20260701 add validation-update-03 VRS mode

src/data_model/rc.rs

@@ -740,6 +740,29 @@ mod strict_name_tests {
         let err = validate_strict_rpki_name(&name, "subject").expect_err("strict name fails");
         assert!(err.to_string().contains("exactly once"), "{err}");
     }
+
+    #[test]
+    fn profile_rejects_rfc8360_v2_policy_oid() {
+        let extensions = RcExtensionsParsed {
+            basic_constraints_ca: vec![true],
+            subject_key_identifier: Vec::new(),
+            authority_key_identifier: Vec::new(),
+            crl_distribution_points: Vec::new(),
+            authority_info_access: Vec::new(),
+            subject_info_access: Vec::new(),
+            certificate_policies: vec![(vec!["1.3.6.1.5.5.7.14.3".to_string()], true)],
+            ip_resources: Vec::new(),
+            as_resources: Vec::new(),
+        };
+
+        let err = extensions
+            .validate_profile(true)
+            .expect_err("v2 policy OID must remain invalid");
+        assert!(
+            matches!(&err, ResourceCertificateProfileError::InvalidCertificatePolicy(oid) if oid == "1.3.6.1.5.5.7.14.3"),
+            "{err}"
+        );
+    }
 }
 
 impl ResourceCertificateParsed {