aicent-grant-ref

our vectors · merged at the lab · PR #210

This family tests the response semantics of an attestation answer: which refusal value the closed vocabulary owes, when the observation member must be null, and which structure members every response carries. It is authored by us and anchored to our own published specification — draft-li-rttp-iqa-addressing-02 (Informational, posted 2026-11-01), sections 8.1 (Refusal Reasons) and 8.2 (Grant Reference). The retrieved TXT copy is pinned at sha256 02491c5a…85044. Every expected value was checked against the published text sentence by sentence.

The family is open as a candidate at the Agent-Authority-Conformance lab (PR #210), offered for anyone to run: give your implementation each case’s input, record the response it produces, and the checker scores it against the published text. Nothing here is a reviewed fixture; the candidate adds nothing to the lab’s schema, failure classes or verifier behavior.

Rules under test

rule	what it decides	basis
`R-ORDER`	The priority order is part of the definition: the reason is the first value in the list whose condition applies — including mismatch over expiry, expiry over revocation, and no condition at all, in which case the reason must be null; emitting a refusal value without a condition is not conformant.	§8.1
`R-NOTDET`	An unreachable source, or an observation that predates the request, ends in `authority_not_determined` and is never read as assent; a diagnostic read does not participate in authorisation.	§8.1, §8.2
`R-NULLOBS`	`observation_as_of_ms` is null whenever the observation the answer relied on is absent or not fresh — even if a later successful observation exists, and a diagnostic read neither backfills the member nor renews evidence.	§8.2
`R-CLOSED`	The set is closed: no affirmative “granted” value, no sixth value, a response without its reason is not conformant, and null reason over the set is the only representation of permitted.	§8.1
`R-GRANTREF`	Every response, permit or refusal, carries the five members: `grant`, `evidence_id`, `issued_at_ms`, `expires_at_ms`, `observation_as_of_ms`.	§8.2

Cases

25 cases — 11 conformant, 12 nonconformant, and 2 ambiguous. Ambiguous cases are scored in named parts (expect_parts), so a case can show which part of an outcome holds and which does not. The full case table — every identifier, its facts at answer time, and the rule that decides — is in the downloadable CANDIDATE.md and vectors.json.

Self-check

At the submitted revision, the submitter’s runs on Python 3 printed 25/25 agree and 21/21 mutants killed, each with exit 0. These show that the checker agrees with the expected results and that every rule has a case depending on it, in both directions. They say nothing about any implementation, and they do not show that the expected results are the right reading of the source — that reading is written out in the CANDIDATE.md, one quoted sentence per rule, for anyone to dispute.

Download

file	size	sha256
CANDIDATE.md	7,575 B	`089091faec6d63e7515f8279b23495866c65438929353a5e7fb8d22daddda0a3`
vectors.json	16,109 B	`f1924f07be2b7dcf93c3832938bdb288f0f2868057fe8396c9c5b4935b71a303`
check.py	5,294 B	`d4644f2317354c67eac7f337f13837f57c3160c410df21f0d430ffb08542fec5`
mutate.py	3,289 B	`9347e1b710c5f83d54afb4c8d99fb2aa66030edc1b4d806af35e9ee899940063`

Canonical source: github.com/Aicent-Stack/conformance · candidates/aicent-grant-ref. Merged at the lab: Agent-Authority-Conformance lab · PR #210. License Apache 2.0 (the license of the repository). The candidate reuses no text from the draft beyond short quoted sentences for rule description.

How to run

python3 -I check.py vectors.json
python3 -I mutate.py

check.py recomputes each case’s verdict from its input and outcome, and compares it with expect and expect_parts. mutate.py weakens or distorts one rule of check.py at a time — including versions that always answer nonconformant and always answer conformant — and fails unless some case catches each change. Zero dependencies; any Python 3.