The Conformance Challenge

A specification is worth exactly what a stranger can reproduce from it. These specifications are frozen, the vectors are public, and the answers ship inside every package. Now we would like to see what the documents alone are worth.

The deal

Take the AICENT-002 specification and the published vector set — 35 vectors, sha256 4b743e63..., shipped inside every package. Write an implementation in any language, from the specification alone. Do not read our code. Replay all 35 vectors byte for byte.

The tiers

Tier 1 — the URI gauntlet (21 vectors). 6 positive forms and 15 fail-closed rejections. If your parser accepts uppercase, or normalises what the spec says must be rejected, you fail exactly where the spec says you must fail.
Tier 2 — the frame and the envelope (14 vectors). 3 deterministic frames, 9 fail-closed frames, 1 accepted frame, 1 envelope. The envelope check requires an Ed25519 backend; everything else is zero-dependency.

What you get

Pass all 35 and you are listed on this page as an independent implementation — your name, your link, your copyright — and your implementation enters the record cited in the RFC's Implementation Status section.
If a vector fails under a faithful reading of the specification, that is our bug. We fix the specification or the implementation, credit you by name, and republish the vectors under a new digest.
Either way, you win. If you would rather pass quietly, say so — passing without a listing is still passing.

Sanity check before you start

pip install rttp && python -m rttp.selftest     # [PASS] all 80 checks passed (3 skipped)
npm install @aicent/rttp && npx @aicent/rttp    # [PASS] all 35 checks passed

These are the reference implementations, CI-asserted on every push. Yours should disagree with them in nothing but the language.

The deal

Take the AICENT-009 specification and the published vector set — sha256 8529549e... (vectors.json, shipped inside every package: PyPI iqa-org, npm @aicent/iqa, crates.io iqa-org). Write an implementation in any language, from the specification alone. Do not read our code. Replay the set byte for byte.

The tiers

Tier 1 — the URI tier. The positive forms and the fail-closed rejections, including the closed-set and domain-prefix rules. The counts live in the vector file — the file is the authority, so nothing here can drift.
Tier 2 — the envelope. The Ed25519-signed attestation envelope. This tier requires a crypto backend; the URI tier is zero-dependency.

What you get

Pass the set and you are listed on this page as an independent implementation — your name, your link, your copyright — and your implementation enters the record cited in the RFC's Implementation Status section.
If a vector fails under a faithful reading of the specification, that is our bug. We fix the specification or the implementation, credit you by name, and republish the vectors under a new digest.
Either way, you win. If you would rather pass quietly, say so — passing without a listing is still passing.

Sanity check before you start

pip install iqa-org && python -m iqa.selftest   # [PASS] all 75 checks passed (3 skipped)
npm install @aicent/iqa && npx @aicent/iqa      # [PASS] all 32 checks passed

These are the reference implementations, CI-asserted on every push. Yours should disagree with them in nothing but the language.

The scoreboard

Scheme	Independent implementations
`rttp`	0 — the seat is open
`iqa`	0 — the seat is open

Reference implementations by the authors do not count — that is the entire point of this page.

The rules

From the specification alone. Do not read our source.
Any language. Zero restrictions.
Offline. No account, no network, no phone-home.
Deterministic. Same input, same bytes, every time.

How to submit

Publish your implementation in a public repository, then email the link and your replay output to lee@iqa.org. We will read it, run it against the vectors, and list it. If something fails, we will tell you exactly which vector and why — and if the fault is ours, you get the credit for finding it.