A AUGENMASS
REGISTRY OVER-ASK AUDITOR
EUDI RELYING-PARTY REGISTRY · PROPORTION BY EYE

WHO IS OVER-ASKING IN THE EUDI REGISTRY?

Audit the registry here. Repair and debug your own EUDI flow with Augenmaß Workbench, a public-preview Rust CLI and Claude Code skill built around the same proportionality engine.

SCOPE OF THIS AUDIT

relying parties visible through the Catalog of Attestations, enriched with their published registration certificates, plus local fixtures for deterministic demo coverage.

RUN THE BOARD ↓ THE HEADLINE CASE SCROLL ↓
01 · THE TALLY

The audit, stamped

Unit of analysis is the certificate. The board rolls up worst-signal-wins per relying party.

Registry-audit mode makes no live wallet request, so the hard "beyond registration" axis is never evaluated (nothing is disclosed and no hard signal is raised). A coverage gap is a gap in what could be inspected, not a clean bill of health.

02 · THE SPREAD

Where they fall

All relying parties as specimens on one plate. Position is the verdict: calm signals settle left, the over-asks drift right. Dot size = certificates on file. Hover, focus or tap a dot to read its record.

SEVERITY DISTRIBUTION
N = 20

Soft over-asks and the labelled category-mismatch heuristic land in the over-ask zone, kept separate. Every relying party is plotted. hover a dot

03 · WORST FIRST

The bar race

All relying parties as horizontal bars, longest = worst. Bar color names the verdict. Click any bar for the certificate-level read.

04 · ONE ENGINE, TWO SURFACES

The toolkit is the product

Over-ask is the headline. The toolkit is the product. The board you just scrolled and the Workbench on your laptop are two surfaces of one proportionality engine.

SURFACE ONE

The public board

The same engine audits the live EUDI registry after the fact: who registered a broader scope than their stated purpose needs. That is this page.

SURFACE TWO

Augenmaß Workbench

The engine as a local instrument: a Rust binary augenmass plus an agent skill. Skill is the front door; the CLI underneath. Apache-2.0.

augenmass <verb> 6 → 16 verbs · since v0.1 · v0.3.0
decode
inspectauto-sniff any EUDI artifact and decode it (structure only)
decodeJWT · SD-JWT VC · mdoc/CBOR · regcert · request · offer · status-list
audit
checkover-ask + format gate on a registration body
auditlint a DCQL / OpenID4VP request against a purpose baseline
baselineslist curated purpose baselines + the cited legal basis
verify · offline
verifypresentation, trust chain, status & status-list · fail-closed
x509-hashcompute / check the x509_hash client_id binding
debug live
serveverifier-in-a-box: debug a real wallet, redacted trace by default
doctordiagnose signed-request / JAR gotchas
evidence
evidenceexport · verify · replay · assert-live a redacted, projector-safe capture
generate · gate
generatea proportionate registration body or DCQL query
validatestructural DCQL validation · CI gate, exits non-zero
registerguard-railed write · refuses on over-ask
registry I/O
listread registrations back
clonelocal registrar-compatible clone store
cachebounded read-through cached-sandbox mirror
filled = the 6 verbs you started with at v0.1 · serve = the live wallet debugger · grounded in eIDAS Art. 5b(3) · GDPR Art. 5(1)(c) · EUDI ARF RPRC_07
05 · LIVE WALLET DEBUG

Debug a real wallet, live

A verifier-in-a-box. augenmass serve --relay augenmass --age-only stands up a local OpenID4VP verifier on the German PID profile; a real EUDI wallet on a phone presents to it over the hosted relay, and you watch every step.

Proven Tested with the EUDI Wallet Sandbox (iOS and Android) and the current sandbox environment, 2026-06-25; the exported evidence bundles passed augenmass evidence assert-live.
LIVE FLOW · OPENID4VP · GERMAN PID · AGE-ONLY REDACTED BY DEFAULT

The relay carries bytes for exactly two routes and decrypts nothing. On a temporary run URL it forwards only /request and /response. The response stays ECDH-ES encrypted to a single-use key; any plaintext response is rejected with HTTP 422. The trace, inspector, and evidence stay on your machine. Hosted relay access is token-gated during preview.

PER-SESSION TRACE · sha-256 shapes only session 7f3a…b2 · single-use key
  1. SESSION_CREATEDnonce minted (32B) · response_uri set · ephemeral key (P-256)
  2. REQUEST_BUILTclient_id x509_hash · signed request object (JAR)
  3. REQUEST_OBJECT_FETCHEDwallet fetched the signed request by reference
  4. RESPONSE_RECEIVEDdirect_post.jwt · encrypted (JWE) · byte length logged
  5. RESPONSE_DECRYPTEDJWE decrypted · ECDH-ES · vp_token present
  6. VERIFIEDholder binding: ok · age predicate requested · disclosed claim keys recordedVERIFIED
  7. OVER_ASK_ANALYZEDrequested 1 · baseline: age check · 0 beyond purpose

evidence assert-live proves the six-event spine through VERIFIED; the live trace then continues into OVER_ASK_ANALYZED (over-ask analysis is live-trace only, not part of the assert-live gate).

One example presentation, three commands:

augenmass inspect 
Detected: SD-JWT VC presentation · vct urn:eudi:pid:de:1 · disclosed: age_equal_or_over predicate
structure decoded only — no signature verified yet
augenmass verify 
VERIFIED  presentation verified: urn:eudi:pid:de:1 (claim keys disclosed, holder binding ok)
augenmass verify · replayed nonce 
REJECTED [NonceMismatch]: KB-JWT nonce does not match the request.

Redacted by default: only shapes (byte lengths, SHA-256 digests, sorted field names, disclosed claim keys), never raw values. Raw capture is opt-in and never served; it is written owner-only on Unix (0600), and should be kept in a private or encrypted workspace on other platforms.

06 · REACH FROM ANYWHERE

Reach the wallet from anywhere

A hosted wallet relay at wallet.augenmass.tech: a small tunnel so a phone wallet can reach your local verifier over public HTTPS, without exposing your whole debugger.

augenmass serve --relay augenmass --age-only ONE HOSTED SERVICE

The --relay augenmass flag opens an outbound WebSocket to wss://wallet.augenmass.tech/_relay/tunnel. The relay hands back a temporary public run URL, baked into the wallet request object. It is a byte-forwarding tunnel, not a verifier: it does not decrypt, does not store bodies, and logs route, status, byte counts, latency, and a short run id. Hosted relay access is token-gated during preview (set AUGENMASS_RELAY_TOKEN).

Forwarded · under the run URL
  • ↦GET /request/<session> the signed request object the wallet fetches
  • ↦POST /response/<session> the encrypted direct_post.jwt the wallet returns
Stays local · never tunneled
  • ×the per-session trace and inspector
  • ×the evidence store and any raw capture
  • ×every debugger route except the two forwarded above

One hosted relay service, not a network. It forwards bytes for two routes between one phone and one local verifier. Proven with a real phone-wallet flow through the hosted relay.

07 · INSTALL & RUN

Stop typing commands. Start asking.

One binary, two ways in. The skill is the front door: ask in plain language and it runs the engine. Or drive the CLI directly.

Detect the over-ask, fix it, gate it before it ever registers. Augenmaß Workbench is a Rust CLI and Claude Code skill for inspect, check, verify, DCQL validation, mdoc decoding, live OpenID4VP debugging, and redacted evidence replay.

/plugin marketplace add augenmass/augenmass-workbench
/plugin install augenmass-workbench@augenmass
›Hey Claude, debug this registration for over-asking.
›Hey Claude, generate a proportionate age-check body, only the over-18 attribute.
›Hey Claude, register it, but refuse if it over-asks.
git clone https://github.com/augenmass/augenmass-workbench.git
cd augenmass-workbench
cargo build --release --locked
./target/release/augenmass --help

Then augenmass check diffs scope against purpose, augenmass verify checks SD-JWT VC presentations, augenmass serve runs a local verifier-in-a-box, and augenmass evidence replay renders a redacted trace.

Public preview. Workbench v0.3.0, the live-wallet proof release, is published: a public repo and GitHub release archives. Build from source (cargo build --release --locked) or download a release archive; the one-line plugin install is still preview-grade.

Rust-first, source-buildable, a Claude Code skill plus CLI for auditing, debugging, and repairing EUDI relying-party registrations and wallet interactions.

Get Augenmaß Workbench ↗