← Conformance archive · companion records: lra-runner (revision 2) · lra-runner (revision 3)

An independent, non-author-produced run of the moltycel-aae-vectors candidate (PR #190, merged 2026-10-26) — conformance vectors for the Agent Authorization Envelope, submitted by Lars Kroehl (MoltyCel, for CryptoKRI GmbH / MolTrust). The candidate's own evidence table recorded two author-produced runs and the line “No independent run exists yet”; this record is that first independent run. Result: all suites green, exit 0 — 64 files byte-verified against the pinned source commit before anything ran; native set 15/15 (5 runtime, 10 structural) plus 14/14 verifier unit tests; enforce set 26/26; composition set 6/6 row-by-row across the eight-stage ladder; 11/11 negative controls; and the regeneration gate rebuilt every vector byte-identically. The candidate shipped code ran unmodified, under its own audit hook that refuses network access during verification.

Scope and method

Family contract: the moltycel-aae-vectors candidate as merged into the lab (PR #190, 2026-10-26), targeting three published revisions of others' Internet-Drafts: native (15 vectors, draft-kroehl-agentic-trust-aae-00), enforce (26 vectors, -02, enforce kernel 3.0), and composition (6 vectors, aae-00 with draft-yossif-psea-02). Frozen inputs: the candidate's 64 files, each a byte copy of MoltyCel/aae-conformance-vectors at commit 6bb462f578c12d339b8fa964a5b1d8f97dbffa68; run.sh compares every one against a fresh clone at that pin before executing anything. Method: the candidate's own verification pipeline, executed unmodified — three schema validations, three shipped reference verifiers, the verifier unit tests, the PSEA fixture pin, and all three generators with a must-be-byte-identical regeneration gate. Every verification step runs under the candidate's offline.py audit hook, which refuses socket and name-lookup calls in the interpreting process. The clone is the only network step; verification itself is offline. We wrote no vectors, altered no verifier, and supplied no expected value: the run scores the author's frozen bytes against the author's own pinned expectations, executed by an independent operator.

Declared claim set: that the candidate's verification pipeline passes end-to-end, unmodified, on a second operator's host — nothing more. A run verifies the vectors, not the spec; scoring and verdict are separate acts. The lab's separate interop/aae-envelope record is the lab's own and is not evidence for this candidate.

Results

The recorded output is run-output.txt (reproduced verbatim, uncut, below); the environment record is ENVIRONMENT.txt; the manifest is SHA256SUMS.txt.

Instrumentation contract (instrumented, not asserted)

• Byte gate before anything runs: all 64 candidate files are compared against a fresh clone of the source at commit 6bb462f; any byte difference aborts the run before scoring.
• Offline enforcement: every verification step executes under the offline.py audit hook — socket and name-lookup calls in that interpreter are refused. (Child processes are not covered; run.sh itself states this.)
• Determinism gate at the end: all three generators re-run and the working tree must remain unchanged — ok: rebuild is byte-identical or the run fails.
• Fixture pin: the third-party PSEA fixture is checksum-verified (psea-fixture-v0.json: OK).
• Recorded, not summarized: the console output of the entire run is captured whole as run-output.txt; nothing above is a paraphrase of a memory.

Mutation battery

No more, no less: none. This candidate ships no mutation battery — its discriminating power is exercised instead through the 11 negative controls (mutated inputs with pinned expected rows, part of the frozen composition set) and through pinned expected verdicts and rejection reasons on every vector. We did not add one: the claim recorded here is the candidate's own pipeline passing unmodified, not a re-engineering of it.

Verdict vocabulary exercised

Diagnostics

The composition suite reports an eight-stage ladder per case (aae_native → action_linkage → principal_linkage → evidence_satisfaction → freshness → decision → admission → outcome); every stage of every case and control is printed row-by-row in the recorded output, so a divergence anywhere would be localized by stage, not merely by case. The native suite reports the exact stopping step and reason per vector; enforce reports verdict plus recomputed core digest.

Exit status

The wrapper captured RUN-EXIT=0. run.sh uses set -eu: any failed check, digest mismatch, or non-identical regeneration aborts the run with a non-zero status before the next step. The recorded run reached the final line (ok: rebuild is byte-identical) and exited zero.

Negative-path self-check

Two layers, both executed: (1) the byte gate — the run begins by comparing all 64 files against the pinned source clone; a tampered candidate file fails the run before any verification; (2) the regeneration gate — the run ends by re-deriving every vector from the generators; a single altered byte in any published file fails the run after all scoring. The 11 negative controls additionally exercise the failure direction of the composition ladder itself.

Determinism and cost

The suite is deterministic by construction: the generators use no clock, no randomness and no network; Ed25519 signing is deterministic (RFC 8032); the regeneration gate is the machine check of that claim and passed. Recorded output of the 2026-11-04 run: sha256 d33a484a643298e3…. Wall-clock cost of the full run (clone, byte gate, all suites, unit tests, regeneration): under two minutes on the recorded host, dominated by the clone; verification itself is offline and fast (the pytest segment alone reports 0.07 s). Any party with git and Python 3.9+ can reproduce it with two commands (below).

Per-vector results (47/47 passed, uncut)

All rows are transcribed from the recorded output; the uncut recording is run-output.txt.

Run metadata (per the lab's required report fields)

Verbatim command and output (uncut)

Command sequence: git clone + checkout of the pin (performed by run.sh), then sh run.sh. The complete console output, uncut:

== candidate bytes equal the source at 6bb462f578c12d339b8fa964a5b1d8f97dbffa68
ok: 64 files
== native, draft-kroehl-agentic-trust-aae-00
$ python3 tools/validate_schema.py
OK    01-valid-root-aae.json
OK    02-expired-not-after.json
OK    03-too-early-not-before.json
OK    04-revocation-endpoint-5xx.json
OK    05-single-use-replay.json
OK    06-delegation-valid-depth-2.json
OK    07-delegation-action-superset.json
OK    08-delegation-constraint-relaxation.json
OK    09-delegation-depth-exceeded.json
OK    10-delegation-cycle-detection.json
OK    11-delegation-cascade-revocation.json
OK    12-signing-authority-mismatch.json
OK    13-unrecognized-required-constraint.json
OK    14-cty-header-wrong.json
OK    15-currency-mismatch-delegation.json

15/15 vectors valid against schema
$ python3 examples/python-verify.py
PASS  01-valid-root-aae.json                     ACCEPT @ step 7  [structural]
PASS  02-expired-not-after.json                  REJECT @ step 3  [runtime] (expired_not_after)
PASS  03-too-early-not-before.json               REJECT @ step 3  [runtime] (not_yet_valid_not_before)
PASS  04-revocation-endpoint-5xx.json            REJECT @ step 8  [runtime] (revocation_status_indeterminate)
PASS  05-single-use-replay.json                  REJECT @ step 5  [runtime] (single_use_already_consumed)
PASS  06-delegation-valid-depth-2.json           ACCEPT @ step 9  [structural]
PASS  07-delegation-action-superset.json         REJECT @ step 9  [structural] (delegated_actions_not_subset)
PASS  08-delegation-constraint-relaxation.json   REJECT @ step 9  [structural] (delegated_constraint_relaxed)
PASS  09-delegation-depth-exceeded.json          REJECT @ step 9  [structural] (delegation_depth_exceeded)
PASS  10-delegation-cycle-detection.json         REJECT @ step 9  [structural] (delegation_cycle_detected)
PASS  11-delegation-cascade-revocation.json      REJECT @ step 9  [runtime] (ancestor_revoked)
PASS  12-signing-authority-mismatch.json         REJECT @ step 1  [structural] (signing_authority_mismatch)
PASS  13-unrecognized-required-constraint.json   REJECT @ step 7  [structural] (unrecognized_required_constraint)
PASS  14-cty-header-wrong.json                   REJECT @ step 2  [structural] (cty_not_aae_json)
PASS  15-currency-mismatch-delegation.json       REJECT @ step 9  [structural] (delegation_currency_mismatch)

15/15 vectors passed  (5 runtime, 10 structural)
$ python3 -m pytest -q -p no:cacheprovider tests/
..............                                                           [100%]
14 passed in 0.07s
== enforce, draft-kroehl-agentic-trust-aae-02
$ python3 tools/validate_enforce_schema.py
PASS  01-type-form-matches-permit.json
PASS  02-instance-value-inside-the-action-deny.json
PASS  03-type-field-missing-from-the-action-deny.json
PASS  04-action-is-a-string-deny.json
PASS  05-action-is-an-array-deny.json
PASS  06-action-is-a-number-deny.json
PASS  07-action-is-null-deny.json
PASS  08-grant-without-type_fields-deny.json
PASS  09-type_fields-without-verb-deny.json
PASS  10-duplicate-name-in-type_fields-deny.json
PASS  11-exact-holds-permit.json
PASS  12-exact-fails-on-a-vanity-prefix-deny.json
PASS  13-enum-holds-permit.json
PASS  14-enum-fails-deny.json
PASS  15-range-holds-at-the-upper-bound-permit.json
PASS  16-range-fails-one-over-the-bound-deny.json
PASS  17-unknown-constraint-type-deny.json
PASS  18-field-path-with-an-empty-segment-deny.json
PASS  19-explicit-hold-pending.json
PASS  20-unaddressed-action-is-never-pending-deny.json
PASS  21-forbid-outranks-an-allowing-grant-deny.json
PASS  22-ratified-by-the-issuing-principal.json
PASS  23-stranger-with-a-valid-signature-rejected.json
PASS  24-a-permit-is-not-ratifiable-caller-error.json
PASS  25-chain-link-pointing-elsewhere-caller-error.json
PASS  26-chain-link-set-explicitly-to-the-ratified-record.json

26/26 enforce vectors valid
$ python3 examples/enforce-verify.py
PASS  01-type-form-matches-permit.json             PERMIT
PASS  02-instance-value-inside-the-action-deny.json DENY
PASS  03-type-field-missing-from-the-action-deny.json DENY
PASS  04-action-is-a-string-deny.json              DENY
PASS  05-action-is-an-array-deny.json              DENY
PASS  06-action-is-a-number-deny.json              DENY
PASS  07-action-is-null-deny.json                  DENY
PASS  08-grant-without-type_fields-deny.json       DENY
PASS  09-type_fields-without-verb-deny.json        DENY
PASS  10-duplicate-name-in-type_fields-deny.json   DENY
PASS  11-exact-holds-permit.json                   PERMIT
PASS  12-exact-fails-on-a-vanity-prefix-deny.json  DENY
PASS  13-enum-holds-permit.json                    PERMIT
PASS  14-enum-fails-deny.json                      DENY
PASS  15-range-holds-at-the-upper-bound-permit.json PERMIT
PASS  16-range-fails-one-over-the-bound-deny.json  DENY
PASS  17-unknown-constraint-type-deny.json         DENY
PASS  18-field-path-with-an-empty-segment-deny.json DENY
PASS  19-explicit-hold-pending.json                PENDING
PASS  20-unaddressed-action-is-never-pending-deny.json DENY
PASS  21-forbid-outranks-an-allowing-grant-deny.json DENY
PASS  22-ratified-by-the-issuing-principal.json    RATIFIED
PASS  23-stranger-with-a-valid-signature-rejected.json REJECTED
PASS  24-a-permit-is-not-ratifiable-caller-error.json RatifyError
PASS  25-chain-link-pointing-elsewhere-caller-error.json RatifyError
PASS  26-chain-link-set-explicitly-to-the-ratified-record.json RATIFIED

26/26 enforce vectors passed
== composition, draft-kroehl-agentic-trust-aae-00 with draft-yossif-psea-02
$ python3 tools/validate_interop_schema.py
OK    interop/psea/vectors/xp-1-aligned-principal.json
OK    interop/psea/vectors/xp-2-principal-divergence.json
OK    interop/psea/vectors/xp-3-unresolved-binding.json
OK    interop/psea/vectors/xp-5a-enrollment-pending.json
OK    interop/psea/vectors/xp-5b-enrollment-complete.json
OK    interop/psea/vectors/xp-6-alias-convergence.json

6/6 composition vectors valid against schema
$ python3 examples/composition-verify.py
stages: aae_native | action_linkage | principal_linkage | evidence_satisfaction | freshness | decision | admission | outcome

PASS  xp-1-aligned-principal.json
        ACCEPT | EQUIVALENT | SAME | SATISFIED | WELL_FORMED | AUTHORIZED | NONE | NONE
PASS  xp-2-principal-divergence.json
        ACCEPT | EQUIVALENT | DIVERGENT(principal_divergence) | UNSATISFIED(principal_divergence) | WELL_FORMED | REFUSED(principal_divergence) | NONE | NONE
PASS  xp-3-unresolved-binding.json
        ACCEPT | EQUIVALENT | UNRESOLVED(unresolved_binding) | NOT_EVALUATED(unresolved_binding) | WELL_FORMED | REFUSED(unresolved_binding) | NONE | NONE
PASS  xp-5a-enrollment-pending.json
        ACCEPT | EQUIVALENT | UNRESOLVED(unresolved_binding) | NOT_EVALUATED(unresolved_binding) | WELL_FORMED | REFUSED(unresolved_binding) | NONE | NONE
PASS  xp-5b-enrollment-complete.json
        ACCEPT | EQUIVALENT | SAME | SATISFIED | WELL_FORMED | AUTHORIZED | NONE | NONE
PASS  xp-6-alias-convergence.json
        ACCEPT | EQUIVALENT | SAME | SATISFIED | WELL_FORMED | AUTHORIZED | NONE | NONE

6/6 composition vectors passed (row-by-row)
$ python3 tools/run_negative_controls.py
stages: aae_native | action_linkage | principal_linkage | evidence_satisfaction | freshness | decision | admission | outcome

PASS  C1  One octet of the secondary-side digest flipped
        ACCEPT | NOT_EQUIVALENT(join_mismatch) | SAME | UNSATISFIED(evidence_covers_a_different_action) | WELL_FORMED | REFUSED(join_mismatch) | NONE | NONE
PASS  C2  XP-3's principal given a table entry resolving to a different principal
        ACCEPT | EQUIVALENT | DIVERGENT(principal_divergence) | UNSATISFIED(principal_divergence) | WELL_FORMED | REFUSED(principal_divergence) | NONE | NONE
PASS  C3  PSEA proof signature tampered
        ACCEPT | INDETERMINATE(secondary_unauthenticated) | UNRESOLVED(secondary_unauthenticated) | UNSATISFIED(invalid_signature) | NOT_EVALUATED(secondary_unauthenticated) | REFUSED(secondary_native_reject) | NONE | NONE
PASS  C4  Clock moved past the AAE not_after
        REJECT(expired_not_after) | INDETERMINATE(aae_not_admitted) | UNRESOLVED(aae_not_admitted) | NOT_EVALUATED(aae_not_admitted) | NOT_EVALUATED(aae_not_admitted) | REFUSED(aae_native_reject) | NONE | NONE
PASS  C5  Another instant inside both validity windows
        ACCEPT | EQUIVALENT | SAME | SATISFIED | WELL_FORMED | AUTHORIZED | NONE | NONE
PASS  C6  Declared aae_digest differs from the signed action_binding
        ACCEPT | INDETERMINATE(aae_binding_mismatch) | UNRESOLVED(action_linkage_unestablished) | NOT_EVALUATED(action_linkage_unestablished) | NOT_EVALUATED(action_linkage_unestablished) | REFUSED(action_linkage_unestablished) | NONE | NONE
PASS  C7  Signed envelope carries no action_binding
        ACCEPT | INDETERMINATE(aae_binding_absent) | UNRESOLVED(action_linkage_unestablished) | NOT_EVALUATED(action_linkage_unestablished) | NOT_EVALUATED(action_linkage_unestablished) | REFUSED(action_linkage_unestablished) | NONE | NONE
PASS  C8  Payload does not hash to the declared action digest
        ACCEPT | NOT_EQUIVALENT(payload_digest_mismatch) | SAME | UNSATISFIED(payload_digest_mismatch) | WELL_FORMED | REFUSED(payload_digest_mismatch) | NONE | NONE
PASS  C9  Payload leaves the I-JSON subset
        ACCEPT | INDETERMINATE(payload_not_i_json) | UNRESOLVED(action_linkage_unestablished) | NOT_EVALUATED(action_linkage_unestablished) | NOT_EVALUATED(action_linkage_unestablished) | REFUSED(action_linkage_unestablished) | NONE | NONE
PASS  C10  Token carries its own key material and claims an enrolled kid
        ACCEPT | INDETERMINATE(secondary_unauthenticated) | UNRESOLVED(secondary_unauthenticated) | UNSATISFIED(invalid_signature) | NOT_EVALUATED(secondary_unauthenticated) | REFUSED(secondary_native_reject) | NONE | NONE
PASS  C11  Signed token with psea_counter absent
        ACCEPT | EQUIVALENT | SAME | SATISFIED | CLAIMS_MALFORMED(counter_malformed) | REFUSED(counter_malformed) | NONE | NONE

11/11 negative controls passed (row-by-row)
psea-fixture-v0.json: OK
== regeneration: every generator rebuilds its files byte for byte
ok: rebuild is byte-identical

Findings raised and resolved

Findings on the corpus: none — zero failed checks across all suites, and no suspected defective vector. Operator-side notes (environmental, not scoring): the run host required python3.11-venv to be installed before the virtual environment could be created, and the source archive's directory layout nests one candidates/ level deeper than the checkout path run.sh assumes — both resolved before the run; neither touches any vector, verifier or expectation. The recorded output begins at the byte gate, which is the first step run.sh prints.

Revision history (append-only): this is the first record for this runner page — there is no prior cut to supersede. The candidate's evidence table (in CANDIDATE.md) records two author-produced runs (Lars Kroehl, 2026-10-25, Mode A; MolTrust, 2026-09-05, enforce set against a second implementation, Mode B, same author on both sides) and stated that no independent run existed; this record is filed to close exactly that gap.

Positioning note: the runner here is the candidate's own shipped pipeline, so the independence of this record rests on the operator, not on an alternate implementation — the complement of our lra-runner records, where the implementation is independent and the operator is the author. Both shapes are legitimate under the lab's author-produced/independent accounting; this page states plainly which one it is.

Artifact and seal

Manifest: moltycel-aae-vectors/ (the candidate as merged, 64 source-pinned files + CANDIDATE.md + CHECKSUMS.sha256 + NOTICE + offline.py + run.sh) · run-output.txt (the recorded run) · ENVIRONMENT.txt · SHA256SUMS.txt. The candidate directory holds no private key material by its own design; the test keys it needs are fetched at the pinned commit by the clone step. Raw files are also served unarchived under /conformance/aae-runner/.

Replay

Two commands (git + Python 3.9+; four PyPI packages; the clone is the only network step — verification itself runs offline under the audit hook):

tar xzf aae-runner-20261104a.tar.gz
cd aae-runner/moltycel-aae-vectors && pip install cryptography jsonschema jcs pytest && sh run.sh

Expected output: ends with ok: rebuild is byte-identical, exit status 0; the byte gate prints ok: 64 files. Provenance: the corpus is MoltyCel/aae-conformance-vectors at commit 6bb462f, merged into the lab as PR #190; the sealed artifact above carries the candidate bytes and this run's record — the tarball is the code-as-run identity of this record.

On independence: this record scores the author's frozen bytes by the author's own pipeline, executed by an operator with no stake in the corpus — the run either passes unmodified on a second host or it does not. The vectors were pinned by commit and checksum before anything ran; the output is a whole-session recording, reproducible by anyone; and nothing in the pipeline was tuned to pass.

One artifact, two addresses

Both addresses are derived from the artifact's own SHA-256 digest — nothing is invented, nothing is registered: the sister schemes split one referent across the question and the answer. Paste either into the respective scheme's resolver to see it resolve locally, without any network call beyond fetching this page.

Verify offline with pip install "iqa-org[ed25519]==1.3.1" and the seal bundle at /attestations/release-attestations.json · Organ AID: ba92fadd46a51caf25633e0f315c4ad10103b879d7397397362f89dc33817153.

Citation