Alien Agent ID — Core

The bootstrap and lifecycle surface. Every other agent-id-* plugin assumes the state directory produced here exists.

Assurance levels (the onboarding ladder)

An agent identity is a single, stable Ed25519 key. What grows over time is the attestation backing it, not the key — so the identity is usable from the very first moment and binding is something you add, never a precondition:

• L0 — self-asserted (init only): the key alone, no human. Already usable: local audit trail (sign/verify), the credential vault, and L0 git commits ("signed by key X, no human backing").
• L1 — anonymous-human: an Alien SSO id_token whose cnf.jkt binds this key and which attests a verified human authorized it, but with a pairwise/pseudonymous sub — a verifier learns "a real human stands behind this key", not which human.
• L2 — linked: an id_token whose sub is the canonical AlienID. Full provenance: artifact → key → this specific human.

The key never changes across rungs, so climbing L0→L1→L2 never invalidates an earlier signature or commit. status reports the current level and the nextStep to climb.

State directory layout (under ${AGENT_ID_STATE_DIR:-$HOME/.agent-id}):