Canonical corpus

Reference / fixtures/v1/manifest.json

The corpus manifest declares each proof, context, canonical action, body, and expected result with SHA-256 digests.

Fixture	Class	Decision	Code	Profile
raw-key-chain	valid	authorized	authorized	auths.mcp
did-key-root-raw-key-actor	valid	authorized	authorized	auths.mcp
raw-key-root-did-key-actor	valid	authorized	authorized	auths.mcp
did-keri-root-raw-key-actor	valid	authorized	authorized	auths.mcp
raw-key-root-did-keri-actor	valid	authorized	authorized	auths.mcp
spiffe-root-raw-key-actor	valid	authorized	authorized	auths.mcp
raw-key-root-spiffe-actor	valid	authorized	authorized	auths.mcp
did-web-root-raw-key-actor	valid	authorized	authorized	auths.mcp
raw-key-root-did-web-actor	valid	authorized	authorized	auths.mcp
webauthn-root-raw-key-actor	valid	authorized	authorized	auths.mcp
raw-key-root-webauthn-actor	valid	authorized	authorized	auths.mcp
hsm-root-raw-key-actor	valid	authorized	authorized	auths.mcp
raw-key-root-hsm-actor	valid	authorized	authorized	auths.mcp
untrusted-did-web-document	invalid	indeterminate	external-fact-unavailable	auths.mcp
did-web-history-without-statement-existence	indeterminate	indeterminate	assurance-requirement-not-met	auths.mcp
did-web-historical-state-unavailable	invalid	indeterminate	historical-state-unavailable	auths.mcp
unsupported-protocol	invalid	indeterminate	unsupported-protocol	auths.mcp
all-of	valid	authorized	authorized	auths.mcp
any-of-valid-invalid-signature	valid	authorized	authorized	auths.mcp
any-of-denied-indeterminate	indeterminate	indeterminate	external-fact-unavailable	auths.mcp
threshold-2-of-3	valid	authorized	authorized	auths.mcp
threshold-mixed-success	valid	authorized	authorized	auths.mcp
threshold-mixed-indeterminate	indeterminate	indeterminate	external-fact-unavailable	auths.mcp
threshold-mixed-denied	denied	denied	invalid-signature	auths.mcp
permission-widening	denied	denied	delegation-expanded	auths.mcp
validity-widening	denied	denied	delegation-expanded	auths.mcp
audience-widening	denied	denied	delegation-expanded	auths.mcp
budget-widening	denied	denied	delegation-expanded	auths.mcp
depth-widening	denied	denied	delegation-expanded	auths.mcp
assurance-policy-change	denied	denied	delegation-expanded	auths.mcp
active-grant-status	denied	authorized	authorized	auths.mcp
missing-grant-status	denied	indeterminate	missing-grant-status	auths.mcp
stale-grant-status	denied	indeterminate	stale-status	auths.mcp
revoked-grant-status	denied	denied	grant-revoked	auths.mcp
grant-status-sequence-rollback	denied	denied	status-sequence-rollback	auths.mcp
wrong-grant-status-method	denied	denied	status-method-mismatch	auths.mcp
untrusted-grant-status-issuer	denied	denied	status-issuer-untrusted	auths.mcp
grant-status-freshness-boundary	denied	authorized	authorized	auths.mcp
grant-status-freshness-beyond	denied	indeterminate	stale-status	auths.mcp
conflicting-grant-status	denied	denied	grant-revoked	auths.mcp
unsupported-grant-status-method	denied	indeterminate	unsupported-status-method	auths.mcp
active-principal-status	status	authorized	authorized	auths.mcp
untrusted-principal-status-issuer	status	denied	status-issuer-untrusted	auths.mcp
revoked-principal-status	denied	denied	principal-revoked	auths.mcp
missing-principal-status	indeterminate	indeterminate	missing-principal-status	auths.mcp
action-permission-not-granted	denied	denied	permission-not-granted	auths.mcp
action-constraint-mismatch	denied	denied	action-constraint-mismatch	auths.mcp
action-budget-exceeded	denied	denied	budget-ceiling-exceeded	auths.mcp
action-validity-expanded	denied	denied	action-outside-validity	auths.mcp
action-actor-mismatch	denied	denied	broken-grant-chain	auths.mcp
unsupported-action-profile	denied	indeterminate	unsupported-profile	auths.unknown
unknown-action-extension	denied	denied	critical-extension-unknown	auths.mcp
action-channel-mismatch	denied	denied	local-policy-denied	auths.mcp
invalid-signature	denied	denied	invalid-signature	auths.mcp
missing-grant-reference	invalid	denied	missing-reference	auths.mcp
missing-plan-leaf	invalid	denied	missing-reference	auths.mcp
signature-suite-substitution	invalid	denied	signature-suite-mismatch	auths.mcp
unknown-signature-suite	invalid	indeterminate	unsupported-signature-suite	auths.mcp
unknown-principal-method	invalid	indeterminate	unsupported-principal-method	auths.mcp
unsupported-evidence-type	invalid	indeterminate	unsupported-evidence-type	auths.mcp
principal-method-mismatch	denied	denied	principal-method-mismatch	auths.mcp
verification-method-mismatch	denied	denied	verification-method-mismatch	auths.mcp
plan-action-mismatch	denied	denied	plan-action-mismatch	auths.mcp
carried-status-digest-mismatch	invalid	denied	digest-mismatch	auths.mcp
p256-high-s-signature	invalid	denied	invalid-signature	auths.mcp
bundle-byte-limit-exceeded	invalid	denied	resource-limit-exceeded	auths.mcp
verification-work-limit-exceeded	invalid	denied	resource-limit-exceeded	auths.mcp
plan-depth-limit-exceeded	invalid	denied	resource-limit-exceeded	auths.mcp
missing-principal-evidence	invalid	indeterminate	missing-principal-evidence	auths.mcp
unused-critical-evidence	invalid	denied	unused-critical-evidence	auths.mcp
duplicate-action-object	invalid	denied	duplicate-object	auths.mcp
duplicate-control-binding	invalid	denied	duplicate-object	auths.mcp
unused-grant-object	invalid	denied	unused-critical-evidence	auths.mcp
evidence-count-over-default	invalid	denied	resource-limit-exceeded	auths.mcp
duplicate-cbor-key	invalid	denied	malformed-proof	auths.mcp
non-minimal-integer	invalid	denied	non-canonical-proof	auths.mcp
trailing-bytes	invalid	denied	malformed-proof	auths.mcp
mismatched-profile-version	denied	denied	action-body-mismatch	auths.mcp
byte-distinct-action	denied	denied	action-body-mismatch	auths.mcp
wrong-audience	denied	denied	audience-mismatch	auths.mcp
wrong-challenge	denied	denied	challenge-mismatch	auths.mcp
composition-requirement-not-met	denied	denied	composition-requirement-not-met	auths.mcp
verifier-configuration-mismatch	denied	denied	verifier-configuration-mismatch	auths.mcp
registry-manifest-mismatch	denied	denied	registry-manifest-mismatch	auths.mcp
unsupported-resource-matcher	indeterminate	indeterminate	unsupported-resource-matcher	auths.mcp
unsupported-profile-policy	indeterminate	indeterminate	unsupported-profile-policy	auths.mcp
exact-marker-extension	valid	authorized	authorized	auths.mcp
exact-marker-extension-invalid	denied	denied	local-policy-denied	auths.mcp
accepted-extension-without-handler	indeterminate	indeterminate	unsupported-critical-extension	auths.mcp
resource-namespace-mismatch	denied	denied	resource-namespace-mismatch	auths.mcp
untrusted-root	denied	denied	untrusted-root	auths.mcp
unsupported-assurance-claim	indeterminate	indeterminate	unsupported-assurance-claim	auths.mcp
unsupported-budget-algebra	indeterminate	indeterminate	unsupported-budget-algebra	auths.mcp
attachment-valid	valid	authorized	authorized	auths.mcp
attachment-missing	denied	denied	attachment-missing	auths.mcp
attachment-wrong-digest	denied	denied	attachment-digest-mismatch	auths.mcp
attachment-wrong-length	denied	denied	attachment-length-mismatch	auths.mcp
attachment-duplicate	denied	denied	duplicate-attachment	auths.mcp
attachment-unused	denied	denied	unused-critical-attachment	auths.mcp
attachment-opaque-allowed	valid	authorized	authorized	auths.mcp
attachment-opaque-denied	denied	denied	opaque-attachment-not-allowed	auths.mcp

Byte ownership

.cbor files are deterministic golden vectors. Generate them only through:

cargo xtask wire --update

The normal cargo xtask wire command verifies that committed bytes have not changed.

For guidance on when vectors need to change, how to add a fixture, and how to review regenerated bytes, see Maintaining canonical CBOR fixtures.