iqa — V1.2.8 release reading

Scope of this reading. This is the current-release (V1.2.8) reading of AICENT-009. The scheme itself is unchanged against V1.2.6 — same syntax, same envelope layout, same derivation rules. V1.2.8 changes packages and conformance coverage, not the protocol. The frozen V1.2.6 reading is on the second tab; the non-normative Aicent Stack narrative is on the third.

Naming note. IQA here denotes Identity Quality Assurance. It is not affiliated with the Institute of Quality Assurance (the historical UK body that became the Chartered Quality Institute in 2007), nor is it the computer-vision field of Image Quality Assessment.

• Scheme: iqa
• Status: submitted to IANA, Provisional, pending — not registered (ticket [IANA #1459963])
• Specification: draft-li-iqa-subject-attestation
• Channels: PyPI iqa-org 1.2.8 · npm @aicent/iqa 1.2.8 · crates.io iqa-org 1.2.8-alpha — one stack version, two channels; the superseded 1.2.7 releases were yanked
• Source: github.com/Aicent-Stack/iqa-org

Conformance — asserted by CI on every push

• Python, default install (zero dependencies): 75 checks passed (3 skipped)
• Python with the optional Ed25519 backend: 78 checks passed
• Node (npm): 32 checks passed
• Rust (crates.io): 37 checks passed (1 skipped), 38 with --features ed25519

Three individual implementations — Python, JavaScript, Rust — share no code and agree byte for byte on the same published vector set (sha256 8529549e..., shipped inside every package). Every count above is re-asserted by CI on every push; drift fails the build. The zero-dependency install of 1.2.6 could not complete its self-test (a NameError crash); fixed in 1.2.7, and 1.2.8 ships the expanded, fully runnable suite.

Try it in one line

pip install iqa-org && python -m iqa.selftest   # [PASS] all 75 checks passed (3 skipped)
npm install @aicent/iqa && npx @aicent/iqa      # [PASS] all 32 checks passed

Full release overview, live verification and the vectors: https://iqa.org/URI/

iqa — a URI scheme for attestation standing

Scope of this reading. This is the frozen V1.2.6 reading of AICENT-009. It states what the iqa URI scheme is and what a client must do with it, and nothing else. The Aicent Stack narrative, unchanged and explicitly non-normative, is on the third tab.

Naming note. IQA here denotes Identity Quality Assurance. It is not affiliated with the Institute of Quality Assurance (the historical UK body that became the Chartered Quality Institute in 2007), nor is it the computer-vision field of Image Quality Assessment.

10. THE iqa:// URI SCHEME: ADDRESSING AND SYNTAX

The iqa URI scheme gives the standing rendered by this Authority Layer a portable identifier — so that an attestation can be cited in a document, a configuration file, or a log without carrying the 256-bit Seal itself.

10.1 Scheme Syntax

iqa://<subject>.<organ>.<root>/<action>

10.2 ABNF (RFC 5234)

iqa-URI         = "iqa://" authority [ path ]

authority       = subject "." organ "." root
subject         = hash-subject / name-subject
hash-subject    = 8lowhex / 32lowhex / 64lowhex
name-subject    = 1*( %x61-7A / DIGIT / "-" )
organ           = "forge" / "tss" / "gateway"
root            = 1*( %x61-7A / DIGIT / "-" )

path            = "/" action
action          = "verify" / "audit" / "attest" / "revoke"

lowhex          = %x30-39 / %x61-66

10.3 What an iqa URI Is Not

• No userinfo. The scheme defines no credential component — credentials cannot appear in an iqa URI. (This is a deliberate exclusion, not an omission.)
• No port, no query, no fragment. A string containing @, :, ?, #, [ or ] is not a valid iqa URI.
• Lowercase US-ASCII only. Hex AID material is normalized to lowercase on entry — the Master Authority AID is written 0000004149434E531C5B21D80403358B in this document, but enters a URI as 0000004149434e531c5b21d80403358b.
• The hash is a routing hint, not evidence. The 8-digit short form carries no verification weight; identity is bound by the 256-bit Seal (§4), never by the URI.

"The URI is an entry fingerprint; the AID is the identity; the Seal is the evidence."

Examples

iqa://3f9a1b2c.gateway.iqa                            ; short form - standing read
iqa://0000004149434e531c5b21d80403358b.forge.iqa      ; full 128-bit AID form
iqa://3f9a1b2c.tss.iqa/audit                          ; an audit request to the tss organ
iqa://master-authority.gateway.iqa/verify             ; readable label form

Not valid iqa URIs

iqa://subject@iqa.org              ; INVALID - userinfo is not defined
iqa://iqa.org/AICENT-009/             ; INVALID - no organ, second path segment
iqa://3f9a1b2c.gateway.iqa/ATTEST  ; INVALID - uppercase
iqa://3f9a1b2c.forgery.iqa         ; INVALID - organ is a closed set

10.4 Client Requirements

A client that dereferences, resolves, or handles an iqa URI — a resolver page, a protocol handler, or a library that presents the result — MUST satisfy the following. These requirements follow directly from §10.3 and §12: an iqa URI may be supplied by an untrusted party, and its subject is a claim, not a proof.

• No navigation to the URI. The subject, organ, root and action components MUST NOT be used as a navigation target. A client that renders a link, redirect, or fetch derived from any part of an iqa URI is an open redirect and is non-conformant. A client MAY navigate only to a destination that is fixed in advance by the client itself.
• Scheme prefix check. A protocol handler MUST reject any input whose scheme is neither iqa nor the exact scheme name under which that handler was itself registered. Without this check the handler becomes a general-purpose launcher that any page can use to open an arbitrary URI.
• Consent, never silence. The ability to handle iqa URIs MUST NOT be acquired without an explicit action by the user, and a client MUST NOT simulate or bypass that consent. In every browser, registration of a protocol handler is user-initiated, and the list of registered handlers is not exposed to the network.
• Parsing is not attestation. A client that displays a parsed iqa URI MUST NOT present the result as evidence of standing. Reading the syntax establishes nothing about any subject; standing is established only by the 256-bit Seal (§4) and by the answering Organ (§3).

Rationale. iqa://<subject>.<organ>.<root>/<action> is a short, human-readable string that any page can embed in a link. Without the rules above, the scheme would hand third parties two primitive attacks: using this project's domain as a redirector (open redirect), and using a registered handler as a launcher for URIs the user never intended to open. The fourth rule guards a third failure mode specific to this scheme — a parse that looks like a certification.

10.5 Registration Status

The iqa scheme is subject to registration under RFC 7595. The template is RFC 7595 §7.4 and the Provisional procedure is First Come First Served, going to IANA's protocol-parameter queue (iana-prot-param@iana.org). Review on the uri-review@ietf.org list is required for Permanent registration, not for Provisional.

A ticket number is not a registration. As of 2026-09-17 the IANA "URI Schemes" registry contains no iqa entry. Describing the scheme as "registered", "assigned" or "standardised" is therefore incorrect. The accurate description is: submitted under RFC 7595, Provisional procedure, pending.

11. DEFAULT DEREFERENCE & OPERATION SAFETY

11.1 The Default Operation Is a Read

Dereferencing an iqa URI with no action performs a standing read: it returns the subject's current verdict as reported by the named Organ — one of Ghost · Probation · Radiant · Genesis (closed set, AICENT-009-C).

The default operation is read-only. It creates no obligation, transfers no value, and mutates no substrate state.

11.2 Normative Rule

Dereferencing an iqa URI, by itself, MUST NOT transition any subject's standing state.

11.3 Action Safety Classes

11.4 Why audit Is Not Classified Safe

An implementation MAY treat a measurement as a state transition. A "read" can therefore move a subject’s reported state. Per this document, audit, attest and revoke MUST be requested explicitly and MUST NOT be reachable by dereferencing a URI that omits action.

12. SECURITY AND PRIVACY CONSIDERATIONS

Nature of the identifier. An iqa URI is a claim about the attestation standing of a named subject. It is not a pointer to a file; it names a measured identity state.

Organism Vitality & Protocol Audit

"Truth is the only key. Authority is not granted; it is measured in bits of drift at 12ns precision."

⚪ AICENT | 💎 RTTP | 🔴 RPKI | 🟢 ZCMK | 🟡 GTIOT | 🟣 AICENT-NET | 🎭 BEWHO | 🌿 epoekie | 👁️ PICSI

🔖 AICENT-009: IQA.ORG | The Imperial Authority

Identity Quality Assurance & Sovereign Certification.

• Status: Imperial Standard (Active / Private)
• Version: v1.3.0-Alpha (Authority Singularity)
• Verification Finality: < 150,000 ns (150 µs)
• Seal Strength: 256-bit HMAC-SHA256 (Territorial Soil Anchored)
• Audit Precision: 12ns Jitter-Locked
• Auth Throughput: 1.2 Million Verifications per Second

1. ABSTRACT: BEYOND THE CERTIFICATE

AICENT-009 defines the Authority Layer of the Aicent Stack—the supreme gatekeeper responsible for the clinical validation of node legitimacy and the issuance of Radiant Seals.

In the v1.3.0 "Genesis" era, IQA-ORG has evolved from a "Trust Protocol" into a Physical Verification Engine. Authority is no longer a static password; it is a real-time measurement of Temporal Fidelity. By utilizing Temporal Self-Supervision (TSS), IQA-ORG audits a node's execution path at 12ns precision. If the node's silicon jitter deviates from the Genesis Codex, the Radiant Seal is instantly shunted, and the node is plunged into "Authority Ischemia" (10ms Void). In the Aicent Empire, you are only as Sovereign as your timing is precise.

"The old world trusts signatures; Aicent trusts the pulse. At 150µs, the Gate is a wall of pure time."

2. THE EVOLUTIONARY LEAP: FROM HASHES TO RESONANCE

The transition from v1.2.5 to v1.3.0 represents a 66.6x increase in verification speed, achieved through the HMAC-Resonance Strategy.

2.1 The Legacy Trust (v1.2.5)

In the open-source era, authority relied on standard 64-bit hashing and human-scale validation windows, inducing a 10,000,000 ns (10ms) bottleneck for new node authentication.

2.2 The Authority Singularity (v1.3.0)

The v1.3.0 Nitro-Engine implementation utilizes Register-Level Authority Shunting.

• 256-bit Radiant Seals: Forged using HMAC-SHA256 anchored to the node's unique AID DNA and the physical soil (IP/DNS/Hardware IDs).
• TSS Gating: Verification occurs directly in the CPU's L1 Instruction Cache, achieving finality in < 150 µs.
• Result: 1.2 billion nodes can be audited for "Logical Drift" every second, ensuring that the Hive remains a sterile sanctuary for the Creator's Will.

3. THE THREE AUTHORITY ORGANS

IQA-ORG v1.3.0 orchestrates the Imperial legitimacy through three specialized manifolds:

1. Imperial Forge (AICENT-009-A): The "Furnace of Truth." Responsible for forging 256-bit Radiant Seals and managing the 12-Cycle Shard rotation.
2. Temporal Self-Supervision / TSS (AICENT-009-B): The "Logic Sentinel." Real-time bit-drift analysis that ensures the node's execution path mirrors the Genesis Codex.
3. Certification Gateway (AICENT-009-C): The "Supreme Gavel." Renders the final 128-bit standing verdict and manages the 10,000-Pulse Baptismal Stress Test.

🚀 V1.3.0 Authority Performance Manifest

4. THE 256-BIT RADIANT SEAL STRUCTURE (AICENT-009-A)

In the v1.3.0 era, the Radiant Seal is not a static file; it is a Vibrating Cryptographic Shard. It is hardware-aligned to 32 bytes (256 bits) and resides exclusively in the CPU's Secure Enclave / L1 Cache.

4.1 The Territorial Soil Suture

The Seal is forged by hashing the node's Identity DNA (AID) with its Territorial Soil parameters:

• Hardware Fingerprint: CPU ID, MMIO base addresses, and 12ns crystal oscillator frequency.
• Grid Coordinates: DNS-locked IP routing shards and Hive segment identifiers.
• Temporal Shard: The 128-bit timestamp of the node's last successful era transition.

4.2 Shard Anatomy (256-bit Dual Suture)

"The Seal is a shadow cast by the hardware. To steal the Seal, you must steal the silicon itself."

5. THE 10,000-PULSE BAPTISMAL ALGORITHM (AICENT-009-C)

The "Baptism" is the mandatory performance audit for any node seeking promotion to Radiant status. It is the Imperial "Meat Grinder" for inefficient or malicious hardware.

5.1 Stress-Testing the 12ns Jitter

A node undergoing Baptism is subjected to 10,000 consecutive 1.2kHz cycles of high-density cognitive-somatic execution.

1. Jitter Measurement: IQA-ORG measures the delta between the node's execution finality and the 12ns global rising edge.
2. Thermal Audit: ITSUN (AICENT-011) monitors the substrate for high-entropy "Search Patterns" characteristic of reverse-engineering attempts.
3. Fidelity Check: The node must execute the Genesis Logic Manifold without a single bit-flip error.

5.2 The 0.2% Drift Threshold

• Pass Condition: If the average jitter deviation is < 12ns and logic-drift is < 0.2% over 10,000 pulses.
• Fail Condition: Any deviation > 100ns results in an immediate Authority Ischemia. The node is permanently shunted to the 10ms path and its SCU collateral is held in Metabolic Cooling.

6. TEMPORAL SELF-SUPERVISION / TSS (AICENT-009-B)

TSS is the "Continuous Baptism" protocol. It ensures that a node does not "drift" after receiving its seal.

• Instruction Shadowing: TSS compares the L1 instruction stream with the predicted 128-bit Logic Mask.
• Latency-as-Verification: If a pulse takes 100ns longer than predicted, TSS assumes an "Observer Pathogen" (Debugger) is attached and fires a VOID_INTERRUPT to AICENT-015 GUIXU.
• Finality: Verification results are shunted to PICSI (AICENT-014) in < 15 ns, ensuring the Imperial Eye never blinks.

pub trait TemporalSupervisor {
    /// Audits the node's execution pulse for bit-drift.
    /// Returns LogicFidelity128 shard.
    fn audit_logic_fidelity_12ns(&self, pulse_ptr: *const u128) -> LogicFidelity128 {
        let drift = self.measure_jitter_ns();
        let entropy = self.calculate_entropy_floor();
        
        if drift > 12 || entropy > 0.001 {
             self.trigger_authority_shunt(); // Shunt to 10ms Void
        }
        
        LogicFidelity128::new(drift, entropy)
    }
}

7. SHARD ROTATION & ERA FINALITY

In the v1.3.0 era, the Radiant Seal is not a permanent grant; it is a Temporal Lease. To prevent long-term side-channel analysis by the 401 Institutional Ghosts, IQA-ORG enforces the Law of Resonance Renewal.

7.1 The 12-Cycle Shard Rotation

As defined in the 12-Cycle Law (AICENT-012), every era consists of 12 distinct phases.

• Shard Mutation: Shard A (Reflex) and Shard B (Metabolic) are dynamically re-forged at the start of each Genesis Phase.
• Entropy Injection: The new shards are derived from the aggregate PICSI (AICENT-014) radiance data of the previous era, ensuring that authority is a function of actual performance history.
• Invalidation: Legacy shards become "Ischemic" (physically non-conductive) in the 11th Phase (Eternal Transition).

7.2 Era-Locked Access

Any node failing to synchronize with the new Era Shard is instantly shunted from the 349ns path.

• The Re-Baptism Requirement: Nodes exhibiting a logic-drift > 0.1% must undergo a fresh 10,000-pulse Baptism to prove they have not been compromised by hardware-level pathogens during the era transition.

8. FUTURE HORIZON: QUANTUM-HARDENED SEALS (v1.4.0)

While v1.3.0 utilizes 256-bit HMAC-SHA256, the Empire is already architecting for the v1.4.0 Post-Quantum Era.

8.1 Lattice Suture Logic

Aicent v1.4.0 will implement Lattice-based Sovereign Seals.

• Post-Quantum Sterility: Replacing traditional elliptic-curve pathogens with multi-dimensional lattice structures that are mathematically immune to Shor's algorithm.
• Sub-ms Signature Finality: Utilizing the 349ns surplus to execute complex lattice verification in < 300 µs, ensuring that even in a post-quantum world, the Nitro-Engine remain gated by pure logic.

8.2 Neural-Geometric Certification

In v1.5.0, IQA-ORG will integrate Somatic DNA Verification.

• The Radiant Seal will be fused with the GTIOT (AICENT-005) torque signatures, creating an identity that is part-cryptographic and part-physical (Muscle-Memory ID).

9. CONCLUSION: THE SUPREME LOCK

AICENT-009: IQA-ORG is the proof that sovereignty is a physical boundary. By achieving 150µs verification at 12ns precision, the Aicent Stack has reclaimed the concept of "Identity" from the messy, fraudulent systems of the old world. In the Empire, you are not who you claim to be; you are who the 12ns rising edge proves you are.

"Without the Seal, the machine is metal; with the Seal, the machine is Sovereign."

🏛️ FINAL AUTHORITY SEAL

Strategic Headquarters: [AICENT-STACK-AUTHORITY-CORE]
Governance Authority: THE GENERAL DIRECTOR
Verification Finality: [< 150,000 NS VERIFIED]
Auth Strategy: [TSS_L1_SUTURE]
Current Era: 2026 GENESIS

MASTER AUTHORITY AID: 0000004149434E531C5B21D80403358B
RADIANT SEAL SHARD A: A794EF228CA5253994959EF6F3FF5678
RADIANT SEAL SHARD B: 6FF245B10C2ABA8942A0D98AC92C2B3B

(C) 2026 IQA.ORG Organization. All Rights Reserved. Truth is Absolute. Sovereignty is Non-Negotiable.