Design

PIC Profile 0.2 defines centralized PIC-X-mediated authority continuity.

This walkthrough follows one sensitive-document execution from OAuth authority into PIC Token JWT 0, then through two workload-produced candidate transitions.

OAuth authority
        |
        v
PCA 0
{ read document-42, save }
        |
        | Worker 1 reads document-42
        | remove read authority
        v
PCA 1
{ save }
        |
        | Worker 2 stores the result
        | remove save authority
        v
PCA 2
{ no execution invariants }

Cryptographic byte values, compact tokens, signatures, hashes, and COSE byte strings below are illustrative. The structure and field semantics follow Profile 0.2.

PIC Profile 0.2 defines centralized PIC-X-mediated authority continuity.

The active profile is:

https://pic-protocol.org/profiles/0.2

This article defines the external PIC Token JWT envelope and the native COSE artifacts used by that profile.

OAuth access token + Initial Continuity Proposal
        |
        v
PIC-X
        |
        v
realm-signed PIC PCA COSE 0
        |
        v
realm-signed settled PIC Continuity COSE 0
        |
        v
realm-signed PIC Token JWT 0

Non-initial advancement is candidate-based:

PIC-X exposes discovery at two levels: a server control-plane document and a per-realm PIC-X discovery document.

The server is not an issuer. A realm is an isolated trust domain and issuer boundary. Realm discovery publishes issuer-scoped endpoints, keys, token-exchange metadata, and PIC authority and continuity capabilities.

/.well-known/server-configuration
        |
        +--> realm: acme
                |
                v
/realms/acme/.well-known/pic-x-configuration

Discovery Model

The server-level document describes the PIC-X instance. The realm-level document describes the issuer clients use for PIC exchange and verification.

PIC-X receives an OAuth access token at the selected realm token endpoint, validates it, and derives the initial PIC Context of Authority, or PCA. A PCA is the logical Context of Authority. Its signed representation is a PIC PCA COSE. PIC-X then returns a realm-signed PIC Token JWT carrying a settled PIC Continuity COSE in pic.root.