iqa-org v1.3.1 reference implementation — scope, conformance, and what comes next

This repository is the reference implementation for the rttp/iqa addressing and attestation scheme specified in draft-li-rttp-iqa-addressing (IETF Independent Submission, in review), published as v1.3.1 across PyPI, npm and crates.io. Tooling that packages these primitives as MCP tools lives in the sibling iqa-mcp repo; the addressing scheme's design discussion lives in the sibling rttp repo.

The implementation covers three layers: addressing (deterministic intent-address derivation from an authority string — SHA-256, first 16 bytes, no registry), the 128-byte AE-128 attestation envelope (layout: magic, version/alg/flags, lease, subject shard, attestation, organ, nonce, standing, reserved, extension), and verification (constant-time full-frame HMAC-SHA256 with lease check; fail-closed on any mismatch, including standing revocation to Ghost).

Conformance is byte-checkable: published_vector in the companion iqa-mcp package ships fixed test vectors, and every derivation in the spec examples is reproducible with nothing but the draft text and a SHA-256 implementation.

Open threads for this discussion: cross-language vector parity (Python / TypeScript / Rust), the standing-state semantics (Ghost / Probation / Radiant / Genesis), lease-window conventions, and what v1.4 should and should not add — the current honest boundary is that delegation is intentionally unspecified in v1.3.x.