Crate didbot_claim_check 

The consistency checks a bot.did.operator claim rests on, and the record it writes.

didbot-claim runs these on the operator’s own machine over a real network; the policy page runs the same ones in a browser, over fetch. Both call this crate rather than each writing the record their own way, so a claim written from a page and a claim written from the command line are the same record, field for field and key for key.

What these checks rest on

The root of trust is the hostname itself: the operator delegated that zone, the server proved control of it by passing ACME DNS-01, and the certificate that produced is what TLS proves belongs to whoever answers the connection. Resolving the did:web document (document) and cross-checking describeServer (agree) are consistency tests layered on top of that connection, not a second proof — a reader who takes the DID match as the security boundary has it backwards.

What is not here

The waiting and the probing are didbot-claim’s: whether TLS answers at all, how long to wait for a certificate, and what the operator’s own machine can reason about zone delegation. A browser is handed a connection the fetch already made and never sees the certificate behind it, so a caller in one shows what it checked and says what it did not.

Re-exports

pub use agree::describes_same_server;

pub use agree::DescribeMismatch;

pub use document::did_json_url;

pub use document::parse_document;

pub use document::signing_key;

pub use document::SigningKeyError;

pub use record::credential_record;

pub use record::key_fingerprint;

pub use record::operator_record;

pub use record::record_key;

pub use record::Allowance;

pub use record::Credential;

pub use record::OperatorClaim;

pub use record::Scope;

pub use record::COLLECTION;

pub use record::CREDENTIAL_COLLECTION;

pub use record::OIDC_IDENTITY_TYPE;

pub use record::PUBLIC_KEY_TYPE;

Modules

agree

Cross-checking com.atproto.server.describeServer against the DID document.

document

Reading the server’s own did:web document: the parse, the id check, and the signing key it publishes.

record

The bot.did.operator record a claim writes, the key it is written at, and the claim a reader parses it back into.