Provenance · Identity · Continuity
Authority is continuity, not possession. Exchange an OAuth token into a PIC execution and watch authority continue — only ever narrowing — through settled checkpoints. Then watch the dropped privilege try to come back, and the state become unrepresentable. The checks below are evaluated from the displayed structures and Profile 0.2 validation rules; byte strings and signatures are illustrative.
Data structures follow PIC Profile 0.2 (the Designing PIC-X series). A PIC Token JWT
(pic+jwt) is the external envelope: pic.root carries the exact
PIC Continuity COSE bytes. A Continuity carries root.pca — the exact signed
PIC PCA COSE bytes of the current trusted checkpoint — with
root.pca_hash = SHA-256 over those exact bytes, and transitions: null
when settled, exactly one workload-signed PIC Continuity Transition COSE in a candidate.
A PCA carries position, the canonical Indexed Authority Map (section-local indexes,
re-materialized at every checkpoint), and challenge.next_challenge. A Transition binds exactly one
predecessor by hash, answers its challenge, attenuates invariants by remove_bitmap (LSB-first —
invariants can only be removed, never added; execution-contract entries can only add restrictions, AND-combined),
and carries proof_of_relationship with
type = "sd-jwt" and the exact UTF-8 bytes of an issuer-signed SD-JWT presentation as evidence.
The workload key accepted from the PoR signs the Transition, the candidate Continuity, and the candidate PIC Token JWT.
Advancement is centralized: RFC 8693 Token Exchange at the realm token endpoint. CBOR/COSE artifacts are shown as readable diagnostic views; every byte string, hash, challenge, and signature below is illustrative.