Attested Context — L0 conformance fixtures¶

Twelve assertions across three fixtures, mapping the extension's L0 section one-to-one:

AC-5 (mediated assembly) deliberately has no fixture assertion: whether the server queried its substrate under its own identity is not observable from the wire. It is verified by architecture review, not by transcript.

How to run¶

python3 runner.py --self-test              # validate the suite itself (do this first)
python3 runner.py --transcripts DIR        # evaluate a captured server transcript
python3 runner.py --list                   # print the 12 assertions

The runner is stdlib-only and never touches the network: capture a transcript first, evaluate second, so every verdict is reproducible from artifacts. A transcript directory holds the seven captured documents laid out as in golden/transcript-pass/ (a server/discover result, the public- and admin-audience tools/list results, a full and a denied tools/call result, the rejected admin call, and the issuer's published key).

A check that can fail — the controls¶

• Positive control: golden/transcript-pass/ is a fully conformant synthetic transcript; the suite must pass it 12/12 or the runner aborts.
• Negative controls: golden/transcript-fail/ holds 11 broken variants — masked field, provenance leak of a denied pointer, admin tool listed to a public caller, publicly cacheable authorization-varying list, missing/tampered attestation, wrong hash, bad signature, missing extension declaration, stripped retrieved_at, uncovered provenance, admin call that succeeds. --self-test requires each to trip exactly the assertions its manifest.json declares — every one of the twelve assertions is tripped by at least one control, so no check in this suite is incapable of failing.
• Crypto control: the embedded Ed25519 verifier is checked against RFC 8032 test vector 1 (including a tampered-message rejection) before any fixture runs; a failure aborts the run as a broken detector, never as a clean result.

Golden transcripts are regenerated deterministically by golden/regenerate.py. ⚠ Its signing key is a test key derived from a public string — reproducibility is the point; it must never be used as a real issuer key.

Canonicalization (the decision of record, 2026-07-30)¶

bundle_hash = sha256: over the RFC 8785 (JCS) canonical form of structuredContent; the signing input is the JCS form of {bundle_hash, issued_at, issuer} — exactly those three fields. At L0 the runner implements the JCS subset for integer numbers, ASCII object keys, strings, bools, null, arrays, and objects, and refuses anything outside it (non-integer numbers, integers past 2^53−1, non-ASCII keys) rather than approximate — a wrong canonical form manufactures false hash verdicts in both directions. Full ECMAScript number formatting arrives with a vetted JCS library at L1+.

What a pass means — and what it does not¶

The golden pass validates the fixtures, not any server. Conformance is claimed only when a real implementation's captured transcript passes 12/12, and the claim names the transcript, the date, and the implementation version.

First passing implementation (2026-07-30, live): the reference implementation serving the public origin passes 12/12 on live-captured transcripts. An author-operated pass advances the use-alone step and is not a second-implementer signal — the suite below is the invitation.