Aicent-Stack/iqa-org

**IQA for Rust: iqa:// subject-attestation addressing, IQA_ROUTE
derivation, AICENT-009 sec. 11.3 action safety classes, the AE-128 fixed
attestation envelope -- and the published conformance vectors that prove an
implementation is right.**
AICENT-009 sec. 10 - sec. 11 - spec v1.2.6 - zero dependencies (default build) - #![forbid(unsafe_code)]
---
Verify it -- no trust required
That is the point of this crate. A specification is worth exactly what an
independent implementation can reproduce from it -- so instead of asking you to
believe a table of numbers, this ships the vectors and replays them locally:
the conformance vector set (8 positive URIs + 18 fail-closed rejections +
5 safety rows + the Ed25519 envelope vector), plus the **AE-128 published
vector** -- reproduced byte for byte from the companion draft's documented
parameters -- behind a fail-closed structural matrix and a full-frame
authentication tamper matrix. Offline, no account, no network.
The three implementations -- Python (pip install iqa-org), JavaScript
(npm install @aicent/iqa), and this one -- **share no code** and agree byte
for byte on the same published vector set (sha256 8529549e..., shipped in all
of them) and on the AE-128 vector (4bd14b6a...).
---
Install
Zero dependencies in the default build: SHA-256 is implemented in-crate
(known-answer tested against NIST vectors), HMAC-SHA256 (RFC 2104) sits on top
of it, and the vector file is read through a minimal in-crate JSON reader. The
sovereign Ed25519 attestation envelope is available behind the optional
ed25519 feature.
---
Quickstart
The two closed sets -- the deliberate difference from rttp
rttp accepts any well-formed action verb. **iqa does not.** AICENT-009 sec. 10.1
marks *both* segments "Closed set":
Malformed input is rejected, not normalised: uppercase anywhere, iqas://,
userinfo, port, query and fragment all fail closed. Nothing is ever accepted
because a check could not be performed.
One honest quirk of the grammar
The ABNF is an ordered choice (hash-subject / name-subject), so a lowercase
hex string of a **non-hash length** (9 digits, say) is a *name subject*, not an
error. The grammar is the grammar; vector #8 pins the behaviour so every
implementation agrees on it.
Action safety classes (AICENT-009 sec. 11.3)
| action | Class | action_safe |
|:---|:---|:---|
| *(omitted)* | SAFE -- standing read | true |
| verify | SAFE -- read-only comparison | true |
| audit | NOT SAFE -- can trigger Authority Ischemia | false |
| attest | NOT SAFE -- state transition | false |
| revoke | NOT SAFE -- state transition | false |
Per sec. 11.2, dereferencing an iqa URI MUST NOT transition any subject's
standing. Tooling built on this crate MUST gate the three NOT-SAFE verbs
behind an explicit user action -- parsing one is not requesting one.
AE-128 -- the fixed answer carrier (default build)
Fixed offsets, HMAC-SHA256 over the whole frame with the attestation field
zeroed, the standing closed set at offset 80, constant-time compare, zero
dependencies. The published vector (envelope::vector_1_frame()) reproduces
byte for byte against the companion draft's parameters -- and against the
Python and JavaScript implementations.
Attestation envelope (feature ed25519)