This page — the iqa:// URI reference · release 1.3.1

Normative here: AICENT-009 §10 (the iqa URI — syntax, ABNF, client requirements, registration status) and §11 (default dereference and operation safety); the four-state standing vocabulary is normative since v1.2.9 (§11.1.1). Current packages: 1.3.1 on PyPI, npm and crates.io — the first formal (non-pre-release) crates.io publication — plus the GitHub organizations; every asserted count (105 default · 108 with the Ed25519 backend · 32 on npm · 17+2 / 19+2 on crates.io) is reproduced by CI on every push.

New in this wave: AE-128, the fixed 128-byte answer carrier (companion draft v0.3, public edition) — magic IQAE, HMAC-SHA256 over the whole frame, the standing closed set at offset 80 — implemented in the packages (iqa.envelope · @aicent/iqa/envelope · iqa_org::envelope) and pinned by ae128-vectors-v1.json (sha256 ceff2d11…). It gets its own live verifier in section 4 below. The conformance base is unchanged (sha256 8529549e…); the era snapshot lives at iqa.org/URI/v1.3.1/.

Offline Verification · in your browser Spec base · packages 1.3.1 (PyPI · npm · crates · GitHub) Live stream — issuing simulated · verifying real Ed25519 · WebCrypto Zero Dependencies iqa:// — scheme name approved · CRI number in expert review

Verify, Don't Trust.

Paste an attestation envelope below. This page verifies it in your browser — crypto.subtle, no account, no network call, no server. [PASS] or it is not.

Citable standing — this page is [IQA-SPEC]

An iqa URI names the attestation state of a subject as reported by one of three named organs (forge · tss · gateway), without carrying the underlying proof. Reading the syntax establishes nothing about any subject — standing is established only by the seal and by the answering organ.

This is a Demo Center scenario, not the normative page. The reference specification cited as [IQA-SPEC] lives at iqa.org/URI; the standing vocabulary it defines (ghost · probation · radiant · genesis, a closed set) and the Table 1 safety classes are exactly what this verifier enforces.

2 · Verify an envelope

Envelope JSON

Archival mode — skip the 120 s freshness window (for published vectors & audit records only; never for live input)

3 · Seal a claim (your own key, generated in this tab)

subject_uri (draft §5.1 grammar) organ — closed set standing — closed set (defined by [IQA-SPEC], iqa.org/URI)

Envelope — copy it into the verifier above, or keep it as an audit record

Canonical signing input (hex) — everything except sig is covered by the signature

4 · AE-128 — the answer carrier (v1.3.1 companion · draft v0.3 · all offline)

The second envelope on this page is deliberately different: no Ed25519, no JSON — a fixed 128-byte frame with every field at a fixed offset, authenticated by HMAC-SHA256 over the entire frame (the attestation field itself zeroed). A verifier needs only a hash function. Everything below runs in your browser via crypto.subtle; the loaded vector is AE128-VECTOR-1 from the companion draft (public edition, §6) and MUST reproduce byte for byte.

press Load AE128-VECTOR-1 below — this map fills with the real decoded bytes, and every field becomes clickable

AE-128 at a glance — hover a field to highlight it, click it to locate its bytes in the hex frame below. The intent_shard at 0x10 is the same 16 bytes the rttp question carries at 0x36 — and flipping any hex digit must break the MAC.

frame — 128 bytes, hex · 0 / 256 hex digits organ key material archival mode — skip the lease check (vectors & audit records only)

Load resets everything to the published vector. To see tamper rejection: change ONE character of the organ key (or flip any hex digit in the frame), then press Verify — offline — it must reject.

5 · The 30-second loop — one address, three ways to know it

Open in the resolver ↗

③ The resolver page — rendered live below, or open it in its own tab

# ① machine side — a clean machine pulls this from the registry first:

$ npx @aicent/iqa

[PASS] all 32 checks passed (node, individual implementation)

              one address: iqa://3f9a1b2c.gateway.iqa
                        │
          ┌─────────────┴─────────────┐
          ▼                           ▼
    ③ web side (for humans)     ② code side (for machines)
    who the address is:         where it goes:
    organ · standing · action   4-byte route fingerprint
    resolved above, live        5c378581 — pure computation
          │                           │
          └────────────┬──────────────┘
                       ▼
          ① 32 published vectors pin both → PASS