Session Handshake (superseded)
The pre-v1 challenge/response session handshake, retired when KYA-OS v1 was ratified. v1 uses stateless per-request proofs.
Session Handshake (superseded)
This page describes the pre-v1 model
The challenge/response session handshake previously documented at this URL was part of the pre-v1 drafts of KYA-OS. It was retired when KYA-OS v1 was ratified by the DIF Trusted AI Agents Working Group on 2026-08-05. KYA-OS v1 has no session handshake.
KYA-OS v1 is stateless: there is no session establishment, no challenge/response round-trip, and no per-session state held between calls. Each MCP request instead carries its own holder-of-key proof under the org.kya-os/proof.v1 profile, and each response carries a detached response proof. The two carriers ride the standard MCP _meta field:
- Requests:
_meta["org.kya-os/request-proof"] - Responses:
_meta["org.kya-os/response-proof"]
A verifier checks each request's proof independently - signature, request-hash binding, audience, and freshness window - so no prior exchange with the caller is required.
Where to go instead
- Quick Start - onboarding with the stateless per-request model
- Binding KYA-OS to MCP - how the proofs ride the MCP
_metachannel - SPEC.md - the normative v1 specification