@oxdeai/conformance 1.3.1 → 2.0.0

package/vectors/delegation-chain-verification.json

@@ -0,0 +1,366 @@
+{
+  "version": "1.3.0",
+  "description": "Conformance vectors for verifyDelegationChain() - chain-level checks: hash binding, delegator, parent expiry, expiry ceiling, single-hop, policy binding. Artifacts generated programmatically using test key material.",
+  "vectors": [
+    {
+      "id": "delegation-chain-001",
+      "mode": "valid",
+      "description": "valid chain - signature correct, hash bound, delegator matches, not expired",
+      "expected": {
+        "status": "ok",
+        "violations": []
+      },
+      "input": {
+        "parent": {
+          "auth_id": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+          "issuer": "oxdeai.policy-engine",
+          "audience": "parent-agent",
+          "intent_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "state_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "decision": "ALLOW",
+          "issued_at": 1000000,
+          "expiry": 1003000,
+          "kid": "2026-01",
+          "alg": "Ed25519",
+          "signature": "r2+gZu1GsLL4HpNAwD61IUTGax1C8GDADopFLgnr2ZCIjvlLZaob6kO5qnirYpgnJf+eF2YFj3zJNpw6RoVkCg=="
+        },
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-c0nf0rm4nce",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "bc25c98576d0f7f7d674e7c3485cdce0597f7091a389b75a89daf831c649b80d",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {
+            "tools": [
+              "provision_gpu"
+            ]
+          },
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "OKfqOEMyQpnd0HGwN8mMZTWMM84AOZvARgqM/ttrDCluAoROJxxPqN3Bhx5nsRt7uQYgM7FrOTXRh1ApowrFAQ=="
+        },
+        "opts": {
+          "now": 1001000
+        }
+      }
+    },
+    {
+      "id": "delegation-chain-002",
+      "mode": "parent-hash-mismatch",
+      "description": "delegation.parent_auth_hash does not match computed hash of supplied parent",
+      "expected": {
+        "status": "invalid",
+        "violations": [
+          {
+            "code": "DELEGATION_PARENT_HASH_MISMATCH",
+            "message": "parent_auth_hash does not match computed hash of parent authorization"
+          }
+        ]
+      },
+      "input": {
+        "parent": {
+          "auth_id": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+          "issuer": "oxdeai.policy-engine",
+          "audience": "parent-agent",
+          "intent_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "state_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "decision": "ALLOW",
+          "issued_at": 1000000,
+          "expiry": 1003000,
+          "kid": "2026-01",
+          "alg": "Ed25519",
+          "signature": "O7KI55KHW8ofKMZo65eOlM+IMAAvdKYoiki5eqFjklZHMfgo/2T5XhCeovj1aC1WhEUufdLqqG85c2o5CB6GDQ=="
+        },
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-c0nf0rm4nce",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "bc25c98576d0f7f7d674e7c3485cdce0597f7091a389b75a89daf831c649b80d",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {
+            "tools": [
+              "provision_gpu"
+            ]
+          },
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "OKfqOEMyQpnd0HGwN8mMZTWMM84AOZvARgqM/ttrDCluAoROJxxPqN3Bhx5nsRt7uQYgM7FrOTXRh1ApowrFAQ=="
+        },
+        "opts": {
+          "now": 1001000
+        }
+      }
+    },
+    {
+      "id": "delegation-chain-003",
+      "mode": "delegator-mismatch",
+      "description": "delegation.delegator does not match parent.audience",
+      "expected": {
+        "status": "invalid",
+        "violations": [
+          {
+            "code": "DELEGATION_DELEGATOR_MISMATCH",
+            "message": "delegator does not match parent.audience"
+          }
+        ]
+      },
+      "input": {
+        "parent": {
+          "auth_id": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+          "issuer": "oxdeai.policy-engine",
+          "audience": "parent-agent",
+          "intent_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "state_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "decision": "ALLOW",
+          "issued_at": 1000000,
+          "expiry": 1003000,
+          "kid": "2026-01",
+          "alg": "Ed25519",
+          "signature": "r2+gZu1GsLL4HpNAwD61IUTGax1C8GDADopFLgnr2ZCIjvlLZaob6kO5qnirYpgnJf+eF2YFj3zJNpw6RoVkCg=="
+        },
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-c0nf0rm4nce",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "bc25c98576d0f7f7d674e7c3485cdce0597f7091a389b75a89daf831c649b80d",
+          "delegator": "wrong-agent",
+          "delegatee": "child-agent",
+          "scope": {
+            "tools": [
+              "provision_gpu"
+            ]
+          },
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "OKfqOEMyQpnd0HGwN8mMZTWMM84AOZvARgqM/ttrDCluAoROJxxPqN3Bhx5nsRt7uQYgM7FrOTXRh1ApowrFAQ=="
+        },
+        "opts": {
+          "now": 1001000
+        }
+      }
+    },
+    {
+      "id": "delegation-chain-004",
+      "mode": "parent-expired",
+      "description": "parent authorization has expired at verification time",
+      "expected": {
+        "status": "invalid",
+        "violations": [
+          {
+            "code": "DELEGATION_PARENT_EXPIRED",
+            "message": "parent authorization has expired"
+          }
+        ]
+      },
+      "input": {
+        "parent": {
+          "auth_id": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+          "issuer": "oxdeai.policy-engine",
+          "audience": "parent-agent",
+          "intent_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "state_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "decision": "ALLOW",
+          "issued_at": 1000000,
+          "expiry": 1003000,
+          "kid": "2026-01",
+          "alg": "Ed25519",
+          "signature": "r2+gZu1GsLL4HpNAwD61IUTGax1C8GDADopFLgnr2ZCIjvlLZaob6kO5qnirYpgnJf+eF2YFj3zJNpw6RoVkCg=="
+        },
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-c0nf0rm4nce",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "bc25c98576d0f7f7d674e7c3485cdce0597f7091a389b75a89daf831c649b80d",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {
+            "tools": [
+              "provision_gpu"
+            ]
+          },
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "OKfqOEMyQpnd0HGwN8mMZTWMM84AOZvARgqM/ttrDCluAoROJxxPqN3Bhx5nsRt7uQYgM7FrOTXRh1ApowrFAQ=="
+        },
+        "opts": {
+          "now": 1003000
+        }
+      }
+    },
+    {
+      "id": "delegation-chain-005",
+      "mode": "expiry-exceeds-parent",
+      "description": "delegation.expiry is greater than parent.expiry",
+      "expected": {
+        "status": "invalid",
+        "violations": [
+          {
+            "code": "DELEGATION_EXPIRY_EXCEEDS_PARENT",
+            "message": "delegation expiry exceeds parent authorization expiry"
+          }
+        ]
+      },
+      "input": {
+        "parent": {
+          "auth_id": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+          "issuer": "oxdeai.policy-engine",
+          "audience": "parent-agent",
+          "intent_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "state_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "decision": "ALLOW",
+          "issued_at": 1000000,
+          "expiry": 1003000,
+          "kid": "2026-01",
+          "alg": "Ed25519",
+          "signature": "r2+gZu1GsLL4HpNAwD61IUTGax1C8GDADopFLgnr2ZCIjvlLZaob6kO5qnirYpgnJf+eF2YFj3zJNpw6RoVkCg=="
+        },
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-ex1ry0verrun",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "bc25c98576d0f7f7d674e7c3485cdce0597f7091a389b75a89daf831c649b80d",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {},
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1003001,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "3qN638hL81WjfFKIQHTgaIySksn5BLZhkmrEcngzhiuGzLmhEkLvNgU2z+hp+88enneY4zFDrgMq+3lsFB9VCA=="
+        },
+        "opts": {
+          "now": 1001000
+        }
+      }
+    },
+    {
+      "id": "delegation-chain-006",
+      "mode": "multi-hop",
+      "description": "parent is a DelegationV1 (has delegation_id) - re-delegation is not permitted",
+      "expected": {
+        "status": "invalid",
+        "violations": [
+          {
+            "code": "DELEGATION_MULTIHOP_DENIED",
+            "message": "parent must be AuthorizationV1 — multi-hop delegation is not permitted"
+          }
+        ]
+      },
+      "input": {
+        "parent": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-c0nf0rm4nce",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "bc25c98576d0f7f7d674e7c3485cdce0597f7091a389b75a89daf831c649b80d",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {
+            "tools": [
+              "provision_gpu"
+            ]
+          },
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "OKfqOEMyQpnd0HGwN8mMZTWMM84AOZvARgqM/ttrDCluAoROJxxPqN3Bhx5nsRt7uQYgM7FrOTXRh1ApowrFAQ=="
+        },
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-c0nf0rm4nce",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "bc25c98576d0f7f7d674e7c3485cdce0597f7091a389b75a89daf831c649b80d",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {
+            "tools": [
+              "provision_gpu"
+            ]
+          },
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "OKfqOEMyQpnd0HGwN8mMZTWMM84AOZvARgqM/ttrDCluAoROJxxPqN3Bhx5nsRt7uQYgM7FrOTXRh1ApowrFAQ=="
+        },
+        "opts": {
+          "now": 1001000
+        }
+      }
+    },
+    {
+      "id": "delegation-chain-007",
+      "mode": "policy-id-mismatch",
+      "description": "delegation.policy_id does not match parent.policy_id",
+      "expected": {
+        "status": "invalid",
+        "violations": [
+          {
+            "code": "DELEGATION_POLICY_ID_MISMATCH",
+            "message": "policy_id does not match parent.policy_id"
+          }
+        ]
+      },
+      "input": {
+        "parent": {
+          "auth_id": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+          "issuer": "oxdeai.policy-engine",
+          "audience": "parent-agent",
+          "intent_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "state_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "decision": "ALLOW",
+          "issued_at": 1000000,
+          "expiry": 1003000,
+          "kid": "2026-01",
+          "alg": "Ed25519",
+          "signature": "r2+gZu1GsLL4HpNAwD61IUTGax1C8GDADopFLgnr2ZCIjvlLZaob6kO5qnirYpgnJf+eF2YFj3zJNpw6RoVkCg=="
+        },
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-c0nf0rm4nce",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "bc25c98576d0f7f7d674e7c3485cdce0597f7091a389b75a89daf831c649b80d",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {
+            "tools": [
+              "provision_gpu"
+            ]
+          },
+          "policy_id": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "OKfqOEMyQpnd0HGwN8mMZTWMM84AOZvARgqM/ttrDCluAoROJxxPqN3Bhx5nsRt7uQYgM7FrOTXRh1ApowrFAQ=="
+        },
+        "opts": {
+          "now": 1001000
+        }
+      }
+    }
+  ]
+}

package/vectors/delegation-parent-hash.json

@@ -0,0 +1,54 @@
+{
+  "version": "1.3.0",
+  "description": "Vectors for delegation_parent_hash = SHA256(canonical_json(AuthorizationV1)). Key insertion order must not affect the result (invariant I1).",
+  "hash_algorithm": "SHA256-utf8",
+  "vectors": [
+    {
+      "id": "delegation-ph-001",
+      "description": "parent hash of a baseline AuthorizationV1 object",
+      "input": {
+        "parent": {
+          "auth_id": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+          "issuer": "oxdeai.policy-engine",
+          "audience": "parent-agent",
+          "intent_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "state_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "decision": "ALLOW",
+          "issued_at": 1000000,
+          "expiry": 1003000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "placeholder"
+        }
+      },
+      "expected": {
+        "parent_auth_hash": "d00ce19cf7aed0764f6b553faeb92e7339b0ece63e4e0e8b7cd42e278b29a89f"
+      }
+    },
+    {
+      "id": "delegation-ph-002",
+      "description": "same parent with keys in different insertion order - hash must be identical (I1)",
+      "input": {
+        "parent": {
+          "signature": "placeholder",
+          "kid": "2026-01",
+          "alg": "Ed25519",
+          "expiry": 1003000,
+          "issued_at": 1000000,
+          "decision": "ALLOW",
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "state_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "intent_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "audience": "parent-agent",
+          "issuer": "oxdeai.policy-engine",
+          "auth_id": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+        }
+      },
+      "invariant": "equals delegation-ph-001",
+      "expected": {
+        "parent_auth_hash": "d00ce19cf7aed0764f6b553faeb92e7339b0ece63e4e0e8b7cd42e278b29a89f"
+      }
+    }
+  ]
+}