How we test an agent protocol

Start with a branch, not a JSON file

A single valid document only proves that one object has an accepted shape. HACP v0.3-candidate defines seven closed record schemas, then validates relationships across three manifest-declared branches: successful continuation, pre-start stop, and a later human response to that stop.

In the success example, the validator follows one task packet through an exact human decision, an admitted consumption receipt, continuation context, start evidence, and agent report. It recomputes RFC 8785 JCS digests and verifies that the same request, action, packet, scope, decision, successor, and timing boundaries survive the chain.

Then break one invariant at a time

The 22 negative cases are not malformed-JSON trivia. They model dangerous near-misses: stripped continuation context, stale replay, an expired or trusted-revoked decision, expanded successor scope, a claim recorded after start, a non-approval consumed as approval, a digest mismatch, records spliced across chains, and a loop ceiling exceeded.

Each case must fail with its exact diagnostic set. That matters because “invalid for some reason” is too weak for a control boundary. A scope expansion should not accidentally pass because an unrelated timestamp parser failed first.

The reproducible check

git checkout 671791f3e7568a57b8e97bea5ac7f8c9e7e74b06
npm ci
npm run hacp:v03-candidate
npm run hacp:v03-external -- --root fixtures/supplementary/v0.3-candidate/wits

At the pinned revision, the candidate suite passes 43/43. The external entry point first revalidates the canonical package and all 22 negatives, then checks a closed manifest, byte digests, schema pins, paths, record roles, three WITS bundles, and cross-record rules. The committed receipt records the bounded result.

Why the manifest is strict

The manifest pins the source packet, regeneration base, schema and validator digests, fixture inventory, valid bundle membership, and exact invalid expectations. Unsafe paths, undeclared JSON, unknown roles, duplicate membership, and unknown manifest versions fail closed. A flat fixture inventory is explicitly rejected as a semantic chain.

What this does not prove

• Passing conformance does not authenticate an issuer or grant authority.
• It does not prove runtime safety beyond the tested boundary.
• It does not prove agent comprehension, provider execution, or exactly-once external effects.
• The tests are local and synthetic.
• The public publication-readiness record preserves the known canonicalization and timestamp-provenance limitations.

Review the canonical manifest, negative corpus, and candidate tests.