@aicent/iqa 1.3.1 → 1.3.2

package/README.md

@@ -4,7 +4,7 @@
 derivation, action safety classes, the AE-128 fixed attestation envelope -- and
 the published conformance vectors that prove an implementation is right.**
 
-[AICENT-009 sec. 10](https://iqa.org/AICENT-009/) - sec. 11 - stack v1.2.6 - zero dependencies - no build step
+[AICENT-009 sec. 10](https://iqa.org/URI/) - sec. 11 - stack v1.2.6 - zero dependencies - no build step
 
 ---
 
@@ -28,7 +28,8 @@ The vectors cover the `iqa://` grammar (AICENT-009 sec. 10.2), the **closed sets
 (`organ` and `action` -- the deliberate difference from `rttp`, whose verb set
 is open), the sec. 11.3 action safety classes, the `IQA_ROUTE` derivation, **and**
 the deterministic Ed25519 attestation envelope -- replayed by both
-implementations. The AE-128 envelope (companion draft v0.3) ships with its own
+implementations. The AE-128 envelope (normative layout: draft-02 sec. 7.2)
+ships with its own
 published vector and full fail-closed matrix under `@aicent/iqa/envelope`.
 
 ### The other half -- Python, on PyPI
@@ -241,7 +242,7 @@ starts agreeing with its own bugs.
 | OK **IQA_ROUTE derivation** | Real (SPEC sec. 3, decision D1). |
 | OK **Action safety classes** | Real, and specified (sec. 11.3). |
 | OK **Conformance vectors + independent replay** | Published and generated. |
-| OK **AE-128 fixed envelope** | Real, and specified (companion draft v0.3, implemented to the byte). |
+| OK **AE-128 fixed envelope** | Real, and specified (draft-02 sec. 7.2, implemented to the byte). |
 | NO **Dereferencing / resolver service** | Not here. The codec computes; *answering* a standing read is an Organ's job (AICENT-009-C sec. 3). |
 | NO **Staking, tiers, vitality** | Operator economics and telemetry -- AICENT-009 narrative, no cryptographic object in this package. |
 | NO **Post-quantum Lattice Guard** | AICENT-009 sec. 12 #11 schedules it for v1.4.0; no implementation exists. |
@@ -254,7 +255,7 @@ starts agreeing with its own bugs.
 
 | Ecosystem | Name | Status |
 |:---|:---|:---|
-| crates.io | **`iqa-org`** | **published** -- `1.3.1`, the first formal (non-pre-release) publication of the crate; Cargo selects it from a plain `iqa-org` requirement. The earlier `1.2.8-alpha` remains published and is not yanked. |
+| crates.io | **`iqa-org`** | **published** -- `1.3.2`; the first formal (non-pre-release) publication of the crate was `1.3.1`; Cargo selects it from a plain `iqa-org` requirement. The earlier `1.2.8-alpha` remains published and is not yanked. |
 | PyPI | **`iqa-org`** | **published** -- the Python reference implementation; `pip install iqa-org` (bare `iqa` blocked by PyPI's typosquatting protection, same class of guard as npm) |
 | npm | **`@aicent/iqa`** | the bare `iqa` name is unregistered but **blocked by npm's typosquatting protection** (too similar to existing short names) -- so this package is published under the organization this project controls, as `@aicent/rttp` already is. The package name itself is still just `iqa`. |
 
@@ -262,26 +263,30 @@ starts agreeing with its own bugs.
 
 ## Specification status
 
-* **`iqa` URI scheme** -- submitted to IANA under RFC 7595, ticket **#1459963**:
-  the scheme **name is approved**; the CRI number is in expert review. It is
-  **not yet registered** -- as of 2026-10-04 the IANA "URI Schemes" registry
-  contains no `iqa` entry. Please describe it that way. (The sibling `rttp`
-  scheme **is** registered: Provisional, CRI 27.)
+* **`iqa` URI scheme** -- **registered**: IANA "URI Schemes" registry,
+  Provisional, **CRI 28** (2026-10-13), submitted under RFC 7595
+  (ticket **#1459963**). (The sibling `rttp` scheme is registered:
+  Provisional, CRI 27.)
 * **Internet-Draft (IETF)** -- under IETF review as the combined Individual
-  Submission Internet-Draft `draft-li-rttp-iqa-addressing` (revision -00,
-  16 pp., 2026-09-24, informational -- both schemes, one document):
+  Submission Internet-Draft `draft-li-rttp-iqa-addressing` (revision -02,
+  40 pp., 2026-11-01, informational -- both schemes, one document):
   https://datatracker.ietf.org/doc/draft-li-rttp-iqa-addressing/ .
+  TXT sha256 `02491c5a59d1e7471be04e8e0d4933dfc22ce19f9b054ead0aa449d6b4485044`.
   An Internet-Draft is a working document -- it is not an IETF standard and
   carries no IETF endorsement.
+* **Conformance records** -- sealed runs and vector families:
+  https://iqa.org/conformance/ ; the published vector sets are pinned at
+  https://iqa.org/challenge/ .
 * **URI grammar** -- AICENT-009 sec. 10.2 (frozen; this package adds no syntax).
 * **Dereference safety** -- AICENT-009 sec. 11 (closed sets and safety classes);
   the four-state standing vocabulary is normative since v1.2.9, sec. 11.1.1.
 * **Attestation envelope** -- `SPEC/IQA-URI-ATTEST-v1.2.6.md` sec. 5, a **draft**:
   the format is implemented and vector-tested, but it is not yet a numbered
   AICENT-009 section.
-* **AE-128** -- companion draft v0.3 (`ae128-draft-v0.3.md`): implemented here
-  to the byte against the published vector. A roadmap artifact of the
-  specification line; it creates no IANA/ISE obligations.
+* **AE-128** -- normative layout: draft-li-rttp-iqa-addressing-02 sec. 7.2
+  (incorporated into the I-D; re-anchored 2026-11-09). The companion draft
+  v0.3 (`ae128-draft-v0.3.md`) remains the historical parameter sheet.
+  Implemented here to the byte against the published vector.
 
 Where this package and the specification disagree, **the specification wins
 and this package is wrong.** Please report it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aicent/iqa",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "description": "IQA for JavaScript: iqa:// subject-attestation addressing, IQA_ROUTE derivation, action safety classes, the AE-128 fixed attestation envelope -- and the published conformance vectors that prove an implementation is right.",
   "author": "IQA.ORG Organization",
   "license": "Apache-2.0",

package/src/ae128-vectors-v1.json

@@ -1,6 +1,6 @@
 {
   "schema": "iqa-ae128-vectors/1",
-  "spec": "ae128-draft-v0.3 sec. 2-6",
+  "spec": "draft-li-rttp-iqa-addressing-02 sec. 7.2",
   "generated_by": "SPEC/tools/ae128_vectors.py",
   "generated_with": "python 3.14.2 on windows",
   "how_to_reproduce": "change the cases in the generator, never the JSON",
@@ -48,7 +48,8 @@
     {
       "name": "flags 0x0001 (unassigned bit)",
       "frame_hex": "4951414501010100000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d544553540000000000000001020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-      "reject_reason": "flags"
+      "reject_reason": "flags",
+      "note": "WEAK: draft-02 sec. 7.2 (1) does not list the flags check; support = field row 'flags - unassigned; sent as 0x0000'. -03 will add flags to the MUST-reject list (owner decision 2026-11-09)"
     },
     {
       "name": "standing 0x04 (outside the closed set)",
@@ -68,7 +69,8 @@
     {
       "name": "organ tag non-ASCII (0xFF)",
       "frame_hex": "4951414501010000000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596aff52472d544553540000000000000001020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-      "reject_reason": "organ"
+      "reject_reason": "organ",
+      "note": "WEAK: draft-02 sec. 7.2 (1) does not list the organ charset check; support = field row 'organ - exactly 8 octets of US-ASCII'. -03 will add it (owner decision 2026-11-09)"
     }
   ],
   "tampered_frames": [

package/src/envelope.d.mts

@@ -1,5 +1,5 @@
 /**
- * AE-128 -- the fixed 128-byte attestation envelope (companion draft v0.3).
+ * AE-128 -- the fixed 128-byte attestation envelope (layout: draft-02 sec. 7.2).
  * Zero dependencies. Field names are snake_case on purpose: they match the
  * Python implementation (iqa.envelope) and the published vector byte for byte.
  */

package/src/envelope.mjs

@@ -1,7 +1,7 @@
-// AE-128 -- the fixed 128-byte attestation envelope (companion draft v0.3).
+// AE-128 -- the fixed 128-byte attestation envelope (layout: draft-02 sec. 7.2).
 //
 // Authority boundaries:
-//   Layout .......... ae128-draft-v0.3 sec. 2 (sole authority)
+//   Layout .......... draft-02 sec. 7.2 (normative layout)
 //   Canonical rule .. draft sec. 3 (HMAC over the full frame, attestation zeroed)
 //   Verification .... draft sec. 4 (fail-closed, constant-time compare)
 //   Standing codes .. AICENT-009 sec. 11.1.1 closed set (0x00..0x03)

package/src/vectors.json

@@ -1,8 +1,8 @@
 {
   "spec": "IQA-URI-ATTEST-v1.2.6",
   "applies_to": [
-    "RFC-009 sec. 10",
-    "RFC-009 sec. 11"
+    "draft-li-rttp-iqa-addressing-02 §§4.2, 5",
+    "AICENT-009 sec. 10-11 (attestation semantics; beyond -02)"
   ],
   "generated_by": "SPEC/tools/iqa_conformance.py",
   "note": "Generated file - do not edit by hand. Change the cases in iqa_conformance.py instead.",
@@ -135,108 +135,108 @@
       "action_omitted": false,
       "action_safe": true,
       "route_hex": "acee0323",
-      "note": "note - 9 hex digits is not a hash length (8/32/64), so the subject parses as a name-subject per the ABNF ordered choice (RFC-009 sec. 10.2)"
+      "note": "note - 9 hex digits is not a hash length (8/32/64), so the subject parses as a name-subject per the ABNF ordered choice (draft-02 §5.1)"
     }
   ],
   "negative_uris": [
     {
       "uri": "iqa://3f9a1b2c.gateway.iqa/AUDIT",
-      "reason": "uppercase action - lowercase only (RFC-009 sec. 10.3)"
+      "reason": "uppercase action - lowercase only (draft-02 §4.2 + §5.1)"
     },
     {
       "uri": "iqa://3F9A1B2C.gateway.iqa/audit",
-      "reason": "uppercase hex subject - lowercase only (RFC-009 sec. 10.3)"
+      "reason": "uppercase hex subject - lowercase only (draft-02 §4.2 + §5.2)"
     },
     {
       "uri": "IQA://3f9a1b2c.gateway.iqa/audit",
-      "reason": "uppercase scheme prefix - canonical form is lowercase (RFC-009 sec. 10.3)"
+      "reason": "uppercase scheme prefix - canonical form is lowercase (draft-02 §4.2)"
     },
     {
       "uri": "iqas://3f9a1b2c.gateway.iqa/audit",
-      "reason": "no iqas variant exists and no fallback is defined - fail closed (RFC-009 sec. 12 #8)"
+      "reason": "no iqas variant exists and no fallback is defined - fail closed (draft-02 §5.2)"
     },
     {
       "uri": "iqa://subject@iqa.org",
-      "reason": "userinfo is not defined (RFC-009 sec. 10.3)"
+      "reason": "userinfo is not defined (draft-02 §4.2)"
     },
     {
       "uri": "iqa://iqa.org/RFC-009/",
-      "reason": "no organ, second path segment - this is an https matter (RFC-009 sec. 10.3)"
+      "reason": "no organ, second path segment - this is an https matter (draft-02 §5.1)"
     },
     {
       "uri": "iqa://3f9a1b2c.forgery.iqa",
-      "reason": "organ is a closed set (RFC-009 sec. 10.1/sec. 10.3)"
+      "reason": "organ is a closed set (draft-02 §5.1)"
     },
     {
       "uri": "iqa://3f9a1b2c.gateway.iqa/pulse",
-      "reason": "action is a closed set - 'pulse' is not one of the four verbs (RFC-009 sec. 10.1)"
+      "reason": "action is a closed set - 'pulse' is not one of the four verbs (draft-02 §5.1)"
     },
     {
       "uri": "iqa://3f9a1b2c.Gateway.iqa/verify",
-      "reason": "organ is case-sensitive within the closed set (RFC-009 sec. 10.3)"
+      "reason": "organ is case-sensitive within the closed set (draft-02 §5.1 + §4.2)"
     },
     {
       "uri": "iqa://3f9a1b2c.gateway.iqa/audit?x=1",
-      "reason": "query is not defined (RFC-009 sec. 10.3)"
+      "reason": "query is not defined (draft-02 §4.2)"
     },
     {
       "uri": "iqa://3f9a1b2c.gateway.iqa/audit#f",
-      "reason": "fragment is not defined (RFC-009 sec. 10.3)"
+      "reason": "fragment is not defined (draft-02 §4.2)"
     },
     {
       "uri": "iqa://3f9a1b2c.gateway.iqa:443/audit",
-      "reason": "port is not defined (RFC-009 sec. 10.3)"
+      "reason": "port is not defined (draft-02 §4.2)"
     },
     {
       "uri": "iqa://3f9a1b2c.gateway.iqa/a/b",
-      "reason": "second path segment - path is a single '/<action>' (RFC-009 sec. 10.2)"
+      "reason": "second path segment - path is a single '/<action>' (draft-02 §5.1)"
     },
     {
       "uri": "iqa://3f9a1b2c.gateway.iqa/",
-      "reason": "trailing '/' with empty action - the closed set has no empty verb (RFC-009 sec. 10.2)"
+      "reason": "trailing '/' with empty action - the closed set has no empty verb (draft-02 §5.1)"
     },
     {
       "uri": "iqa://a.b",
-      "reason": "authority has two segments, must be <subject>.<organ>.<root> (RFC-009 sec. 10.2)"
+      "reason": "authority has two segments, must be <subject>.<organ>.<root> (draft-02 §5.1)"
     },
     {
       "uri": "iqa://a.b.c.d/audit",
-      "reason": "authority has four segments, must be <subject>.<organ>.<root> (RFC-009 sec. 10.2)"
+      "reason": "authority has four segments, must be <subject>.<organ>.<root> (draft-02 §5.1)"
     },
     {
       "uri": "https://3f9a1b2c.gateway.iqa/audit",
-      "reason": "not an iqa scheme - there is no fallback (RFC-009 sec. 10.3, sec. 12 #8)"
+      "reason": "not an iqa scheme - there is no fallback (draft-02 §5.2 + §4.5.2)"
     },
     {
       "uri": "iqa://3f9a1b2c.gateway.iqa/audit ",
-      "reason": "trailing whitespace"
+      "reason": "trailing whitespace (draft-02 §5.1)"
     }
   ],
   "action_safety": [
     {
       "action": null,
       "safe": true,
-      "why": "omitted - standing read (RFC-009 sec. 11.1/sec. 11.3)"
+      "why": "omitted - standing read (draft-02 §5.3/§5.4)"
     },
     {
       "action": "verify",
       "safe": true,
-      "why": "read-only comparison, no state written (RFC-009 sec. 11.3)"
+      "why": "read-only comparison, no state written (draft-02 §5.4)"
     },
     {
       "action": "audit",
       "safe": false,
-      "why": "a failing measurement triggers Authority Ischemia (RFC-009 sec. 11.3/sec. 11.4)"
+      "why": "a failing measurement may change standing (draft-02 §5.4)"
     },
     {
       "action": "attest",
       "safe": false,
-      "why": "state transition - Seal issuance (RFC-009 sec. 11.3)"
+      "why": "state transition - Seal issuance (draft-02 §5.4)"
     },
     {
       "action": "revoke",
       "safe": false,
-      "why": "state transition - standing withdrawal (RFC-009 sec. 11.3)"
+      "why": "state transition - standing withdrawal (draft-02 §5.4)"
     }
   ],
   "attest_envelope_vector": {