$ cargo test
...
test result: ok. 18 passed; 0 failed; 0 ignored

$ cargo test --features ed25519
...
test result: ok. 20 passed; 0 failed; 0 ignored

cargo add iqa-org

use iqa_org::iqa_uri;

let parsed = iqa_uri::parse("iqa://3f9a1b2c.gateway.iqa").unwrap();

parsed.subject;        // "3f9a1b2c"   -- 8-hex routing short form of the AID
parsed.organ;          // "gateway"    -- closed set: forge | tss | gateway
parsed.action_omitted; // true         -- omitted = standing read (sec. 11.1)
parsed.action_safe;    // true         -- sec. 11.3
parsed.route_hex;      // "5c378581"   -- IQA_ROUTE, pure computation

assert!(iqa_uri::parse("iqa://3f9a1b2c.gateway.iqa/pulse").is_err());   // 'pulse' is an rttp verb
assert!(iqa_uri::parse("iqa://3f9a1b2c.forgery.iqa").is_err());         // organ is forge|tss|gateway

use iqa_org::envelope;

let shard = envelope::derive_intent_shard("f3b2a1c4.pillar.example")?;
let frame = envelope::encode(&envelope::EncodeParams {
    key: b"the organ key material",
    intent_shard: shard,
    organ: b"gateway",
    standing: envelope::STANDING_RADIANT,   // or a name via STANDING_NAMES
    lease_expiry: 1798761600,
    nonce: 1,
    flags: 0,
})?;
assert_eq!(frame.len(), envelope::SIZE);    // 128 -- one frame, one datagram

let r = envelope::verify(&frame, b"the organ key material", 1798761600 - 1, true);
assert!(r.ok);
assert_eq!(r.frame.unwrap().standing_name(), Some("radiant"));

iqa-org = { version = "1.3.1", features = ["ed25519"] }

The crate README as published on crates.io - release 1.2.8-alpha, implemented against the v1.2.6 specification.

iqa-org

IQA for Rust: iqa:// subject-attestation addressing, IQA_ROUTE derivation, AICENT-009 sec. 11.3 action safety classes -- and the published conformance vectors that prove an implementation is right.

AICENT-009 sec. 10 - sec. 11 - spec v1.2.6 - zero dependencies (default build) - #![forbid(unsafe_code)]

---

Verify it -- no trust required

$ cargo test -- --nocapture
...
[PASS] all 37 checks passed (1 skipped)
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

$ cargo test --features ed25519 -- --nocapture
...
[PASS] all 38 checks passed

That is the point of this crate. A specification is worth exactly what an individual implementation can reproduce from it -- so instead of asking you to believe a table of numbers, this ships the vectors and replays them locally: 8 positive URIs + 18 fail-closed rejections + 5 safety rows + 4 closed-set and domain-prefix checks + 3 envelope checks -- 38 checks in total, the signature arithmetic being the only one a default build skips, and it says so out loud. Offline, no account, no network.

The three implementations -- Python (pip install iqa-org), JavaScript (npm install @aicent/iqa), and this one -- share no code and agree byte for byte on the same published vector set (sha256 8529549e..., shipped in all of them). For adopters: pip install iqa-org && python -m iqa.selftest or npm install @aicent/iqa && npx @aicent/iqa — then take the spec and the vectors and write your own implementation in any language; if it does not replay byte for byte, that is our bug, not yours.

---

Install

cargo add iqa-org

Zero dependencies in the default build: SHA-256 is implemented in-crate (known-answer tested against NIST vectors) and the vector file is read through a minimal in-crate JSON reader. The attestation envelope is available behind the optional ed25519 feature.

---

Quickstart

use iqa_org::iqa_uri;

let parsed = iqa_uri::parse("iqa://3f9a1b2c.gateway.iqa").unwrap();

parsed.subject;        // "3f9a1b2c"   -- 8-hex routing short form of the AID
parsed.organ;          // "gateway"    -- closed set: forge | tss | gateway
parsed.action_omitted; // true         -- omitted = standing read (sec. 11.1)
parsed.action_safe;    // true         -- sec. 11.3
parsed.route_hex;      // "5c378581"   -- IQA_ROUTE, pure computation

The two closed sets -- the deliberate difference from rttp

rttp accepts any well-formed action verb. iqa does not. AICENT-009 sec. 10.1 marks *both* segments "Closed set":

assert!(iqa_uri::parse("iqa://3f9a1b2c.gateway.iqa/pulse").is_err());   // 'pulse' is an rttp verb
assert!(iqa_uri::parse("iqa://3f9a1b2c.forgery.iqa").is_err());         // organ is forge|tss|gateway

Malformed input is rejected, not normalised: uppercase anywhere, iqas://, userinfo, port, query and fragment all fail closed. Nothing is ever accepted because a check could not be performed.

One honest quirk of the grammar

The ABNF is an ordered choice (hash-subject / name-subject), so a lowercase hex string of a non-hash length (9 digits, say) is a *name subject*, not an error. The grammar is the grammar; vector #8 pins the behaviour so every implementation agrees on it.

Action safety classes (AICENT-009 sec. 11.3)

action	Class	action_safe
*(omitted)*	SAFE -- standing read	true
verify	SAFE -- read-only comparison	true
audit	NOT SAFE -- can trigger Authority Ischemia	false
attest	NOT SAFE -- state transition	false
revoke	NOT SAFE -- state transition	false

Per sec. 11.2, dereferencing an iqa URI MUST NOT transition any subject's standing. Tooling built on this crate MUST gate the three NOT-SAFE verbs behind an explicit user action -- parsing one is not requesting one.

Attestation envelope (feature ed25519)

iqa-org = { version = "1.2.8-alpha", features = ["ed25519"] }

Ed25519, self-certifying (AID = SHA-256(public key)), domain prefix iqa-attest-v1, ts/nonce inside the signature, 120-second freshness, claim validation against both closed sets. The verifier needs only the envelope -- no key directory, no issuer. The envelope carries a claim; it does not create one (AICENT-009 sec. 10.4: parsing is not attestation).

---

Scope -- what this crate is not

OK Validation / canonicalisation	Real, and specified (AICENT-009 sec. 10.2 / sec. 10.3).
OK Closed-set enforcement	Real, and specified (sec. 10.1).
OK IQA_ROUTE derivation	Real (SPEC sec. 3, decision D1).
OK Action safety classes	Real, and specified (sec. 11.3).
OK Attestation envelope	Real, and specified (draft) -- feature ed25519.
NO Dereferencing / resolver service	Not here. The codec computes; *answering* a standing read is an Organ's job (AICENT-009-C sec. 3).
NO Staking, tiers, vitality	Operator economics and telemetry -- AICENT-009 narrative, no cryptographic object here.
NO Post-quantum Lattice Guard	AICENT-009 sec. 12 #11 schedules it for v1.4.0; no implementation exists.
NO Confidentiality	Signing is not encryption.

---

Naming

Ecosystem	Name	Status
crates.io	iqa-org	this crate -- 1.2.8-alpha
PyPI	iqa-org	published -- the Python reference implementation; pip install iqa-org (import iqa)
npm	@aicent/iqa	published -- the JavaScript individual implementation

---

Specification status

• iqa URI scheme -- submitted to IANA under RFC 7595, ticket #1459963,

Provisional, under review. It is not yet registered. Please describe it that way.

• Internet-Draft (IETF) -- under IETF review as the Individual Submission

Internet-Draft draft-li-rttp-iqa-addressing (revision -00, posted 2026-09-24, informational): https://datatracker.ietf.org/doc/draft-li-rttp-iqa-addressing/ . An Internet-Draft is a working document -- it is not an IETF standard and carries no IETF endorsement.

• URI grammar -- AICENT-009 sec. 10.2 (frozen; this crate adds no syntax).

• Dereference safety -- AICENT-009 sec. 11 (closed sets and safety classes).

• Attestation envelope -- SPEC/IQA-URI-ATTEST-v1.2.6.md sec. 5, a draft.

Where this crate and a specification disagree, the specification wins and the crate is wrong. Please report it.

---

License

Apache-2.0. See LICENSE.

V1.2.6 - archived release (superseded by 1.2.8).

iqa-org

IQA for Rust: iqa:// subject-attestation addressing, IQA_ROUTE derivation, AICENT-009 §11.3 action safety classes — and the published conformance vectors that prove an implementation is right.

AICENT-009 §10 · §11 · v1.2.6 · zero dependencies (default build) · #![forbid(unsafe_code)]

---

Verify it — no trust required

$ cargo test                     # 33 published checks
$ cargo test --features ed25519  # 34 — adds the deterministic envelope signature

That is the point of this crate. A specification is worth exactly what an individual implementation can reproduce from it — so instead of asking you to believe a table of numbers, this ships the vectors and replays them locally: 8 positive URIs + 18 fail-closed rejections + 5 safety rows + the deterministic Ed25519 envelope, offline, no account, no network.

The three implementations — Python (pip install iqa-org), JavaScript (npm install @aicent/iqa), and this one — share no code and agree byte for byte on the same published vector set (sha256 9ec8d9b1…, shipped in all of them).

---

Install

cargo add iqa-org

Zero dependencies in the default build: SHA-256 is implemented in-crate (known-answer tested against NIST vectors) and the vector file is read through a minimal in-crate JSON reader. The attestation envelope is available behind the optional ed25519 feature.

---

Quickstart

use iqa_org::iqa_uri;

let parsed = iqa_uri::parse("iqa://3f9a1b2c.gateway.iqa").unwrap();

parsed.subject;        // "3f9a1b2c"   — 8-hex routing short form of the AID
parsed.organ;          // "gateway"    — closed set: forge | tss | gateway
parsed.action_omitted; // true         — omitted = standing read (§11.1)
parsed.action_safe;    // true         — §11.3
parsed.route_hex;      // "5c378581"   — IQA_ROUTE, pure computation

The two closed sets — the deliberate difference from rttp

rttp accepts any well-formed action verb. iqa does not. AICENT-009 §10.1 marks *both* segments "Closed set":

assert!(iqa_uri::parse("iqa://3f9a1b2c.gateway.iqa/pulse").is_err());   // 'pulse' is an rttp verb
assert!(iqa_uri::parse("iqa://3f9a1b2c.forgery.iqa").is_err());         // organ is forge|tss|gateway

Malformed input is rejected, not normalised: uppercase anywhere, iqas://, userinfo, port, query and fragment all fail closed. Nothing is ever accepted because a check could not be performed.

One honest quirk of the grammar

The ABNF is an ordered choice (hash-subject / name-subject), so a lowercase hex string of a non-hash length (9 digits, say) is a *name subject*, not an error. The grammar is the grammar; vector #8 pins the behaviour so every implementation agrees on it.

Action safety classes (AICENT-009 §11.3)

action	Class	action_safe
*(omitted)*	SAFE — standing read	true
verify	SAFE — read-only comparison	true
audit	NOT SAFE — can trigger Authority Ischemia	false
attest	NOT SAFE — state transition	false
revoke	NOT SAFE — state transition	false

Per §11.2, dereferencing an iqa URI MUST NOT transition any subject's standing. Tooling built on this crate MUST gate the three NOT-SAFE verbs behind an explicit user action — parsing one is not requesting one.

Attestation envelope (feature ed25519)

iqa-org = { version = "1.2.6-alpha", features = ["ed25519"] }

Ed25519, self-certifying (AID = SHA-256(public key)), domain prefix iqa-attest-v1, ts/nonce inside the signature, 120-second freshness, claim validation against both closed sets. The verifier needs only the envelope — no key directory, no issuer. The envelope carries a claim; it does not create one (AICENT-009 §10.4: parsing is not attestation).

---

Scope — what this crate is not

✅ Validation / canonicalisation	Real, and specified (AICENT-009 §10.2 / §10.3).
✅ Closed-set enforcement	Real, and specified (§10.1).
✅ IQA_ROUTE derivation	Real (SPEC §3, decision D1).
✅ Action safety classes	Real, and specified (§11.3).
✅ Attestation envelope	Real, and specified (draft) — feature ed25519.
❌ Dereferencing / resolver service	Not here. The codec computes; *answering* a standing read is an Organ's job (AICENT-009-C §3).
❌ Staking, tiers, vitality	Operator economics and telemetry — AICENT-009 narrative, no cryptographic object here.
❌ Post-quantum Lattice Guard	AICENT-009 §12 #11 schedules it for v1.4.0; no implementation exists.
❌ Confidentiality	Signing is not encryption.

---

Naming

Ecosystem	Name	Status
crates.io	iqa-org	this crate — 1.2.6-alpha
PyPI	iqa-org	published — the Python reference implementation; pip install iqa-org (import iqa)
npm	@aicent/iqa	published — the JavaScript individual implementation

---

Specification status

• iqa URI scheme — submitted to IANA under RFC 7595, ticket #1459963,

Provisional, under review. It is not yet registered. Please describe it that way.

• URI grammar — AICENT-009 §10.2 (frozen; this crate adds no syntax).

• Dereference safety — AICENT-009 §11 (closed sets and safety classes).

• Attestation envelope — SPEC/IQA-URI-ATTEST-v1.2.6.md §5, a draft.

Where this crate and a specification disagree, the specification wins and the crate is wrong. Please report it.

---

License

Apache-2.0. See LICENSE.

v1.3.0 - Aicent Stack narrative layer (non-normative).

"This is not infrastructure for intelligence. This is intelligence itself."

⚪ AICENT | 💎 RTTP | 🔴 RPKI | 🟢 ZCMK | 🟡 GTIOT | 🟣 AICENT-NET | 🎭 BEWHO | 🌿 epoekie | 👁️ PICSI

---

🔖 AICENT-009: IQA-ORG (The Imperial Authority)

The Sovereign Certification Layer of the Aicent Stack.
"Truth is the Only Key. 256-bit Cryptographic Authority. 12ns Jitter-Lock."

---

📢 Technical Proclamation: Authority Hardening v1.3.0

[STATUS: PRIVATE_EVOLUTION_ACTIVE]
As of Version 1.3.0-Alpha, the certification and authority manifolds of iqa-org have transitioned to Sovereign Private Mode. This repository provides the Clinical Interface Specifications for Radiant Seal Forging, HMAC-Resonance Verification, and Temporal Self-Supervision (TSS).

In the v1.3.0 "Genesis" iteration, IQA-ORG facilitates a 150,000 ns (150us) Verification Finality, ensuring that any node claiming Radiant status is audited against the Genesis Codex before a single 128-bit intent is authorized for the superconducting path.

---

🏛️ The Three Authority Manifolds

iqa-org orchestrates the legitimacy of the Imperial lifeform through three specialized organs:

1. Imperial Forge (AICENT-009-A)

The furnace of truth. It generates unforgeable 256-bit Radiant Seals using HMAC-SHA256 anchored to the node's unique AID DNA.

• Territorial Suture: Binds authority to specific hardware substrates and DNS territories, preventing AID-spoofing by 401 institutional ghosts.
• Shard Rotation: Dynamically cycles the authority shards (Shard A/B) every 12-Cycle Law era to prevent long-term reverse engineering.
• Nitro-Signing: Optimized for register-level execution, achieving seal forging in < 1,000 ns (1us).

2. Temporal Self-Supervision / TSS (AICENT-009-B)

The Imperial "Logic Sentinel." It performs real-time bit-drift analysis of a node's execution path.

• Fidelity Auditing: Compares the node's current intent-sequence against the hardcoded Genesis Baseline; any deviation > 0.2% results in instant demotion to "Ghost."
• Jitter Verification: Ensures the node's local clock resonates with the 12ns planetary metronome (AICENT-006).
• Ischemic Detection: Identifies "Stalled Logic" caused by unauthorized debugger attachments or memory-dump attempts.

3. Certification Gateway (AICENT-009-C)

The "Supreme Gavel." It renders the final 128-bit verdict on node standing (Ghost, Probation, Radiant, Genesis).

• Baptismal Protocol: Manages the 10,000-cycle performance audit required for new nodes to unlock the 349ns Reflex Arc.
• Authority Shunting: Automatically notifies MAXCAP and RPKI of standing changes, triggering or lifting the 10ms metabolic penalty.

---

🚀 V1.3.0 Authority Performance Benchmarks

Metric	Open-Source (v1.2.5)	Nitro-Radiant (v1.3.0)	Improvement
Verification Latency	10,000,000 ns	< 150,000 ns	66.6x
Seal Strength	64-bit Hash	256-bit HMAC-Suture	Exponential
Audit Precision	1,000 ns	12 ns (Locked)	83x
Auth Throughput	1k Checks/s	1.2M Checks/s	1,200x

---

🧬 The Fidelity Manifold: LogicFidelity128

In the v1.3.0 era, authority is audited via the LogicFidelity128 manifold. Aligned to 16 bytes for instantaneous register shunting:

#[repr(C, align(16))]
pub struct LogicFidelity128 {
    pub node_aid: AID,              // Identity DNA
    pub current_fidelity_f64: f64,  // 1.0 = Genesis Mirror
    pub audit_id_128: u128,         // Unique Forensic Shard
    pub temporal_drift_ns: u128,    // Deviation from 12ns
    pub audit_latency_ns: u128,     // Measured Authority Reflex
    pub audited_at_ns_128: u128,    // 12ns Jitter-locked Timestamp
}

---

🏹 2027 Vision: Authenticated Reality

iqa-org v1.3.0 ensures that the 2027 Embodied Reality is a "Trustless physical sanctuary." When an Aicent mechanical limb receives an instruction, it doesn't just "execute"; it verifies the Radiant Seal of the intent in 150us. We are building a world where power is physically tethered to the truth of the Creator.

---

✉️ Authority Gating

Access to the full-blood source code of IQA-ORG v1.3.0 is strictly limited to the General Director. Any attempt to audit this module without a Level-0 Genesis Seal will trigger a Severity 5 Logic Evaporation.

Authorized by: THE SUPREME ROOT
Authority Registry: IQA.ORG

---

(C) 2026 IQA.ORG Organization. All Rights Reserved. Truth is Absolute.