attenu-guard-java 0.1.0 - Java implementation of the Agent Delegation
Chain offline verification algorithm (draft-asor-wimse-agent-delegation-chain).

Provenance
  A Java implementation of the draft's verification algorithm, by a party other
  than the draft's author. It was aligned to and differentially tested against
  the reference implementation attenu-io/attenu-guard rather than written from
  the draft alone, so it is a port in the operative sense. It also comes from
  the same party that produced the vectors in vectors/, so its agreement with
  those vectors is not independent evidence for them.
  Upstream baseline: attenu-guard e2fd094 (v0.19.1).
  Licence: Apache-2.0. LICENSE and NOTICE are upstream's own and are included.

What it does
  Offline verification steps 1-5 of the draft: JWS signature, par_hash byte
  commitment, depth bounds, authority subsumption, and time. Steps 6-8
  (holder binding, status list, actual-action authorization) are out of scope.
  Zero runtime dependencies: the library compiles against the JDK alone.

How this file is laid out
  Paths below are relative to the root of attenu-guard-java-0.1.0-src.zip. On
  the download page the same text is java/README.txt and the vectors sit one
  level up, in ../vectors/. Score.java and verify-corpus.sh are published there
  as readable copies only: both need the sources, so run them from the unzipped
  source package.

Verify against the reference corpus - one command, no silent skip
  unzip attenu-guard-java-0.1.0-src.zip && cd attenu-guard-java-0.1.0
  ./tools/verify-corpus.sh

  That builds with the JDK only, scores the vectors in this package, clones the
  reference implementation at the pinned baseline
  (attenu-guard e2fd09466f12e3dd66eba8219ef059687e023e39), scores its corpus,
  and - if Maven is installed - runs its JUnit suite with the corpus included.
    --corpus PATH     use a checkout you already have, no clone
    --no-maven        JDK only; skip the JUnit suite
    --ref REF         a different revision
    ATTENU_GUARD_URL  clone from a mirror or a local path instead of GitHub

Score the vectors in this package by hand - JDK only, no network, no Maven
  javac -d out $(find src/main/java -name '*.java')
  javac -cp out -d out tools/Score.java
  java -cp out Score vectors

Maven
  mvn -B test
      Library unit tests only. The corpus test SKIPS unless the reference
      corpus is present at ../tests/vectors, which it is not in this package.
      A green run here does NOT mean the vectors were scored: Maven reports it
      as skipped, not failed.
  mvn -B test -Dattenu.vectors=/path/to/attenu-guard/tests/vectors
      Runs the corpus test against the full upstream corpus.
  mvn -B package
      Builds target/attenu-guard-java-0.1.0.jar. No binary is published with
      this package: build your own so what you run is what you built. (Maven
      embeds timestamps, so two builds of the same sources are not
      byte-identical.)

  Do NOT point -Dattenu.vectors at the vectors/ directory in this package.
  That test asserts the corpus covers every rejection reason, and these three
  vectors are a subset, so it fails by design. Score them with the JDK-only
  path above.

Measured at packaging time
  upstream corpus attenu-guard/tests/vectors @ e2fd094 .......... 20/20
  the three vectors in vectors/ .................................... 3/3
  57 tests green against the full corpus, including the check that the corpus
  is not trivially green. Both paths were exercised offline.

Scope
  A green run is evidence of conformance to a frozen corpus. It is not a
  completeness theorem, not a production-security statement, and not a
  certification.