Vord

Architecture Decision Record

0025. Standards conformance posture

Context

Vord's external surface conforms to OIDC rather than innovates (ADR-0003), and a relying party verifies a Vord token with stock libraries. But claiming conformance and demonstrating it are different things, and competing with Entra/Okta/Auth0 requires the demonstration: a credible, public conformance story is to an identity provider what a clean Jepsen run or a passing conformance-vector suite is to Wyrd — a credibility artifact, not a marketing line. This ADR fixes the certification target, which also disciplines the flow set (ADR-0014): you can only certify what you actually ship.

Decision

  1. OpenID Connect conformance is the v1-era target for the OpenID Provider profiles Vord ships — at M4 exactly the basic and config OP profiles over the v1 flow set (ADR-0014); the dynamic profile requires Dynamic Client Registration, which ADR-0038 reserves rather than ships, so it joins the scope with the DCR milestone, per decision 4's certify-what-ships rule. The OpenID Foundation's conformance test suite is free and open, and is run in CI as the conformance gate — the identity analog of Wyrd's conformance-vector discipline (the format's "data outlives software" posture, ADR-0003, applied to the protocol surface). The official certification listing (a paid OpenID Foundation step) is optional — pursued only if/when funded or warranted for adoption, never a release gate; running the free suite is what the project depends on.

  2. FAPI 2.0 is a reserved roadmap target. Financial-grade API security (sender-constrained tokens via DPoP or mTLS, pushed authorization requests) requires the DPoP and PAR seats reserved in ADR-0014 — which is why they are reserved now. FAPI is not a v1 commitment, but the v1 token and request shapes are chosen so it remains reachable without a breaking change.

  3. SAML interoperability conformance is reserved with the SAML milestone (ADR-0017) — the SAML analog of OIDC certification, run when the IdP is built.

  4. Certify what ships, ship what certifies. The v1 certification scope is exactly the ADR-0014 flow set — no aspirational profiles certified, no shipped flow left uncertified. Scope grows by milestone (the OP profiles at M4, FAPI when DPoP/PAR are built, SAML interop with the IdP), each a stated definition of done in the implementation arc.

Consequences

  • Conformance is a CI gate and a public artifact, not a claim — the credibility a prospective adopter weighs Vord against Okta/Entra/Auth0 with.
  • The certification target retroactively justifies ADR-0014's reserved seats: DPoP and PAR are reserved precisely because FAPI needs them and a token-shape break to add them later would be unacceptable.
  • "Certify what ships" keeps the scope honest and bounded — no certifying a profile Vord does not implement, no shipping a flow Vord cannot stand behind.
  • Each conformance milestone (OIDC OP at M4, FAPI later, SAML interop with the IdP) is a definition-of-done in the arc, so conformance is sequenced with the build, not retrofitted at the end.