Capabilities

TrustPlane Auth secures machine-to-machine calls through a set of capabilities that work together: issuing proof-bound passports, binding them to exact requests, blocking replays, enforcing per-route policy, and recording every decision. Each capability maps to real code, a real CLI command, or a real make target — nothing here is aspirational.

The capability map

flowchart TB
  subgraph Issue["Issue & prove"]
    C1["Passport issue/verify"]
    C2["Request binding (transcript-v1)"]
  end
  subgraph Enforce["Enforce"]
    C3["Replay protection"]
    C4["Bundle policy & freshness"]
    C5["Signed bundle lifecycle"]
    C6["Trust anchors & allowed_sources"]
  end
  subgraph Deploy["Deploy & operate"]
    C7["Brownfield adapter"]
    C8["Broker & attested_workload"]
    C9["Audit events"]
  end
  C1 --> C2 --> C3
  C4 --> C5
  C6 --> C7

What each capability does

#	Capability	One-liner	Page
1	Passport issue/verify	Mint and locally verify a short-lived proof-bound artifact	→
2	Request binding	Bind a passport to this exact request with transcript-v1	→
3	Replay protection	Consume each jti once, atomically (memory or Redis)	→
4	Bundle policy & freshness	Per-route rules + fail-closed staleness from a local bundle	→
5	Signed bundle lifecycle	Sign, verify, refresh, and remove trust/policy material safely	→
6	Trust anchors & allowed_sources	Authorize many issuers/clients per route; add clients with no redeploy	→
7	Brownfield adapter	Reverse-proxy verifier in front of an unmodified API	→
8	Attested workloads	Local broker issuer; optional SPIFFE/SPIRE-attested identity	→
9	Audit events	Stable JSON record of every allow/deny decision	→

Try each capability

Every capability has a runnable proof. The full table with reason codes lives in the capability map; here is the short version:

Capability	Try it with
Passport issue/verify	trustplane issue + trustplane verify; make demo
Request binding	make demo-provider-gateway; trustplane sign --curl
Replay protection	make demo-provider-gateway (duplicate → jti_replay)
Bundle policy & freshness	trustplane bundle build; make demo-provider-gateway
Signed bundle lifecycle	trustplane bundle sign; trustplane bundle verify; trustplane bundle remove-source
Trust anchors & merge	trustplane bundle merge-source; multi-anchor fixture
Brownfield adapter	make demo-adapter (valid / 401 / 403)
Broker & attested_workload	trustplane broker issue; trustplane up; SPIRE M2M verification flow
Audit events	emitted by broker/verifier/adapter decisions

A note on scope

These capabilities are the v0.1 boundary — a local product-readiness contract, gated by make v01-acceptance. Deployment of the adapter is covered separately under the deployment guide, and uses these same capabilities unchanged. See versioning for exactly what is in and out of scope.

Next steps

• Start with Passports — the artifact everything else builds on.
• See the capability map for the full capability-to-example table.