@oxdeai/conformance 1.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (17) hide show
  1. package/README.md +54 -0
  2. package/dist/extract-vectors.js +416 -0
  3. package/dist/scripts/extract-vectors.d.ts +6 -0
  4. package/dist/scripts/extract-vectors.js +417 -0
  5. package/dist/scripts/extract-vectors.js.map +1 -0
  6. package/dist/src/validate.d.ts +1 -0
  7. package/dist/src/validate.js +394 -0
  8. package/dist/src/validate.js.map +1 -0
  9. package/package.json +20 -0
  10. package/scripts/extract-vectors.ts +460 -0
  11. package/src/validate.ts +467 -0
  12. package/tsconfig.json +14 -0
  13. package/vectors/audit-chain.json +94 -0
  14. package/vectors/authorization-payload.json +58 -0
  15. package/vectors/envelope-verification.json +78 -0
  16. package/vectors/intent-hash.json +87 -0
  17. package/vectors/snapshot-hash.json +130 -0
package/vectors/envelope-verification.json ADDED
@@ -0,0 +1,78 @@
1
+ {
2
+ "version": "1.0.0",
3
+ "vectors": [
4
+ {
5
+ "id": "envelope-001",
6
+ "description": "ok — strict mode with STATE_CHECKPOINT",
7
+ "expected": {
8
+ "status": "ok",
9
+ "policyId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
10
+ "stateHash": "343583cdb32ec10dae8f1f824afc1fffd06978ae8a87904a65683d3e11f8bcd1",
11
+ "auditHeadHash": "c70408b47892206887ead2bae10bd173db151c5e46ef8a6fc078e81c22bc4284",
12
+ "violations": []
13
+ }
14
+ },
15
+ {
16
+ "id": "envelope-002",
17
+ "description": "ok — best-effort mode without checkpoint",
18
+ "expected": {
19
+ "status": "ok",
20
+ "violations": []
21
+ }
22
+ },
23
+ {
24
+ "id": "envelope-003",
25
+ "description": "invalid — policyId mismatch",
26
+ "expected": {
27
+ "status": "invalid",
28
+ "violations": [
29
+ {
30
+ "code": "POLICY_ID_MISMATCH",
31
+ "message": "event.policyId mismatch (expected=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa, got=cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc)",
32
+ "index": 0
33
+ },
34
+ {
35
+ "code": "POLICY_ID_MISMATCH",
36
+ "message": "snapshot policyId does not match audit policyId"
37
+ },
38
+ {
39
+ "code": "POLICY_ID_MISMATCH",
40
+ "message": "event.policyId mismatch (expected=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa, got=cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc)",
41
+ "index": 1
42
+ },
43
+ {
44
+ "code": "POLICY_ID_MISMATCH",
45
+ "message": "event.policyId mismatch (expected=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa, got=cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc)",
46
+ "index": 2
47
+ }
48
+ ]
49
+ }
50
+ },
51
+ {
52
+ "id": "envelope-004",
53
+ "description": "invalid — corrupt envelope bytes",
54
+ "expected": {
55
+ "status": "invalid",
56
+ "violations": [
57
+ {
58
+ "code": "ENVELOPE_MALFORMED",
59
+ "message": "envelope decode failed"
60
+ }
61
+ ]
62
+ }
63
+ },
64
+ {
65
+ "id": "envelope-005",
66
+ "description": "inconclusive — strict mode without checkpoint",
67
+ "expected": {
68
+ "status": "inconclusive",
69
+ "violations": [
70
+ {
71
+ "code": "NO_STATE_ANCHOR",
72
+ "message": "no STATE_CHECKPOINT event with stateHash found"
73
+ }
74
+ ]
75
+ }
76
+ }
77
+ ]
78
+ }
package/vectors/intent-hash.json ADDED
@@ -0,0 +1,87 @@
1
+ {
2
+ "version": "1.0.0",
3
+ "vectors": [
4
+ {
5
+ "id": "intent-hash-001",
6
+ "input": {
7
+ "intent_id": "intent-42",
8
+ "agent_id": "agent-1",
9
+ "action_type": "PAYMENT",
10
+ "amount": "1000000",
11
+ "target": "merchant-1",
12
+ "timestamp": 1730000000,
13
+ "metadata_hash": "0000000000000000000000000000000000000000000000000000000000000000",
14
+ "nonce": "42",
15
+ "signature": "sig-placeholder",
16
+ "depth": 0,
17
+ "tool": "openai.responses",
18
+ "tool_call": true,
19
+ "type": "EXECUTE"
20
+ },
21
+ "expected": {
22
+ "hash": "aea574158239260e0161c0a23d641730d532952a7f538f7537e7ad4c03fe08db"
23
+ }
24
+ },
25
+ {
26
+ "id": "intent-hash-002",
27
+ "input": {
28
+ "tool_call": true,
29
+ "tool": "openai.responses",
30
+ "depth": 0,
31
+ "nonce": "42",
32
+ "timestamp": 1730000000,
33
+ "target": "merchant-1",
34
+ "amount": "1000000",
35
+ "action_type": "PAYMENT",
36
+ "agent_id": "agent-1",
37
+ "metadata_hash": "0000000000000000000000000000000000000000000000000000000000000000",
38
+ "intent_id": "intent-42",
39
+ "type": "EXECUTE",
40
+ "signature": "sig-placeholder"
41
+ },
42
+ "expected": {
43
+ "hash": "aea574158239260e0161c0a23d641730d532952a7f538f7537e7ad4c03fe08db"
44
+ },
45
+ "invariant": "equals intent-hash-001"
46
+ },
47
+ {
48
+ "id": "intent-hash-003",
49
+ "input": {
50
+ "intent_id": "intent-42",
51
+ "agent_id": "agent-1",
52
+ "action_type": "PAYMENT",
53
+ "amount": "1000000",
54
+ "target": "merchant-1",
55
+ "timestamp": 1730000000,
56
+ "metadata_hash": "0000000000000000000000000000000000000000000000000000000000000000",
57
+ "nonce": "42",
58
+ "signature": "sig-placeholder",
59
+ "depth": 0,
60
+ "tool": "openai.responses",
61
+ "tool_call": true,
62
+ "type": "EXECUTE",
63
+ "_internal_trace_id": "ignored"
64
+ },
65
+ "binding_fields": [
66
+ "intent_id",
67
+ "agent_id",
68
+ "action_type",
69
+ "depth",
70
+ "amount",
71
+ "asset",
72
+ "target",
73
+ "timestamp",
74
+ "metadata_hash",
75
+ "nonce",
76
+ "type",
77
+ "authorization_id",
78
+ "tool",
79
+ "tool_call"
80
+ ],
81
+ "expected": {
82
+ "hash": "aea574158239260e0161c0a23d641730d532952a7f538f7537e7ad4c03fe08db"
83
+ },
84
+ "invariant": "equals intent-hash-001"
85
+ }
86
+ ]
87
+ }
package/vectors/snapshot-hash.json ADDED
@@ -0,0 +1,130 @@
1
+ {
2
+ "version": "1.0.0",
3
+ "vectors": [
4
+ {
5
+ "id": "snapshot-hash-001",
6
+ "input_state": {
7
+ "policy_version": "v1.0.0",
8
+ "period_id": "period-1",
9
+ "kill_switch": {
10
+ "global": false,
11
+ "agents": {}
12
+ },
13
+ "allowlists": {},
14
+ "budget": {
15
+ "budget_limit": {
16
+ "agent-1": "5000000"
17
+ },
18
+ "spent_in_period": {
19
+ "agent-1": "0"
20
+ }
21
+ },
22
+ "max_amount_per_action": {
23
+ "agent-1": "2000000"
24
+ },
25
+ "velocity": {
26
+ "config": {
27
+ "window_seconds": 60,
28
+ "max_actions": 10
29
+ },
30
+ "counters": {}
31
+ },
32
+ "replay": {
33
+ "window_seconds": 300,
34
+ "max_nonces_per_agent": 256,
35
+ "nonces": {}
36
+ },
37
+ "concurrency": {
38
+ "max_concurrent": {
39
+ "agent-1": 3
40
+ },
41
+ "active": {},
42
+ "active_auths": {}
43
+ },
44
+ "recursion": {
45
+ "max_depth": {
46
+ "agent-1": 5
47
+ }
48
+ },
49
+ "tool_limits": {
50
+ "window_seconds": 60,
51
+ "max_calls": {
52
+ "agent-1": 50
53
+ },
54
+ "calls": {}
55
+ }
56
+ },
57
+ "expected": {
58
+ "snapshot_base64": "eyJlbmdpbmVWZXJzaW9uIjoiMS4wLjEiLCJmb3JtYXRWZXJzaW9uIjoxLCJtb2R1bGVzIjp7IkFsbG93bGlzdE1vZHVsZSI6eyJhY3Rpb25fdHlwZXMiOltdLCJhc3NldHMiOltdLCJ0YXJnZXRzIjpbXX0sIkJ1ZGdldE1vZHVsZSI6eyJidWRnZXRfbGltaXQiOnsiYWdlbnQtMSI6IjUwMDAwMDAifSwibWF4X2Ftb3VudF9wZXJfYWN0aW9uIjp7ImFnZW50LTEiOiIyMDAwMDAwIn0sInNwZW50X2luX3BlcmlvZCI6eyJhZ2VudC0xIjoiMCJ9fSwiQ29uY3VycmVuY3lNb2R1bGUiOnsiYWN0aXZlIjp7ImFnZW50LTEiOjB9LCJhY3RpdmVfYXV0aHMiOnsiYWdlbnQtMSI6e319LCJtYXhfY29uY3VycmVudCI6eyJhZ2VudC0xIjozfX0sIktpbGxTd2l0Y2hNb2R1bGUiOnsiYWdlbnRzIjp7fSwiZ2xvYmFsIjpmYWxzZX0sIlJlY3Vyc2lvbkRlcHRoTW9kdWxlIjp7Im1heF9kZXB0aCI6eyJhZ2VudC0xIjo1fX0sIlJlcGxheU1vZHVsZSI6eyJtYXhfbm9uY2VzX3Blcl9hZ2VudCI6MjU2LCJub25jZXMiOnt9LCJ3aW5kb3dfc2Vjb25kcyI6MzAwfSwiVG9vbEFtcGxpZmljYXRpb25Nb2R1bGUiOnsiY2FsbHMiOnt9LCJtYXhfY2FsbHMiOnsiYWdlbnQtMSI6NTB9LCJtYXhfY2FsbHNfYnlfdG9vbCI6e30sIndpbmRvd19zZWNvbmRzIjo2MH0sIlZlbG9jaXR5TW9kdWxlIjp7ImNvbmZpZyI6eyJtYXhfYWN0aW9ucyI6MTAsIndpbmRvd19zZWNvbmRzIjo2MH0sImNvdW50ZXJzIjp7fX19LCJwb2xpY3lJZCI6ImFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWEifQ==",
59
+ "state_hash": "ad35d2f6ae9867f852fcf4d5f8e5bbc1c9f3fc2776799cd6011897866d9f1e2c"
60
+ }
61
+ },
62
+ {
63
+ "id": "snapshot-hash-002",
64
+ "input_state": {
65
+ "policy_version": "v1.0.0",
66
+ "period_id": "period-1",
67
+ "kill_switch": {
68
+ "global": false,
69
+ "agents": {}
70
+ },
71
+ "allowlists": {},
72
+ "budget": {
73
+ "budget_limit": {
74
+ "agent-1": "999999999999999999"
75
+ },
76
+ "spent_in_period": {
77
+ "agent-1": "0"
78
+ }
79
+ },
80
+ "max_amount_per_action": {
81
+ "agent-1": "2000000"
82
+ },
83
+ "velocity": {
84
+ "config": {
85
+ "window_seconds": 60,
86
+ "max_actions": 10
87
+ },
88
+ "counters": {}
89
+ },
90
+ "replay": {
91
+ "window_seconds": 300,
92
+ "max_nonces_per_agent": 256,
93
+ "nonces": {}
94
+ },
95
+ "concurrency": {
96
+ "max_concurrent": {
97
+ "agent-1": 3
98
+ },
99
+ "active": {},
100
+ "active_auths": {}
101
+ },
102
+ "recursion": {
103
+ "max_depth": {
104
+ "agent-1": 5
105
+ }
106
+ },
107
+ "tool_limits": {
108
+ "window_seconds": 60,
109
+ "max_calls": {
110
+ "agent-1": 50
111
+ },
112
+ "calls": {}
113
+ }
114
+ },
115
+ "expected": {
116
+ "snapshot_base64": "eyJlbmdpbmVWZXJzaW9uIjoiMS4wLjEiLCJmb3JtYXRWZXJzaW9uIjoxLCJtb2R1bGVzIjp7IkFsbG93bGlzdE1vZHVsZSI6eyJhY3Rpb25fdHlwZXMiOltdLCJhc3NldHMiOltdLCJ0YXJnZXRzIjpbXX0sIkJ1ZGdldE1vZHVsZSI6eyJidWRnZXRfbGltaXQiOnsiYWdlbnQtMSI6Ijk5OTk5OTk5OTk5OTk5OTk5OSJ9LCJtYXhfYW1vdW50X3Blcl9hY3Rpb24iOnsiYWdlbnQtMSI6IjIwMDAwMDAifSwic3BlbnRfaW5fcGVyaW9kIjp7ImFnZW50LTEiOiIwIn19LCJDb25jdXJyZW5jeU1vZHVsZSI6eyJhY3RpdmUiOnsiYWdlbnQtMSI6MH0sImFjdGl2ZV9hdXRocyI6eyJhZ2VudC0xIjp7fX0sIm1heF9jb25jdXJyZW50Ijp7ImFnZW50LTEiOjN9fSwiS2lsbFN3aXRjaE1vZHVsZSI6eyJhZ2VudHMiOnt9LCJnbG9iYWwiOmZhbHNlfSwiUmVjdXJzaW9uRGVwdGhNb2R1bGUiOnsibWF4X2RlcHRoIjp7ImFnZW50LTEiOjV9fSwiUmVwbGF5TW9kdWxlIjp7Im1heF9ub25jZXNfcGVyX2FnZW50IjoyNTYsIm5vbmNlcyI6e30sIndpbmRvd19zZWNvbmRzIjozMDB9LCJUb29sQW1wbGlmaWNhdGlvbk1vZHVsZSI6eyJjYWxscyI6e30sIm1heF9jYWxscyI6eyJhZ2VudC0xIjo1MH0sIm1heF9jYWxsc19ieV90b29sIjp7fSwid2luZG93X3NlY29uZHMiOjYwfSwiVmVsb2NpdHlNb2R1bGUiOnsiY29uZmlnIjp7Im1heF9hY3Rpb25zIjoxMCwid2luZG93X3NlY29uZHMiOjYwfSwiY291bnRlcnMiOnt9fX0sInBvbGljeUlkIjoiYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYSJ9",
117
+ "state_hash": "6393bcf479fc4ad32a5bcb95429a1bcd6de987f0d2156392623108294814f003",
118
+ "normalized_budget_limit": "999999999999999999"
119
+ }
120
+ },
121
+ {
122
+ "id": "snapshot-hash-003",
123
+ "input_snapshot_base64": "eyJlbmdpbmVWZXJzaW9uIjoiMS4wLjEiLCJmb3JtYXRWZXJzaW9uIjoxLCJtb2R1bGVzIjp7IkFsbG93bGlzdE1vZHVsZSI6eyJhY3Rpb25fdHlwZXMiOltdLCJhc3NldHMiOltdLCJ0YXJnZXRzIjpbXX0sIkJ1ZGdldE1vZHVsZSI6eyJidWRnZXRfbGltaXQiOnsiYWdlbnQtMSI6IjUwMDAwMDAifSwibWF4X2Ftb3VudF9wZXJfYWN0aW9uIjp7ImFnZW50LTEiOiIyMDAwMDAwIn0sInNwZW50X2luX3BlcmlvZCI6eyJhZ2VudC0xIjoiMCJ9fSwiQ29uY3VycmVuY3lNb2R1bGUiOnsiYWN0aXZlIjp7ImFnZW50LTEiOjB9LCJhY3RpdmVfYXV0aHMiOnsiYWdlbnQtMSI6e319LCJtYXhfY29uY3VycmVudCI6eyJhZ2VudC0xIjozfX0sIktpbGxTd2l0Y2hNb2R1bGUiOnsiYWdlbnRzIjp7fSwiZ2xvYmFsIjpmYWxzZX0sIlJlY3Vyc2lvbkRlcHRoTW9kdWxlIjp7Im1heF9kZXB0aCI6eyJhZ2VudC0xIjo1fX0sIlJlcGxheU1vZHVsZSI6eyJtYXhfbm9uY2VzX3Blcl9hZ2VudCI6MjU2LCJub25jZXMiOnt9LCJ3aW5kb3dfc2Vjb25kcyI6MzAwfSwiVG9vbEFtcGxpZmljYXRpb25Nb2R1bGUiOnsiY2FsbHMiOnt9LCJtYXhfY2FsbHMiOnsiYWdlbnQtMSI6NTB9LCJtYXhfY2FsbHNfYnlfdG9vbCI6e30sIndpbmRvd19zZWNvbmRzIjo2MH0sIlZlbG9jaXR5TW9kdWxlIjp7ImNvbmZpZyI6eyJtYXhfYWN0aW9ucyI6MTAsIndpbmRvd19zZWNvbmRzIjo2MH0sImNvdW50ZXJzIjp7fX19LCJwb2xpY3lJZCI6ImFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWEifQ==",
124
+ "expected": {
125
+ "state_hash": "ad35d2f6ae9867f852fcf4d5f8e5bbc1c9f3fc2776799cd6011897866d9f1e2c"
126
+ },
127
+ "invariant": "equals snapshot-hash-001"
128
+ }
129
+ ]
130
+ }