# JouleClaw policy-receipt conformance vectors

Independent verifiers cross-checking the canonical signed core
(det-CBOR per RFC 8949 §4.2.1) and the COSE_Sign1 envelope (RFC 9052,
EdDSA / Ed25519) every Rust producer of a `PolicyReceipt` must emit.
Three implementations — Rust + Python + Go — produce bit-identical
bytes on every vector.

## Files

| File | What |
|------|------|
| `vectors-policy.json` | 3 canonical vectors: allow / explicit-deny / no-matching-allow. Each carries the receipt JSON, the canonical signed-core CBOR hex, and the COSE_Sign1 envelope hex. |
| `verify.py` | Python verifier (cbor2 + cryptography). |
| `verify.go` | Go verifier (stdlib only — no go.mod required). |

## Vectors

1. **Allow** — filesystem read of a workspace file under the
   `read-workspace` rule. Decision `Allow(rule="read-workspace")`,
   action `Filesystem(/workspace/notes.md, read)`.
2. **Explicit deny** — filesystem read of a workspace secret shadowed
   by the `no-secrets` rule. Decision
   `Deny(explicit_deny, rule="no-secrets")`.
3. **No-matching-allow** — network connect against an empty policy.
   Decision `Deny(no_matching_allow)`, action
   `Network(api.example.com:443, connect)`.

## Test key

Same Ed25519 seed JCR-1 uses for its v1 cascade-receipt vectors so
verifiers can cross-validate both receipt families against one key.

```
seed:    000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
pub:     03a107bff3ce10be1d70dd18e74bc09967e4d6309ba50d5f1ddc8664125531b8
kid:     did:keri:EJ9testStewardAID000000000000000
```

**TEST KEY ONLY.** Never use in production.

## Running

```bash
# Python:
python3 verify.py vectors-policy.json

# Go (stdlib only):
go run verify.go vectors-policy.json
```

Both must print PASS on all three vectors. Any byte mismatch means a
producer somewhere has drifted; fix the producer, not the vectors.

## Regenerating

Vectors are regenerated by the Rust example
`gen_policy_vectors.rs`. The Rust-side test
`policy_vectors_match_committed_conformance` (in `src/lib.rs`) loads
the committed JSON and re-derives every byte from the embedded
receipt, so a drifting producer fails the Rust test before the
Python and Go verifiers ever run.

```bash
cargo run -p jouleclaw-policy-receipt --example gen_policy_vectors \
  -- crates/jouleclaw-policy-receipt/conformance/vectors-policy.json
```

## Scope (v1)

- Schema id: `policy/1`. The wire shape is the v1 form of
  `jouleclaw_policy_receipt::PolicyReceipt` — `(jc_receipt, id,
  closed_at, steward, engine_id, audit_sequence, policy_version,
  agent, action, decision)`. Any future schema bump will land
  alongside `vectors-policy-v1.1.json`, leaving v1 vectors frozen.
- Signing algorithm: EdDSA over Ed25519 (`alg = -8`) only.
  ES256 (`alg = -7`) is permitted by COSE but not currently
  exercised here.