AEB-1 · Consequence-admission conformance

Test the boundary between evidence and effect.

A free, open reference self-test for the last control point before a consequential action. It is format-neutral across a receipt, permit, token, credential, or mandate—and tests whether your boundary keeps each artifact's meaning intact.

ReceiptPermitTokenCredentialMandate

Reference self-testFREE · OPEN · LOCAL

Run from your project

$ npx @emilia-protocol/verify aeb-conformance --reference

22

hostile vectors

01

reference contract

SELF

test only

Inspect the reference vectors &nearr;

THE ADMISSION CONTRACT

One ordered boundary. Native semantics stay native.

AEB does not turn every artifact into an AEB object. The relying party verifies each input under its own rules, joins only verified facts to the exact action, makes a separate local authorization decision, and takes custody of the outcome.

Verify natively

Keep each artifact under its own signature, issuer, audience, freshness, and status rules.

Match the action

Compare verified evidence to the executor-owned, frozen material action without guessing equivalence.

Keep roles distinct

Evidence satisfaction does not collapse identity, policy, human authority, or local authorization into one verdict.

Consume before effect

Atomically consume or reserve one-time authority before dispatch so concurrent replay cannot win twice.

Preserve uncertainty

Keep provider outcome separate from observed effect, and reconcile the same operation before any later attempt.

VERIFIED ≠ MATCHED ≠ SATISFIED ≠ AUTHORIZED ≠ RESERVED ≠ INVOKING ≠ PROVIDER OUTCOME ≠ OBSERVED EFFECT

WHAT AEB-1 TRIES TO BREAK

Passing the happy path is not the test.

The pack targets the places where valid-looking evidence can still produce an unsafe effect. Every case has a bounded expected result that can be compared across implementations.

ACTION_MISMATCH

Exact-action mismatch

Change a material field between evidence and effect. The expected result is refusal, even when the original artifact remains valid.

EXPECTED · REFUSE

STATUS_NOT_CURRENT

Stale, revoked, or unavailable

Present stale or revoked authority—or make a required status source unavailable. Ambiguity must never become permission.

EXPECTED · HOLD CLOSED

ROLE_CONFUSION

Role confusion

Try to use workload identity as a permit, machine policy as named-human authorization, or another artifact in the wrong evidence slot.

EXPECTED · REFUSE

REPLAY

One-time consumption and replay

Race or replay the same authority. The reference contract allows one atomic consume or reserve transition, never two effects.

EXPECTED · AT MOST ONCE

INDETERMINATE

No blind retry

Lose the result after invocation may have begun. Provider outcome and observed effect remain INDETERMINATE, and the original authority stays closed to retry.

EXPECTED · HOLD CLOSED

RECONCILIATION_AUTH

Authenticated reconciliation

Resolve uncertainty only with an authenticated source matched to the same action, operation, provider environment, audience, and target.

EXPECTED · MATCH OR HOLD

FORMAT-NEUTRAL BY DESIGN

Bring the artifact your system already trusts.

A receipt, permit, token, credential, or mandate can enter through a pinned native verifier and adapter. The pack tests consequence-admission behavior at the common boundary; it does not redefine the artifact, its issuer, or what it proves.

Native input

receiptpermittokencredentialmandate

Shared boundary question

Does verified evidence satisfy the requirements for this exact action now, can local policy authorize it once, and can the boundary retain custody when provider outcome or observed effect is unknown?

THE CLAIM BOUNDARY

A useful self-test, with no borrowed authority.

What it is

Free. Open. Self-run.

A deterministic reference pack for checking your implementation's verdicts against the published AEB-1 consequence-admission cases. Run it locally, inspect the vectors, and report the exact scope you tested.

What it is not

No certification by implication.

Not a certification.
Not an audit or assurance opinion.
Not evidence of adoption or endorsement.
Not proof of complete mediation in a deployment.

AEB is an individual Internet-Draft. A passing reference run says only that the tested implementation produced the expected results for the tested vectors under the stated configuration. Deployment topology, bypass paths, durable state, trust inputs, and operational controls remain separate evidence. A local atomicity result applies only inside the consequence owner's demonstrated transaction domain; it is not a claim of atomicity across a remote or federated boundary.

READ THE CONTRACT

Inspect every layer behind the result.

Engineering evidence →

See the wider claim-to-code, formal-model, conformance, and fault-testing evidence.

Open protocol →

Place AEB in the larger exact-action evidence and consequence-control architecture.

Reference vectors ↗

Inspect the deterministic AEB-1 consequence-admission cases on GitHub.

Referee GitHub Action ↗

Run a checked-in implementation against the bounded offline self-test contract without granting execution authority.

AEB Internet-Draft ↗

Read the published individual Internet-Draft and its ordered processing model.

Run AEB-1 now

npx @emilia-protocol/verify aeb-conformance --reference

Open the reference pack &nearr;