{
  "title": "RCO v1 signature test vectors (spec v1.1)",
  "date": "2026-08-29",
  "status": "TEST VECTORS ONLY - the key below exists only for these vectors, is published deliberately including its private part so implementers can reconstruct the signing inputs and verify every byte (ECDSA signatures are randomized; nothing claims byte-reproduction), and is on no production keyring; records here are never served",
  "profile": {
    "serialization": "detached JWS Compact Serialization (RFC 7515) with unencoded payload (RFC 7797)",
    "protected_header": {
      "alg": "ES256",
      "b64": false,
      "crit": [
        "b64"
      ],
      "kid": "gsc-rco-test-2026-08"
    },
    "protected_header_b64url": "eyJhbGciOiJFUzI1NiIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il0sImtpZCI6ImdzYy1yY28tdGVzdC0yMDI2LTA4In0",
    "signing_input": "ASCII(BASE64URL(UTF8(protected header)) || '.') || RFC 8785 canonical JSON of the record with the `signature` member removed",
    "signature_encoding": "ES256 raw R||S (64 octets, IEEE P1363), base64url",
    "signature_field": "BASE64URL(protected header) || '..' || BASE64URL(signature)  (payload detached)",
    "verification": "reconstruct the signing input from the received record minus `signature`, resolve the kid on the issuer JWKS taken from the signed issuer registry, verify ES256"
  },
  "jwks": {
    "keys": [
      {
        "kty": "EC",
        "x": "lMGKiZoo-uquJ4sJDQdcBnd3fYaX6og0MsJX3-eFuLE",
        "y": "BJclQL60yBBSK4eDdGmXzvglLQFRe28Ll_ptEZoQ8hw",
        "crv": "P-256",
        "kid": "gsc-rco-test-2026-08",
        "use": "sig",
        "alg": "ES256"
      }
    ]
  },
  "test_private_key_jwk": {
    "kty": "EC",
    "x": "lMGKiZoo-uquJ4sJDQdcBnd3fYaX6og0MsJX3-eFuLE",
    "y": "BJclQL60yBBSK4eDdGmXzvglLQFRe28Ll_ptEZoQ8hw",
    "crv": "P-256",
    "d": "ycfpc44q3EjZsQW4-SN5kXWq1K1x8DpvF133_QKFAzA"
  },
  "vectors": [
    {
      "vector": 1,
      "description": "CPG-200 ALLOW",
      "record": {
        "rco_version": "1.0",
        "issuer": {
          "id": "gsc-test",
          "rail": "bpc",
          "name": "GreenCore Solutions Corp. (test vector)"
        },
        "key_id": "gsc-rco-test-2026-08",
        "verification_url": "https://rco-a2a.ai/schema/v1.1/signature-test-vectors.json#jwks",
        "record_id": "rco:gsc-test:gtin:00990832300082:FR-ECO-10060:1",
        "object_id": "gtin:00990832300082",
        "jurisdiction": "FR-ECO-10060",
        "signal": "CPG-200",
        "state": "ALLOW",
        "resolved_at": "2026-08-29T12:00:00Z",
        "valid_until": "2026-09-29T12:00:00Z",
        "supersedes": null,
        "eco_ref": {
          "url": "https://fr-eco-10060.ai/eco/00990832300082.json",
          "hash": "sha256:def19cbefd2c28db6f876de01fd1bef43ce0fd1f82130fa4fb004890d093d40b"
        },
        "rule_set": {
          "id": "FR-ECO-10060",
          "version": "2026.08",
          "hash": "sha256:c362c17263cf25afd0b5cde8ad3d67c7185f9a2c4abcefe5a06c211701f123f5",
          "effective_from": "2026-08-01T00:00:00Z"
        },
        "evidence_refs": [],
        "signature": "eyJhbGciOiJFUzI1NiIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il0sImtpZCI6ImdzYy1yY28tdGVzdC0yMDI2LTA4In0..RiScTPi9FgmH3Gd1CXofjOcuOQnXAoAApC4u0rKtJ9Jag9T_1XDWkCZtHg30pe6XU3itak7DYGowvzjK2dGNjg"
      },
      "canonical_signing_payload": "{\"eco_ref\":{\"hash\":\"sha256:def19cbefd2c28db6f876de01fd1bef43ce0fd1f82130fa4fb004890d093d40b\",\"url\":\"https://fr-eco-10060.ai/eco/00990832300082.json\"},\"evidence_refs\":[],\"issuer\":{\"id\":\"gsc-test\",\"name\":\"GreenCore Solutions Corp. (test vector)\",\"rail\":\"bpc\"},\"jurisdiction\":\"FR-ECO-10060\",\"key_id\":\"gsc-rco-test-2026-08\",\"object_id\":\"gtin:00990832300082\",\"rco_version\":\"1.0\",\"record_id\":\"rco:gsc-test:gtin:00990832300082:FR-ECO-10060:1\",\"resolved_at\":\"2026-08-29T12:00:00Z\",\"rule_set\":{\"effective_from\":\"2026-08-01T00:00:00Z\",\"hash\":\"sha256:c362c17263cf25afd0b5cde8ad3d67c7185f9a2c4abcefe5a06c211701f123f5\",\"id\":\"FR-ECO-10060\",\"version\":\"2026.08\"},\"signal\":\"CPG-200\",\"state\":\"ALLOW\",\"supersedes\":null,\"valid_until\":\"2026-09-29T12:00:00Z\",\"verification_url\":\"https://rco-a2a.ai/schema/v1.1/signature-test-vectors.json#jwks\"}",
      "sha256_of_canonical_payload": "sha256:bf5a2fb41cd82bea0e9688aa77ba52280a64596f00c4068a5306c0e3326674a1"
    },
    {
      "vector": 2,
      "description": "CPG-300 CONDITIONAL with structured conditions",
      "record": {
        "rco_version": "1.0",
        "issuer": {
          "id": "gsc-test",
          "rail": "bpc",
          "name": "GreenCore Solutions Corp. (test vector)"
        },
        "key_id": "gsc-rco-test-2026-08",
        "verification_url": "https://rco-a2a.ai/schema/v1.1/signature-test-vectors.json#jwks",
        "record_id": "rco:gsc-test:gtin:00990832300082:DE-ECO-10060:1",
        "object_id": "gtin:00990832300082",
        "jurisdiction": "DE-ECO-10060",
        "signal": "CPG-300",
        "state": "CONDITIONAL",
        "conditions": [
          {
            "code": "LABEL-DE-01",
            "ref": "https://de-eco-10060.ai/rules/2026.08#LABEL-DE-01"
          }
        ],
        "resolved_at": "2026-08-29T12:00:00Z",
        "valid_until": "2026-09-29T12:00:00Z",
        "supersedes": null,
        "eco_ref": {
          "url": "https://de-eco-10060.ai/eco/00990832300082.json",
          "hash": "sha256:9ced52e314705ccb258a9d777735bf0d356811a55e3864720ea48dedd18d3326"
        },
        "rule_set": {
          "id": "DE-ECO-10060",
          "version": "2026.08",
          "hash": "sha256:ee5b77cced6503358f7ca955d6a3c3dc9d28d90c14c2ad88eece33518d226f35",
          "effective_from": "2026-08-01T00:00:00Z"
        },
        "evidence_refs": [
          {
            "kind": "esg-credential",
            "url": "https://de-esg-cpg.org/credentials/test-vector.json",
            "hash": "sha256:b0a908413e5e217972b3b7d644cee0246f93513834876e3fe5852056b9977dea"
          }
        ],
        "signature": "eyJhbGciOiJFUzI1NiIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il0sImtpZCI6ImdzYy1yY28tdGVzdC0yMDI2LTA4In0..dH9rKL47n-Q5_LpEElKuqrF0a3ZgwXtT0gavd6EW6k_-47SJ1T5HVmLW5opa8Q8WogcMYblFF6xD7pwzf_Yxhw"
      },
      "canonical_signing_payload": "{\"conditions\":[{\"code\":\"LABEL-DE-01\",\"ref\":\"https://de-eco-10060.ai/rules/2026.08#LABEL-DE-01\"}],\"eco_ref\":{\"hash\":\"sha256:9ced52e314705ccb258a9d777735bf0d356811a55e3864720ea48dedd18d3326\",\"url\":\"https://de-eco-10060.ai/eco/00990832300082.json\"},\"evidence_refs\":[{\"hash\":\"sha256:b0a908413e5e217972b3b7d644cee0246f93513834876e3fe5852056b9977dea\",\"kind\":\"esg-credential\",\"url\":\"https://de-esg-cpg.org/credentials/test-vector.json\"}],\"issuer\":{\"id\":\"gsc-test\",\"name\":\"GreenCore Solutions Corp. (test vector)\",\"rail\":\"bpc\"},\"jurisdiction\":\"DE-ECO-10060\",\"key_id\":\"gsc-rco-test-2026-08\",\"object_id\":\"gtin:00990832300082\",\"rco_version\":\"1.0\",\"record_id\":\"rco:gsc-test:gtin:00990832300082:DE-ECO-10060:1\",\"resolved_at\":\"2026-08-29T12:00:00Z\",\"rule_set\":{\"effective_from\":\"2026-08-01T00:00:00Z\",\"hash\":\"sha256:ee5b77cced6503358f7ca955d6a3c3dc9d28d90c14c2ad88eece33518d226f35\",\"id\":\"DE-ECO-10060\",\"version\":\"2026.08\"},\"signal\":\"CPG-300\",\"state\":\"CONDITIONAL\",\"supersedes\":null,\"valid_until\":\"2026-09-29T12:00:00Z\",\"verification_url\":\"https://rco-a2a.ai/schema/v1.1/signature-test-vectors.json#jwks\"}",
      "sha256_of_canonical_payload": "sha256:a40c27b90b28136a8e49d63f644e97f2f89d6d1e0fe30c8c81a6be67068e1c33"
    },
    {
      "vector": 3,
      "description": "CPG-404 NOT_FOUND with eco_ref null",
      "record": {
        "rco_version": "1.0",
        "issuer": {
          "id": "gsc-test",
          "rail": "bpc",
          "name": "GreenCore Solutions Corp. (test vector)"
        },
        "key_id": "gsc-rco-test-2026-08",
        "verification_url": "https://rco-a2a.ai/schema/v1.1/signature-test-vectors.json#jwks",
        "record_id": "rco:gsc-test:gtin:00990832300099:FR-ECO-10060:1",
        "object_id": "gtin:00990832300099",
        "jurisdiction": "FR-ECO-10060",
        "signal": "CPG-404",
        "state": "NOT_FOUND",
        "resolved_at": "2026-08-29T12:00:00Z",
        "valid_until": "2026-09-29T12:00:00Z",
        "supersedes": null,
        "eco_ref": null,
        "rule_set": {
          "id": "FR-ECO-10060",
          "version": "2026.08",
          "hash": "sha256:c362c17263cf25afd0b5cde8ad3d67c7185f9a2c4abcefe5a06c211701f123f5",
          "effective_from": "2026-08-01T00:00:00Z"
        },
        "evidence_refs": [],
        "signature": "eyJhbGciOiJFUzI1NiIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il0sImtpZCI6ImdzYy1yY28tdGVzdC0yMDI2LTA4In0..EHDpFOS2KxsWH5ErbtY4BzN_PQziKMy3LxBMlOzTANUapym8sKjmzA05wQPeuBNwunLTCKWrv3KosseS7n0P_A"
      },
      "canonical_signing_payload": "{\"eco_ref\":null,\"evidence_refs\":[],\"issuer\":{\"id\":\"gsc-test\",\"name\":\"GreenCore Solutions Corp. (test vector)\",\"rail\":\"bpc\"},\"jurisdiction\":\"FR-ECO-10060\",\"key_id\":\"gsc-rco-test-2026-08\",\"object_id\":\"gtin:00990832300099\",\"rco_version\":\"1.0\",\"record_id\":\"rco:gsc-test:gtin:00990832300099:FR-ECO-10060:1\",\"resolved_at\":\"2026-08-29T12:00:00Z\",\"rule_set\":{\"effective_from\":\"2026-08-01T00:00:00Z\",\"hash\":\"sha256:c362c17263cf25afd0b5cde8ad3d67c7185f9a2c4abcefe5a06c211701f123f5\",\"id\":\"FR-ECO-10060\",\"version\":\"2026.08\"},\"signal\":\"CPG-404\",\"state\":\"NOT_FOUND\",\"supersedes\":null,\"valid_until\":\"2026-09-29T12:00:00Z\",\"verification_url\":\"https://rco-a2a.ai/schema/v1.1/signature-test-vectors.json#jwks\"}",
      "sha256_of_canonical_payload": "sha256:65e1ab9975fd658086fdeaa8bdfc03181ea0b74f69b02e8871a200be7e1e4ac1"
    }
  ]
}