Server verification
Keep capability verification, key-possession authentication, and privileged authority separate.
For current possession, delegation, owner/self-root policy, revocation and replay use SDK 0.7.2's IdentityVerifier. The older facade and AEGIS contracts below remain distinct.
ACT verification answers whether a capability envelope is valid for the configured issuer, audience, time and scope. Challenge-response answers whether the caller possesses the key used for a proof. Authority verification answers whether an operation is authorized through a trusted lineage/anchor path.
The SDK 0.7.2 verification facade exposes VerificationClient and PrivilegedAuthorityVerifier. PrivilegedAuthorityVerificationClient composes configured request and authority verification. Configure the correct provider; passing a DID or a claimed ancestor is not enough.
AEGIS exposes VerificationPipeline and store/cache interfaces. Select the resolver, revocation/liveness behavior and trust policy needed by your deployment. Cache lifetime and invalidation matter when authority changes.
A middleware name does not prove this entire sequence runs. Verify the actual call path from the protected route to the configured authority verifier, including failure propagation. See AEGIS verification and conformance.