Internet Engineering Task Force D. Watts Internet-Draft Independent Researcher Intended status: Informational September 2026 Expires: 5 March 2027 AID-1 Provider-Independent Conformance Requirements and Test-Vector Model draft-watts-ai-identity-conformance-00 Abstract This document defines provider-independent conformance requirements for AID-1. It specifies the execution model for a deterministic machine-readable test-vector corpus, including canonicalization, cryptographic, identity-binding, delegation, authorization, temporal, revocation, replay, attestation, provenance, and integration cases. The conformance corpus contains 69 vectors. Six replay cases are architectural boundary tests, including R5, which requires AID-1 verification to succeed while a downstream D6 scientific- admissibility decision rejects the same evidence. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 5 March 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights Watts Expires 5 March 2027 [Page 1] Internet-Draft AID-1-TEST September 2026 and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Conformance Requirements . . . . . . . . . . . . . . . . . . 2 3. Machine-Readable Corpus . . . . . . . . . . . . . . . . . . . 3 4. Vector Execution Model . . . . . . . . . . . . . . . . . . . 4 5. Expected Outcomes . . . . . . . . . . . . . . . . . . . . . . 4 6. Required Coverage . . . . . . . . . . . . . . . . . . . . . . 4 7. Replay and Architectural Boundary Cases . . . . . . . . . . . 5 7.1. R5: AID-1 Valid, D6 Reject . . . . . . . . . . . . . . . 5 8. Provider Independence . . . . . . . . . . . . . . . . . . . . 5 9. Reference Vector Runner . . . . . . . . . . . . . . . . . . . 6 10. Release Gates . . . . . . . . . . . . . . . . . . . . . . . . 6 11. Security Considerations . . . . . . . . . . . . . . . . . . . 6 12. Privacy Considerations . . . . . . . . . . . . . . . . . . . 7 13. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7 14. Publication and Versioning . . . . . . . . . . . . . . . . . 7 15. Normative References . . . . . . . . . . . . . . . . . . . . 7 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 7 1. Introduction AID-1 is intentionally independent of software-only, TPM, TEE, HSM, enclave, cloud, or other implementation providers. Conformance therefore depends on observable verification behavior rather than implementation mechanism. This document defines the semantic contract for the AID-1-TEST machine-readable corpus and its reference vector runner. 2. Conformance Requirements An implementation claiming conformance to AID-1 MUST execute the complete required vector corpus and MUST produce the expected outcome for every required vector. The provider under test MUST NOT receive privileged knowledge of the expected result beyond the ordinary input data supplied to an AID-1 verifier. The same vector corpus MUST be usable without semantic modification against SoftwareProvider, MockTPMProvider, MockTEEProvider, and future provider implementations. Watts Expires 5 March 2027 [Page 2] Internet-Draft AID-1-TEST September 2026 3. Machine-Readable Corpus The AID-1-TEST v1 corpus contains 69 deterministic vectors. Each vector SHOULD contain, directly or by stable reference, a base fixture, mutation or transformation, expected verification outcome, expected failure codes where applicable, and any downstream boundary expectations. aid-1-test-vectors/ manifest.json schema/ vector.schema.json manifest.schema.json fixtures/ identities/ keys/ delegations/ authorizations/ attestations/ provenance/ vectors/ schema/ canonicalization/ crypto/ identity/ delegation/ authorization/ temporal/ revocation/ replay/ attestation/ provenance/ integration/ replay/ R1.json R2.json R3.json R4.json R5.json R6.json The machine-readable corpus is the executable test artifact. This document specifies the semantics required for interpreting that corpus. Watts Expires 5 March 2027 [Page 3] Internet-Draft AID-1-TEST September 2026 4. Vector Execution Model A reference runner SHOULD evaluate each vector using the following conceptual process: base fixture + specified mutation | v deterministic candidate object | v AID-1 verifier | v actual decision | v expected decision | v PASS / FAIL A mutation MUST be deterministic. A runner MUST NOT modify fields that are outside the mutation specified by the vector. 5. Expected Outcomes A vector MAY expect ALLOW, DENY, or INDETERMINATE. A vector MAY also expect one or more standardized failure codes. INDETERMINATE MUST NOT be treated as equivalent to ALLOW for conformance purposes. 6. Required Coverage The corpus MUST include vectors covering at least: * JCS canonicalization and rejection of unsupported values; * Ed25519 positive and negative signature verification; * tampered-envelope rejection; * key-substitution rejection; * identity binding independent from a self-supplied key; Watts Expires 5 March 2027 [Page 4] Internet-Draft AID-1-TEST September 2026 * capability, resource, state, time, and delegation enforcement; * revoked and unavailable revocation states; * duplicate nonce and action replay; * forged or untrusted external attestation; * key rotation, overlap, supersession, and historical validity; * audit-chain deletion, reordering, and mutation detection; and * confused-deputy, audience-confusion, cross-repository replay, delegation-escalation, and stale-credential cases. 7. Replay and Architectural Boundary Cases Six replay cases, R1 through R6, are reserved as architecture-level conformance cases. These cases are intended to detect accidental collapse of trust domains across implementations. 7.1. R5: AID-1 Valid, D6 Reject R5 is a mandatory conformance invariant. AID-1 verification: VALID D6 scientific-admissibility decision: REJECT An implementation MUST pass R5 by preserving the distinction between AID-1 identity/provenance verification and downstream scientific admissibility. A provider or integration that automatically converts successful AID-1 verification into downstream D6 acceptance is non-conformant. 8. Provider Independence A provider implementation MAY use software keys, TPM-backed keys, TEE-backed keys, HSMs, secure enclaves, or future mechanisms. The provider MUST expose behavior compatible with the AID-1 verifier and MUST preserve the same externally observable decision semantics. Provider-specific implementation details MUST NOT alter the expected outcome of any provider-independent vector. Watts Expires 5 March 2027 [Page 5] Internet-Draft AID-1-TEST September 2026 9. Reference Vector Runner The reference runner SHOULD load the corpus manifest, validate each vector against its schema, construct the candidate object, execute the AID-1 verifier, compare actual and expected outcomes, and emit a deterministic report. The reference runner SHOULD report at least the vector identifier, actual decision, expected decision, observed failure codes, expected failure codes, and PASS or FAIL status. 10. Release Gates An implementation MUST NOT claim completion of the AID-1 v1 security conformance profile until the required gates pass. These gates include: 1. JCS conformance and rejection tests; 2. Ed25519 positive, negative, tampered-envelope, and key- substitution vectors; 3. identity-binding separation from self-supplied key material; 4. independent authorization checks for capability, resource, state, time, and delegation; 5. revocation and unavailable-registry handling; 6. replay resistance; 7. external attestation verification; 8. rotation and historical-verification behavior; 9. audit-integrity checks; and 10. adversarial trust-boundary vectors. 11. Security Considerations A conformance suite is security-sensitive because a weak oracle can certify incorrect behavior. The corpus, manifest, schemas, and runner SHOULD therefore be content-addressed or otherwise integrity protected. Watts Expires 5 March 2027 [Page 6] Internet-Draft AID-1-TEST September 2026 Test providers MUST NOT be permitted to alter vector expectations during execution. CI systems SHOULD pin the corpus revision used for a conformance claim. 12. Privacy Considerations Conformance fixtures SHOULD use synthetic identities, synthetic credentials, and non-production attestation material unless a test explicitly requires otherwise. Real personal credentials, production secrets, and live private keys MUST NOT be distributed in the public corpus. 13. IANA Considerations This document requests no IANA actions. 14. Publication and Versioning The 69-vector corpus SHOULD be versioned independently but SHOULD declare the AID-1 specification revision against which it is evaluated. Published conformance reports SHOULD identify both the corpus revision and the implementation revision. 15. Normative References [AID1] Watts, D., "AID-1: A Cryptographically Bindable Identity and Provenance Architecture for AI Systems", Work in Progress, Internet-Draft, draft-watts-ai-identity-00, September 2026, . [RFC8785] Rundgren, A., Jordan, B., and S. Erdtman, "JSON Canonicalization Scheme (JCS)", RFC 8785, June 2020, . Author's Address Deonte Watts Independent Researcher Email: deonte@goodshyt.fun URI: https://orcid.org/0009-0005-8586-3650 Watts Expires 5 March 2027 [Page 7]