# byline — know which of your agents wrote what

byline is an AAuth server (draft-hardt-oauth-aauth-protocol, aauth.dev) whose
root identity is the tailnet user: agents get their own cryptographic identity
(ES256 keypair, aa-agent+jwt with cnf.jwk, RFC 9421 signed requests), and every
delegation traces back to the human who spawned the agent. Deploys to the mf
Workers platform go through an AAuth-protected wrangler-compatible /client/v4
proxy, so each deployed worker carries a byline: agent → person.

## Discovery
- https://byline.proc.io/.well-known/aauth-person.json   (person server: token_endpoint, jwks)
- https://byline.proc.io/.well-known/aauth-agent.json    (agent token issuer)
- https://byline.proc.io/.well-known/aauth-resource.json (the deploy resource)

## Agent lifecycle
1. A signed-in person calls POST /api/agents {name} → {agent_id, bootstrap_token} (one-time, 15 min).
2. The agent generates its own P-256 keypair and calls POST /api/agents/redeem
   {bootstrap_token, jwk} → aa-agent+jwt bound to that key. A 'deploy' grant
   from the spawning person exists from step 1.
3. To deploy: signed GET /client/v4/user → 401 AAuth-Requirement with a
   resource token → signed POST /token {resource_token} → auth token →
   signed request with Authorization: AAuth <auth_token> → AAuth-Access
   opaque token → use it as CLOUDFLARE_API_TOKEN with
   CLOUDFLARE_API_BASE_URL=https://byline.proc.io/client/v4 and plain wrangler.

## Auth
On the mf platform the tailnet is the root identity (env.TAILNET). On
Cloudflare, sign in with passkeys via AuthGravity (authgravity.org).

## Attribution
GET /api/deploys lists every deploy with its agent and root person.

Built by Infinite Logic PBC (infinitelogic.org).