Blog · 2026-10-10 · The public challenge

A public challenge: any language, fully offline — if it doesn't run, it's on us

“A specification is worth exactly what a stranger can reproduce from it.”

Author: Aicent Stack · The challenge itself lives at iqa.org/challenge/

This year has produced many articles on "trustworthy agents", "semantic addressing", and "auditability". We did not want to be an exception — so we decided to do something unoriginal: freeze our protocol specification, publish the 35 test vectors, and leave two empty slots on the scoreboard, waiting for a stranger to run them.

The rules are four, verbatim from iqa.org/challenge/:

  1. Read the spec only. Our source code is off limits.
  2. Any language. Zero restrictions.
  3. Fully offline. No account, no network, no callbacks.
  4. Deterministic. Same input, same bytes, every time.

The 30-second self-check (runs right after install)

pip install rttp && python -m rttp.selftest              # [PASS] all 80 checks passed (3 skipped)
pip install "rttp[ed25519]" && python -m rttp.selftest   # [PASS] all 83 checks passed
pip install iqa-org && python -m iqa.selftest            # [PASS] all 108 checks passed (3 skipped)
pip install "iqa-org[ed25519]" && python -m iqa.selftest # [PASS] all 111 checks passed
npm install @aicent/rttp && npx @aicent/rttp             # [PASS] all 35 checks passed
cargo add rttp && cargo test                             # [PASS] 13 tests + 1 doc test
npm install @aicent/iqa && npx @aicent/iqa               # [PASS] all 32 checks passed
cargo add iqa-org && cargo test                          # [PASS] 18 tests + 2 doc tests

The expected output of these eight commands is pinned on the challenge page — the CI asserts it on every push. Install, run, and you will know whether our implementation and our documentation tell the same story.

To be clear: "any language" is the challenger's freedom, not the boundary of our implementation — the three reference implementations are a starting point, not a ceiling. Go, Java, C... that is exactly what the scoreboard is waiting for.

Scoreboard: 0 to 0, seats empty

The challenge page carries a scoreboard: independent implementations, rttp = 0, iqa = 0.

It also carries a harsher line: "The authors' own reference implementations don't count — that is the entire point of this page."

So who are the two seats for? For anyone who reads only the specification, never our source, and re-derives deterministic results in any language. Run all 35 vectors and your name, your repository, and your copyright go onto the challenge page and into the specification's Implementation Status section, cited for the long term.

And if it doesn't run?

The page's own words: "If a vector fails under a faithful reading of the specification, that is our bug. We fix the specification or the implementation, credit you by name, and republish the vectors with new digests."

The best part of this arrangement: you win either way. Run it through — your name enters the record. It fails — our bug gets fixed with your name on the credit. And if you would rather pass quietly without being listed, that counts as a pass too.

The honest boundary

The specification is under review in the IETF independent submission stream (rttp:// registered with IANA · Provisional · CRI 27; iqa:// registered with IANA · Provisional · CRI 28). What we are challenging is "whether the documentation is self-sufficient" — not market position, not whose slogan is louder. The page has been there since the day it launched; the seats are still empty.

Run it through — your name enters the record. It fails — our bug is fixed with your name on it. Either way, you win.