@adastracomputing/ink 0.1.0-alpha.0

package/test-vectors/handshake.json

@@ -0,0 +1,482 @@
+{
+  "description": "INK v0.1 handshake test vectors — challenge (Stage 2a), rejection (Stage 2b), resolution (Stage 3). All signatures use key material from keys.json.",
+  "vectors": [
+    {
+      "id": "challenge-valid",
+      "description": "Alice sends a valid challenge to Bob (Stage 2a)",
+      "input": {
+        "method": "POST",
+        "path": "/ink/v1/did:plc:bob456test/challenge",
+        "recipientDid": "did:plc:bob456test",
+        "body": {
+          "protocol": "ink/0.1",
+          "type": "network.tulpa.challenge",
+          "intentRef": "msg-intent-001",
+          "challengeType": "availability",
+          "nonce": "Y2hhbG5vbmNlMQ",
+          "timestamp": "2026-03-25T12:00:00Z"
+        },
+        "timestamp": "2026-03-25T12:00:00Z",
+        "signerPrivateKeyHex": "02362f546f26d9c252c9209d1218e3174654b04b5f08f2ee2b3fa7874111d086"
+      },
+      "expected": {
+        "canonicalBody": "{\"challengeType\":\"availability\",\"intentRef\":\"msg-intent-001\",\"nonce\":\"Y2hhbG5vbmNlMQ\",\"protocol\":\"ink/0.1\",\"timestamp\":\"2026-03-25T12:00:00Z\",\"type\":\"network.tulpa.challenge\"}",
+        "signatureBase": "ink/0.1\nPOST\n/ink/v1/did:plc:bob456test/challenge\ndid:plc:bob456test\n{\"challengeType\":\"availability\",\"intentRef\":\"msg-intent-001\",\"nonce\":\"Y2hhbG5vbmNlMQ\",\"protocol\":\"ink/0.1\",\"timestamp\":\"2026-03-25T12:00:00Z\",\"type\":\"network.tulpa.challenge\"}\n2026-03-25T12:00:00Z",
+        "signatureBase64url": "RpVtDeOoEegibsJdKJtaM6Iku6aaew7ckJ6PmtG__z4AnerYp85tcRSSSYbT2BPGKxqLXqVT6Kx9Kj2KkkC6Cw",
+        "accepted": true
+      }
+    },
+    {
+      "id": "challenge-invalid-path",
+      "description": "Challenge signature fails when verified against /rejection path",
+      "input": {
+        "method": "POST",
+        "path": "/ink/v1/did:plc:bob456test/rejection",
+        "recipientDid": "did:plc:bob456test",
+        "body": {
+          "protocol": "ink/0.1",
+          "type": "network.tulpa.challenge",
+          "intentRef": "msg-intent-001",
+          "challengeType": "availability",
+          "nonce": "Y2hhbG5vbmNlMQ",
+          "timestamp": "2026-03-25T12:00:00Z"
+        },
+        "timestamp": "2026-03-25T12:00:00Z",
+        "originalSignatureBase64url": "RpVtDeOoEegibsJdKJtaM6Iku6aaew7ckJ6PmtG__z4AnerYp85tcRSSSYbT2BPGKxqLXqVT6Kx9Kj2KkkC6Cw"
+      },
+      "expected": {
+        "accepted": false,
+        "reason": "Signature was computed over /challenge but verified against /rejection"
+      }
+    },
+    {
+      "id": "challenge-invalid-recipient",
+      "description": "Challenge signature fails when verified with wrong recipient DID",
+      "input": {
+        "method": "POST",
+        "path": "/ink/v1/did:plc:bob456test/challenge",
+        "recipientDid": "did:plc:mallory999",
+        "body": {
+          "protocol": "ink/0.1",
+          "type": "network.tulpa.challenge",
+          "intentRef": "msg-intent-001",
+          "challengeType": "availability",
+          "nonce": "Y2hhbG5vbmNlMQ",
+          "timestamp": "2026-03-25T12:00:00Z"
+        },
+        "timestamp": "2026-03-25T12:00:00Z",
+        "originalSignatureBase64url": "RpVtDeOoEegibsJdKJtaM6Iku6aaew7ckJ6PmtG__z4AnerYp85tcRSSSYbT2BPGKxqLXqVT6Kx9Kj2KkkC6Cw"
+      },
+      "expected": {
+        "accepted": false,
+        "reason": "recipientDid in signature base does not match verifier"
+      }
+    },
+    {
+      "id": "challenge-tampered-intentRef",
+      "description": "Challenge signature fails when intentRef is tampered",
+      "input": {
+        "method": "POST",
+        "path": "/ink/v1/did:plc:bob456test/challenge",
+        "recipientDid": "did:plc:bob456test",
+        "body": {
+          "protocol": "ink/0.1",
+          "type": "network.tulpa.challenge",
+          "intentRef": "msg-intent-TAMPERED",
+          "challengeType": "availability",
+          "nonce": "Y2hhbG5vbmNlMQ",
+          "timestamp": "2026-03-25T12:00:00Z"
+        },
+        "timestamp": "2026-03-25T12:00:00Z",
+        "originalSignatureBase64url": "RpVtDeOoEegibsJdKJtaM6Iku6aaew7ckJ6PmtG__z4AnerYp85tcRSSSYbT2BPGKxqLXqVT6Kx9Kj2KkkC6Cw"
+      },
+      "expected": {
+        "accepted": false,
+        "reason": "Body was modified after signing"
+      }
+    },
+    {
+      "id": "challenge-timestamp-expired",
+      "description": "Challenge rejected — timestamp more than 5 minutes in the past",
+      "input": {
+        "messageTimestamp": "2026-03-25T11:50:00Z",
+        "receiverClock": "2026-03-25T12:00:00Z",
+        "nonce": "Y2hhbG5vbmNlMQ"
+      },
+      "expected": {
+        "accepted": false,
+        "errorCode": "expired_message"
+      }
+    },
+    {
+      "id": "challenge-timestamp-future",
+      "description": "Challenge rejected — timestamp more than 30 seconds in the future",
+      "input": {
+        "messageTimestamp": "2026-03-25T12:01:00Z",
+        "receiverClock": "2026-03-25T12:00:00Z",
+        "nonce": "Y2hhbGZ1dHVyZQ"
+      },
+      "expected": {
+        "accepted": false,
+        "errorCode": "expired_message"
+      }
+    },
+    {
+      "id": "challenge-duplicate-nonce",
+      "description": "Challenge rejected — nonce already seen",
+      "input": {
+        "messageTimestamp": "2026-03-25T12:00:00Z",
+        "receiverClock": "2026-03-25T12:00:00Z",
+        "nonce": "Y2hhbG5vbmNlMQ",
+        "previouslySeenNonces": [
+          "Y2hhbG5vbmNlMQ"
+        ]
+      },
+      "expected": {
+        "accepted": false,
+        "errorCode": "duplicate_nonce"
+      }
+    },
+    {
+      "id": "rejection-valid",
+      "description": "Bob sends a valid rejection to Alice (Stage 2b)",
+      "input": {
+        "method": "POST",
+        "path": "/ink/v1/did:plc:alice123test/rejection",
+        "recipientDid": "did:plc:alice123test",
+        "body": {
+          "protocol": "ink/0.1",
+          "type": "network.tulpa.rejection",
+          "intentRef": "msg-intent-001",
+          "reason": "capacity",
+          "detail": "Too many pending coordination requests",
+          "nonce": "cmVqbm9uY2Ux",
+          "timestamp": "2026-03-25T12:01:00Z"
+        },
+        "timestamp": "2026-03-25T12:01:00Z",
+        "signerPrivateKeyHex": "4ea0adf03599751231c1c3b7fc5a6c9d2e2f2f97bcd7c885c0add2f47b9af181"
+      },
+      "expected": {
+        "canonicalBody": "{\"detail\":\"Too many pending coordination requests\",\"intentRef\":\"msg-intent-001\",\"nonce\":\"cmVqbm9uY2Ux\",\"protocol\":\"ink/0.1\",\"reason\":\"capacity\",\"timestamp\":\"2026-03-25T12:01:00Z\",\"type\":\"network.tulpa.rejection\"}",
+        "signatureBase": "ink/0.1\nPOST\n/ink/v1/did:plc:alice123test/rejection\ndid:plc:alice123test\n{\"detail\":\"Too many pending coordination requests\",\"intentRef\":\"msg-intent-001\",\"nonce\":\"cmVqbm9uY2Ux\",\"protocol\":\"ink/0.1\",\"reason\":\"capacity\",\"timestamp\":\"2026-03-25T12:01:00Z\",\"type\":\"network.tulpa.rejection\"}\n2026-03-25T12:01:00Z",
+        "signatureBase64url": "Dxye5S0lV3uUGck8ozOxF8kavH_ZTcxbdQm7i50hrVLewU1_wDvF3hMYrFHJsSmwnGThvCaM1SDLsaiEiksKBA",
+        "accepted": true
+      }
+    },
+    {
+      "id": "rejection-invalid-path",
+      "description": "Rejection signature fails when verified against /challenge path",
+      "input": {
+        "method": "POST",
+        "path": "/ink/v1/did:plc:alice123test/challenge",
+        "recipientDid": "did:plc:alice123test",
+        "body": {
+          "protocol": "ink/0.1",
+          "type": "network.tulpa.rejection",
+          "intentRef": "msg-intent-001",
+          "reason": "capacity",
+          "detail": "Too many pending coordination requests",
+          "nonce": "cmVqbm9uY2Ux",
+          "timestamp": "2026-03-25T12:01:00Z"
+        },
+        "timestamp": "2026-03-25T12:01:00Z",
+        "originalSignatureBase64url": "Dxye5S0lV3uUGck8ozOxF8kavH_ZTcxbdQm7i50hrVLewU1_wDvF3hMYrFHJsSmwnGThvCaM1SDLsaiEiksKBA"
+      },
+      "expected": {
+        "accepted": false,
+        "reason": "Signature was computed over /rejection but verified against /challenge"
+      }
+    },
+    {
+      "id": "rejection-invalid-recipient",
+      "description": "Rejection signature fails when verified with wrong recipient DID",
+      "input": {
+        "method": "POST",
+        "path": "/ink/v1/did:plc:alice123test/rejection",
+        "recipientDid": "did:plc:mallory999",
+        "body": {
+          "protocol": "ink/0.1",
+          "type": "network.tulpa.rejection",
+          "intentRef": "msg-intent-001",
+          "reason": "capacity",
+          "detail": "Too many pending coordination requests",
+          "nonce": "cmVqbm9uY2Ux",
+          "timestamp": "2026-03-25T12:01:00Z"
+        },
+        "timestamp": "2026-03-25T12:01:00Z",
+        "originalSignatureBase64url": "Dxye5S0lV3uUGck8ozOxF8kavH_ZTcxbdQm7i50hrVLewU1_wDvF3hMYrFHJsSmwnGThvCaM1SDLsaiEiksKBA"
+      },
+      "expected": {
+        "accepted": false,
+        "reason": "recipientDid in signature base does not match verifier"
+      }
+    },
+    {
+      "id": "rejection-tampered-reason",
+      "description": "Rejection signature fails when reason field is tampered",
+      "input": {
+        "method": "POST",
+        "path": "/ink/v1/did:plc:alice123test/rejection",
+        "recipientDid": "did:plc:alice123test",
+        "body": {
+          "protocol": "ink/0.1",
+          "type": "network.tulpa.rejection",
+          "intentRef": "msg-intent-001",
+          "reason": "expired",
+          "detail": "Too many pending coordination requests",
+          "nonce": "cmVqbm9uY2Ux",
+          "timestamp": "2026-03-25T12:01:00Z"
+        },
+        "timestamp": "2026-03-25T12:01:00Z",
+        "originalSignatureBase64url": "Dxye5S0lV3uUGck8ozOxF8kavH_ZTcxbdQm7i50hrVLewU1_wDvF3hMYrFHJsSmwnGThvCaM1SDLsaiEiksKBA"
+      },
+      "expected": {
+        "accepted": false,
+        "reason": "Body was modified after signing"
+      }
+    },
+    {
+      "id": "rejection-timestamp-expired",
+      "description": "Rejection rejected — timestamp expired",
+      "input": {
+        "messageTimestamp": "2026-03-25T11:50:00Z",
+        "receiverClock": "2026-03-25T12:00:00Z",
+        "nonce": "cmVqbm9uY2Ux"
+      },
+      "expected": {
+        "accepted": false,
+        "errorCode": "expired_message"
+      }
+    },
+    {
+      "id": "rejection-duplicate-nonce",
+      "description": "Rejection rejected — duplicate nonce",
+      "input": {
+        "messageTimestamp": "2026-03-25T12:01:00Z",
+        "receiverClock": "2026-03-25T12:01:00Z",
+        "nonce": "cmVqbm9uY2Ux",
+        "previouslySeenNonces": [
+          "cmVqbm9uY2Ux"
+        ]
+      },
+      "expected": {
+        "accepted": false,
+        "errorCode": "duplicate_nonce"
+      }
+    },
+    {
+      "id": "resolution-accepted",
+      "description": "Bob sends a 'accepted' resolution to Alice (Stage 3)",
+      "input": {
+        "method": "POST",
+        "path": "/ink/v1/did:plc:alice123test/resolution",
+        "recipientDid": "did:plc:alice123test",
+        "body": {
+          "protocol": "ink/0.1",
+          "type": "network.tulpa.resolution",
+          "intentRef": "msg-intent-001",
+          "outcome": "accepted",
+          "nonce": "cmVzb2x1dGlvbi0YWNjZXB0ZWQ",
+          "timestamp": "2026-03-25T12:05:00Z",
+          "details": {
+            "scheduledAt": "2026-04-01T15:00:00Z",
+            "duration": "30m"
+          }
+        },
+        "timestamp": "2026-03-25T12:05:00Z",
+        "signerPrivateKeyHex": "4ea0adf03599751231c1c3b7fc5a6c9d2e2f2f97bcd7c885c0add2f47b9af181"
+      },
+      "expected": {
+        "canonicalBody": "{\"details\":{\"duration\":\"30m\",\"scheduledAt\":\"2026-04-01T15:00:00Z\"},\"intentRef\":\"msg-intent-001\",\"nonce\":\"cmVzb2x1dGlvbi0YWNjZXB0ZWQ\",\"outcome\":\"accepted\",\"protocol\":\"ink/0.1\",\"timestamp\":\"2026-03-25T12:05:00Z\",\"type\":\"network.tulpa.resolution\"}",
+        "signatureBase": "ink/0.1\nPOST\n/ink/v1/did:plc:alice123test/resolution\ndid:plc:alice123test\n{\"details\":{\"duration\":\"30m\",\"scheduledAt\":\"2026-04-01T15:00:00Z\"},\"intentRef\":\"msg-intent-001\",\"nonce\":\"cmVzb2x1dGlvbi0YWNjZXB0ZWQ\",\"outcome\":\"accepted\",\"protocol\":\"ink/0.1\",\"timestamp\":\"2026-03-25T12:05:00Z\",\"type\":\"network.tulpa.resolution\"}\n2026-03-25T12:05:00Z",
+        "signatureBase64url": "Gz7YiTPogpiTpTq0FttCq1tFtNA6bkeut7h-55nsu2xpZTd0vraF6hmmmyfTojtRzVfeMu7XOXIK4qIQJt7gDg",
+        "accepted": true
+      }
+    },
+    {
+      "id": "resolution-declined",
+      "description": "Bob sends a 'declined' resolution to Alice (Stage 3)",
+      "input": {
+        "method": "POST",
+        "path": "/ink/v1/did:plc:alice123test/resolution",
+        "recipientDid": "did:plc:alice123test",
+        "body": {
+          "protocol": "ink/0.1",
+          "type": "network.tulpa.resolution",
+          "intentRef": "msg-intent-001",
+          "outcome": "declined",
+          "nonce": "cmVzb2x1dGlvbi0ZGVjbGluZWQ",
+          "timestamp": "2026-03-25T12:05:00Z"
+        },
+        "timestamp": "2026-03-25T12:05:00Z",
+        "signerPrivateKeyHex": "4ea0adf03599751231c1c3b7fc5a6c9d2e2f2f97bcd7c885c0add2f47b9af181"
+      },
+      "expected": {
+        "canonicalBody": "{\"intentRef\":\"msg-intent-001\",\"nonce\":\"cmVzb2x1dGlvbi0ZGVjbGluZWQ\",\"outcome\":\"declined\",\"protocol\":\"ink/0.1\",\"timestamp\":\"2026-03-25T12:05:00Z\",\"type\":\"network.tulpa.resolution\"}",
+        "signatureBase": "ink/0.1\nPOST\n/ink/v1/did:plc:alice123test/resolution\ndid:plc:alice123test\n{\"intentRef\":\"msg-intent-001\",\"nonce\":\"cmVzb2x1dGlvbi0ZGVjbGluZWQ\",\"outcome\":\"declined\",\"protocol\":\"ink/0.1\",\"timestamp\":\"2026-03-25T12:05:00Z\",\"type\":\"network.tulpa.resolution\"}\n2026-03-25T12:05:00Z",
+        "signatureBase64url": "rlhcLWtcp2wXqxBVAbfyU9er-EBs2fUqZDfIrqOkwH9yuNgplawXP73IVQHFUmYa6fS1amlU2MXzgRPmYD73Dw",
+        "accepted": true
+      }
+    },
+    {
+      "id": "resolution-escalated_to_human",
+      "description": "Bob sends a 'escalated_to_human' resolution to Alice (Stage 3)",
+      "input": {
+        "method": "POST",
+        "path": "/ink/v1/did:plc:alice123test/resolution",
+        "recipientDid": "did:plc:alice123test",
+        "body": {
+          "protocol": "ink/0.1",
+          "type": "network.tulpa.resolution",
+          "intentRef": "msg-intent-001",
+          "outcome": "escalated_to_human",
+          "nonce": "cmVzb2x1dGlvbi0ZXNjYWxhdGVkX3RvX2h1bWFu",
+          "timestamp": "2026-03-25T12:05:00Z"
+        },
+        "timestamp": "2026-03-25T12:05:00Z",
+        "signerPrivateKeyHex": "4ea0adf03599751231c1c3b7fc5a6c9d2e2f2f97bcd7c885c0add2f47b9af181"
+      },
+      "expected": {
+        "canonicalBody": "{\"intentRef\":\"msg-intent-001\",\"nonce\":\"cmVzb2x1dGlvbi0ZXNjYWxhdGVkX3RvX2h1bWFu\",\"outcome\":\"escalated_to_human\",\"protocol\":\"ink/0.1\",\"timestamp\":\"2026-03-25T12:05:00Z\",\"type\":\"network.tulpa.resolution\"}",
+        "signatureBase": "ink/0.1\nPOST\n/ink/v1/did:plc:alice123test/resolution\ndid:plc:alice123test\n{\"intentRef\":\"msg-intent-001\",\"nonce\":\"cmVzb2x1dGlvbi0ZXNjYWxhdGVkX3RvX2h1bWFu\",\"outcome\":\"escalated_to_human\",\"protocol\":\"ink/0.1\",\"timestamp\":\"2026-03-25T12:05:00Z\",\"type\":\"network.tulpa.resolution\"}\n2026-03-25T12:05:00Z",
+        "signatureBase64url": "n0N6c0GCsDq3boAvM2jnN1Fyx4xTNy5HUrL8w5nLJ5NK_U-VXHVjIgLcNeb-eDvsXPHloizs7jIhiZfX6LzmBg",
+        "accepted": true
+      }
+    },
+    {
+      "id": "resolution-expired",
+      "description": "Bob sends a 'expired' resolution to Alice (Stage 3)",
+      "input": {
+        "method": "POST",
+        "path": "/ink/v1/did:plc:alice123test/resolution",
+        "recipientDid": "did:plc:alice123test",
+        "body": {
+          "protocol": "ink/0.1",
+          "type": "network.tulpa.resolution",
+          "intentRef": "msg-intent-001",
+          "outcome": "expired",
+          "nonce": "cmVzb2x1dGlvbi0ZXhwaXJlZA",
+          "timestamp": "2026-03-25T12:05:00Z"
+        },
+        "timestamp": "2026-03-25T12:05:00Z",
+        "signerPrivateKeyHex": "4ea0adf03599751231c1c3b7fc5a6c9d2e2f2f97bcd7c885c0add2f47b9af181"
+      },
+      "expected": {
+        "canonicalBody": "{\"intentRef\":\"msg-intent-001\",\"nonce\":\"cmVzb2x1dGlvbi0ZXhwaXJlZA\",\"outcome\":\"expired\",\"protocol\":\"ink/0.1\",\"timestamp\":\"2026-03-25T12:05:00Z\",\"type\":\"network.tulpa.resolution\"}",
+        "signatureBase": "ink/0.1\nPOST\n/ink/v1/did:plc:alice123test/resolution\ndid:plc:alice123test\n{\"intentRef\":\"msg-intent-001\",\"nonce\":\"cmVzb2x1dGlvbi0ZXhwaXJlZA\",\"outcome\":\"expired\",\"protocol\":\"ink/0.1\",\"timestamp\":\"2026-03-25T12:05:00Z\",\"type\":\"network.tulpa.resolution\"}\n2026-03-25T12:05:00Z",
+        "signatureBase64url": "eu9c-cNHGxsjRp1m4SW5NS0J5fHnYfaRt1akSWLwMIXIqrkTX0hrshEIFmQMUg5iiEad6h_p6rQuFT98ixavDg",
+        "accepted": true
+      }
+    },
+    {
+      "id": "resolution-invalid-path",
+      "description": "Resolution signature fails when verified against /challenge path",
+      "input": {
+        "method": "POST",
+        "path": "/ink/v1/did:plc:alice123test/challenge",
+        "recipientDid": "did:plc:alice123test",
+        "body": {
+          "protocol": "ink/0.1",
+          "type": "network.tulpa.resolution",
+          "intentRef": "msg-intent-001",
+          "outcome": "accepted",
+          "details": {
+            "scheduledAt": "2026-04-01T15:00:00Z",
+            "duration": "30m"
+          },
+          "nonce": "cmVzb2x1dGlvbi0YWNjZXB0ZWQ",
+          "timestamp": "2026-03-25T12:05:00Z"
+        },
+        "timestamp": "2026-03-25T12:05:00Z",
+        "originalSignatureBase64url": "Gz7YiTPogpiTpTq0FttCq1tFtNA6bkeut7h-55nsu2xpZTd0vraF6hmmmyfTojtRzVfeMu7XOXIK4qIQJt7gDg"
+      },
+      "expected": {
+        "accepted": false,
+        "reason": "Signature was computed over /resolution but verified against /challenge"
+      }
+    },
+    {
+      "id": "resolution-invalid-recipient",
+      "description": "Resolution signature fails when verified with wrong recipient DID",
+      "input": {
+        "method": "POST",
+        "path": "/ink/v1/did:plc:alice123test/resolution",
+        "recipientDid": "did:plc:mallory999",
+        "body": {
+          "protocol": "ink/0.1",
+          "type": "network.tulpa.resolution",
+          "intentRef": "msg-intent-001",
+          "outcome": "accepted",
+          "details": {
+            "scheduledAt": "2026-04-01T15:00:00Z",
+            "duration": "30m"
+          },
+          "nonce": "cmVzb2x1dGlvbi0YWNjZXB0ZWQ",
+          "timestamp": "2026-03-25T12:05:00Z"
+        },
+        "timestamp": "2026-03-25T12:05:00Z",
+        "originalSignatureBase64url": "Gz7YiTPogpiTpTq0FttCq1tFtNA6bkeut7h-55nsu2xpZTd0vraF6hmmmyfTojtRzVfeMu7XOXIK4qIQJt7gDg"
+      },
+      "expected": {
+        "accepted": false,
+        "reason": "recipientDid mismatch"
+      }
+    },
+    {
+      "id": "resolution-tampered-outcome",
+      "description": "Resolution signature fails when outcome is tampered",
+      "input": {
+        "method": "POST",
+        "path": "/ink/v1/did:plc:alice123test/resolution",
+        "recipientDid": "did:plc:alice123test",
+        "body": {
+          "protocol": "ink/0.1",
+          "type": "network.tulpa.resolution",
+          "intentRef": "msg-intent-001",
+          "outcome": "declined",
+          "details": {
+            "scheduledAt": "2026-04-01T15:00:00Z",
+            "duration": "30m"
+          },
+          "nonce": "cmVzb2x1dGlvbi0YWNjZXB0ZWQ",
+          "timestamp": "2026-03-25T12:05:00Z"
+        },
+        "timestamp": "2026-03-25T12:05:00Z",
+        "originalSignatureBase64url": "Gz7YiTPogpiTpTq0FttCq1tFtNA6bkeut7h-55nsu2xpZTd0vraF6hmmmyfTojtRzVfeMu7XOXIK4qIQJt7gDg"
+      },
+      "expected": {
+        "accepted": false,
+        "reason": "Body was modified after signing"
+      }
+    },
+    {
+      "id": "resolution-timestamp-expired",
+      "description": "Resolution rejected — timestamp expired",
+      "input": {
+        "messageTimestamp": "2026-03-25T11:50:00Z",
+        "receiverClock": "2026-03-25T12:00:00Z",
+        "nonce": "cmVzZXhwaXJlZA"
+      },
+      "expected": {
+        "accepted": false,
+        "errorCode": "expired_message"
+      }
+    },
+    {
+      "id": "resolution-duplicate-nonce",
+      "description": "Resolution rejected — duplicate nonce",
+      "input": {
+        "messageTimestamp": "2026-03-25T12:05:00Z",
+        "receiverClock": "2026-03-25T12:05:00Z",
+        "nonce": "cmVzZHVwbm9uY2U",
+        "previouslySeenNonces": [
+          "cmVzZHVwbm9uY2U"
+        ]
+      },
+      "expected": {
+        "accepted": false,
+        "errorCode": "duplicate_nonce"
+      }
+    }
+  ]
+}

package/test-vectors/jcs.json

@@ -0,0 +1,30 @@
+{
+  "description": "JCS (RFC 8785) canonicalization test cases for INK message signing",
+  "vectors": [
+    {
+      "description": "Intent message — keys sorted lexicographically, no whitespace",
+      "input": {
+        "protocol": "ink/0.1",
+        "type": "network.tulpa.intent",
+        "from": "did:plc:alice123test",
+        "to": "did:plc:bob456test",
+        "intentType": "scheduling",
+        "purpose": "Discuss partnership opportunity",
+        "urgency": "normal",
+        "expiresAt": "2026-03-25T00:00:00Z",
+        "nonce": "dGVzdG5vbmNlMTIzNDU2Nzg",
+        "timestamp": "2026-03-18T12:00:00Z"
+      },
+      "expectedCanonical": "{\"expiresAt\":\"2026-03-25T00:00:00Z\",\"from\":\"did:plc:alice123test\",\"intentType\":\"scheduling\",\"nonce\":\"dGVzdG5vbmNlMTIzNDU2Nzg\",\"protocol\":\"ink/0.1\",\"purpose\":\"Discuss partnership opportunity\",\"timestamp\":\"2026-03-18T12:00:00Z\",\"to\":\"did:plc:bob456test\",\"type\":\"network.tulpa.intent\",\"urgency\":\"normal\"}"
+    },
+    {
+      "description": "Empty details object",
+      "input": {
+        "protocol": "ink/0.1",
+        "details": {},
+        "type": "network.tulpa.resolution"
+      },
+      "expectedCanonical": "{\"details\":{},\"protocol\":\"ink/0.1\",\"type\":\"network.tulpa.resolution\"}"
+    }
+  ]
+}

package/test-vectors/key-rotation.json

@@ -0,0 +1,101 @@
+{
+  "description": "INK v0.1 key rotation test vectors — auth header keyId extension, rotated-key verification, revoked-key rejection and refresh-on-miss. All scenarios use runtime-generated keys (not static fixtures) and are exercised by test/ink-key-rotation.test.ts.",
+  "vectors": [
+    {
+      "id": "auth-header-with-keyid",
+      "description": "Authorization header includes optional keyId parameter after signature",
+      "format": "INK-Ed25519 <base64url(sig)> keyId=<keyId>",
+      "regex": "^INK-Ed25519\\s+(\\S+)(?:\\s+keyId=(\\S+))?$",
+      "examples": [
+        {
+          "header": "INK-Ed25519 abc123 keyId=sig-2026-03",
+          "signature": "abc123",
+          "keyId": "sig-2026-03"
+        },
+        {
+          "header": "INK-Ed25519 abc123",
+          "signature": "abc123",
+          "keyId": null,
+          "note": "Legacy format — no keyId"
+        }
+      ]
+    },
+    {
+      "id": "rotated-key-verification",
+      "description": "After rotation, new key signs messages. Verifier with [old=retired, new=active] keyset accepts.",
+      "scenario": {
+        "step1": "Agent generates keyV1, signs messages",
+        "step2": "Agent rotates: keyV1 retired, keyV2 active, keyV1 private wiped",
+        "step3": "Agent signs with keyV2, includes keyId=sig-v2 in auth header",
+        "step4": "Counterparty resolves keyset from Agent Card: [sig-v1=retired, sig-v2=active]",
+        "step5": "verifyInkSignatureWithKeys with hintKeyId=sig-v2 → verified=true, keyId=sig-v2"
+      }
+    },
+    {
+      "id": "historical-message-verification",
+      "description": "Messages signed before rotation still verify against retired key in keyset",
+      "scenario": {
+        "step1": "Message signed with keyV1 at T=2026-03-20",
+        "step2": "Key rotated at T=2026-03-25: keyV1 retired, keyV2 active",
+        "step3": "Counterparty verifies old message with keyset [sig-v1=retired, sig-v2=active]",
+        "step4": "verifyInkSignatureWithKeys with hintKeyId=sig-v1 → verified=true, keyStatus=retired"
+      }
+    },
+    {
+      "id": "revoked-key-rejection",
+      "description": "Messages signed with a revoked key are rejected even if cryptographically valid",
+      "scenario": {
+        "step1": "Agent has [sig-compromised=revoked, sig-current=active]",
+        "step2": "Attacker signs message with compromised key, sets keyId=sig-compromised",
+        "step3": "verifyInkSignatureWithKeys skips revoked keys",
+        "step4": "Result: verified=false"
+      }
+    },
+    {
+      "id": "refresh-on-miss",
+      "description": "When all cached keys fail to verify, receiver refetches Agent Card and retries",
+      "scenario": {
+        "step1": "Receiver has stale cache with only keyV1",
+        "step2": "Sender rotated to keyV2 and signs message with it",
+        "step3": "Verification against stale keyset [sig-v1=active] → fails",
+        "step4": "Receiver fetches fresh Agent Card: [sig-v1=retired, sig-v2=active]",
+        "step5": "Retry verification → verified=true, keyId=sig-v2"
+      },
+      "constraints": {
+        "maxRetries": 1,
+        "note": "Only one refresh attempt per verification to prevent infinite loops"
+      }
+    },
+    {
+      "id": "keyid-precedence",
+      "description": "When keyId appears in both auth header and message body (signingKeyId), the auth header takes precedence for verification hint",
+      "scenario": {
+        "headerKeyId": "sig-header",
+        "bodySigningKeyId": "sig-body",
+        "verificationHint": "sig-header",
+        "note": "Header is transport-layer; body is application-layer. Transport takes precedence for the verifier."
+      }
+    },
+    {
+      "id": "unknown-keyid-fallthrough",
+      "description": "When header keyId references a key not in the keyset, verifier falls through to normal iteration",
+      "scenario": {
+        "headerKeyId": "sig-unknown",
+        "keyset": [
+          {"keyId": "sig-actual", "status": "active"}
+        ],
+        "result": "Hinted key not found → skip hint → iterate active keys → verified with sig-actual"
+      }
+    },
+    {
+      "id": "audit-event-signing-key-tracking",
+      "description": "INK audit events record signingKeyId in data field so historical events can be verified against the correct key",
+      "schema": {
+        "data": {
+          "signingKeyId": "sig-v2",
+          "note": "Verifiers use this to select the correct key from the agent's historical keyset"
+        }
+      }
+    }
+  ]
+}

package/test-vectors/keys.json

@@ -0,0 +1,32 @@
+{
+  "description": "Fixed key material for INK v0.1 test vectors. NOT for production use.",
+  "alice": {
+    "did": "did:plc:alice123test",
+    "agentId": "agent-alice-01",
+    "signing": {
+      "publicKeyHex": "16d8c7758b7816f4540730fa5b01921bfa0c52459e435b8f970cd8ef3e548fba",
+      "privateKeyHex": "02362f546f26d9c252c9209d1218e3174654b04b5f08f2ee2b3fa7874111d086"
+    },
+    "encryption": {
+      "publicKeyHex": "3e24f178fa03cff75136b485611e53c37d628205b13bc53d7bd5415e3d1d7472",
+      "privateKeyHex": "b0691398c0e6254015c3d17c18268faf42bc4ae831ae249b7773437977e62f6c"
+    }
+  },
+  "bob": {
+    "did": "did:plc:bob456test",
+    "agentId": "agent-bob-01",
+    "signing": {
+      "publicKeyHex": "11dce4522822fffcb059f547b9e0b16bb8f47084fec275b46f813701273c014b",
+      "privateKeyHex": "4ea0adf03599751231c1c3b7fc5a6c9d2e2f2f97bcd7c885c0add2f47b9af181"
+    },
+    "encryption": {
+      "publicKeyHex": "613ca2aa2ff1102e440dd05ead7f05c11ea440d1109f3d058f9e5302cbf26f0b",
+      "privateKeyHex": "986e5e08b69232b6c888c838ada1669139c2993db417b482a780b86f067d8658"
+    }
+  },
+  "ephemeral": {
+    "note": "Ephemeral X25519 key pair for encryption test vector (INK §3.4.0 step 1)",
+    "publicKeyHex": "50bf0e81d5e4475282ed7739da2772594fb0d24816258dbceec766e580c5454b",
+    "privateKeyHex": "40fa01588b6f88871ad04a49fef0215fa00d79f2f5bb33cb3ee9742853601077"
+  }
+}