Feat/implement scitt verification

[jhateley-godaddy]

This pull request introduces support for SCITT-based verification to the ANS Agent Client SDK and its integration examples, updating documentation, examples, and dependencies to reflect the new approach. The changes provide a high-level, recommended verification flow using SCITT, while retaining and clarifying the existing manual DANE/Badge flow. The documentation and code now clearly distinguish between the two verification patterns, and new dependencies are added to support caching and SCITT artifact handling.

SCITT Verification Support and Example Integration:

• Added a new high-level example and helper method for SCITT verification using AnsVerifiedClient in A2aClientExample.java, including detailed step-by-step output and integration pattern documentation. [1] [2] [3] [4] [5]
• Updated the A2A client example README to describe both manual (DANE/Badge) and SCITT verification approaches, with usage instructions, code samples, and a comprehensive verification policy table. [1] [2] [3] [4]

Verification Policy and Documentation Updates:

• Revised all documentation references to verification policies, deprecating FULL in favor of SCITT_REQUIRED and SCITT_ENHANCED, and clarified the recommended use cases for each policy. [1] [2] [3] [4]

Dependency and Build Configuration:

• Added the Caffeine caching library and CBOR test dependency to build.gradle.kts to support SCITT artifact handling and improve test coverage. [1] [2] [3]
• Updated example project dependencies to include the local ans-sdk-agent-client module.

CI and Workflow Maintenance:

• Updated GitHub Actions workflow to use newer versions of gradle/actions/wrapper-validation and actions/cache for better reliability and security. (.github/workflows/ci.yml)

These changes modernize the verification flow, making SCITT the recommended approach for production environments, and provide clear guidance and examples for developers integrating with the ANS Agent Client SDK.

[Copilot]

Pull request overview

Adds SCITT-based verification to the ANS Agent Client SDK and transparency module, updating policies and examples to make SCITT the recommended verification flow while retaining DANE/Badge support.

Changes:

• Introduces SCITT domain model + helpers (headers, parsing/expectations, caching decisions) and expands TransparencyClient with SCITT-oriented APIs and trusted-domain validation.
• Extends agent-client verification pipeline to support SCITT (new policy presets, pre/post verification integration, server-side request verification types).
• Updates examples/docs/dependencies and CI workflow to reflect SCITT flows and newer tooling.

Reviewed changes

Copilot reviewed 97 out of 106 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
ans-sdk-transparency/src/test/java/com/godaddy/ans/sdk/transparency/scitt/ScittPreVerifyResultTest.java	Adds tests for SCITT pre-verify result factories/accessors
ans-sdk-transparency/src/test/java/com/godaddy/ans/sdk/transparency/scitt/ScittFetchExceptionTest.java	Adds tests for SCITT fetch exception behavior
ans-sdk-transparency/src/test/java/com/godaddy/ans/sdk/transparency/scitt/ScittExpectationTest.java	Adds tests covering expectation statuses, helpers, defensive copies
ans-sdk-transparency/src/test/java/com/godaddy/ans/sdk/transparency/scitt/RefreshDecisionTest.java	Adds tests for refresh decision factories
ans-sdk-transparency/src/test/java/com/godaddy/ans/sdk/transparency/scitt/MetadataHashVerifierTest.java	Adds tests for hash validation, computation, and verification
ans-sdk-transparency/src/main/java/com/godaddy/ans/sdk/transparency/scitt/package-info.java	Documents SCITT verification package and flow
ans-sdk-transparency/src/main/java/com/godaddy/ans/sdk/transparency/scitt/TrustedDomainRegistry.java	Adds trusted-domain allowlist for TL key fetching
ans-sdk-transparency/src/main/java/com/godaddy/ans/sdk/transparency/scitt/ScittVerifier.java	Introduces SCITT verifier interface + post-verification result record
ans-sdk-transparency/src/main/java/com/godaddy/ans/sdk/transparency/scitt/ScittPreVerifyResult.java	Adds SCITT pre-verification result record + factories
ans-sdk-transparency/src/main/java/com/godaddy/ans/sdk/transparency/scitt/ScittParseException.java	Adds checked exception for SCITT artifact parsing failures
ans-sdk-transparency/src/main/java/com/godaddy/ans/sdk/transparency/scitt/ScittHeaders.java	Defines SCITT-related HTTP header constants
ans-sdk-transparency/src/main/java/com/godaddy/ans/sdk/transparency/scitt/ScittHeaderProvider.java	Adds abstraction for outgoing/incoming SCITT headers + parsed artifacts
ans-sdk-transparency/src/main/java/com/godaddy/ans/sdk/transparency/scitt/ScittFetchException.java	Adds runtime exception for SCITT fetch failures
ans-sdk-transparency/src/main/java/com/godaddy/ans/sdk/transparency/scitt/ScittExpectation.java	Introduces expectation/status model for SCITT verification outcomes
ans-sdk-transparency/src/main/java/com/godaddy/ans/sdk/transparency/scitt/RefreshDecision.java	Introduces result type for root-key refresh decisioning
ans-sdk-transparency/src/main/java/com/godaddy/ans/sdk/transparency/scitt/MetadataHashVerifier.java	Implements metadata integrity verification from token-provided hashes
ans-sdk-transparency/src/main/java/com/godaddy/ans/sdk/transparency/scitt/DefaultScittHeaderProvider.java	Implements Base64 header encode/decode and artifact parsing
ans-sdk-transparency/src/main/java/com/godaddy/ans/sdk/transparency/scitt/CwtClaims.java	Adds CWT claim record + Instant helpers
ans-sdk-transparency/src/main/java/com/godaddy/ans/sdk/transparency/scitt/CoseProtectedHeader.java	Adds COSE protected header record + hex keyId utilities
ans-sdk-transparency/src/main/java/com/godaddy/ans/sdk/transparency/TransparencyClient.java	Expands client for SCITT operations (receipt/token/root keys) + trusted-domain validation
ans-sdk-transparency/build.gradle.kts	Adds CBOR/Caffeine/BouncyCastle dependencies for SCITT
ans-sdk-crypto/src/main/java/com/godaddy/ans/sdk/crypto/CertificateUtils.java	Reuses CryptoCache for SHA-256 fingerprint + exposes normalization
ans-sdk-core/src/test/java/com/godaddy/ans/sdk/concurrent/AnsExecutorsTest.java	Adds tests for scheduled executors and queue capacity
ans-sdk-core/src/main/java/com/godaddy/ans/sdk/crypto/CryptoCache.java	Adds thread-local caching for digests/signature verification
ans-sdk-core/src/main/java/com/godaddy/ans/sdk/concurrent/AnsExecutors.java	Adds bounded IO executor + scheduled executor helpers
ans-sdk-agent-client/src/test/java/com/godaddy/ans/sdk/agent/verification/VerificationResultTest.java	Updates enum tests for new SCITT verification type
ans-sdk-agent-client/src/test/java/com/godaddy/ans/sdk/agent/verification/PreVerificationResultTest.java	Extends tests to cover SCITT fields and behavior
ans-sdk-agent-client/src/test/java/com/godaddy/ans/sdk/agent/verification/DnssecValidationModeTest.java	Adds tests for DNSSEC validation mode enum behavior
ans-sdk-agent-client/src/test/java/com/godaddy/ans/sdk/agent/verification/DnsResolverConfigTest.java	Adds tests for DNS resolver presets
ans-sdk-agent-client/src/test/java/com/godaddy/ans/sdk/agent/verification/DefaultResolverFactoryTest.java	Adds tests for resolver factory behavior
ans-sdk-agent-client/src/test/java/com/godaddy/ans/sdk/agent/verification/DefaultConnectionVerifierTest.java	Extends verifier tests to cover SCITT flows and policy combining
ans-sdk-agent-client/src/test/java/com/godaddy/ans/sdk/agent/verification/DefaultCertificateFetcherTest.java	Adds tests for certificate fetcher singleton + behavior
ans-sdk-agent-client/src/test/java/com/godaddy/ans/sdk/agent/verification/DanePolicyTest.java	Adds tests for DANE policy behavior
ans-sdk-agent-client/src/test/java/com/godaddy/ans/sdk/agent/http/NoOpConnectionVerifierTest.java	Updates tests after policy preset rename/removal
ans-sdk-agent-client/src/test/java/com/godaddy/ans/sdk/agent/http/DefaultAgentHttpClientFactoryTest.java	Updates tests to use DANE_AND_BADGE instead of removed FULL
ans-sdk-agent-client/src/test/java/com/godaddy/ans/sdk/agent/exception/ScittVerificationExceptionTest.java	Adds tests for SCITT verification exception mapping
ans-sdk-agent-client/src/test/java/com/godaddy/ans/sdk/agent/exception/ClientConfigurationExceptionTest.java	Adds tests for client configuration exception
ans-sdk-agent-client/src/test/java/com/godaddy/ans/sdk/agent/VerificationPolicyTest.java	Updates policy preset tests for SCITT presets and removal of FULL
ans-sdk-agent-client/src/test/java/com/godaddy/ans/sdk/agent/ConnectOptionsTest.java	Updates tests for preset policy changes
ans-sdk-agent-client/src/test/java/com/godaddy/ans/sdk/agent/AnsConnectionTest.java	Adds tests for new AnsConnection post-verification behaviors
ans-sdk-agent-client/src/main/java/com/godaddy/ans/sdk/agent/verification/VerificationResult.java	Adds SCITT verification type
ans-sdk-agent-client/src/main/java/com/godaddy/ans/sdk/agent/verification/TlsaUtils.java	Uses CryptoCache for SHA-256/SHA-512 matching types
ans-sdk-agent-client/src/main/java/com/godaddy/ans/sdk/agent/verification/PreVerificationResult.java	Adds SCITT pre-verify result storage + helper methods
ans-sdk-agent-client/src/main/java/com/godaddy/ans/sdk/agent/verification/ConnectionVerifier.java	Adds scittPreVerify() with default not-present behavior; updates combine signature
ans-sdk-agent-client/src/main/java/com/godaddy/ans/sdk/agent/verification/ClientRequestVerifier.java	Adds server-side API for validating incoming client requests
ans-sdk-agent-client/src/main/java/com/godaddy/ans/sdk/agent/verification/ClientRequestVerificationResult.java	Adds structured result type for client request verification
ans-sdk-agent-client/src/main/java/com/godaddy/ans/sdk/agent/http/NoOpConnectionVerifier.java	Implements SCITT pre-verify no-op default
ans-sdk-agent-client/src/main/java/com/godaddy/ans/sdk/agent/exception/ScittVerificationException.java	Adds typed exception for SCITT verification failures
ans-sdk-agent-client/src/main/java/com/godaddy/ans/sdk/agent/exception/ClientConfigurationException.java	Adds exception for verified-client initialization/config failures
ans-sdk-agent-client/src/main/java/com/godaddy/ans/sdk/agent/VerificationPolicy.java	Adds SCITT policy dimension + new presets SCITT_REQUIRED/ENHANCED
ans-sdk-agent-client/src/main/java/com/godaddy/ans/sdk/agent/AnsConnection.java	Adds connection handle for post-verification using captured TLS cert
ans-sdk-agent-client/examples/mcp-server-spring/src/main/resources/application.yml	Adds config for Spring MCP server example (SCITT, mTLS, policies)
ans-sdk-agent-client/examples/mcp-server-spring/src/main/java/com/godaddy/ans/examples/mcp/spring/health/ScittHealthIndicator.java	Adds actuator health indicator for SCITT artifacts
ans-sdk-agent-client/examples/mcp-server-spring/src/main/java/com/godaddy/ans/examples/mcp/spring/filter/ScittHeaderResponseFilter.java	Adds servlet filter that injects SCITT headers on responses
ans-sdk-agent-client/examples/mcp-server-spring/src/main/java/com/godaddy/ans/examples/mcp/spring/filter/ClientVerificationFilter.java	Adds request filter to verify clients via SCITT+mTLS
ans-sdk-agent-client/examples/mcp-server-spring/src/main/java/com/godaddy/ans/examples/mcp/spring/controller/McpController.java	Adds MCP endpoint controller wiring MCP servlet transport
ans-sdk-agent-client/examples/mcp-server-spring/src/main/java/com/godaddy/ans/examples/mcp/spring/config/ScittLifecycle.java	Starts/stops background SCITT refresh lifecycle
ans-sdk-agent-client/examples/mcp-server-spring/src/main/java/com/godaddy/ans/examples/mcp/spring/config/ScittConfig.java	Configures TransparencyClient, ScittArtifactManager, request verifier beans
ans-sdk-agent-client/examples/mcp-server-spring/src/main/java/com/godaddy/ans/examples/mcp/spring/config/McpServerProperties.java	Adds typed config properties with policy parsing
ans-sdk-agent-client/examples/mcp-server-spring/src/main/java/com/godaddy/ans/examples/mcp/spring/McpServerSpringApplication.java	Adds Spring Boot app entrypoint + BouncyCastle registration
ans-sdk-agent-client/examples/mcp-server-spring/build.gradle.kts	Adds Gradle config for Spring MCP server example
ans-sdk-agent-client/examples/mcp-server-spring/README.md	Documents Spring MCP server example, flows, configuration
ans-sdk-agent-client/examples/mcp-client/build.gradle.kts	Updates MCP SDK dependency version
ans-sdk-agent-client/examples/mcp-client/README.md	Updates client example docs to use AnsVerifiedClient + SCITT policies
ans-sdk-agent-client/examples/http-api/src/main/java/com/godaddy/ans/examples/httpapi/HttpApiExample.java	Adds SCITT verification example via AnsVerifiedClient
ans-sdk-agent-client/examples/http-api/README.md	Updates docs to include SCITT example and policy guidance
ans-sdk-agent-client/examples/a2a-client/src/main/java/com/godaddy/ans/examples/a2a/A2aClientExample.java	Adds AnsVerifiedClient-based SCITT example alongside manual flow
ans-sdk-agent-client/examples/a2a-client/README.md	Documents both manual and SCITT verification patterns
ans-sdk-agent-client/examples/README.md	Updates examples overview to include SCITT policies
ans-sdk-agent-client/build.gradle.kts	Adds caffeine + CBOR to support SCITT/caching in agent-client
README.md	Updates docs to replace removed FULL policy with DANE_AND_BADGE
.github/workflows/ci.yml	Updates GitHub Actions wrapper validation and cache actions versions

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.