feat: vector generator + negative (MUST-reject) bank#18
Merged
Conversation
Two coupled open-menu items: reproducible provenance for the vectors, and a bank of cases a conformant implementation MUST reject. vectors/generate.ts re-derives every committed vector's value fields from documented seeds, reusing the vector-tested reference crypto so it cannot drift from the runner. `--check` (the default) reproduces all 23 positive value fields (aad, key-binding, hkdf, x25519, ed25519, payload-aead, key-wrap, federation) and asserts the committed files match, then asserts negative.json equals the generator output. It does not rewrite the RFC-anchored, cross-verified positive files, so their reviewed prose is preserved. CI (the vectors job) and `task test` run `--check`; this is the provenance and drift gate. vectors/negative.json is the MUST-reject bank the generator owns, derived from the same seeds as the positives. 16 cases across three operations: payload-decrypt and key-unwrap MUST fail authentication (flipped GCM tag, flipped body bit, truncation, missing tag, wrong AAD repoId/version/epoch, wrong data key, wrong recipient or ephemeral wrap key); ed25519-verify MUST return false (flipped signature, wrong message, wrong public key). A new conformance test asserts every case is rejected. Wire base64 strictness is implementation-specific and intentionally not tested. Indexed in vectors/index.json (new `negative` kind); documented in vectors/README.md, SPEC §11, CLAUDE.md, and llms.txt. Conformance runner is now 53 tests; generator --check is green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two coupled open-menu items: reproducible provenance for the vectors, and a bank a conformant impl MUST reject. Conformance runner 53 tests (was 37); generator
--checkgreen; no-em-dash house rule held.Vector generator (
vectors/generate.ts)Re-derives every committed vector's value fields from documented seeds, reusing the vector-tested reference crypto (cannot drift from the runner).
--check(default, read-only): reproduces all 23 positive value fields (aad, key-binding, hkdf, x25519, ed25519, payload-aead, key-wrap, federation) and asserts the committed files match; then assertsnegative.jsonequals generator output. Provenance + drift gate — run in CI (vectors job) andtask test.--writeownsnegative.json.Negative bank (
vectors/negative.json, 16 cases)Derived from the same seeds as the positives; new
test/negative.test.tsasserts each is rejected.Wiring
vectors/index.json(+negativekind), SPEC §11,vectors/README.md(Negative + Regenerating sections), CLAUDE.md, llms.txt, CHANGELOG. CI stepbun vectors/generate.ts --checkadded to the vectors job;task vectors-check+ folded intotask test.Verified locally
bun vectors/generate.ts --check: all 23 positives reproduce from seeds, negative bank in sync.Menu remainder
Reference IdP + persistent server; gRPC example; browser/WASM demo;
llms-full.txt; spec quardrails (size caps, idempotency,Retry-After).