{
  "specification": "https://openproofing.org/specifications/evidence-record",
  "version": "1.0",
  "schema": "https://openproofing.org/specifications/evidence-record.schema.json",
  "testKey": {
    "note": "Public half of a key generated for this set of vectors only. Its private key was discarded after signing.",
    "publicJwk": {
      "kty": "EC",
      "crv": "P-256",
      "x": "ggV-y_fH493y8qObSplJ3htJn8odQ0wSufsr5zqaU18",
      "y": "smWENELUrve9mCbPrpVVcDxaSPZ6VzYBdqLS956EeYw"
    },
    "thumbprint": "k5Q1VcFHoKaHgFAwr5YnMh1KjFhDxrBXB1fbqymAHrU"
  },
  "clockSkewSeconds": 60,
  "conventions": {
    "input": "record is the decoded payload; jws is the record in the JWS Compact Serialization. audience and nonce are the values the relying party expects, now is the time of verification and freshnessSeconds the window for issuedAt. jwk, when present, is the public key the attestation would bind.",
    "expected": "Each case lists one result per verification step of section 6, in order. structure is the check against section 4 that precedes step 1. Steps 1 and 6 (router signature) are not checked without Apple's and Google's attestation roots and the router's published keys."
  },
  "cases": [
    {
      "name": "valid-record",
      "description": "The specification's example record for remote IAL2, given as JSON. Every step that can be checked passes; the signature is not checked because no JWS is given.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "pass",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "not-signed"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "pass",
          "reason": "fresh"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "pass",
          "reason": "registry-bound"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "pass",
          "reason": "attributes-verified"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "pass",
          "reason": "met-consistent"
        }
      ]
    },
    {
      "name": "valid-jws",
      "description": "The same record with device.keyId set to the test key's thumbprint, signed with the test key. Every step that can be checked passes, including the signature.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "jws": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJ2ZXJzaW9uIjoiMS4wIiwiaWQiOiI2ZjFjMmE5ZS00YjdkLTRlMmEtOWM1MS0wZDhlM2I3YTJmNjQiLCJhdWRpZW5jZSI6InJwLmV4YW1wbGUtYmFuay5jb20iLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImlzc3VlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxOFoiLCJhc3N1cmFuY2UiOnsidGFyZ2V0IjoiSUFMMiIsIm1ldCI6dHJ1ZX0sImNoZWNrcyI6W3sicHJvb2YiOiJkcml2ZXJzTGljZW5zZSIsInN0ZXAiOiJldmlkZW5jZSIsIm91dGNvbWUiOiJwYXNzIiwic291cmNlIjoiQUFNVkEgREwvSUQgQ2FyZCBEZXNpZ24gU3RhbmRhcmQsIDUxLWp1cmlzZGljdGlvbiBjYXRhbG9nIiwiY2hlY2tlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxMVoifSx7InByb29mIjoibGljZW5zZVJlY29yZCIsInN0ZXAiOiJhdHRyaWJ1dGVzIiwib3V0Y29tZSI6InBhc3MiLCJzb3VyY2UiOiJBQU1WQSBETERWIiwiY2hlY2tlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxMi40MDBaIiwicmVnaXN0cnlSZXNwb25zZSI6ImV5SmhiR2NpT2lKRlV6STFOaUlzSW10cFpDSTZJbkp2ZFhSbGNpMHlNREkyTFRFeEluMC5leUp3Y205dlppSTZJbXhwWTJWdWMyVlNaV052Y21RaUxDSnZkWFJqYjIxbElqb2ljR0Z6Y3lJc0ltNXZibU5sSWpvaWJpMHdVelpmVjNwQk1rMXFJaXdpWVhWa0lqb2ljbkF1WlhoaGJYQnNaUzFpWVc1ckxtTnZiU0o5LmMybG5ibUYwZFhKbCJ9LHsicHJvb2YiOiJsaXZlbmVzcyIsInN0ZXAiOiJ2ZXJpZmljYXRpb24iLCJvdXRjb21lIjoicGFzcyIsInNvdXJjZSI6IklTTy9JRUMgMzAxMDctMyBwcmVzZW50YXRpb24gYXR0YWNrIGRldGVjdGlvbiIsImNoZWNrZWRBdCI6IjIwMjYtMTEtMDJUMTU6MDQ6MTMuODAwWiJ9LHsicHJvb2YiOiJmYWNlTWF0Y2giLCJzdGVwIjoidmVyaWZpY2F0aW9uIiwib3V0Y29tZSI6InBhc3MiLCJzb3VyY2UiOiJEb2N1bWVudCBwb3J0cmFpdCBvciBjaGlwIHBob3RvIiwiY2hlY2tlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxNS4yMDBaIn0seyJwcm9vZiI6InBob25lIiwic3RlcCI6ImZyYXVkIiwib3V0Y29tZSI6InBhc3MiLCJzb3VyY2UiOiJHU01BIENBTUFSQSBOdW1iZXIgVmVyaWZpY2F0aW9uIGFuZCBTSU0gU3dhcCB2aWEgQWR1bmEsIE1PLVNNUyIsImNoZWNrZWRBdCI6IjIwMjYtMTEtMDJUMTU6MDQ6MTYuNjAwWiIsInJlZ2lzdHJ5UmVzcG9uc2UiOiJleUpoYkdjaU9pSkZVekkxTmlJc0ltdHBaQ0k2SW5KdmRYUmxjaTB5TURJMkxURXhJbjAuZXlKd2NtOXZaaUk2SW5Cb2IyNWxJaXdpYjNWMFkyOXRaU0k2SW5CaGMzTWlMQ0p1YjI1alpTSTZJbTR0TUZNMlgxZDZRVEpOYWlJc0ltRjFaQ0k2SW5Kd0xtVjRZVzF3YkdVdFltRnVheTVqYjIwaWZRLmMybG5ibUYwZFhKbCJ9XSwiZGV2aWNlIjp7InBsYXRmb3JtIjoiaW9zIiwiYXR0ZXN0YXRpb24iOnsiZm9ybWF0IjoiYXBwbGUtYXBwLWF0dGVzdCIsInN0YXRlbWVudCI6Im8yTm1iWFJ2WVhCd2JHVXRZWEJ3WVhSMFpYTjBaMkYwZEZOMGJYU2nigKYifSwia2V5SWQiOiJrNVExVmNGSG9LYUhnRkF3cjVZbk1oMUtqRmhEeHJCWEIxZmJxeW1BSHJVIn0sImF0dHJpYnV0ZXMiOnsiZ2l2ZW5OYW1lIjp7InZhbHVlIjoiSm9yZGFuIiwidmVyaWZpZWRCeSI6WyJkcml2ZXJzTGljZW5zZSIsImxpY2Vuc2VSZWNvcmQiXX0sImZhbWlseU5hbWUiOnsidmFsdWUiOiJSaXZlcmEiLCJ2ZXJpZmllZEJ5IjpbImRyaXZlcnNMaWNlbnNlIiwibGljZW5zZVJlY29yZCJdfSwiYmlydGhEYXRlIjp7InZhbHVlIjoiMTk5MC0wNC0xNyIsInZlcmlmaWVkQnkiOlsiZHJpdmVyc0xpY2Vuc2UiLCJsaWNlbnNlUmVjb3JkIl19LCJhZGRyZXNzIjp7InZhbHVlIjoiMTIwMCBFeGFtcGxlIEF2ZSwgU3ByaW5nZmllbGQsIElMIDYyNzAxIiwidmVyaWZpZWRCeSI6WyJkcml2ZXJzTGljZW5zZSIsImxpY2Vuc2VSZWNvcmQiXX0sImRvY3VtZW50TnVtYmVyIjp7InZhbHVlIjoiUjEyMy00NTY3LTg5MDEiLCJ2ZXJpZmllZEJ5IjpbImRyaXZlcnNMaWNlbnNlIiwibGljZW5zZVJlY29yZCJdfSwiZG9jdW1lbnRJc3N1ZXIiOnsidmFsdWUiOiJVUy1JTCIsInZlcmlmaWVkQnkiOlsiZHJpdmVyc0xpY2Vuc2UiLCJsaWNlbnNlUmVjb3JkIl19fX0.5bbM57X1dsiNw9uKp2DpxzL07P_z4NjBDAU-vTLfHuIEQuTTyAbSf0RT_RQWP8wQKRjyzrcoVbm4qbgVC0U2ng",
        "jwk": {
          "kty": "EC",
          "crv": "P-256",
          "x": "ggV-y_fH493y8qObSplJ3htJn8odQ0wSufsr5zqaU18",
          "y": "smWENELUrve9mCbPrpVVcDxaSPZ6VzYBdqLS956EeYw"
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "pass",
          "reason": "signature-valid"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "pass",
          "reason": "fresh"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "pass",
          "reason": "registry-bound"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "pass",
          "reason": "attributes-verified"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "pass",
          "reason": "met-consistent"
        }
      ]
    },
    {
      "name": "tampered-jws",
      "description": "The signed record with its payload replaced after signing: the id differs. The signature does not verify.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "jws": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJ2ZXJzaW9uIjoiMS4wIiwiaWQiOiIwZDdhNGYzZS05MWMyLTRiOGUtYTZkNS0zZjJlMWM5YjhhNzAiLCJhdWRpZW5jZSI6InJwLmV4YW1wbGUtYmFuay5jb20iLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImlzc3VlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxOFoiLCJhc3N1cmFuY2UiOnsidGFyZ2V0IjoiSUFMMiIsIm1ldCI6dHJ1ZX0sImNoZWNrcyI6W3sicHJvb2YiOiJkcml2ZXJzTGljZW5zZSIsInN0ZXAiOiJldmlkZW5jZSIsIm91dGNvbWUiOiJwYXNzIiwic291cmNlIjoiQUFNVkEgREwvSUQgQ2FyZCBEZXNpZ24gU3RhbmRhcmQsIDUxLWp1cmlzZGljdGlvbiBjYXRhbG9nIiwiY2hlY2tlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxMVoifSx7InByb29mIjoibGljZW5zZVJlY29yZCIsInN0ZXAiOiJhdHRyaWJ1dGVzIiwib3V0Y29tZSI6InBhc3MiLCJzb3VyY2UiOiJBQU1WQSBETERWIiwiY2hlY2tlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxMi40MDBaIiwicmVnaXN0cnlSZXNwb25zZSI6ImV5SmhiR2NpT2lKRlV6STFOaUlzSW10cFpDSTZJbkp2ZFhSbGNpMHlNREkyTFRFeEluMC5leUp3Y205dlppSTZJbXhwWTJWdWMyVlNaV052Y21RaUxDSnZkWFJqYjIxbElqb2ljR0Z6Y3lJc0ltNXZibU5sSWpvaWJpMHdVelpmVjNwQk1rMXFJaXdpWVhWa0lqb2ljbkF1WlhoaGJYQnNaUzFpWVc1ckxtTnZiU0o5LmMybG5ibUYwZFhKbCJ9LHsicHJvb2YiOiJsaXZlbmVzcyIsInN0ZXAiOiJ2ZXJpZmljYXRpb24iLCJvdXRjb21lIjoicGFzcyIsInNvdXJjZSI6IklTTy9JRUMgMzAxMDctMyBwcmVzZW50YXRpb24gYXR0YWNrIGRldGVjdGlvbiIsImNoZWNrZWRBdCI6IjIwMjYtMTEtMDJUMTU6MDQ6MTMuODAwWiJ9LHsicHJvb2YiOiJmYWNlTWF0Y2giLCJzdGVwIjoidmVyaWZpY2F0aW9uIiwib3V0Y29tZSI6InBhc3MiLCJzb3VyY2UiOiJEb2N1bWVudCBwb3J0cmFpdCBvciBjaGlwIHBob3RvIiwiY2hlY2tlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxNS4yMDBaIn0seyJwcm9vZiI6InBob25lIiwic3RlcCI6ImZyYXVkIiwib3V0Y29tZSI6InBhc3MiLCJzb3VyY2UiOiJHU01BIENBTUFSQSBOdW1iZXIgVmVyaWZpY2F0aW9uIGFuZCBTSU0gU3dhcCB2aWEgQWR1bmEsIE1PLVNNUyIsImNoZWNrZWRBdCI6IjIwMjYtMTEtMDJUMTU6MDQ6MTYuNjAwWiIsInJlZ2lzdHJ5UmVzcG9uc2UiOiJleUpoYkdjaU9pSkZVekkxTmlJc0ltdHBaQ0k2SW5KdmRYUmxjaTB5TURJMkxURXhJbjAuZXlKd2NtOXZaaUk2SW5Cb2IyNWxJaXdpYjNWMFkyOXRaU0k2SW5CaGMzTWlMQ0p1YjI1alpTSTZJbTR0TUZNMlgxZDZRVEpOYWlJc0ltRjFaQ0k2SW5Kd0xtVjRZVzF3YkdVdFltRnVheTVqYjIwaWZRLmMybG5ibUYwZFhKbCJ9XSwiZGV2aWNlIjp7InBsYXRmb3JtIjoiaW9zIiwiYXR0ZXN0YXRpb24iOnsiZm9ybWF0IjoiYXBwbGUtYXBwLWF0dGVzdCIsInN0YXRlbWVudCI6Im8yTm1iWFJ2WVhCd2JHVXRZWEJ3WVhSMFpYTjBaMkYwZEZOMGJYU2nigKYifSwia2V5SWQiOiJrNVExVmNGSG9LYUhnRkF3cjVZbk1oMUtqRmhEeHJCWEIxZmJxeW1BSHJVIn0sImF0dHJpYnV0ZXMiOnsiZ2l2ZW5OYW1lIjp7InZhbHVlIjoiSm9yZGFuIiwidmVyaWZpZWRCeSI6WyJkcml2ZXJzTGljZW5zZSIsImxpY2Vuc2VSZWNvcmQiXX0sImZhbWlseU5hbWUiOnsidmFsdWUiOiJSaXZlcmEiLCJ2ZXJpZmllZEJ5IjpbImRyaXZlcnNMaWNlbnNlIiwibGljZW5zZVJlY29yZCJdfSwiYmlydGhEYXRlIjp7InZhbHVlIjoiMTk5MC0wNC0xNyIsInZlcmlmaWVkQnkiOlsiZHJpdmVyc0xpY2Vuc2UiLCJsaWNlbnNlUmVjb3JkIl19LCJhZGRyZXNzIjp7InZhbHVlIjoiMTIwMCBFeGFtcGxlIEF2ZSwgU3ByaW5nZmllbGQsIElMIDYyNzAxIiwidmVyaWZpZWRCeSI6WyJkcml2ZXJzTGljZW5zZSIsImxpY2Vuc2VSZWNvcmQiXX0sImRvY3VtZW50TnVtYmVyIjp7InZhbHVlIjoiUjEyMy00NTY3LTg5MDEiLCJ2ZXJpZmllZEJ5IjpbImRyaXZlcnNMaWNlbnNlIiwibGljZW5zZVJlY29yZCJdfSwiZG9jdW1lbnRJc3N1ZXIiOnsidmFsdWUiOiJVUy1JTCIsInZlcmlmaWVkQnkiOlsiZHJpdmVyc0xpY2Vuc2UiLCJsaWNlbnNlUmVjb3JkIl19fX0.5bbM57X1dsiNw9uKp2DpxzL07P_z4NjBDAU-vTLfHuIEQuTTyAbSf0RT_RQWP8wQKRjyzrcoVbm4qbgVC0U2ng",
        "jwk": {
          "kty": "EC",
          "crv": "P-256",
          "x": "ggV-y_fH493y8qObSplJ3htJn8odQ0wSufsr5zqaU18",
          "y": "smWENELUrve9mCbPrpVVcDxaSPZ6VzYBdqLS956EeYw"
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "fail",
          "reason": "signature-invalid"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "pass",
          "reason": "fresh"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "pass",
          "reason": "registry-bound"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "pass",
          "reason": "attributes-verified"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "pass",
          "reason": "met-consistent"
        }
      ]
    },
    {
      "name": "jws-without-key",
      "description": "The signed record with no public key supplied. The signature is not checked.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "jws": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJ2ZXJzaW9uIjoiMS4wIiwiaWQiOiI2ZjFjMmE5ZS00YjdkLTRlMmEtOWM1MS0wZDhlM2I3YTJmNjQiLCJhdWRpZW5jZSI6InJwLmV4YW1wbGUtYmFuay5jb20iLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImlzc3VlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxOFoiLCJhc3N1cmFuY2UiOnsidGFyZ2V0IjoiSUFMMiIsIm1ldCI6dHJ1ZX0sImNoZWNrcyI6W3sicHJvb2YiOiJkcml2ZXJzTGljZW5zZSIsInN0ZXAiOiJldmlkZW5jZSIsIm91dGNvbWUiOiJwYXNzIiwic291cmNlIjoiQUFNVkEgREwvSUQgQ2FyZCBEZXNpZ24gU3RhbmRhcmQsIDUxLWp1cmlzZGljdGlvbiBjYXRhbG9nIiwiY2hlY2tlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxMVoifSx7InByb29mIjoibGljZW5zZVJlY29yZCIsInN0ZXAiOiJhdHRyaWJ1dGVzIiwib3V0Y29tZSI6InBhc3MiLCJzb3VyY2UiOiJBQU1WQSBETERWIiwiY2hlY2tlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxMi40MDBaIiwicmVnaXN0cnlSZXNwb25zZSI6ImV5SmhiR2NpT2lKRlV6STFOaUlzSW10cFpDSTZJbkp2ZFhSbGNpMHlNREkyTFRFeEluMC5leUp3Y205dlppSTZJbXhwWTJWdWMyVlNaV052Y21RaUxDSnZkWFJqYjIxbElqb2ljR0Z6Y3lJc0ltNXZibU5sSWpvaWJpMHdVelpmVjNwQk1rMXFJaXdpWVhWa0lqb2ljbkF1WlhoaGJYQnNaUzFpWVc1ckxtTnZiU0o5LmMybG5ibUYwZFhKbCJ9LHsicHJvb2YiOiJsaXZlbmVzcyIsInN0ZXAiOiJ2ZXJpZmljYXRpb24iLCJvdXRjb21lIjoicGFzcyIsInNvdXJjZSI6IklTTy9JRUMgMzAxMDctMyBwcmVzZW50YXRpb24gYXR0YWNrIGRldGVjdGlvbiIsImNoZWNrZWRBdCI6IjIwMjYtMTEtMDJUMTU6MDQ6MTMuODAwWiJ9LHsicHJvb2YiOiJmYWNlTWF0Y2giLCJzdGVwIjoidmVyaWZpY2F0aW9uIiwib3V0Y29tZSI6InBhc3MiLCJzb3VyY2UiOiJEb2N1bWVudCBwb3J0cmFpdCBvciBjaGlwIHBob3RvIiwiY2hlY2tlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxNS4yMDBaIn0seyJwcm9vZiI6InBob25lIiwic3RlcCI6ImZyYXVkIiwib3V0Y29tZSI6InBhc3MiLCJzb3VyY2UiOiJHU01BIENBTUFSQSBOdW1iZXIgVmVyaWZpY2F0aW9uIGFuZCBTSU0gU3dhcCB2aWEgQWR1bmEsIE1PLVNNUyIsImNoZWNrZWRBdCI6IjIwMjYtMTEtMDJUMTU6MDQ6MTYuNjAwWiIsInJlZ2lzdHJ5UmVzcG9uc2UiOiJleUpoYkdjaU9pSkZVekkxTmlJc0ltdHBaQ0k2SW5KdmRYUmxjaTB5TURJMkxURXhJbjAuZXlKd2NtOXZaaUk2SW5Cb2IyNWxJaXdpYjNWMFkyOXRaU0k2SW5CaGMzTWlMQ0p1YjI1alpTSTZJbTR0TUZNMlgxZDZRVEpOYWlJc0ltRjFaQ0k2SW5Kd0xtVjRZVzF3YkdVdFltRnVheTVqYjIwaWZRLmMybG5ibUYwZFhKbCJ9XSwiZGV2aWNlIjp7InBsYXRmb3JtIjoiaW9zIiwiYXR0ZXN0YXRpb24iOnsiZm9ybWF0IjoiYXBwbGUtYXBwLWF0dGVzdCIsInN0YXRlbWVudCI6Im8yTm1iWFJ2WVhCd2JHVXRZWEJ3WVhSMFpYTjBaMkYwZEZOMGJYU2nigKYifSwia2V5SWQiOiJrNVExVmNGSG9LYUhnRkF3cjVZbk1oMUtqRmhEeHJCWEIxZmJxeW1BSHJVIn0sImF0dHJpYnV0ZXMiOnsiZ2l2ZW5OYW1lIjp7InZhbHVlIjoiSm9yZGFuIiwidmVyaWZpZWRCeSI6WyJkcml2ZXJzTGljZW5zZSIsImxpY2Vuc2VSZWNvcmQiXX0sImZhbWlseU5hbWUiOnsidmFsdWUiOiJSaXZlcmEiLCJ2ZXJpZmllZEJ5IjpbImRyaXZlcnNMaWNlbnNlIiwibGljZW5zZVJlY29yZCJdfSwiYmlydGhEYXRlIjp7InZhbHVlIjoiMTk5MC0wNC0xNyIsInZlcmlmaWVkQnkiOlsiZHJpdmVyc0xpY2Vuc2UiLCJsaWNlbnNlUmVjb3JkIl19LCJhZGRyZXNzIjp7InZhbHVlIjoiMTIwMCBFeGFtcGxlIEF2ZSwgU3ByaW5nZmllbGQsIElMIDYyNzAxIiwidmVyaWZpZWRCeSI6WyJkcml2ZXJzTGljZW5zZSIsImxpY2Vuc2VSZWNvcmQiXX0sImRvY3VtZW50TnVtYmVyIjp7InZhbHVlIjoiUjEyMy00NTY3LTg5MDEiLCJ2ZXJpZmllZEJ5IjpbImRyaXZlcnNMaWNlbnNlIiwibGljZW5zZVJlY29yZCJdfSwiZG9jdW1lbnRJc3N1ZXIiOnsidmFsdWUiOiJVUy1JTCIsInZlcmlmaWVkQnkiOlsiZHJpdmVyc0xpY2Vuc2UiLCJsaWNlbnNlUmVjb3JkIl19fX0.5bbM57X1dsiNw9uKp2DpxzL07P_z4NjBDAU-vTLfHuIEQuTTyAbSf0RT_RQWP8wQKRjyzrcoVbm4qbgVC0U2ng"
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "no-key"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "pass",
          "reason": "fresh"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "pass",
          "reason": "registry-bound"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "pass",
          "reason": "attributes-verified"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "pass",
          "reason": "met-consistent"
        }
      ]
    },
    {
      "name": "alg-not-es256",
      "description": "A JWS whose protected header names HS256. Section 3 requires ES256.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "jws": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ2ZXJzaW9uIjoiMS4wIiwiaWQiOiI2ZjFjMmE5ZS00YjdkLTRlMmEtOWM1MS0wZDhlM2I3YTJmNjQiLCJhdWRpZW5jZSI6InJwLmV4YW1wbGUtYmFuay5jb20iLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImlzc3VlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxOFoiLCJhc3N1cmFuY2UiOnsidGFyZ2V0IjoiSUFMMiIsIm1ldCI6dHJ1ZX0sImNoZWNrcyI6W3sicHJvb2YiOiJkcml2ZXJzTGljZW5zZSIsInN0ZXAiOiJldmlkZW5jZSIsIm91dGNvbWUiOiJwYXNzIiwic291cmNlIjoiQUFNVkEgREwvSUQgQ2FyZCBEZXNpZ24gU3RhbmRhcmQsIDUxLWp1cmlzZGljdGlvbiBjYXRhbG9nIiwiY2hlY2tlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxMVoifSx7InByb29mIjoibGljZW5zZVJlY29yZCIsInN0ZXAiOiJhdHRyaWJ1dGVzIiwib3V0Y29tZSI6InBhc3MiLCJzb3VyY2UiOiJBQU1WQSBETERWIiwiY2hlY2tlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxMi40MDBaIiwicmVnaXN0cnlSZXNwb25zZSI6ImV5SmhiR2NpT2lKRlV6STFOaUlzSW10cFpDSTZJbkp2ZFhSbGNpMHlNREkyTFRFeEluMC5leUp3Y205dlppSTZJbXhwWTJWdWMyVlNaV052Y21RaUxDSnZkWFJqYjIxbElqb2ljR0Z6Y3lJc0ltNXZibU5sSWpvaWJpMHdVelpmVjNwQk1rMXFJaXdpWVhWa0lqb2ljbkF1WlhoaGJYQnNaUzFpWVc1ckxtTnZiU0o5LmMybG5ibUYwZFhKbCJ9LHsicHJvb2YiOiJsaXZlbmVzcyIsInN0ZXAiOiJ2ZXJpZmljYXRpb24iLCJvdXRjb21lIjoicGFzcyIsInNvdXJjZSI6IklTTy9JRUMgMzAxMDctMyBwcmVzZW50YXRpb24gYXR0YWNrIGRldGVjdGlvbiIsImNoZWNrZWRBdCI6IjIwMjYtMTEtMDJUMTU6MDQ6MTMuODAwWiJ9LHsicHJvb2YiOiJmYWNlTWF0Y2giLCJzdGVwIjoidmVyaWZpY2F0aW9uIiwib3V0Y29tZSI6InBhc3MiLCJzb3VyY2UiOiJEb2N1bWVudCBwb3J0cmFpdCBvciBjaGlwIHBob3RvIiwiY2hlY2tlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxNS4yMDBaIn0seyJwcm9vZiI6InBob25lIiwic3RlcCI6ImZyYXVkIiwib3V0Y29tZSI6InBhc3MiLCJzb3VyY2UiOiJHU01BIENBTUFSQSBOdW1iZXIgVmVyaWZpY2F0aW9uIGFuZCBTSU0gU3dhcCB2aWEgQWR1bmEsIE1PLVNNUyIsImNoZWNrZWRBdCI6IjIwMjYtMTEtMDJUMTU6MDQ6MTYuNjAwWiIsInJlZ2lzdHJ5UmVzcG9uc2UiOiJleUpoYkdjaU9pSkZVekkxTmlJc0ltdHBaQ0k2SW5KdmRYUmxjaTB5TURJMkxURXhJbjAuZXlKd2NtOXZaaUk2SW5Cb2IyNWxJaXdpYjNWMFkyOXRaU0k2SW5CaGMzTWlMQ0p1YjI1alpTSTZJbTR0TUZNMlgxZDZRVEpOYWlJc0ltRjFaQ0k2SW5Kd0xtVjRZVzF3YkdVdFltRnVheTVqYjIwaWZRLmMybG5ibUYwZFhKbCJ9XSwiZGV2aWNlIjp7InBsYXRmb3JtIjoiaW9zIiwiYXR0ZXN0YXRpb24iOnsiZm9ybWF0IjoiYXBwbGUtYXBwLWF0dGVzdCIsInN0YXRlbWVudCI6Im8yTm1iWFJ2WVhCd2JHVXRZWEJ3WVhSMFpYTjBaMkYwZEZOMGJYU2nigKYifSwia2V5SWQiOiJrNVExVmNGSG9LYUhnRkF3cjVZbk1oMUtqRmhEeHJCWEIxZmJxeW1BSHJVIn0sImF0dHJpYnV0ZXMiOnsiZ2l2ZW5OYW1lIjp7InZhbHVlIjoiSm9yZGFuIiwidmVyaWZpZWRCeSI6WyJkcml2ZXJzTGljZW5zZSIsImxpY2Vuc2VSZWNvcmQiXX0sImZhbWlseU5hbWUiOnsidmFsdWUiOiJSaXZlcmEiLCJ2ZXJpZmllZEJ5IjpbImRyaXZlcnNMaWNlbnNlIiwibGljZW5zZVJlY29yZCJdfSwiYmlydGhEYXRlIjp7InZhbHVlIjoiMTk5MC0wNC0xNyIsInZlcmlmaWVkQnkiOlsiZHJpdmVyc0xpY2Vuc2UiLCJsaWNlbnNlUmVjb3JkIl19LCJhZGRyZXNzIjp7InZhbHVlIjoiMTIwMCBFeGFtcGxlIEF2ZSwgU3ByaW5nZmllbGQsIElMIDYyNzAxIiwidmVyaWZpZWRCeSI6WyJkcml2ZXJzTGljZW5zZSIsImxpY2Vuc2VSZWNvcmQiXX0sImRvY3VtZW50TnVtYmVyIjp7InZhbHVlIjoiUjEyMy00NTY3LTg5MDEiLCJ2ZXJpZmllZEJ5IjpbImRyaXZlcnNMaWNlbnNlIiwibGljZW5zZVJlY29yZCJdfSwiZG9jdW1lbnRJc3N1ZXIiOnsidmFsdWUiOiJVUy1JTCIsInZlcmlmaWVkQnkiOlsiZHJpdmVyc0xpY2Vuc2UiLCJsaWNlbnNlUmVjb3JkIl19fX0.QUulO5Fzpyby53UpP82KS-iYZ2a0_5aPJiqok6sfiiJnn_r5uUxDAUpDloclFGFoHVKZj1wG8EmiKuG0TEpflQ",
        "jwk": {
          "kty": "EC",
          "crv": "P-256",
          "x": "ggV-y_fH493y8qObSplJ3htJn8odQ0wSufsr5zqaU18",
          "y": "smWENELUrve9mCbPrpVVcDxaSPZ6VzYBdqLS956EeYw"
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "fail",
          "reason": "alg-not-es256"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "pass",
          "reason": "fresh"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "pass",
          "reason": "registry-bound"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "pass",
          "reason": "attributes-verified"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "pass",
          "reason": "met-consistent"
        }
      ]
    },
    {
      "name": "key-id-mismatch",
      "description": "A record signed with the test key whose device.keyId names another key. The signature verifies; the thumbprint does not match.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "jws": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJ2ZXJzaW9uIjoiMS4wIiwiaWQiOiI2ZjFjMmE5ZS00YjdkLTRlMmEtOWM1MS0wZDhlM2I3YTJmNjQiLCJhdWRpZW5jZSI6InJwLmV4YW1wbGUtYmFuay5jb20iLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImlzc3VlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxOFoiLCJhc3N1cmFuY2UiOnsidGFyZ2V0IjoiSUFMMiIsIm1ldCI6dHJ1ZX0sImNoZWNrcyI6W3sicHJvb2YiOiJkcml2ZXJzTGljZW5zZSIsInN0ZXAiOiJldmlkZW5jZSIsIm91dGNvbWUiOiJwYXNzIiwic291cmNlIjoiQUFNVkEgREwvSUQgQ2FyZCBEZXNpZ24gU3RhbmRhcmQsIDUxLWp1cmlzZGljdGlvbiBjYXRhbG9nIiwiY2hlY2tlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxMVoifSx7InByb29mIjoibGljZW5zZVJlY29yZCIsInN0ZXAiOiJhdHRyaWJ1dGVzIiwib3V0Y29tZSI6InBhc3MiLCJzb3VyY2UiOiJBQU1WQSBETERWIiwiY2hlY2tlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxMi40MDBaIiwicmVnaXN0cnlSZXNwb25zZSI6ImV5SmhiR2NpT2lKRlV6STFOaUlzSW10cFpDSTZJbkp2ZFhSbGNpMHlNREkyTFRFeEluMC5leUp3Y205dlppSTZJbXhwWTJWdWMyVlNaV052Y21RaUxDSnZkWFJqYjIxbElqb2ljR0Z6Y3lJc0ltNXZibU5sSWpvaWJpMHdVelpmVjNwQk1rMXFJaXdpWVhWa0lqb2ljbkF1WlhoaGJYQnNaUzFpWVc1ckxtTnZiU0o5LmMybG5ibUYwZFhKbCJ9LHsicHJvb2YiOiJsaXZlbmVzcyIsInN0ZXAiOiJ2ZXJpZmljYXRpb24iLCJvdXRjb21lIjoicGFzcyIsInNvdXJjZSI6IklTTy9JRUMgMzAxMDctMyBwcmVzZW50YXRpb24gYXR0YWNrIGRldGVjdGlvbiIsImNoZWNrZWRBdCI6IjIwMjYtMTEtMDJUMTU6MDQ6MTMuODAwWiJ9LHsicHJvb2YiOiJmYWNlTWF0Y2giLCJzdGVwIjoidmVyaWZpY2F0aW9uIiwib3V0Y29tZSI6InBhc3MiLCJzb3VyY2UiOiJEb2N1bWVudCBwb3J0cmFpdCBvciBjaGlwIHBob3RvIiwiY2hlY2tlZEF0IjoiMjAyNi0xMS0wMlQxNTowNDoxNS4yMDBaIn0seyJwcm9vZiI6InBob25lIiwic3RlcCI6ImZyYXVkIiwib3V0Y29tZSI6InBhc3MiLCJzb3VyY2UiOiJHU01BIENBTUFSQSBOdW1iZXIgVmVyaWZpY2F0aW9uIGFuZCBTSU0gU3dhcCB2aWEgQWR1bmEsIE1PLVNNUyIsImNoZWNrZWRBdCI6IjIwMjYtMTEtMDJUMTU6MDQ6MTYuNjAwWiIsInJlZ2lzdHJ5UmVzcG9uc2UiOiJleUpoYkdjaU9pSkZVekkxTmlJc0ltdHBaQ0k2SW5KdmRYUmxjaTB5TURJMkxURXhJbjAuZXlKd2NtOXZaaUk2SW5Cb2IyNWxJaXdpYjNWMFkyOXRaU0k2SW5CaGMzTWlMQ0p1YjI1alpTSTZJbTR0TUZNMlgxZDZRVEpOYWlJc0ltRjFaQ0k2SW5Kd0xtVjRZVzF3YkdVdFltRnVheTVqYjIwaWZRLmMybG5ibUYwZFhKbCJ9XSwiZGV2aWNlIjp7InBsYXRmb3JtIjoiaW9zIiwiYXR0ZXN0YXRpb24iOnsiZm9ybWF0IjoiYXBwbGUtYXBwLWF0dGVzdCIsInN0YXRlbWVudCI6Im8yTm1iWFJ2WVhCd2JHVXRZWEJ3WVhSMFpYTjBaMkYwZEZOMGJYU2nigKYifSwia2V5SWQiOiJOemJMc1hoOHVEQ2NkLTZNTndYRjRXXzdub1dYRlpBZkhreFpzUkdDOVhzIn0sImF0dHJpYnV0ZXMiOnsiZ2l2ZW5OYW1lIjp7InZhbHVlIjoiSm9yZGFuIiwidmVyaWZpZWRCeSI6WyJkcml2ZXJzTGljZW5zZSIsImxpY2Vuc2VSZWNvcmQiXX0sImZhbWlseU5hbWUiOnsidmFsdWUiOiJSaXZlcmEiLCJ2ZXJpZmllZEJ5IjpbImRyaXZlcnNMaWNlbnNlIiwibGljZW5zZVJlY29yZCJdfSwiYmlydGhEYXRlIjp7InZhbHVlIjoiMTk5MC0wNC0xNyIsInZlcmlmaWVkQnkiOlsiZHJpdmVyc0xpY2Vuc2UiLCJsaWNlbnNlUmVjb3JkIl19LCJhZGRyZXNzIjp7InZhbHVlIjoiMTIwMCBFeGFtcGxlIEF2ZSwgU3ByaW5nZmllbGQsIElMIDYyNzAxIiwidmVyaWZpZWRCeSI6WyJkcml2ZXJzTGljZW5zZSIsImxpY2Vuc2VSZWNvcmQiXX0sImRvY3VtZW50TnVtYmVyIjp7InZhbHVlIjoiUjEyMy00NTY3LTg5MDEiLCJ2ZXJpZmllZEJ5IjpbImRyaXZlcnNMaWNlbnNlIiwibGljZW5zZVJlY29yZCJdfSwiZG9jdW1lbnRJc3N1ZXIiOnsidmFsdWUiOiJVUy1JTCIsInZlcmlmaWVkQnkiOlsiZHJpdmVyc0xpY2Vuc2UiLCJsaWNlbnNlUmVjb3JkIl19fX0.W9QfaygkX-LHZcTi4JYRrjCRyxQh3x2TmWO-UAO-MN-p_tIXgGa1ljJ0dlIXVslg06pUeU8D3yqU8EICR6GUfA",
        "jwk": {
          "kty": "EC",
          "crv": "P-256",
          "x": "ggV-y_fH493y8qObSplJ3htJn8odQ0wSufsr5zqaU18",
          "y": "smWENELUrve9mCbPrpVVcDxaSPZ6VzYBdqLS956EeYw"
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "fail",
          "reason": "key-id-mismatch"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "pass",
          "reason": "fresh"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "pass",
          "reason": "registry-bound"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "pass",
          "reason": "attributes-verified"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "pass",
          "reason": "met-consistent"
        }
      ]
    },
    {
      "name": "wrong-audience",
      "description": "The relying party expects a different audience than the record names.",
      "input": {
        "audience": "rp.example-insurer.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "pass",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "not-signed"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "fail",
          "reason": "audience-mismatch"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "pass",
          "reason": "fresh"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "pass",
          "reason": "registry-bound"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "pass",
          "reason": "attributes-verified"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "pass",
          "reason": "met-consistent"
        }
      ]
    },
    {
      "name": "wrong-nonce",
      "description": "The relying party issued a different nonce than the record carries.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-7Qx2_PbL9Rk",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "pass",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "not-signed"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "fail",
          "reason": "nonce-mismatch"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "pass",
          "reason": "fresh"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "pass",
          "reason": "registry-bound"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "pass",
          "reason": "attributes-verified"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "pass",
          "reason": "met-consistent"
        }
      ]
    },
    {
      "name": "stale-issued-at",
      "description": "Verified 5 minutes 40.6 seconds after issuedAt, outside the 300-second freshness window.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:10:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "pass",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "not-signed"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "fail",
          "reason": "stale"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "pass",
          "reason": "registry-bound"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "pass",
          "reason": "attributes-verified"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "pass",
          "reason": "met-consistent"
        }
      ]
    },
    {
      "name": "future-issued-at",
      "description": "issuedAt lies 139.4 seconds after the time of verification, beyond the 60-second clock skew.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:02:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "pass",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "not-signed"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "fail",
          "reason": "future"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "pass",
          "reason": "registry-bound"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "pass",
          "reason": "attributes-verified"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "pass",
          "reason": "met-consistent"
        }
      ]
    },
    {
      "name": "missing-required-field",
      "description": "The record has no nonce member.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "pass",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "fail",
          "reason": "invalid",
          "details": [
            {
              "path": "nonce",
              "code": "missing"
            }
          ]
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "not-checked",
          "reason": "structure-invalid"
        }
      ]
    },
    {
      "name": "unknown-proof-id",
      "description": "A check names a proof that section 4.5 does not list.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "retinaScan",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "pass",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "fail",
          "reason": "invalid",
          "details": [
            {
              "path": "checks[0].proof",
              "code": "enum"
            }
          ]
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "not-checked",
          "reason": "structure-invalid"
        }
      ]
    },
    {
      "name": "local-proof-in-record",
      "description": "A check names deathRecord, a local proof the relying party runs on its own systems. Local proofs are not part of the record (section 4.5).",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "pass",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            },
            {
              "proof": "deathRecord",
              "step": "fraud",
              "outcome": "pass",
              "source": "NTIS Limited Access Death Master File",
              "checkedAt": "2026-11-02T15:04:11Z"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "fail",
          "reason": "invalid",
          "details": [
            {
              "path": "checks[5].proof",
              "code": "enum"
            }
          ]
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "not-checked",
          "reason": "structure-invalid"
        }
      ]
    },
    {
      "name": "step-mismatch",
      "description": "A check names a step other than the one its proof belongs to.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "fraud",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "pass",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "fail",
          "reason": "invalid",
          "details": [
            {
              "path": "checks[0].step",
              "code": "step-mismatch"
            }
          ]
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "not-checked",
          "reason": "structure-invalid"
        }
      ]
    },
    {
      "name": "unsupported-version",
      "description": "The record declares major version 2, which a 1.0 consumer does not implement.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "2.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "pass",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "fail",
          "reason": "invalid",
          "details": [
            {
              "path": "version",
              "code": "pattern"
            }
          ]
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "not-checked",
          "reason": "structure-invalid"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "not-checked",
          "reason": "structure-invalid"
        }
      ]
    },
    {
      "name": "unknown-members-ignored",
      "description": "The record and a check carry members this version does not define. Section 9 requires consumers to ignore them.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z",
              "extension": true
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "pass",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          },
          "extension": {
            "note": "added by a later minor version"
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "not-signed"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "pass",
          "reason": "fresh"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "pass",
          "reason": "registry-bound"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "pass",
          "reason": "attributes-verified"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "pass",
          "reason": "met-consistent"
        }
      ]
    },
    {
      "name": "registry-response-other-nonce",
      "description": "The license record check carries a registry response produced for another record's nonce.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi03UXgyX1BiTDlSayIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "pass",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "not-signed"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "pass",
          "reason": "fresh"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "fail",
          "reason": "registry-binding-mismatch",
          "details": [
            {
              "path": "checks[1].registryResponse",
              "code": "nonce-mismatch"
            }
          ]
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "pass",
          "reason": "attributes-verified"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "pass",
          "reason": "met-consistent"
        }
      ]
    },
    {
      "name": "registry-response-outcome-differs",
      "description": "The registry response says fail while the check says pass.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoiZmFpbCIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "pass",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "not-signed"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "pass",
          "reason": "fresh"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "fail",
          "reason": "registry-binding-mismatch",
          "details": [
            {
              "path": "checks[1].registryResponse",
              "code": "outcome-mismatch"
            }
          ]
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "pass",
          "reason": "attributes-verified"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "pass",
          "reason": "met-consistent"
        }
      ]
    },
    {
      "name": "no-attributes",
      "description": "The relying party requested no attributes, so the record carries none. Step 7 has nothing to check.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "pass",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "not-signed"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "pass",
          "reason": "fresh"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "pass",
          "reason": "registry-bound"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "not-checked",
          "reason": "no-attributes"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "pass",
          "reason": "met-consistent"
        }
      ]
    },
    {
      "name": "attribute-not-a-source",
      "description": "birthDate names the phone number check, which cannot verify a date of birth.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "pass",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "phone"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "not-signed"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "pass",
          "reason": "fresh"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "pass",
          "reason": "registry-bound"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "fail",
          "reason": "attributes-unverified",
          "details": [
            {
              "path": "attributes.birthDate.verifiedBy[0]",
              "code": "not-a-source"
            }
          ]
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "pass",
          "reason": "met-consistent"
        }
      ]
    },
    {
      "name": "attribute-without-passing-check",
      "description": "documentNumber names passportChip, a proof that can verify it but has no check in the record.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "pass",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord",
                "passportChip"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "not-signed"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "pass",
          "reason": "fresh"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "pass",
          "reason": "registry-bound"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "fail",
          "reason": "attributes-unverified",
          "details": [
            {
              "path": "attributes.documentNumber.verifiedBy[2]",
              "code": "no-passing-check"
            }
          ]
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "pass",
          "reason": "met-consistent"
        }
      ]
    },
    {
      "name": "recovered-record",
      "description": "A record issued from the recovery vault on a new device: recovery.proofedAt names the original proofing. Every step that can be checked passes.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "pass",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          },
          "recovery": {
            "proofedAt": "2026-03-14T10:22:05Z"
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "not-signed"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "pass",
          "reason": "fresh"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "pass",
          "reason": "registry-bound"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "pass",
          "reason": "attributes-verified"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "pass",
          "reason": "met-consistent"
        }
      ]
    },
    {
      "name": "met-without-liveness",
      "description": "The liveness check is absent but assurance.met is true. Identity verification needs liveness and face match together.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "not-signed"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "pass",
          "reason": "fresh"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "pass",
          "reason": "registry-bound"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "pass",
          "reason": "attributes-verified"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "pass",
          "reason": "claimed-steps-passed"
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "fail",
          "reason": "met-without-coverage",
          "details": [
            {
              "path": "verification",
              "code": "not-covered"
            }
          ]
        }
      ]
    },
    {
      "name": "check-failed-while-met",
      "description": "The liveness check failed but assurance.met is true.",
      "input": {
        "audience": "rp.example-bank.com",
        "nonce": "n-0S6_WzA2Mj",
        "now": "2026-11-02T15:05:00Z",
        "freshnessSeconds": 300,
        "record": {
          "version": "1.0",
          "id": "6f1c2a9e-4b7d-4e2a-9c51-0d8e3b7a2f64",
          "audience": "rp.example-bank.com",
          "nonce": "n-0S6_WzA2Mj",
          "issuedAt": "2026-11-02T15:04:18Z",
          "assurance": {
            "target": "IAL2",
            "met": true
          },
          "checks": [
            {
              "proof": "driversLicense",
              "step": "evidence",
              "outcome": "pass",
              "source": "AAMVA DL/ID Card Design Standard, 51-jurisdiction catalog",
              "checkedAt": "2026-11-02T15:04:11Z"
            },
            {
              "proof": "licenseRecord",
              "step": "attributes",
              "outcome": "pass",
              "source": "AAMVA DLDV",
              "checkedAt": "2026-11-02T15:04:12.400Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6ImxpY2Vuc2VSZWNvcmQiLCJvdXRjb21lIjoicGFzcyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiYXVkIjoicnAuZXhhbXBsZS1iYW5rLmNvbSJ9.c2lnbmF0dXJl"
            },
            {
              "proof": "liveness",
              "step": "verification",
              "outcome": "fail",
              "source": "ISO/IEC 30107-3 presentation attack detection",
              "checkedAt": "2026-11-02T15:04:13.800Z"
            },
            {
              "proof": "faceMatch",
              "step": "verification",
              "outcome": "pass",
              "source": "Document portrait or chip photo",
              "checkedAt": "2026-11-02T15:04:15.200Z"
            },
            {
              "proof": "phone",
              "step": "fraud",
              "outcome": "pass",
              "source": "GSMA CAMARA Number Verification and SIM Swap via Aduna, MO-SMS",
              "checkedAt": "2026-11-02T15:04:16.600Z",
              "registryResponse": "eyJhbGciOiJFUzI1NiIsImtpZCI6InJvdXRlci0yMDI2LTExIn0.eyJwcm9vZiI6InBob25lIiwib3V0Y29tZSI6InBhc3MiLCJub25jZSI6Im4tMFM2X1d6QTJNaiIsImF1ZCI6InJwLmV4YW1wbGUtYmFuay5jb20ifQ.c2lnbmF0dXJl"
            }
          ],
          "device": {
            "platform": "ios",
            "attestation": {
              "format": "apple-app-attest",
              "statement": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSi…"
            },
            "keyId": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
          },
          "attributes": {
            "givenName": {
              "value": "Jordan",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "familyName": {
              "value": "Rivera",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "birthDate": {
              "value": "1990-04-17",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "address": {
              "value": "1200 Example Ave, Springfield, IL 62701",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentNumber": {
              "value": "R123-4567-8901",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            },
            "documentIssuer": {
              "value": "US-IL",
              "verifiedBy": [
                "driversLicense",
                "licenseRecord"
              ]
            }
          }
        }
      },
      "expected": [
        {
          "id": "structure",
          "specStep": null,
          "result": "pass",
          "reason": "valid"
        },
        {
          "id": "attestation",
          "specStep": 1,
          "result": "not-checked",
          "reason": "attestation-roots-unavailable"
        },
        {
          "id": "signature",
          "specStep": 2,
          "result": "not-checked",
          "reason": "not-signed"
        },
        {
          "id": "audience",
          "specStep": 3,
          "result": "pass",
          "reason": "audience-matches"
        },
        {
          "id": "nonce",
          "specStep": 4,
          "result": "pass",
          "reason": "nonce-matches"
        },
        {
          "id": "freshness",
          "specStep": 5,
          "result": "pass",
          "reason": "fresh"
        },
        {
          "id": "registryBinding",
          "specStep": 6,
          "result": "pass",
          "reason": "registry-bound"
        },
        {
          "id": "registrySignature",
          "specStep": 6,
          "result": "not-checked",
          "reason": "router-keys-unavailable"
        },
        {
          "id": "attributes",
          "specStep": 7,
          "result": "pass",
          "reason": "attributes-verified"
        },
        {
          "id": "policy",
          "specStep": 8,
          "result": "fail",
          "reason": "claimed-step-not-passed",
          "details": [
            {
              "path": "checks[2]",
              "code": "not-passed"
            }
          ]
        },
        {
          "id": "assurance",
          "specStep": 9,
          "result": "fail",
          "reason": "met-without-coverage",
          "details": [
            {
              "path": "verification",
              "code": "not-covered"
            }
          ]
        }
      ]
    }
  ]
}