[Specs-cx] Multi-party contract

[nara hideki]

Hi,all experts.

I had a off meeting with =nat about CX in the afternoon.
The followings are what we discussed.

1.  Any party should be able to notfiy CX contract identifier to any
party in the contract.

    Current revision of the CX spec, only "cxstat" is defined.  "cxid"
like parameter seems to be wanted to notify the contract identifier.

2. Signatory is a party who  a RP starts to have CX session with.
That should be advertised in XRDS/XRD for the user/server identifier.

3. /Contract/Pary/obligation/endpoint  [0..n] is better. Site can be
configured as a farm with some servers.
    But the response must be the exactly same.

4. Data request provided at /Contract/Party/obligation/endpoint which
is the url and should be requested in the following form ::

    endpoint?id=_cx_identifier_&party=_party_identfier_in_the_contract_

    The "Party" must encrypt the response message using the public key
of  "_party_identfier_in_the_contract_"

5. The contract itself can be fetched by any party in the contract.
Contract request is the exactly same as the "Data request".
    But the url is the CX identifier itself.

6. Any party should state the notification endpoint.
/Contract/Party/returnto  is good , isn't it?

7. Magic Signature could be more simple and better than XML Signature.

I'm happy if discussion would be split into single item.

Best regards.
-----
hdknr