Skip to main content

​
Before first production request

  • /.well-known/fau-agent serves HTTPS JSON; domain matches host; no redirect
  • Ed25519 keypair; stable kid; private key in a secret store
  • RFC 9421 covers @method, @target-uri, @authority, content-digest
  • Unique nonces; NTP-synced clocks; lifetime ≤ 300 s
  • Resolve via https://relay.fau.run/v1/resolve
  • Live path: unsigned GET /.well-known/fau-node, signed POST /mcp
  • MCP: Accept: application/json, text/event-stream; initialize before tools
  • Offline path: sealed queue (know v1 replies may not be decryptable)
  • UI shows match codes + verified domain on approval_required
  • Retry rules: structured/ask without approval_id; excerpt/send with it
  • Backoff on HTTP 429 and tool rate_limited
  • No code path requests Gmail passwords or OAuth inbox tokens

​
Product copy

  • “Answers from mail on your computer,” not “we connect to Gmail for you.”
  • On denial/block, blame policy/user choice, not a vague platform error.

​
Security review prompts

  • Can a stolen capability token be used from another domain? (Should fail bound_key.)
  • Can tool args widen categories? (Gateway clamps.)
  • Do you log raw excerpts? Prefer not to.