From 390a07f834f02fe26f4da3bb21ad005e18b4cebe Mon Sep 17 00:00:00 2001
From: Beon de Nood <beon@bigdune.net>
Date: Sat, 2 May 2026 11:07:22 -0400
Subject: [PATCH 1/2] docs: fix gRPC method signatures to match implementation

- request_badge returns (success, result_dict, error), not (token, error)
- badge keeper events are dicts with 'type'/'token' keys, not objects
- verify() takes (payload, signature), returns (valid, key_id, error)
- verify_attached() takes (jws) only, returns (valid, payload, key_id, error)

Fixes: DOCS_REMEDIATION_PLAN P0-5
---
 README.md | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index c5ba273..d867ad2 100644
--- a/README.md
+++ b/README.md
@@ -442,11 +442,14 @@ with CapiscioRPCClient() as client:
     claims, error = client.badge.parse_badge(token)
 
     # Request CA-signed badge
-    token, error = client.badge.request_badge(
+    success, result, error = client.badge.request_badge(
         agent_id="my-agent-123",
         api_key="capi_key_...",
         ca_url="https://registry.capisc.io"
     )
+    if success:
+        token = result["token"]
+        print(f"Badge expires: {result['expires_at']}")
 
     # Start badge keeper (auto-renewal)
     for event in client.badge.start_keeper(
@@ -456,8 +459,8 @@ with CapiscioRPCClient() as client:
         ttl_seconds=300,
         renew_before_seconds=60
     ):
-        if event.event_type == "renewed":
-            print(f"Badge renewed: {event.badge_token}")
+        if event["type"] == "renewed":
+            print(f"Badge renewed: {event['token']}")
 ```
 
 ### 2. DIDService - DID Parsing
@@ -543,10 +546,9 @@ with CapiscioRPCClient() as client:
     )
 
     # Verify a signature
-    valid, payload, error = client.simpleguard.verify(
+    valid, key_id, error = client.simpleguard.verify(
+        payload=b"important message",
         signature=signature,
-        expected_payload=b"important message",
-        public_key_jwk='{"kty":"OKP",...}'
     )
 
     # Sign with attached payload (JWS Compact)
@@ -555,10 +557,9 @@ with CapiscioRPCClient() as client:
         key_id="my-key-1"
     )
 
-    # Verify attached signature
-    valid, payload, error = client.simpleguard.verify_attached(
+    # Verify attached signature (key resolved from JWS header)
+    valid, payload, key_id, error = client.simpleguard.verify_attached(
         jws=jws,
-        public_key_jwk='{"kty":"OKP",...}'
     )
 
     # Get key information

From 5e2a9289825f891b4ea8ddf92fb4d2536b65923c Mon Sep 17 00:00:00 2001
From: Beon de Nood <beon@bigdune.net>
Date: Sat, 2 May 2026 11:34:34 -0400
Subject: [PATCH 2/2] docs: fix DID parse example and TrustStore docs

- DID parse returns dict without 'document_url'; that's a separate
  client.did.document_url() call. Split example accordingly.
- TrustStore add_key() raises NotImplementedError. Updated docs to
  show available is_trusted() method and mark add_key as unimplemented.
- Fixed path output from string to list (actual return type).

Fixes: DOCS_REMEDIATION_PLAN P2-8
---
 README.md | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index d867ad2..1575ec3 100644
--- a/README.md
+++ b/README.md
@@ -473,22 +473,23 @@ with CapiscioRPCClient() as client:
     if did_info:
         print(f"Method: {did_info['method']}")          # "web"
         print(f"Domain: {did_info['domain']}")          # "registry.capisc.io"
-        print(f"Path: {did_info['path']}")              # "agents/my-agent"
-        print(f"Document URL: {did_info['document_url']}")  # "https://registry.capisc.io/agents/my-agent/did.json"
+        print(f"Path: {did_info['path']}")              # ["agents", "my-agent"]
+
+    # Get document URL (separate call)
+    url, error = client.did.document_url("did:web:registry.capisc.io:agents:my-agent")
+    print(f"Document URL: {url}")  # "https://registry.capisc.io/agents/my-agent/did.json"
 ```
 
 ### 3. TrustStoreService - Manage Trusted CA Keys
 
+> **Note**: `add_key()` is not yet implemented (raises `NotImplementedError`).
+> `is_trusted()` is available for checking trust status.
+
 ```python
 with CapiscioRPCClient() as client:
-    # Add trusted CA key
-    kid, error = client.trust.add_key(
-        did="did:web:registry.capisc.io",
-        public_key=b'{"kty":"OKP",...}',
-        format="JWK"
-    )
-
-    print(f"Added key: {kid}")
+    # Check if a DID is in the trust store
+    trusted = client.trust.is_trusted("did:web:registry.capisc.io")
+    print(f"Trusted: {trusted}")
 ```
 
 ### 4. RevocationService - Check Revocation Status