diff --git a/spec/cache-key-format.md b/spec/cache-key-format.md
index 483fdfd..172bc7d 100644
--- a/spec/cache-key-format.md
+++ b/spec/cache-key-format.md
@@ -6,7 +6,7 @@
 
 **Deterministic key generation from function identity and arguments.**
 
-*Protocol Version 1.0 · Verified against `cachekit-py` v0.5.0 (`src/cachekit/key_generator.py`)*
+*Protocol Version 1.0 · Verified against `cachekit-py` v0.12.0 (`src/cachekit/key_generator.py`)*
 
 </div>
 
@@ -18,6 +18,7 @@
 - [Cross-SDK Key Generation Strategy](#cross-sdk-key-generation-strategy)
 - [Argument Hashing Algorithm](#argument-hashing-algorithm)
 - [Character Normalization](#character-normalization)
+- [Test Vectors](#test-vectors)
 - [Pseudocode for SDK Implementors](#pseudocode-for-sdk-implementors)
 
 ---
@@ -188,6 +189,14 @@ After key construction, the following characters are replaced:
 
 ---
 
+## Test Vectors
+
+[`test-vectors/cache-keys.json`](../test-vectors/cache-keys.json) contains 10 auto-mode key vectors (`args` + `kwargs` + metadata → `expected_key`) covering primitives, mixed args/kwargs, `null`, booleans, nested dicts, and the no-namespace form. Keys were generated at top level, so the `func:` segment is `__main__.{qualname}` — cross-SDK implementations substitute their own module path; only the args-hash segment must match byte-for-byte.
+
+Enforcement: the vectors are vendored (sha256-pinned) into cachekit-py and byte-verified against `CacheKeyGenerator` on every default CI run (`tests/unit/protocol/test_cache_key_vectors.py`). A vector failing there is a key-stability break to triage — never silently regenerate: a changed key orphans every existing cache entry and turns the fleet's hits into billed misses.
+
+---
+
 ## Pseudocode for SDK Implementors
 
 <details>
diff --git a/test-vectors/cache-keys.json b/test-vectors/cache-keys.json
index b63fbe6..304fae8 100644
--- a/test-vectors/cache-keys.json
+++ b/test-vectors/cache-keys.json
@@ -1,6 +1,7 @@
 {
   "version": "1.0.0",
-  "generator": "cachekit-py v0.5.0",
+  "generator": "cachekit-py v0.12.0",
+  "ci_verification": "Vendored (sha256-pinned) and byte-verified against CacheKeyGenerator in cachekit-py default CI: tests/unit/protocol/test_cache_key_vectors.py",
   "note": "Keys include __main__ module because vectors were generated at top level. Cross-SDK implementations should substitute their own module path \u2014 only the args hash portion must match.",
   "key_format": "ns:{namespace}:func:{module}.{qualname}:args:{blake2b_256_hex}:{ic_flag}{serializer_code}",
   "hash_algorithm": "blake2b-256 of msgpack([normalized_args, sorted_kwargs])",