docs(spec): add IC-TDF v1alpha specification suite by dmihalcik-virtru · Pull Request #3907 · opentdf/platform

dmihalcik-virtru · 2026-08-20T12:51:05Z

Stacked on #3887.

Proposed Changes

Reorganize the IC XML Data Encoding Specification for Trusted Data Format, IC-TDF.XML.V2014-DEC-r2017-JUL, into parallel BaseTDF-style components under spec/ictdf/v1alpha.
Preserve the XML vocabulary, schema, controlled vocabularies, constraint rules, and validation semantics. The refactoring changes document ownership only.
Cover the full normative surface: the IC-TDF.xsd structure, all three CVEs, all 49 Schematron constraint rules, the TDO/TDC object model, assertion scope and transitivity, binding coverage, layered encryption, and the multi-pass conformance procedure.
Add two documents with no BaseTDF counterpart: ICTDF-SCP for the assertion scope algebra (scope determines binding coverage in IC-TDF, so it is load-bearing rather than an assertion property) and ICTDF-VAL for the four-to-five step validation procedure over foreign-namespace content.
Add an OpenTDF interoperability profile and an IC-TDF/BaseTDF migration guide.
List the BinaryTDF and IC-TDF suites in spec/README.md, which previously referenced neither.

Module layout

Layer	Documents
Foundation	SEC, ALG
Model	MTD, SCP
Policy	POL
Operations	BND, KAO, KAS, PAY
Storage	LOC, PKG
Schema	SCH
Assembly	VAL, CORE
Examples	EX
Profile and guide	ICTDF-OPENTDF, ICTDF-MIG

ICTDF-BND covers the signature half of BaseTDF-ASN. IC-TDF has no INT counterpart: it defines no segmentation and no per-segment integrity, so payload integrity comes from the encryption method or from binding coverage. The suite README states these boundaries explicitly.

Notes for reviewers

The source specification permits several things a current spec should not bless: SHA1 and SHA1with* in the signature CVE, AttachedKey, and examples using @algorithm="AES" (a family, not a mode) and a literal normalizationMethod="Normalization Method" placeholder. Those are reproduced faithfully in ICTDF-EX and annotated as not production-safe, and ICTDF-SEC/ICTDF-ALG mark SHA-1 and AttachedKey as MUST NOT produce. That security guidance is an addition to the source and is scoped to guidance, not wire format.

ICTDF-KAS documents what IC-TDF actually carries — RemoteStoredKey/@protocol and @uri, WrappedPDPKey/EncryptedPolicyObject — and states explicitly that IC-TDF defines no key-release protocol.

Source: DI2E ICS-Data_Standards, Public Release, available for use without restriction.

Checklist

I have added or updated unit tests (not applicable: documentation only)
I have added or updated integration tests (not applicable: documentation only)
I have added or updated documentation

Testing Instructions

Documentation-only change. Verified that all 49 source rule IDs (00001-00019, 00025-00028, 00030-00055) appear in the ICTDF-SCH catalog with no gaps or extras, that every IC-TDF-ID-* cited across the suite is a valid rule, that all relative Markdown links resolve, and that all 17 ICTDF-* cross-references name real modules. No Go changes, so make lint and make fmt do not apply; the repository has no Markdown linter.

coderabbitai · 2026-08-20T12:51:16Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 88e8ec94-9501-4d65-bc57-71e86f96b6de

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-20T12:57:11Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	222.977857ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	120.901873ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	422.177912ms
Throughput	236.87 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	46.57880877s
Average Latency	465.026975ms
Throughput	107.34 requests/second

github-actions · 2026-08-20T13:05:59Z

github-actions · 2026-08-20T21:36:42Z

X-Test Failure Report

✅ go@pull-3907-pull-3907
✅ go@main-pull-3907
✅ go@pull-3907-main
✅ js@main-v0.9.0
✅ js@main-pull-3907
✅ go@main-main
✅ java@main-v0.9.0
✅ java@main-pull-3907
✅ java@main-main
cukes-report
✅ js@main-main
server-logs-go@main-v0.9.0
opentdf~~platform~~NSL2VJ.dockerbuild
govulncheck-failure-5
govulncheck-failure-8
govulncheck-failure-0
govulncheck-failure-1
govulncheck-failure-4

github-actions · 2026-08-21T01:30:43Z

X-Test Failure Report

github-actions · 2026-08-21T01:36:39Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	219.988841ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	119.279741ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	411.696381ms
Throughput	242.90 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.360129878s
Average Latency	442.859071ms
Throughput	112.71 requests/second

github-actions · 2026-08-21T01:36:42Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	212.186117ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	125.439027ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	431.047935ms
Throughput	231.99 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.174342809s
Average Latency	440.930148ms
Throughput	113.19 requests/second

github-actions · 2026-08-21T01:45:59Z

github-actions · 2026-08-21T02:16:33Z

X-Test Failure Report

github-actions · 2026-08-21T02:22:13Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	216.019286ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	120.707783ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	434.034004ms
Throughput	230.40 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.988859533s
Average Latency	449.309235ms
Throughput	111.14 requests/second

github-actions · 2026-08-21T02:22:23Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	204.07528ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	125.77988ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	437.497203ms
Throughput	228.57 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.489144337s
Average Latency	434.237063ms
Throughput	114.97 requests/second

github-actions · 2026-08-21T02:24:03Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

examples
otdfctl
sdk
service
lib/ocrypto
lib/fixtures
tests-bdd

See the workflow run for details.

github-actions · 2026-08-21T02:31:42Z

github-actions Bot added the size/xl label Aug 20, 2026

dmihalcik-virtru force-pushed the ictdf/spec-v1alpha branch from 444c636 to bc14a41 Compare August 20, 2026 21:21

dmihalcik-virtru mentioned this pull request Aug 20, 2026

docs(spec): add NanoTDF v1alpha specification suite #3909

Draft

3 tasks

dmihalcik-virtru force-pushed the binarytdf/spec-v1alpha branch from eacb646 to b25dc4f Compare August 21, 2026 01:30

dmihalcik-virtru force-pushed the ictdf/spec-v1alpha branch from bc14a41 to 27527de Compare August 21, 2026 01:30

docs(spec): add IC-TDF v1alpha specification suite

b2c8109

dmihalcik-virtru force-pushed the ictdf/spec-v1alpha branch from 27527de to b2c8109 Compare August 21, 2026 02:16

Uh oh!

Conversation

dmihalcik-virtru commented Aug 20, 2026

Proposed Changes

Module layout

Notes for reviewers

Checklist

Testing Instructions

Uh oh!

coderabbitai Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Aug 20, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Aug 20, 2026

X-Test Results

Uh oh!

github-actions Bot commented Aug 20, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Aug 21, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Aug 21, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Aug 21, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Aug 21, 2026

X-Test Results

Uh oh!

github-actions Bot commented Aug 21, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Aug 21, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Aug 21, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Aug 21, 2026

⚠️ Govulncheck found vulnerabilities ⚠️

Uh oh!

github-actions Bot commented Aug 21, 2026

X-Test Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Aug 20, 2026 •

edited

Loading