Verify without trusting us
A specification is worth exactly what an independent implementation can reproduce from it. Below are the three ecosystems and the one thing each of them asserts.
Three commands
# Rust
cargo add rttp
cargo test
# Python
pip install rttp && python -m rttp.selftest
# JavaScript
npm install @aicent/rttp && npx @aicent/rttp
The bytes being checked
One file ships in all three packages, unchanged. Check it before you trust anything below:
| Item | Value |
|---|---|
| File | vectors/rttp-conformance-v1.2.6.json (in the npm package: src/vectors.json) |
| Size | 13,460 bytes |
| SHA-256 | 4b743e633941d4bc9c0eea17013d8c5619e73b9616dea2fe2877e47f9bc48c27 |
| Self-check | python vectors_manifest.py --check vectors.manifest.json — the crate ships a manifest that re-derives the byte count and hash |
The same vector bytes are shipped in every package, so one hash covers all mirrors of one protocol. A hash mismatch means you are not looking at the published set — stop there and tell us.
What the replay covers
Counted from that file, not from our prose:
| Key | Count |
|---|---|
| positive_uris | 6 |
| negative_uris (fail-closed rejections) | 15 |
| frame_vectors | 3 |
| compat_vector_spec_rev_0 | 1 |
| negative_frames (expected=reject) | 9 |
| positive_frames (expected=accept) | 1 |
| envelope_vector | 1 |
Total items: 36. The public conformance challenge
counts this same set as 35 vectors — the difference is the single backward-compatibility vector above
(compat_vector_spec_rev_0), which is shipped but not part of the challenge set.
The Rust, Python and JavaScript implementations share no code and agree byte for byte on this same file.
Protocol revision vs package version
The file is named v1.2.6 because it is generated against protocol revision v1.2.6;
the packages carrying it are version 1.3.1. The two numbers are different counters on purpose —
a package release may ship the protocol revision it was generated from. Every entry above also carries
frame_size 128, action_max_len 16 and the rule
ROUTE_SHARD = SHA-256(ASCII(canonical_authority))[0:16], which you can check against the
URI grammar.
Write your own
Take the grammar and the vectors and implement them in any language. If your implementation does not replay byte for byte, that is our bug, not yours — report it at lee@aicent.com.
Public third-party challenge: iqa.org/challenge — 35 vectors, any language, byte for byte.
What is deliberately not asked of you
- No account, no API key, no telemetry.
- No network calls during verification — the address is derived, not looked up.
- No trust in this site: the packages and the registry links above are third parties.