These are primary technical inputs read for the design on October 6, 2026. Recheck the relevant source before implementing its surface. No linked example alone proves peer acceptance.
| Contract | Scope |
|---|---|
| RFC 9421 | HTTP message signatures, algorithms, derived fields, responses, trailers, challenges, vectors. |
| HTTP signature registry | Exact registered algorithm names and parameters. |
| RFC 8941, RFC 9651 | Structured Fields; apply the field's selected schema and referenced types. |
| RFC 9530 | Content and representation digests and preference fields. |
| Web Bot Auth WG draft | Current draft profile and discovery, subject to change. |
| RFC 7515, RFC 7516 | JWS and JWE machinery where the actual selected profile uses them. |
| RFC 7517, RFC 7638, RFC 8037 | JWK, thumbprints, OKP keys. |
| RFC 8725 | JWT algorithm, issuer, audience, type and validation rules. |
| Livebook importer, exporter | Actual notebook parse/export API and branch behavior. |
| ExDoc | Generated API and guide tooling. |
Source-bound profile selection
Generic RFC 9421 requires caller-supplied coverage, algorithm, freshness, replay,
and trust policy. Web Bot Auth protocol-00 selects its exact dictionary-member
Signature-Agent representation, labels, tags, discovery types, and nested
coverage. Another source revision cannot silently broaden these predicates.
The profile decision defines source-bound
acceptance, and the testing guide distinguishes published
vectors, independent construction, and deployed-peer evidence.
Generic HTTP and JOSE identifiers are separate exact wire tokens. Structured
Field parameter names cannot contain uppercase letters. The HTTP algorithm
ed25519 and JOSE EdDSA require explicit selection in their own registries;
no spelling alias or automatic cross-profile fallback exists. Sources include
RFC 9421 Sections 2.3, 2.5, and 3.3.6,
RFC 8941 Section 3.1.2, and
RFC 7518 Section 3.5.
Application profiles live in extension packages through the bounded surface in ADR 0013. Core standards are not weakened to accommodate conflicting examples. Definitive source evidence is required before advertising an ambiguity-dependent rule as conformant.
Provenance
Store immutable public captures with original source URL, retrieval time, content digest, license and source revision before deriving corpus cases. Store release receipts separately from human guides. Independent published vectors and local examples have distinct labels. No secret, customer payload, or private source belongs in the public corpus.