[KonstantinMirin]

Agents that negotiate and commit deals over HTTP need to know who sent each request and each answer, and keep proof of it. This PR adds iab_agentic_primitives.web_bot_auth, a module that does this with Web Bot Auth, the IETF protocol for signing automated HTTP traffic. CoMP 1.0 already lists Web Bot Auth as an AI authentication method. The module implements the profile proposed for OpenProposal § 2.8 in IABTechLab/OpenProposal#142.

What it does

• Identity is an origin. An agent is https://<host>. Its Ed25519 keys sit in a key directory at the host's well-known path, and every key in the directory signs it, which proves the host holds them. No shared secret: anyone can verify.
• Requests and responses are both signed. A response signature covers the request's signature, so it can't be replayed as the answer to another request. Bodies are covered through Content-Digest.
• Verification follows a fixed order. Each refusal is typed and maps to 400, 403, 429 or 503. Verifiers cache directories, reject replayed nonces, and take their authority from configuration, never Host.
• The module confirms a credential, and the application decides identity. Its job ends at "origin X signed this". Which origins may act is the application's own authorization.
• It plugs into common stacks: an httpx transport that signs each hop for its own URI and verifies each answer, ASGI middleware for FastAPI or Starlette, and a sync runtime.

Design choices

• Built on existing libraries. http-message-signatures, http-sf, joserfc and idna do the cryptography and parsing. The module owns only the profile rules.
• Opt-in and self-contained. Everything sits behind a wba extra, so the core install keeps pydantic as its only dependency. The module uses relative imports only.
• Conformance and interop are included.
  • The package ships conformance vectors and a grader for adapters in any language.
  • A Node harness proves interop with Cloudflare's web-bot-auth 0.2.0 in both directions: 128 checks, including URLs with raw [], | and {}.

One change outside the module

requires-python rises from 3.11 to 3.12 for the whole package. The pydantic models in the conformance tooling need typing.TypedDict semantics that only 3.12 provides. If you'd rather keep 3.11, I can switch those types to typing_extensions.

How to review

• WEB_BOT_AUTH.md is the guide: the profile rules, the module map, and examples for signing, FastAPI and httpx.
• make quality runs ruff, mypy strict, the import contracts and the tests for the module (935 tests, 94% branch coverage). make interop runs the Cloudflare harness.
• openproposal-web-bot-auth shows the module in use: a minimal buyer and seller with a Docker end-to-end setup, running live.

Happy to split this, rename the module, or move the vectors.

Postindustria (IAB Tech Lab member)

Analyzed and generated with the help of Claude, fully reviewed by me.