Conformance

GRP v0.1 conformance is tested with @grp-protocol/conformance. The package includes canonical vectors, a runner, JSON/Markdown reports, and signed report creation/verification.

Conformance is how an operator makes a narrow, checkable claim. A report does not say “this company is trustworthy.” It says a specific target URL passed a specific GRP profile against a specific vector set at a specific time.

Profiles

Profile	Use
`core`	Offline deterministic checks: mechanisms, mandate vectors, receipt vectors, canonicalization, discovery shape.
`transport`	Core plus REST and MCP lifecycle probes against a live target.
`operator`	Transport plus discovery honesty, negative contracts, A2A Agent Card checks when advertised, and operator-level metadata.

Use the smallest profile that matches the claim:

Use core for libraries and mechanism implementations.
Use transport for room servers that expose REST and MCP.
Use operator for hosted services that publish discovery, keys, reports, optional A2A, and operational metadata.

Run


npm run conformance --workspace=@grp-protocol/conformance -- --profile=core
npm run conformance --workspace=@grp-protocol/conformance -- --profile=transport --target=http://localhost:3001
npm run conformance --workspace=@grp-protocol/conformance -- --profile=operator --target=http://localhost:3001

Signed Reports


npm run conformance --workspace=@grp-protocol/conformance -- --profile=operator --target=https://operator.example --report=grp-conformance-report.json
 
GRP_CONFORMANCE_SIGNING_KEY_BASE64=... npm run conformance --workspace=@grp-protocol/conformance -- sign \
  --report=grp-conformance-report.json \
  --key-env=GRP_CONFORMANCE_SIGNING_KEY_BASE64 \
  --kid=operator-2026-05 \
  --out=grp-conformance-signed.json
 
npm run conformance --workspace=@grp-protocol/conformance -- verify \
  --signed-report=grp-conformance-signed.json \
  --jwks=operator-jwks.json

A publishable operator claim should include the signed report, the operator JWKS or known public key, and the target URL tested.

Reading a Report

Every report includes the protocol version, requested profile, target URL, pass/fail/skip counts, per-test diagnostics, and the SHA-256 digest of the static vector set. Signed reports wrap that report in a compact JWS so downstream readers can verify that the report body was not changed after signing.