== candidate bytes equal the source at 6bb462f578c12d339b8fa964a5b1d8f97dbffa68 ok: 64 files == native, draft-kroehl-agentic-trust-aae-00 $ python3 tools/validate_schema.py OK 01-valid-root-aae.json OK 02-expired-not-after.json OK 03-too-early-not-before.json OK 04-revocation-endpoint-5xx.json OK 05-single-use-replay.json OK 06-delegation-valid-depth-2.json OK 07-delegation-action-superset.json OK 08-delegation-constraint-relaxation.json OK 09-delegation-depth-exceeded.json OK 10-delegation-cycle-detection.json OK 11-delegation-cascade-revocation.json OK 12-signing-authority-mismatch.json OK 13-unrecognized-required-constraint.json OK 14-cty-header-wrong.json OK 15-currency-mismatch-delegation.json 15/15 vectors valid against schema $ python3 examples/python-verify.py PASS 01-valid-root-aae.json ACCEPT @ step 7 [structural] PASS 02-expired-not-after.json REJECT @ step 3 [runtime] (expired_not_after) PASS 03-too-early-not-before.json REJECT @ step 3 [runtime] (not_yet_valid_not_before) PASS 04-revocation-endpoint-5xx.json REJECT @ step 8 [runtime] (revocation_status_indeterminate) PASS 05-single-use-replay.json REJECT @ step 5 [runtime] (single_use_already_consumed) PASS 06-delegation-valid-depth-2.json ACCEPT @ step 9 [structural] PASS 07-delegation-action-superset.json REJECT @ step 9 [structural] (delegated_actions_not_subset) PASS 08-delegation-constraint-relaxation.json REJECT @ step 9 [structural] (delegated_constraint_relaxed) PASS 09-delegation-depth-exceeded.json REJECT @ step 9 [structural] (delegation_depth_exceeded) PASS 10-delegation-cycle-detection.json REJECT @ step 9 [structural] (delegation_cycle_detected) PASS 11-delegation-cascade-revocation.json REJECT @ step 9 [runtime] (ancestor_revoked) PASS 12-signing-authority-mismatch.json REJECT @ step 1 [structural] (signing_authority_mismatch) PASS 13-unrecognized-required-constraint.json REJECT @ step 7 [structural] (unrecognized_required_constraint) PASS 14-cty-header-wrong.json REJECT @ step 2 [structural] (cty_not_aae_json) PASS 15-currency-mismatch-delegation.json REJECT @ step 9 [structural] (delegation_currency_mismatch) 15/15 vectors passed (5 runtime, 10 structural) $ python3 -m pytest -q -p no:cacheprovider tests/ .............. [100%] 14 passed in 0.07s == enforce, draft-kroehl-agentic-trust-aae-02 $ python3 tools/validate_enforce_schema.py PASS 01-type-form-matches-permit.json PASS 02-instance-value-inside-the-action-deny.json PASS 03-type-field-missing-from-the-action-deny.json PASS 04-action-is-a-string-deny.json PASS 05-action-is-an-array-deny.json PASS 06-action-is-a-number-deny.json PASS 07-action-is-null-deny.json PASS 08-grant-without-type_fields-deny.json PASS 09-type_fields-without-verb-deny.json PASS 10-duplicate-name-in-type_fields-deny.json PASS 11-exact-holds-permit.json PASS 12-exact-fails-on-a-vanity-prefix-deny.json PASS 13-enum-holds-permit.json PASS 14-enum-fails-deny.json PASS 15-range-holds-at-the-upper-bound-permit.json PASS 16-range-fails-one-over-the-bound-deny.json PASS 17-unknown-constraint-type-deny.json PASS 18-field-path-with-an-empty-segment-deny.json PASS 19-explicit-hold-pending.json PASS 20-unaddressed-action-is-never-pending-deny.json PASS 21-forbid-outranks-an-allowing-grant-deny.json PASS 22-ratified-by-the-issuing-principal.json PASS 23-stranger-with-a-valid-signature-rejected.json PASS 24-a-permit-is-not-ratifiable-caller-error.json PASS 25-chain-link-pointing-elsewhere-caller-error.json PASS 26-chain-link-set-explicitly-to-the-ratified-record.json 26/26 enforce vectors valid $ python3 examples/enforce-verify.py PASS 01-type-form-matches-permit.json PERMIT PASS 02-instance-value-inside-the-action-deny.json DENY PASS 03-type-field-missing-from-the-action-deny.json DENY PASS 04-action-is-a-string-deny.json DENY PASS 05-action-is-an-array-deny.json DENY PASS 06-action-is-a-number-deny.json DENY PASS 07-action-is-null-deny.json DENY PASS 08-grant-without-type_fields-deny.json DENY PASS 09-type_fields-without-verb-deny.json DENY PASS 10-duplicate-name-in-type_fields-deny.json DENY PASS 11-exact-holds-permit.json PERMIT PASS 12-exact-fails-on-a-vanity-prefix-deny.json DENY PASS 13-enum-holds-permit.json PERMIT PASS 14-enum-fails-deny.json DENY PASS 15-range-holds-at-the-upper-bound-permit.json PERMIT PASS 16-range-fails-one-over-the-bound-deny.json DENY PASS 17-unknown-constraint-type-deny.json DENY PASS 18-field-path-with-an-empty-segment-deny.json DENY PASS 19-explicit-hold-pending.json PENDING PASS 20-unaddressed-action-is-never-pending-deny.json DENY PASS 21-forbid-outranks-an-allowing-grant-deny.json DENY PASS 22-ratified-by-the-issuing-principal.json RATIFIED PASS 23-stranger-with-a-valid-signature-rejected.json REJECTED PASS 24-a-permit-is-not-ratifiable-caller-error.json RatifyError PASS 25-chain-link-pointing-elsewhere-caller-error.json RatifyError PASS 26-chain-link-set-explicitly-to-the-ratified-record.json RATIFIED 26/26 enforce vectors passed == composition, draft-kroehl-agentic-trust-aae-00 with draft-yossif-psea-02 $ python3 tools/validate_interop_schema.py OK interop/psea/vectors/xp-1-aligned-principal.json OK interop/psea/vectors/xp-2-principal-divergence.json OK interop/psea/vectors/xp-3-unresolved-binding.json OK interop/psea/vectors/xp-5a-enrollment-pending.json OK interop/psea/vectors/xp-5b-enrollment-complete.json OK interop/psea/vectors/xp-6-alias-convergence.json 6/6 composition vectors valid against schema $ python3 examples/composition-verify.py stages: aae_native | action_linkage | principal_linkage | evidence_satisfaction | freshness | decision | admission | outcome PASS xp-1-aligned-principal.json ACCEPT | EQUIVALENT | SAME | SATISFIED | WELL_FORMED | AUTHORIZED | NONE | NONE PASS xp-2-principal-divergence.json ACCEPT | EQUIVALENT | DIVERGENT(principal_divergence) | UNSATISFIED(principal_divergence) | WELL_FORMED | REFUSED(principal_divergence) | NONE | NONE PASS xp-3-unresolved-binding.json ACCEPT | EQUIVALENT | UNRESOLVED(unresolved_binding) | NOT_EVALUATED(unresolved_binding) | WELL_FORMED | REFUSED(unresolved_binding) | NONE | NONE PASS xp-5a-enrollment-pending.json ACCEPT | EQUIVALENT | UNRESOLVED(unresolved_binding) | NOT_EVALUATED(unresolved_binding) | WELL_FORMED | REFUSED(unresolved_binding) | NONE | NONE PASS xp-5b-enrollment-complete.json ACCEPT | EQUIVALENT | SAME | SATISFIED | WELL_FORMED | AUTHORIZED | NONE | NONE PASS xp-6-alias-convergence.json ACCEPT | EQUIVALENT | SAME | SATISFIED | WELL_FORMED | AUTHORIZED | NONE | NONE 6/6 composition vectors passed (row-by-row) $ python3 tools/run_negative_controls.py stages: aae_native | action_linkage | principal_linkage | evidence_satisfaction | freshness | decision | admission | outcome PASS C1 One octet of the secondary-side digest flipped ACCEPT | NOT_EQUIVALENT(join_mismatch) | SAME | UNSATISFIED(evidence_covers_a_different_action) | WELL_FORMED | REFUSED(join_mismatch) | NONE | NONE PASS C2 XP-3's principal given a table entry resolving to a different principal ACCEPT | EQUIVALENT | DIVERGENT(principal_divergence) | UNSATISFIED(principal_divergence) | WELL_FORMED | REFUSED(principal_divergence) | NONE | NONE PASS C3 PSEA proof signature tampered ACCEPT | INDETERMINATE(secondary_unauthenticated) | UNRESOLVED(secondary_unauthenticated) | UNSATISFIED(invalid_signature) | NOT_EVALUATED(secondary_unauthenticated) | REFUSED(secondary_native_reject) | NONE | NONE PASS C4 Clock moved past the AAE not_after REJECT(expired_not_after) | INDETERMINATE(aae_not_admitted) | UNRESOLVED(aae_not_admitted) | NOT_EVALUATED(aae_not_admitted) | NOT_EVALUATED(aae_not_admitted) | REFUSED(aae_native_reject) | NONE | NONE PASS C5 Another instant inside both validity windows ACCEPT | EQUIVALENT | SAME | SATISFIED | WELL_FORMED | AUTHORIZED | NONE | NONE PASS C6 Declared aae_digest differs from the signed action_binding ACCEPT | INDETERMINATE(aae_binding_mismatch) | UNRESOLVED(action_linkage_unestablished) | NOT_EVALUATED(action_linkage_unestablished) | NOT_EVALUATED(action_linkage_unestablished) | REFUSED(action_linkage_unestablished) | NONE | NONE PASS C7 Signed envelope carries no action_binding ACCEPT | INDETERMINATE(aae_binding_absent) | UNRESOLVED(action_linkage_unestablished) | NOT_EVALUATED(action_linkage_unestablished) | NOT_EVALUATED(action_linkage_unestablished) | REFUSED(action_linkage_unestablished) | NONE | NONE PASS C8 Payload does not hash to the declared action digest ACCEPT | NOT_EQUIVALENT(payload_digest_mismatch) | SAME | UNSATISFIED(payload_digest_mismatch) | WELL_FORMED | REFUSED(payload_digest_mismatch) | NONE | NONE PASS C9 Payload leaves the I-JSON subset ACCEPT | INDETERMINATE(payload_not_i_json) | UNRESOLVED(action_linkage_unestablished) | NOT_EVALUATED(action_linkage_unestablished) | NOT_EVALUATED(action_linkage_unestablished) | REFUSED(action_linkage_unestablished) | NONE | NONE PASS C10 Token carries its own key material and claims an enrolled kid ACCEPT | INDETERMINATE(secondary_unauthenticated) | UNRESOLVED(secondary_unauthenticated) | UNSATISFIED(invalid_signature) | NOT_EVALUATED(secondary_unauthenticated) | REFUSED(secondary_native_reject) | NONE | NONE PASS C11 Signed token with psea_counter absent ACCEPT | EQUIVALENT | SAME | SATISFIED | CLAIMS_MALFORMED(counter_malformed) | REFUSED(counter_malformed) | NONE | NONE 11/11 negative controls passed (row-by-row) psea-fixture-v0.json: OK == regeneration: every generator rebuilds its files byte for byte ok: rebuild is byte-identical