Publish machine-readable conformance profiles + test vectors and conformance badge

[github-actions]

Motivation

RDX already references conformance concepts and profiles (RDX-009, RDX-063, RDX-096..098). However, adoption and interoperability require an authoritative, machine-checkable conformance suite: a set of named conformance profiles (core, cal-taf, sbom-embedded, reader-lite) each with a JSON Schema subset, explicit MUST/SHOULD matrix, and signed test vectors (valid/invalid). A conformance badge and deterministic test vectors accelerate vendor interoperability and make CI-based verification straightforward.

Proposed change

1. Define conformance profile manifest: conformance/profiles.yaml listing profiles such as:

   • core: minimal required top-level (schemaVersion, documentId, riskSet.itemDefinition).
   • cal-taf: core + required calAssuranceLevels and tafAssessments fields.
   • sbom-embedded: documents intended to be embedded in CycloneDX metadata.properties (size and encoding constraints).
   • reader-lite: fields required by the RDX Reader viewer (RDX-101).

   Each profile entry MUST include:

   • unique profile id and human label
   • list of normative RDX requirement IDs satisfied by the profile (e.g., RDX-010, RDX-032)
   • a JSON Schema fragment or JSON Schema allOf pointer to a profile schema
   • link to test-vectors directory

2. Produce deterministic test vectors:

   • conformance/test-vectors/{profile}/valid/*.json (minimum valid document, maximal valid document),
   • conformance/test-vectors/{profile}/invalid/*.json (missing required field, schemaVersion mismatch, invalid UUID, additionalProperties violation if profile forbids them).
   • Each vector includes an expectation metadata file (expected.yaml) describing pass/fail and reason codes.

3. Provide a validator harness tools/conformance-validator/ (node/python) that takes a profile id and runs all vectors producing a machine-readable run report (JSON) and optional signed badge artifact conformance/results/{implementation}-{profile}-{date}.json which can be used to display a conformance badge.

4. Add CONFORMANCE.md describing the profile evolution policy: how to add new profiles, how profiles map to RDX-XXX requirements, and deprecation policy aligned with VERSIONING.md.

5. New RDX requirement: RDX-122: "Publish machine-readable conformance profiles, canonical test vectors, and a reference validator harness to enable automated interoperability testing" (new requirement).

Backward-compatible: purely test-and-doc artifacts; RDX schema unchanged.

References

• JEP / IETF drafts on conformance and test suites for similar ecosystems (profiles + signed test vectors). Example draft: draft-wang-jep-conformance. https://datatracker.ietf.org/doc/draft-wang-jep-conformance/.
• OVERT and other conformance examples showing test-vectors + badges. https://overt.is/OVERT_v1.0_STANDARD.pdf.
• Practical examples: how conformance/test-vectors are used in other specifications (e.g., attestation receipts drafts). https://ftp.kaist.ac.kr/ietf/draft-chueayen-attestation-receipts-01.html.

Acceptance criteria

1. Add conformance/profiles.yaml with at least the 4 initial profiles (core, cal-taf, sbom-embedded, reader-lite) and explicit mapping to RDX requirement IDs.
2. Add test vectors under conformance/test-vectors/ for each profile: at least one minimal-valid, one maximal-valid, and three invalid vectors exercising common failure modes.
3. Add tools/conformance-validator/ reference harness that runs profile vectors and emits a machine-readable report (JSON). The harness must exit non-zero if any 'valid' vector fails or any 'invalid' vector unexpectedly passes.
4. Add CONFORMANCE.md describing the process to add profiles, how to version test vectors, and how to sign conformance reports for public display.
5. Update REQUIREMENTS.md with RDX-122 (new requirement) and a cross-reference table showing which existing RDX requirements each conformance profile enforces.
6. Add a CI job that runs the conformance-validator against the repository's own examples and produces a passing/failing badge; pull requests that add or modify schema-relevant files must run the conformance suite and include results.

These artifacts will make RDX interoperability measurable and reduce vendor friction during adoption.

---

Generated by tools/ai_idea_scout.py via the AI Idea Scout workflow.
Review the proposal, refine the title/body/labels, and close if not desired.