Checkpoint.AspNet 1.13.0

• .NETFramework 4.6.2

  • Checkpoint.Core (>= 1.13.0)

1.13.0: security fix for unverified identity headers, signed per-org status lists verified in the engine, fail-closed credential outages, re-stamped OpenAI signing key and a working Instruct fallback link

Security fix (#6258): an unverified request header could change how a request
was classified and named, and so get it past tenant policy. When the engine had
not flagged an agent, both adapters relabelled the request as a named AI agent
from client-supplied headers that nothing verified (a vendor client header, or
a Signature-Agent whose signature did not verify). Composed Cedar
(principal.category, principal.name) and the dashboard deny list read the
relabelled result, so a request could pass a rule written against bots,
incomplete-data visitors, a named agent or a deny-listed agent. Rules that
require a verified delegation or granted scopes were not affected. The engine's
classification now stands. Affects Checkpoint.AspNetCore and Checkpoint.AspNet
0.2.0 through 1.12.0; the composed-policy bypass affects 1.2.0 through 1.12.0.
SupplementaryDetector.Apply remains only as an [Obsolete(error: true)] stub
that returns the engine's result unchanged: an app still on an older adapter is
fixed by updating Checkpoint.Core alone, and source that calls it no longer
compiles. SignatureVerificationHelper no longer turns an unverified signature
verifier answer into an AI agent; a custom ISignatureVerifier must return
Verified = true to change the result.

Signed per-org status lists (#5887, #5894, #6051): the embedded engine now
verifies every status list against its issuer's DID document (signature,
assertion key, list URL and validity window) before any bit is used, and there
is no unsigned path. A credential's status is read only from its issuing org's
own list, https://<host>/orgs/<slug>/status-lists/<listId>, and a
list counts only for credentials of the issuer that signed it. The retired
platform-wide and per-org delegation lists are not signed per issuer and never
verify, so a credential that points at one is not admitted. Status lists are
refetched every 30 seconds and never used more than 60 seconds after they were
fetched (it was 300), nor after the engine's trust window for them ends. A
status index past the end of an org list (131072 entries) is treated as
revoked. PreWarmStatusListUrls takes org list URLs. WebMCP read-only requires a
did:web org issuer (did:web:<host>:orgs:<slug>) and reads each credential's
list from the issuer document's origin.

Fail closed on credential outages (#5652): a request presenting a KYA
credential that fails verification returns 503 with Retry-After: 3 even when
FailOpen is enabled. Trusted roots are resolved for KYA signatures,
delegation-proof headers (including KYA-OS-Delegation-Credential) and
structurally recognized VC-JWTs; opaque and unrelated bearer tokens do not
trigger root lookup. Credential claims still require engine verification,
including issuer, project, holder, expiry and revocation. Cedar evaluation
errors on enforcing projects fail closed; shadow mode keeps the structured
decision.

Instruct fallback link (#6103): with no policy redirect URL, the Instruct and
Challenge responses linked to {BaseUrl}/api/v1/bouncer/authorize, which needs
agent_did and requested_scopes, so every agent that followed it got a 400.
McpInstructBuilder.BuildAuthUrl now falls back to the project's connect page,
{BaseUrl}/connect/{ProjectId}?agent=<agent name, lowercased>, the page the
dashboard and the DNS gateway send. A policy redirect URL still wins. The
project id is percent-encoded as one path segment; an unnamed agent gets
agent=unknown. The hostname argument is no longer used.

Embedded engines (#6260): the compiled OpenAI signing key seed is re-stamped
from the live directory (it now expires 2026-10-26) and the lean and Cedar
engines are rebuilt from the same source. Nothing else changes.

No behavior change (#6062): PolicyEvaluator takes an optional lock-wait timeout
on its internal constructor, for tests on loaded machines.

Already shipped in 1.12.0, listed because they merged after its version commit:
#5926, #5949, #5974, #5983 and #5987.

This is a minor version, with these public API changes: SupplementaryDetector
is obsolete-as-error (no adapter in this release calls it);
SignedStatusListVerifier and StatusList2021 are removed, since the engine now
verifies status lists; WebMcpReadOnlyOptions.StatusListUrl is removed; and
StatusIssuerDocuments is added. Code that used the removed members no longer
compiles. Update all four packages together; a 1.12.0 or 1.11.9 adapter keeps
working on this Core.
Target frameworks and third-party dependency versions are unchanged from 1.12.0.

Release history: https://github.com/Know-That-Ai/checkpoint/blob/main/packages/checkpoint-dotnet/CHANGELOG.md