Skip to content

STANDARDS_LEDGER.md

Latest commit

 

History

History
170 lines (135 loc) · 28.4 KB

STANDARDS_LEDGER.md

File metadata and controls

170 lines (135 loc) · 28.4 KB
Raw

Standards ledger

Status: Reference catalogue of every external standard PEAC Protocol cites or implements. Each row carries an explicit status label, a citation site (code path or spec doc), and the role the standard plays. This document is descriptive, not aspirational: listing a standard here does not imply certification, conformance claim, or roadmap commitment.

Status labels

Label Meaning
Standards Track Approved Standards Track document at IETF (Proposed / Internet Standard) or W3C (Recommendation) or ISO/IEC. Stable reference.
Informational RFC Editor or working-group document published for reference. Not a Standards Track requirement; PEAC may rely on it normatively even when its source track is Informational.
IRTF Informational Document published by an IRTF Research Group. Informational at the RFC Editor; not IETF Standards Track.
BCP IETF Best Current Practice. Operational guidance; binding within IETF stream.
FIPS US Federal Information Processing Standard. Standards Track at NIST.
W3C Recommendation W3C Technical Report at the final stage.
International Standard ISO/IEC published standard.
Regulatory Government regulation. Applicability and enforcement scope per the regulator. Cited for mapping, never for certification.
Draft / RFC-to-be At RFC Editor AUTH48 or post-IESG approval; RFC number not yet assigned. Status flips to Standards Track or Informational once the RFC is published.
Watchlist Tracked by PEAC for future composition. No current implementation, no current normative dependency.

PEAC does not issue conformance certificates for any external standard. Where a row says "PEAC implements," it means PEAC implements the cited subset of the standard for the role described in the "Citation site" column; it does not mean PEAC is certified against the full document.

A. Wire format and signing

Standard Status Role in PEAC Citation site
RFC 7515 (JWS) Standards Track Compact serialization for peac-receipt/0.1 and interaction-record+jwt packages/crypto/src/jws.ts
RFC 7517 (JWK) Standards Track Embedded-key rejection rule (E_JWS_EMBEDDED_KEY); JWKS member shape packages/jwks-cache/src/resolver.ts
RFC 7518 (JWA) Standards Track Algorithm identifier EdDSA (and only that) packages/crypto/src/jws.ts
RFC 7519 (JWT) Standards Track Compact JWT shape with typ: interaction-record+jwt (Wire 0.2) packages/protocol/src/issue.ts
RFC 7638 (JWK Thumbprint) Standards Track kid derivation packages/crypto/src/
RFC 7797 (JWS Unencoded Payload) Standards Track b64:false rejection (E_JWS_B64_REJECTED) packages/crypto/__tests__/jws.property.test.ts
RFC 8032 (Ed25519 / Ed448) IRTF Informational Canonical signature algorithm. Note: RFC 8032 is an IRTF CFRG Informational document, not IETF Standards Track. Its parameters are referenced normatively here. packages/crypto/src/jws.ts
RFC 8259 (JSON) Standards Track Payload format wire format
RFC 7493 (I-JSON) Standards Track Raw I-JSON gate on JWS protected header and payload bytes before JSON parse: rejects duplicate member names, out-of-range numbers, invalid UTF-8, surrogates, and noncharacters packages/crypto/src/ijson.ts, sdks/go/ijson.go, specs/conformance/parity-corpus/ijson-raw-input/
RFC 8725 (JWS / JWT BCP) BCP Hardening guidance applied at JWS verify packages/crypto/src/jws.ts
FIPS 186-5 FIPS NIST FIPS reference for EdDSA parameters reference

B. HTTP and API surfaces

Standard Status Role in PEAC Citation site
RFC 9110 (HTTP Semantics) Standards Track General header semantics apps/api/src/
RFC 9421 (HTTP Message Signatures) Standards Track @peac/http-signatures profile packages/http-signatures/
RFC 9449 (DPoP) Standards Track Sender-constrained tokens; optional composition docs/specs/AGENT-IDENTITY.md
RFC 9457 (Problem Details) Standards Track Reference verifier error response shape apps/api/src/errors.ts
RFC 9651 (Structured Fields) Standards Track Content-Usage and content-signal header parsing packages/mappings/content-signals/
RFC 9745 (Deprecation Header) Informational Endpoint lifecycle signaling on legacy /verify alias apps/api/src/index.ts (LEGACY_VERIFY_DEPRECATION_HEADERS)
RFC 8594 (Sunset Header) Informational Endpoint retirement-horizon signaling on legacy /verify alias same
RFC 8288 (Web Linking) Standards Track rel="deprecation" Link header on the legacy alias same
RateLimit header fields (draft-ietf-httpapi-ratelimit-headers) Active Internet-Draft /v1/verify emits deployed RateLimit-Limit / RateLimit-Remaining / RateLimit-Reset compatibility fields; the active draft status is tracked separately and may differ from earlier deployed field names. apps/api/src/verify-v1.ts

PEAC treats RFC 9745 and RFC 8594 as operational signaling conventions even though their source track is Informational; both are widely deployed and their semantics are stable.

C. Discovery and metadata

Standard Status Role in PEAC Citation site
RFC 8615 (Well-Known URIs) Standards Track /.well-known/peac-issuer.json, /.well-known/peac.txt, /.well-known/agent-card.json paths docs/specs/PEAC-ISSUER.md, docs/specs/PEAC-TXT.md
RFC 9728 (OAuth 2.0 Protected Resource Metadata) Standards Track Issuer-discovery alignment for protected-resource metadata docs/specs/PEAC-ISSUER.md
RFC 3986 (URI Generic Syntax) Standards Track Issuer URL canonical form packages/protocol/src/
RFC 4648 (base64url) Standards Track JWS encoding packages/crypto/src/base64url.ts
RFC 4122 / RFC 9562 (UUIDs) Standards Track jti / rid generation (UUIDv7) packages/protocol/src/issue.ts
RFC 3339 (timestamps) Standards Track / Proposed Standard occurred_at ISO 8601 timestamp formatting in records (iat is Unix seconds) wire format

D. Canonicalization and Informational dependencies

Standard Status Role in PEAC Citation site
RFC 8785 (JCS) Informational Canonical JSON for claim digest, policy digest, document digest. PEAC relies on RFC 8785 normatively even though its source track is Informational; the cross-language parity corpus pins byte-stable behavior. packages/crypto/src/jcs.ts, docs/specs/DOCUMENT-BINDING.md
RFC 2119 + RFC 8174 (BCP 14) BCP MUST / SHOULD / MAY key-words across PEAC specs spec convention
RFC 1035 (DNS) Internet Standard Hostname semantics reference
RFC 1918 / RFC 4193 / RFC 6890 BCP / IS / Reference Private and special-purpose IP-range definitions used by SSRF policy packages/net/node/src/ssrf.ts

E. Identity and supporting standards

Standard Status Role in PEAC Citation site
W3C DID Core 1.0 W3C Recommendation did: prefix support in iss docs/specs/DID-RESOLUTION-PROFILE.md
W3C VC Data Model W3C Recommendation Watchlist; not on the current wire watchlist
RFC 9309 (Robots Exclusion) Internet Standard Content-usage signals resolver packages/mappings/content-signals/

F. API contracts

Standard Status Decision at v0.13.0 Citation site
OpenAPI 3.1.x OpenAPI Spec Public contract for POST /v1/verify, POST /v1/issue, GET /v1/issuer-health is OpenAPI 3.1.1 packages/schema/openapi/verify.yaml, apps/api/openapi.yaml
OpenAPI 3.2.0 OpenAPI Spec Deferred. v0.13.0 stays on OpenAPI 3.1.x for tooling-compatibility reasons. A patch-level move within 3.1.x is allowed; a move to 3.2.0 requires a separate maintainer decision once tooling adoption is verified. docs/decisions/openapi-version.md (planned)

pnpm verify:openapi:drift (scripts/verify-openapi-drift.mjs) enforces that packages/schema/openapi/verify.yaml and apps/api/openapi.yaml agree on the shared /v1/verify contract and that downstream surfaces (integrator kits, deployment recipes) restate the contract consistently.

G. Experimental cryptography (not on the current wire)

Standard Status PEAC stance
RFC 9052 (COSE_Sign1) Standards Track Watchlist. No implementation commitment. A future codec is gated on benchmarks-on-real-workloads, tooling maturity, and migration safety.
RFC 9053 (COSE Algorithms) Standards Track Pairs with RFC 9052; watchlist
RFC 8949 (CBOR) Standards Track Pairs with RFC 9052; watchlist
RFC 8392 (CWT) Standards Track Pairs with RFC 9052; watchlist
FIPS 204 (ML-DSA, post-quantum) FIPS Watchlist. No v0.13.x implementation scope. Any design spike happens in research tracks; no delivery commitment.

The current wire format is JWS Compact Serialization with Ed25519. There is no algorithm negotiation surface and no plan to introduce COSE/CBOR as a default in the v0.13.x line.

H. SCITT transparency composition

Standard Status PEAC stance Composition note
RFC 9943 (SCITT Architecture) and RFC 9942 (COSE Receipts) Standards Track Informative external composition only; no PEAC wire change. Published June 2026. See PEAC and SCITT Composition.

J. Provisioning lifecycle composition (advisory references)

Standards referenced by the Provisioning Lifecycle Profile (docs/specs/PROVISIONING-LIFECYCLE-PROFILE.md, introduced in v0.14.2). PEAC composes with these standards by carrying digests / refs only; PEAC does not implement OAuth, DPoP, OAuth Protected Resource Metadata, or Shared Payment Tokens.

Standard Status Role in PEAC Citation site
RFC 9700 BCP 240, Best Current Practice (published January 2025) OAuth 2.0 Security Best Current Practice. PEAC may carry digests of OAuth-flow artifacts; PEAC does not implement OAuth 2.0. last_verified 2026-05-09. https://datatracker.ietf.org/doc/rfc9700/ docs/specs/PROVISIONING-LIFECYCLE-PROFILE.md
RFC 6749 Standards Track (Proposed Standard) OAuth 2.0 Authorization Framework. PEAC may carry references to OAuth flows; PEAC does not implement OAuth 2.0. last_verified 2026-05-09. https://datatracker.ietf.org/doc/rfc6749/ same
draft-ietf-oauth-v2-1-15 Watchlist — Active Internet-Draft (NOT RFC); last updated 2026-03-02; expires 2026-09-03 OAuth 2.1 is an Internet-Draft as of last_verified 2026-05-09. PEAC does not depend on OAuth 2.1. https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-1/ same
draft-ietf-oauth-security-topics-update Watchlist — Active Internet-Draft (monitor-only) Tracked for downstream-impact awareness. PEAC does not depend on this draft. last_verified 2026-05-09. same

I. Regulatory references

These rows describe how PEAC artifacts can be used as evidence for regulatory mappings. They are not certification claims and they are not enforced by PEAC.

Reference Status PEAC role Citation site
EU AI Act (Annex IV transparency) Regulatory Mapping doc; applicability horizon 2026-08-02 onward docs/compliance/EU-AI-ACT-ANNEX-IV-MAPPING.md
EU CRA Regulatory Cyber-resilience applicability where scoped reference
ISO/IEC 42001:2023 Clause 8 International Standard AI management system operational controls docs/compliance/ISO-42001-MAPPING.md
NIST AI RMF 1.0 Informational (non-regulatory) Voluntary framework; cited in compliance prose reference

Maintenance discipline

Adding a new standard reference to this ledger requires:

  1. A row with the correct status label.
  2. A citation site (code path or spec doc) that demonstrates where PEAC implements or relies on the standard. References without an implementation site MUST go in the Watchlist section.
  3. A test or fixture (where applicable) that proves the implementation behavior.

Updating a status (for example when an RFC-to-be publishes) requires:

  1. Updating the row in this document.
  2. Updating any in-code comments or spec-doc references that named the document by draft name.
  3. A note in CHANGELOG.md under "Changed".

Removing a row requires explicit maintainer approval; standards are kept listed even when their PEAC role is purely historical, with a status note explaining the historical role.