Checkpoint.AspNet 1.12.0

• .NETFramework 4.6.2

  • Checkpoint.Core (>= 1.12.0)

1.12.0: BREAKING zero-evidence classification and protected-resource metadata issuer, ASP.NET Core result accessors, consent re-challenges, startup settings check and an MCP-I proof replay window fix

Security fix (#5949): the embedded engine skipped the 300-second MCP-I proof
replay window, and the 60-second future-skew bound, whenever the embedded
delegation credential carried exp, so a captured proof verified again for the
credential's whole lifetime. The window now applies to every MCP-I proof, and an
expired credential is still refused as before. A proof outside the window blocks
as Expired and is never re-challenged.

BREAKING (#5886): a request with no evidence either way is now IncompleteData,
not Human. No setting restores Human, including
ScannerMisclassificationHint=Off. Built-in enforcement does not change for these
requests: IsAgent stays false and composed rules still read them as human. What
changes is what is reported: DetectionClass, KYA-Class, KYA-Verification,
VerificationMethod and the class sent to the dashboard. Requalify any code or
report that reads those.

DetectionResult.NoEvidence is true for exactly that verdict. Suspicious-header
requests stay IncompleteData but carry no verification method, so
VerificationMethod is null and KYA-Verification is not sent. The Reasons text
changes. CheckpointApiClient reports these requests to the dashboard as
incomplete_data, where it sent human, with detectionBasis no_evidence, so the
dashboard's human counts for this traffic drop; DetectionEvent adds NoEvidence.
As in 1.11.9, composed rules aimed at all agents match every incomplete_data
visitor; a zero-evidence (no_evidence) visitor stays exempt, like human.
ComposedPolicyCache rewrites policy text at compile, so a deployed rule that
does not compare the category to no_evidence reads that visitor as human; if
the rewritten text fails to compile, the authored text is used with the same
reading and one warning per policy text. A policy nested deeper than 32 levels
is refused. A forged mcp_i_handshake or kyaos_handshake envelope is now
category unknown, not incomplete_data, so a rule that names incomplete_data no
longer matches it. The embedded engine reports 0.2.1. Human still comes from
SDK-built results that do not run the engine (path_skipped, wasm_error,
blocking placeholders) and from PatternAgentDetector. #5886 re-lands #5060,
which was reverted in #5881; neither was published.

BREAKING (#5926): the authorization_servers entry both adapters serve at
/.well-known/oauth-protected-resource is now the org's issuer exactly as the
platform sends it in the project's policy response (authorizationServerIssuer,
read as ComposedPolicyFlags.AuthorizationServerIssuer): the org's own issuer
domain when it has one, else https://kya.vouched.id/, then /oauth/{slug}.
Before, the SDK built {BaseUrl origin}/oauth/gateway/{slug} from
ResourceOrgDid, or the bare BaseUrl origin, and the platform serves neither.
Without an issuer in the policy response, or without a policy (no ProjectId
and ApiKey, or EnableComposedPolicy false), the path answers 404
{"error":"not_found"}, as the gateway worker does. OAuth clients register
again on first use.

#5983, behavior change: protected-resource metadata is served only for an
authorizationServerIssuer that is an absolute https URI (https:// followed by
a host, no whitespace, control character or backslash). Any other value is
treated as no issuer, so the path answers 404 {"error":"not_found"}.
ProtectedResourceMetadataBuilder.IsHttpsIssuer holds the rule, and
BuildDocument throws ArgumentException for an issuer that fails it.

#5968, behavior change: an engine block whose metadata carries
consent_remediable true now renders the same challenge a first-contact
challenge renders, instead of a plain block. The engine sets it only for a
scope shortfall against the scopes this host requires, a delegation whose own
exp passed, or one its status list marks revoked. The challenge follows
EnableDelegationChallengeWire and asks for the scopes the verify demanded
(DetectionResult.DemandedScopes), falling back to the route's scopes only when
that set is empty, and the dashboard report is a challenge. Every other
credential failure still blocks, and a policy action of instruct, redirect,
challenge or block is kept. Adds DetectionResult.DemandedScopes,
DetectionResult.ConsentRemediable, ConsentRechallenge.IsRechallenge and a
McpInstructBuilder.BuildBody overload that takes the required scopes.
Checkpoint.AspNet mirrors Checkpoint.AspNetCore.

#5911: in Checkpoint.AspNetCore, an exception from your endpoint or a later
middleware now reaches the host's error handling after running once. Before,
fail-open handling could run the request twice, answer a human with the agent
action under OnDetectionUnavailable=Baseline, or return its own 503 with
FailOpen=false. KYA-Failopen no longer appears on application errors. Classic
ASP.NET was not affected.

#5907: Checkpoint.AspNetCore adds HttpContext.GetCheckpointResult(),
GetCheckpointSessionId() and WasCheckpointSkipped(), matching Checkpoint.AspNet.
The HttpContext.Items keys keep their values, but their names are internal.

#5906: a missing ProjectId or ApiKey is reported once at startup: a warning
that names the missing setting, or an error for an ApiKey without a ProjectId.
The app still starts in local detection-only mode and nothing throws. ASP.NET
Core logs through ILogger category Checkpoint.Configuration; classic ASP.NET
writes one Trace record.

#5817 and #5941 rebuild the embedded engine. #5817 fixes the vendor-key feed
backoff, which the .NET SDK does not use. #5941 adds a deny list of non-browser
TLS cipher-list hashes read from tlsClientCiphersSha1, which the .NET SDK does
not send. Neither changes .NET verdicts.

#5942: detection telemetry carries the trusted edge JA4 as transport.ja4 on
the /api/v1/log-detection body. It is the kya-edge-ja4 header the SDK already
reads, trusted only when EdgeTrustPolicy is Cloudflare, or TrustedProxy with
TrustedHops above 0, and omitted otherwise, so a client-sent header never
reaches telemetry without an edge policy. DetectionEvent gains an init-only
TransportJa4 and DetectionResult a TransportJa4 with an internal setter; no
interface gains a member.

#5713 rebuilds the embedded engine: it rejects a compact JWS that declares an
unsupported crit or b64 protected member before accepting its signature, on
every proof path.

#5974 re-stamps the OpenAI RFC 9421 signing key compiled into the embedded
engine: same key, expiry moved from 2026-10-12 15:47 UTC to 2026-10-19 20:58
UTC. The .NET SDK does not apply the signed key bundle, so this is the only key
the engine's own OpenAI signature check has. That check failed as expired from
2026-10-12, as it does in 1.11.9, and fell back to the user-agent pattern. In
this release it verifies again until 2026-10-19 20:58 UTC. ChatGptSignatureVerifier
(EnableSignatureVerification, on by default) fetches OpenAI's live key
directory and is unchanged. The engine's ruleset hash changes with the key.

The public API changes are additions plus a nullable annotation on
GetCheckpointPostureOutcome, and one deliberate source break (#5926):
ProtectedResourceMetadataBuilder's BuildDocument, BuildNativeDocument and
BuildAccessGuide take the platform's issuer as a parameter. Their 1.11.9
signatures and ResolveIssuer remain as [Obsolete] error stubs (#5987) that
throw ArgumentException, so source calling them no longer compiles, while a 1.11.9
adapter running on this Core still binds, catches the exception and answers
kyaos/authorization-host-unavailable instead of failing with
MissingMethodException. No other Core member a 1.11.9 adapter calls changed
its signature.

This is a minor version on purpose: the 1.11.9 adapters accept any Core 1.11.9
or later with no upper bound, so NuGet would resolve a 2.0.0 Core for them the
same way, and a major version would only slow uptake of a fix sites need
(1.11.9 advertises an issuer the platform no longer serves). Update all four
packages together; the 1.12.0 adapters require Checkpoint.Core 1.12.0 or later.
Target frameworks and third-party dependency versions are unchanged from 1.11.9.
Qualify the real Framework/IIS installation and the matching Authorization Host
before broader enablement.

Release history: https://github.com/Know-That-Ai/checkpoint/blob/main/packages/checkpoint-dotnet/CHANGELOG.md