Approval Protocol — Conformance Vectors

Normative for the Approval Protocol 1.0. Every vector is also a valid Decision Trace; a verifier runs the trace format’s checks first, then these. A conformant verifier must produce the stated result and exactly the stated (code, seq) set.

Each directory holds trace.jsonl, keys.json and expected.json.

Vector	Exercises	Expected
01-valid-single-approver	One eligible approver, quorum 1, invoked before expiry	VALID
02-quorum-two	Two distinct approvers reach quorum 2	VALID
03-denied	A denial; outcome denied; no invocation	VALID
04-expired	No decision before expires; service records expiry	VALID
05-invoked-after-expiry	Approved in time, invoked after expires	E_APPROVAL_EXPIRED
06-self-approval-then-valid	Originating principal’s approval recorded valid: false, then a valid one	VALID
07-ineligible-approver-misrecorded	Service records an ineligible approver as valid and approved, then invokes	E_VALIDITY, E_OUTCOME, E_APPROVAL_MISSING
08-duplicate-approver-misrecorded	Same approver counted twice toward quorum 2	E_VALIDITY, E_OUTCOME
09-decision-before-request	A decision with no earlier request	E_DECISION_ORDER
10-invocation-deviates	Approved a refund of line 3, invoked a refund of line 2	E_PLAN_MISMATCH
11-approval-reused	One approval, two invocations	E_APPROVAL_REUSED on the second
12-break-glass	Break-glass by an eligible group satisfies quorum 2 alone	VALID
13-request-hash-mismatch	Request’s plan_hash does not match its plan	E_PLAN_HASH, then E_PLAN_MISMATCH at invocation
14-invocation-without-request	A gated invocation citing a request that was never made	E_APPROVAL_MISSING
15-deputised-approval	Someone with no eligibility of their own, deciding on authority lent by someone who has it	VALID
16-deputised-by-the-submitter-misrecorded	The authority was lent by the person whose work is being approved, and the service recorded it as valid	E_VALIDITY, E_OUTCOME, then E_APPROVAL_MISSING at invocation

Vector 10 is the one the protocol exists for. Generated by the reference implementation (Rashnu), pkg/approval/vectors_test.go; regenerate with go test ./pkg/approval -run TestVectors -update.