Run DIF did:webvh compliance test vectors; report divergences (#134)

[moisesja]

Reconnaissance pass on #134: replay the DIF didwebvh-test-suite committed vectors through our resolver and report divergences. Building the Docker harness that would register NetDid as implementations/dotnet/ is deliberately deferred until these findings are triaged.

Suite pinned at f792ce4 (2026-07-30).

Why this was worth doing

Every did:webvh test in this repo is self-generated — NetDid writes a log, NetDid reads it back. That shape passes even when the wire format is wrong for everyone else, which is exactly how #95 survived a fully green suite. This replays logs authored by six independent implementations instead.

It immediately found the same class of bug again (#135).

What's in the PR

tools/NetDid.Tools.WebVhVectors — replays committed vectors offline through DidWebVhMethod via a file-backed IWebVhHttpClient, and writes tasks/webvh-vector-divergence.md.

No src/ changes, no test-count change, no version bump. Findings are filed as issues; fixes are separate work.

• Suite cloned on demand to a gitignored path, not vendored — so its own CLAUDE.md and .claude/settings.json cannot be picked up as this repo's agent instructions, and its contents are treated as untrusted data (read as bytes, fed to the resolver, never executed).
• IsPackable=false, verified absent from dotnet pack output — publish.yml packs the whole solution, so this matters.
• Report carries no generation timestamp; re-running produces a byte-identical file (verified), avoiding the commit churn documented for w3c-conformance-report.md.
• Zero PackageReferences — the script.yaml scanner is hand-rolled to avoid adding a YAML dependency to solution-wide CPM, and is guarded by a self-check that cross-references every negative scenario's parsed expectError against the committed result, throwing rather than letting a parser bug masquerade as a conformance finding.

Results

88 happy-path replays (13 scenarios × 6 implementations, including historical versions) and 21 negative vectors.

Confirmed positive — our wire format interoperates

63 foreign logs accepted, with zero rejections attributable to a hash or signature mismatch. Resolution recomputes the SCID from the genesis preimage and every entry hash in the chain (LogChainValidator.cs:136-145, :194) and verifies eddsa-jcs-2022 proofs — so accepting a log authored by ts/rust/java/java-eecc/dart is direct evidence our encoding matches theirs. First independent confirmation of the #95 fix; settles #35.

All 21 negative vectors rejected, including path traversal, percent-encoded traversal, and percent-encoded IP-literal SSRF probes against 127.0.0.1 and the 169.254.169.254 cloud metadata endpoint.

Issues filed

#	Severity	Finding
#135	Critical	did-witness.json read/written with proofs; spec and all 6 implementations use proof
#136	High	Implicit #files / #whois services neither materialized nor resolvable
#137	Medium	didDocumentMetadata omits scid (unanimous) and versionNumber
#138	Medium	didDocumentMetadata.updated omitted at version 1
#139	Medium	Malformed/unsafe identifiers resolve as notFound instead of invalidDid

#135 is the #95 pattern repeating. WitnessValidator.cs:196 writes "proofs" and :272 reads it, so NetDid witness files round-trip against themselves while no witnessed DID interoperates in either direction. A blanket catch { return null; } at :263-266 swallows the KeyNotFoundException, which is why it stayed hidden. Two negative witness vectors currently pass vacuously — parsing fails before any witness security logic runs.

Evidence added to existing issues

• SCID generation does not match DIF Universal Resolver expectations (did:webvh spec version mismatch) #35 — recommended for closure, 63 foreign logs validate.
• Adopt current W3C DID Resolution error model: RFC 9457 error objects (INTERNAL_ERROR type URIs) and empty didDocumentMetadata on failure #123 — 20 of 21 negative vectors return a code the suite does not expect; invalidDidLog is one bucket for every hash, proof, parameter and timestamp failure.
• did:webvh: resolver does not enforce the spec's future-skew bound on versionTime (MUST fail beyond tolerance) #131 — not covered by this suite. The committed negative-versiontime-future log's tail is also non-monotonic, so our existing "strictly later than version N-1" rule rejects it before any future-skew bound applies. It passes for the wrong reason; did:webvh: resolver does not enforce the spec's future-skew bound on versionTime (MUST fail beyond tolerance) #131 stays open and unverified.

Not our defect

All 15 python logs are rejected because their verification methods omit controller. Our strictness is deliberate (#121) and backed by W3C DID Core §5.3.1, and 5 of 6 implementations emit it — didwebvh-py is the outlier. Worth reporting upstream; not filed, as that's an outward-facing action on a third-party repo.

Verification

• dotnet build netdid.sln -c Release → 0 warnings, 0 errors
• dotnet test netdid.sln -c Release → 1709 passed, 0 failed, 7 skipped (Ethr integration, Docker-gated); counts unchanged from main
• dotnet pack → 6 packages, tool absent
• Samples run end-to-end; w3c-conformance-report.md unchanged
• Two consecutive harness runs produce byte-identical reports

Reproduce:

git clone https://github.com/decentralized-identity/didwebvh-test-suite.git \
  tools/NetDid.Tools.WebVhVectors/suite
dotnet run --project tools/NetDid.Tools.WebVhVectors

Closes #134.

🤖 Generated with Claude Code