[AI assisted] Plan G core: AnchorResolver abstraction + FQDN/did:web/LEI profiles

[scourtney-godaddy]

Introduces the AnchorResolver interface so the RA can use something other than the FQDN as the agent's cryptographic identity anchor. Every registration still carries an FQDN as agentHost (the operational endpoint where the agent terminates TLS); what changes is what serves as the identity anchor. The existing FQDN path lifts behind the interface; two new resolvers land alongside it: did:web and LEI. No wire changes yet; that is the next PR.

---

The first of three Plan G PRs. This one adds the ANS-0 Identity
Anchor abstraction the proposal at
docs/proposals/2026-05-16-spec-skeletons/ans-0-identity-anchor.md
specifies, plus two concrete anchor-profile resolvers (FQDN, DID
via did:web, LEI), and the registry facade that dispatches inputs
to the right resolver by lexical form. No service or handler
changes yet; those land in the next PR in the stack. Two more DID
methods (did:key, did:pkh) plus real-world LEI vectors land in
the third PR in the stack.

Domain types:

• domain.AnchorType enum: fqdn, did, lei. Closed; a fourth
  top-level type is an ANS-0 amendment, not a profile addition.
• domain.IdentityClaim carries the typed result of resolution:
  anchor type, canonical resolved ID, public key in JWK form,
  optional metadata URL pointer, IssuedAt + ExpiresAt for cache
  bounds. The struct shape matches the TypeScript signature in
  the architectural-index skeleton §3.1.

Port:

• port.AnchorResolver is the contract higher-spec code reads
  identity through: Resolve(ctx, input) → (*IdentityClaim, error)
  plus SupportedProfiles() []string for configuration audit.

Adapters under internal/adapter/anchor/:

• fqdn: lifts the FQDN canonicalization and label validation
  that previously lived inline in the registration service. RFC
  1123 hostname constraints, lowercase + trailing-dot strip,
  rejection of underscore-prefixed labels (ANS-3 reserves those
  for registry records).
• did: implements did:web resolution. HTTPS GET against
  /.well-known/did.json (or the path-component variant for
  scoped DIDs), DID document parsing, verification method
  selection (assertionMethod first, then authentication, then
  any verificationMethod entry; tie-breaker on the most recent
  updated/created), JWK conversion (publicKeyJwk passes
  through; publicKeyMultibase and publicKeyPem return typed
  not-implemented errors flagging the migration boundary).
  Cross-domain redirects fail closed with
  DID_REDIRECT_DOMAIN_MISMATCH.
• lei: ISO 17442 mod-97 (ISO 7064 MOD 97-10) check digits
  in pure Go, plus a GLEIFClient interface stub. A production
  GLEIF API client lands when an actual GLEIF testbed is wired
  into CI; today the resolver is useful for testbeds and unit
  tests with no network call (Resolve returns
  LEI_GLEIF_NOT_CONFIGURED if no client is injected).
• registry: dispatches by lexical form per ANS-0 §4.1.
  did: prefix → DID branch; 20-char ASCII alphanumeric → LEI
  branch; RFC 1123 hostname with at least one dot → FQDN branch;
  anything else → INVALID_ANCHOR_FORMAT. Configuration-driven:
  unconfigured branches return PROFILE_NOT_CONFIGURED so the
  startup validator catches deployment shape errors before the
  first registration request.

Tests:

• FQDN canonicalization edge cases (empty, single-label, too
  long, embedded whitespace, empty/oversize labels, hyphen
  edges, underscore rejection, non-LDH characters).
• did:web happy path against an httptest TLS server plus the
  documented failure modes (404, bad content type, ID mismatch,
  no verification method, missing publicKey* shape, redirect
  policy).
• LEI canonicalization happy path plus all the LEI_BAD_FORMAT
  and LEI_BAD_CHECK_DIGITS cases. Resolution against an
  injected fake GLEIFClient covers ACTIVE acceptance,
  INACTIVE/LAPSED/RETIRED/MERGED rejection, lookup error
  propagation, missing-attestation-key rejection.
• Registry dispatch matrix (FQDN, did:web, LEI shape,
  FQDN-shape with a dot beats LEI shape, every reject path,
  PROFILE_NOT_CONFIGURED branches, full SupportedProfiles
  union).
• All resolvers satisfy the port.AnchorResolver compile-time
  check (var _ port.AnchorResolver = (*Registry)(nil)).

The DNSid mention in the original FQDN package comment was
replaced with the spec's generic external-key-locator framing
per the proposal's update on the same day. The resolver itself
names no specific external discovery effort.

Stacks on #14 (Plan F) → #13 (Plan D) → #12 (Plans A + C).
Merge order: #12 → #13 → #14 → this.

Test plan

• make check (gofmt + golangci-lint + 90% coverage gate)
• Each resolver has its own unit tests covering happy path + every documented error code
• Registry facade dispatch matrix (FQDN, did, LEI, unknown shape, profile-not-configured)
• LEI mod-97 against GLEIF documentation example (round-trip + perturbed-check-digit rejection)
• No live network calls in CI (the did:web resolver uses httptest; the LEI resolver stubs GLEIFClient)

🤖 Generated with Claude Code