# Sandbox conformance vectors — v1

The v1 wire vectors. Each file is regenerated by `gen_vectors` and verified by the harness; see [`../README.md`](../README.md) and [`../VERSIONS.md`](../VERSIONS.md).

| File | Class | Contents |
|------|-------|----------|
| `content_addressing.json` | C1 | byte inputs (hex) → expected `b3:` content id |
| `capability.json` | C2 | grant sets → allow/deny decision per query (incl. negatives) |
| `receipt.json` | C3 | a CPU+GPU receipt → canonical core (hex), content id, sealed JCR-1 envelope (hex), steward key |
| `attestation.json` | C4 | an S5 attestation → JCS bytes, content id, Ed25519 signature (hex), supervisor key |
| `tier.json` | C5 | grant set + isolation flags → required tier (S0–S7) |
| `durable.json` | C6/C7/C10 | a run-record trace → head id; a devcontainer → manifest id; a fleet → merkle root (all `b3:`) |
| `negative.json` | C-neg | malformed receipts + attestations a conformant host MUST reject |
| `confidential.json` | C-tee | SEV-SNP report verify (valid + negatives) + audit-chain check |
| `flow.json` | C13 | a run's calls in order → the origins each read adds, and whether each sink may be reached |

The signing keys are fixed test keys embedded in the vector builders (`receipt` key `[3;32]`, supervisor key `[5;32]`); the public keys travel in the vector files. These are conformance fixtures, not operational keys.