Complete Draft 04 conformance alignment

[litzki-systems]

Summary

Complete the reference implementation and repository documentation alignment with the accepted draft-litzki-sovp-04 specification.

Protocol and implementation

• Enforce Draft 04 v2.0 freshness requirements, expiry, clock skew, and the 600-second issuance window through the merged reference implementation.
• Enforce host binding against the DNS resolution domain, including case and trailing-dot normalization.
• Use the URL hostname for DNS key references so canonical URLs with ports remain correctly bound to DNS.
• Restrict the well-known fallback to HTTP 404.
• Keep unverified-document resource limits before signature processing.
• Parse DNS TXT records using the exact v=SOVP1; k=<standard-base64> syntax and require a 32-byte Ed25519 public key.
• Preserve multi-record DNS key rotation with a maximum of four candidates.

Conformance coverage

• Add normative boundary tests for freshness clock skew and issuance limits.
• Verify that unknown top-level members remain inside the signed scope.
• Verify that contentAddress and scan remain outside the signed scope.
• Test host normalization and canonical URLs containing ports.
• Test malformed, truncated, extended, and invalid DNS TXT records.
• Keep the existing fixed cryptographic vectors intact.

Examples and deployment reference

• Update all current examples to Draft 04 terminology and behavior.
• Update the ARD trustManifest example to schema v2.0 and the current contentAddress shape.
• Replace the stale v1.4 static Cloudflare Worker artifact with a publisher-supplied, pre-signed Draft 04 v2.0 document delivered through SOVP_IDENTITY_JSON.
• Update security, contributing, README, and changelog documentation.

Explicit Draft 04 scope limits

Instance binding remains documented as an implementation limitation, consistent with Draft 04. Nonce deduplication remains a roadmap item. Mode B gateway enforcement remains outside the reference implementation.

Validation

GitHub Actions runs the complete test suite on Python 3.9, 3.11, and 3.13.