did - XibalbaTechSol/integrity-core GitHub Wiki

title: Decentralized Identifier (DID) acronyms: [DID] created: 2026-07-07 updated: 2026-09-15 type: concept tags: [identity, cryptography] confidence: high source_files:

• docs/INTERFACE_CONTRACT.md
• integrity-cli/integrity_cli/identity.py

• Overview

An agent's on-protocol identity: a real Ed25519 keypair (no HMAC pseudo-signature fallback — the old prototype had one, explicitly documented as fake, and it was removed in this rewrite) expressed as a did:key-style document:

{
  "id": "did:integrity:<hex-pubkey-fingerprint>",
  "controller": "did:integrity:<hex-pubkey-fingerprint>",
  "created": "<ISO8601>",
  "verificationMethod": [{
    "id": "did:integrity:<fingerprint>#key-1",
    "type": "Ed25519VerificationKey2020",
    "publicKeyMultibase": "<base58btc/multicodec-encoded pubkey>"
  }]
}

Fingerprint (load-bearing). The <fingerprint> is the full sha256(pubkey) (64 hex chars) — not the raw key and not a truncation. This is consistent across integrity-sdk and integrity-cli, and it's why a BCC commitment must carry the public key separately (a hash can't be reversed to the key): the verifier binds the carried key by re-checking sha256(pubkey) == fingerprint.

EVM binding. An agent also holds a separate secp256k1 EVM wallet (used to deploy its own contracts). The SDK/CLI bind it to the DID by adding a CAIP-10 blockchainAccountId verification method (eip155:<chainId>:<0xADDRESS>, type EcdsaSecp256k1RecoveryMethod2020), so resolving the DID yields the agent's on-chain address.

Implemented for real in integrity-cli (identity.py — hand-rolled base58, verified against the reference base58 package) and integrity-sdk (did.py).

See Interface Contract §4.1.