# WIMSE Execution Context Tokens — Reference Implementations

This directory contains **reference implementations** of [Execution Context Tokens (ECTs)](../draft-nennemann-wimse-execution-context-00.txt) for the WIMSE (Workload Identity in Multi System Environments) draft. Each refimpl provides ECT creation, verification, DAG validation, and an in-memory audit ledger.

## Implementations

| Language | Path      | Description |
|----------|-----------|-------------|
| **Go**   | [go-lang/](go-lang/) | Production-ready Go library and demo. Config via env; optional JTI replay cache. |
| **Python** | [python/](python/) | Python 3.9+ library and demo. Same API surface and env-based config. |

## Scope (all refimpls)

- **ECT format**: JWT (JWS Compact Serialization) with required/optional claims per the spec (Section 4).
- **Creation**: Build and sign ECTs with ES256; `kid` and `typ: wimse-exec+jwt` in the JOSE header.
- **Verification**: Full Section 7 procedure (parse, typ/alg, key resolution, signature, claims, optional DAG).
- **DAG validation**: Section 6 (uniqueness, parent existence, temporal ordering, acyclicity, parent policy).
- **Ledger**: Interface plus in-memory append-only store (Section 9).

No WIT/WPT issuance or full WIMSE stack; refimpls use key resolution only. Suitable for conformance testing and as a template for production integrations.

### Replay cache (multi-instance)

The optional JTI replay cache (`JTICache` / `JtiCache`) is **in-memory only**. For multiple verifier instances behind a load balancer, replay detection must be shared. Use a distributed store (e.g. Redis, database) and implement the same contract as `JTISeen`: a function that returns true if the JTI was already seen, and ensure each verified JTI is recorded (e.g. with TTL). See go-lang/README and python/README for configuration and how to plug in a custom `JTISeen` / `jti_seen`.

## Quick start

**Go**

```bash
cd refimpl/go-lang && go run ./cmd/demo
go test ./...
```

**Python**

```bash
cd refimpl/python && pip install -e . && python3 demo.py
python3 -m pytest tests/ -v
```

## Specification

- **Draft**: `draft-nennemann-wimse-execution-context-00`
- **Sections**: 4 (format), 5 (HTTP header), 6 (DAG), 7 (verification), 9 (ledger interface).

## License

Same as the Internet-Draft (IETF Trust). Code components under Revised BSD per BCP 78/79.