@markdown-ai/cli 1.0.0-rc.2

package/dist/conformance/README.md

@@ -0,0 +1,36 @@
+# MDA conformance suite
+
+A reference set of fixtures for validators and compilers. Every fixture is bound to one or more spec rules in `manifest.yaml` so a failing run identifies which rule fired.
+
+## Layout
+
+```
+conformance/
+├── manifest.yaml          # Binds fixture → rule id → expected verdict
+├── valid/                 # MUST pass source-side validation
+├── invalid/               # MUST fail validation; reason in manifest
+└── compile/               # MUST compile to expected output (per-fixture subdir)
+```
+
+## How to use
+
+A conforming MDA validator MUST:
+
+1. Load `manifest.yaml`.
+2. For each entry under `valid/`: validate the file against the schemas indicated in its `against` list. Verdict MUST be **accept**.
+3. For each entry under `invalid/`: validate the file. Verdict MUST be **reject**. Rule IDs are informative for humans; when `expected-error` is present, the rejection category MUST match it.
+4. For each entry under `compile/`: read `input.mda`, compile to the named target, and compare the output tree to `expected/` byte-for-byte (after YAML-key-order normalization).
+
+For trusted-runtime semantic fixtures, `verified-identities` records the
+post-crypto identity that the runner should match against the trust policy.
+
+A run that disagrees with the manifest on any entry is a non-conformance.
+
+## Adding fixtures
+
+When a new spec rule is added, add at least one `valid/` and one `invalid/` fixture exercising it. Update `manifest.yaml` in the same PR.
+
+Numbering convention: fixture IDs are stable numeric slugs. Allocate the next
+unused integer; do not infer fixture type from the number.
+
+The compiler's CI MUST run this suite on every PR.

package/dist/conformance/invalid/11-name-uppercase.mda

@@ -0,0 +1,8 @@
+---
+name: BadName
+description: name field uses uppercase letters; expected to be rejected by §02-2.1 (kebab-case identifier shape).
+---
+
+# Bad name
+
+This source is invalid because `name` is not a kebab-case identifier.

package/dist/conformance/invalid/12-description-over-1024.mda

@@ -0,0 +1,8 @@
+---
+name: too-long-description
+description: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+---
+
+# Too long
+
+This source's description exceeds 1024 characters; expected to be rejected by §02-2.2.

package/dist/conformance/invalid/13-skill-output-mda-extended-toplevel.md

@@ -0,0 +1,10 @@
+---
+name: bad-skill-output
+description: Compiled SKILL.md keeps `doc-id` at the top level instead of nesting under metadata.mda. Expected to be rejected by §06-targets/skill-md §06-3.3 (unevaluatedProperties:false).
+doc-id: 99999999-9999-9999-9999-999999999999
+---
+
+# Bad SKILL output
+
+A conformant compiler MUST relocate `doc-id` to `metadata.mda.doc-id`. This file
+exists to verify that the strict SKILL.md target schema rejects the violation.

package/dist/conformance/invalid/14-signature-without-integrity.mda

@@ -0,0 +1,14 @@
+---
+name: bad-signature-no-integrity
+description: Source declaring signatures[] without the required integrity anchor. The dependentRequired clause MUST reject this.
+signatures:
+  - signer: "did-web:tools.example.com"
+    key-id: "ed25519-9c4e7b"
+    payload-digest: "sha256:a4f9c0d2e8b3a16e9c01b8f3d2a5c7b14e9f8a3d6c2b1e7f0a8d4c3b9e2f1a05"
+    algorithm: ed25519
+    signature: "BASE64ILLUSTRATIVE=="
+---
+
+# Bad
+
+This fixture has a signature but no integrity field; the source schema MUST reject it.

package/dist/conformance/invalid/15-version-range-compound.mda

@@ -0,0 +1,13 @@
+---
+name: bad-version-range
+description: Source declaring a depends-on entry with a compound version-range. v1.0 admits only exact and caret ranges; the schema MUST reject.
+metadata:
+  mda:
+    depends-on:
+      - name: pdf-tools
+        version-range: ">=1.2.0 <2.0.0"
+---
+
+# Bad
+
+This fixture uses a compound version-range (`>=1.2.0 <2.0.0`) which is not in the v1.0 admitted subset.

package/dist/conformance/invalid/16-agents-md-allowed-tools-toplevel.md

@@ -0,0 +1,8 @@
+---
+description: AGENTS.md output that places allowed-tools at the top level. The AGENTS.md target schema forbids this; allowed-tools must nest under the relevant vendor namespace.
+allowed-tools: "Read Bash(git:*)"
+---
+
+# Bad AGENTS.md
+
+This file violates §06-targets/agents-md §06-3.2.

package/dist/conformance/invalid/17-mcp-server-md-missing-name.md

@@ -0,0 +1,7 @@
+---
+description: MCP-SERVER.md output that omits the required top-level `name` field. The MCP-SERVER.md target schema requires both `name` and `description`.
+---
+
+# Bad MCP-SERVER.md
+
+This file violates §06-targets/mcp-server-md §06-3.1.

package/dist/conformance/invalid/18-integrity-bad-digest-length.mda

@@ -0,0 +1,11 @@
+---
+name: bad-integrity-length
+description: Source declaring sha256 algorithm with a digest of incorrect length. The conditional length constraint MUST reject.
+integrity:
+  algorithm: sha256
+  digest: "sha256:a4f9c0"
+---
+
+# Bad
+
+This fixture has a sha256 algorithm but only 6 hex characters in the digest; sha256 requires exactly 64.

package/dist/conformance/invalid/19-signature-digest-mismatch.mda

@@ -0,0 +1,17 @@
+---
+name: bad-signature-digest-mismatch
+description: Source whose signatures[0].payload-digest is well-formed but does NOT equal integrity.digest. The §09-2 cross-field rule MUST reject.
+integrity:
+  algorithm: sha256
+  digest: "sha256:a4f9c0d2e8b3a16e9c01b8f3d2a5c7b14e9f8a3d6c2b1e7f0a8d4c3b9e2f1a05"
+signatures:
+  - signer: "did-web:tools.example.com"
+    key-id: "ed25519-9c4e7b"
+    payload-digest: "sha256:0000000000000000000000000000000000000000000000000000000000000000"
+    algorithm: ed25519
+    signature: "BASE64ILLUSTRATIVE=="
+---
+
+# Bad
+
+Both digests pass schema validation individually (correct prefix, correct hex length), but they are not equal. §09-2 mandates byte-for-byte equality, enforced by the runner's semantic check.

package/dist/conformance/invalid/24-unterminated-frontmatter.mda

@@ -0,0 +1,7 @@
+---
+name: unterminated
+description: Opening fence with no closing --- line; §02-1.1 step 5 requires extractors to refuse this file.
+
+# Body never reached
+
+The conformance runner records this fixture as a §02-1.1 step 5 rejection (extraction-expected: unterminated-frontmatter).

package/dist/conformance/invalid/25-invalid-utf8.mda

@@ -0,0 +1,8 @@
+---
+name: invalid-utf8-source
+description: Body contains a stray 0xFF byte; UTF-8 decode MUST fail per §02-1.1 step 2.
+---
+
+# Invalid UTF-8
+
+This line ends with a stray byte: � and that byte is not a valid UTF-8 continuation, so the strict TextDecoder raises and the runner records an invalid-encoding rejection.

package/dist/conformance/invalid/26-skill-md-body-only.md

@@ -0,0 +1,3 @@
+# Skill without frontmatter
+
+This file has no opening `---` fence at offset 0. AGENTS.md permits frontmatter-free authoring (§06-targets/agents-md), but every other Tier-1/Tier-2 target — including SKILL.md — requires a YAML frontmatter block. The conformance runner records this fixture as a §02 / §06-targets/skill-md rejection.

package/dist/conformance/invalid/28-trust-policy-issuer-only.json

@@ -0,0 +1,12 @@
+{
+  "version": 1,
+  "trustedSigners": [
+    {
+      "type": "sigstore-oidc",
+      "issuer": "https://token.actions.githubusercontent.com"
+    }
+  ],
+  "rekor": {
+    "url": "https://rekor.sigstore.dev"
+  }
+}

package/dist/conformance/invalid/29-sigstore-signature-without-rekor.mda

@@ -0,0 +1,15 @@
+---
+name: sigstore-without-rekor
+description: Invalid Sigstore signature fixture with missing Rekor coordinates.
+integrity:
+  algorithm: sha256
+  digest: "sha256:a4f9c0d2e8b3a16e9c01b8f3d2a5c7b14e9f8a3d6c2b1e7f0a8d4c3b9e2f1a05"
+signatures:
+  - signer: "sigstore-oidc:https://token.actions.githubusercontent.com"
+    key-id: "fulcio:abc123"
+    payload-digest: "sha256:a4f9c0d2e8b3a16e9c01b8f3d2a5c7b14e9f8a3d6c2b1e7f0a8d4c3b9e2f1a05"
+    algorithm: ecdsa-p256
+    signature: "MEUCIQDkX"
+---
+
+# Invalid Sigstore Signature

package/dist/conformance/invalid/30-did-web-signature-with-rekor.mda

@@ -0,0 +1,17 @@
+---
+name: did-web-with-rekor
+description: Invalid did:web signature fixture with Sigstore-only Rekor fields.
+integrity:
+  algorithm: sha256
+  digest: "sha256:a4f9c0d2e8b3a16e9c01b8f3d2a5c7b14e9f8a3d6c2b1e7f0a8d4c3b9e2f1a05"
+signatures:
+  - signer: "did-web:tools.example.com"
+    key-id: "ed25519:abc123"
+    payload-digest: "sha256:a4f9c0d2e8b3a16e9c01b8f3d2a5c7b14e9f8a3d6c2b1e7f0a8d4c3b9e2f1a05"
+    algorithm: ed25519
+    signature: "MEUCIQDkX"
+    rekor-log-id: "c0d23b6c4f2"
+    rekor-log-index: 123
+---
+
+# Invalid did:web Signature

package/dist/conformance/invalid/31-payload-type-jcs-suffix.mda

@@ -0,0 +1,18 @@
+---
+name: payload-type-jcs-suffix
+description: Invalid signature fixture using a non-IANA +jcs+json structured suffix.
+integrity:
+  algorithm: sha256
+  digest: "sha256:a4f9c0d2e8b3a16e9c01b8f3d2a5c7b14e9f8a3d6c2b1e7f0a8d4c3b9e2f1a05"
+signatures:
+  - signer: "sigstore-oidc:https://token.actions.githubusercontent.com"
+    key-id: "fulcio:abc123"
+    payload-digest: "sha256:a4f9c0d2e8b3a16e9c01b8f3d2a5c7b14e9f8a3d6c2b1e7f0a8d4c3b9e2f1a05"
+    algorithm: ecdsa-p256
+    signature: "MEUCIQDkX"
+    rekor-log-id: "c0d23b6c4f2"
+    rekor-log-index: 123
+    payload-type: "application/vnd.example.llm-config+jcs+json"
+---
+
+# Invalid Payload Type

package/dist/conformance/invalid/32-trust-policy-sigstore-without-rekor.json

@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "trustedSigners": [
+    {
+      "type": "sigstore-oidc",
+      "issuer": "https://token.actions.githubusercontent.com",
+      "subject": "repo:sno-ai/llmix:ref:refs/tags/v2.0.0"
+    }
+  ]
+}

package/dist/conformance/invalid/33-trust-policy-sigstore-empty-rekor.json

@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "trustedSigners": [
+    {
+      "type": "sigstore-oidc",
+      "issuer": "https://token.actions.githubusercontent.com",
+      "subject": "repo:sno-ai/llmix:ref:refs/tags/v2.0.0"
+    }
+  ],
+  "rekor": {}
+}

package/dist/conformance/invalid/34-trust-policy-sigstore-rekor-disabled.json

@@ -0,0 +1,14 @@
+{
+  "version": 1,
+  "trustedSigners": [
+    {
+      "type": "sigstore-oidc",
+      "issuer": "https://token.actions.githubusercontent.com",
+      "subject": "repo:sno-ai/llmix:ref:refs/tags/v2.0.0"
+    }
+  ],
+  "rekor": {
+    "url": "https://rekor.sigstore.dev",
+    "required": false
+  }
+}

package/dist/conformance/invalid/37-trusted-runtime-missing-integrity.mda

@@ -0,0 +1,11 @@
+---
+name: trusted-runtime-missing-integrity
+description: Schema-valid source that trusted-runtime must reject because integrity is absent.
+metadata:
+  mda:
+    version: "1.0.0"
+---
+
+# Missing integrity
+
+Schema validation can pass, but production trusted-runtime cannot load it.

package/dist/conformance/invalid/38-trusted-runtime-missing-signature.mda

@@ -0,0 +1,14 @@
+---
+name: trusted-runtime-missing-signature
+description: Schema-valid source that trusted-runtime must reject because signatures are absent.
+integrity:
+  algorithm: sha256
+  digest: "sha256:a4f9c0d2e8b3a16e9c01b8f3d2a5c7b14e9f8a3d6c2b1e7f0a8d4c3b9e2f1a05"
+metadata:
+  mda:
+    version: "1.0.0"
+---
+
+# Missing signature
+
+Integrity alone is not enough for trusted-runtime.

package/dist/conformance/invalid/39-trusted-runtime-duplicate-did-web-signature.mda

@@ -0,0 +1,25 @@
+---
+name: trusted-runtime-duplicate-did-web-signature
+description: Two valid-looking signatures from the same trusted did:web identity must count once.
+integrity:
+  algorithm: sha256
+  digest: "sha256:a4f9c0d2e8b3a16e9c01b8f3d2a5c7b14e9f8a3d6c2b1e7f0a8d4c3b9e2f1a05"
+signatures:
+  - signer: "did-web:tools.example.com"
+    key-id: "ed25519-9c4e7b"
+    payload-digest: "sha256:a4f9c0d2e8b3a16e9c01b8f3d2a5c7b14e9f8a3d6c2b1e7f0a8d4c3b9e2f1a05"
+    algorithm: ed25519
+    signature: "BASE64ILLUSTRATIVE=="
+  - signer: "did-web:tools.example.com"
+    key-id: "ed25519-9c4e7b"
+    payload-digest: "sha256:a4f9c0d2e8b3a16e9c01b8f3d2a5c7b14e9f8a3d6c2b1e7f0a8d4c3b9e2f1a05"
+    algorithm: ed25519
+    signature: "BASE64ILLUSTRATIVE=="
+metadata:
+  mda:
+    version: "1.0.0"
+---
+
+# Duplicate signer
+
+Duplicate entries do not satisfy a two-identity quorum.

package/dist/conformance/invalid/40-trusted-runtime-untrusted-did-web-signer.mda

@@ -0,0 +1,20 @@
+---
+name: trusted-runtime-untrusted-did-web-signer
+description: Schema-valid signed source whose did:web signer is outside the runtime trust policy.
+integrity:
+  algorithm: sha256
+  digest: "sha256:a4f9c0d2e8b3a16e9c01b8f3d2a5c7b14e9f8a3d6c2b1e7f0a8d4c3b9e2f1a05"
+signatures:
+  - signer: "did-web:evil.example.com"
+    key-id: "ed25519-9c4e7b"
+    payload-digest: "sha256:a4f9c0d2e8b3a16e9c01b8f3d2a5c7b14e9f8a3d6c2b1e7f0a8d4c3b9e2f1a05"
+    algorithm: ed25519
+    signature: "BASE64ILLUSTRATIVE=="
+metadata:
+  mda:
+    version: "1.0.0"
+---
+
+# Untrusted signer
+
+The signature shape is valid, but the signer is not trusted.

package/dist/conformance/invalid/41-trust-policy-did-web-with-rekor.json

@@ -0,0 +1,12 @@
+{
+  "version": 1,
+  "trustedSigners": [
+    {
+      "type": "did-web",
+      "domain": "tools.example.com"
+    }
+  ],
+  "rekor": {
+    "url": "https://rekor.sigstore.dev"
+  }
+}

package/dist/conformance/invalid/44-trusted-runtime-untrusted-sigstore-subject.mda

@@ -0,0 +1,23 @@
+---
+name: trusted-runtime-untrusted-sigstore-subject
+description: Schema-valid Sigstore-signed source whose verified OIDC subject is outside the runtime trust policy.
+integrity:
+  algorithm: sha256
+  digest: "sha256:a4f9c0d2e8b3a16e9c01b8f3d2a5c7b14e9f8a3d6c2b1e7f0a8d4c3b9e2f1a05"
+signatures:
+  - signer: "sigstore-oidc:https://accounts.google.com"
+    key-id: "fulcio:9c4e7b2f1a05c3b9e2d6c2b1e7f0a8d4c3b9e2f1a05c3b9e2d6c2b1e7f0a8d4c"
+    payload-digest: "sha256:a4f9c0d2e8b3a16e9c01b8f3d2a5c7b14e9f8a3d6c2b1e7f0a8d4c3b9e2f1a05"
+    algorithm: ecdsa-p256
+    signature: "MEUCIQDkXILLUSTRATIVESIGNATUREBYTESFORFIXTUREPURPOSESONLY=="
+    rekor-log-id: "c0d23b6c4f200000000000000000000000000000000000000000000000000000"
+    rekor-log-index: 87654321
+metadata:
+  mda:
+    version: "1.0.0"
+---
+
+# Untrusted Sigstore subject
+
+The Sigstore issuer is recognized, but the verified OIDC subject does not match
+the runtime trust policy.

package/dist/conformance/invalid/45-runtime-policy-version-2.json

@@ -0,0 +1,9 @@
+{
+  "version": 2,
+  "trustedSigners": [
+    {
+      "type": "did-web",
+      "domain": "tools.example.com"
+    }
+  ]
+}