Repository navigation
feat(validator): read stream stamps from aid.stream as well as cpex.stream - #601
Merged
Merged
Conversation
…tream Emitters that target the AI Identity platform and OCSF rather than a gateway write AID-EMIT-1 stream stamps under AI Identity's own vocabulary, unmapped."aid.stream", proposed for AID-EMIT-1 as a 1.2.0 vocabulary profile. The CPEX host family keeps unmapped."cpex.stream". scripts/aid_emit1_validator.py looked only at cpex.stream, so an aid record's stream was never checked. It now looks up aid.stream first, then cpex.stream (STREAM_STAMP_KEYS), so GAP-STREAM, W-STREAM-HEAD and E-STREAM-ORDER cover both. A record carrying both keys is read from aid.stream and warned as W-STREAM-VOCAB. cpex records validate exactly as before. Matches the platform ingest change. The validator's tests run against its synced copy in the platform repository: an aid story validates with signatures, an aid gap and a non-zero aid head are surfaced, and both keys are warned with aid.stream read.
Levaj2000
marked this pull request as ready for review
October 12, 2026 21:08
Levaj2000
added a commit
that referenced
this pull request
Oct 12, 2026
main gained #601 and #602, which both added CHANGELOG entries at the top of Unreleased, so CHANGELOG.md conflicted. Resolved by taking main's CHANGELOG and re-adding this PR's one entry under Added. Also formats the EmitterConfig example in docs/specs/aid-emit-py.md the way ruff 0.16.9 (pinned in requirements-dev.txt) does: it formats Python code blocks inside Markdown, and ruff format --check failed CI on it. Content unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
scripts/aid_emit1_validator.pyread stream stamps only fromunmapped."cpex.stream". Emitters that target the AI Identity platform and OCSF rather than a gateway (the LiteLLM adapter designed in #600) write them under AI Identity's own vocabulary,unmapped."aid.stream", so their streams were never checked.STREAM_STAMP_KEYS = ("aid.stream", "cpex.stream"): stamps are read fromaid.stream, elsecpex.stream.GAP-STREAM,W-STREAM-HEADandE-STREAM-ORDERnow cover both vocabularies.aid.streamand warned asW-STREAM-VOCAB(a warning, not an error: the record is well-formed, but two sets of stamps let a SIEM and a verifier read different sequences).unmappedno longer raises inside the chain check.cpexvocabulary, including every committed vector, validate exactly as before.Matches the platform ingest change, which reads the same two keys in the same order and records the same both-keys case as an anomaly.
Testing
The validator has no tests in this repository; they run against its synced copy in the platform repository, which takes this file over unmodified once it merges. Run there against this exact file:
aid.streamstory validates with signatures; anaid.streamgap is aGAP-STREAMerror under--strict-gaps; a non-zeroaid.streamhead isW-STREAM-HEAD; both keys present isW-STREAM-VOCAB, withaid.streamread (a deliberately gappedcpex.streamcopy opens no gap);aidstory) guards against false alarms;21 passed.ruff checkandruff format --checkpass on the edited file under this repo's config.