Conformance center

The vectors decide.

An open protocol is only real if independent implementations agree to the byte. GOVP-CORE-CONFORMANCE-1 is the executable definition of GOVP-1: golden vectors that pin the canonical bytes, the derived IDs and the pass/fail verdicts every implementation must reproduce.

GOVP-CORE-CONFORMANCE-1 · golden vectors

vectors.json · 8 vectors · pinned signing-input SHA-256 per record

Download vectors.json View raw

The suite

Eight vectors, every edge that matters

Positive vectors prove your canonical bytes are exact; negative vectors prove your verifier rejects what it must. A conforming implementation reproduces all expected values — not just the verdict.

Vector	What it pins	Expected
01-valid-document	A complete, signed GOVP-1 document record.	core_valid
02-valid-dataset-whitespace	Trailing spaces/tabs on lines — canonical ASCII trim before signing.	core_valid
03-legacy-aliases-crlf	Legacy keys (type/sha256/pubkey), CRLF line endings and comments — parser tolerance.	core_valid
04-wrong-govp-id	A declared GOVP-ID that does not match the content.	govpid_ok = false
05-bad-signature	An invalid Ed25519 signature.	signature_ok = false
06-missing-required	A missing required field (evidence).	format_ok = false
07-not-govp1	version ≠ GOVP-1 — not a GOVP-1 record at all.	core_valid = false
08-empty-value-dropped	An empty field (license) dropped from the signing input; signature still verifies.	core_valid

Each vector carries the full record text plus the expected govp_id and the pinned signing_input_sha256 — so a mismatch tells you where your bytes diverge, not just that they do.

Run the harness

One command, four languages

The reference harness runs the same vectors against the Python, JavaScript, Kotlin and PHP implementations and fails on the first byte of divergence.

# reproducible cross-language conformance (from the reference repo)
$ make test          # PHP lint + pytest conformance/ in an isolated venv

# or drive your own implementation against the vectors directly
$ govp-conformance run vectors.json --impl ./your-verifier
8/8 vectors · canonical bytes exact · verdicts exact — CONFORMANT

The WordPress reference plugin additionally ships these vectors as a built-in self-test, so an operator can prove — inside their own installation — that it verifies byte-for-byte like the references.

Conformant implementations

Held to the same bytes

Python 8/8

Reference signer & verifier; drives the conformance runner.

JavaScript 8/8

Browser + Node; powers the in-page verifier and playground.

Kotlin 8/8

JVM / Android issuing and verification.

PHP 8/8

libsodium engine behind the WordPress reference plugin.

Written a new implementation that passes? Tell us at contact@gemacode.org and it will be listed here after review.

Self-certification

How to claim "GOVP-conformant"

Implement from the normative spec
Everything you need is in the GOVP-1 specification — parsing, canonicalization, signing, ID derivation, verification.
Reproduce all 8 vectors exactly
Canonical bytes (pinned SHA-256), derived GOVP-IDs and every per-check verdict. All of them, not just core_valid.
Keep the vectors in your CI
Conformance is a property of every build, not of one afternoon.
Say it — accurately
You may state: "conforms to GOVP-1 (GOVP-CORE-CONFORMANCE-1: pass)". Claims about profiles you don't implement (e.g. RFC 3161 anchoring) are not covered by the core suite.

Get the vectors Sanity-check in the playground Conformance in governance