joule-moq: grant_proof (the WRP1 record, check_proof, the SETUP options and helpers,
grant_digest_and_principal, base64url) and a strict Ed25519 check shared with the
receipts. The relay sends its SETUP first with a fresh GRANT_CHALLENGE, checks every
grant its rules mark proof against the client's GRANT_PROOF before serving any
request, and closes a session that presents one without a proof that passes with
UNAUTHORIZED; the transports give it the target the client addressed. Its test client
presents grants with proofs; tests/grant_proof.rs. The web client presents its grant
with a proof signed in wasm, the per-participant secret gone.
Not yet built or run.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
75a4e7e3f2