AWAKE is not just another secure-messaging or key-exchange spec. Its distinctive move is to bootstrap trust over a public channel by proving capability possession before treating the counterparty as trusted.
The spec is explicit that the relevant question in open P2P settings is often not “who is this?” but “what can this party actually do?” That makes AWAKE a capability-rooted trust-bootstrap layer rather than a pure identity protocol.
The protocol composes existing systems on purpose: UCAN carries authorization proof, while MLS handles the ongoing secure session after bootstrapping. That clean split is analytically useful.
The staged flow matters: public requestor broadcast with temporary X25519 DID and capability criteria, provider response with encrypted nullipotent UCAN proof, requestor authorization, then MLS session traffic.
The provider-proof stage is especially important because it proves resource access without granting real authority to the requestor yet. That is a meaningful decomposition compared with flatter auth handshakes.
The spec’s crypto choices — fresh X25519 session keys, HKDF-derived secrets, XChaCha-Poly1305 pre-MLS encryption, then MLS afterward — show an attempt to keep bootstrap state ephemeral and narrowly scoped.
The governance file is a useful maturity signal: the project is governed as a community-spec working group with consensus-based maintenance and appeal processes, so it should be treated as a live spec effort rather than settled production infrastructure.
Specific source signals worth retaining
AWAKE README abstract/introduction: strongest source for the claim that the protocol bootstraps a secure session on a public channel using UCAN-rooted authority proof.
Sequence and payload sections in the README: best source for the concrete protocol decomposition and the role of temporary DIDs, capability criteria, and nullipotent UCANs.
Governance document: useful context for judging maturity, openness, and how much to treat the spec as evolving versus standardized.
Why this entry belongs in the corpus
It strengthens the wallet/auth/authority cluster with a capability-rooted secure-session bootstrap that sits between authorization standards and messaging transports.
It provides a comparison point for any system claiming local-first auth, P2P secure sessions, or capability-based connectivity without making the provider-proof stage explicit.
The durable insight is that secure channels and trusted authority proofs are separable layers, and AWAKE makes that separation unusually legible.