id.openagent:openagent-sdk is the Kotlin/JVM SDK — verify-first like the other languages.
Private preview. The artifact is not yet on Maven Central; the repository is private during consolidation.

Verify an ACT

Verification follows the normative procedure of act/SPECIFICATION.md in order: envelope decode with a scoped CBOR decoder owned by the package (no codec dependency), version/algorithm checks, Ed25519 signature verification (JDK EdDSA, X.509-wrapped raw keys) before any claim check, temporal checks with leeway, and issuer/audience/scope policy with the non-widening rule.

Guard Ktor routes

A missing, forged, expired, wrong-audience, or under-scoped token gets a 401 with the reason (WWW-Authenticate: OpenAgent); the route never runs. Verified claims land in call.attributes[ActClaimsKey].

Key custody

Everything derives deterministically from one 32-byte seed (Ed25519 signing keypair + X25519 encryption keypair, public derivation via BouncyCastle — the JDK exposes it only through internal APIs). Kotlin custody uses SHA-256 keyed derivation (documented); the canonical cross-SDK derivation is BLAKE3.

In the box

Conformance

13 tests, including the 13 canonical ACT vectors via VectorTest on every ./gradlew test run — the same vectors the other five languages run.

Next