Snapshot 2026-10-07

Files

What this is

vectors/reject_refresh_reparent.json is offered to the -02 vector set of draft-asor-wimse-agent-delegation-chain. A validly-issued child token is presented with a re-issued copy of the parent it was delegated under: identical authority (iss, sub, scopes, ceilings, ttl, iat, exp, depth fields), honestly re-signed over its new bytes, differing only in jti. The child's par_hash still commits to the original parent's signing input, so verification step 2 — the byte commitment — rejects it with par_hash_mismatch. Steps 1, 3, 4 and 5 pass, so subsumption cannot catch it.

That makes it complementary to the existing reject_spliced_parent vector, which substitutes a different, broader parent. Here the parent's authority does not move; only the token instance does.

vectors/control_valid_under_actual_parent.json is the same child under its actual parent (accept). It is byte-identical to the first two tokens of the existing valid_chain vector, so it exists as a local control for attribution and is not offered to the corpus. vectors/reject_refresh_reparent_timeshift.json is the same class with iat and exp shifted by the same delta.

java/ is a Java implementation of the offline verification algorithm (steps 1–5), a port of attenu-io/attenu-guard at e2fd094 (v0.19.1). It scores 20/20 on the upstream corpus as of that baseline and 3/3 on the vectors here. Sources only — no compiled binary is published, so what you run is what you built. java/README.txt gives a JDK-only path that needs neither Maven nor network.

patch/ adds the offered vector to the reference implementation's own harness for review.

What is not claimed

• No vulnerability, no attack, no production-security statement. This is a regression anchor for one verification step.
• The Java implementation is by a party other than the draft's author, but it was aligned to and differentially tested against the reference implementation rather than written from the draft alone. It also comes from the same party that produced these vectors, so it is not independent validation of them.
• The corpus covers verification steps 1–5. Holder binding, status lists and actual-action authorization are out of scope.
• A green run is evidence of conformance to a frozen corpus, not a completeness theorem and not a certification.