RFC-ATF-8: Agent Trust Fabric — OMNIX Governance Credential Public Verifier. W3C Verifiable Credential Interoperability, Standalone Offline Verification Protocol, and Adversarial Audit Standard for Governance Credentials

RFC-ATF-8 specifies the OMNIX Governance Credential Public Verifier (OGC-PV) — the eighth RFC in the ATF Open Standard series published by OMNIX QUANTUM LTD. RFC-ATF-8 answers the question implied by seven prior RFCs: by whom, using what tool, following what protocol, with what guarantees, can OMNIX governance credentials be independently verified? The answer is: any party, using verify_vc_offline.py, following the ten-check protocol specified herein, with the guarantees encoded in OGC-PV-INV-001 through OGC-PV-INV-010. Three gaps are closed: The Standalone Verification Gap: No documented protocol existed for external parties to verify OMNIX governance receipts with zero platform dependencies. RFC-ATF-8 provides verify_vc_offline.py — a single-file Python 3.8+ verifier, zero OMNIX module imports, ten verification checks (VV-001 through VV-010), machine-readable JSON output (--json), and deterministic exit codes (0=VALID, 1=INVALID, 2=usage error). OGC-PV-INV-008 specifies this exit code contract as immutable. The Adversarial Validation Gap: The VC interoperability layer had not been adversarially audited to the same standard as the governance engine. RFC-ATF-8 provides a formal 10-vector adversarial audit (A01–A10, 28 sub-checks) covering: credential forgery, content hash tampering, algorithm downgrade, cross-credential proof transplant, decision field flip, empty veto chain injection, W3C VC envelope extraction, schema bypass, TTL rollback, and ReceiptToVC idempotency. Result: 28/28 PASS, 0 FAIL, 0 pre-audit findings. The Public Interface Gap: Non-technical stakeholders had no zero-friction verification path. RFC-ATF-8 provides VCVerifierPage — a public React page at /vc-verify — with ten check cards, trust score, jurisdiction semantics, PQC proof display, and live revocation status. OGC-PV-INV-010 specifies the UI Truth Contract: no optimistic display, no client-side trust computation. The primary novel contribution is the Cross-Credential Proof Transplant Defense (OGC-PV-INV-007): When a W3C VC is provided, the verifier force-sets (not setdefault) receipt['content_hash'] = proof['signedData']. VV-002 then recomputes SHA-256 over the credential's payload and compares against the force-set value. If the proof was issued for a different receipt, VV-002 FAILs — without PQC library or network access. This defense is not present in any prior W3C VC verification specification known to the authors as of June 2026. Ten-check verification protocol: HARD checks (failure → overall=INVALID): VV-001 SCHEMA · VV-002 HASH · VV-003 DECISION · VV-004 VETO_CHAIN · VV-005 TTL Soft checks (failure → WARN/SKIP, not INVALID): VV-006 SIG_ALGO · VV-007 ISSUER · VV-008 PREV_HASH · VV-009 PQC_SIG · VV-010 REVOCATION VV-001 through VV-008 require zero network and zero third-party packages. VV-009 requires pypqc (pip install pypqc). VV-010 requires network (skipped with --no-network flag). W3C interoperability: ReceiptToVC wraps any OMNIX governance receipt into a W3C Verifiable Credential (JSON-LD) with DID anchor did:web:omnixquantum.net, ML-DSA-65 proof block, and W3C StatusList2021 credentialStatus. Ten regulatory framework jurisdiction semantics: EU AI Act · GDPR · UK AI Principles · US EO 14110 · CCPA · ISO 42001 · NIST AI RMF · Financial (MiFID II/FCA) · OHADA · APEC CBPR. 10 new invariants are introduced (OGC-PV-INV-001 through OGC-PV-INV-010), bringing the total ATF invariant count to 129 formally specified invariants across 22 protocol families. An implementation complying with RFC-ATF-1 through RFC-ATF-8 is designated ATF-OGC-Compliant — the eighth and current highest compliance tier in the ATF stack. Compliance hierarchy: ATF-ID-Compliant → … → ATF-SCGC-Compliant (119 inv.) → ATF-OGC-Compliant (129 inv.) Regulatory alignment: EU AI Act Art. 12 (tamper-evidence), Art. 13 (public verifier) · GDPR Art. 22 (automated decisions) · NIST AI RMF GOVERN 1.1 · W3C StatusList2021. Related ADR: ADR-214 (OGC Public Verifier). Test suite: tests/test_vc_interop.py (96 tests, all PASS). Standalone verifier: scripts/verify_vc_offline.py. Adversarial audit: scripts/audit_vc_adversarial.py (28/28 PASS).