Authority Envelope — Conformance Vectors

Normative for the Authority Envelope 1.0. Every trace is a valid Decision Trace; a verifier runs the format’s checks first, then these. Bundles hold parent.jsonl and child.jsonl.

Vector	Exercises	Expected
01-valid-intersection	Agent holds refunds.issue, principal does not; envelope is the intersection; an action within it	VALID
02-intersection-widened	clearances lists refunds.issue, which held.principal lacks	E_INTERSECTION
03-bad-signature	issuer names one control-plane key; signed by another	E_ENVELOPE_SIG
04-action-outside-envelope	tool.invoked requires refunds.issue; envelope grants orders.read	E_ACTION_UNAUTHORISED
05-approval-does-not-widen	The same action, approval-gated and approved	E_ACTION_UNAUTHORISED
06-valid-delegation	Child envelope derived from the parent: same principal, subset, within remaining budget, depth +1, linked	VALID
07-child-widened	Child claims a clearance the parent’s envelope lacks	E_CHILD_WIDENED, E_INTERSECTION
08-child-budget-over-remaining	Child tokens exceed what the parent had left after consumption	E_CHILD_BUDGET
09-child-different-principal	Delegation tried to re-originate authority	E_CHILD_PRINCIPAL, E_PRINCIPAL
10-child-wrong-depth	Depth 3 under a depth-0 parent	E_CHILD_DEPTH
11-child-expires-after-parent	Child outlives its parent’s authority	E_CHILD_EXPIRY
12-envelope-wrong-scope	Envelope names another task	E_ENVELOPE_SCOPE

Vectors 04 and 05 together are the point: an approval authorises an action within the envelope and never adds to it. Generated by the reference implementation (Rashnu), pkg/authority/vectors_test.go; regenerate with go test ./pkg/authority -run TestVectors -update.