This page — the iqa:// URI reference · release 1.2.8

Normative here: RFC-009 §10 (the iqa URI — syntax, ABNF, client requirements, registration status) and §11 (default dereference and operation safety). Everything below is verified offline, in your browser, from the envelope itself. Current packages: 1.2.8 on PyPI and npm, 1.2.8-alpha on crates.io — every asserted count (75 default · 78 with the Ed25519 backend · 32 on npm · 37/38 on crates.io) is reproduced by CI on every push.

Offline Verification · in your browser Spec v1.2.6 · packages 1.2.8 (PyPI, npm) Live stream — issuing simulated · verifying real Ed25519 · WebCrypto Zero Dependencies iqa:// — submitted (IANA #1459963), not yet registered

Verify, Don't Trust.

Paste an attestation envelope below. This page verifies it in your browser — crypto.subtle, no account, no network call, no server. [PASS] or it is not.

Citable standing

An iqa URI names the attestation state of a subject as reported by one of three named organs (forge · tss · gateway), without carrying the underlying proof. Reading the syntax establishes nothing about any subject — standing is established only by the seal and by the answering organ.

1 · Live — the grid, attested in real time

Verified

Rejected

Avg verify

—

Last verify

—

connecting…

Latency is measured in this browser around crypto.subtle.verify (includes JS scheduling overhead). The RFC-009 §4.3 target (< 150 µs) is a hardware-integrated figure — measured numbers are shown as measured, nothing is claimed.

What the live stream above proves — and what it does not

✓The Ed25519 mathematics. AID self-certification (AID = SHA-256(pub)), canonical signing input, and the signature itself — replayed locally against SPEC/IQA-URI-ATTEST-v1.2.6 §5, the same vectors the iqa-org (PyPI and crates.io) and @aicent/iqa packages ship.
✓The grammar. Claim payloads are checked against RFC-009 §10.2 — closed sets (forge·tss·gateway, verify·audit·attest·revoke), lowercase US-ASCII, fail closed.
✗A verified signature does not prove the standing is true. It proves who said it, not that it is so — parsing is not attestation, and verifying is not trusting (RFC-009 §10.4). Whether the standing is real is the answering Organ's business (§3), not this page's.
✗No revocation, no lookup. A compromised key stays valid to any verifier that has never met it. Absence of evidence is not evidence of compliance — fail closed (§12 #10).
⚠In the live stream above, the issuing side is a simulated Gateway organ — the subjects, standings and vitality numbers are canned. What is real: every envelope carries a genuine Ed25519 signature, and every verification runs in this browser. The issuer is theatre; the judge is your machine.

2 · Verify an envelope

Envelope JSON

Archival mode — skip the 120 s freshness window (for published vectors & audit records only; never for live input)

3 · Seal a claim (your own key, generated in this tab)

subject_uri (RFC-009 §10.2) organ — closed set standing — closed set (RFC-009-C §3)

Envelope — copy it into the verifier above, or keep it as an audit record

Canonical signing input (hex) — everything except sig is covered by the signature

4 · Replay it from the registries

pypi · iqa-org 1.2.8 · npm · @aicent/iqa 1.2.8 · crates.io · iqa-org 1.2.8-alpha

$ pip install iqa-org && python -m iqa.selftest # [PASS] all 75 checks (3 skipped) — core install

$ pip install "iqa-org[ed25519]" && python -m iqa.selftest # [PASS] all 78 checks — with the Ed25519 backend

$ npm install @aicent/iqa && npx @aicent/iqa # [PASS] all 32 checks — npm, individual implementation

$ cargo add iqa-org@1.2.8-alpha && cargo test # 37 checks (1 skipped) replayed — crates.io, SHA-256 written in-crate

Three implementations share no code; all replay the same published vector set (sha256 8529549e…, shipped in each package) and agree byte for byte. Apache-2.0. Versioning: 1.2.8 on PyPI and npm, 1.2.8-alpha on crates.io. 1.2.8 carries a large conformance expansion and no protocol change: the asserted check counts grew to 75 (default) and 78 (with the optional Ed25519 backend) on PyPI, 35 on npm and 37/38 on crates.io; the package metadata now carries the IETF naming; and verify_envelope keeps returning its documented error instead of raising NameError when the optional [ed25519] backend is absent (fixed in 1.2.7). Modules, vectors and wire format are unchanged.

5 · The 30-second loop — one address, three ways to know it

Open in the resolver ↗

③ The resolver page — rendered live below, or open it in its own tab

# ① machine side — a clean machine pulls this from the registry first:

$ npx @aicent/iqa

[PASS] all 32 checks passed (node, individual implementation)

              one address: iqa://3f9a1b2c.gateway.iqa
                        │
          ┌─────────────┴─────────────┐
          ▼                           ▼
    ③ web side (for humans)     ② code side (for machines)
    who the address is:         where it goes:
    organ · standing · action   4-byte route fingerprint
    resolved above, live        5c378581 — pure computation
          │                           │
          └────────────┬──────────────┘
                       ▼
          ① 32 published vectors pin both → PASS