# ADCR test vectors 0.1.0

Generated by `../generate_vectors.py` from fixed inputs; every file here is byte-stable and can be regenerated with `python3 -I ../generate_vectors.py`. Run them with `python3 -I ../run_vectors.py`.

Each suite holds `cases/<case>.json` (one export per case) and `expected.json`. For each case `expected.json` gives:

- `verdict`: what a conforming verifier returns.
- `findings`: the finding names that MUST appear (SPEC.md EXP-04). For a `verified` case there are none. The generator checks that the reference verifier reports exactly these names, so each negative case reports only what it declares: outside `interactions_v1` that is the rule it is named for (`anchor_coverage_misstated` adds the informational `unanchored_tail` its misstated coverage leaves), and each `interactions_v1` case breaks two.
- `trust_anchors` (on the suite, overridable per case): the PEM file to pin, relative to the suite directory. `null` means run without one; the verdict is then `refused`.
- `profile` (`profile_v1` cases): the producer profile, under `profiles/`, to run the verifier with (`--profile`).

## The timestamp tokens

`keys/` holds a test timestamp authority made by `../make_test_authority.py` with OpenSSL: a test root (`root.pem`, also `trust-anchors.pem`), a test TSA certificate with the timeStamping purpose (`tsa.pem`), the same key under a certificate valid only during 2024 (`tsa-expired.pem`), and a second root and TSA that are not trust anchors (`other-root.pem`, `other-tsa.pem`). The TSA private keys are not published: verifying needs only the certificates and the tokens. The authority is disposable; `make_test_authority.py` makes a new one, after which `generate_vectors.py` mints every token again.

Every anchor carries a real RFC 3161 TimeStampResp, minted once with `openssl ts -reply` and kept in `keys/tokens/`, named by the statement digest and the signer, except where a case breaks the token on purpose: `anchor_token_parse` carries bytes that are not a token, `anchor_token_status_rejected` a hand-built rejection response, and `anchor_token_signature` a minted token with its signature altered. The generator mints a token only when a statement has none on disk, so regenerating from the committed tokens is byte-stable. `openssl ts -verify` against `trust-anchors.pem` returns `Verification: OK` for the token of every `*_valid` case and fails, at the expected step, for the expired signer, the wrong imprint, the altered signature and the untrusted root.

## Suites

| Suite | Cases | What it shows |
|---|---|---|
| `record_v1` | 29 | required fields, number form, content-free and person-safe records, keyed commitments, locators, decisions, fallbacks, failures, classification, legal holds |
| `law_v1` | 10 | rule references, ELI and national provisions, checked versus caller-asserted provisions, rule set digests |
| `chain_v1` | 9 | write-time chain: edits, removals, insertions, broken links, unchained rows, pre-chain rows, backdating |
| `anchor_v1` | 14 | anchor statements and every token step: parse, status, imprint, signature, trust, and `refused` without trust anchors |
| `oversight_v1` | 13 | human oversight records, the proposal and final action pair, Article 14(5) dual verification, oversight evaluation |
| `rights_v1` | 20 | decisions about a person: legal basis, decision mode, notice, explanation inputs, withheld information, contests, notices, incidents |
| `export_v1` | 7 | the envelope: required fields, signatures, summaries that must match the records, content-free exports |
| `profile_v1` | 10 | the producer profile: required fields, high-risk retention periods, domain tags, copies, and an export that disagrees with its profile |
| `interactions_v1` | 5 | two failure axes in one export (advisory) |

[`../COVERAGE.md`](../COVERAGE.md) lists, per MUST, which cases exercise it.

## Schema

Every `verified` case validates against `schema/export.schema.json`, and every profile of a `verified` case against `schema/producer-profile.schema.json`. The export schema also rejects 62 of the negative cases. The rest break rules a schema cannot state, which only the verifier checks (SPEC.md Annex A): rules that span records, the number form, the anchor token (its parse, status, imprint, signature and trust), the export against its producer profile, and rules inside one record that depend on other fields or on what a value means.