Source-bound HTTP request signing and verification for draft-ietf-webbotauth-httpsig-protocol-00.

verify/3 validates every web-bot-auth signature independently. It requires created/expires, a SHA-256 JWK thumbprint key ID, authority or target URI coverage, and a matching dictionary Signature-Agent member when present. Legacy strings reject. Caller trust resolves the (URL, key) pair before agent attribution. Nested signature coverage includes the inner input and every inner component. One replay claim follows validation of the entire envelope.

Options are :representation, :digest_state (generic digest contracts), and :timeout (1..300,000 ms, default 5,000, one discovery/trust deadline). Unresolved associations return :agent_unresolved with a bounded detail; they never imply invalid cryptography or populate a URL principal. Policy explicitly permits held keys when desired. No network or store is started.

sign/4 accepts label, agent (location, type), public key, algorithm, created, expires, and nonce (string or nil); optional components adds identifiers to authority and the matching agent member. The key supplies its thumbprint; private material remains behind the arity-two signer. Lifetimes are positive and at most 86,400 seconds. The only option is :field_schemas. Signing adds a dictionary member without replacing other agent members. Authorization always remains unevaluated. See RequestSeal.Error for reasons.