# Conformance vector versions

The vector set is versioned independently of the spec text and the reference library. A change to wire behaviour (canonical forms, content addressing, JCR-1 sealing, JCS canonicalization, tier-minimization rule) MUST bump the set and be recorded here.

## v1 — initial

The first vector set, covering C1–C5 (SPEC §10):

- **C1** `content_addressing.json` — BLAKE3-256 `b3:` content addresses over fixed byte inputs.
- **C2** `capability.json` — deny-by-default `Enforcer` decisions over an empty and a populated grant set, including negatives.
- **C3** `receipt.json` — a heterogeneous CPU+GPU receipt (all `HwShunt`): canonical det-CBOR core, content id, and a sealed JCR-1 (`sandbox/1`) envelope under a fixed steward key.
- **C4** `attestation.json` — an S5 CPU+GPU run attestation: JCS-canonicalized core, content id, and an Ed25519 signature under a fixed supervisor key.
- **C5** `tier.json` — required-tier resolution across the S0–S7 ladder for representative grant sets and isolation flags.
- **C-neg** `negative.json` — malformed artifacts a conformant host MUST reject: receipts (provenance/measured coupling, total mismatch, measured-coverage mismatch), attestations (unnamed accelerator, S6-without-TEE), replay journals (divergence, truncation), and a mid-run grant-set mutation (detectable via content addressing).
- **C-tee** `confidential.json` — SEV-SNP report verification (valid against policy + VCEK; negatives: wrong launch measurement, tampered body failing the ECDSA-P384 signature) and a hash-chained audit-log vector that must verify (SPEC §7.6, §7.7).

Generated by `cargo run -p sandbox-conformance --bin gen_vectors`. Verified by `cargo test -p sandbox-conformance` (in-code and file-backed packs) and `sandbox conformance`.