Reference
How a claim of implementation is checked
An implementation conforms when it reaches the specifications' verdicts, field for field, on cases written in advance. Three kinds of check exist. Hand-written vectors, whose expected results were derived from the text. Derived mutants, small changes an attacker or a faulty presenter could make, with the reference's verdict on each. And a runner that tests a relying party over HTTP, in any language.
A disagreement on any case means one of two readings of the text is wrong. Both outcomes improve the specification.
The checks
| Check | Specification | Cases | What it establishes |
|---|---|---|---|
| Signature suite vectors ↗ | NOMOS-SPEC-010 | 30 | Every rule of the three suites, including the small-order Ed25519 keys a verifier must refuse at load. |
| Chain-of-trust interop vectors ↗ | NOMOS-SPEC-007 1.7.0 | 14 | Resolution, scope, revocation and freshness staples for the original walk. |
| Chain-of-trust vectors, rev. 1.9 ↗ | NOMOS-SPEC-007 rev. 1.9 | 37 | Target-first, scope-aware resolution, each case run in every presentation order it lists. |
| Revocation-source vectors ↗ | NOMOS-SPEC-007 rev. 1.10 | 22 + 349 derived | Which revocations count against a pinned root, and when a list is current; hand-written cases plus derived mutants with the reference's verdicts. |
| Act vectors ↗ | NOMOS-SPEC-008 0.6.0 | 43 + 1,693 derived | Every verdict and refusal of the Act verifier; agreement on the derived mutants is the strongest evidence of a matching reading. |
| Certificate selection vectors ↗ | NOMOS-SPEC-009 0.2.0 | 7 | The closure a carrier must present, including pools far larger than an Act may carry. |
| Relying-party HTTP runner ↗ | NOMOS-SPEC-009 | 17 checks | Fresh Acts from published test keys, over HTTP only, so a relying party in any language can be tested. |
Implementations
Each passes every check for the specifications it covers. All of them are by the authors of the specifications. An independent implementation is invited.
nomosprotocol
Python
The reference verifiers for SPEC-007, -008 and -010, and a relying party, carrier and witness for SPEC-009. The vectors are generated and checked with this code.
@nomosprotocol/verify
TypeScript
SPEC-007 rev. 1.10, SPEC-008 0.6.0 and SPEC-010. Agrees with the Python reference on every vector and every derived mutant.
Chain-of-trust prototype
TypeScript
SPEC-007, from the specification repository.
Suite checker
JavaScript
SPEC-010, written from the specification text alone using only the platform's built-in cryptography.
Building one
The implementer's guide gives the order to build in, the check for each step, and the rules most often misread, each one a place where two implementations by the authors once disagreed.
The specifications are on Specifications.
Cite this
This is a field in formation; this page will be revised. Cite the version date below, not the day you happen to be reading this.
Suggested citation
SafeHaven (2026). Conformance. Computable Authority, version of 2026-10-28. https://www.computableauthority.com/conformance
BibTeX
@misc{computableauthority-conformance,
author = {SafeHaven},
title = {Conformance},
howpublished = {Computable Authority},
year = {2026},
note = {Version of 2026-10-28},
url = {https://www.computableauthority.com/conformance},
}