id.openagent:openagent-sdk is the Kotlin/JVM SDK — verify-first like the
other languages.
Private preview. The artifact is not yet on Maven Central; the
repository is private during consolidation.
Verify an ACT
Verification follows the normative procedure of act/SPECIFICATION.md in
order: envelope decode with a scoped CBOR decoder owned by the package (no
codec dependency), version/algorithm checks, Ed25519 signature
verification (JDK EdDSA, X.509-wrapped raw keys) before any claim check,
temporal checks with leeway, and issuer/audience/scope policy with the
non-widening rule.
Guard Ktor routes
A missing, forged, expired, wrong-audience, or under-scoped token gets a
401 with the reason (WWW-Authenticate: OpenAgent); the route never runs.
Verified claims land in call.attributes[ActClaimsKey].
Key custody
Everything derives deterministically from one 32-byte seed (Ed25519
signing keypair + X25519 encryption keypair, public derivation via
BouncyCastle — the JDK exposes it only through internal APIs). Kotlin
custody uses SHA-256 keyed derivation (documented); the canonical
cross-SDK derivation is BLAKE3.
In the box
13 tests, including the 13 canonical ACT vectors via VectorTest on every
./gradlew test run — the same vectors the other five languages run.
Next