{
  "generated_by": "vectors/gen.mjs (every key derives from a label; what Ed25519 signs reproduces byte for byte; an ECDSA signature is one valid signature and is NEW EACH RUN, so root_b, leaf_b, leaf_b_twin and the P-256 envelope differ in their signature bytes from one generation to the next, and are to be verified, never compared)",
  "now": "2026-09-13T12:00:00Z",
  "certificates": {
    "root_a": {
      "der_hex": "308201313081e4a0030201020209009902956916dc1741300506032b657030143112301006035504030c09416c696e612052616f3020170d3236303930313030303030305a180f39393939313233313233353935395a30143112301006035504030c09416c696e612052616f302a300506032b657003210072797f971e6d7db62a222d6fc5dc4ecf0a37da238c3dba4edc378a1c43cacfb0a351304f30120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302020430290603551d0e0422042091fb3d906eb14ac59a36dbd666c5670169c68ad860fc780a37875b7d63860b50300506032b65700341007cf5cf2ee42ee1f9b9352037b4481e031273d3395cd67949cd5e6905aed782f3571f4cf04690de150d64bd02407da3c86681ad2a8a4f8041db977a28dabdb708",
      "note": "Ed25519 root, self-signed, CN \"Alina Rao\", notAfter 9999-12-31"
    },
    "root_b": {
      "der_hex": "308201783082011ea003020102020900e51123c1ee85d6e0300a06082a8648ce3d04030230173115301306035504030c0c426861726174204d656874613020170d3236303930313030303030305a180f39393939313233313233353935395a30173115301306035504030c0c426861726174204d656874613059301306072a8648ce3d020106082a8648ce3d030107034200042182cffdf3abefadb51050e603f6da251cb03575cd9b2f7baafae23519a92fa6efd75d4108e0295da93862096a0cc55709e8ca1e00fb5a398fe7f2f41f369699a351304f30120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302020430290603551d0e04220420c4d1dc13f1531d0508e128392934cc7e2f574827c9d960f1f5e5d441d2e5d0f3300a06082a8648ce3d0403020348003045022100ef6f40755526e552094f3b3f78541c533ecbae37929eb19deb925b9d976caf3b02204bf48e6b14112e1cd35a2f5f863431b722a0c7ae703970e1a3c4198a86b26adb",
      "note": "P-256 root, self-signed, CN \"Bharat Mehta\""
    },
    "root_c": {
      "der_hex": "308201353081e8a003020102020900abe1f0c28d4f0d8f300506032b657030173115301306035504030c0c4368616e6472612049796572301e170d3236303930313030303030305a170d3238303130313030303030305a30173115301306035504030c0c4368616e6472612049796572302a300506032b657003210093fa835c0d98975e4dfd1253682bfa8fcfa5c88b9c27622981b7715d01912075a351304f30120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302020430290603551d0e0422042010c7462ef86a91d6525d7e7c0df46a299f5b0b9df8b73f517ad2133f06a295c9300506032b6570034100dcaa7dadb3d4ff3e160482527d65a0a6653b6a527a3b697f2421ec862628d4c10de127e794c0966771bd5b885c839959e36bbeca6c54ddc1951fdc7e64c33a0d",
      "note": "Ed25519 root, self-signed, CN \"Chandra Iyer\", with the end date its person chose: notAfter 2028-01-01"
    },
    "leaf_a": {
      "der_hex": "308201b93082016ba003020102020900ea540e3161472cf5300506032b657030143112301006035504030c09416c696e612052616f301e170d3236303930313030303030305a170d3237303930313030303030305a30143112301006035504030c09416c696e612052616f302a300506032b65700321001ce0f36e1d5893400ff6e56a8cd265e3794642e86639e4ff88e73b0c56164454a381d93081d6300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d250416301406082b0601050507030106082b06010505070302303f0603551d1104383036861f68747470733a2f2f6167656e742e616c696e612e6578616d706c652f6d637082136167656e742e616c696e612e6578616d706c6530290603551d0e042204200975ead0c601974554d791f5af4c5e8075e2270da564996c609168cadd201663302b0603551d2304243022802091fb3d906eb14ac59a36dbd666c5670169c68ad860fc780a37875b7d63860b50300506032b65700341001ee7f12004e2eec7364cfb46c500d606f800c7890cbe1923c741e7218bea12327cd901a8cee470be46fb681802ddbc2ab7a973bbd25aee6a2d02e726e28d800e",
      "note": "Ed25519 leaf under root_a for https://agent.alina.example/mcp, 2026-09-01 to 2027-09-01, with a dNSName beside the URI"
    },
    "leaf_b": {
      "der_hex": "308201e830820190a003020102020862cf0a32fd882130300a06082a8648ce3d04030230173115301306035504030c0c426861726174204d65687461301e170d3236303930313030303030305a170d3237303930313030303030305a30173115301306035504030c0c426861726174204d656874613059301306072a8648ce3d020106082a8648ce3d0301070342000425ae89c5b1dd827dbf4898149b8aa8e757abf2dc340aadea8dd8962f23c4c9b03533b78eb5547b8b8d023e00a768bcc6243985160b980f6d7ad036e4e437b539a381c53081c2300c0603551d130101ff04023000300e0603551d0f0101ff040403020388301d0603551d250416301406082b0601050507030106082b06010505070302302b0603551d1104243022862068747470733a2f2f6167656e742e6268617261742e6578616d706c652f6d637030290603551d0e04220420cc2276300ca426c3925b404000e1510d28aca2309aa924a723f03bf9742d3971302b0603551d23042430228020c4d1dc13f1531d0508e128392934cc7e2f574827c9d960f1f5e5d441d2e5d0f3300a06082a8648ce3d0403020346003043021f471852b24c95bdfa9b038a85c89c74c04d3e5f74f7ebab2adeeae4f7330cae0220346bb62de6aeb188a5cb7e653b637e4638115cedc1b80f26825c7298d8ddb229",
      "note": "P-256 leaf under root_b for https://agent.bharat.example/mcp, 2026-09-01 to 2027-09-01, keyUsage digitalSignature+keyAgreement"
    },
    "leaf_a_expired": {
      "der_hex": "308201a330820155a00302010202080c2ba902f1b494b2300506032b657030143112301006035504030c09416c696e612052616f301e170d3235303630313030303030305a170d3236303630313030303030305a30143112301006035504030c09416c696e612052616f302a300506032b65700321001ce0f36e1d5893400ff6e56a8cd265e3794642e86639e4ff88e73b0c56164454a381c43081c1300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d250416301406082b0601050507030106082b06010505070302302a0603551d1104233021861f68747470733a2f2f6167656e742e616c696e612e6578616d706c652f6d637030290603551d0e042204200975ead0c601974554d791f5af4c5e8075e2270da564996c609168cadd201663302b0603551d2304243022802091fb3d906eb14ac59a36dbd666c5670169c68ad860fc780a37875b7d63860b50300506032b6570034100bd3e08c9907a2eaff999ae36ba73832e1f8203d12d2b6bffaf4673badc6c8f7c0ca40ea2103c1c18ea1d3a9ccda10078cba409ecd9f66b9240473945427f690a",
      "note": "leaf_a's key and endpoint, 2025-06-01 to 2026-06-01: expired at NOW"
    },
    "leaf_a_long": {
      "der_hex": "308201a430820156a003020102020900bca80aa75de7cf1e300506032b657030143112301006035504030c09416c696e612052616f301e170d3236303930313030303030305a170d3237313031303030303030305a30143112301006035504030c09416c696e612052616f302a300506032b65700321001ce0f36e1d5893400ff6e56a8cd265e3794642e86639e4ff88e73b0c56164454a381c43081c1300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d250416301406082b0601050507030106082b06010505070302302a0603551d1104233021861f68747470733a2f2f6167656e742e616c696e612e6578616d706c652f6d637030290603551d0e042204200975ead0c601974554d791f5af4c5e8075e2270da564996c609168cadd201663302b0603551d2304243022802091fb3d906eb14ac59a36dbd666c5670169c68ad860fc780a37875b7d63860b50300506032b6570034100b917a5bd634c0d8043cc0db0f7f4e0af19864b61f16c1a9cc4b3631b3231ae5ffa9d6d65c932db48758c7f8205991309e59f7328febcdb887b0dd4b7fa66460a",
      "note": "leaf_a's key and endpoint, 2026-09-01 to 2027-10-10: 404 days"
    },
    "leaf_a_next": {
      "der_hex": "308201a330820155a0030201020208184ebda4c22a39ae300506032b657030143112301006035504030c09416c696e612052616f301e170d3237303830323030303030305a170d3238303830313030303030305a30143112301006035504030c09416c696e612052616f302a300506032b6570032100dfa2709de5df9d8ba0777dca0c057929965e2e4c1dad64b2b5575da5317e6841a381c43081c1300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d250416301406082b0601050507030106082b06010505070302302a0603551d1104233021861f68747470733a2f2f6167656e742e616c696e612e6578616d706c652f6d637030290603551d0e0422042065408c3946e4d3f67b94d604ce6db33905fb8c1a338f19c07fd5291617e33afd302b0603551d2304243022802091fb3d906eb14ac59a36dbd666c5670169c68ad860fc780a37875b7d63860b50300506032b6570034100ae9628d44a62bc0206cbba247107af806cfab8a8dd8a30123cc4e607cc3185960e0debda938790397288b5e7c8301e318774b43910caa94f9f57ec35316dbf04",
      "note": "a fresh key for the same endpoint, 2027-08-02 to 2028-08-01: the renewal that supersedes leaf_a"
    },
    "leaf_c": {
      "der_hex": "308201ac3082015ea0030201020209009ea0bddafb957295300506032b657030173115301306035504030c0c4368616e6472612049796572301e170d3236303930313030303030305a170d3237303930313030303030305a30173115301306035504030c0c4368616e6472612049796572302a300506032b6570032100e78afc044e110567e3d9e1c165ef300cf4300e5c1a19ce72b15b9b7b8f5e3323a381c63081c3300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d250416301406082b0601050507030106082b06010505070302302c0603551d1104253023862168747470733a2f2f6167656e742e6368616e6472612e6578616d706c652f6d637030290603551d0e04220420caee43ea8b13027c58cb63d328fc5e209e5921f347ca7508c682cb01e4fffc89302b0603551d2304243022802010c7462ef86a91d6525d7e7c0df46a299f5b0b9df8b73f517ad2133f06a295c9300506032b65700341004a28ede30cc8d530f64a2482436438cc89b75c3a04f32aed906e7b6d65bb7072fe390126d83b86ed42228b1f27b6c55dbe40f7c8a596609b7cd38bd1ff7f5000",
      "note": "Ed25519 leaf under root_c for https://agent.chandra.example/mcp, 2026-09-01 to 2027-09-01, ending before its root"
    },
    "leaf_c_last": {
      "der_hex": "308201ab3082015da003020102020871c183e395a439d6300506032b657030173115301306035504030c0c4368616e6472612049796572301e170d3237303130313030303030305a170d3238303130313030303030305a30173115301306035504030c0c4368616e6472612049796572302a300506032b6570032100e78afc044e110567e3d9e1c165ef300cf4300e5c1a19ce72b15b9b7b8f5e3323a381c63081c3300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d250416301406082b0601050507030106082b06010505070302302c0603551d1104253023862168747470733a2f2f6167656e742e6368616e6472612e6578616d706c652f6d637030290603551d0e04220420caee43ea8b13027c58cb63d328fc5e209e5921f347ca7508c682cb01e4fffc89302b0603551d2304243022802010c7462ef86a91d6525d7e7c0df46a299f5b0b9df8b73f517ad2133f06a295c9300506032b6570034100e1cad48a457f1b9d3c9039bea01074392c0e0919f7dc62199f90dc3ffc5d9b27e467add011e9d09398d0c1a8ac23cbef4a58dd2ed1be41cb8f638a3d9664c902",
      "note": "leaf_c's key and endpoint, 2027-01-01 to 2028-01-01: ends the second its root does"
    },
    "leaf_c_outlives": {
      "der_hex": "308201ab3082015da003020102020876d225b87262cb2f300506032b657030173115301306035504030c0c4368616e6472612049796572301e170d3237303630313030303030305a170d3238303630313030303030305a30173115301306035504030c0c4368616e6472612049796572302a300506032b6570032100e78afc044e110567e3d9e1c165ef300cf4300e5c1a19ce72b15b9b7b8f5e3323a381c63081c3300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d250416301406082b0601050507030106082b06010505070302302c0603551d1104253023862168747470733a2f2f6167656e742e6368616e6472612e6578616d706c652f6d637030290603551d0e04220420caee43ea8b13027c58cb63d328fc5e209e5921f347ca7508c682cb01e4fffc89302b0603551d2304243022802010c7462ef86a91d6525d7e7c0df46a299f5b0b9df8b73f517ad2133f06a295c9300506032b65700341005ddb39a45715511670e4877518be660615f0f18aefc26d42383b67a6b97c5d6d53ada91f662e00654e2fc447f3a1e1f7390845cf719037e76c7f66886aaf8d0f",
      "note": "leaf_c's key and endpoint, 2027-06-01 to 2028-06-01: ends after its root, which rule 4 refuses"
    },
    "leaf_b_twin": {
      "der_hex": "308201ea30820190a003020102020862cf0a32fd882130300a06082a8648ce3d04030230173115301306035504030c0c426861726174204d65687461301e170d3236303930313030303030305a170d3237303930313030303030305a30173115301306035504030c0c426861726174204d656874613059301306072a8648ce3d020106082a8648ce3d0301070342000425ae89c5b1dd827dbf4898149b8aa8e757abf2dc340aadea8dd8962f23c4c9b03533b78eb5547b8b8d023e00a768bcc6243985160b980f6d7ad036e4e437b539a381c53081c2300c0603551d130101ff04023000300e0603551d0f0101ff040403020388301d0603551d250416301406082b0601050507030106082b06010505070302302b0603551d1104243022862068747470733a2f2f6167656e742e6268617261742e6578616d706c652f6d637030290603551d0e04220420cc2276300ca426c3925b404000e1510d28aca2309aa924a723f03bf9742d3971302b0603551d23042430228020c4d1dc13f1531d0508e128392934cc7e2f574827c9d960f1f5e5d441d2e5d0f3300a06082a8648ce3d0403020348003045022023e6161f7d09b9f949d1f27669bfed4ef4f26dce2e16184b1a1c54044a1f99cd022100936983af98bb6a88265761d7736bb061586db282a5e59ca4a32cbb1a3d7a8863",
      "note": "leaf_b's TBS under the OTHER twin of an ECDSA signature, (r, n − s): it verifies under root_b and is refused by the profile (§14.1: low-S)",
      "refused": true
    },
    "leaf_a_feb30": {
      "der_hex": "308201a430820156a003020102020900de7fe857145b30bb300506032b657030143112301006035504030c09416c696e612052616f301e170d3236303233303132303030305a170d3237303330313030303030305a30143112301006035504030c09416c696e612052616f302a300506032b65700321001ce0f36e1d5893400ff6e56a8cd265e3794642e86639e4ff88e73b0c56164454a381c43081c1300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d250416301406082b0601050507030106082b06010505070302302a0603551d1104233021861f68747470733a2f2f6167656e742e616c696e612e6578616d706c652f6d637030290603551d0e042204200975ead0c601974554d791f5af4c5e8075e2270da564996c609168cadd201663302b0603551d2304243022802091fb3d906eb14ac59a36dbd666c5670169c68ad860fc780a37875b7d63860b50300506032b6570034100dcf5f0121338a9e7381e7e982395d4f000f22e1079b5c10028e835f41a69ba4702b57e40888e8217bbcb017ee8d56c64e74e7492ce6b69ae1999610ef78d0e06",
      "note": "leaf_a's key and endpoint with a notBefore of 260230120000Z, 30 February: refused, not read as 2 March (§14.1)",
      "refused": true
    },
    "leaf_a_aki3": {
      "der_hex": "3082018730820139a003020102020900b134d8a0c4474f83300506032b657030143112301006035504030c09416c696e612052616f301e170d3236303930313030303030305a170d3237303930313030303030305a30143112301006035504030c09416c696e612052616f302a300506032b65700321001ce0f36e1d5893400ff6e56a8cd265e3794642e86639e4ff88e73b0c56164454a381a73081a4300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d250416301406082b0601050507030106082b06010505070302302a0603551d1104233021861f68747470733a2f2f6167656e742e616c696e612e6578616d706c652f6d637030290603551d0e042204200975ead0c601974554d791f5af4c5e8075e2270da564996c609168cadd201663300e0603551d23040730058003010203300506032b657003410063f5e965d31f3a86d1a39ae11742e98a4cf5ba4e7ab8969b03f9d5381508db5c018cd32645807ec350aa8714df589f482b8254d9b12046cb36de8fd5fed9b40c",
      "note": "leaf_a's key and endpoint with an authorityKeyIdentifier of three bytes, 01 02 03: refused, because a key identifier is 32 bytes (§14.1), at card intake as much as in a chain",
      "refused": true
    },
    "root_c_backwards": {
      "der_hex": "308201353081e8a003020102020900cc7ee76dfd7cd361300506032b657030173115301306035504030c0c4368616e6472612049796572301e170d3236303930313030303030305a170d3236303833313233353935395a30173115301306035504030c0c4368616e6472612049796572302a300506032b657003210093fa835c0d98975e4dfd1253682bfa8fcfa5c88b9c27622981b7715d01912075a351304f30120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302020430290603551d0e0422042010c7462ef86a91d6525d7e7c0df46a299f5b0b9df8b73f517ad2133f06a295c9300506032b65700341000301b3157eaab5697452ac1d6ac0630dba6d251b3780c3764a0628bc8cda75bd9ad22fa3aed58a04e4ca77a079018bed2d19b0dc268c367d7b78e54266b40b02",
      "note": "root_c's key and name with notAfter 2026-08-31T23:59:59Z, before its notBefore: refused by the profile (§14.1)",
      "refused": true
    }
  },
  "leaf_keys_pkcs8_hex": {
    "leaf_a": "302e020100300506032b657004220420e3243080ed02732529eefba42d0f7e576c79b06dba351525611abce2771d9cf1",
    "leaf_a_next": "302e020100300506032b657004220420b8cdbdc2e637be798937f714c93aa5ecb6263a7e943e0dd7ba60ef0e7b73e162",
    "leaf_b": "3041020100301306072a8648ce3d020106082a8648ce3d03010704273025020101042058f95740ead99d8bdb345794fd57d4c3274dd8ac64ac1225184f03283aad3d28",
    "leaf_c": "302e020100300506032b65700422042006b29015329cc41a26202229779d3d547eece30293cd7dfebb8a053ea42053e8"
  },
  "chain_cases": [
    {
      "name": "alina valid",
      "chain": [
        "leaf_a",
        "root_a"
      ],
      "expected_root": "sha256:kfs9kG6xSsWaNtvWZsVnAWnGithg_HgKN4dbfWOGC1A",
      "expected_endpoint": "https://agent.alina.example/mcp",
      "now": "2026-09-13T12:00:00Z",
      "expect": "accept"
    },
    {
      "name": "bharat valid",
      "chain": [
        "leaf_b",
        "root_b"
      ],
      "expected_root": "sha256:xNHcE_FTHQUI4Sg5KTTMfi9XSCfJ2WDx9eXUQdLl0PM",
      "expected_endpoint": "https://agent.bharat.example/mcp",
      "now": "2026-09-13T12:00:00Z",
      "expect": "accept"
    },
    {
      "name": "first contact, no expectation",
      "chain": [
        "leaf_a",
        "root_a"
      ],
      "now": "2026-09-13T12:00:00Z",
      "expect": "accept"
    },
    {
      "name": "chain of three",
      "chain": [
        "leaf_a",
        "root_a",
        "root_a"
      ],
      "now": "2026-09-13T12:00:00Z",
      "expect": "refuse",
      "rule": 1
    },
    {
      "name": "single certificate is not a chain",
      "chain": [
        "root_a"
      ],
      "now": "2026-09-13T12:00:00Z",
      "expect": "refuse",
      "rule": 1
    },
    {
      "name": "leaf presented as root",
      "chain": [
        "leaf_a",
        "leaf_a"
      ],
      "now": "2026-09-13T12:00:00Z",
      "expect": "refuse",
      "rule": 1
    },
    {
      "name": "root is not the one pinned",
      "chain": [
        "leaf_a",
        "root_a"
      ],
      "expected_root": "sha256:xNHcE_FTHQUI4Sg5KTTMfi9XSCfJ2WDx9eXUQdLl0PM",
      "now": "2026-09-13T12:00:00Z",
      "expect": "refuse",
      "rule": 2
    },
    {
      "name": "leaf under the wrong root",
      "chain": [
        "leaf_a",
        "root_b"
      ],
      "now": "2026-09-13T12:00:00Z",
      "expect": "refuse",
      "rule": 3
    },
    {
      "name": "expired leaf",
      "chain": [
        "leaf_a_expired",
        "root_a"
      ],
      "now": "2026-09-13T12:00:00Z",
      "expect": "refuse",
      "rule": 4
    },
    {
      "name": "leaf not yet valid",
      "chain": [
        "leaf_a_next",
        "root_a"
      ],
      "now": "2026-09-13T12:00:00Z",
      "expect": "refuse",
      "rule": 4
    },
    {
      "name": "leaf longer than 398 days",
      "chain": [
        "leaf_a_long",
        "root_a"
      ],
      "now": "2026-09-13T12:00:00Z",
      "expect": "refuse",
      "rule": 4
    },
    {
      "name": "endpoint mismatch",
      "chain": [
        "leaf_a",
        "root_a"
      ],
      "expected_endpoint": "https://agent.alina.example/mcp/",
      "now": "2026-09-13T12:00:00Z",
      "expect": "refuse",
      "rule": 5
    },
    {
      "name": "an ECDSA signature swapped for its twin",
      "chain": [
        "leaf_b_twin",
        "root_b"
      ],
      "now": "2026-09-13T12:00:00Z",
      "expect": "refuse",
      "rule": 1
    },
    {
      "name": "a validity field that is not a date",
      "chain": [
        "leaf_a_feb30",
        "root_a"
      ],
      "now": "2026-09-13T12:00:00Z",
      "expect": "refuse",
      "rule": 1
    },
    {
      "name": "an issuer key identifier that is not 32 bytes",
      "chain": [
        "leaf_a_aki3",
        "root_a"
      ],
      "now": "2026-09-13T12:00:00Z",
      "expect": "refuse",
      "rule": 1
    },
    {
      "name": "a root with an end date not yet reached",
      "chain": [
        "leaf_c",
        "root_c"
      ],
      "expected_root": "sha256:EMdGLvhqkdZSXX58DfRqKZ9bC534tz9RetITPwailck",
      "expected_endpoint": "https://agent.chandra.example/mcp",
      "now": "2026-09-13T12:00:00Z",
      "expect": "accept"
    },
    {
      "name": "a root at the last second of its end date",
      "chain": [
        "leaf_c_last",
        "root_c"
      ],
      "now": "2028-01-01T00:00:00Z",
      "expect": "accept"
    },
    {
      "name": "a root past its end date",
      "chain": [
        "leaf_c_last",
        "root_c"
      ],
      "now": "2028-01-01T00:00:01Z",
      "expect": "refuse",
      "rule": 4,
      "reason": "root has expired"
    },
    {
      "name": "a leaf that outlives its root",
      "chain": [
        "leaf_c_outlives",
        "root_c"
      ],
      "now": "2027-09-01T00:00:00Z",
      "expect": "refuse",
      "rule": 4,
      "reason": "leaf outlives the root"
    },
    {
      "name": "a root whose end date is before its start",
      "chain": [
        "leaf_c",
        "root_c_backwards"
      ],
      "now": "2026-09-13T12:00:00Z",
      "expect": "refuse",
      "rule": 1,
      "reason": "root notAfter is before its notBefore"
    }
  ],
  "newest_leaf_cases": [
    {
      "pinned": "leaf_a",
      "presented": "leaf_a",
      "expect": "same"
    },
    {
      "pinned": "leaf_a",
      "presented": "leaf_a_next",
      "expect": "newer"
    },
    {
      "pinned": "leaf_a_next",
      "presented": "leaf_a",
      "expect": "superseded"
    },
    {
      "pinned": "leaf_a",
      "presented": "leaf_a_long",
      "expect": "conflict"
    }
  ],
  "certificate_renewed_cases": [
    {
      "name": "renewal followed",
      "pinned_leaf": "leaf_a",
      "dialed": "https://agent.alina.example/mcp",
      "now": "2027-08-15T12:00:00Z",
      "answer": {
        "code": "certificate_renewed",
        "data": {
          "chain": [
            "MIIBozCCAVWgAwIBAgIIGE69pMIqOa4wBQYDK2VwMBQxEjAQBgNVBAMMCUFsaW5hIFJhbzAeFw0yNzA4MDIwMDAwMDBaFw0yODA4MDEwMDAwMDBaMBQxEjAQBgNVBAMMCUFsaW5hIFJhbzAqMAUGAytlcAMhAN-icJ3l352LoHd9ygwFeSmWXi5MHa1ksrVXXaUxfmhBo4HEMIHBMAwGA1UdEwEB_wQCMAAwDgYDVR0PAQH_BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAqBgNVHREEIzAhhh9odHRwczovL2FnZW50LmFsaW5hLmV4YW1wbGUvbWNwMCkGA1UdDgQiBCBlQIw5RuTT9nuU1gTObbM5BfuMGjOPGcB_1SkWF-M6_TArBgNVHSMEJDAigCCR-z2QbrFKxZo229ZmxWcBacaK2GD8eAo3h1t9Y4YLUDAFBgMrZXADQQCulijUSmK8AgbLuiRxB6-AbPq4qN2KMBI8xOYHzDGFlg4N69qTh5A5coi158gwHjGHdLQ5EMqpT59X7DUxbb8E",
            "MIIBMTCB5KADAgECAgkAmQKVaRbcF0EwBQYDK2VwMBQxEjAQBgNVBAMMCUFsaW5hIFJhbzAgFw0yNjA5MDEwMDAwMDBaGA85OTk5MTIzMTIzNTk1OVowFDESMBAGA1UEAwwJQWxpbmEgUmFvMCowBQYDK2VwAyEAcnl_lx5tfbYqIi1vxdxOzwo32iOMPbpO3DeKHEPKz7CjUTBPMBIGA1UdEwEB_wQIMAYBAf8CAQAwDgYDVR0PAQH_BAQDAgIEMCkGA1UdDgQiBCCR-z2QbrFKxZo229ZmxWcBacaK2GD8eAo3h1t9Y4YLUDAFBgMrZXADQQB89c8u5C7h-bk1IDe0SB4DEnPTOVzWeUnNXmkFrteC81cfTPBGkN4VDWS9AkB9o8hmga0qik-AQduXeijavbcI"
          ]
        }
      },
      "expect": "follow"
    },
    {
      "name": "older chain discarded",
      "pinned_leaf": "leaf_a_next",
      "dialed": "https://agent.alina.example/mcp",
      "now": "2027-08-15T12:00:00Z",
      "answer": {
        "code": "certificate_renewed",
        "data": {
          "chain": [
            "MIIBuTCCAWugAwIBAgIJAOpUDjFhRyz1MAUGAytlcDAUMRIwEAYDVQQDDAlBbGluYSBSYW8wHhcNMjYwOTAxMDAwMDAwWhcNMjcwOTAxMDAwMDAwWjAUMRIwEAYDVQQDDAlBbGluYSBSYW8wKjAFBgMrZXADIQAc4PNuHViTQA_25WqM0mXjeUZC6GY55P-I5zsMVhZEVKOB2TCB1jAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB_wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwPwYDVR0RBDgwNoYfaHR0cHM6Ly9hZ2VudC5hbGluYS5leGFtcGxlL21jcIITYWdlbnQuYWxpbmEuZXhhbXBsZTApBgNVHQ4EIgQgCXXq0MYBl0VU15H1r0xegHXiJw2lZJlsYJFoyt0gFmMwKwYDVR0jBCQwIoAgkfs9kG6xSsWaNtvWZsVnAWnGithg_HgKN4dbfWOGC1AwBQYDK2VwA0EAHufxIATi7sc2TPtGxQDWBvgAx4kMvhkjx0HnIYvqEjJ82QGozuRwvkb7aBgC3bwqt6lzu9Ja7motAucm4o2ADg",
            "MIIBMTCB5KADAgECAgkAmQKVaRbcF0EwBQYDK2VwMBQxEjAQBgNVBAMMCUFsaW5hIFJhbzAgFw0yNjA5MDEwMDAwMDBaGA85OTk5MTIzMTIzNTk1OVowFDESMBAGA1UEAwwJQWxpbmEgUmFvMCowBQYDK2VwAyEAcnl_lx5tfbYqIi1vxdxOzwo32iOMPbpO3DeKHEPKz7CjUTBPMBIGA1UdEwEB_wQIMAYBAf8CAQAwDgYDVR0PAQH_BAQDAgIEMCkGA1UdDgQiBCCR-z2QbrFKxZo229ZmxWcBacaK2GD8eAo3h1t9Y4YLUDAFBgMrZXADQQB89c8u5C7h-bk1IDe0SB4DEnPTOVzWeUnNXmkFrteC81cfTPBGkN4VDWS9AkB9o8hmga0qik-AQduXeijavbcI"
          ]
        }
      },
      "expect": "discard"
    },
    {
      "name": "another root discarded",
      "pinned_leaf": "leaf_a",
      "dialed": "https://agent.alina.example/mcp",
      "now": "2026-09-13T12:00:00Z",
      "answer": {
        "code": "certificate_renewed",
        "data": {
          "chain": [
            "MIIB6DCCAZCgAwIBAgIIYs8KMv2IITAwCgYIKoZIzj0EAwIwFzEVMBMGA1UEAwwMQmhhcmF0IE1laHRhMB4XDTI2MDkwMTAwMDAwMFoXDTI3MDkwMTAwMDAwMFowFzEVMBMGA1UEAwwMQmhhcmF0IE1laHRhMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJa6JxbHdgn2_SJgUm4qo51er8tw0Cq3qjdiWLyPEybA1M7eOtVR7i40CPgCnaLzGJDmFFguYD2160Dbk5De1OaOBxTCBwjAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB_wQEAwIDiDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwKwYDVR0RBCQwIoYgaHR0cHM6Ly9hZ2VudC5iaGFyYXQuZXhhbXBsZS9tY3AwKQYDVR0OBCIEIMwidjAMpCbDkltAQADhUQ0orKIwmqkkpyPwO_l0LTlxMCsGA1UdIwQkMCKAIMTR3BPxUx0FCOEoOSk0zH4vV0gnydlg8fXl1EHS5dDzMAoGCCqGSM49BAMCA0YAMEMCH0cYUrJMlb36mwOKhcicdMBNPl909-urKt7q5PczDK4CIDRrti3mrrGIpct-ZTtjfkY4EVztwbgPJoJccpjY3bIp",
            "MIIBeDCCAR6gAwIBAgIJAOURI8HuhdbgMAoGCCqGSM49BAMCMBcxFTATBgNVBAMMDEJoYXJhdCBNZWh0YTAgFw0yNjA5MDEwMDAwMDBaGA85OTk5MTIzMTIzNTk1OVowFzEVMBMGA1UEAwwMQmhhcmF0IE1laHRhMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIYLP_fOr7621EFDmA_baJRywNXXNmy97qvriNRmpL6bv111BCOApXak4YglqDMVXCejKHgD7WjmP5_L0HzaWmaNRME8wEgYDVR0TAQH_BAgwBgEB_wIBADAOBgNVHQ8BAf8EBAMCAgQwKQYDVR0OBCIEIMTR3BPxUx0FCOEoOSk0zH4vV0gnydlg8fXl1EHS5dDzMAoGCCqGSM49BAMCA0gAMEUCIQDvb0B1VSblUglPOz94VBxTPsuuN5KesZ3rkludl2yvOwIgS_SOaxQRLhzTWi9fhjQxtyKgx65wOXDho8QZioayats"
          ]
        }
      },
      "expect": "discard"
    }
  ],
  "envelopes": [
    {
      "name": "alina-to-bharat",
      "form": "chain",
      "suite": "HDTP-SEAL-P256",
      "sender_chain": [
        "leaf_a",
        "root_a"
      ],
      "recipient_chain": [
        "leaf_b",
        "root_b"
      ],
      "plaintext_hex": "7b226d6574686f64223a22746f6f6c732f63616c6c222c22706172616d73223a7b226e616d65223a2273656e645f6d657373616765222c22617267756d656e7473223a7b226d73675f6964223a227665632d31222c2274657874223a2268656c6c6f2066726f6d207468652048445450207465737420766563746f7273227d7d2c22636861696e223a5b224d4949427554434341577567417749424167494a414f7055446a466852797a314d4155474179746c634441554d524977454159445651514444416c4262476c7559534253595738774868634e4d6a59774f5441784d4441774d4441775768634e4d6a63774f5441784d4441774d444177576a41554d524977454159445651514444416c4262476c7559534253595738774b6a414642674d725a5841444951416334504e754856695451415f323557714d306d586a65555a433647593535502d49357a734d56685a45564b4f4232544342316a414d42674e5648524d4241663845416a41414d41344741315564447745425f775145417749486744416442674e5648535545466a4155426767724267454642516344415159494b77594242515548417749775077594456523052424467774e6f59666148523063484d364c7939685a3256756443356862476c755953356c654746746347786c4c32316a634949545957646c626e517559577870626d45755a586868625842735a54417042674e56485134454967516743585871304d59426c3056553135483172307865674858694a77326c5a4a6c73594a466f79743067466d4d774b7759445652306a42435177496f41676b6673396b473678537357614e7476575a73566e41576e47697468675f48674b4e34646266574f4743314177425159444b3256774130454148756678494154693773633254507447785144574276674178346b4d76686b6a7830486e49597671456a4a383251476f7a755277766b6237614267433362777174366c7a75394a61376d6f744175636d346f32414467222c224d4949424d544342354b41444167454341676b416d514b566152626346304577425159444b3256774d425178456a415142674e5642414d4d435546736157356849464a68627a4167467730794e6a41354d4445774d4441774d444261474138354f546b354d54497a4d54497a4e546b314f566f77464445534d424147413155454177774a51577870626d4567556d46764d436f77425159444b32567741794541636e6c5f6c78357466625971496931767864784f7a776f3332694f4d5062704f3344654b4845504b7a37436a555442504d42494741315564457745425f7751494d415942416638434151417744675944565230504151485f42415144416749454d436b474131556444675169424343522d7a32516272464b785a6f3232395a6d785763426163614b3247443865416f33683174395934594c5544414642674d725a5841445151423839633875354337682d626b314944653053423444456e50544f567a5765556e4e586d6b467274654338316366545042476b4e345644575339416b42396f38686d67613071696b2d415164755865696a6176626349225d7d",
      "protected": "eyJjdHkiOiJhcHBsaWNhdGlvbi9oZHRwLWNhbGwranNvbiIsImV4cCI6MTc4OTMwMTQwMCwia2lkIjoic2hhMjU2OnpDSjJNQXlrSnNPU1cwQkFBT0ZSRFNpc29qQ2FxU1NuSV9BNy1YUXRPWEUiLCJtc2dfaWQiOiJ2ZWMtdjEtYWxpbmEtdG8tYmhhcmF0Iiwic3VpdGUiOiJIRFRQLVNFQUwtUDI1NiIsInRzIjoxNzg5MzAwODAwLCJ2IjoxfQ",
      "enc": "BDtCX1LmUSqSnb_0czHEYeELskyQ6mf5B1n8Uw5LU5J9W5u8OoBwdS7uyb_lPIu6ZFbVLWMVQc4uoCyxi2iB55Y",
      "ct": "kCRX1NHxkygGve7HK-_BYDxWTdGAvUY4ZSMVj50aMUzZv9pY4Y2IB740f9PLrgS7M1p4dkGPJKDcF2hypMWB6M-V2c7GsynyYLTWbPBAikixfbSB5POnSQ9-L_bP5Mmb8DAH61OCR4V7fmLuxMF9b3Bb780o4M6Raa_eYlM_Qv5WYbCdUZ1KMFPU7tcuX8SEfOknPQn61C09o3SY9-vC76ArJQ02X1zjeUjDacCrGlxnH9y8B0qmXuuQnjhDFhOMNfdqBOQDG_YlVIk5E5yzw6Y9ezxk0JKhSkYO1Qpjq5ymKFd6Dc5CD9ZS6aL8d_w3lxNITJp0IDLXwl2hNte4ZHTce4GxyS_0WnZvecjo6hrXBzTYuz2-1hXqzvZhrCHA7_csq_Dh-mx3iqkUX0edNLJqNDv4Roudun-MQ61zYDDIWhvy1dqKdaP9FPyAq5Ugrta8_frfXplkVfsSBErBy-Nw8EBnLUv1ZYAORBEuRpToo2A3gGXpE7uh22Z6VIQiqMwPa800BGMyqx2JSbdfC_oBQpJLxAYBbCWpgW0ATw9YDzDDe24zj_8kewt8X1SmjY0MNmLNb5JI0U4scAjPUa0LmRGusJDIEAx8wDAnagev2kSPJYxs8pT0yug_UXoFJmBVqHZcz10si5d_upaeOU-ae5vBN1s6QdkcoixYAJa8gYDlonbbWqJj4_h06-3KsEKHUiN2cb7omuoSBLiIIkLToI__kgyIxJL79oUS8plYKjQLgiKtMGFpyt9s1-FFDb8tWR-Sa-suEbH8C-YEaqsy4P8OLXv_OauWptEFjenVJ6oTyxBe4GylmkdkVfY7BoS4rU2-jVr_DjjU_oIw5sEIWt8o3GykhStBcYfTwJMDWgA-3mYjnEsaeswnw3b9m4qz0dgOhoLAba65MyYGdy_NQWH7lgmYVO1jM_DVzlV0pQCw8aUa2Q497d3_EC6U9a85jkWCEKaVo-_O44L-Eh2OLEDpCS8vfBpHd80Gp_7j210QMg27ANjPmybjSbafm-ruE8QQzycKnYevfnVdQrmmJSvDbhUNwTf_GK2b0u33VKKCz8TvrSG1Z1e0UfBib09uPyBAVU2pLkxW56gDkUQFUmGsMEobJ4of0IbzDdloUh2rMSV3WwV-pWj-bHAA3jXlEs4swVBbgGz6j_5eV1n9nJhaiTzdYmd0xw-cvB0X2HBSSYn9z6tUa7sd1Sxl0rOCBPNcIcgnxNFbVnjr7DVG6KuKl_kZl9nh0xXCCcPS5YwAaL9OXCAYGbtHAIhDhi8-DZzY4pYdbNL0bGmg3CQqtcFISGauQ54CxsTRtfsTtvTcYjLWf_nYNnr4ipOxnkV-FD2UY5sJ0cbVTtIlmyX0FvZLOnjCk-9W01n7IcXb9wBFkbeTlWN5tliN7c2CPh5GXjIQCWPI51poAWMPeJ05PpteeortPX-6DutmT1wp-gS2qGk6swkCLdL4NQl0nnyiMM3MRbJt6j6yBjqrG9QyGX1tdvc0ajcW_maDsxP56J_vdPqIjr06aJQ43DN-IMYhW4C_Tq_t58cqYUM7",
      "sig": "FALrKT-0zNjr4vwAsiq-jSh4gzkrghC8b6q495eT6dUoMB_lA2hR499R8f4ApgavJwTog7BnNJ2O_BMpkFLZAw"
    },
    {
      "name": "bharat-to-alina",
      "form": "chain",
      "suite": "HDTP-SEAL-X25519",
      "sender_chain": [
        "leaf_b",
        "root_b"
      ],
      "recipient_chain": [
        "leaf_a",
        "root_a"
      ],
      "plaintext_hex": "7b226d6574686f64223a22746f6f6c732f63616c6c222c22706172616d73223a7b226e616d65223a2273656e645f6d657373616765222c22617267756d656e7473223a7b226d73675f6964223a227665632d31222c2274657874223a2268656c6c6f2066726f6d207468652048445450207465737420766563746f7273227d7d2c22636861696e223a5b224d49494236444343415a436741774942416749495973384b4d76324949544177436759494b6f5a497a6a304541774977467a45564d424d47413155454177774d516d6868636d46304945316c614852684d423458445449324d446b774d5441774d4441774d466f58445449334d446b774d5441774d4441774d466f77467a45564d424d47413155454177774d516d6868636d46304945316c614852684d466b77457759484b6f5a497a6a3043415159494b6f5a497a6a304441516344516741454a61364a78624864676e325f534a67556d34716f3531657238747730437133716a6469574c795045796241314d37654f74565237693430435067436e614c7a474a446d4646677559443231363044626b354465314f614f4278544342776a414d42674e5648524d4241663845416a41414d41344741315564447745425f775145417749446944416442674e5648535545466a4155426767724267454642516344415159494b77594242515548417749774b7759445652305242435177496f59676148523063484d364c7939685a3256756443356961474679595851755a586868625842735a533974593341774b5159445652304f42434945494d7769646a414d704362446b6c7441514144685551306f724b49776d716b6b707950774f5f6c304c546c784d437347413155644977516b4d434b41494d54523342507855783046434f456f4f536b307a4834765630676e79646c673866586c314548533564447a4d416f4743437147534d343942414d43413059414d454d434830635955724a4d6c6233366d774f4b68636963644d424e506c3930392d75724b7437713550637a444b3443494452727469336d727247497063742d5a54746a666b593445567a74776267504a6f4a6363706a5933624970222c224d4949426544434341523667417749424167494a414f555249384875686462674d416f4743437147534d343942414d434d4263784654415442674e5642414d4d44454a6f59584a686443424e5a57683059544167467730794e6a41354d4445774d4441774d444261474138354f546b354d54497a4d54497a4e546b314f566f77467a45564d424d47413155454177774d516d6868636d46304945316c614852684d466b77457759484b6f5a497a6a3043415159494b6f5a497a6a3044415163445167414549594c505f664f72373632314546446d415f62614a5279774e58584e6d793937717672694e526d704c36627631313142434f417058616b3459676c71444d565843656a4b48674437576a6d50355f4c30487a61576d614e524d45387745675944565230544151485f42416777426745425f7749424144414f42674e56485138424166384542414d43416751774b5159445652304f42434945494d54523342507855783046434f456f4f536b307a4834765630676e79646c673866586c314548533564447a4d416f4743437147534d343942414d43413067414d45554349514476623042315653626c55676c504f7a393456427854507375754e354b65735a33726b6c75646c3279764f774967535f534f617851524c687a5457693966686a517874794b67783635774f5844686f38515a696f6179617473225d7d",
      "protected": "eyJjdHkiOiJhcHBsaWNhdGlvbi9oZHRwLWNhbGwranNvbiIsImV4cCI6MTc4OTMwMTQwMCwia2lkIjoic2hhMjU2OkNYWHEwTVlCbDBWVTE1SDFyMHhlZ0hYaUp3MmxaSmxzWUpGb3l0MGdGbU0iLCJtc2dfaWQiOiJ2ZWMtdjEtYmhhcmF0LXRvLWFsaW5hIiwic3VpdGUiOiJIRFRQLVNFQUwtWDI1NTE5IiwidHMiOjE3ODkzMDA4MDAsInYiOjF9",
      "enc": "MVw3MjzMuEfaKu4ljNQhqMibwGg-JhN9EZRI132Dyng",
      "ct": "dWsgrpMX2RWbzriWASLry8fm9E9hcG9xPAI9khDCknz9WcjcA3OPI6Py4YEuocuWSHIbDySz_uJh_exQde8FyS1oazSguRoeH3AAzfcWSTIl5AZU0y1CoSG3yObLeCFqQpfd5nY1SEeLgr3K3EOkIEEygUL0hYsYO8dhV8JWeNP05f2-rY5t21E_w4cp0zXNH-a-sW7WVI4vTPVxWTcYuBZX7eZ1jhtz6qwZzXOdRFhirglOe_A9glv3ccp3NuXIXBi3r2VMqDyPqAs42PAKoBbScN8C2n76y64yVYAdwOHqY5OWhY5tVDHVYGXIxpRlwYKTOFmuO-rmCnO3_8vjme-YebM0oTzi1Bm6KprZQTzLQvs23bdJnJ6qWB1dh7fAErOac3XpflogUlYfjJv8dEDpbFQpi953Ex5VeKBEoynP9zrXNYvyr3jXAdlgUSniAk50P8fX2kgfLqztdtF-frLNPxYC57uyLdj4aX2rL5h_LGNOOzHtTIX0mnP_ylMicQr20JwGKkVlVEnEZ-LUFfbepYQPbO3WKYjxvttbAmjPdMrpZCksYoUcivJFpmaXotIJwzMqRthTJmm9QtLKoAJESfE9tKmMyV8cg0HwDbZav7ikUFscUMmYXCBKv3bWpWTmK58gGSYxVSoCdbN53JLynZlrvGirfhEJWl7fwZj9ovsN-rOPpwLaPHw4YKX_apXPvl9mEuyb0uyIW9_7P-5LXtz_tqQ22-8I-Hpoq_AM3TLdIg6IbqBFyGocI4zHJ_wFKN24pl-2G8RsFDZt6QPV9W_S0c0DXfYQCiuw9Y6McImJJf4_7NycWby3PyzlrgIFZIc3_ytGw5si7wVY6LaeSxOMJbdf00tgC0YyJEU_NYwE_rO874waJ9Ki-zr5QfzK9-9NTf81GPz4_Bd49a7Xgn8ZjZ0lFWtXTZeudd31dC2Eua1SBNlsZ0H_C7PsTCNugkKvWAZg7J-LsaKNGVRu53ZlcjppUm2OOp0Z43Ck5jxCOa5ufKipNkPadOwGyKkNL5EVRTcSo5BaOz7x2T_yXuh3y94HErLP2IVjr62vO5WPgfwNGPrOhVqbs6n5CMCv4KE9ajnZteBaCaHYDEbbab3C73a28gvuWbarUHoxDl3Wciv7wFPclRzQ_GqqJJn7weBYUSegqi8Hc0upznt5KPJIo2JUrKZQHRbAcfOKDKv8AG4eHa9VhZUfDa0eWw1tU4YOI3zzV31Qy0_Qk-hqJatu7MWgenCxWL-BjkZ0I3apDgbMVvac-Vq73kX3IIIXSNokJCr5tth1u_j0CPtq9Xx_VOAtUd_CfNC1mtdY5E966v5D_Oj7vZZ0zCJw31YfCpqLNSXZ9s4Bwp6NM1siQ3zWGAkMz-Ob0PdgoAPxk8tSlnA4xsW67PfPr-_hCOt_KCMjZugBNckkX1EQVj_1XaCftvd2FyZKQongKqmwsjJEoaw8MUx6YcvHm8cLEdnFh0CSmyRAUpPsJ5zKZW3YZOv2NbSlM-n-L4MG6YjJRGkz68IMr9PZbJvyrDSJjg4nvQQiB8kPwVEEDnPxsZ-6I5JIuCpSCRK7YkCxJILHbdS6AaA7GqX_Ygsh4xOZyuSANYCI9eyaugWxxt5JdkU96669PWD9Fc7RhKMz1pVlWrAU2lQSR4BAaZ4CNd8FvHAg_0iEDFWKv5FrWiTWVGpWH0wOHlQfcxyeH6cym1LE1ETxE7U74isOWXw4zYqzkzdOhJ5Xt3Thd9AwmNvN5xanzuWorbSys7RNQA",
      "sig": "MEQCIAkON1eCRnY7aZ-QX8SPOkoljVwPGGVxx1Cg_boylUb7AiAWR-n9tQJNR_4HcXAjXfkgdM-LDD5Txv9EicOs_9Qv3w"
    },
    {
      "name": "alina-to-bharat-by-reference",
      "form": "leaf",
      "suite": "HDTP-SEAL-P256",
      "sender_chain": [
        "leaf_a",
        "root_a"
      ],
      "recipient_chain": [
        "leaf_b",
        "root_b"
      ],
      "plaintext_hex": "7b226d6574686f64223a22746f6f6c732f63616c6c222c22706172616d73223a7b226e616d65223a2273656e645f6d657373616765222c22617267756d656e7473223a7b226d73675f6964223a227665632d31222c2274657874223a2268656c6c6f2066726f6d207468652048445450207465737420766563746f7273227d7d2c226c656166223a227368613235363a43585871304d59426c3056553135483172307865674858694a77326c5a4a6c73594a466f79743067466d4d227d",
      "protected": "eyJjdHkiOiJhcHBsaWNhdGlvbi9oZHRwLWNhbGwranNvbiIsImV4cCI6MTc4OTMwMTQwMCwia2lkIjoic2hhMjU2OnpDSjJNQXlrSnNPU1cwQkFBT0ZSRFNpc29qQ2FxU1NuSV9BNy1YUXRPWEUiLCJtc2dfaWQiOiJ2ZWMtdjEtYWxpbmEtdG8tYmhhcmF0LXJlZiIsInN1aXRlIjoiSERUUC1TRUFMLVAyNTYiLCJ0cyI6MTc4OTMwMDgwMCwidiI6MX0",
      "enc": "BM0lqrSTC4qyxAL87KoXr5eo3uRJwBiNtiUZtL790YzJsVBeaS7lhSedGyNsPBYWt5DVV1qcT6YDaV8b2E7C2oo",
      "ct": "iq0O-sqrJdSp_ys5IYY-qv3dJprm0nfugrDPCU5W4wSxl78Av1aCXT0blwJjk9GZOBdLVa0ULi2qKFos6c6M0m7nLEhgJdfV5tFujW3NiQyDyYg2YfK_D4bM-iZTD9U_cG8scQRLOSMqREaWmRk_Qw8P1fplrmhfux3GQ5Tl9VOBoTQqZNmGORPy-rnDB6Rp9aox6Irhrh8ZqP4Y8z00dZ8-v1uSeot-bupNNLT7p0Gd9FGnW9Kk8HTMKefGGUkmc5wTlt5t0rqy6xqwxw",
      "sig": "o2uZXByY56E1WPrl-gFetWUj2hhfb_zMgrRgVdyqEBMjRd0rlJPrXN7HDxHHznQg_xr-RnFZKQq7hx_lQYM0DA"
    }
  ],
  "derivation": [
    {
      "label": "root",
      "prf": "9He89-EmS-vXLacNUr056xb8vfOisUPULoWKtxOPUaM",
      "salt": "hArwKi9mjuCpCqvaa0fl_xMKCi-SS5B43gVC_6wbU4M",
      "info": "hdtp/root/1",
      "seed": "K8uwdL17lL4d-C6p4K0jjI4gzu_MRrpql9OuMs7TWV0",
      "alg": "ed25519",
      "spki": "MCowBQYDK2VwAyEAFkQ4dYeAKQ7d7VaBCdHDkUj-lNiP5B5ni3z3_Tlc6A8",
      "fingerprint": "sha256:sTsPU8cHx-jNcHuwgjPLe9oOku1XLvqu9t6jDwGUtsw",
      "note": "the identity this passkey is: Ed25519 from the derived seed. No certificate: a root's serial and notBefore are the wallet's, not the derivation's, so the key is what reproduces and the certificate is not"
    },
    {
      "label": "store-key",
      "prf": "9He89-EmS-vXLacNUr056xb8vfOisUPULoWKtxOPUaM",
      "salt": "hArwKi9mjuCpCqvaa0fl_xMKCi-SS5B43gVC_6wbU4M",
      "info": "hdtp/store-key/1",
      "seed": "hc9IVLsZfOxTgxEUlaDpcUHSkrNaf6ynXm036NwuQ3E",
      "note": "HKDF-SHA256 over the same prf; a 32-byte secret, not a key"
    },
    {
      "label": "store-id",
      "prf": "9He89-EmS-vXLacNUr056xb8vfOisUPULoWKtxOPUaM",
      "salt": "hArwKi9mjuCpCqvaa0fl_xMKCi-SS5B43gVC_6wbU4M",
      "info": "hdtp/store-id/1",
      "seed": "ii0qTaCcVQoglH-nZqmdhPIUqczEVnD54FSDsm9hLv4",
      "note": "HKDF-SHA256 over the same prf; a 32-byte secret, not a key"
    }
  ],
  "signed_card": {
    "leaf": "leaf_a",
    "card": "BEGIN:VCARD\r\nVERSION:4.0\r\nFN:Alina Rao\r\nX-HDTP-VERSION:1\r\nX-HDTP-CERT:MIIBuTCCAWugAwIBAgIJAOpUDjFhRyz1MAUGAytlcDAUMRIwEAYDVQQDDAlBbGl\r\n uYSBSYW8wHhcNMjYwOTAxMDAwMDAwWhcNMjcwOTAxMDAwMDAwWjAUMRIwEAYDVQQDDAlBbGluY\r\n SBSYW8wKjAFBgMrZXADIQAc4PNuHViTQA_25WqM0mXjeUZC6GY55P-I5zsMVhZEVKOB2TCB1jA\r\n MBgNVHRMBAf8EAjAAMA4GA1UdDwEB_wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBB\r\n QUHAwIwPwYDVR0RBDgwNoYfaHR0cHM6Ly9hZ2VudC5hbGluYS5leGFtcGxlL21jcIITYWdlbnQ\r\n uYWxpbmEuZXhhbXBsZTApBgNVHQ4EIgQgCXXq0MYBl0VU15H1r0xegHXiJw2lZJlsYJFoyt0gF\r\n mMwKwYDVR0jBCQwIoAgkfs9kG6xSsWaNtvWZsVnAWnGithg_HgKN4dbfWOGC1AwBQYDK2VwA0E\r\n AHufxIATi7sc2TPtGxQDWBvgAx4kMvhkjx0HnIYvqEjJ82QGozuRwvkb7aBgC3bwqt6lzu9Ja7\r\n motAucm4o2ADg\r\nX-HDTP-SEAL:required\r\nEND:VCARD\r\n",
    "card_sig": "hoqEtTzpoQOTFZ6xGlAO_ecu4d_6L1AHgH_E1Nm5oyhJ43IUG4dznyWjNFJNA8eCZUk3ogcF2qqljEk0GD2QAA",
    "note": "the card leaf_a's host serves with `get_card`, `redeem_invite` and the invite landing; card_sig is pure Ed25519 by leaf_a's key over the card text's UTF-8 bytes, CRLF line ends included, written as base64url without padding"
  }
}