# description
Cryptographic proof binding an MCP tool request/response pair to an agent's identity and session context.

# properties.jws.description
Compact JWS (header.payload.signature) signed with Ed25519. The payload contains canonicalized proof metadata.

# $defs.ProofMeta.properties.kid.description
Key identifier for the signing key (matches JWS header kid).

# $defs.ProofMeta.properties.ts.description
Unix timestamp in seconds when the proof was generated.

# $defs.ProofMeta.properties.nonce.description
Session nonce from the handshake, binding proof to session.

# $defs.ProofMeta.properties.sessionId.description
Session identifier from handshake response.

# $defs.ProofMeta.properties.requestHash.description
SHA-256 hash of JCS-canonicalized request. Format: 'sha256:<64 hex chars>'.

# $defs.ProofMeta.properties.responseHash.description
SHA-256 hash of JCS-canonicalized response. Absent on denial / step-up proofs (no response). Format: 'sha256:<64 hex chars>'.

# $defs.ProofMeta.properties.scopeId.description
Optional scope identifier for fine-grained authorization tracking.

# $defs.ProofMeta.properties.delegationRef.description
Optional reference to delegation credential authorizing this action.

# $defs.ProofMeta.properties.clientDid.description
Optional client DID for multi-party scenarios.

# $defs.ProofMeta.properties.outcome.description
Authorization outcome. Present on denial / step-up / needs-authorization proofs; absent (implicitly 'allowed') on success proofs.

# $defs.ProofMeta.properties.reason.description
Human-readable reason accompanying a denied / step-up / needs-authorization outcome.