{
  "name": "AFMR Reputation Attestation Verifier Requirements",
  "version": "0.1",
  "status": "working-draft",
  "canonical_url": "https://afmr.ai/standards/reputation-attestation/0.1/verifier.json",
  "profile": "https://afmr.ai/standards/reputation-attestation/0.1",
  "schema": "https://afmr.ai/standards/reputation-attestation/0.1/schema.json",
  "discovery": "https://afmr.ai/.well-known/afmr.json",
  "normative_terms": "MUST, MUST NOT, SHOULD, SHOULD NOT, and MAY are used as in RFC 2119.",
  "inputs": [
    "Candidate AFMR Reputation Attestation JSON",
    "Verification time",
    "Network access to declared authorities, keys, status, conformance, assessments, and evidence",
    "Optional relying-principal policy, evaluated only after AFMR verification"
  ],
  "outcomes": {
    "valid": "All mandatory structural, authority, proof, scope, evidence, timing, conformance, and lifecycle checks succeed.",
    "invalid": "A deterministic mandatory check fails.",
    "indeterminate": "A mandatory check cannot complete because required authoritative material is unavailable or unresolved."
  },
  "requirements": [
    {
      "id": "V-01",
      "name": "Resolve discovery",
      "requirement": "The verifier MUST fetch or use a fresh trusted copy of the AFMR discovery record and MUST resolve the exact profile and AFMR vocabulary versions named by the candidate.",
      "invalid_when": "The candidate names an unsupported, withdrawn, or conflicting authority.",
      "indeterminate_when": "The authoritative discovery record cannot be obtained and no fresh trusted copy is available."
    },
    {
      "id": "V-02",
      "name": "Validate structure",
      "requirement": "The verifier MUST validate the complete candidate against the exact versioned profile schema before interpreting standing.",
      "invalid_when": "Schema validation fails."
    },
    {
      "id": "V-03",
      "name": "Verify issuer proof",
      "requirement": "The verifier MUST resolve the declared verification method and verify the proof over the profile-defined canonical payload.",
      "invalid_when": "The signature or proof is malformed, does not verify, or is made by a key not authorized by the issuer.",
      "indeterminate_when": "The verification method or key status cannot be resolved."
    },
    {
      "id": "V-04",
      "name": "Verify subject and tags",
      "requirement": "The verifier MUST bind the result to the exact subject agent identifier and MUST interpret each expertise tag only under its declared vocabulary and measurement method.",
      "invalid_when": "The subject binding conflicts with referenced identity evidence or a tag has no resolvable declared vocabulary.",
      "indeterminate_when": "Required identity or tag authority material is unavailable."
    },
    {
      "id": "V-05",
      "name": "Verify governance endpoint",
      "requirement": "The verifier MUST resolve the endpoint-conformance record and confirm the endpoint identifier, canonical URL, process version, AFMR version, process scope, and applicable period.",
      "invalid_when": "The conformance record conflicts with any of those fields or has an adverse lifecycle status.",
      "indeterminate_when": "The authoritative conformance record or its lifecycle status cannot be resolved."
    },
    {
      "id": "V-06",
      "name": "Verify AFMR assessment",
      "requirement": "The verifier MUST resolve the referenced AFMR assessment, confirm the claimed conformance level, and confirm that its status is current for the attested process and period.",
      "invalid_when": "The assessment does not cover the endpoint or scope, does not support the claimed level, or is suspended, expired, revoked, or superseded.",
      "indeterminate_when": "The assessment or authoritative status is unavailable."
    },
    {
      "id": "V-07",
      "name": "Verify evidence",
      "requirement": "The verifier MUST resolve each required evidence object, compute its sha256 digest over the retrieved bytes, and compare it to the attestation.",
      "invalid_when": "A digest differs or required evidence contradicts a mandatory attestation field.",
      "indeterminate_when": "Required evidence cannot be retrieved."
    },
    {
      "id": "V-08",
      "name": "Verify time and lifecycle",
      "requirement": "The verifier MUST confirm issued_at, valid_from, valid_until, and the current status returned by lifecycle.status_uri at verification time.",
      "invalid_when": "The record is not yet valid, expired, suspended, revoked, superseded, or temporally inconsistent.",
      "indeterminate_when": "Current lifecycle status cannot be resolved."
    },
    {
      "id": "V-09",
      "name": "Return structured reasons",
      "requirement": "The verifier MUST return one top-level outcome and MUST enumerate each failed or unresolved requirement with its identifier and authoritative URI.",
      "invalid_when": "The verifier represents partial completion as valid."
    },
    {
      "id": "V-10",
      "name": "Preserve the policy boundary",
      "requirement": "The verifier MUST NOT convert a valid result into admission, generalized trust, ranking, or transaction authority. Any relying-principal policy MUST run as a separate step and return a separate result.",
      "invalid_when": "The verifier emits an unqualified safety, superiority, admission, or transaction claim."
    }
  ],
  "minimum_result_shape": {
    "outcome": "valid | invalid | indeterminate",
    "attestation_id": "URI",
    "verified_at": "date-time",
    "profile_version": "string",
    "afmr_version": "string",
    "checks": [
      {
        "requirement": "V-01",
        "result": "pass | fail | unresolved",
        "authority": "URI",
        "reason": "string"
      }
    ],
    "policy_result": null
  },
  "claim_boundary": "A valid result verifies a bounded record. It does not guarantee future behavior, freedom from unknown failure modes, legal compliance, universal safety, unqualified superiority, admission, or authority to transact.",
  "open_issues": [
    "Select a mandatory proof suite and canonicalization method.",
    "Set maximum cache ages for discovery, keys, conformance, and lifecycle status.",
    "Publish valid, invalid, and indeterminate test vectors.",
    "Define verifier interoperability reporting."
  ]
}