Skip to content

fix(compliance-cli,schemas): stop making a chain and a payment rail conformance bars #103

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ucekmez wants to merge 1 commit into
base: feat/webhook-backfill-redelivery
Choose a base branch
from
Open

fix(compliance-cli,schemas): stop making a chain and a payment rail conformance bars #103

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/current/SPECIFICATION.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1080,7 +1080,7 @@ EEP nodes that advertise `pqc_ready: true` in their `/.well-known/eep.json` mani
| FIPS 204 | ML-DSA-65 | Digital signatures |
| FIPS 205 | SLH-DSA-128s | Hash-based signatures (stateless) |

Nodes SHOULD advertise supported algorithms in the `pqc_algorithms` array of the manifest. Nodes that are not yet PQC-ready MUST set `pqc_ready: false` (not omit the field).
Nodes SHOULD advertise supported algorithms in the `pqc_algorithms` array of the manifest. `pqc_ready` is OPTIONAL and defaults to `false`; a node that is not PQC-ready MAY either set it explicitly or omit it. Omission and `false` are equivalent, and neither affects conformance at any tier — PQC readiness is a capability a publisher advertises, not a bar it must clear.

### 11.7 Signing Algorithm Negotiation (Crypto-Agility)

Expand Down
4 changes: 2 additions & 2 deletions docs/standards/draft-eep-protocol-core-00.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,8 +143,8 @@ The fields relevant to the Core tier are:
| `eep_version` | string | yes | The EEP version supported, e.g. `"0.1"`. |
| `layers` | object | yes | Endpoint URLs per layer; see below. |
| `supported_content_types` | array | yes | Media types the Layer 1 entity endpoint can serve, e.g. `["application/json", "text/markdown"]`. |
| `pqc_ready` | boolean | yes | Whether the publisher can verify post-quantum signature algorithms. |
| `x402_enabled` | boolean | yes | Whether the publisher supports HTTP 402 payment gating. |
| `pqc_ready` | boolean | no | Whether the publisher can verify post-quantum signature algorithms. Absent means false. |
| `x402_enabled` | boolean | no | Whether the publisher supports HTTP 402 payment gating. Absent means false. |
| `gates_url` | string (URI) | no | Absolute https URL of the gate configuration document. |
| `services_url` | string (URI) | no | Absolute https URL of the service catalog. |
| `updated_at` | string | no | RFC 3339 timestamp of the last manifest change. |
Expand Down
48 changes: 30 additions & 18 deletions packages/@eep-dev/compliance-cli/src/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,9 +155,9 @@ const RECOMMENDATIONS: Record<string, string> = {
'/.well-known/eep.json manifest reachable': 'Serve eep manifest with stable URL and valid JSON contract.',
'manifest.did field present': 'Include did in manifest and keep it resolvable.',
'manifest.eep_version field present': 'Publish supported eep_version in manifest.',
'manifest.reputation (ERC-8004) field present': 'Add reputation block with contract information when claiming full-tier readiness.',
'manifest.pqc_ready flag present': 'Publish pqc_ready boolean in manifest.',
'manifest.x402_enabled flag present': 'Publish x402_enabled boolean in manifest.',
'manifest.reputation (ERC-8004) field present': 'Optional. Add a reputation block with contract information only if you use on-chain reputation; it is not required for any conformance tier.',
'manifest.pqc_ready flag present': 'Optional. Publish pqc_ready only if you advertise post-quantum signature verification; absent means false.',
'manifest.x402_enabled flag present': 'Optional. Publish x402_enabled only if you support HTTP 402 payment gating; absent means false.',
'HTTP 403 response for non-payment gate': 'Return RFC-consistent 403 response body for non-payment gate denials.',
'Federation registry economics metadata': 'Publish optional `economics` on `/.well-known/eep-registry.json` (registration fee, query quota, staking/challenge policy).',
'Cold-start trust status endpoint': 'Expose GET /eep/trust-status?agent_did=… returning trust_state cold_start or standard (reference stacks).',
Expand Down Expand Up @@ -734,25 +734,37 @@ async function runTests() {
if (json.eep_version) pass('manifest.eep_version field present', json.eep_version);
else fail('manifest.eep_version field present', 'missing');

// ERC-8004 reputation field (G3)
// ERC-8004 reputation field (G3).
//
// OPTIONAL in eep-manifest.json, so failing a publisher for
// its absence made the conformance bar stricter than the
// schema — and made an Ethereum reputation registry a
// prerequisite for Full conformance. A publisher with no
// blockchain involvement could not reach Full. Report it,
// don't fail on it.
if (json.reputation && json.reputation.contract) {
pass('manifest.reputation (ERC-8004) field present', json.reputation.contract);
logPass('manifest.reputation (ERC-8004) field present', json.reputation.contract);
} else {
fail('manifest.reputation (ERC-8004) field present', 'missing or no contract');
}

// PQC readiness flag (G8)
if (typeof json.pqc_ready === 'boolean') {
pass('manifest.pqc_ready flag present', String(json.pqc_ready));
} else {
fail('manifest.pqc_ready flag present', 'missing or not a boolean');
logSkip(
'manifest.reputation (ERC-8004) field present',
'optional in eep-manifest.json — only meaningful for publishers using on-chain reputation',
);
}

// x402 enabled flag (G2)
if (typeof json.x402_enabled === 'boolean') {
pass('manifest.x402_enabled flag present', String(json.x402_enabled));
} else {
fail('manifest.x402_enabled flag present', 'missing or not a boolean');
// PQC readiness and x402 flags. Both are OPTIONAL with a
// documented default of false — a publisher that supports
// neither post-quantum verification nor HTTP 402 payment
// gating is fully conformant and simply omits them. Report
// what is declared; do not require a declaration.
for (const flag of ['pqc_ready', 'x402_enabled'] as const) {
const value = json[flag];
if (typeof value === 'boolean') {
logPass(`manifest.${flag} flag present`, String(value));
} else if (value === undefined) {
logSkip(`manifest.${flag} flag present`, 'optional — absent means false');
} else {
logFail(`manifest.${flag} flag present`, `present but not a boolean: ${typeof value}`);
}
}

// Dynamic capability discovery (G5)
Expand Down
Loading