The bytes all three projects must agree on.

One profile, three projects

The profile pins six families of behaviour, one directory of vectors each. A vector is a JSON file naming its input and its expected output — canonical bytes, a digest, an error class — and it is frozen once merged.

A complete vector — jcs/basic-ordering:

{
  "name": "jcs/basic-ordering",
  "description": "object keys serialize in sorted order regardless of input order",
  "input": { "value": { "b": 2, "a": 1, "c": [3, "x"] } },
  "expected": {
    "canonical": "{\"a\":1,\"b\":2,\"c\":[3,\"x\"]}",
    "sha256_hex": "7f26f35fd8404944dd9a2441528c810b6c55fb2ae7b569b0438d309d81806acf"
  }
}

Strict I-JSON acceptance

A request body is a single UTF-8 I-JSON text within hard caps, checked in this order. The first failure names the error class, and the order-3 classes surface in token order during one parse — an early duplicate key beats a later unsafe number.

Within a single member-name token, the reserved-name check precedes the duplicate check. Implementations must process tokens iteratively: input nested thousands of levels deep — bounded only by the size cap — may never crash a rederiver, and the depth cap is enforced after the scan rather than by running out of stack. A vector pins exactly that pathological case. Responses follow the same rules under the 1,048,576-byte cap, and a vector opts into that context explicitly.

Canonical bytes, and the $domain tag

Canonical bytes are RFC 8785 JCS over exactly the value space the acceptance rules admit: object keys sorted by UTF-16 code units, numbers in ECMAScript minimal form, short escapes plus \u00xx for the remaining C0 controls, everything else literal UTF-8. Key sorting by UTF-16 code units is not the same as UTF-8 byte order — an astral key sorts as its surrogate pair — and a vector pins that difference rather than leaving it to be discovered.

Type-tagged bytes inject a reserved top-level member and then canonicalize:

tagged(tag, obj) = JCS(obj ∪ {"$domain": tag})   # obj must not carry $domain

$domain (0x24) sorts before every letter, so the tag always leads the canonical bytes. It is reserved at every depth of wire bodies and fails closed on collision, which is why it can never be smuggled in as data. This mirrors kovee's own $domain envelope member so the tag namespace is shared while the byte layouts stay distinct.

RFC 9457 problems, and deliberate non-substitutability

Byom's problem object requires type, title and kind; type is exactly https://byom.dev/problems/ + kind. Extension members are allowed only under reverse-domain names, and they carry no authority.

Byom and kovee both emit RFC 9457 problems and their conventions diverge on purpose. A validator that accepts the other project's spelling or namespace fails these vectors' intent.

There is no translation table, and no value from one convention ever satisfies a field of the other, even for semantically matching errors.

The six digest classes

Every digest field on the wire is a typed DigestRef with a closed member set, never an unlabelled hash:

{ "class": "local_erasure_safe", "algorithm": "hmac-sha-256",
  "key_ref": "society-key:soc-garden/object:engram-42", "value_hex": "…" }

Exactly class, algorithm, value_hex, plus key_ref — and nothing else. Class and algorithm pairing is closed; key_ref is required exactly for the keyed classes and forbidden for the public ones; value_hex is exactly 64 lowercase hex characters. Raw keys, per-object secrets and salts are never part of a ref, and a member whose name looks like key material fails closed.

The classes are never interchangeable. A well-constructed digest of the wrong class is digest_class_mismatch even when the 32-byte value spaces coincide, and the vectors pin the complete ordered substitution matrix with values that are arithmetically correct under the class they are offered as — so every rejection is proven to be a typing decision rather than a wrong-bytes accident.

The two keyed classes are mutually non-substitutable for a concrete reason. Erasing one object must destroy exactly that object's verifiability, so an authority subject takes a per-object secret. Verifying an index or a chain must survive the erasure of one member, so the index takes a per-scope key. Swapping them silently changes what "delete this" means.

The A8 cross-boundary rule

This is the profile's newest rule and the only one found by running code rather than by review. Wiring kovee's episode pipeline to a real byomd found that byom was demanding four keyed digests from kovee — values kovee could only echo as opaque blobs, one of which was obtainable in practice only by reading byom's database — and that a fifth digest byom required at placement was published nowhere at all.

A portable_public field does not mean "trust what the peer sent". The receiving side rebuilds the frozen fragment from its own committed state and refuses a value that does not re-derive. A digest that is merely stored because a caller sent it is asserted, not verified — even when its class is right.

Byom's applied instances each name a $domain tag and an exact, closed member list; widening or narrowing that list changes the digest and is a wire change on both sides.

Idempotency domains

Byom's idempotency domain is {actor_binding_digest, operation, endpoint_incarnation, society_id, society_recovery_epoch, idempotency_key}, digested as HMAC-SHA-256(per-society index key, tagged("bpp-idempotency-domain-v1", domain)) and emitted as a scope_erasure_safe ref.

It is keyed because the domain embeds an actor binding and a caller-chosen key — erasable, low-entropy material that must never carry a public hash. It is scope-keyed rather than object-keyed because the index key is one key across every entry: destroying it erases offline verifiability of the whole index, never a single entry. Saying so is the whole point of having six classes instead of one.

Kovee's command idempotency digest, by contrast, is a public structural SHA-256 over non-sensitive command material, and akson separates domains by DSSE payload type in the pre-authentication encoding rather than in JSON at all. All three are correct for their store, and a vector pins that no value from one ever satisfies a field of another — even byte-equal.

The privacy access chain

Allowed and denied sensitive reads both append to a hash-chained access record. The preimage members are exact and all required — society, access sequence, event id, endpoint incarnation, recovery epoch, actor binding, operation, purpose, query or scope digest, result object count, result bytes, outcome, dependency digest, occurred-at — plus the chain link, which at genesis is wholly absent: no member, never a null-valued pseudo-ref.

The record's own self-referential digest is excluded from its preimage, and a record that offers it inside the preimage fails closed. Both the record digest and the chain link are scope_erasure_safe under the chain key.

The release rule has two failure arms and neither of them serves bytes: an outcome other than allowed releases nothing and still chains a record; a failed journal commit releases nothing at all. Records carry cardinality and byte counts, never result plaintext.

Two independent rederivers

Every expected value in the corpus is re-derived from scratch by two programs that share no code and no dependencies — one Python stdlib only, one Node builtins only. Both go nonzero on any mismatch and on an empty vector tree, so a deleted corpus is a failure rather than a pass.

python3 family-vectors/xcheck.py           # exit 0 = every `expected` re-derived
node    family-vectors/tscheck/check.mjs   # the same, in a second language

Kovee and akson consume this directory through the family lock: their CI checks out the byom commit the manifest pins, asserts that the checked-out commit is that commit, and runs xcheck.py from that tree. A local copy alone is never provenance.