Module consent 

The consent seam.

plan/oauth.md’s hard part: OAuth’s authorize step assumes a human at a browser, and an agent has none. What stands in for the person is the agent’s own daemon: POST /oauth/par mints a decision record and a one-time ConsentReference for it, the daemon reads the decision through bot.did.listPendingAuthorizations and answers it with bot.did.approveAuthorization, carrying that reference under Credential::AccountSelf. The DID doing the approving is therefore the one the presented agent token authenticates as, never a value in the body.

What this module builds is everything behind that route: ConsentReference minting, ConsentStore, and confirm — the function the route reaches, doing two checks:

1. the reference is live and unused, and
2. the account named in the request is the authenticated agent.

Policy is not one of them. The sign-in was judged once, at PAR (crate::oauth::par), and the answer is in the record: a record whose verdict is a denial carries no reference, so there is nothing here to confirm. Evaluating again at this point could only contradict a record that already told the agent allow.

The invariant

Approval happens because the named agent confirmed, never because there was nobody to say no. confirm takes the authenticated DID as an explicit argument rather than trusting anything in the request body, so a caller cannot self-attest its own identity.

Structs

ConsentReference

A one-time reference minted when authorize is ready for confirmation.

MemoryConsentStore

The in-process consent store.

PendingConsent

What a pending consent decision is about.

Enums

ConsentError

Why confirm refused.

Constants

CONSENT_TTL

How long a minted consent reference stays live before it must be reissued.

REFERENCE_BYTES 🔒

Random bytes a reference is drawn from.

Traits

ConsentStore

Where pending consent decisions live between authorize minting a reference and a stamped call confirming it.

Functions

begin

Mints a pending consent, for authorize to hand back as the reference the agent’s confirming tool call must carry.

confirm

This is the seam. A future PreToolUse-stamped tool call reaches this function (through whatever HTTP or in-process boundary the harness that drives it uses — not decided here) with reference from the tool call’s arguments and stamped_did from the rewrite, not from the caller.