@oxdeai/conformance 1.3.1 → 2.0.0

package/vectors/delegation-signature-verification.json

@@ -0,0 +1,317 @@
+{
+  "version": "1.3.0",
+  "description": "Conformance vectors for DelegationV1 Ed25519 signature verification path. Mirrors authorization-signature-verification.json. Artifacts generated programmatically using test key material.",
+  "vectors": [
+    {
+      "id": "delegation-sig-001",
+      "mode": "valid",
+      "description": "correctly signed delegation - full chain + signature verification passes",
+      "expected": {
+        "status": "ok",
+        "violations": []
+      },
+      "input": {
+        "parent": {
+          "auth_id": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+          "issuer": "oxdeai.policy-engine",
+          "audience": "parent-agent",
+          "intent_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "state_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "decision": "ALLOW",
+          "issued_at": 1000000,
+          "expiry": 1003000,
+          "kid": "2026-01",
+          "alg": "Ed25519",
+          "signature": "r2+gZu1GsLL4HpNAwD61IUTGax1C8GDADopFLgnr2ZCIjvlLZaob6kO5qnirYpgnJf+eF2YFj3zJNpw6RoVkCg=="
+        },
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-c0nf0rm4nce",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "bc25c98576d0f7f7d674e7c3485cdce0597f7091a389b75a89daf831c649b80d",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {
+            "tools": [
+              "provision_gpu"
+            ]
+          },
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "OKfqOEMyQpnd0HGwN8mMZTWMM84AOZvARgqM/ttrDCluAoROJxxPqN3Bhx5nsRt7uQYgM7FrOTXRh1ApowrFAQ=="
+        },
+        "opts": {
+          "now": 1001000,
+          "requireSignatureVerification": true,
+          "trustedKeySets": {
+            "issuer": "parent-agent",
+            "version": "1",
+            "keys": [
+              {
+                "kid": "2026-01",
+                "alg": "Ed25519",
+                "public_key": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAWiMMGTYK7zzHwZXLzDpCshxAH6Lgx8gVsJaixePuY7g=\n-----END PUBLIC KEY-----"
+              }
+            ]
+          }
+        }
+      }
+    },
+    {
+      "id": "delegation-sig-002",
+      "mode": "tampered-signature",
+      "description": "signature bytes corrupted after signing",
+      "expected": {
+        "status": "invalid",
+        "violations": [
+          {
+            "code": "DELEGATION_SIGNATURE_INVALID",
+            "message": "signature verification failed"
+          }
+        ]
+      },
+      "input": {
+        "parent": {
+          "auth_id": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+          "issuer": "oxdeai.policy-engine",
+          "audience": "parent-agent",
+          "intent_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "state_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "decision": "ALLOW",
+          "issued_at": 1000000,
+          "expiry": 1003000,
+          "kid": "2026-01",
+          "alg": "Ed25519",
+          "signature": "r2+gZu1GsLL4HpNAwD61IUTGax1C8GDADopFLgnr2ZCIjvlLZaob6kO5qnirYpgnJf+eF2YFj3zJNpw6RoVkCg=="
+        },
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-c0nf0rm4nce",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "bc25c98576d0f7f7d674e7c3485cdce0597f7091a389b75a89daf831c649b80d",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {
+            "tools": [
+              "provision_gpu"
+            ]
+          },
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "OKfqOEMyQpnd0HGwN8mMZTWMM84AOZvARgqM/ttrDCluAoROJxxPqN3Bhx5nsRt7uQYgM7FrOTXRh1ApowrFAAAA"
+        },
+        "opts": {
+          "now": 1001000,
+          "requireSignatureVerification": true,
+          "trustedKeySets": {
+            "issuer": "parent-agent",
+            "version": "1",
+            "keys": [
+              {
+                "kid": "2026-01",
+                "alg": "Ed25519",
+                "public_key": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAWiMMGTYK7zzHwZXLzDpCshxAH6Lgx8gVsJaixePuY7g=\n-----END PUBLIC KEY-----"
+              }
+            ]
+          }
+        }
+      }
+    },
+    {
+      "id": "delegation-sig-003",
+      "mode": "wrong-kid",
+      "description": "kid references a key not present in trustedKeySets",
+      "expected": {
+        "status": "invalid",
+        "violations": [
+          {
+            "code": "DELEGATION_KID_UNKNOWN",
+            "message": "kid not found for issuer/alg"
+          }
+        ]
+      },
+      "input": {
+        "parent": {
+          "auth_id": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+          "issuer": "oxdeai.policy-engine",
+          "audience": "parent-agent",
+          "intent_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "state_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "decision": "ALLOW",
+          "issued_at": 1000000,
+          "expiry": 1003000,
+          "kid": "2026-01",
+          "alg": "Ed25519",
+          "signature": "r2+gZu1GsLL4HpNAwD61IUTGax1C8GDADopFLgnr2ZCIjvlLZaob6kO5qnirYpgnJf+eF2YFj3zJNpw6RoVkCg=="
+        },
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-c0nf0rm4nce",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "bc25c98576d0f7f7d674e7c3485cdce0597f7091a389b75a89daf831c649b80d",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {
+            "tools": [
+              "provision_gpu"
+            ]
+          },
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "unknown-kid",
+          "signature": "OKfqOEMyQpnd0HGwN8mMZTWMM84AOZvARgqM/ttrDCluAoROJxxPqN3Bhx5nsRt7uQYgM7FrOTXRh1ApowrFAQ=="
+        },
+        "opts": {
+          "now": 1001000,
+          "requireSignatureVerification": true,
+          "trustedKeySets": {
+            "issuer": "parent-agent",
+            "version": "1",
+            "keys": [
+              {
+                "kid": "2026-01",
+                "alg": "Ed25519",
+                "public_key": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAWiMMGTYK7zzHwZXLzDpCshxAH6Lgx8gVsJaixePuY7g=\n-----END PUBLIC KEY-----"
+              }
+            ]
+          }
+        }
+      }
+    },
+    {
+      "id": "delegation-sig-004",
+      "mode": "tampered-field",
+      "description": "a payload field (delegatee) mutated after signing - signature covers original",
+      "expected": {
+        "status": "invalid",
+        "violations": [
+          {
+            "code": "DELEGATION_SIGNATURE_INVALID",
+            "message": "signature verification failed"
+          }
+        ]
+      },
+      "input": {
+        "parent": {
+          "auth_id": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+          "issuer": "oxdeai.policy-engine",
+          "audience": "parent-agent",
+          "intent_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "state_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "decision": "ALLOW",
+          "issued_at": 1000000,
+          "expiry": 1003000,
+          "kid": "2026-01",
+          "alg": "Ed25519",
+          "signature": "r2+gZu1GsLL4HpNAwD61IUTGax1C8GDADopFLgnr2ZCIjvlLZaob6kO5qnirYpgnJf+eF2YFj3zJNpw6RoVkCg=="
+        },
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-c0nf0rm4nce",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "bc25c98576d0f7f7d674e7c3485cdce0597f7091a389b75a89daf831c649b80d",
+          "delegator": "parent-agent",
+          "delegatee": "evil-agent",
+          "scope": {
+            "tools": [
+              "provision_gpu"
+            ]
+          },
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "OKfqOEMyQpnd0HGwN8mMZTWMM84AOZvARgqM/ttrDCluAoROJxxPqN3Bhx5nsRt7uQYgM7FrOTXRh1ApowrFAQ=="
+        },
+        "opts": {
+          "now": 1001000,
+          "requireSignatureVerification": true,
+          "trustedKeySets": {
+            "issuer": "parent-agent",
+            "version": "1",
+            "keys": [
+              {
+                "kid": "2026-01",
+                "alg": "Ed25519",
+                "public_key": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAWiMMGTYK7zzHwZXLzDpCshxAH6Lgx8gVsJaixePuY7g=\n-----END PUBLIC KEY-----"
+              }
+            ]
+          }
+        }
+      }
+    },
+    {
+      "id": "delegation-sig-005",
+      "mode": "expired",
+      "description": "correctly signed delegation whose expiry is in the past at verification time",
+      "expected": {
+        "status": "invalid",
+        "violations": [
+          {
+            "code": "DELEGATION_EXPIRED",
+            "message": "delegation has expired"
+          }
+        ]
+      },
+      "input": {
+        "parent": {
+          "auth_id": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+          "issuer": "oxdeai.policy-engine",
+          "audience": "parent-agent",
+          "intent_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "state_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "decision": "ALLOW",
+          "issued_at": 1000000,
+          "expiry": 1003000,
+          "kid": "2026-01",
+          "alg": "Ed25519",
+          "signature": "r2+gZu1GsLL4HpNAwD61IUTGax1C8GDADopFLgnr2ZCIjvlLZaob6kO5qnirYpgnJf+eF2YFj3zJNpw6RoVkCg=="
+        },
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-exp1r3d00000",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "bc25c98576d0f7f7d674e7c3485cdce0597f7091a389b75a89daf831c649b80d",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {},
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1000999,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "kZVhvVrd3yqR5m1eTT/xAyMFR+PXe3ZdApv8870f2wMhNooXpzFDfuO7WYbpBJmRc/LVLrT2bP1fBFW9fv4GAw=="
+        },
+        "opts": {
+          "now": 1001000,
+          "requireSignatureVerification": true,
+          "trustedKeySets": {
+            "issuer": "parent-agent",
+            "version": "1",
+            "keys": [
+              {
+                "kid": "2026-01",
+                "alg": "Ed25519",
+                "public_key": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAWiMMGTYK7zzHwZXLzDpCshxAH6Lgx8gVsJaixePuY7g=\n-----END PUBLIC KEY-----"
+              }
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/vectors/delegation-verification.json

@@ -0,0 +1,252 @@
+{
+  "version": "1.3.0",
+  "description": "Conformance vectors for verifyDelegation() - isolated delegation artifact checks without chain resolution.",
+  "vectors": [
+    {
+      "id": "delegation-verify-001",
+      "description": "valid delegation - no signature check, correct fields, not expired",
+      "input": {
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-000000000001",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {},
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "placeholder"
+        },
+        "opts": { "now": 1001000 }
+      },
+      "expected": { "status": "ok", "violations": [] }
+    },
+    {
+      "id": "delegation-verify-002",
+      "description": "expired delegation - expiry < now",
+      "input": {
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-000000000002",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {},
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1000999,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "placeholder"
+        },
+        "opts": { "now": 1001000 }
+      },
+      "expected": {
+        "status": "invalid",
+        "violations": [{ "code": "DELEGATION_EXPIRED", "message": "delegation has expired" }]
+      }
+    },
+    {
+      "id": "delegation-verify-003",
+      "description": "expiry === now - boundary: expired (now >= expiry)",
+      "input": {
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-000000000003",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {},
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1001000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "placeholder"
+        },
+        "opts": { "now": 1001000 }
+      },
+      "expected": {
+        "status": "invalid",
+        "violations": [{ "code": "DELEGATION_EXPIRED", "message": "delegation has expired" }]
+      }
+    },
+    {
+      "id": "delegation-verify-004",
+      "description": "missing required field - delegation_id empty",
+      "input": {
+        "delegation": {
+          "delegation_id": "",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {},
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "placeholder"
+        },
+        "opts": { "now": 1001000 }
+      },
+      "expected": {
+        "status": "invalid",
+        "violations": [{ "code": "DELEGATION_MISSING_FIELD", "message": "delegation_id is required" }]
+      }
+    },
+    {
+      "id": "delegation-verify-005",
+      "description": "scope.tools violation - child requests tool not in parent scope",
+      "input": {
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-000000000005",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": { "tools": ["query_db", "provision_gpu"] },
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "placeholder"
+        },
+        "opts": {
+          "now": 1001000,
+          "parentScope": { "tools": ["provision_gpu"] }
+        }
+      },
+      "expected": {
+        "status": "invalid",
+        "violations": [{ "code": "DELEGATION_SCOPE_VIOLATION", "message": "scope.tools contains tools not in parent: query_db" }]
+      }
+    },
+    {
+      "id": "delegation-verify-006",
+      "description": "scope.max_amount violation - child max_amount exceeds parent",
+      "input": {
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-000000000006",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": { "max_amount": "500" },
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "placeholder"
+        },
+        "opts": {
+          "now": 1001000,
+          "parentScope": { "max_amount": "300" }
+        }
+      },
+      "expected": {
+        "status": "invalid",
+        "violations": [{ "code": "DELEGATION_SCOPE_VIOLATION", "message": "scope.max_amount 500 exceeds parent max_amount 300" }]
+      }
+    },
+    {
+      "id": "delegation-verify-007",
+      "description": "delegatee mismatch - expectedDelegatee does not match delegation.delegatee",
+      "input": {
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-000000000007",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {},
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "placeholder"
+        },
+        "opts": {
+          "now": 1001000,
+          "expectedDelegatee": "other-agent"
+        }
+      },
+      "expected": {
+        "status": "invalid",
+        "violations": [{ "code": "DELEGATION_AUDIENCE_MISMATCH", "message": "delegatee does not match expectedDelegatee" }]
+      }
+    },
+    {
+      "id": "delegation-verify-008",
+      "description": "replay - delegation_id already present in consumedDelegationIds",
+      "input": {
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-000000000008",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {},
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "placeholder"
+        },
+        "opts": {
+          "now": 1001000,
+          "consumedDelegationIds": ["d1d1d1d1-0000-0000-0000-000000000008"]
+        }
+      },
+      "expected": {
+        "status": "invalid",
+        "violations": [{ "code": "DELEGATION_REPLAY", "message": "delegation_id has already been consumed" }]
+      }
+    },
+    {
+      "id": "delegation-verify-009",
+      "description": "requireSignatureVerification with no trustedKeySets → DELEGATION_TRUST_MISSING",
+      "input": {
+        "delegation": {
+          "delegation_id": "d1d1d1d1-0000-0000-0000-000000000009",
+          "issuer": "parent-agent",
+          "audience": "child-agent",
+          "parent_auth_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "delegator": "parent-agent",
+          "delegatee": "child-agent",
+          "scope": {},
+          "policy_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "issued_at": 1000000,
+          "expiry": 1002000,
+          "alg": "Ed25519",
+          "kid": "2026-01",
+          "signature": "placeholder"
+        },
+        "opts": {
+          "now": 1001000,
+          "requireSignatureVerification": true
+        }
+      },
+      "expected": {
+        "status": "invalid",
+        "violations": [{ "code": "DELEGATION_TRUST_MISSING", "message": "trustedKeySets required for Ed25519 verification" }]
+      }
+    }
+  ]
+}

package/vectors/envelope-verification.json

@@ -7,8 +7,8 @@
       "expected": {
         "status": "ok",
         "policyId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "stateHash": "41f336cb4677d73b2c494e3a8aa6d89196cc603309742227faff06ac4da7333c",
-        "auditHeadHash": "210f6da534cd7eb92e4747d56604f57738f9af2e9f4cace24a489f9f00ecbe0c",
+        "stateHash": "af9020dcf23b68ca00ae29a5b1371d892763e0a49fe07866fbdba88b0b2f56a8",
+        "auditHeadHash": "ae47035e849bbc046bd17489186ad3b899edb170ad1cedcee01ad0dcdb25b409",
         "violations": []
       }
     },
@@ -75,4 +75,4 @@
       }
     }
   ]
-}
+}