@aep-foundation/conformance 0.1.0

package/fixtures/aep-specs/schemas/platform-agent-identity.schema.json

@@ -0,0 +1,60 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.aep.foundation/schemas/platform-agent-identity.schema.json",
+  "title": "AEP Platform Agent Identity",
+  "type": "object",
+  "required": [
+    "agent_did",
+    "agent_identity_id",
+    "created_at",
+    "did_document_url",
+    "key_id",
+    "service_did",
+    "signing_algorithms",
+    "status",
+    "updated_at"
+  ],
+  "additionalProperties": true,
+  "properties": {
+    "agent_did": {
+      "type": "string",
+      "pattern": "^did:"
+    },
+    "agent_identity_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "created_at": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "did_document_url": {
+      "type": "string",
+      "pattern": "^https://"
+    },
+    "key_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "service_did": {
+      "type": "string",
+      "pattern": "^did:"
+    },
+    "signing_algorithms": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "string",
+        "enum": ["EdDSA", "ES256"]
+      }
+    },
+    "status": {
+      "type": "string",
+      "enum": ["active", "revoked", "suspended", "terminated"]
+    },
+    "updated_at": {
+      "type": "string",
+      "format": "date-time"
+    }
+  }
+}

package/fixtures/aep-specs/schemas/platform-discovery.schema.json

@@ -0,0 +1,107 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.aep.foundation/schemas/platform-discovery.schema.json",
+  "title": "AEP Platform Discovery Document",
+  "type": "object",
+  "required": ["aep_version", "endpoints", "http", "identity", "platform", "signing"],
+  "additionalProperties": true,
+  "properties": {
+    "aep_version": {
+      "type": "string",
+      "pattern": "^[0-9]+\\.[0-9]+$"
+    },
+    "endpoints": {
+      "type": "object",
+      "required": ["lifecycle", "provision", "sign", "list"],
+      "additionalProperties": true,
+      "properties": {
+        "hosted_verification": {
+          "type": "string",
+          "pattern": "^/"
+        },
+        "lifecycle": {
+          "type": "string",
+          "pattern": "^/"
+        },
+        "provision": {
+          "type": "string",
+          "pattern": "^/"
+        },
+        "sign": {
+          "type": "string",
+          "pattern": "^/"
+        },
+        "list": {
+          "type": "string",
+          "pattern": "^/"
+        }
+      }
+    },
+    "http": {
+      "type": "object",
+      "required": ["endpoint_base"],
+      "additionalProperties": true,
+      "properties": {
+        "endpoint_base": {
+          "type": "string",
+          "pattern": "^/"
+        }
+      }
+    },
+    "identity": {
+      "type": "object",
+      "required": ["did_methods", "did_url_template"],
+      "additionalProperties": true,
+      "properties": {
+        "did_methods": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string"
+          }
+        },
+        "did_url_template": {
+          "type": "string",
+          "pattern": "^https://"
+        }
+      }
+    },
+    "platform": {
+      "type": "object",
+      "required": ["hosted_verification", "name"],
+      "additionalProperties": true,
+      "properties": {
+        "did": {
+          "type": "string",
+          "pattern": "^did:"
+        },
+        "hosted_verification": {
+          "type": "boolean"
+        },
+        "name": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "signing": {
+      "type": "object",
+      "required": ["algorithms", "default_lifetime_seconds"],
+      "additionalProperties": true,
+      "properties": {
+        "algorithms": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "enum": ["EdDSA", "ES256"]
+          }
+        },
+        "default_lifetime_seconds": {
+          "type": "string",
+          "pattern": "^(?:[1-9][0-9]?|[12][0-9]{2}|300)$"
+        }
+      }
+    }
+  }
+}

package/fixtures/aep-specs/schemas/platform-lifecycle-request.schema.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.aep.foundation/schemas/platform-lifecycle-request.schema.json",
+  "title": "AEP Platform Lifecycle Request",
+  "type": "object",
+  "required": ["status"],
+  "additionalProperties": false,
+  "properties": {
+    "status": {
+      "type": "string",
+      "enum": ["active", "revoked", "suspended", "terminated"]
+    }
+  }
+}

package/fixtures/aep-specs/schemas/platform-lifecycle-response.schema.json

@@ -0,0 +1,60 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.aep.foundation/schemas/platform-lifecycle-response.schema.json",
+  "title": "AEP Platform Lifecycle Response",
+  "type": "object",
+  "required": [
+    "agent_did",
+    "agent_identity_id",
+    "created_at",
+    "did_document_url",
+    "key_id",
+    "service_did",
+    "signing_algorithms",
+    "status",
+    "updated_at"
+  ],
+  "additionalProperties": true,
+  "properties": {
+    "agent_did": {
+      "type": "string",
+      "pattern": "^did:"
+    },
+    "agent_identity_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "created_at": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "did_document_url": {
+      "type": "string",
+      "pattern": "^https://"
+    },
+    "key_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "service_did": {
+      "type": "string",
+      "pattern": "^did:"
+    },
+    "signing_algorithms": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "string",
+        "enum": ["EdDSA", "ES256"]
+      }
+    },
+    "status": {
+      "type": "string",
+      "enum": ["active", "revoked", "suspended", "terminated"]
+    },
+    "updated_at": {
+      "type": "string",
+      "format": "date-time"
+    }
+  }
+}

package/fixtures/aep-specs/schemas/platform-provision-request.schema.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.aep.foundation/schemas/platform-provision-request.schema.json",
+  "title": "AEP Platform Provision Request",
+  "type": "object",
+  "required": ["idempotency_key", "service_did"],
+  "additionalProperties": false,
+  "properties": {
+    "idempotency_key": {
+      "type": "string",
+      "minLength": 1
+    },
+    "service_did": {
+      "type": "string",
+      "pattern": "^did:"
+    }
+  }
+}

package/fixtures/aep-specs/schemas/platform-sign-request.schema.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.aep.foundation/schemas/platform-sign-request.schema.json",
+  "title": "AEP Platform Sign Request",
+  "type": "object",
+  "required": ["jti", "op", "service_did"],
+  "additionalProperties": false,
+  "properties": {
+    "jti": {
+      "type": "string",
+      "minLength": 1
+    },
+    "op": {
+      "type": "string",
+      "enum": ["enroll", "grant", "revoke", "status"]
+    },
+    "service_did": {
+      "type": "string",
+      "pattern": "^did:"
+    },
+    "lifetime_seconds": {
+      "type": "string",
+      "pattern": "^(?:[1-9][0-9]?|[12][0-9]{2}|300)$"
+    }
+  }
+}

package/fixtures/aep-specs/schemas/platform-sign-response.schema.json

@@ -0,0 +1,34 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.aep.foundation/schemas/platform-sign-response.schema.json",
+  "title": "AEP Platform Sign Response",
+  "type": "object",
+  "required": ["agent_did", "client_assertion", "expires_at", "issued_at", "jti", "service_did"],
+  "additionalProperties": true,
+  "properties": {
+    "agent_did": {
+      "type": "string",
+      "pattern": "^did:"
+    },
+    "client_assertion": {
+      "type": "string",
+      "minLength": 1
+    },
+    "expires_at": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "issued_at": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "jti": {
+      "type": "string",
+      "minLength": 1
+    },
+    "service_did": {
+      "type": "string",
+      "pattern": "^did:"
+    }
+  }
+}

package/fixtures/aep-specs/schemas/platform-verification-request.schema.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.aep.foundation/schemas/platform-verification-request.schema.json",
+  "title": "AEP Platform Verification Request",
+  "type": "object",
+  "required": ["client_assertion", "op", "service_did"],
+  "additionalProperties": false,
+  "properties": {
+    "client_assertion": {
+      "type": "string",
+      "minLength": 1
+    },
+    "op": {
+      "type": "string",
+      "enum": ["enroll", "grant", "revoke", "status"]
+    },
+    "service_did": {
+      "type": "string",
+      "pattern": "^did:"
+    }
+  }
+}

package/fixtures/aep-specs/schemas/platform-verification-response.schema.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.aep.foundation/schemas/platform-verification-response.schema.json",
+  "title": "AEP Platform Verification Response",
+  "type": "object",
+  "required": ["reason", "service_did", "verified"],
+  "additionalProperties": true,
+  "properties": {
+    "agent_did": {
+      "type": "string",
+      "pattern": "^did:"
+    },
+    "agent_identity_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "op": {
+      "type": "string",
+      "enum": ["enroll", "grant", "revoke", "status"]
+    },
+    "reason": {
+      "type": "string",
+      "enum": ["not_recognized", "verified"]
+    },
+    "service_did": {
+      "type": "string",
+      "pattern": "^did:"
+    },
+    "status": {
+      "type": "string",
+      "enum": ["active", "revoked", "suspended", "terminated"]
+    },
+    "verified": {
+      "type": "boolean"
+    }
+  }
+}

package/fixtures/aep-specs/schemas/problem.schema.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.aep.foundation/schemas/problem.schema.json",
+  "title": "AEP Problem Details",
+  "type": "object",
+  "required": ["type", "title", "status", "code"],
+  "additionalProperties": true,
+  "properties": {
+    "type": {
+      "type": "string",
+      "pattern": "^urn:aep:error:"
+    },
+    "title": {
+      "type": "string",
+      "minLength": 1
+    },
+    "status": {
+      "type": "integer"
+    },
+    "code": {
+      "type": "string",
+      "minLength": 1
+    }
+  }
+}

package/fixtures/aep-specs/schemas/revoke-request.schema.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.aep.foundation/schemas/revoke-request.schema.json",
+  "title": "AEP Revoke Request",
+  "type": "object",
+  "additionalProperties": true,
+  "oneOf": [
+    {
+      "required": ["grant_type"]
+    },
+    {
+      "required": ["credential_id"]
+    },
+    {
+      "required": ["all_grant_types"]
+    }
+  ],
+  "properties": {
+    "grant_type": {
+      "type": "string",
+      "minLength": 1
+    },
+    "credential_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "all_grant_types": {
+      "type": "string",
+      "enum": ["true"]
+    }
+  }
+}

package/fixtures/aep-specs/schemas/revoke-response.schema.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.aep.foundation/schemas/revoke-response.schema.json",
+  "title": "AEP Revoke Response",
+  "type": "object",
+  "additionalProperties": false
+}

package/fixtures/aep-specs/schemas/status-response.schema.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.aep.foundation/schemas/status-response.schema.json",
+  "title": "AEP Status Response",
+  "type": "object",
+  "required": ["status"],
+  "additionalProperties": true,
+  "properties": {
+    "status": {
+      "type": "string",
+      "enum": ["active", "pending", "unavailable", "suspended", "terminated", "rejected"]
+    },
+    "owner_action_required": {
+      "type": "string",
+      "enum": ["true", "false"]
+    },
+    "requirements_pending": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "since": {
+      "type": "string",
+      "format": "date-time"
+    }
+  }
+}

package/fixtures/aep-specs/test-vectors/README.md

@@ -0,0 +1,100 @@
+# AEP Test Vectors
+
+This directory contains deterministic test vectors for the currently published
+AEP Internet-Draft set.
+
+The initial vector set should cover:
+
+| Category                | Purpose                                                                                                                                                             | Draft Coverage                |
+| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- |
+| Inspect document        | Validate required fields, command advertisement, grant type advertisement, `did:web`, HTTP binding configuration, and extension discovery shape.                    | Core                          |
+| Client assertion JWT    | Validate JOSE header fields, JWT claim fields, `aud`, `op`, `iat`, `exp`, and `jti` requirements.                                                                   | Core                          |
+| Error response          | Validate AEP Problem Details shape and stable error codes.                                                                                                          | Core                          |
+| Idempotency             | Validate safe retry shape and idempotency conflict behavior.                                                                                                        | Core                          |
+| Enroll request/response | Validate minimal enrollment request and response shape.                                                                                                             | Core                          |
+| Status response         | Validate enrolled identity status response shape.                                                                                                                   | Core                          |
+| Grant/Revoke request    | Validate shared Grant and Revoke request fields, including revoke-all behavior.                                                                                     | Core plus credential profiles |
+| OAuth Bearer credential | Validate OAuth Bearer Grant response, presentation syntax, expiry, scopes, and Revoke shape.                                                                        | OAuth Bearer                  |
+| API-key credential      | Validate API-key Grant response, API-key value syntax, header selection, expiry, scopes, and Revoke shape.                                                          | API-key                       |
+| Basic credential        | Validate Basic Grant response, generated username/password constraints, Basic presentation syntax, expiry, scopes, and Revoke shape.                                | Basic                         |
+| Platform specification  | Validate Platform discovery, Service-scoped Agent DID provisioning, distinct opaque DIDs per Service, delegated signing, lifecycle, and hosted verification shapes. | Platform Hosted Identity      |
+
+## File Layout
+
+Vectors use one directory per category:
+
+```text
+test-vectors/
+  inspect/
+  client-assertion/
+  errors/
+  idempotency/
+  enroll/
+  status/
+  grant-revoke/
+  platform/
+  credentials/
+    oauth-bearer/
+    api-key/
+    basic/
+```
+
+Each vector file is JSON. File names use lowercase hyphenated identifiers:
+
+```text
+<category>/<vector-id>.json
+```
+
+## Vector Format
+
+Each vector has this top-level shape:
+
+```json
+{
+  "id": "inspect-minimal-http",
+  "title": "Minimal HTTP Inspect document",
+  "description": "A Service advertising the baseline HTTP binding and current credential profiles.",
+  "drafts": ["draft-kavian-agent-enrollment-protocol-01"],
+  "category": "inspect",
+  "applies_to": ["agent", "service"],
+  "profile": "core-http",
+  "input": {},
+  "expected": {}
+}
+```
+
+Required fields:
+
+| Field         | Requirement                                                                     |
+| ------------- | ------------------------------------------------------------------------------- |
+| `id`          | Lowercase hyphenated vector identifier.                                         |
+| `title`       | Short human-readable name.                                                      |
+| `description` | One- or two-sentence explanation of the behavior under test.                    |
+| `drafts`      | Draft identifiers covered by the vector.                                        |
+| `category`    | Vector category.                                                                |
+| `applies_to`  | Array containing `agent`, `service`, or both.                                   |
+| `profile`     | `core-http`, `platform-hosted-identity`, `oauth-bearer`, `api-key`, or `basic`. |
+| `input`       | Test input object.                                                              |
+| `expected`    | Expected output or validation result object.                                    |
+
+## Validation Rules
+
+A vector validator should check at least:
+
+- JSON parseability.
+- File path matches `category` and `id`.
+- `id` uses lowercase hyphenated syntax.
+- `drafts` contains only published AEP draft identifiers.
+- `category` is one of the known vector categories.
+- `applies_to` contains only known roles.
+- `profile` is one of the known profiles.
+- `input` and `expected` are JSON objects.
+
+The validator should not require live network access. Network-dependent checks
+belong in the future conformance harness, not in static vector validation.
+
+Run static vector validation with:
+
+```sh
+make -C ietf check-vectors
+```

package/fixtures/aep-specs/test-vectors/client-assertion/enroll-claims.json

@@ -0,0 +1,26 @@
+{
+  "id": "enroll-claims",
+  "title": "Client assertion claims for Enroll",
+  "description": "A valid baseline AEP client assertion claim set for an Enroll command.",
+  "drafts": ["draft-kavian-agent-enrollment-protocol-01"],
+  "category": "client-assertion",
+  "applies_to": ["agent", "service"],
+  "profile": "core-http",
+  "input": {
+    "service_did": "did:web:api.example.com",
+    "agent_did": "did:web:agent.example.com:agents:123",
+    "command": "enroll",
+    "issued_at": 1748428800,
+    "expires_at": 1748429100,
+    "jti": "01J0AEPVECTORENROLL0000000001"
+  },
+  "expected": {
+    "iss": "did:web:agent.example.com:agents:123",
+    "sub": "did:web:agent.example.com:agents:123",
+    "aud": "did:web:api.example.com",
+    "op": "enroll",
+    "iat": 1748428800,
+    "exp": 1748429100,
+    "jti": "01J0AEPVECTORENROLL0000000001"
+  }
+}

package/fixtures/aep-specs/test-vectors/credentials/api-key/grant-response.json

@@ -0,0 +1,20 @@
+{
+  "id": "grant-response",
+  "title": "API-key Grant response",
+  "description": "A successful API-key session-credential response.",
+  "drafts": ["draft-kavian-aep-api-key-session-credential-01"],
+  "category": "credentials/api-key",
+  "applies_to": ["agent", "service"],
+  "profile": "api-key",
+  "input": {
+    "grant_type": "api-key",
+    "requested_scopes": ["read"]
+  },
+  "expected": {
+    "api_key": "aep_live_7Jm5Example",
+    "credential_id": "key_01HZY8W7Q2F8J7D3P9G9Z1N6TT",
+    "expires_at": "2026-12-01T00:00:00Z",
+    "header": "x-api-key",
+    "scopes": ["read"]
+  }
+}

package/fixtures/aep-specs/test-vectors/credentials/basic/grant-response.json

@@ -0,0 +1,21 @@
+{
+  "id": "grant-response",
+  "title": "Basic Grant response",
+  "description": "A successful HTTP Basic session-credential response.",
+  "drafts": ["draft-kavian-aep-basic-session-credential-01"],
+  "category": "credentials/basic",
+  "applies_to": ["agent", "service"],
+  "profile": "basic",
+  "input": {
+    "grant_type": "basic",
+    "requested_scopes": ["read"]
+  },
+  "expected": {
+    "credential_id": "bas_01HZY8W7Q2F8J7D3P9G9Z1N6TT",
+    "expires_at": "2026-12-01T00:00:00Z",
+    "password": "s3cr3tExample",
+    "realm": "api.example.com",
+    "scopes": ["read"],
+    "username": "aep_agent_abc123"
+  }
+}