{ "manifest_version": 1, "protocol_release": "0.2.1", "description": "Deterministic offline conformance corpus shared by the TypeScript and Python Open Receipt verifiers.", "test_key_warning": "Fixtures use RFC 8032 test keys only. Never use them in production.", "vectors": [ { "id": "v01-valid-pinned-event", "category": "v0.1-signature", "operation": "verify_receipt", "input": "vectors/v0.1/delivered-local.valid.json", "fixtures": { "issuer_metadata": "fixtures/v0.1/issuer.json" }, "protocol_version": "0.1", "classification": "positive", "purpose": "Valid v0.1 event with authoritative offline issuer metadata.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "key_status_unknown", "key_id": "open-receipt-local-vector-2026", "key_source": "issuer_metadata", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "valid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": true, "warning_codes": [] } }, { "id": "v01-valid-embedded-event", "category": "v0.1-trust", "operation": "verify_receipt", "input": "vectors/v0.1/delivered-local.valid.json", "protocol_version": "0.1", "classification": "positive", "purpose": "Embedded key proves mathematical validity without issuer identity trust.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": "open-receipt-local-vector-2026", "key_source": "embedded", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "valid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "embedded_only", "valid": true, "warning_codes": [] } }, { "id": "v01-valid-complete-bundle", "category": "v0.1-chain", "operation": "verify_receipt", "input": "vectors/v0.1/validated-local.valid.json", "fixtures": { "issuer_metadata": "fixtures/v0.1/issuer.json" }, "protocol_version": "0.1", "classification": "positive", "purpose": "Complete signed parent chain in a v0.1 offline bundle.", "expected": { "chain": "complete", "error_codes": [], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "key_status_unknown", "key_id": "open-receipt-local-vector-2026", "key_source": "issuer_metadata", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "valid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": true, "warning_codes": [] } }, { "id": "v01-valid-partial-bundle-explicit", "category": "v0.1-chain", "operation": "verify_receipt", "input": "vectors/v0.1/missing-parents.partial.json", "fixtures": { "issuer_metadata": "fixtures/v0.1/issuer.json" }, "options": { "require_complete_chain": false }, "protocol_version": "0.1", "classification": "positive", "purpose": "An explicit partial-chain policy is preserved for a v0.1 bundle with omitted parents.", "expected": { "chain": "partial", "error_codes": ["parent_hash_not_found"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "key_status_unknown", "key_id": "open-receipt-local-vector-2026", "key_source": "issuer_metadata", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "valid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": true, "warning_codes": [] } }, { "id": "v01-valid-partial-chain", "category": "v0.1-chain", "operation": "verify_receipt", "input": "vectors/v0.1/validated-local.valid.json", "document_path": "event", "fixtures": { "issuer_metadata": "fixtures/v0.1/issuer.json" }, "protocol_version": "0.1", "classification": "positive", "purpose": "A standalone signed event reports a partial chain when parents are absent.", "expected": { "chain": "partial", "error_codes": [], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "key_status_unknown", "key_id": "open-receipt-local-vector-2026", "key_source": "issuer_metadata", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "valid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": true, "warning_codes": [] } }, { "id": "v01-tampered-amount", "category": "payload-tampering", "operation": "verify_receipt", "input": "vectors/v0.1/changed-amount.invalid.json", "fixtures": { "issuer_metadata": "fixtures/v0.1/issuer.json" }, "protocol_version": "0.1", "classification": "must_reject", "purpose": "Changed commercial amount invalidates the detached signature.", "expected": { "chain": "not_applicable", "error_codes": ["bad_signature"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "key_status_unknown", "key_id": "open-receipt-local-vector-2026", "key_source": "issuer_metadata", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "invalid", "schema_valid": true, "signature_valid": false, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": [] } }, { "id": "v01-tampered-seller", "category": "payload-tampering", "operation": "verify_receipt", "input": "vectors/v0.1/changed-seller.invalid.json", "fixtures": { "issuer_metadata": "fixtures/v0.1/issuer.json" }, "protocol_version": "0.1", "classification": "must_reject", "purpose": "Changed seller invalidates the detached signature.", "expected": { "chain": "not_applicable", "error_codes": ["bad_signature"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "key_status_unknown", "key_id": "open-receipt-local-vector-2026", "key_source": "issuer_metadata", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "invalid", "schema_valid": true, "signature_valid": false, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": [] } }, { "id": "v01-tampered-evidence", "category": "payload-tampering", "operation": "verify_receipt", "input": "vectors/v0.1/changed-evidence.invalid.json", "fixtures": { "issuer_metadata": "fixtures/v0.1/issuer.json" }, "protocol_version": "0.1", "classification": "must_reject", "purpose": "Changed evidence invalidates the detached signature.", "expected": { "chain": "not_applicable", "error_codes": ["bad_signature"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "key_status_unknown", "key_id": "open-receipt-local-vector-2026", "key_source": "issuer_metadata", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "invalid", "schema_valid": true, "signature_valid": false, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": [] } }, { "id": "v01-wrong-public-key", "category": "key-resolution", "operation": "verify_receipt", "input": "vectors/v0.1/wrong-key.invalid.json", "fixtures": { "issuer_metadata": "fixtures/v0.1/issuer.json" }, "protocol_version": "0.1", "classification": "must_reject", "purpose": "A wrong authoritative issuer key cannot verify the event.", "expected": { "chain": "not_applicable", "error_codes": ["signing_key_id_mismatch"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": "open-receipt-local-vector-2026", "key_source": "none", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "invalid", "schema_valid": true, "signature_valid": false, "supported_version": true, "trust_mode": "embedded_only", "valid": false, "warning_codes": [] } }, { "id": "v01-parent-hash-mismatch", "category": "v0.1-chain", "operation": "verify_receipt", "input": "vectors/v0.1/broken-parent.invalid.json", "fixtures": { "issuer_metadata": "fixtures/v0.1/issuer.json" }, "protocol_version": "0.1", "classification": "must_reject", "purpose": "Deleted or cross-chain substituted parent does not satisfy the signed hash.", "expected": { "chain": "invalid", "error_codes": ["parent_hash_not_found"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "key_status_unknown", "key_id": "open-receipt-local-vector-2026", "key_source": "issuer_metadata", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "invalid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": [] } }, { "id": "v01-malformed-signature", "category": "signature-encoding", "operation": "verify_receipt", "input": "vectors/v0.1/malformed-signature.invalid.json", "fixtures": { "issuer_metadata": "fixtures/v0.1/issuer.json" }, "protocol_version": "0.1", "classification": "must_reject", "purpose": "Malformed detached JWS fails closed.", "expected": { "chain": "not_applicable", "error_codes": ["malformed_detached_jws"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": null, "key_source": "none", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "invalid", "schema_valid": true, "signature_valid": false, "supported_version": true, "trust_mode": "embedded_only", "valid": false, "warning_codes": [] } }, { "id": "v02-active-pinned-attested", "category": "v0.2-trust", "operation": "verify_receipt", "input": "vectors/v0.2/active-evidence-key.valid.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.generated-active.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "positive", "purpose": "Active evidence key, valid attestation, trusted issuer, and fresh pinned metadata.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "active_key_valid_at_issuance", "issuance_attestation_status": "valid", "issuer_trusted": true, "key_conclusion": "valid_at_issuance", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "valid_with_warnings", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": true, "warning_codes": ["issuance_attestation_valid"] } }, { "id": "v02-active-embedded-indeterminate", "category": "v0.2-trust", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.generated-active.json", "protocol_version": "0.2", "classification": "negative", "purpose": "Embedded-only verification preserves an indeterminate issuer conclusion.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": "example-evidence-2026-q3", "key_source": "embedded", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "indeterminate", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "embedded_only", "valid": false, "warning_codes": ["issuance_attestation_missing", "issuer_untrusted", "key_status_unknown"] } }, { "id": "v02-active-pinned-unattested", "category": "v0.2-trust", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.generated-active.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.generated-active.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "positive", "purpose": "Fresh pinned metadata establishes the issuer; missing attestation remains a warning.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "active_key_valid_at_issuance", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "valid_at_issuance", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "valid_with_warnings", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": true, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-malformed-pinned-metadata", "category": "metadata-validation", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.generated-active.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.malformed.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "purpose": "Malformed pinned trust metadata fails closed without throwing.", "expected": { "chain": "not_applicable", "error_codes": [ "invalid_metadata_signature", "issuer_untrusted", "verification_key_not_found" ], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": "example-evidence-2026-q3", "key_source": "none", "metadata_chain_valid": false, "metadata_freshness": "unknown", "metadata_hash_valid": false, "metadata_signature_valid": false, "overall_status": "invalid", "schema_valid": true, "signature_valid": false, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-metadata-missing-required-field", "category": "metadata-validation", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.generated-active.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.missing-previous-hash.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "purpose": "Missing schema-required top-level metadata fields fail closed.", "expected": { "chain": "not_applicable", "error_codes": ["invalid_metadata", "issuer_untrusted", "verification_key_not_found"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": "example-evidence-2026-q3", "key_source": "none", "metadata_chain_valid": false, "metadata_freshness": "unknown", "metadata_hash_valid": false, "metadata_signature_valid": false, "overall_status": "invalid", "schema_valid": true, "signature_valid": false, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-malformed-metadata-history", "category": "metadata-validation", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.metadata-history.json", "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.history-v2.json", "previous_metadata": ["fixtures/v0.2/issuer-metadata.malformed.json"] }, "purpose": "A malformed prior metadata generation fails closed without escaping verification.", "expected": { "chain": "not_applicable", "error_codes": ["issuer_untrusted", "metadata_hash_chain_invalid"], "historical_result": "active_key_valid_at_issuance", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "valid_at_issuance", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": false, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "invalid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-metadata-key-missing-status", "category": "metadata-validation", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.generated-active.json", "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.missing-key-status.json" }, "purpose": "Metadata keys missing the required lifecycle status fail closed.", "expected": { "chain": "not_applicable", "error_codes": ["invalid_metadata_key", "issuer_untrusted", "verification_key_not_found"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": "example-evidence-2026-q3", "key_source": "none", "metadata_chain_valid": false, "metadata_freshness": "unknown", "metadata_hash_valid": false, "metadata_signature_valid": false, "overall_status": "invalid", "schema_valid": true, "signature_valid": false, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-metadata-key-missing-nullable-field", "category": "metadata-validation", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.generated-active.json", "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.missing-activated-at.json" }, "purpose": "A missing schema-required nullable key field is not normalized as null.", "expected": { "chain": "not_applicable", "error_codes": ["invalid_metadata_key", "issuer_untrusted", "verification_key_not_found"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": "example-evidence-2026-q3", "key_source": "none", "metadata_chain_valid": false, "metadata_freshness": "unknown", "metadata_hash_valid": false, "metadata_signature_valid": false, "overall_status": "invalid", "schema_valid": true, "signature_valid": false, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-stale-pinned-metadata", "category": "metadata-freshness", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.generated-active.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.generated-active.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-09-03T12:00:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "positive", "purpose": "Stale offline metadata reports its knowledge boundary without changing signature validity.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "active_key_valid_at_issuance", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "valid_but_metadata_stale", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "stale", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "valid_with_warnings", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": true, "warning_codes": ["issuance_attestation_missing", "metadata_stale"] } }, { "id": "v02-tampered-payload", "category": "payload-tampering", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.tampered-payload.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.generated-active.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "purpose": "A changed signed payload is invalid.", "expected": { "chain": "not_applicable", "error_codes": ["bad_signature"], "historical_result": "active_key_valid_at_issuance", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "valid_at_issuance", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "invalid", "schema_valid": true, "signature_valid": false, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-tampered-signature", "category": "signature-encoding", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.bad-signature.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.generated-active.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "purpose": "A changed Ed25519 signature is invalid.", "expected": { "chain": "not_applicable", "error_codes": ["bad_signature"], "historical_result": "active_key_valid_at_issuance", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "valid_at_issuance", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "invalid", "schema_valid": true, "signature_valid": false, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-malformed-base64-signature", "category": "signature-encoding", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.malformed-base64-signature.json", "protocol_version": "0.2", "classification": "must_reject", "purpose": "Invalid base64url is rejected rather than normalized permissively.", "expected": { "chain": "not_applicable", "error_codes": ["malformed_base64url"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": null, "key_source": "none", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "invalid", "schema_valid": true, "signature_valid": false, "supported_version": true, "trust_mode": "embedded_only", "valid": false, "warning_codes": [] } }, { "id": "v02-noncanonical-base64-signature", "category": "signature-encoding", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.noncanonical-base64-signature.json", "protocol_version": "0.2", "classification": "must_reject", "purpose": "Equivalent bytes with non-zero base64url pad bits are rejected as noncanonical encoding.", "expected": { "chain": "not_applicable", "error_codes": ["malformed_base64url"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": null, "key_source": "none", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "invalid", "schema_valid": true, "signature_valid": false, "supported_version": true, "trust_mode": "embedded_only", "valid": false, "warning_codes": [] } }, { "id": "v02-unsupported-algorithm", "category": "algorithm-confusion", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.unsupported-algorithm.json", "protocol_version": "0.2", "classification": "must_reject", "purpose": "A protected header cannot select a different signature algorithm.", "expected": { "chain": "not_applicable", "error_codes": ["unsupported_jws_algorithm"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": null, "key_source": "none", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "invalid", "schema_valid": true, "signature_valid": false, "supported_version": true, "trust_mode": "embedded_only", "valid": false, "warning_codes": [] } }, { "id": "v02-malformed-public-key", "category": "key-resolution", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.malformed-key.json", "protocol_version": "0.2", "classification": "must_reject", "purpose": "Malformed embedded Ed25519 public key material fails closed.", "expected": { "chain": "not_applicable", "error_codes": ["bad_signature"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": "example-evidence-2026-q3", "key_source": "embedded", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "invalid", "schema_valid": true, "signature_valid": false, "supported_version": true, "trust_mode": "embedded_only", "valid": false, "warning_codes": ["issuance_attestation_missing", "issuer_untrusted", "key_status_unknown"] } }, { "id": "v02-unsupported-version", "category": "versioning", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.unsupported-version.json", "protocol_version": "9.9", "classification": "must_reject", "purpose": "Unknown Open Receipt versions are not interpreted as a supported version.", "expected": { "chain": "invalid", "error_codes": ["unsupported_spec_version"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": null, "key_source": "none", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "invalid", "schema_valid": false, "signature_valid": false, "supported_version": false, "trust_mode": "embedded_only", "valid": false, "warning_codes": [] } }, { "id": "v02-missing-required-field", "category": "schema", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.missing-required.json", "protocol_version": "0.2", "classification": "must_reject", "purpose": "Missing required event identifier fails closed.", "expected": { "chain": "invalid", "error_codes": ["invalid_event_id"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": null, "key_source": "none", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "invalid", "schema_valid": false, "signature_valid": false, "supported_version": true, "trust_mode": "embedded_only", "valid": false, "warning_codes": [] } }, { "id": "v02-unknown-required-semantics", "category": "schema", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.unknown-field.json", "protocol_version": "0.2", "classification": "must_reject", "purpose": "Unknown top-level semantics are not silently ignored.", "expected": { "chain": "invalid", "error_codes": ["unknown_event_field:future_required_semantics"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": null, "key_source": "none", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "invalid", "schema_valid": false, "signature_valid": false, "supported_version": true, "trust_mode": "embedded_only", "valid": false, "warning_codes": [] } }, { "id": "v02-retired-key-valid-at-issuance", "category": "key-lifecycle", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.retired-valid.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.retired-valid.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "positive", "purpose": "A retired key remains historically valid for issuance inside its window.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "retired_key_valid_at_issuance", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "retired_key_valid_at_issuance", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "valid_with_warnings", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": true, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-signed-after-retirement", "category": "key-lifecycle", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.retired-after.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.retired-after.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "purpose": "A signature created after retirement is invalid.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "signed_after_retirement", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "key_status_unknown", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "invalid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-signed-before-revocation", "category": "key-lifecycle", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.revoked-before.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.revoked-before.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "positive", "purpose": "Prospective revocation preserves an earlier valid signature.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "signed_before_revocation", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "valid_at_issuance", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "valid_with_warnings", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": true, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-signed-after-revocation", "category": "key-lifecycle", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.revoked-after.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.revoked-after.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "purpose": "A signature at or after revocation is invalid.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "signed_after_revocation", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "signed_after_revocation", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "invalid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-precompromise-valid-attestation", "category": "issuance-attestation", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.compromised-before-attested.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.compromised-before.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "positive", "purpose": "Independent issuance-log evidence supports a pre-compromise issuance claim.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "signed_before_compromise", "issuance_attestation_status": "valid", "issuer_trusted": true, "key_conclusion": "valid_at_issuance", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "valid_with_warnings", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": true, "warning_codes": ["issuance_attestation_valid"] } }, { "id": "v02-precompromise-missing-attestation", "category": "issuance-attestation", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.compromised-before-unattested.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.compromised-before.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "negative", "purpose": "A pre-compromise claim without backdating evidence is indeterminate.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "signed_before_compromise", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "key_status_unknown", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "indeterminate", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["backdating_resistance_insufficient", "issuance_attestation_missing"] } }, { "id": "v02-unknown-compromise-time", "category": "key-lifecycle", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.compromised-unknown.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.compromised-unknown.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "negative", "purpose": "Unknown compromise effective time remains indeterminate.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "compromise_time_unknown", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "key_status_unknown", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "indeterminate", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["backdating_resistance_insufficient", "issuance_attestation_missing"] } }, { "id": "v02-signed-after-compromise", "category": "key-lifecycle", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.compromised-after.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.compromised-after.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "purpose": "A signature at or after compromise is invalid.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "signed_after_compromise", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "signed_after_compromise", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "invalid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-key-before-activation", "category": "key-lifecycle", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.not-yet-valid.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.not-yet-valid.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "purpose": "A key used before its validity window fails closed.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "key_not_yet_valid", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "key_status_unknown", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "invalid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-key-expired", "category": "key-lifecycle", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.expired.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.expired.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "purpose": "A key used after its validity window fails closed.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "key_expired", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "key_status_unknown", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "invalid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-wrong-key-purpose", "category": "key-resolution", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.wrong-purpose.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.wrong-purpose.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "purpose": "An issuance-log key cannot validate Open Receipt evidence.", "expected": { "chain": "not_applicable", "error_codes": ["key_purpose_mismatch", "verification_key_not_found"], "historical_result": "key_purpose_mismatch", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "key_status_unknown", "key_id": "example-evidence-2026-q3", "key_source": "none", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "invalid", "schema_valid": true, "signature_valid": false, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-unknown-kid", "category": "key-resolution", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.unknown-kid.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.generated-active.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "purpose": "Unknown key identifiers fail closed.", "expected": { "chain": "not_applicable", "error_codes": ["key_unknown"], "historical_result": "key_unknown", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "key_status_unknown", "key_id": "unknown", "key_source": "none", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "invalid", "schema_valid": true, "signature_valid": false, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-tampered-metadata-signature", "category": "metadata-history", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.tampered-metadata-signature.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.tampered-signature.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "purpose": "Tampered signed issuer metadata cannot establish trust.", "expected": { "chain": "not_applicable", "error_codes": ["issuer_untrusted", "metadata_signature_invalid"], "historical_result": "active_key_valid_at_issuance", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "valid_at_issuance", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": false, "overall_status": "invalid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-metadata-hash-mismatch", "category": "metadata-history", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.generated-active.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.retired-valid.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "purpose": "Receipt metadata hash pin must match the exact supplied snapshot.", "expected": { "chain": "not_applicable", "error_codes": ["issuer_untrusted", "metadata_hash_or_version_mismatch"], "historical_result": "retired_key_valid_at_issuance", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "retired_key_valid_at_issuance", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": false, "metadata_signature_valid": true, "overall_status": "invalid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-invalid-issuance-attestation", "category": "issuance-attestation", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.invalid-attestation.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.generated-active.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "purpose": "Invalid issuance-log signature cannot support an issuance claim.", "expected": { "chain": "not_applicable", "error_codes": ["attestation_signature_invalid", "issuance_attestation_invalid"], "historical_result": "active_key_valid_at_issuance", "issuance_attestation_status": "invalid", "issuer_trusted": true, "key_conclusion": "valid_at_issuance", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "invalid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": [] } }, { "id": "v02-metadata-history-valid", "category": "metadata-history", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.metadata-history.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.history-v2.json", "previous_metadata": ["fixtures/v0.2/issuer-metadata.generated-active.json"] }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-31T12:02:00Z", "resolved_at": "2026-07-31T12:01:30Z" }, "protocol_version": "0.2", "classification": "positive", "purpose": "A valid signed metadata hash history authorizes the current snapshot.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "active_key_valid_at_issuance", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "valid_at_issuance", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "valid_with_warnings", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": true, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-metadata-history-broken", "category": "metadata-history", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.metadata-history-broken.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.history-v2-broken.json", "previous_metadata": ["fixtures/v0.2/issuer-metadata.generated-active.json"] }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-31T12:02:00Z", "resolved_at": "2026-07-31T12:01:30Z" }, "protocol_version": "0.2", "classification": "must_reject", "purpose": "Broken signed metadata hash history fails closed.", "expected": { "chain": "not_applicable", "error_codes": ["issuer_untrusted", "metadata_hash_chain_invalid"], "historical_result": "active_key_valid_at_issuance", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "valid_at_issuance", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": false, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "invalid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": false, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-bare-historical-parent-hash", "category": "v0.2-compatibility", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.bare-parent-hash.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.generated-active.json" }, "options": { "trust_mode": "pinned_metadata", "now": "2026-07-30T12:02:00Z", "resolved_at": "2026-07-30T12:01:30Z" }, "protocol_version": "0.2", "classification": "positive", "purpose": "Immutable early-v0.2 bare SHA-256 parent digests retain compatibility.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "active_key_valid_at_issuance", "issuance_attestation_status": "missing", "issuer_trusted": true, "key_conclusion": "valid_at_issuance", "key_id": "example-evidence-2026-q3", "key_source": "issuer_metadata", "metadata_chain_valid": true, "metadata_freshness": "fresh", "metadata_hash_valid": true, "metadata_signature_valid": true, "overall_status": "valid_with_warnings", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "pinned_metadata", "valid": true, "warning_codes": ["issuance_attestation_missing"] } }, { "id": "v02-numeric-canonicalization-signature", "category": "canonicalization", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.numeric-edge.json", "protocol_version": "0.2", "classification": "negative", "purpose": "Signature passes only when ECMAScript/RFC 8785 numeric rendering is reproduced.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": "example-evidence-2026-q3", "key_source": "embedded", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "indeterminate", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "embedded_only", "valid": false, "warning_codes": ["issuance_attestation_missing", "issuer_untrusted", "key_status_unknown"] } }, { "id": "v02-unicode-canonicalization-signature", "category": "canonicalization", "operation": "verify_receipt", "input": "vectors/v0.2/receipt.unicode-edge.json", "protocol_version": "0.2", "classification": "negative", "purpose": "Signature verifies with UTF-16 property ordering and unescaped Unicode scalars.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": "example-evidence-2026-q3", "key_source": "embedded", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "indeterminate", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "embedded_only", "valid": false, "warning_codes": ["issuance_attestation_missing", "issuer_untrusted", "key_status_unknown"] } }, { "id": "v02-valid-checkpoint", "category": "checkpoint", "operation": "verify_checkpoint", "input": "vectors/v0.2/checkpoint.valid.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.generated-active.json" }, "protocol_version": "0.2", "classification": "positive", "purpose": "Valid issuance-log checkpoint signature and key lifecycle.", "expected": { "chain": "not_applicable", "error_codes": [], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": null, "key_source": "none", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "valid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "embedded_only", "valid": true, "warning_codes": [] } }, { "id": "v02-invalid-checkpoint", "category": "checkpoint", "operation": "verify_checkpoint", "input": "vectors/v0.2/checkpoint.invalid.json", "fixtures": { "issuer_metadata": "fixtures/v0.2/issuer-metadata.generated-active.json" }, "protocol_version": "0.2", "classification": "must_reject", "purpose": "Tampered checkpoint content invalidates its signature.", "expected": { "chain": "not_applicable", "error_codes": ["invalid_checkpoint"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": null, "key_source": "none", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "invalid", "schema_valid": false, "signature_valid": false, "supported_version": true, "trust_mode": "embedded_only", "valid": false, "warning_codes": [] } }, { "id": "canonical-numeric-rendering", "category": "canonicalization", "operation": "canonicalize", "input": "vectors/v0.2/canonical-number.json", "protocol_version": "0.1-0.2", "classification": "positive", "purpose": "RFC 8785 thresholds differ from Python's default json serialization.", "expected": { "canonical": "{\"a\":1e-7,\"b\":100000000000000000000,\"c\":333333333.3333333,\"negative_zero\":0}", "chain": "not_applicable", "error_codes": [], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": null, "key_source": "none", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "valid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "embedded_only", "valid": true, "warning_codes": [] } }, { "id": "canonical-unicode-ordering", "category": "canonicalization", "operation": "canonicalize", "input": "vectors/v0.2/canonical-unicode.json", "protocol_version": "0.1-0.2", "classification": "positive", "purpose": "RFC 8785 uses UTF-16 code-unit ordering for object properties.", "expected": { "canonical": "{\"\\r\":\"Carriage Return\",\"€\":\"Euro Sign\",\"😀\":\"Emoji\",\"דּ\":\"Hebrew Letter\"}", "chain": "not_applicable", "error_codes": [], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": null, "key_source": "none", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "valid", "schema_valid": true, "signature_valid": true, "supported_version": true, "trust_mode": "embedded_only", "valid": true, "warning_codes": [] } }, { "id": "malformed-json-duplicate-key", "category": "malformed-json", "operation": "parse_json", "input": "vectors/malformed/duplicate-key.json.txt", "protocol_version": "unknown", "classification": "must_reject", "purpose": "Raw JSON duplicate member names are rejected before verification.", "expected": { "chain": "invalid", "error_codes": ["malformed_json"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": null, "key_source": "none", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "invalid", "schema_valid": false, "signature_valid": false, "supported_version": false, "trust_mode": "embedded_only", "valid": false, "warning_codes": [] } }, { "id": "malformed-json-truncated", "category": "malformed-json", "operation": "parse_json", "input": "vectors/malformed/truncated.json.txt", "protocol_version": "unknown", "classification": "must_reject", "purpose": "Truncated JSON is rejected before verification.", "expected": { "chain": "invalid", "error_codes": ["malformed_json"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": null, "key_source": "none", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "invalid", "schema_valid": false, "signature_valid": false, "supported_version": false, "trust_mode": "embedded_only", "valid": false, "warning_codes": [] } }, { "id": "malformed-json-non-finite-number", "category": "json-parsing", "operation": "parse_json", "input": "vectors/malformed/non-finite-number.json.txt", "protocol_version": null, "classification": "must_reject", "purpose": "Non-standard NaN input is rejected at the strict JSON boundary.", "expected": { "chain": "invalid", "error_codes": ["malformed_json"], "historical_result": "key_status_unknown", "issuance_attestation_status": "missing", "issuer_trusted": false, "key_conclusion": "key_status_unknown", "key_id": null, "key_source": "none", "metadata_chain_valid": null, "metadata_freshness": "unknown", "metadata_hash_valid": null, "metadata_signature_valid": null, "overall_status": "invalid", "schema_valid": false, "signature_valid": false, "supported_version": false, "trust_mode": "embedded_only", "valid": false, "warning_codes": [] } } ] }