vaid-mint 0.1.0__tar.gz

vaid_mint-0.1.0/.gitignore

@@ -0,0 +1,24 @@
+# Rust
+/target
+**/*.rs.bk
+Cargo.lock.orig
+
+# Backtraces
+rustc-ice-*.txt
+
+# Editor / OS
+.DS_Store
+*.swp
+.idea/
+.vscode/
+
+# Python
+__pycache__/
+*.py[cod]
+.pytest_cache/
+*.egg-info/
+dist/
+build/
+.venv/
+.buildvenv/
+.installtest/

vaid_mint-0.1.0/PKG-INFO

@@ -0,0 +1,103 @@
+Metadata-Version: 2.4
+Name: vaid-mint
+Version: 0.1.0
+Summary: The open, self-hostable reference mint (Python) for the VAID standard: mint a root VAID and mint attenuated child VAIDs (scope/capability-contained delegation).
+Project-URL: Homepage, https://github.com/solara-associates/vaid
+Project-URL: Repository, https://github.com/solara-associates/vaid
+Project-URL: Source, https://github.com/solara-associates/vaid/tree/main/python/vaid-mint
+Project-URL: Issues, https://github.com/solara-associates/vaid/issues
+Author-email: "solara.associates" <info@solara.associates>
+License: Apache-2.0
+Keywords: agent-identity,attenuation,delegation,ed25519,mint,vaid
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Requires-Python: >=3.10
+Requires-Dist: cryptography>=42.0
+Requires-Dist: rfc8785>=0.1.2
+Requires-Dist: vaid-pop>=0.1.0
+Provides-Extra: test
+Requires-Dist: pytest>=8.0; extra == 'test'
+Description-Content-Type: text/markdown
+
+# vaid-mint (Python)
+
+The Python mirror of the Rust `vaid-mint` crate: the open, self-hostable
+**reference mint** for the VAID (Verifiable Agent Identity) standard.
+
+- **`mint_root`** — mint a root/operator VAID (BYO-key with proof-of-possession,
+  or generate-and-discard), gated by an explicit `AuthorizationGate`.
+- **`mint_child`** — **attenuated delegation**: an authenticated parent mints a
+  child whose authority is always a subset of its own (`child ⊆ parent`).
+
+## Trust model — read this before using the mint
+
+This is a reference implementation with two deliberate, **unguarded** defaults:
+
+1. **`mint_root` has no authorization gate by default (`PermitAll`).** Anyone who
+   can call this code can mint a root VAID. Supply a real `AuthorizationGate` for
+   anything beyond local experimentation.
+2. **`mint_child` is intentionally ungated — attenuation *is* the authorization.**
+   Any holder of a valid parent VAID can mint children from it; a child can only
+   *narrow* scope/capabilities relative to its parent, never widen
+   (`child ⊆ parent`). Possession of a parent VAID is itself the authorization
+   boundary for delegation here. **Treat parent-VAID custody with the same care as
+   a credential.**
+
+Neither of these is a security recommendation for production use — they are the
+honest defaults of a self-hostable reference mint. See the sections below for
+where each is enforced in code.
+
+```python
+from vaid_mint import ReferenceIssuer, InMemoryAudit, MintService, VaidSeed
+
+issuer = ReferenceIssuer.ephemeral(24)
+mint = MintService(issuer, InMemoryAudit())
+root = mint.mint_root(VaidSeed(
+    agent_class="orchestrator", version="1.0.0", tenant_id="acme",
+    scope_boundary=["data.acme"], capability_set=["read", "write"],
+))
+assert issuer.verify_vaid(root)
+```
+
+## The split
+
+This is the open engine of a HashiCorp-Vault-style split. Durable revocation,
+KMS-backed kernel keys, and the audit-of-record are the closed managed authority
+and are **not** here. `mint_root` is gated by an `AuthorizationGate` that defaults
+to `PermitAll` — a reference-implementation choice, **not** a security
+recommendation; production deployments should pass a real gate to `MintService`.
+
+`mint_child` is intentionally **ungated because attenuation *is* the
+authorization**: any holder of a valid parent VAID can mint children from it, and
+a child can only narrow scope/capabilities relative to that parent, never widen
+(`child ⊆ parent`). So **possession of a parent VAID is itself the authorization
+boundary for delegation** — treat parent-VAID custody with the same care as a
+credential.
+
+## Cross-language byte-identity
+
+Proof-of-possession reuses the `vaid-pop` primitive verbatim. The signed VAID
+**document** is proven byte-identical to the Rust mint by the vendored frozen
+vector `vaid_mint/vectors/mint_v1.json` (the same `mint_v1.json` the Rust
+`mint_conformance` test asserts). Run the packaged firewall:
+
+```
+vaid-mint-conformance          # exit 0 = PASS (installed mint == frozen vector)
+```
+
+Per **Decision B** this is self-consistent within this repo (Rust == Python); it
+is **not** byte-conformant against the closed substrate's (still-moving) VAID
+format.
+
+## Install (local dev)
+
+`vaid-mint` depends on `vaid-pop`. For a local checkout, install both editable:
+
+```
+pip install -e python/vaid-pop
+pip install -e python/vaid-mint --no-deps
+```

vaid_mint-0.1.0/README.md

@@ -0,0 +1,78 @@
+# vaid-mint (Python)
+
+The Python mirror of the Rust `vaid-mint` crate: the open, self-hostable
+**reference mint** for the VAID (Verifiable Agent Identity) standard.
+
+- **`mint_root`** — mint a root/operator VAID (BYO-key with proof-of-possession,
+  or generate-and-discard), gated by an explicit `AuthorizationGate`.
+- **`mint_child`** — **attenuated delegation**: an authenticated parent mints a
+  child whose authority is always a subset of its own (`child ⊆ parent`).
+
+## Trust model — read this before using the mint
+
+This is a reference implementation with two deliberate, **unguarded** defaults:
+
+1. **`mint_root` has no authorization gate by default (`PermitAll`).** Anyone who
+   can call this code can mint a root VAID. Supply a real `AuthorizationGate` for
+   anything beyond local experimentation.
+2. **`mint_child` is intentionally ungated — attenuation *is* the authorization.**
+   Any holder of a valid parent VAID can mint children from it; a child can only
+   *narrow* scope/capabilities relative to its parent, never widen
+   (`child ⊆ parent`). Possession of a parent VAID is itself the authorization
+   boundary for delegation here. **Treat parent-VAID custody with the same care as
+   a credential.**
+
+Neither of these is a security recommendation for production use — they are the
+honest defaults of a self-hostable reference mint. See the sections below for
+where each is enforced in code.
+
+```python
+from vaid_mint import ReferenceIssuer, InMemoryAudit, MintService, VaidSeed
+
+issuer = ReferenceIssuer.ephemeral(24)
+mint = MintService(issuer, InMemoryAudit())
+root = mint.mint_root(VaidSeed(
+    agent_class="orchestrator", version="1.0.0", tenant_id="acme",
+    scope_boundary=["data.acme"], capability_set=["read", "write"],
+))
+assert issuer.verify_vaid(root)
+```
+
+## The split
+
+This is the open engine of a HashiCorp-Vault-style split. Durable revocation,
+KMS-backed kernel keys, and the audit-of-record are the closed managed authority
+and are **not** here. `mint_root` is gated by an `AuthorizationGate` that defaults
+to `PermitAll` — a reference-implementation choice, **not** a security
+recommendation; production deployments should pass a real gate to `MintService`.
+
+`mint_child` is intentionally **ungated because attenuation *is* the
+authorization**: any holder of a valid parent VAID can mint children from it, and
+a child can only narrow scope/capabilities relative to that parent, never widen
+(`child ⊆ parent`). So **possession of a parent VAID is itself the authorization
+boundary for delegation** — treat parent-VAID custody with the same care as a
+credential.
+
+## Cross-language byte-identity
+
+Proof-of-possession reuses the `vaid-pop` primitive verbatim. The signed VAID
+**document** is proven byte-identical to the Rust mint by the vendored frozen
+vector `vaid_mint/vectors/mint_v1.json` (the same `mint_v1.json` the Rust
+`mint_conformance` test asserts). Run the packaged firewall:
+
+```
+vaid-mint-conformance          # exit 0 = PASS (installed mint == frozen vector)
+```
+
+Per **Decision B** this is self-consistent within this repo (Rust == Python); it
+is **not** byte-conformant against the closed substrate's (still-moving) VAID
+format.
+
+## Install (local dev)
+
+`vaid-mint` depends on `vaid-pop`. For a local checkout, install both editable:
+
+```
+pip install -e python/vaid-pop
+pip install -e python/vaid-mint --no-deps
+```

vaid_mint-0.1.0/pyproject.toml

@@ -0,0 +1,61 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "vaid-mint"
+# Independent semver. Additive-minor for new optional fields; MAJOR for any change
+# to the canonical VAID document shape / signing bytes (those break cross-language
+# byte-identity against mint_v1.json).
+version = "0.1.0"
+description = "The open, self-hostable reference mint (Python) for the VAID standard: mint a root VAID and mint attenuated child VAIDs (scope/capability-contained delegation)."
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "Apache-2.0" }
+authors = [{ name = "solara.associates", email = "info@solara.associates" }]
+keywords = ["vaid", "agent-identity", "ed25519", "delegation", "attenuation", "mint"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "License :: OSI Approved :: Apache Software License",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+]
+# vaid-pop supplies the shared JCS→SHA-256→Ed25519 PoP primitive (mint reuses it
+# for proof-of-possession, NOT reimplemented). cryptography = Ed25519; rfc8785 =
+# RFC 8785 JCS, byte-identical to the Rust serde_jcs path (locked by mint_v1.json).
+# Do NOT substitute another JCS library without re-proving byte-equality.
+dependencies = [
+    "vaid-pop>=0.1.0",
+    "cryptography>=42.0",
+    "rfc8785>=0.1.2",
+]
+
+[project.scripts]
+# The packaged firewall: an external consumer who installed ONLY the wheel can run
+# `vaid-mint-conformance` to prove the mint they got reproduces the frozen
+# cross-language VAID-document vector byte-for-byte.
+vaid-mint-conformance = "vaid_mint.conformance:main"
+
+[project.urls]
+Homepage = "https://github.com/solara-associates/vaid"
+Repository = "https://github.com/solara-associates/vaid"
+Source = "https://github.com/solara-associates/vaid/tree/main/python/vaid-mint"
+Issues = "https://github.com/solara-associates/vaid/issues"
+
+[project.optional-dependencies]
+test = [
+    "pytest>=8.0",
+]
+
+[tool.hatch.build.targets.wheel]
+# The vendored conformance vector ships inside the wheel so a consumer's CI runs
+# the firewall against the exact bytes this mint was proven against.
+packages = ["vaid_mint"]
+
+[tool.hatch.build.targets.sdist]
+include = ["vaid_mint", "tests", "README.md"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

vaid_mint-0.1.0/tests/test_mint_behavior.py

@@ -0,0 +1,298 @@
+"""Behavior parity tests — the Python mint mirrors the Rust ``vaid_mint::mint``
+unit tests (attenuation matrix, proof-of-possession, the authorization gate, and
+end-to-end verify). These are behavioral, not byte-identity; the frozen vector
+(``test_mint_conformance.py``) covers cross-language byte-identity of the document.
+"""
+
+from __future__ import annotations
+
+import uuid
+
+import pytest
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from vaid_pop import canonical_request_signing_bytes, utc_whole_second_rfc3339
+
+from vaid_mint import (
+    DenyAll,
+    InMemoryAudit,
+    MintService,
+    ReferenceIssuer,
+    VaidSeed,
+    build_mint_pop_payload,
+    build_unsigned_vaid_document,
+    compute_lineage_hash,
+    has_capability,
+    is_in_scope,
+)
+from vaid_mint.error import IdentityError, UnauthorizedError
+from vaid_mint.mint_types import MintPop
+
+
+# ── fixtures / helpers ──
+
+
+def fixture():
+    audit = InMemoryAudit()
+    issuer = ReferenceIssuer.ephemeral(1)
+    return MintService(issuer, audit), audit, issuer
+
+
+def holder_key() -> Ed25519PrivateKey:
+    return Ed25519PrivateKey.generate()
+
+
+def pub_bytes(k: Ed25519PrivateKey) -> bytes:
+    return k.public_key().public_bytes_raw()
+
+
+def make_pop(seed, registered_key, signing_key, nonce, issued_at=None) -> MintPop:
+    issued_at = issued_at or utc_whole_second_rfc3339()
+    payload = build_mint_pop_payload(
+        seed, public_key_der=registered_key, nonce=nonce, issued_at=issued_at
+    )
+    digest = canonical_request_signing_bytes(payload)
+    return MintPop(nonce=nonce, issued_at=issued_at, signature=signing_key.sign(digest))
+
+
+def byo_seed(public_key_der: bytes) -> VaidSeed:
+    return VaidSeed(
+        agent_class="runner",
+        version="1.0.0",
+        tenant_id="codex",
+        scope_boundary=["data.x"],
+        capability_set=["read"],
+        public_key_der=public_key_der,
+    )
+
+
+def parent_doc(tenant, scope, caps) -> dict:
+    vid = str(uuid.uuid4())
+    return build_unsigned_vaid_document(
+        vaid_id=vid,
+        agent_id=vid,
+        agent_class="parent",
+        version="1.0.0",
+        tenant_id=tenant,
+        issued_at="2026-06-04T12:00:00Z",
+        expires_at="2026-06-05T12:00:00Z",
+        public_key_der=[],
+        parent_vaid=None,
+        scope_boundary=list(scope),
+        lineage_hash="lineage",
+        capability_set=list(caps),
+    )
+
+
+def child_seed(parent, scope, caps, child_pub) -> VaidSeed:
+    return VaidSeed(
+        agent_class="child",
+        version="1.0.0",
+        tenant_id=parent["tenant_id"],
+        parent_vaid=parent["vaid_id"],
+        scope_boundary=list(scope),
+        capability_set=list(caps),
+        public_key_der=child_pub,
+    )
+
+
+def signed_child(parent, scope, caps, nonce):
+    k = holder_key()
+    pub = pub_bytes(k)
+    seed = child_seed(parent, scope, caps, pub)
+    return seed, make_pop(seed, pub, k, nonce)
+
+
+# ── mint_root ──
+
+
+def test_root_generate_and_discard_mints_and_audits():
+    svc, audit, _ = fixture()
+    seed = VaidSeed(
+        agent_class="researcher",
+        version="1.0.0",
+        tenant_id="codex",
+        scope_boundary=["data.governance"],
+        capability_set=["read.documents"],
+    )
+    vaid = svc.mint_root(seed)
+    assert vaid["agent_class"] == "researcher"
+    assert vaid["scope_boundary"] == ["data.governance"]
+    assert vaid["parent_vaid"] is None
+    assert len(audit.entries) == 1
+    assert audit.entries[0].details["delegated"] is False
+
+
+def test_root_byo_key_with_valid_pop_binds_key():
+    svc, audit, _ = fixture()
+    k = holder_key()
+    registered = pub_bytes(k)
+    seed = byo_seed(registered)
+    pop = make_pop(seed, registered, k, "nonce-aaa")
+    vaid = svc.mint_root(seed, pop)
+    assert bytes(vaid["public_key_der"]) == registered
+    assert audit.entries[0].details["byo_key"] is True
+
+
+def test_root_byo_key_with_pop_for_different_key_is_rejected():
+    svc, audit, _ = fixture()
+    victim, attacker = holder_key(), holder_key()
+    victim_pub = pub_bytes(victim)
+    seed = byo_seed(victim_pub)
+    pop = make_pop(seed, victim_pub, attacker, "nonce-bbb")  # signed by attacker
+    with pytest.raises(IdentityError, match="does not verify"):
+        svc.mint_root(seed, pop)
+    assert audit.is_empty()
+
+
+def test_root_byo_key_without_pop_is_rejected():
+    svc, _, _ = fixture()
+    seed = byo_seed(pub_bytes(holder_key()))
+    with pytest.raises(IdentityError, match="proof-of-possession required"):
+        svc.mint_root(seed, None)
+
+
+def test_root_byo_key_replay_is_rejected():
+    svc, _, _ = fixture()
+    k = holder_key()
+    registered = pub_bytes(k)
+    seed = byo_seed(registered)
+    pop = make_pop(seed, registered, k, "nonce-replay")
+    svc.mint_root(seed, pop)
+    with pytest.raises(IdentityError, match="replay"):
+        svc.mint_root(seed, pop)
+
+
+def test_root_mint_denied_by_gate_has_no_side_effects():
+    audit = InMemoryAudit()
+    svc = MintService(ReferenceIssuer.ephemeral(1), audit, DenyAll())
+    seed = VaidSeed(agent_class="x", version="1.0.0", tenant_id="codex")
+    with pytest.raises(UnauthorizedError, match="denied by gate"):
+        svc.mint_root(seed)
+    assert audit.is_empty()
+
+
+# ── mint_child — attenuated delegation ──
+
+
+def test_child_within_bounds_is_minted_with_lineage_and_delegated_audit():
+    svc, audit, _ = fixture()
+    parent = parent_doc("aifactory", ["data.aifactory"], ["read", "write"])
+    seed, pop = signed_child(parent, ["data.aifactory.sub"], ["read"], "ok-1")
+    vaid = svc.mint_child(seed, parent, pop)
+    assert vaid["parent_vaid"] == parent["vaid_id"]
+    assert audit.entries[0].details["delegated"] is True
+    assert audit.entries[0].details["attenuation_verified"] is True
+
+
+def test_child_scope_exceeding_parent_is_denied():
+    svc, audit, _ = fixture()
+    parent = parent_doc("aifactory", ["data.aifactory"], ["read"])
+    seed, pop = signed_child(parent, ["data.somewhere-else"], ["read"], "deny-scope")
+    with pytest.raises(UnauthorizedError, match="scope_boundary exceeds"):
+        svc.mint_child(seed, parent, pop)
+    assert audit.is_empty()
+
+
+def test_empty_child_scope_under_restricted_parent_is_denied():
+    svc, _, _ = fixture()
+    parent = parent_doc("aifactory", ["data.aifactory"], ["read"])
+    seed, pop = signed_child(parent, [], ["read"], "deny-empty-scope")
+    with pytest.raises(UnauthorizedError, match="scope_boundary exceeds"):
+        svc.mint_child(seed, parent, pop)
+
+
+def test_empty_parent_scope_permits_any_child_scope():
+    svc, _, _ = fixture()
+    parent = parent_doc("aifactory", [], ["read"])
+    s1, p1 = signed_child(parent, ["data.anything"], ["read"], "u-1")
+    svc.mint_child(s1, parent, p1)
+    s2, p2 = signed_child(parent, [], ["read"], "u-2")
+    svc.mint_child(s2, parent, p2)
+
+
+def test_child_caps_exceeding_parent_are_denied():
+    svc, _, _ = fixture()
+    parent = parent_doc("aifactory", ["data.aifactory"], ["read"])
+    seed, pop = signed_child(parent, ["data.aifactory.sub"], ["read", "write"], "deny-caps")
+    with pytest.raises(UnauthorizedError, match="capability_set exceeds"):
+        svc.mint_child(seed, parent, pop)
+
+
+def test_empty_parent_caps_may_delegate_nothing_but_empty_child_caps_ok():
+    svc, _, _ = fixture()
+    parent = parent_doc("aifactory", [], [])
+    s1, p1 = signed_child(parent, [], ["read"], "caps-deny")
+    with pytest.raises(UnauthorizedError, match="capability_set exceeds"):
+        svc.mint_child(s1, parent, p1)
+    s2, p2 = signed_child(parent, [], [], "caps-ok")
+    svc.mint_child(s2, parent, p2)
+
+
+def test_cross_tenant_child_is_denied():
+    svc, audit, _ = fixture()
+    parent = parent_doc("aifactory", ["data.aifactory"], ["read"])
+    k = holder_key()
+    pub = pub_bytes(k)
+    seed = child_seed(parent, ["data.aifactory.sub"], ["read"], pub)
+    seed.tenant_id = "codex"  # forge a foreign tenant
+    pop = make_pop(seed, pub, k, "forge-tenant")
+    with pytest.raises(UnauthorizedError, match="cross-tenant delegation is denied"):
+        svc.mint_child(seed, parent, pop)
+    assert audit.is_empty()
+
+
+def test_child_claiming_a_different_parent_vaid_is_denied():
+    svc, audit, _ = fixture()
+    parent = parent_doc("aifactory", ["data.aifactory"], ["read"])
+    k = holder_key()
+    pub = pub_bytes(k)
+    seed = child_seed(parent, ["data.aifactory.sub"], ["read"], pub)
+    seed.parent_vaid = str(uuid.uuid4())  # forge a different parent
+    pop = make_pop(seed, pub, k, "forge-parent")
+    with pytest.raises(UnauthorizedError, match="parent_vaid"):
+        svc.mint_child(seed, parent, pop)
+    assert audit.is_empty()
+
+
+def test_mint_child_without_parent_context_is_denied():
+    svc, _, _ = fixture()
+    parent = parent_doc("aifactory", ["data.aifactory"], ["read"])
+    seed, pop = signed_child(parent, ["data.aifactory.sub"], ["read"], "no-parent")
+    with pytest.raises(UnauthorizedError, match="no verified parent VAID"):
+        svc.mint_child(seed, None, pop)
+
+
+def test_mint_child_without_byo_key_is_denied():
+    svc, _, _ = fixture()
+    parent = parent_doc("aifactory", ["data.aifactory"], ["read"])
+    seed = child_seed(parent, ["data.aifactory.sub"], ["read"], None)
+    with pytest.raises(IdentityError, match="BYO-key required"):
+        svc.mint_child(seed, parent, None)
+
+
+def test_rejected_attenuation_does_not_consume_the_pop_nonce():
+    svc, _, _ = fixture()
+    parent = parent_doc("aifactory", ["data.aifactory"], ["read"])
+    # Scope-exceeding request with nonce "N" → denied at attenuation, before insert.
+    s_denied, p_denied = signed_child(parent, ["data.elsewhere"], ["read"], "N")
+    with pytest.raises(UnauthorizedError):
+        svc.mint_child(s_denied, parent, p_denied)
+    # A VALID request reusing nonce "N" now succeeds — "N" was never consumed.
+    s_ok, p_ok = signed_child(parent, ["data.aifactory.sub"], ["read"], "N")
+    svc.mint_child(s_ok, parent, p_ok)
+
+
+def test_minted_child_verifies_and_is_contained_by_parent():
+    audit = InMemoryAudit()
+    issuer = ReferenceIssuer.ephemeral(1)
+    svc = MintService(issuer, audit)
+    parent = parent_doc("aifactory", ["data.aifactory"], ["read", "write"])
+    seed, pop = signed_child(parent, ["data.aifactory.reports"], ["read"], "e2e")
+    child = svc.mint_child(seed, parent, pop)
+
+    assert issuer.verify_vaid(child)
+    assert all(is_in_scope(parent, s) for s in child["scope_boundary"])
+    assert all(has_capability(parent, c) for c in child["capability_set"])
+    # sanity: the derived lineage_hash on the child is self-consistent
+    assert child["lineage_hash"] == compute_lineage_hash(child["parent_vaid"], child["agent_id"])

vaid_mint-0.1.0/tests/test_mint_conformance.py

@@ -0,0 +1,65 @@
+"""Canonical mint conformance gate (Python side of the cross-language firewall).
+
+The vendored vector ``vaid_mint/vectors/mint_v1.json`` is byte-identical to the
+Rust copy (a CI drift-check enforces that). These tests assert the Python mint
+reproduces the frozen VAID-document digest + kernel signature byte-for-byte, and
+that the derived fields (``lineage_hash``, ``vaid_id == agent_id``) match. A
+mismatch is a BLOCKER. The Rust ``mint_conformance`` test asserts the same vector.
+
+Per Decision B this proves self-consistency WITHIN this repo (Rust == Python),
+NOT conformance against the closed substrate's VAID format.
+"""
+
+from __future__ import annotations
+
+import json
+from importlib.resources import files
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+    Ed25519PrivateKey,
+    Ed25519PublicKey,
+)
+
+from vaid_mint.document import canonical_vaid_signing_bytes, compute_lineage_hash
+
+
+def _vector() -> dict:
+    data = files("vaid_mint").joinpath("vectors/mint_v1.json").read_text()
+    return json.loads(data)
+
+
+def test_document_digest_matches_frozen_vector():
+    v = _vector()
+    digest = canonical_vaid_signing_bytes(v["input"])
+    assert digest.hex() == v["digest_sha256_hex"], (
+        "Python VAID-document digest diverged from the frozen vector — BLOCKER"
+    )
+    assert len(digest) == 32
+
+
+def test_kernel_signature_matches_frozen_vector():
+    v = _vector()
+    seed = bytes.fromhex(v["ed25519"]["kernel_private_key_seed_hex"])
+    sk = Ed25519PrivateKey.from_private_bytes(seed)
+
+    pub = sk.public_key().public_bytes_raw()
+    assert pub.hex() == v["ed25519"]["kernel_public_key_hex"], "kernel pubkey diverged — BLOCKER"
+
+    digest = canonical_vaid_signing_bytes(v["input"])
+    sig = sk.sign(digest)
+    assert sig.hex() == v["ed25519"]["signature_hex"], "kernel signature diverged — BLOCKER"
+    assert len(sig) == 64
+    Ed25519PublicKey.from_public_bytes(pub).verify(sig, digest)  # raises on failure
+
+
+def test_lineage_hash_derivation_matches_frozen_vector():
+    v = _vector()
+    inp = v["input"]
+    assert compute_lineage_hash(inp["parent_vaid"], inp["agent_id"]) == inp["lineage_hash"], (
+        "recomputed lineage_hash diverged — BLOCKER"
+    )
+
+
+def test_vaid_id_equals_agent_id():
+    v = _vector()
+    assert v["input"]["vaid_id"] == v["input"]["agent_id"]