{ "generated_at": "2026-10-14", "results": "one run of the suite in 17 jest batches, one after another against commit 576089807 with uncommitted changes: 2757 tests in 143 files (2757 passed, 0 failed)", "counts": { "PASSING": 223, "UNPROVEN": 0, "NO_TESTS": 15 }, "gate": "holds", "status_labels": { "Live": "Used in a live export with a customer, with passing conformance tests and a sample dossier.", "Beta": "Built and tested, and offered by arrangement; not yet used in a live export.", "Scaffolded": "A mapping and a sample exist as data; no export is built yet.", "Roadmap": "Planned; nothing is built yet.", "Not applicable": "The law does not cover this kind of product.", "Built": "Privacy test: the test as specified exists and passes.", "Planned": "Privacy test: part or none of it exists; the tests listed are the part that exists today." }, "claims": [ { "id": "CLM-01", "kind": "claim", "statement": "Open the dossier for a lot and check every party's records in your own browser: who signed each step, that nothing has changed since, that each party's records run without a gap, and that each handover was signed by the party that gave the lot and by the party that received it.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "verifies: every record, every party, every handover", "passed": true }, { "title": "one byte altered in a grower record: changed, and that record's signature line fails", "passed": true }, { "title": "two parties each with tenant_seq 5, the grower's missing: gap_in_sequence here, and no gap from the old single-tenant loop", "passed": true }, { "title": "the giver's proposal removed: handover_unmatched", "passed": true }, { "title": "the embedded sample is what the fixture builds, every check but the time passes, and a wrong seal number changes it", "passed": true } ], "evidence": "/provenance/samples/four-party-sample.json", "last_checked": "2026-10-13" }, { "id": "CLM-02", "kind": "claim", "statement": "The file is not sent anywhere.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "its only inline script is the version check, and every script it loads is on disk", "passed": true }, { "title": "the worker answers a verify message with the checker's result", "passed": true }, { "title": "the offline kit and the export name no network address and load no third-party host", "passed": true }, { "title": "verify.html loads only files beside it, runs no inline script, and nothing in the zip names a network address", "passed": true } ], "evidence": "/provenance-verify.html", "last_checked": "2026-10-13" }, { "id": "CLM-03", "kind": "claim", "statement": "Each record is signed by the party that made it, with that party's own key. The page checks every signature against the key in that party's key document, which travels in the file.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "one byte altered in a grower record: changed, and that record's signature line fails", "passed": true }, { "title": "the key the record names is tried first", "passed": true }, { "title": "a second document with another key listed first: unreadable, \"conflicting key documents\", naming the DID, never blaming a record", "passed": true }, { "title": "B forwards to C a pack whose A records B re-signed, with a DID document giving B's key as A's: C refuses it", "passed": true } ], "evidence": "/provenance/samples/tamper-sample.json", "last_checked": "2026-10-13" }, { "id": "CLM-04", "kind": "claim", "statement": "Each party numbers its own records in order and seals each day's records under one signed day root, which also states how many records the party made for each lot that day.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the three-lot tree: leaves in sortkey order B, A, C, the expected subroots, root, proofs and indices", "passed": true }, { "title": "two lots on one day: two leaves, each lot's count and subroot its own records', each leaf's proof walks to the signed root", "passed": true }, { "title": "the three-lot, two-lot, one-lot and empty trees", "passed": true }, { "title": "L0 the genuine multi-lot dossier verifies, and says each lot shown matches the count its party signed", "passed": true }, { "title": "the published lot commitment vectors: the checker's port gives every value, and accepts every published absence", "passed": true } ], "evidence": "/provenance/test-vectors.json", "last_checked": "2026-10-13" }, { "id": "CLM-05", "kind": "claim", "statement": "For every day root of a party in this file, the file must show either that party's records of the lot with the count it signed, or its signed statement that it made none that day; the page checks both. So a record of this lot cut from a day whose day root is in the file, or from between two records of a party's chain, is found.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "T1 two lots; X's records of its last day cut with their entry, the day root kept: not verified (incomplete, no count or absence for X under that day root); the last-holder line is dated from the day before", "passed": true }, { "title": "A8 the absence removed: incomplete, naming the party, the lot and day 2", "passed": true }, { "title": "L11 the subject lot's last grower record cut from the file: not verified, the count not met", "passed": true }, { "title": "L13 the entry for a shown lot removed: incomplete, naming the party and the lot", "passed": true }, { "title": "S1 a middle record of the lot removed from the selection: gap_in_sequence (the next record's link is broken)", "passed": true }, { "title": "an absence verifies in every gap: below the first leaf, between leaves, above the last", "passed": true } ], "evidence": "/provenance/test-vectors.json", "last_checked": "2026-10-13" }, { "id": "CLM-06", "kind": "claim", "statement": "A record in the file that no signed day root covers makes the file incomplete rather than verified.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "incomplete is tier 3, exit 3: below every finding that something is wrong, above every state where integrity holds", "passed": true }, { "title": "the line list names the party whose records are not covered, and the handover with no completion", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-07", "kind": "claim", "statement": "A handover is two records: the giving party's proposal and the receiving party's acceptance, both naming the same terms. The page checks that both are in the file and that each is signed by its own party.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "both parties end holding both signed records, each checkable under the other's published key", "passed": true }, { "title": "the giver's proposal removed: handover_unmatched", "passed": true }, { "title": "withdrawal and acceptance both present: handover_disputed, without choosing a winner", "passed": true }, { "title": "signed by another tenant's real key while claiming to be the giver", "passed": true }, { "title": "terms altered after signing (a later expiry)", "passed": true } ], "evidence": "/provenance/samples/four-party-sample.json", "last_checked": "2026-10-13" }, { "id": "CLM-08", "kind": "claim", "statement": "A seal, certificate or container number is recorded only as a salted fingerprint. Type the number you read on the seal, and the page tells you whether it is the one recorded.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a wrong seal number typed: changed, on that line; the right one matches", "passed": true }, { "title": "the embedded sample is what the fixture builds, every check but the time passes, and a wrong seal number changes it", "passed": true }, { "title": "the right number typed against a replaced salt: the line says the salt is unsigned and the record is not shown to have changed", "passed": true } ], "evidence": "/provenance/samples/four-party-sample.json", "last_checked": "2026-10-13" }, { "id": "CLM-09", "kind": "claim", "statement": "To know who a party is, compare the key fingerprint shown here with the one that party gives you directly.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "without the parties' fingerprints the headline is key_not_pinned, once per party, and nothing worse", "passed": true }, { "title": "verifies: every record, every party, every handover", "passed": true } ], "evidence": "/provenance/samples.json", "last_checked": "2026-10-13" }, { "id": "CLM-10", "kind": "claim", "statement": "Once this page has loaded, the check needs no network connection. The check is one script, which runs in your browser; nothing in the file you choose leaves your device.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "dossier.json from the zip verifies `verified` with the checker from the zip, run in Node from a folder of its own", "passed": true }, { "title": "the offline kit and the export name no network address and load no third-party host", "passed": true }, { "title": "its only inline script is the version check, and every script it loads is on disk", "passed": true } ], "evidence": "/downloads/provenance-verifier.js", "last_checked": "2026-10-13" }, { "id": "CLM-11", "kind": "claim", "statement": "Inclusion proofs. Where a party's records are in the file in full, the page rebuilds each day root from them, so a missing proof changes nothing.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "E1 proofs all removed (the ranges are rebuilt from the records)", "passed": true }, { "title": "S6 proofs stripped from the selection: incomplete, naming the party", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-12", "kind": "claim", "statement": "The readable copy of each record. It is there for display only; the signed bytes decide.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the readable copy: a copy that disagrees with the signed bytes is reported, never read in their place", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-13", "kind": "claim", "statement": "The date the file was put together. It is not signed and is not read.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the date the file was put together: any value, or none, gives the same result", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-14", "kind": "claim", "statement": "The names and types given to keys in a key document. Only the key itself is checked, against the fingerprint you give.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the type given to a key in a key document changes nothing; the key itself is held to the fingerprint", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-15", "kind": "claim", "statement": "Every step of an export chain — grower, processor, exporter, buyer — written to a tamper-evident, cryptographically sealed record. A buyer in Rotterdam or Singapore verifies the seal offline.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "verifies: every record, every party, every handover", "passed": true }, { "title": "one byte altered in a grower record: changed, and that record's signature line fails", "passed": true }, { "title": "the signed bytes are the record; receipt_version 1; the signature verifies", "passed": true }, { "title": "dossier.json from the zip verifies `verified` with the checker from the zip, run in Node from a folder of its own", "passed": true }, { "title": "the altered sample: one byte changed, and the checker says changed", "passed": true } ], "evidence": "/provenance/samples/tamper-sample.json", "last_checked": "2026-10-13" }, { "id": "CLM-16", "kind": "claim", "statement": "A buyer in Rotterdam or Singapore verifies the seal offline: no account on the seller’s platform, no take-our-word-for-it spreadsheet.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "dossier.json from the zip verifies `verified` with the checker from the zip, run in Node from a folder of its own", "passed": true }, { "title": "is registered with the orphan gate, the sitemap and the public-surface CSP, and the landing links to it", "passed": true } ], "evidence": "/provenance/samples/four-party-sample.json", "last_checked": "2026-10-13" }, { "id": "CLM-17", "kind": "claim", "statement": "Each party signs with its own key, or with key shares its own custodians hold, and keeps its own records. A buyer checks the file in a browser with no account on anyone’s platform. Separate nodes for parties that want to run their own are on the roadmap.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the landing's Provenance detail sheet carries the D9 sentences, and no longer says a platform sits in the middle or that every party holds a node", "passed": true }, { "title": "signed with the participants' shares only: no mandate, no mandate_ref, never the Village key", "passed": true }, { "title": "verify.html loads only files beside it, runs no inline script, and nothing in the zip names a network address", "passed": true }, { "title": "is registered with the orphan gate, the sitemap and the public-surface CSP, and the landing links to it", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-18", "kind": "claim", "statement": "Personal information is kept out of signed records: every field of a signed record is a closed list, a date, a digest, a DID or a six-digit tariff code, and the schema refuses to load a free-text field.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "adding a `str` field to a table stops the module loading", "passed": true }, { "title": "a `strarr` field, or a `str` inside a nested table, stops it too", "passed": true }, { "title": "an unknown key `lat` (top level, or in a location class): SCHEMA, attest never called, no row", "passed": true }, { "title": "a stored record from a lot that has a label carries neither, anywhere in the row", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-19", "kind": "claim", "statement": "A wrong step is put right by a correction that names it; the earlier record stays, and the check shows both.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a correction supersedes a step; the listing shows the step with its replacement; nothing is rewritten", "passed": true }, { "title": "S8 a superseded step is shown with the correction that replaced it", "passed": true }, { "title": "a correction naming a step already superseded is refused, and so is the race for it (FORK)", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-20", "kind": "claim", "statement": "One tenant's lots, chains and records are not readable by another tenant; an id from another tenant answers exactly as an unknown id does.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "tenant B asking for tenant A's lot is byte-identical to an unknown id, a malformed id and the gate", "passed": true }, { "title": "C cannot list A's or B's lots, chains or counterparties", "passed": true }, { "title": "tenant A cannot read tenant B's lot or chain", "passed": true }, { "title": "B's stored pack is invisible to C by every read the code offers", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-21", "kind": "claim", "statement": "The dossier a holder downloads carries the published checker, byte for byte, with its SHA-256, and a README in five languages.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "holds exactly the files of design 4 as amended, and the checker is the published one, matching its .sha256", "passed": true }, { "title": "the README is in five languages, repeats the checker's \"did not establish\" list, and carries no banned word", "passed": true } ], "evidence": "/downloads/provenance-verifier.js.sha256", "last_checked": "2026-10-13" }, { "id": "CLM-22", "kind": "claim", "statement": "When a lot passes from party to party, each giver sends its own signed records on with the lot, so the last holder's file shows every party back to the first, and an altered or substituted pack is refused.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "A -> B -> C: C's dossier headlines as a complete file does, no gap and no incomplete line; without the packs it does not", "passed": true }, { "title": "one byte of a signed record altered", "passed": true }, { "title": "a real pack for another of A's handovers to B, presented as this handover's", "passed": true }, { "title": "A -> B -> C -> D -> E -> F: the fifth pack goes without tokens, the sixth with only its giver's segment; each is stored and the dossier builds", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-23", "kind": "claim", "statement": "A party's chain that forks, with two records following the same one, is reported as changed when both branches are in the file.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "T6a both branches of the fork shown: changed, with a line saying the grower's chain forks", "passed": true }, { "title": "two children of one parent under a race: never two children of one parent, no hole", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-24", "kind": "claim", "statement": "A new lot can be derived from named input lots; the check rebuilds the lot graph and reports an input lot that is not in the file.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a derived lot from two open lots: origin derived, inputs from the caller's own rows, sorted; the graph is the checker's", "passed": true }, { "title": "A0 the unaltered derivation dossier verifies", "passed": true }, { "title": "A1 a derivation whose input lot is not in the file is incomplete, and the line names the input", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-25", "kind": "claim", "statement": "Each record is time-stamped by an outside authority, which sees only a fingerprint; when no authority answers, the record is still signed and says so, and a later day root carries the stamp.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a step is stamped: the record names the token, the token is kept under this tenant, and the authority saw only a digest", "passed": true }, { "title": "authority down: the step is still signed, with the operator_attested block, and its row is marked", "passed": true }, { "title": "steps signed while the authority was down are covered by a day root stamped once it answers, and the dossier verifies", "passed": true }, { "title": "A -> B -> C stamped throughout: C's dossier carries every party's tokens and verifies with every stamp checked", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-26", "kind": "claim", "statement": "The check returns a result for any file it is given, and refuses a file over 25 MB or over 20,000 records with a line stating the limit.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the checker returns a result, never a throw, for anything it is given", "passed": true }, { "title": "a file over 25 MB is unreadable, and a line states the limit", "passed": true }, { "title": "a file of more than 20,000 records is unreadable, and a line states the limit", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-27", "kind": "claim", "statement": "The format of the evidence bundle is published, with test vectors, and the published checker meets every vector.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "canonical JSON: the checker gives the published bytes for every accepted input and refuses every refused one", "passed": true }, { "title": "a record signature: the checker accepts the published signature, refuses the altered bytes, and meets RFC 8032 test 1", "passed": true }, { "title": "the day tree: the checker's root of 1, 2, 3 and 5 leaves, and every published proof walks to it with the checker's flags", "passed": true }, { "title": "the published files are what the builders write (vectors, specification)", "passed": true } ], "evidence": "/provenance/test-vectors.json", "last_checked": "2026-10-13" }, { "id": "CLM-28", "kind": "claim", "statement": "The checker's SHA-256 is published, and a copy of it can be hashed with any SHA-256 tool and compared.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the checker's published SHA-256 is the hash of the file, and the specification states it", "passed": true }, { "title": "holds exactly the files of design 4 as amended, and the checker is the published one, matching its .sha256", "passed": true } ], "evidence": "/downloads/provenance-verifier.js.sha256", "last_checked": "2026-10-13" }, { "id": "CLM-29", "kind": "claim", "statement": "Sample dossiers can be downloaded and checked, each listed in samples.json with what it carries and the result to expect: the four-party sample carries no outside time-stamp token, so every check passes except the time; the honey samples carry time stamps from a test authority the checker does not trust; each altered copy, with one byte of one signed record changed, is shown as changed.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the four-party sample: with its fingerprints every check passes but the time, which it does not carry; without them key_not_pinned", "passed": true }, { "title": "the altered sample: one byte changed, and the checker says changed", "passed": true }, { "title": "the samples on disk are what the builder writes, and the first is the verify page's sample byte for byte", "passed": true } ], "evidence": "/provenance/samples.json", "last_checked": "2026-10-13" }, { "id": "CLM-30", "kind": "claim", "statement": "Time stamps from two or more outside authorities per day root, with a quorum of two of three, and the full tokens, certificate chains and revocation information in the bundle.", "status": "Roadmap", "result": "NO_TESTS", "tests": [], "last_checked": "2026-10-13" }, { "id": "CLM-31", "kind": "claim", "statement": "An evidence-strength label on every record, from its source and its signing model, in the checker's result and report.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "there are vectors for every source, every signing model, a later start and an early end", "passed": true }, { "title": "labels for every source, model, window and threshold; windows from mandate records; corroboration of mixed rows", "passed": true }, { "title": "M0 a grower signing under a standing authorisation it gave: verified; LIM-01 every record carries its label, and the label dates the authorisation", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-32", "kind": "claim", "statement": "A printable report and a command-line checker with exit codes.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "exits with the checker's own code and prints the report: the result, the lines, the not-established list, LIM-05 not legal advice, LIM-07 New Zealand none", "passed": true }, { "title": "an altered record exits 1 (changed); --json prints the checker's result with the checker's SHA-256", "passed": true }, { "title": "LIM-05, LIM-07: the printed report says it is not legal advice and that New Zealand has no authority; the legal copy carries \"Seek legal advice\"", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-33", "kind": "claim", "statement": "EU Deforestation Regulation supplier evidence pack for cattle and beef.", "status": "Roadmap", "result": "NO_TESTS", "tests": [], "last_checked": "2026-10-13" }, { "id": "CLM-34", "kind": "claim", "statement": "A mapping to the concepts of MPI Trade Certification, for use alongside an MPI certificate.", "status": "Roadmap", "result": "NO_TESTS", "tests": [], "last_checked": "2026-10-13" }, { "id": "CLM-35", "kind": "claim", "statement": "An information-request response pack for a buyer in scope of the Corporate Sustainability Due Diligence Directive.", "status": "Roadmap", "result": "NO_TESTS", "tests": [], "last_checked": "2026-10-13" }, { "id": "CLM-36", "kind": "claim", "statement": "Digital Product Passport for the six food sectors: the regulation excludes food, feed, and living plants and animals.", "status": "Not applicable", "result": "NO_TESTS", "tests": [], "last_checked": "2026-10-13" }, { "id": "CLM-37", "kind": "claim", "statement": "Splitting and merging lots with a mass balance from opened quantity commitments, checked by the checker.", "status": "Roadmap", "result": "NO_TESTS", "tests": [], "last_checked": "2026-10-13" }, { "id": "LIM-01", "kind": "limit", "statement": "A seal does not prove the facts are true.", "status": "Beta", "result": "PASSING", "visible_feature": "Evidence-strength label on every record in the checker's result and report (source and signing), computed from the signed record; the file's own label is compared, never trusted", "tests": [ { "title": "there are vectors for every source, every signing model, a later start and an early end", "passed": true }, { "title": "labels for every source, model, window and threshold; windows from mandate records; corroboration of mixed rows", "passed": true }, { "title": "M0 a grower signing under a standing authorisation it gave: verified; LIM-01 every record carries its label, and the label dates the authorisation", "passed": true }, { "title": "S1 a self-stated record presented as third_party in the file's label: changed", "passed": true }, { "title": "S3 the stated corroboration raised to corroborated: the page shows its own, says the file's differs, and never prints the raised level", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "LIM-02", "kind": "limit", "statement": "Using Provenance does not meet a legal obligation; adapters short of Live are not complete.", "status": "Beta", "result": "PASSING", "visible_feature": "Adapter status label with \"rules last checked against \" per adapter, read from the regulatory facts file", "tests": [ { "title": "LIM-02: every adapter row prints its status from the register and the date its rules were last checked, with the source", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "LIM-03", "kind": "limit", "statement": "We are not a certification body; Provenance records the fingerprint of a certificate issued by others.", "status": "Roadmap", "result": "PASSING", "visible_feature": "Evidence kind certificate shown as \"fingerprint of a certificate issued by others\"; the evidence kind list exists today, the label text is to be built", "tests": [ { "title": "enums and formats", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "LIM-04", "kind": "limit", "statement": "Whether the lot meets any law, standard or scheme, including the EU Deforestation Regulation.", "status": "Beta", "result": "PASSING", "visible_feature": "\"What this check did not establish\" under every result, on the check page, in the checker's own result and in the dossier README", "tests": [ { "title": "verifies: every record, every party, every handover", "passed": true }, { "title": "the English in the markup and the page script carries no banned claim word either", "passed": true }, { "title": "the README is in five languages, repeats the checker's \"did not establish\" list, and carries no banned word", "passed": true } ], "evidence": "/provenance-verify.html", "last_checked": "2026-10-13" }, { "id": "LIM-05", "kind": "limit", "statement": "This is a description of how the product works, not legal advice.", "status": "Beta", "result": "PASSING", "visible_feature": "The \"not legal advice\" sentence at the head of the printable report and the check page", "tests": [ { "title": "LIM-05, LIM-07: the printed report says it is not legal advice and that New Zealand has no authority; the legal copy carries \"Seek legal advice\"", "passed": true }, { "title": "exits with the checker's own code and prints the report: the result, the lines, the not-established list, LIM-05 not legal advice, LIM-07 New Zealand none", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "LIM-06", "kind": "limit", "statement": "Not every time stamp is qualified; qualified status is shown per authority and per token, and only where verified.", "status": "Beta", "result": "PASSING", "visible_feature": "Per-token line in the checker's result: the authority, the time, whether it appears on the trusted list the checker carries, the confirmation found in the file, and \"Labelled: qualified\" only when both agree; otherwise \"not verified as qualified\"", "tests": [ { "title": "T2 a token from an issuer this page does not trust, the signed time block calling it qualified: timestamp_missing, and no line calls it qualified", "passed": true }, { "title": "T4 confirmed in the file AND on the trusted list the page carries: labelled qualified; on the list alone or confirmed alone: not", "passed": true }, { "title": "T5 a confirmation naming a different certificate, T6 a withdrawn confirmation, T7 confirmed as not qualified: never labelled qualified", "passed": true }, { "title": "LIM-06: the page never prints \"qualified\" for a time stamp except through the checker's label", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "LIM-07", "kind": "limit", "statement": "We know of no time-stamping authority in New Zealand.", "status": "Beta", "result": "PASSING", "visible_feature": "Authority list in the report ends \"New Zealand: none; in development\"", "tests": [ { "title": "LIM-05, LIM-07: the printed report says it is not legal advice and that New Zealand has no authority; the legal copy carries \"Seek legal advice\"", "passed": true }, { "title": "exits with the checker's own code and prints the report: the result, the lines, the not-established list, LIM-05 not legal advice, LIM-07 New Zealand none", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "LIM-09", "kind": "limit", "statement": "Provenance never edits or deletes a sealed record; what is signed stays signed.", "status": "Roadmap", "result": "PASSING", "visible_feature": "(a) the confirmation panel before every signing action in the console; (b) checker line \"commitment unopened (data erased)\" and (c) the sealed erasure event, to be built at milestone 2", "tests": [ { "title": "every POST in the console is sent from a Confirm: inside a confirmation panel's send, or a step-up Confirm handler", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "LIM-10", "kind": "limit", "statement": "We do not claim the system is infallible: keys can be lost or compromised, and time-stamp authorities can fail.", "status": "Beta", "result": "PASSING", "visible_feature": "Key event records (rotation, withdrawal, compromise) that stop a key and are read by the checker; the unanchored_under_withdrawn_key line and the \"Keys you know were withdrawn\" field; the per-record time line stating how many authorities answered against the number required; the custody label per record", "tests": [ { "title": "K1 the signing key declared compromised from 2020-01-01T00:00:00.000Z: unanchored_under_withdrawn_key", "passed": true }, { "title": "a withdrawal of the Village key: the DID entry gets its window, the key signs nothing new, its old record still verifies", "passed": true }, { "title": "a key event: signed, sequenced, under a step-up; a rotation signed by a key that is not the successor is refused before signing", "passed": true }, { "title": "T3 a day root that claims two authorities obtained, the second token nowhere: timestamp_missing", "passed": true }, { "title": "B0 a key the file says was withdrawn before its records: unanchored_under_withdrawn_key, exit 5", "passed": true }, { "title": "B2, through the page: a fingerprint typed into \"Keys you know were withdrawn\" gives the same word as B0", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "LIM-11", "kind": "limit", "statement": "We do not claim to verify the physical world.", "status": "Beta", "result": "PASSING", "visible_feature": "Label text \"The page checks the fingerprint, not the instrument\"; corroboration lines", "tests": [ { "title": "LIM-11: the device source says the page checks the fingerprint, not the instrument", "passed": true }, { "title": "LIM-11: the device source says the page checks the fingerprint, not the instrument; LIM-12: who held the key, never \"sole control\"", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "LIM-12", "kind": "limit", "statement": "The presumption of section 228 of the Contract and Commercial Law Act 2017 is not claimed for a signature made by a Village on an organisation's standing authorisation.", "status": "Beta", "result": "PASSING", "visible_feature": "Custody label per record in the checker's result, saying who held the key (for example held by the organisation's Village under a standing authorisation its owner gave, with the dates), never \"sole control\"; a key document that disagrees with the record's signing model is reported", "tests": [ { "title": "LIM-12: the custody label says who held the key, never \"sole control\"; the third-party text claims no independence", "passed": true }, { "title": "LIM-11: the device source says the page checks the fingerprint, not the instrument; LIM-12: who held the key, never \"sole control\"", "passed": true }, { "title": "C1 the key document says the key is participant_held: incomplete", "passed": true }, { "title": "M0 a grower signing under a standing authorisation it gave: verified; LIM-01 every record carries its label, and the label dates the authorisation", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "LIM-13", "kind": "limit", "statement": "Outside the EU and New Zealand the record is evidence on its own terms, for local law to weigh.", "status": "Roadmap", "result": "NO_TESTS", "visible_feature": "Report header names the jurisdictions of the authorities in the file and nothing else", "tests": [], "last_checked": "2026-10-13" }, { "id": "LIM-14", "kind": "limit", "statement": "Whether an unopenable fingerprint counts as anonymous is not stated.", "status": "Roadmap", "result": "NO_TESTS", "visible_feature": "The erased-commitment line never uses the word; a test asserts it is absent from the checker and the five locales", "tests": [], "last_checked": "2026-10-13" }, { "id": "LIM-15", "kind": "limit", "statement": "The legal framing of your records is your responsibility.", "status": "Roadmap", "result": "NO_TESTS", "visible_feature": "Onboarding acknowledgement (D14.3), sealed in the first mandate", "tests": [], "last_checked": "2026-10-13" }, { "id": "LIM-16", "kind": "limit", "statement": "Some records must be kept by law for a period, such as the EU Deforestation Regulation's five years.", "status": "Roadmap", "result": "NO_TESTS", "visible_feature": "Retention rule shown on the erasure screen with its source and date read (PRIV-17)", "tests": [], "last_checked": "2026-10-13" }, { "id": "LIM-17", "kind": "limit", "statement": "Your records, keys and participant register are held in New Zealand or in the European Union, according to the region chosen when your Village was set up.", "status": "Roadmap", "result": "NO_TESTS", "visible_feature": "\"Records held in \" on the Provenance settings page; the region field exists, the page line is to be built", "tests": [], "last_checked": "2026-10-13" }, { "id": "LIM-18", "kind": "limit", "statement": "Proofs about a location without revealing it are on the roadmap; no page claims them.", "status": "Beta", "result": "PASSING", "visible_feature": "The privacy note's table row marked Roadmap (D14.4)", "tests": [ { "title": "LIM-18: the location-proof row of the privacy table is marked Roadmap, and no other sentence offers such a proof", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "LIM-19", "kind": "limit", "statement": "Copies already shared cannot be recalled.", "status": "Roadmap", "result": "NO_TESTS", "visible_feature": "Dossier panel text before the download (console) and the sealed disclosure event listing what left (milestone 2)", "tests": [], "last_checked": "2026-10-13" }, { "id": "PRIV-01", "kind": "privacy", "statement": "Schema lint: no sealed payload schema in any adapter or sector profile contains a field typed as name, contact, address or free-form personal data; a new sealed field that is not classified fails the build.", "status": "Built", "result": "PASSING", "tests": [ { "title": "every field of every kind, nested ones included, carries one of the six classes", "passed": true }, { "title": "a new field with no classification stops the module loading (the lint is load-time, not advisory)", "passed": true }, { "title": "no field is TYPED as an unbounded string, at any level", "passed": true }, { "title": "adding a `str` field to a table stops the module loading", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-02", "kind": "privacy", "statement": "Canary leak test: canary personal data entered through the participant register appears in no sealed record, bundle, time-stamp request, log line, webhook, QR payload or report.", "status": "Planned", "result": "PASSING", "tests": [ { "title": "a step is stamped: the record names the token, the token is kept under this tenant, and the authority saw only a digest", "passed": true }, { "title": "the pack carries only signed records, day roots, proofs, terms and keys: no row id, label, salt or tenant id", "passed": true }, { "title": "a stored record from a lot that has a label carries neither, anywhere in the row", "passed": true }, { "title": "control: the search finds the canaries where they were put (the participant register and the lot label)", "passed": true }, { "title": "zero hits: every sealed record of every party, the dossier and its zip, the packs and the mailbox, the time-stamp requests and tokens, the signing-action rows, the key access log and every log line", "passed": true }, { "title": "PRIV-02 and PRIV-13 nothing outside the register and the plots holds a canary, before the erasure, after it, and after the sweep and the replay; PRIV-19 the only egress is the time-stamp request", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-03", "kind": "privacy", "statement": "Participant ids are not derived from names, emails or labels; identical personal data gives different ids across tenants.", "status": "Built", "result": "PASSING", "tests": [ { "title": "lot_ref is SHA-256 of the canonical { genesis_tenant_did, lot_salt (hex) }", "passed": true }, { "title": "PRIV-03 a participant id and a plot id are random UUIDs; the same data and the same geometry in two tenants give different ids and commitments", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-04", "kind": "privacy", "statement": "Every free-text field that flows into a sealed payload shows the warning \"This will be sealed permanently. Don't enter personal information.\"", "status": "Planned", "result": "PASSING", "tests": [ { "title": "every POST in the console is sent from a Confirm: inside a confirmation panel's send, or a step-up Confirm handler", "passed": true }, { "title": "PRIV-04 an email address, a telephone number and a coordinate pair, as the canary is written", "passed": true }, { "title": "PRIV-04 identity numbers: NZ IRD (checksum), NHI, driver licence; IBAN (checksum); EU VAT; BSN (11-proef)", "passed": true }, { "title": "PRIV-04 ordinary business words and the sealed field shapes pass: a digest, a date, a tariff code, a weight", "passed": true }, { "title": "PRIV-04 a finding names the field and the type and never the text that matched", "passed": true }, { "title": "PRIV-04 configurable: a type can be left out, an extra pattern added, a bad pattern refused", "passed": true }, { "title": "PRIV-04 the environment configures the default detector, and a broken value falls back to the built-in rules", "passed": true }, { "title": "PRIV-04 refused with the field and type; no text in the error", "passed": true }, { "title": "PRIV-04 an override must be explicit: acknowledged true, a reason of 8 to 200 characters, nothing else", "passed": true }, { "title": "PRIV-04 clean text passes without an override and reports nothing overridden", "passed": true }, { "title": "PRIV-04 the recipient reference is screened for personal data: refused unless an explicit, reasoned override, which is recorded without the text", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-05", "kind": "privacy", "statement": "Hiding: with the salt withheld, a dictionary attack on a commitment recovers nothing; salts carry at least 128 bits from a CSPRNG and are never reused.", "status": "Planned", "result": "PASSING", "tests": [ { "title": "mint returns only the key id and the lot_ref, never the salt; nothing in clear in any collection", "passed": true }, { "title": "PRIV-05 salts are 32 bytes from the CSPRNG and never reused: 300 plots and 100 register entries through the real path", "passed": true }, { "title": "PRIV-05 a dictionary attack on a plot commitment and on a registration digest recovers nothing without the salt", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-06", "kind": "privacy", "statement": "Binding: altering the data or the salt by one bit makes commitment verification fail.", "status": "Planned", "result": "PASSING", "tests": [ { "title": "the right number typed against a replaced salt: the line says the salt is unsigned and the record is not shown to have changed", "passed": true }, { "title": "PRIV-06 one bit of the data or of the salt changes the commitment, for a plot and for a registration number", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-07", "kind": "privacy", "statement": "Separation: salts are stored apart from the data they protect, and neither store alone allows recovery.", "status": "Built", "result": "PASSING", "tests": [ { "title": "mint returns only the key id and the lot_ref, never the salt; nothing in clear in any collection", "passed": true }, { "title": "another tenant's lot salt key id is refused, even when this tenant has a lot row naming it", "passed": true }, { "title": "PRIV-07 the data stores hold no salt and the key store holds no data", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-08", "kind": "privacy", "statement": "Erasure flow: erasing a participant removes the register entry, files and salt from primary storage, and no API returns them.", "status": "Built", "result": "PASSING", "tests": [ { "title": "a failed lot-row insert after mint: the caller destroys the salt, and it can never be read again", "passed": true }, { "title": "PRIV-08 erasing a canary participant removes the entry, the plot, both salts, from primary storage; no route returns them", "passed": true }, { "title": "the ledger row is written before any salt is destroyed or row deleted", "passed": true }, { "title": "if sealing fails the event waits in the outbox, the erasure stands, and a later retry seals it", "passed": true }, { "title": "a tenant with no standing authorisation for erasure events still erases; the event waits for one", "passed": true }, { "title": "the justification is the closed list: a free-text reason is refused and nothing is touched", "passed": true }, { "title": "a participant of another tenant, an unknown id and a malformed id are the same not_found, and touch nothing", "passed": true }, { "title": "PRIV-08 the platform's tenant-leaving path erases the register: TenantDeletionService.executeDeletion runs the ledger-first erasure, with no sealed event for a chain that is going", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-09", "kind": "privacy", "statement": "After erasure the offline checker still passes the chain. Where the erasing party's own signed erasure record is in the file, a commitment whose data was erased is reported as \"Commitment unopened (data erased)\", never as a change; a copy of a file given out before the erasure is the receiver's own and does not change.", "status": "Planned", "result": "PASSING", "tests": [ { "title": "lot_salts deleted: verified, with a line naming the lot whose salt is not provided", "passed": true }, { "title": "PRIV-09 erasing changes no sealed byte: every sealed row before the erasure is byte-identical after it, the chain still runs without a gap, and the erasure event is the only addition", "passed": true }, { "title": "PRIV-09 and PRIV-14 the checker reads the same dossier before and after a register correction and after an erasure: the same verdict, the same lines", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-10", "kind": "privacy", "statement": "A sealed, time-stamped erasure event is appended, linked to the affected records, with no personal data.", "status": "Built", "result": "PASSING", "tests": [ { "title": "PRIV-10 a sealed, time-stamped erasure event names the classes and the commitment digests and nothing else: no id, no key id, no personal data", "passed": true }, { "title": "PRIV-17 on: the held items are erased with the basis retention_ended, in the tenant's context, and the sealed event says so", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-11", "kind": "privacy", "statement": "After erasure, the dictionary attack of PRIV-05 against the stored commitments still recovers nothing.", "status": "Built", "result": "PASSING", "tests": [ { "title": "PRIV-11 after erasure the dictionary attack still recovers nothing: the salt is gone, the key row is zeroed, the digest is unchanged", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-12", "kind": "privacy", "statement": "A restore from a backup made before an erasure re-applies the erasure from the erasure ledger, where the ledger survives, before the restored system serves any data; the replay is tested in tests/unit/provenance/erasureLedgerReplay.test.js. The longest backup kept, about six months (measured 14 October 2026), is stated in the console erasure note, which also says that whole-server snapshots kept by the hosting providers follow the providers' own schedules.", "status": "Built", "result": "PASSING", "tests": [ { "title": "PRIV-12 an erasure writes the ledger row to the collection AND to a file outside the database; both chain, and neither holds personal data", "passed": true }, { "title": "PRIV-12 the chain links entry to entry in both stores, and a changed byte breaks it", "passed": true }, { "title": "PRIV-12 a line cut short by a crash is ignored, and the next entry starts a fresh line so both parse and the chain holds", "passed": true }, { "title": "PRIV-12 append-only: the ledger model refuses every update and delete path", "passed": true }, { "title": "PRIV-12 each tenant has its own ledger file and its own chain: B's erasure is not in A's file or A's replay", "passed": true }, { "title": "PRIV-12 restore a pre-erasure database: the erasure is re-applied by the replay before anything is served, and the sealed event is made again", "passed": true }, { "title": "PRIV-12 the restored system serves nothing before the replay: the first request after the restore runs it, and the erased entry is not there", "passed": true }, { "title": "PRIV-12 a running process notices a restore under it: the ledger head moved, the next request replays", "passed": true }, { "title": "PRIV-12 the file ledger lost, the database intact: the file is rebuilt from the database by the next replay", "passed": true }, { "title": "PRIV-12 the replay is per tenant and runs in that tenant's context", "passed": true }, { "title": "PRIV-12 a ledger entry cannot reach a lot salt, a signing key or another row's salt: the guard skips it", "passed": true }, { "title": "PRIV-12 neither store readable: every Provenance route answers 503 and nothing is served", "passed": true }, { "title": "PRIV-12 one store readable is enough to serve; with PROVENANCE_LEDGER_REQUIRE_BOTH it is not", "passed": true }, { "title": "PRIV-12 if neither store takes the ledger row, nothing is erased and the call fails", "passed": true }, { "title": "PRIV-12 if one store takes it, the erasure goes ahead and the other is filled by the next replay", "passed": true }, { "title": "PRIV-12 a restore that takes the database AND the ledger file back to before the erasure resurrects the data: the limit the notes state", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-13", "kind": "privacy", "statement": "After erasure, no canary is found in caches, search indexes, queues, exports, analytics or logs.", "status": "Planned", "result": "PASSING", "tests": [ { "title": "PRIV-13 residuals: after erasure no canary is in any row of any collection, the ledger file, the outbox, the key-access log, the time-stamp requests, the log lines or the route responses", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-14", "kind": "privacy", "statement": "Correcting personal data in the participant register changes no sealed bytes and leaves the chain verifying.", "status": "Built", "result": "PASSING", "tests": [ { "title": "a stored record from a lot that has a label carries neither, anywhere in the row", "passed": true }, { "title": "ProvenanceLot holds local_label (max 80) and only a key id for the salt, and indexes neither", "passed": true }, { "title": "PRIV-14 correcting an uncommitted field changes no sealed byte and no commitment; the allow-list holds", "passed": true }, { "title": "PRIV-14 the committed fields and the identity fields are refused with a clear code, and the whole call writes nothing", "passed": true }, { "title": "PRIV-09 and PRIV-14 the checker reads the same dossier before and after a register correction and after an erasure: the same verdict, the same lines", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-15", "kind": "privacy", "statement": "A wrong business fact is fixed only by a new linked amendment; a direct edit fails; the checker shows both with their times.", "status": "Built", "result": "PASSING", "tests": [ { "title": "a correction supersedes a step; the listing shows the step with its replacement; nothing is rewritten", "passed": true }, { "title": "S8 a superseded step is shown with the correction that replaced it", "passed": true }, { "title": "PRIV-15 a direct update of a sealed record is refused by the model", "passed": true }, { "title": "PRIV-15 a wrong registration number is corrected only by a new salt and a linked sealed correction: refused until the correction is sealed, then both records stand", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-16", "kind": "privacy", "statement": "A default evidence bundle carries commitments, not raw personal data or coordinates; including raw values needs an explicit disclosure that is itself sealed as a disclosure event.", "status": "Built", "result": "PASSING", "tests": [ { "title": "a dossier built for tenant A holds no row of tenant B; every record checks, and with no outside stamp the headline is timestamp_missing", "passed": true }, { "title": "PRIV-16 a dossier and its zip hold the plot commitment and the establishment digest, and no geometry, no salt, no register data", "passed": true }, { "title": "PRIV-16 a disclosure seals first, then returns the opening, which opens the commitment the sealed step carries", "passed": true }, { "title": "PRIV-16 if the seal fails nothing is released, no salt is read, no log row is written, and the step-up can be used again", "passed": true }, { "title": "PRIV-16 a passkey or a two-step code only: a password step-up is refused and spends nothing; none at all is 401", "passed": true }, { "title": "PRIV-16 a password step-up is refused BEFORE the step-up is claimed (nothing is spent, then given back); one for another purpose, or six minutes old, is 401", "passed": true }, { "title": "PRIV-16 the recipient class decides: geometry goes to a regulator, an auditor or a certifier, never to a buyer or \"other\"; a lot salt to any", "passed": true }, { "title": "PRIV-16 evidence salts and quantity openings are the holder's, not the platform's: named, they are refused as not held; a class list that does not match the ids is invalid", "passed": true }, { "title": "PRIV-16 another tenant's plot or lot, an unknown one and a malformed one: the uniform 404 or a 400, nothing sealed, nothing read", "passed": true }, { "title": "PRIV-16 the log lists disclosures without openings; a moderator and a platform admin cannot reach it or ask", "passed": true }, { "title": "PRIV-16 service level: no step-up, a password, or a stale object is refused before any plot is read", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-17", "kind": "privacy", "statement": "With a retention rule configured from a dated official source, an erasure request on in-scope data is held with its basis recorded and executes when the period ends; out-of-scope data is erased at once.", "status": "Built", "result": "PASSING", "tests": [ { "title": "PRIV-17 a rule without a source (no URL, a URL that is not https, no read date, a future read date) is not creatable, by the service or the route", "passed": true }, { "title": "PRIV-17 a rule carries its basis, period, source, read date, pending changes and scope, as the owner gave them; no period is built in", "passed": true }, { "title": "PRIV-17 seeded from the facts file: the EUDR five years, its articles, its source and the day it was read, as the file states them", "passed": true }, { "title": "PRIV-17 if the facts file does not carry the rule with a source and a date, NO rule is seeded and the reason is said", "passed": true }, { "title": "PRIV-17 the route seeds the rule for the owner and reports a repeat as already seeded", "passed": true }, { "title": "PRIV-17 in scope: HELD with the basis recorded, nothing destroyed, use restricted, no ledger row and no sealed event yet", "passed": true }, { "title": "PRIV-17 out of scope: erased at once, with a ledger row and a sealed event (no purpose, a purpose no rule covers, or a class the rule does not cover)", "passed": true }, { "title": "PRIV-17 the period is the rule's, not the code's: a two-year rule holds for two years, a one-month rule for one month", "passed": true }, { "title": "PRIV-17 a later sealed use of the commitment moves the end of the period: the anchor is the later of creation and last use", "passed": true }, { "title": "PRIV-17 off by default: with the switch unset nothing is read and nothing is erased, however due", "passed": true }, { "title": "PRIV-17 the platform switch comes before any tenant is read, and the tenant's own before its data", "passed": true }, { "title": "PRIV-17 dry run: says exactly what it would erase and erases nothing", "passed": true }, { "title": "PRIV-17 on: the held items are erased with the basis retention_ended, in the tenant's context, and the sealed event says so", "passed": true }, { "title": "PRIV-17 a per-tenant cap: no more than five holds in one pass", "passed": true }, { "title": "PRIV-17 a hold whose item was used again before expiry is extended, not executed", "passed": true }, { "title": "PRIV-17 one tenant's rules and holds never reach another's data", "passed": true }, { "title": "PRIV-17 a leaving tenant: the register is erased whole, holds are not applied (design 6: delete; the export is offered first)", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-18", "kind": "privacy", "statement": "Outbound time-stamp requests to every authority hold only a hash, a nonce and policy fields.", "status": "Planned", "result": "PASSING", "tests": [ { "title": "a step is stamped: the record names the token, the token is kept under this tenant, and the authority saw only a digest", "passed": true }, { "title": "PRIV-18 the three free authorities and the paid one: the request parses as version, imprint, optional policy, nonce, certReq and nothing more; no canary in the body or the headers", "passed": true }, { "title": "PRIV-18 through the real attest path: a sealed erasure event and a sealed disclosure event are stamped by their digest and nothing else", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "PRIV-19", "kind": "privacy", "statement": "Residency (the operator's text arrived truncated here; this completion is Fable's): with the region set to New Zealand, no salt, key or participant-register row is written to a store outside the New Zealand deployment; the same for the EU.", "status": "Planned", "result": "PASSING", "tests": [ { "title": "PRIV-19 the region is NZ unless the deployment says EU; anything else is refused and the routes answer 503", "passed": true }, { "title": "PRIV-19 every Provenance model is declared as holding personal data or as holding none (a new store cannot appear unclassified)", "passed": true }, { "title": "PRIV-19 no register, plot, erasure or disclosure code path opens a connection other than to the local database or sends a request carrying a salt, a key or a canary", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-60", "kind": "claim", "statement": "Each party in an export chain, from grower to processor, exporter and buyer, signs its own records of a lot, and each giver sends its records on with the lot. A buyer checks the whole chain in a browser, offline, with no account on anyone's platform.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "A -> B -> C: C's dossier headlines as a complete file does, no gap and no incomplete line; without the packs it does not", "passed": true }, { "title": "A -> B -> C -> D -> E -> F: the fifth pack goes without tokens, the sixth with only its giver's segment; each is stored and the dossier builds", "passed": true }, { "title": "dossier.json from the zip verifies `verified` with the checker from the zip, run in Node from a folder of its own", "passed": true }, { "title": "verify.html loads only files beside it, runs no inline script, and nothing in the zip names a network address", "passed": true }, { "title": "is registered with the orphan gate, the sitemap and the public-surface CSP, and the landing links to it", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-61", "kind": "claim", "statement": "An outside time-stamping authority sees only a fingerprint of each record. A dossier holds the records of the lot it is for and the records its givers sent on with the lot; the organisation's other lots stay out of it.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a step is stamped: the record names the token, the token is kept under this tenant, and the authority saw only a digest", "passed": true }, { "title": "a dossier built for tenant A holds no row of tenant B; every record checks, and with no outside stamp the headline is timestamp_missing", "passed": true }, { "title": "a selection (another lot of A inside the same day root): none of its records leave, and with outside stamps it verifies", "passed": true }, { "title": "a received lot carries the giver's signed proposal the receiver holds, nothing else of the giver's, and never headlines verified", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-62", "kind": "claim", "statement": "A seal shows which key signed a record, what was signed and, with an outside time stamp, when it existed. The check shows whether the record in front of you is the one its party signed.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "verifies: every record, every party, every handover", "passed": true }, { "title": "one byte altered in a grower record: changed, and that record's signature line fails", "passed": true }, { "title": "T1 one token removed from the file: timestamp_missing, never verified", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-63", "kind": "claim", "statement": "Every record says who stated it and how it was signed, and the check shows that label with every record. The check works the label out from two signed fields of the record; a file whose copy of the label says otherwise is reported.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "M0 a grower signing under a standing authorisation it gave: verified; LIM-01 every record carries its label, and the label dates the authorisation", "passed": true }, { "title": "S1 a self-stated record presented as third_party in the file's label: changed", "passed": true }, { "title": "S2 only the label's text altered: the page prints its own text and says the file's label differs", "passed": true }, { "title": "labels for every source, model, window and threshold; windows from mandate records; corroboration of mixed rows", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-64", "kind": "claim", "statement": "For each lot the check also says, point by point (origin, handling, quantity and inspection), whether another party that did not hold the lot recorded an attestation about it. This is worked out from the records, never signed.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the holders' own statements never corroborate one another, however many holders there are", "passed": true }, { "title": "an attestation not marked third_party corroborates nothing", "passed": true }, { "title": "S3 the stated corroboration raised to corroborated: the page shows its own, says the file's differs, and never prints the raised level", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-65", "kind": "claim", "statement": "An organisation chooses how its signing key is held: by its Village, under a standing authorisation its owner gives; split, so that the Village and the organisation's own key holders must sign together; or split among the organisation's own key holders, with no share held by the Village.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the Village key signs its own kinds under a Village mandate; a hybrid mandate and the hybrid kinds are co-signed with the group key", "passed": true }, { "title": "a missing share refuses: neither the Village nor the organisation signs alone, and the Village key is never asked", "passed": true }, { "title": "signed with the participants' shares only: no mandate, no mandate_ref, never the Village key", "passed": true }, { "title": "hybrid needs exactly one Village share and an organisation that cannot sign alone; participant_held needs none; every share declared", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-66", "kind": "claim", "statement": "A Village signs nothing for an organisation without a standing authorisation that covers the kind of record and the date. The owner gives it after signing in again with a passkey or a two-step code; a password alone is refused. It lasts at most twelve months, can be withdrawn at any time, and both the grant and the withdrawal are signed records.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "no mandate: refused before the key store is asked anything; the mandate itself is the bootstrap", "passed": true }, { "title": "scope: a mandate for steps signs steps and nothing else", "passed": true }, { "title": "expired and not yet valid", "passed": true }, { "title": "LIM-15: a grant needs a passkey or a two-step code; a password alone is refused and spends nothing", "passed": true }, { "title": "the body: all three acknowledgements, a window of at most 12 months, nothing else; and the gate: owner, CSRF, a fresh step-up of this purpose", "passed": true }, { "title": "withdrawal by route (any method); afterwards nothing is signed for the tenant, with a plain reason", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-67", "kind": "claim", "statement": "Under either split arrangement the Village key is never used in place of a missing share: if a share is missing, nothing is signed.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "NO FALLBACK: not registered, a Village share in the arrangement, custodians down, or a kind not under the group key: refused, the Village key never asked", "passed": true }, { "title": "a missing share refuses: neither the Village nor the organisation signs alone, and the Village key is never asked", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-68", "kind": "claim", "statement": "Before the first standing authorisation the owner ticks three statements, set out below, and the ticks are sealed inside the authorisation.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "LIM-15: a grant needs a passkey or a two-step code; a password alone is refused and spends nothing", "passed": true }, { "title": "the body: all three acknowledgements, a window of at most 12 months, nothing else; and the gate: owner, CSRF, a fresh step-up of this purpose", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-69", "kind": "claim", "statement": "A key that is withdrawn, rotated or declared compromised is recorded in a signed key event. From then on the key signs nothing new, and what it signed before stays checkable.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a withdrawal of the Village key: the DID entry gets its window, the key signs nothing new, its old record still verifies", "passed": true }, { "title": "a rotation of the group key on a split-key tenant stops the old group key", "passed": true }, { "title": "a key event: signed, sequenced, under a step-up; a rotation signed by a key that is not the successor is refused before signing", "passed": true }, { "title": "K1 the signing key declared compromised from 2020-01-01T00:00:00.000Z: unanchored_under_withdrawn_key", "passed": true }, { "title": "K1 the signing key declared compromised from 2099-01-01T00:00:00.000Z: verified", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-70", "kind": "claim", "statement": "The demo runs the published checker in a worker inside this page. Nothing it checks is sent anywhere.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the tamper demo runs headlessly: the sample is checked, then one byte is changed and the check says changed", "passed": true }, { "title": "nothing leaves the page during the demo", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-71", "kind": "claim", "statement": "The check labels a time stamp qualified only when a party in the file has confirmed the authority against its member state's trusted list and the trusted list the checker carries says the same; any other time stamp is labelled not verified as qualified.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "T4 confirmed in the file AND on the trusted list the page carries: labelled qualified; on the list alone or confirmed alone: not", "passed": true }, { "title": "T5 a confirmation naming a different certificate, T6 a withdrawn confirmation, T7 confirmed as not qualified: never labelled qualified", "passed": true }, { "title": "T2 a token from an issuer this page does not trust, the signed time block calling it qualified: timestamp_missing, and no line calls it qualified", "passed": true }, { "title": "LIM-06: the page never prints \"qualified\" for a time stamp except through the checker's label", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-72", "kind": "claim", "statement": "Each organisation keeps its own register of time-stamp authorities. Its owner confirms an authority against the official trusted list of the authority's member state; the confirmation is a signed record that travels in the organisation's dossiers, and a link that is not the official list for that state is refused.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the official list only; the record seals no URL and no name; withdrawal pairs with it; another tenant cannot touch it", "passed": true }, { "title": "a confirmation is a signing action: no mandate covering it, nothing sealed", "passed": true }, { "title": "T8 a confirmation edited in the file (its signed bytes changed, the copy in step): changed", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-73", "kind": "claim", "statement": "A day root states how many authorities it needs and how many answered, and a day root that claims a time stamp the file does not carry is not shown as verified.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "T3 a day root that claims two authorities obtained, the second token nowhere: timestamp_missing", "passed": true }, { "title": "the time attestation (D4): no quorum, a quorum that does not add up, a qualified status with no list reference", "passed": true }, { "title": "met is a string, never a boolean; no other quorum key", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-74", "kind": "claim", "statement": "A builder for a buyer's own profile of what it expects from its suppliers, published by that buyer as data.", "status": "Roadmap", "result": "NO_TESTS", "tests": [], "last_checked": "2026-10-13" }, { "id": "CLM-76", "kind": "claim", "statement": "Kiwifruit, first as an invented chain for testing.", "status": "Roadmap", "result": "NO_TESTS", "tests": [], "last_checked": "2026-10-13" }, { "id": "CLM-77", "kind": "claim", "statement": "Every claim on this page names an entry in the conformance register, and the build leaves out any claim whose entry is not passing.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "every claim on the page is an entry of the register, word for word, and the build leaves out a claim whose entry does not hold", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-78", "kind": "claim", "statement": "Each record asks Certum, in Poland, for a time stamp. For an organisation whose order includes qualified time stamps, ArubaPEC, in Italy, is asked as well, and each authority's token is kept separately.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a step is stamped: the record names the token, the token is kept under this tenant, and the authority saw only a digest", "passed": true }, { "title": "with the qualified authority ON, BOTH authorities are handed to the anchor", "passed": true }, { "title": "each authority carries its OWN token hash — one hash cannot stand for two stamps", "passed": true }, { "title": "DEFAULT OFF: with nothing configured, no paid provider is ever handed over", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-79", "kind": "claim", "statement": "A lot's salt is kept apart from the lot's records, and a salt that has been destroyed can never be read again.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "mint returns only the key id and the lot_ref, never the salt; nothing in clear in any collection", "passed": true }, { "title": "a failed lot-row insert after mint: the caller destroys the salt, and it can never be read again", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-38", "kind": "claim", "statement": "Signing, as the record states it (this page cannot check how the key was held):", "status": "Beta", "result": "PASSING", "tests": [ { "title": "every label line says the signing part is as the record states it, and that the page cannot check how the key was held; the label text itself is the platform's", "passed": true }, { "title": "LIM-11: the device source says the page checks the fingerprint, not the instrument; LIM-12: who held the key, never \"sole control\"", "passed": true }, { "title": "C1 the key document says the key is participant_held: incomplete", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-39", "kind": "claim", "statement": "A compromise time a party states for its key is shown as a stated time, not verified, and every record signed with that key is listed as signed before or after it, or not shown either way; none is quietly relabelled.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "K2 a back-dated compromise: the key record shows a STATED compromise time; each record signed with that key is listed as signed before or after it, none quietly relabelled", "passed": true }, { "title": "K1 the signing key declared compromised from 2020-01-01T00:00:00.000Z: unanchored_under_withdrawn_key", "passed": true }, { "title": "K1 the signing key declared compromised from 2099-01-01T00:00:00.000Z: verified", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-40", "kind": "claim", "statement": "A standing authorisation granted days before the records that name it can be shown on its own day root, without the day roots between, in a selection only; such a day root must show no lot record and must show the authorisation the records name, and the check names it on a line.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "D0 the genuine detached layout: verified; a selection; the day root on its own is named; the label dates the authorisation", "passed": true }, { "title": "D0b the control: every row supplied, one unbroken run (a selection: the other lot is not shown), no day root on its own", "passed": true }, { "title": "D1 the mandate removed, with or without its day root: not verified, signed outside any authorisation shown", "passed": true }, { "title": "D2 another party's mandate and its day root put in the grower's segment: not verified", "passed": true }, { "title": "D3 the mandate's inclusion proof forged, and the detached day root edited: changed", "passed": true }, { "title": "D4 withdrawn before use, the withdrawal included on its own day root: incomplete, withdrawn; the label says it ended early", "passed": true }, { "title": "D5 expired before use: incomplete, expired", "passed": true }, { "title": "D6 a day root on its own that shows a lot record (the middle of a lot cut out): not verified, never read as detached", "passed": true }, { "title": "D7 the detached layout labelled complete_range: incomplete, the run of day roots broken", "passed": true }, { "title": "D9 an earlier day root holding only a standing authorisation the records do not name, added on its own: incomplete, not read as detached", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "LIM-20", "kind": "limit", "statement": "Where a standing authorisation is shown on its own day root, a record the party signed on a day between that day root and the rest, such as a withdrawal of the authorisation or a key record, is not in the file and would not show.", "status": "Beta", "result": "PASSING", "visible_feature": "The checker's line naming each detached day root says that a record signed on a day between would not show; the specification states the same", "tests": [ { "title": "D8 DOCUMENTED LIMIT: a withdrawal on a day between, its day root left out: verified, and the line says such a record would not show", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "LIM-21", "kind": "limit", "statement": "How a signing key was held. The record states how it was signed; this check cannot see inside a key holder's systems.", "status": "Beta", "result": "PASSING", "visible_feature": "Item 11 of \"What this check did not establish\", printed under every result, on the check page, in the README and in five languages", "tests": [ { "title": "the did-not-establish list names how a key was held, on the page, in the README source and in five languages", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-41", "kind": "claim", "statement": "A party that signs with more than one key is pinned by all of its fingerprints, given as a list or separated by commas; every record's key must be one of them and every fingerprint given must be a key of that party, or the result is key_mismatch.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "H0 both keys pinned (an array, or one string separated by commas): verified; either key alone: key_mismatch", "passed": true }, { "title": "H1 a fingerprint given that is not a key in the party's key document or key history: key_mismatch, said on its own line", "passed": true }, { "title": "H2 nothing given: key_not_pinned, as before", "passed": true }, { "title": "H3 a record signed by a key that is not in the key document at all: changed, whatever is pinned", "passed": true }, { "title": "H4 a record signed with the Village key that states threshold_hybrid and names the split key's authorisation: incomplete, another key", "passed": true }, { "title": "H5 the command line takes --pin repeated for one party, or one value separated by commas", "passed": true }, { "title": "the honey sample's threshold_hybrid processor, pinned as a list, verifies with the test authority", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-42", "kind": "claim", "statement": "A synthetic honey chain, built end to end through the platform with Village-held, split-key and third-party signers, checks out in the offline checker with every outside time stamp checked, and the canary personal data put into the participant register and lot labels appears in none of its sealed records, files, time-stamp requests, packs or logs.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the offline checker in Node: headline verified, every record verified, every stamp checked", "passed": true }, { "title": "the Village-custodied parties sign with their Village key under a mandate; the processor's every record is co-signed by its FROST group key", "passed": true }, { "title": "the blend balances on the holders' openings: 800 kg out of 480 + 350 kg in; no lot grows", "passed": true }, { "title": "third-party records under the lab's own key and mandate; they corroborate the manuka lot's origin and handling", "passed": true }, { "title": "control: the search finds the canaries where they were put (the participant register and the lot label)", "passed": true }, { "title": "zero hits: every sealed record of every party, the dossier and its zip, the packs and the mailbox, the time-stamp requests and tokens, the signing-action rows, the key access log and every log line", "passed": true } ], "evidence": "/provenance/samples.json", "last_checked": "2026-10-13" }, { "id": "CLM-43", "kind": "claim", "statement": "Only the key a record names verifies it: a record whose signature checks under another of the party's keys, or that names a key the party's key document does not hold, is shown as changed, whatever fingerprints are given.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "A2 a step signed with the Village key whose signer_did names the split key: changed, whatever is pinned", "passed": true }, { "title": "A3 one Village key mints the split-key grant and signs every step naming the split key: changed", "passed": true }, { "title": "A4 one key only: the grant names \"ghost\" and every step names #ghost, all signed with the one key: changed", "passed": true }, { "title": "the genuine case stays verified: a hybrid party pinned by both keys signs each record with the key it names", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-44", "kind": "claim", "statement": "A standing authorisation must be signed with the key it names; one signed by another key covers nothing, and the records that name it are shown as incomplete, with the reason.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "A1 a threshold_hybrid grant naming the split key but signed with the Village key: records under it incomplete, named", "passed": true }, { "title": "A10 a withdrawal effective years ahead: the grant's line dates when the later record ends it", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-45", "kind": "claim", "statement": "A time-stamp quorum counts different authorities, each with its own token; the same authority twice, or two names over one token, is refused before signing and is not verified in a file.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "C1 the same authority twice, one token: the platform refuses to sign it, and a file carrying one (signed by hand) is not verified", "passed": true }, { "title": "C2 two authority names, one token: the platform refuses to sign it, and a file carrying one (signed by hand) is not verified", "passed": true }, { "title": "the platform keeps an attest step's quorum only when its own authorities give it", "passed": true }, { "title": "a quorum is of different authorities with different tokens: a repeated authority or token is refused, here and by the signing host", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-46", "kind": "claim", "statement": "An authority confirmation is superseded only by a later confirmation of the same party, and while a party's confirmation that an authority is not qualified stands, no token of that authority is labelled qualified.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "C4 another party \"supersedes\" a party's not-qualified confirmation with a qualified one: the first stands, and the token is not labelled qualified", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-47", "kind": "claim", "statement": "A lot holder's own attestation about its lot is the holder speaking, not corroboration: only a party that did not hold the lot can corroborate or contest a point.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "B3 a lot holder's own third_party attestation does not corroborate the lot", "passed": true }, { "title": "it differs from corroborationOf exactly where a holder attests", "passed": true }, { "title": "the holders' own statements never corroborate one another, however many holders there are", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-48", "kind": "claim", "statement": "At most 16 fingerprints are read for one party; any given beyond 16 are named as not read, and an empty fingerprint on the command line is refused with a message.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "P1 P2 more than 16 fingerprints: those past 16 are said not to be read", "passed": true }, { "title": "an empty --pin value is a message, exit 6", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-49", "kind": "claim", "statement": "A key record is matched to a key by its signed fields, not by a name in the key document, and the result counts the records each key record covers.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "K1 a compromised key record from 2020, the key document's id for that key renamed: not verified; the key record counts the records it covers", "passed": true }, { "title": "K3 a withdrawn key record from 2020, the key document's id for that key renamed: not verified; the key record counts the records it covers", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-50", "kind": "claim", "statement": "A key document that lists one key under two ids, or one id twice, is shown as inconsistent and the records it covers as changed, whatever fingerprints are given.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "A5 one key listed under two ids: the key document is inconsistent", "passed": true }, { "title": "A3x village_pub_under_split_id: changed whatever is pinned, the key document named inconsistent, never \"verified\"", "passed": true }, { "title": "A3x split_id_twice_village_first: changed whatever is pinned, the key document named inconsistent, never \"verified\"", "passed": true }, { "title": "A3x split_id_twice_split_first: changed whatever is pinned, the key document named inconsistent, never \"verified\"", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-51", "kind": "claim", "statement": "A record signed jointly must verify under a key different from the party's Village-held key; otherwise it is shown as incomplete and its label does not say it was signed jointly.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a joint signing under the Village's own key: incomplete, signing_key_not_distinct, and the label does not say \"Signed jointly\"", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-52", "kind": "claim", "statement": "A reader can bind a fingerprint to a key id, on the page or the command line; a binding to another key, or to an id the party's key document does not hold, is a key mismatch.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "pins bound to a key id: the genuine hybrid party verifies; a swapped binding, or an id the document lacks, is key_mismatch", "passed": true }, { "title": "a party's box takes plain fingerprints and KEY=FINGERPRINT entries, the latter bound to that key", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-53", "kind": "claim", "statement": "A quorum the record states as met, whose checked tokens come from fewer distinct stamping certificates than required, is shown as incomplete.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "C5 two tokens of one stamping certificate under two authority names, the signed quorum \"2 of 2\": incomplete, quorum_not_met_here", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-54", "kind": "claim", "statement": "A confirmation citing an older entry of the trusted list than the one the checker carries does not earn the qualified label, and the line says why.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "C7b a confirmation citing an older entry of the trusted list than the one the check carries: not labelled qualified, and said why", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-55", "kind": "claim", "statement": "Only an attestation whose signature verified, from a party the reader pinned that holds no record of the lot in the file, counts as corroboration.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the control: a pinned certifier's attestation corroborates, worded as a party with no record of this lot in this file, and the limit said once", "passed": true }, { "title": "B5a the certifier not pinned: its attestation does not corroborate", "passed": true }, { "title": "B5b the attestation's signature corrupted: it does not corroborate", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-56", "kind": "claim", "statement": "Two parties each beginning the same lot, with no handover between them, is shown as incomplete; and a damaged entry never explains away a gap, both being reported.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "G1 two pinned parties each harvest the same lot reference with no handover: incomplete, lot_claimed_by_two_parties", "passed": true }, { "title": "X1 the middle step removed and a junk entry put in its place: the gap is reported (and the junk entry too)", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-57", "kind": "claim", "statement": "Text taken from a record or the file is shown with control and direction characters escaped, so it can never start a line of the report or pose as a result, and a field name that is a built-in name is a finding on that record, never a failure of the whole check.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "I1 a prototype name in a record field is a finding on that record, never a failure of the whole run", "passed": true }, { "title": "I2 a signed provider_id carrying a line break and a forged \"[verified]\" line: the text report never starts a line with it", "passed": true }, { "title": "I3 unsigned text a file editor controls (a declared role, an unknown field name) never starts a line or becomes a second Result", "passed": true }, { "title": "every lookup table the checker indexes by a record field finds nothing under a prototype name", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-58", "kind": "claim", "statement": "A time-stamp quorum counts authorities cautiously: two tokens whose checked paths share any key, or end at anchors run by the same operator, count as one authority, and the count is never more than the number of distinct stamping certificates.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "A4 one authority (one root) with two stamping certificates, under two provider names, \"2 of 2\" signed: incomplete, quorum_not_met_here", "passed": true }, { "title": "the control: two authorities with two different roots meet the quorum of two", "passed": true }, { "title": "C3 one organisation through a cross-signed intermediate, one token via each root, both roots trusted: one authority, incomplete", "passed": true }, { "title": "C4 the same token twice, its certificates repacked to run through the other root: one authority, one stamping certificate", "passed": true }, { "title": "C9 both intermediates and both roots in each token: one authority", "passed": true }, { "title": "two independent roots: two authorities; the same two roots given one operator: one authority", "passed": true }, { "title": "the bundled anchors name their operators: both Certum roots are one operator, Aruba and the Portuguese state another each", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-59", "kind": "claim", "statement": "A fingerprint given for a DID that is not a party in the file, or bound with a DID not spelled exactly as the party's, is named as unused and changes no verdict.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "F3 a pin for a DID not in the file, a bound pin whose DID is not a party's exact spelling, and a \"#\" written as %23: each named as unused, no verdict changed by the first", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-80", "kind": "claim", "statement": "Where a lot holder signs a third-party attestation on its own lot, the label says the file shows that party holds the lot.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "F4 a holder signs a third_party attestation on its own lot: the label says the file shows that party holds the lot", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-81", "kind": "claim", "statement": "A confirmation earns the qualified label only when it cites exactly the trusted-list entry the checker carries: another member state's list, an older issue or a different issue date earns none.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "F5 a confirmation citing another member state's list (DE, sequence 1 of 1999): {\n trusted_list_jurisdiction: 'DE',\n trusted_list_sequence: 1,\n trusted_list_issued: '1999-01-01'\n}", "passed": true }, { "title": "F5 a confirmation citing the same sequence of the same list with another issue date: { trusted_list_issued: '2020-01-01' }", "passed": true }, { "title": "F5 a confirmation citing an older issue of the same list: { trusted_list_sequence: 1, trusted_list_issued: '1999-01-01' }", "passed": true }, { "title": "F5 a confirmation citing the same list, the same issue (the control): {}", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-82", "kind": "claim", "statement": "A fingerprint in a party's key history that no record in the file uses is named on a line, and the verdict is unchanged.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "F6 a key history listing a fingerprint nothing uses: named on a line, the verdict unchanged", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-83", "kind": "claim", "statement": "Control, direction, zero-width and other invisible characters in text taken from a file are escaped where the result is made, so the page, the report, the command line and its JSON carry none of them raw.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a declared role and a bound pin carrying direction, zero-width and line-break characters: no string anywhere in the result carries one raw, nor does --json", "passed": true }, { "title": "F7 the checker's and the page's escapes cover the combining grapheme joiner, variation selectors, fillers, braille blank, Mongolian selectors and tag characters", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-84", "kind": "claim", "statement": "A party with a segment but no checked record is still held to the fingerprint given for it: the fingerprint is compared with its key document, and a wrong one is a key mismatch.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "P1 a party with a segment and no records: a wrong pin is key_mismatch; a right one is said to match its key document, never \"no fingerprint was given\"", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-85", "kind": "claim", "statement": "A fingerprint bound to a key id is compared with the key the party's key document gives that id, even when no record names it; a different key there is a key mismatch.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "P3d a bound pin #frost giving the Village key, while the document gives #frost another key and no record names it: key_mismatch", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-86", "kind": "claim", "statement": "The source part and the signing part of a record's label are chosen independently, so a holder's own attestation and a signing the page cannot show are both stated, and the label never says \"Signed jointly\" for a signing the page cannot show.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the label says both: the holder's own attestation, and the signing the page cannot show; never \"Signed jointly\" (checker and page)", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-87", "kind": "claim", "statement": "A literal \"\" and a real U+202E print differently, in the checker, the command line and the page", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-200", "kind": "claim", "statement": "An evidence pack for the EU importer of New Zealand cattle and beef is built from a lot's signed records: a zip of the sealed chain slice, the EUDR mapping table, the establishments where the cattle were kept, the mass balance of the lot genealogy and a README in five languages. It carries commitments only, unless a sealed disclosure names the openings, and the owner exports it through its own route. It is not validated against the Commission's V3 schema, and the importer, not the New Zealand exporter, submits the due diligence statement.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "by default: commitments only. Three establishments, each with a plot commitment and no geometry; quantities committed, mass balance unchecked", "passed": true }, { "title": "the table says, for each element, where it is evidenced or that it is not; the importer's own elements are never claimed", "passed": true }, { "title": "the pack carries the dossier it was made from, named by its SHA-256, and the checker verifies that dossier", "passed": true }, { "title": "an establishment with no plot commitment: the geolocation row is partial and counts it; no establishment at all: not evidenced", "passed": true }, { "title": "a quantity that exceeds: the mass balance says exceeds, and the genealogy row says partial, never evidenced", "passed": true }, { "title": "every item of the 2023 Annex II list has an element: operator, HS code, description, quantity, country, geolocation, references, negligible risk, signature", "passed": true }, { "title": "3.33 the default pack is commitments only: a zip of four files, the plot committed and not opened, no coordinate anywhere", "passed": true }, { "title": "five languages, always: every pack carries the README in en, de, fr, nl and mi, translated from today's English", "passed": true } ], "evidence": "/provenance/samples/beef-chain.json", "last_checked": "2026-10-13" }, { "id": "CLM-201", "kind": "claim", "statement": "A New Zealand beef chain, from the first farm to an importer in the EU, is sealed under one sector profile, beef_nz_v1, and the importer's dossier verifies in the offline check.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the offline checker in Node: headline verified, every record verified, every stamp checked", "passed": true }, { "title": "every step in the file was sealed under beef_nz_v1 and is a beef activity the profile allows", "passed": true }, { "title": "the genuine sample: verified only with the test root; without it, every check but the time passes", "passed": true }, { "title": "what the sample shows is in it: beef_nz_v1 steps, the slaughter of two lots, both trust modes, a balanced mass balance, three establishments as commitments", "passed": true } ], "evidence": "/provenance/samples/beef-chain.json", "last_checked": "2026-10-13" }, { "id": "CLM-202", "kind": "claim", "statement": "The beef profile adds up the genealogy: a slaughter of several lots into one carcass lot, and a boning into cuts, balance on the quantities their holders open; a quantity that is not opened leaves the result unchecked, never balanced.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the genealogy balances on the holders' openings: 5560 kg of carcass from 10500 kg live; 3600 kg of boneless cuts from 5520 kg chilled; no lot grows", "passed": true }, { "title": "a quantity that exceeds: the mass balance says exceeds, and the genealogy row says partial, never evidenced", "passed": true }, { "title": "slaughter and boning are told apart by the subheading each carries, in the signed record", "passed": true } ], "evidence": "/provenance/samples/beef-chain.json", "last_checked": "2026-10-13" }, { "id": "CLM-203", "kind": "claim", "statement": "The beef chain holds both trust modes: the farms, the exporter and the importer sign with keys their Villages hold under standing authorisations, and the processor signs jointly with a key split between it and its Village.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the Village-custodied parties sign with their Village key under a mandate; the processor's every record is co-signed by its FROST group key", "passed": true } ], "evidence": "/provenance/samples/beef-chain.json", "last_checked": "2026-10-13" }, { "id": "CLM-204", "kind": "claim", "statement": "A separate organisation's attestation about a lot it does not hold corroborates the lot's origin and handling in the beef chain, and the label says whose record it is.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "third-party records under the auditor's own key and mandate; they corroborate the mob's origin and the carcass lot's handling", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-205", "kind": "claim", "statement": "In the evidence pack a plot geometry or a quantity opening appears only when its holder disclosed it in a sealed disclosure event that names it; by default the pack holds commitments only.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "without the events, with the wrong holder's, or with a recipient class that differs, the pack is refused; so is an opening that does not match its commitment", "passed": true }, { "title": "each holder's sealed disclosure event lets that holder's openings and geometries in: the mass balance balances, the quantity shows, the geometries show", "passed": true }, { "title": "a geometry opens its commitment only with a disclosure event naming plot_geometry and that commitment; then the pack shows it and counts it", "passed": true }, { "title": "an opening that does not hash to its commitment, or a geometry that does not hash to its digest, is refused", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-206", "kind": "claim", "statement": "A sealed record carries the id of a sector profile; the id of a regulatory adapter is never sealed into a record, and the two lists of ids share none.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "beef_nz_v1 is on the schema's list and has rules; eudr_cattle_v1 is an adapter id, off the list, and no profile has its name", "passed": true }, { "title": "the adapter ids and the profile ids are disjoint, so an id means one thing", "passed": true }, { "title": "the signing host's own copy of the profile list is the schema's list", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-207", "kind": "claim", "statement": "Cattle and beef only: the beef profile refuses a leather tariff heading, and the pack says that leather and other derived products ceased to be in scope on 18 September 2026.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "cattle and beef only: the tariff subheadings are 0102 and 0201 and 0202, and no leather heading (ex 4101, 4104, 4107) can be sealed", "passed": true }, { "title": "the English says what the pack is and is not, leads with what it does, and claims no compliance", "passed": true }, { "title": "no claim of compliance, no TRACES client; leather appears only as out of scope", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-208", "kind": "claim", "statement": "The beef sample dossiers: the genuine file verifies given the test authority's root, the altered copy shows the one changed byte, and the incomplete copy says what was left out.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the genuine sample: verified only with the test root; without it, every check but the time passes", "passed": true }, { "title": "the altered sample differs from the genuine one in exactly one byte of one signed record", "passed": true }, { "title": "the incomplete sample: the same records, the first farm's tokens left out, and the notice that says so", "passed": true } ], "evidence": "/provenance/samples/beef-chain-altered.json", "last_checked": "2026-10-13" }, { "id": "CLM-209", "kind": "claim", "statement": "A name, a phone number and two plot geometries entered into tenant data reach no sealed record, dossier, evidence pack, log line, time-stamp request or sample in the beef chain.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "control: the search finds the canaries where they were put (the participant register, the lot label, the opened geometries)", "passed": true }, { "title": "zero hits: every sealed record, both dossiers and the zip, the default pack and its zip, the packs and mailbox, the time-stamp requests and tokens, the signing-action rows, the key access log and every log line", "passed": true }, { "title": "PRIV-02: no canary personal value, and no plot geometry, in any sample file, read as text or with its signed bytes decoded", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-210", "kind": "claim", "statement": "The pack states the rules it rests on with their sources and the date each was read: the Regulation applies to large and medium operators from 30 December 2026 and to micro and small operators from 30 June 2027, New Zealand is benchmarked low risk, and the field list is as in the 2023 Regulation, checked against the 2025 amendment before Beta.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "each fact the register holds is the adapter's, with the register's value; every fact has a source URL and the read-on date", "passed": true }, { "title": "the two UNVERIFIED rows carry D7's wording word for word, a source, the read-on date and what the re-read found", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-100", "kind": "claim", "statement": "Names, contact details and addresses are kept in the participant register, outside the seal. Correcting them changes nothing that has been sealed.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "PRIV-14 correcting an uncommitted field changes no sealed byte and no commitment; the allow-list holds", "passed": true }, { "title": "PRIV-14 the committed fields and the identity fields are refused with a clear code, and the whole call writes nothing", "passed": true }, { "title": "PRIV-09 and PRIV-14 the checker reads the same dossier before and after a register correction and after an erasure: the same verdict, the same lines", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-101", "kind": "claim", "statement": "A registration number or a coordinate that a sealed record commits to is not edited in the register. It is put right by a new commitment with a new salt, linked from a sealed correction that points to the one it replaces.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "PRIV-15 a direct update of a sealed record is refused by the model", "passed": true }, { "title": "PRIV-15 a wrong registration number is corrected only by a new salt and a linked sealed correction: refused until the correction is sealed, then both records stand", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-102", "kind": "claim", "statement": "Erasing a participant removes their register entry and the geometry of their plots, with the salts of their registration numbers and plots, so the fingerprints in sealed records can no longer be opened. The erasure is recorded in a sealed event that names classes and fingerprints and holds no personal data.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "PRIV-08 erasing a canary participant removes the entry, the plot, both salts, from primary storage; no route returns them", "passed": true }, { "title": "PRIV-10 a sealed, time-stamped erasure event names the classes and the commitment digests and nothing else: no id, no key id, no personal data", "passed": true }, { "title": "PRIV-11 after erasure the dictionary attack still recovers nothing: the salt is gone, the key row is zeroed, the digest is unchanged", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-103", "kind": "claim", "statement": "Each erasure is written first to a ledger kept in two places, the database and a file on the host's disk outside it. When a system is restored, the ledger is replayed and every erasure is applied again before any Provenance route serves. If neither copy can be read, nothing is served.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "PRIV-12 an erasure writes the ledger row to the collection AND to a file outside the database; both chain, and neither holds personal data", "passed": true }, { "title": "PRIV-12 the chain links entry to entry in both stores, and a changed byte breaks it", "passed": true }, { "title": "PRIV-12 a line cut short by a crash is ignored, and the next entry starts a fresh line so both parse and the chain holds", "passed": true }, { "title": "PRIV-12 append-only: the ledger model refuses every update and delete path", "passed": true }, { "title": "PRIV-12 each tenant has its own ledger file and its own chain: B's erasure is not in A's file or A's replay", "passed": true }, { "title": "PRIV-12 restore a pre-erasure database: the erasure is re-applied by the replay before anything is served, and the sealed event is made again", "passed": true }, { "title": "PRIV-12 the restored system serves nothing before the replay: the first request after the restore runs it, and the erased entry is not there", "passed": true }, { "title": "PRIV-12 a running process notices a restore under it: the ledger head moved, the next request replays", "passed": true }, { "title": "PRIV-12 the file ledger lost, the database intact: the file is rebuilt from the database by the next replay", "passed": true }, { "title": "PRIV-12 the replay is per tenant and runs in that tenant's context", "passed": true }, { "title": "PRIV-12 a ledger entry cannot reach a lot salt, a signing key or another row's salt: the guard skips it", "passed": true }, { "title": "PRIV-12 neither store readable: every Provenance route answers 503 and nothing is served", "passed": true }, { "title": "PRIV-12 one store readable is enough to serve; with PROVENANCE_LEDGER_REQUIRE_BOTH it is not", "passed": true }, { "title": "PRIV-12 if neither store takes the ledger row, nothing is erased and the call fails", "passed": true }, { "title": "PRIV-12 if one store takes it, the erasure goes ahead and the other is filled by the next replay", "passed": true }, { "title": "PRIV-12 a restore that takes the database AND the ledger file back to before the erasure resurrects the data: the limit the notes state", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-104", "kind": "claim", "statement": "A retention rule is held as data: its legal basis, its period, its source and the day it was read. An erasure request on data a rule covers is held, with the basis recorded and use restricted to that purpose, and carried out when the period ends. Data no rule covers is erased at once.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "PRIV-17 a rule without a source (no URL, a URL that is not https, no read date, a future read date) is not creatable, by the service or the route", "passed": true }, { "title": "PRIV-17 a rule carries its basis, period, source, read date, pending changes and scope, as the owner gave them; no period is built in", "passed": true }, { "title": "PRIV-17 seeded from the facts file: the EUDR five years, its articles, its source and the day it was read, as the file states them", "passed": true }, { "title": "PRIV-17 if the facts file does not carry the rule with a source and a date, NO rule is seeded and the reason is said", "passed": true }, { "title": "PRIV-17 the route seeds the rule for the owner and reports a repeat as already seeded", "passed": true }, { "title": "PRIV-17 in scope: HELD with the basis recorded, nothing destroyed, use restricted, no ledger row and no sealed event yet", "passed": true }, { "title": "PRIV-17 out of scope: erased at once, with a ledger row and a sealed event (no purpose, a purpose no rule covers, or a class the rule does not cover)", "passed": true }, { "title": "PRIV-17 the period is the rule's, not the code's: a two-year rule holds for two years, a one-month rule for one month", "passed": true }, { "title": "PRIV-17 a later sealed use of the commitment moves the end of the period: the anchor is the later of creation and last use", "passed": true }, { "title": "PRIV-17 off by default: with the switch unset nothing is read and nothing is erased, however due", "passed": true }, { "title": "PRIV-17 the platform switch comes before any tenant is read, and the tenant's own before its data", "passed": true }, { "title": "PRIV-17 dry run: says exactly what it would erase and erases nothing", "passed": true }, { "title": "PRIV-17 on: the held items are erased with the basis retention_ended, in the tenant's context, and the sealed event says so", "passed": true }, { "title": "PRIV-17 a per-tenant cap: no more than five holds in one pass", "passed": true }, { "title": "PRIV-17 a hold whose item was used again before expiry is extended, not executed", "passed": true }, { "title": "PRIV-17 one tenant's rules and holds never reach another's data", "passed": true }, { "title": "PRIV-17 a leaving tenant: the register is erased whole, holds are not applied (design 6: delete; the export is offered first)", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-105", "kind": "claim", "statement": "The geometry of each production plot is held on behalf of its owner, with a salt of its own. A sealed step carries only a commitment to it.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the commitment is pinned: a fixed polygon and salt give the canonical bytes and the hashes written in the notes (the checker's vector)", "passed": true }, { "title": "coordinates are rounded to seven places before they are hashed, and the stored geometry is the rounded form", "passed": true }, { "title": "only a Point or a one-ring closed Polygon in range; everything else is refused with the field and the value never quoted", "passed": true }, { "title": "a plot has its own collection, its own salt and unique partial indexes; its participant and its predecessor must be this tenant's", "passed": true }, { "title": "PRIV-07 the data stores hold no salt and the key store holds no data", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-106", "kind": "claim", "statement": "Raw coordinates and salts leave only when an owner discloses them. The owner confirms with a passkey or a two-step code, a sealed record of what, to which kind of recipient and when is made first, and the opening goes only to that kind of recipient.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "PRIV-16 a dossier and its zip hold the plot commitment and the establishment digest, and no geometry, no salt, no register data", "passed": true }, { "title": "PRIV-16 a disclosure seals first, then returns the opening, which opens the commitment the sealed step carries", "passed": true }, { "title": "PRIV-16 if the seal fails nothing is released, no salt is read, no log row is written, and the step-up can be used again", "passed": true }, { "title": "PRIV-16 a passkey or a two-step code only: a password step-up is refused and spends nothing; none at all is 401", "passed": true }, { "title": "PRIV-16 a password step-up is refused BEFORE the step-up is claimed (nothing is spent, then given back); one for another purpose, or six minutes old, is 401", "passed": true }, { "title": "PRIV-16 the recipient class decides: geometry goes to a regulator, an auditor or a certifier, never to a buyer or \"other\"; a lot salt to any", "passed": true }, { "title": "PRIV-16 evidence salts and quantity openings are the holder's, not the platform's: named, they are refused as not held; a class list that does not match the ids is invalid", "passed": true }, { "title": "PRIV-16 another tenant's plot or lot, an unknown one and a malformed one: the uniform 404 or a 400, nothing sealed, nothing read", "passed": true }, { "title": "PRIV-16 the log lists disclosures without openings; a moderator and a platform admin cannot reach it or ask", "passed": true }, { "title": "PRIV-16 service level: no step-up, a password, or a stale object is refused before any plot is read", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-107", "kind": "claim", "statement": "Free text that looks like personal data (an email address, a telephone number, a New Zealand or European identity number, a coordinate pair) is refused by the privacy routes unless the owner overrides it with a stated reason, and the override is recorded. No sealed field takes free text.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "PRIV-04 an email address, a telephone number and a coordinate pair, as the canary is written", "passed": true }, { "title": "PRIV-04 identity numbers: NZ IRD (checksum), NHI, driver licence; IBAN (checksum); EU VAT; BSN (11-proef)", "passed": true }, { "title": "PRIV-04 ordinary business words and the sealed field shapes pass: a digest, a date, a tariff code, a weight", "passed": true }, { "title": "PRIV-04 a finding names the field and the type and never the text that matched", "passed": true }, { "title": "PRIV-04 configurable: a type can be left out, an extra pattern added, a bad pattern refused", "passed": true }, { "title": "PRIV-04 the environment configures the default detector, and a broken value falls back to the built-in rules", "passed": true }, { "title": "PRIV-04 refused with the field and type; no text in the error", "passed": true }, { "title": "PRIV-04 an override must be explicit: acknowledged true, a reason of 8 to 200 characters, nothing else", "passed": true }, { "title": "PRIV-04 clean text passes without an override and reports nothing overridden", "passed": true }, { "title": "PRIV-04 the recipient reference is screened for personal data: refused unless an explicit, reasoned override, which is recorded without the text", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-108", "kind": "claim", "statement": "A proof about a plot that does not reveal it, such as inside a declared region or outside a protected area.", "status": "Roadmap", "result": "NO_TESTS", "tests": [], "last_checked": "2026-10-13" }, { "id": "CLM-211", "kind": "claim", "statement": "The owner chooses the sector profile new lots are created under; each new lot keeps that profile for the rest of its chain, and a later change of the setting never re-profiles a lot that already exists.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "PUT: moderator 403, no CSRF token 403, platform admin 404, an id off the list 400, any other key 400, no key 400; nothing stored", "passed": true }, { "title": "with beef_nz_v1 set: the genesis is sealed under it, the row pins it, the view says so; a genesis the profile refuses makes no lot and no step", "passed": true }, { "title": "a later step is validated under the lot's pin: a step the profile refuses is refused, appends nothing, and a step it allows is sealed under it", "passed": true }, { "title": "a change of setting never re-profiles a lot that exists: the pin survives a switch to honey and to none, and a new lot takes the new setting", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-212", "kind": "claim", "statement": "In the evidence pack an opening appears only under a sealed disclosure event of the party that holds it, checked against its own signed bytes, made no later than the pack, and for the recipient class the owner expects.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the event must be the holder's: an event by another party, even one that names the commitment, opens nothing", "passed": true }, { "title": "the receipt hash must be the hash of the bytes and signature given, and the record must be what the bytes say: a 64-hex of the caller's choosing is refused", "passed": true }, { "title": "an expected recipient class, when given, must be the event's; none given asks nothing", "passed": true }, { "title": "an event dated after the pack is refused, whether its decided_at or its occurred_at is late", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-213", "kind": "claim", "statement": "The owner exports an evidence pack from a lot with a passkey or two-step code. The pack carries commitments only. A plot's geometry enters it only under the receipt of a sealed disclosure event of the owner's own, made for that kind of recipient, and each event can be used for one export.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "3.33 the default pack is commitments only: a zip of four files, the plot committed and not opened, no coordinate anywhere", "passed": true }, { "title": "3.33 an opened pack: the opening comes only with the receipt hash of a sealed event naming it, for that recipient class", "passed": true }, { "title": "3.33 an event is bound to ONE export: a second use is 409 disclosure_already_used, whatever the step-up, and a race makes one pack", "passed": true }, { "title": "3.33 the recipient must be the event's: another class is 409 disclosure_recipient_mismatch, the event is not spent, and nothing is recorded", "passed": true }, { "title": "3.33 a failed build does not burn the event, and says nothing of the values", "passed": true }, { "title": "3.33 owner only: a moderator is 403, a member 403, a platform admin 404; another tenant's lot or event is the uniform 404; a malformed or unknown lot_ref too", "passed": true }, { "title": "3.33 no step-up is 401; a password is refused; a step-up for another purpose or an old one is 401; a spent step-up cannot export twice; nothing is recorded", "passed": true }, { "title": "3.33 the body is a whitelist: any other key, a bad recipient class or a bad hash is 400 and spends nothing", "passed": true }, { "title": "3.33 an event that opens only lot salts still binds to its one export and opens no geometry; one for a plot of another lot opens none here", "passed": true }, { "title": "3.33 canary: nothing outside the register and the plots, and no log line, carries the canary after an opened and a default export", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-214", "kind": "claim", "statement": "A lot received by handover keeps the sector profile its giver's signed proposal carried, whatever the receiving tenant's own setting says. A proposal that carries none leaves the lot without a profile, and the lot records why.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "3.28 a beef lot received by a tenant whose setting is honey is pinned to beef_nz_v1, and the receiver's steps are held to beef, not honey", "passed": true }, { "title": "3.28 the receiver's setting never re-profiles the received lot, and a later change of it does nothing", "passed": true }, { "title": "3.28 a lot whose proposal carried no profile stays unpinned and records the limit; a lot of an unprofiled giver is not given the receiver's setting", "passed": true }, { "title": "3.28 a profile id this platform does not know leaves the lot unpinned with the limit \"unknown_profile\"; a lot that returns to a holder keeps its one pin", "passed": true }, { "title": "3.28 the lot row of another tenant is untouched, and the pin is on the receiver's own row only", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-215", "kind": "claim", "statement": "After a registration number is corrected, an erasure of the participant also names the fingerprints that records sealed before the correction carry.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "3.35 after a completed amendment the sealed erasure event and the ledger entry list the OLD digest as well as the current one", "passed": true }, { "title": "3.35 the history is bounded to twenty digests, newest last, and a pending amendment's digest is named too", "passed": true }, { "title": "3.35 the twenty-first prior digest pushes out the oldest", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-300", "kind": "claim", "statement": "The owner console sets the sector profile new lots are created under, says it applies to new lots only, and sends the change only after the owner confirms it.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the sector profile: the two sentences shown, nothing sent before Confirm, then the PUT; a refused profile is said plainly", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-301", "kind": "claim", "statement": "The owner console corrects only the participant fields that no sealed record covers; a refused change to a covered field is explained in plain words with the linked-amendment path.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the participant register: add, then correct only the allowed fields, each sent only after Confirm; a sealed-field refusal points to the amendment", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-302", "kind": "claim", "statement": "Before a participant is erased, the owner console states what erasure does and what it cannot undo (copies already shared; a restored backup has the erasure applied again), asks the owner to confirm it is them, and says plainly when applying the erasure is still under way.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "erasing a participant: what erasure does and cannot undo is shown, nothing is sent before Confirm and the step-up; 202 is said plainly", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-303", "kind": "claim", "statement": "The owner console lists plots by their commitments and shows a plot's coordinates only when the owner opens that plot.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "plots: a point is added after Confirm; the list shows the commitment and never coordinates until the owner opens one", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-304", "kind": "claim", "statement": "When the server refuses text that looks like personal data, the owner console names the field and the kind of data and never the text; a recorded override needs a reason and a second confirmation.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the personal-data refusal names the field and the kind of data, never the value; the recorded override needs a reason and a second Confirm", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-305", "kind": "claim", "statement": "Every typed field in the owner console that reaches a sealed record carries the warning \"This will be sealed permanently. Don't enter personal information.\"; every other typed field says it is not sealed.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "PRIV-04: every text input that can reach a sealed record carries the warning; every other one says it is not sealed", "passed": true }, { "title": "PRIV-04, static: every field the server screens with the free-text guard is either not sent by the console or sent from an input that carries the warning", "passed": true }, { "title": "PRIV-04: the sealed-permanently warning is the operator's own sentence, verbatim, in the strings and the English locale", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-306", "kind": "claim", "statement": "A moderator is not shown the participant register, the sector profile or the erasure log in the owner console.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a moderator is not shown the register, the profile or the erasure log, and a direct link says they are the owner's", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-307", "kind": "claim", "statement": "The owner console lists retention holds, the erasure log and disclosure events read only.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "erasure and disclosure: holds, the erasure log and disclosures are listed read only", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-400", "kind": "claim", "statement": "The offline check states the mass balance of the quantities opened in a dossier: balanced, unbalanced, not compared or not checked; balanced says only that the figures in the file add up.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the vectors were read", "passed": true }, { "title": "the opening digest, for every unit, many values, and every malformed opening", "passed": true }, { "title": "over generated record sets: blends, splits, chains, corrections, unopened and mismatched openings, every tolerance", "passed": true }, { "title": "balanced: 1000 kg harvested, 900 kg packed; the line says only that the figures in the file add up", "passed": true }, { "title": "unbalanced: 1000 kg harvested, 1100 kg packed", "passed": true }, { "title": "unchecked: the pack's quantity not opened", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-401", "kind": "claim", "statement": "The checker carries the Italian, Polish and Portuguese trusted lists, each with its sequence and issue date, and counts real tokens of different authorities as different authorities.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the real Certum and the real Aruba tokens on one day root: 2 authorities, 2 stamping certificates, no quorum finding", "passed": true }, { "title": "with the real Portuguese state token too: 3 authorities; the same real token named twice is refused by the platform", "passed": true }, { "title": "the lists, sources and services; the real Portuguese token is listed, the real Certum token (time.certum.pl, not a qualified unit) is not", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-402", "kind": "claim", "statement": "A record naming a sector profile this copy of the checker does not know is checked as any other, with a line naming the profile, never shown as changed; the profile ids are those of the platform schema.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a record naming a profile the checker does not list is checked as any other, with a line naming the profile, never changed", "passed": true }, { "title": "beef_nz_v1 in, eudr_cattle_v1 out; equal to receiptSchemas.PROFILE_IDS", "passed": true }, { "title": "a step naming beef_nz_v1: no profile line; one naming eudr_cattle_v1 (now an adapter id): the profile line", "passed": true }, { "title": "\"zzz\" on a step: the profile_unknown line, the record checked, never changed", "passed": true }, { "title": "\"zzz\" on a step whose signature is also damaged: changed for the signature, and the profile still named", "passed": true }, { "title": "malformed \"Bad Id\": a contract fault, no profile line", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-403", "kind": "claim", "statement": "A commitment whose data its party erased is shown as \"Commitment unopened (data erased)\", informational and never as a change, only on a verified erasure record of the same party whose key the reader pinned.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a sealed erasure event for the pack's quantity: \"commitment unopened (data erased)\", informational, verified, never tamper", "passed": true }, { "title": "erased after the lot's day root: both real events are in the file, verify as records, and the checker says each commitment was erased, once, informational, without lowering the headline", "passed": true }, { "title": "erased the same day: the events sit in the lot's own day root, every record in its range is shown, and the segment is a complete range", "passed": true }, { "title": "no fingerprint entered for the party: the events are not read, so no commitment is said to be erased", "passed": true }, { "title": "an altered erasure event (its basis changed in the signed bytes) is changed, and is not read as an erasure", "passed": true }, { "title": "past the size limits the events are left out and the file is built as it was before", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-404", "kind": "claim", "statement": "A disclosed boundary of a plot of land is checked against the commitment its party signed: a match is shown with whether a signed disclosure record of that party is in the file, any change to the geometry, its digest or its salt is shown as changed, and an opening no shown record carries is listed and not read.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "given the real disclosure's openings: carried as returned, with the party's disclosure event and its proof; the checker says opened and signed, never a coordinate", "passed": true }, { "title": "openings handed in without a sealed disclosure: carried, and the checker says opened without a sealed disclosure event", "passed": true }, { "title": "a moved vertex (geometry tampered, digest left) is a mismatch", "passed": true }, { "title": "a moved vertex with its geometry digest recomputed is still a mismatch (the commitment binds the digest)", "passed": true }, { "title": "a changed salt is a mismatch", "passed": true }, { "title": "two openings swapped between two plots of the file are both mismatches", "passed": true }, { "title": "an opening for a commitment not in the file is listed as not read, and changes nothing", "passed": true }, { "title": "a duplicate key, a malformed opening, an empty object and more than 256 openings are unreadable", "passed": true }, { "title": "an altered disclosure record is changed and is not read as the party's disclosure", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-216", "kind": "claim", "statement": "A lot handed over under a sector profile that does not fit it (another sector's profile, an id off the closed list, or a tariff code the profile does not allow) is refused at acceptance: nothing is signed and no lot row is made.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a valid id on the wrong sector's lot (honey profile on a beef lot) is refused at acceptance: profile_mismatch, nothing signed, no lot row", "passed": true }, { "title": "an id off the closed list, signed by the giver, is refused as a schema fault: nothing signed, no lot row", "passed": true }, { "title": "the same profile as the lot (beef on a beef lot) and the tariff code must fit too: a beef profile on terms with a honey tariff code is refused", "passed": true }, { "title": "the inbox shows the carried profile before the receiver accepts; an unprofiled lot shows none and why", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-217", "kind": "claim", "statement": "An evidence-pack export that was left part-built for more than ten minutes is taken over by the next export with that disclosure, atomically; a live build is never taken over, a finished export never goes stale, and a slow build that was taken over hands out no pack.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a building row older than ten minutes is abandoned: a new export with that event replaces it, atomically, and the event is then spent", "passed": true }, { "title": "a building row younger than ten minutes is a live build: 409, and nothing is replaced", "passed": true }, { "title": "at the claim itself (a race past the early look) a live build is never taken over: the service refuses with disclosure_already_used", "passed": true }, { "title": "an exported row never goes stale, however old", "passed": true }, { "title": "a slow build whose row was taken over as abandoned hands out no pack: 409 and the zip is not sent", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-218", "kind": "claim", "statement": "In production a deployment whose data region is not set answers every Provenance route with 503 data_region_unset until its host chooses New Zealand or the EU; a host cannot choose by saying nothing.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "PRIV-19 in production an unset region is \"unset\", not NZ, and every Provenance route answers 503 data_region_unset until a host chooses; a host cannot self-declare by saying nothing", "passed": true }, { "title": "PRIV-19 the region is NZ unless the deployment says EU; anything else is refused and the routes answer 503", "passed": true } ], "last_checked": "2026-10-13" }, { "id": "CLM-405", "kind": "claim", "statement": "A shortfall in the party leaf, which holds every standing authorisation, key record and authority confirmation, is shown as incomplete in every segment, so a stripped key record, mandate withdrawal or confirmation withdrawal never verifies; an attestation is counted under the lot it speaks about, so one left out of a file for that lot while its count stays reads incomplete, within the day roots the file includes; erasure and disclosure records, kept in a separate leaf, may be left unshown under a selection label and are then counted on one line, with no claim of completeness.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a genuine file whose party erased another entry: the always-shown leaf in full, the omittable leaf short, labelled a selection; verified with one line", "passed": true }, { "title": "K cases on the split leaves: a key record, a mandate withdrawal or a confirmation withdrawal stripped is never verified, whatever the label", "passed": true }, { "title": "C4: an omittable shortfall never stops a shown erasure record being read; an original-leaf shortfall does", "passed": true }, { "title": "an attestation is committed under the lot it speaks about (decision V29, which replaced this test's V28 reading): shown with that lot, verified", "passed": true }, { "title": "the day root itself commits the two leaves apart: a key record and an erasure record of one day sit in different leaves", "passed": true }, { "title": "erasure and disclosure records, and only they, go to the omittable leaf, in the platform and in the checker; any other or future kind to the original", "passed": true }, { "title": "K1.1 the compromise key record stripped: selective, complete_range, and with the label removed", "passed": true }, { "title": "K2 a key withdrawal stripped, and K2b a rotation stripped (selective)", "passed": true }, { "title": "K3 a standing-authorisation withdrawal stripped (selective and complete_range); K12 the same for a two-lot party, nothing else edited", "passed": true }, { "title": "K4 an authority confirmation's withdrawal stripped under a selection label", "passed": true }, { "title": "K7 the compromise stripped beside an erasure event: not verified, and no commitment is said to be erased", "passed": true }, { "title": "K9 two growers: the first one's compromise stripped, its segment labelled a selection, the second as built", "passed": true }, { "title": "K11.1 a two-lot party (the builder labels the file a selection): the key record stripped, nothing else edited", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-14" }, { "id": "CLM-406", "kind": "claim", "statement": "A time stamp is labelled qualified only when the trusted-list entry is a qualified time-stamping service whose status is granted and began no later than the stamp; a withdrawn status, another type, or a status that began later earns no label, and a confirmation citing a newer issue of the list does not override the checker's snapshot.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "every snapshot entry carries type QTST, status granted and a status start no later than its list issue; the Italian entry as read on 13 Oct 2026", "passed": true }, { "title": "control: granted since 2017, type QTST, confirmed: qualified", "passed": true }, { "title": "a status that began after the stamp (2030): listed, but not as qualified at the time of the stamp", "passed": true }, { "title": "a withdrawn status, and a type other than QTST, earn no label", "passed": true }, { "title": "a confirmation citing a newer issue of the list: the snapshot decides, and the text says the confirmation cites a newer issue", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-407", "kind": "claim", "statement": "A correction of a derivation step keeps the lot derived from the same inputs, so its mass balance is still checked, in the offline checker and on the platform.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "500 kg in, 600 kg out; the 600 kg step corrected (time only): still unbalanced, in the checker and on the platform; the lot graph keeps the derivation", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-408", "kind": "claim", "statement": "An erasure or disclosure record is read only when it verified, its party is pinned, it is proved into a day root in the file and it was not signed under a key stated compromised before it; the erasure date is shown as the party states it.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "an erasure event signed under a key the party states was compromised before every token is not read", "passed": true }, { "title": "an erasure event no day root in the file proves is not read; a proved one is shown with its date as stated", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-409", "kind": "claim", "statement": "A quantity or plot opening is said to match only for a record whose signature verified; for any other record the check says the opening was not checked against it.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "an opening on a record whose signature did not verify is never said to match the commitment it signed (quantity and plot)", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-219", "kind": "claim", "statement": "Erasing a participant writes one ledger entry however many erasures race: claims are taken in a fixed order, the first lost claim stops the loser, a claim left by a crash can be taken again after five minutes, and a failed ledger write gives the claim back.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "two concurrent erasures of one participant make ONE ledger entry; the loser does nothing", "passed": true }, { "title": "a claim left by a crash can be taken again after five minutes; a fresh one cannot; a failed ledger write gives the claim back", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-13" }, { "id": "CLM-410", "kind": "claim", "statement": "Every included day root in a file carries an entry or an absence proof for both reserved party leaves; a reserved leaf stripped whole, records and entry, is shown as incomplete.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a file whose party has no erasure or disclosure record carries an absence proof for the omittable leaf; stripping the proof, or an entry, is incomplete", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-14" }, { "id": "CLM-411", "kind": "claim", "statement": "The reserved reference of the omittable party leaf is never a lot: it is refused as a lot reference and as a derivation input by the platform schema, the signing host, handover terms, the dossier builder and the checker, and every copy of both reserved references is the SHA-256 of its text.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "every copy of both reserved refs is SHA-256 of its ASCII text, and the copies agree", "passed": true }, { "title": "the new ref is refused as a lot everywhere the old one is: schema, signing host, handover terms, dossier, checker", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-14" }, { "id": "CLM-412", "kind": "claim", "statement": "Whenever any number of a party's range is missing from a file, every record shown needs its own inclusion proof; a record whose proof was deleted does not verify.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "in the designed case every record shown still needs its own inclusion proof: one deleted is not verified (found by the V28 differential)", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-14" }, { "id": "CLM-413", "kind": "claim", "statement": "Where a party leaves erasure or disclosure records unshown, the line that counts them also says that which kinds were filed there is only the signer's word, and that an opened value may have been erased by a record not shown.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "K6.14: a quantity erasure record stripped and the erased opening put back reads as before, and the line says the opened value may have been erased", "passed": true }, { "title": "K13.1: a key compromise the signer filed under the omittable leaf and stripped reads as before, and the line says the kinds are only the signer's word", "passed": true }, { "title": "both clauses are in the line in all five locales, each with its placeholders, and the English locale equals the page", "passed": true }, { "title": "ownRecords.PARTY_FULL_KINDS = dossier.PARTY_SHOWN_KINDS = the checker's SHOWN_PARTY_KINDS, all on the always-shown leaf", "passed": true } ], "evidence": "/provenance-bundle-spec.html", "last_checked": "2026-10-14" }, { "id": "CLM-501", "kind": "claim", "statement": "An organisation that leaves is offered a full export of its records first: every signed record with its signature, its register and plots, and the ledgers. After the export is confirmed and a cancel window has passed, the platform deletes its own copy and keeps only the organisation's DID entry with its keys retired and the erasure ledger; copies its counterparties already hold are theirs and remain.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "every sealed row is in it with its canonical bytes and signature, day roots included; the time-stamp token is Provenance's only", "passed": true }, { "title": "lot rows with labels, the register, plots with geometries, the ledger and the signing-action evidence are in it; the salt key ids are not", "passed": true }, { "title": "every Provenance collection is empty for the leaver, the sealed chain included, and no erasure event is sealed", "passed": true }, { "title": "a counterparty's copy is its own: the leaver's open offer is expired in the receiver's mailbox through the delivery module, and the row is kept", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-414", "kind": "claim", "statement": "A New Zealand dairy chain, from two farms by tanker to a processor, an exporter and an importer in the EU, is sealed under one sector profile, dairy_nz_v1, and the importer's dossier verifies in the offline check.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the offline checker in Node: headline verified, every record verified, every stamp checked; the merge and the cheese run are in it", "passed": true }, { "title": "every step in the file was sealed under dairy_nz_v1 and is a dairy activity the profile allows; a farm carries its registration only as a digest", "passed": true }, { "title": "the genuine sample: verified only with the test root; without it, every check but the time passes", "passed": true }, { "title": "what the sample shows is in it: dairy_nz_v1 steps, the merge of two lots and the cheese run, both trust modes, a balanced mass balance in kilograms", "passed": true } ], "evidence": "/provenance/samples/dairy-chain.json", "last_checked": "2026-10-14" }, { "id": "CLM-415", "kind": "claim", "statement": "The dairy profile follows milk from many farm lots merged into one processing lot and split into product lots: the genealogy balances in kilograms on the quantities their holders open, and a quantity that is not opened leaves the result unchecked.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the importer's file balances on the holders' openings, in mass: 13930 kg weighed in, 13900 kg merged, 1400 kg of cheese from it; no lot grows", "passed": true }, { "title": "the processor's own records, which hold BOTH product runs, split the merged lot: 2600 kg of products out of 13900 kg, one group of two outputs", "passed": true }, { "title": "merge, separation and product run are told apart by the heading the step carries and the number of inputs", "passed": true }, { "title": "the genealogy cap is the schema's: 32 input lots are a lot_set, 33 are not, and the profile refuses 33 and takes 32 on a merge and a product run", "passed": true } ], "evidence": "/provenance/samples/dairy-chain.json", "last_checked": "2026-10-14" }, { "id": "CLM-416", "kind": "claim", "statement": "Under the dairy profile the mass balance has one dimension, mass: a litre quantity is never converted, and in the platform's reading a group that mixes litres with kilograms, or is wholly in litres, never reads balanced; the offline checker does not apply the dairy mass rule.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a group that MIXES litres with kilograms is not_comparable and never balanced, and nothing converts one to the other", "passed": true }, { "title": "a group wholly in litres is compared in litres by the shared function, and under dairy's rule is not_comparable, never balanced; ml and a count likewise", "passed": true }, { "title": "all in kilograms: balanced; the output heavier than the inputs: exceeds (tolerance 0)", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-417", "kind": "claim", "statement": "A step the dairy profile does not allow is refused before any time stamp is asked for and before anything is signed, and a lot created under it keeps it for the rest of its chain.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a lot whose genesis the profile refuses: refused before any time stamp is asked for, any salt minted, any row written or anything signed", "passed": true }, { "title": "a later step the profile refuses is refused before any time stamp or signature, and appends nothing; an allowed one is sealed under the lot's pin", "passed": true }, { "title": "the builder itself refuses (not only the services), and generic_v1 does not narrow", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-418", "kind": "claim", "statement": "A dairy lot handed to another tenant keeps the dairy profile whatever the receiver's own setting is, and each lot a tenant creates keeps the profile it was created under.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "is pinned to dairy_nz_v1 from the giver's signed proposal, never to the receiver's setting; the inbox shows the carried profile first", "passed": true }, { "title": "is pinned to dairy_nz_v1 from the giver's signed proposal, never to the receiver's setting; the inbox shows the carried profile first", "passed": true }, { "title": "is pinned to dairy_nz_v1 from the giver's signed proposal, never to the receiver's setting; the inbox shows the carried profile first", "passed": true }, { "title": "the receiver's steps on it are held to dairy, not to its own setting: a honey or beef step is refused by the pin, a dairy step is sealed under it", "passed": true }, { "title": "the receiver's steps on it are held to dairy, not to its own setting: a honey or beef step is refused by the pin, a dairy step is sealed under it", "passed": true }, { "title": "the receiver's steps on it are held to dairy, not to its own setting: a honey or beef step is refused by the pin, a dairy step is sealed under it", "passed": true }, { "title": "one tenant, three lots under three settings: each lot keeps the profile it was created under, and its later steps are held to it", "passed": true }, { "title": "verifyOfferForReceiver: profile_mismatch for a terms heading outside chapter 04's dairy headings; a dairy heading passes the fit", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-419", "kind": "claim", "statement": "The dairy sample dossiers: the genuine file verifies given the test authority's root, the altered copy shows the one changed byte, and the incomplete copy says what was left out.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the genuine sample: verified only with the test root; without it, every check but the time passes", "passed": true }, { "title": "the altered sample differs from the genuine one in exactly one byte of one signed record", "passed": true }, { "title": "the incomplete sample: the same records, the first farm's tokens left out, and the notice that says so", "passed": true } ], "evidence": "/provenance/samples/dairy-chain-altered.json", "last_checked": "2026-10-14" }, { "id": "CLM-420", "kind": "claim", "statement": "The dairy profile has one id, dairy_nz_v1, the same in the schema, the tenant setting, the lot record, the signing host and the checker; it is reachable through the settings route and is not offered in the owner console.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "dairy_nz_v1 is on the schema's list, in the tenant setting's enum, the lot model's enum, the signing host's list and the checker's list; each list is the schema's", "passed": true }, { "title": "the registry has it, under its own id, with the profile module: and a profile is not an adapter id", "passed": true }, { "title": "the console does not offer it (API only), and every console choice is a profile that has rules", "passed": true }, { "title": "the settings route offers it as having rules while the console does not: GET /settings/profile lists dairy_nz_v1 in with_rules; setting it by the API works", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-421", "kind": "claim", "statement": "A name, a phone number and a position entered into a farm's tenant data reach no sealed record, dossier, log line, time-stamp request or sample in the dairy chain.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "control: the search finds the canaries where they were put (the participant register and the lot label)", "passed": true }, { "title": "zero hits: every sealed record of every party, the dossier and its zip, the packs and the mailbox, the time-stamp requests and tokens, the signing-action rows, the key access log and every log line", "passed": true }, { "title": "PRIV-02: no canary personal value in any sample file, read as text or with its signed bytes decoded", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-502", "kind": "claim", "statement": "A machine key for Provenance carries only the two narrow Provenance scopes (create a lot, append a step) and no scope of any other family, and only the organisation's owner can mint one; a platform admin can never mint one.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "are narrow and exactly these: one to create a lot, one to append a step", "passed": true }, { "title": "the owner can mint each scope and both, and the key is saved with exactly those scopes", "passed": true }, { "title": "the owner cannot mix a Provenance scope with any other scope", "passed": true }, { "title": "a platform admin cannot mint one: with the synthetic role \"admin\" every Village gives them", "passed": true }, { "title": "nor can a platform admin who is also holding the role \"owner\" in this Village", "passed": true }, { "title": "a moderator cannot mint one, and nothing is saved", "passed": true }, { "title": "a member cannot mint one, and nothing is saved", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-503", "kind": "claim", "statement": "A machine key stops working as soon as its creator is no longer an active owner or moderator of the Village; it is checked on every request.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the creator must still be an active owner or moderator of this Village on EVERY request", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-504", "kind": "claim", "statement": "When either Provenance switch is off, every machine route answers the same 404, before any key is looked at.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the tenant switch off (flag false): the same 404, with a good key and with a bad one", "passed": true }, { "title": "the tenant switch off (no provenanceRecord): the same 404, with a good key and with a bad one", "passed": true }, { "title": "the tenant switch off (no settings): the same 404, with a good key and with a bad one", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-505", "kind": "claim", "statement": "A retry cannot seal a second record: every machine write carries an Idempotency-Key, the same key and body replay the first answer, and a failure after the seal keeps the key so the retry seals nothing.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "an Idempotency-Key is required, and the same key with the same body replays: one lot, one genesis, the same answer", "passed": true }, { "title": "A FAILURE AFTER THE SEAL leaves the claim: the retry with the same key seals nothing, and the chain has the one record", "passed": true }, { "title": "eight concurrent identical calls make exactly one winner; the rest replay what it sealed", "passed": true }, { "title": "an indeterminate claim can never be taken again: a retry seals nothing", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-506", "kind": "claim", "statement": "A batch of steps or a CSV file is checked whole before the first seal; a failure at a seal stops there and reports the index and the count sealed; errors name a field path, never a cell's value.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a bad row anywhere seals NOTHING: the whole batch is checked first; the error carries the index and a field path, never the value", "passed": true }, { "title": "a failure at the seal of row 2 stops there: sealed 2, the receipts of those two, the failing index; a replay says the same and seals nothing", "passed": true }, { "title": "a good row followed by a bad row seals neither", "passed": true }, { "title": "a bad cell is refused by the validator naming a field PATH only, never the value", "passed": true }, { "title": "refuses a cell over 256 characters and reports where, not what", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-507", "kind": "claim", "statement": "The CSV columns are a closed set, and no caller can set the capture time, capture mode, signing model, standing authorisation, profile or tenant of a record.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the set has no column that names a tenant, a lot_ref, a time of capture, a capture mode, a signing model, a mandate or a profile", "passed": true }, { "title": "a repeated column and a missing required column are refused", "passed": true }, { "title": "creates the lot and signs its genesis; the historical date is occurred_at; the builder sets capture fields; no salt in the answer", "passed": true }, { "title": "a body naming a tenant changes nothing: the lot lands in the key's tenant and a tenantId key is a refusal", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-508", "kind": "claim", "statement": "Machine-route limits are per key and per tenant, never per address.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "per key (6 a minute on /steps/batch): a key that has spent its budget is 429, a second key from the same address is not", "passed": true }, { "title": "per tenant (12 a minute on /steps/batch): once the tenant's keys together have spent it, a fresh key is 429 too; another tenant is untouched", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-509", "kind": "claim", "statement": "Every machine route is held to the key's own tenant: another tenant's lot, named by reference or by row id, answers exactly as an unknown lot, and nothing of a batch or CSV naming it is sealed.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "CROSS-TENANT: tenant B's lot, named by its reference or by its row id, is byte-identical to an unknown lot for tenant A's key", "passed": true }, { "title": "CROSS-TENANT: a row naming tenant B's lot is lot_not_found for tenant A, and nothing of the batch is sealed", "passed": true }, { "title": "CROSS-TENANT: a CSV naming tenant B's lot is lot_not_found and seals nothing", "passed": true }, { "title": "no key is 401; a cookie alone is 401 (not a CSRF 403); an unknown key is 401; another tenant's key is 403; nothing is written", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-510", "kind": "claim", "statement": "A webhook destination must be https and resolve only to addresses on the open internet, checked when it is registered and again at every delivery; a redirect is reported as a failure and its Location is never requested, and no log line names the destination or the secret.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "https to a public name passes; every other scheme is refused", "passed": true }, { "title": "a name that resolves to a private address is refused", "passed": true }, { "title": "a stored URL whose name now resolves to a private address is not requested, and the failure is recorded", "passed": true }, { "title": "a 302 is reported as a redirect and the Location is not requested", "passed": true }, { "title": "a redirect reported as ok is still a failure (an opaque redirect, or a 3xx a stub marks ok)", "passed": true }, { "title": "failures of every kind log nothing that names the destination or the secret", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-511", "kind": "claim", "statement": "A Provenance webhook payload carries exactly six keys from the sealed receipt, and nothing else a record holds.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "exactly six keys, with the values the receipt gives", "passed": true }, { "title": "a record stuffed with every kind of sensitive value contributes none of it", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-512", "kind": "claim", "statement": "A webhook failure can neither fail nor delay a seal: a dispatcher that throws, rejects or never answers leaves the sealed record in place and the next seal unaffected.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a dispatcher that throws: the seal resolves with its receipt and the row exists", "passed": true }, { "title": "a dispatcher that never answers does not hold up the seal or the next seal", "passed": true }, { "title": "the real dispatch path with a hanging endpoint does not delay the seal", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-513", "kind": "claim", "statement": "Provenance webhook events are sent only while both switches are on, read when the event is raised, and each tenant's events reach only that tenant's endpoints.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the tenant switch off: nothing is sent; on again: it is", "passed": true }, { "title": "the switches are read when the event is raised, not when the webhook was registered", "passed": true }, { "title": "tenant B's event reaches B's endpoint only, never A's", "passed": true }, { "title": "sealed from inside tenant A's request context, B's event still goes to B only", "passed": true }, { "title": "dispatch for tenant B called from tenant A's context reaches B's webhooks only", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-514", "kind": "claim", "statement": "Each January, and once for each dated event in force, an archive root covers the party's day roots by one Merkle root, linked to the previous archive root.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the root covers the day roots up to the year end and no later one; its content is what the schema says", "passed": true }, { "title": "later in the year it catches up once, and the next January covers only the new year", "passed": true }, { "title": "an event in force builds a root over every day root so far, once; the root after it links to the January one", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-515", "kind": "claim", "statement": "No archive root is signed for a tenant without a live standing authorisation naming archive roots.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a tenant whose mandate does not name archive_root is skipped and counted; nothing is signed and the key store is not asked (real resolver)", "passed": true }, { "title": "no mandate at all, an expired one and a withdrawn one are skips too; another failure is a failure", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-516", "kind": "claim", "statement": "An archive root whose time-stamp quorum was not met is still sealed and reported, never hidden, after a twelve-hour wait for an outside stamp.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "no RFC 3161 stamp within the grace: deferred, nothing sealed, no fork; asked again and sealed when an authority answers", "passed": true }, { "title": "after the grace the root is sealed with whatever the authorities gave, and reported (quorum.met false)", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-517", "kind": "claim", "statement": "The offline checker carries and reads an archive root the job produced.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "an archive root the job produced, signed by a party of the four-party chain, travels among that party's day roots and is read as carried", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-518", "kind": "claim", "statement": "The leaving export is for the owner only, with a step-up, and each download link works once.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "export, download once, confirm the typed digest, freeze, cancel", "passed": true }, { "title": "a moderator is 403 owner_only on every route; an API-key session is 403", "passed": true }, { "title": "no step-up, a step-up for another purpose (the dossier's) and a replayed step-up are all refused; nothing is stored", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-519", "kind": "claim", "statement": "After a confirmed export and the end of the cancel window, the platform deletes its whole copy of the organisation's Provenance data and keeps only the DID entry with its keys retired, the erasure ledger and its service ledgers; the deletion runs whatever the Provenance switches say.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "every Provenance collection is empty for the leaver, the sealed chain included, and no erasure event is sealed", "passed": true }, { "title": "kept: the erasure ledger in both stores (with the tenant_copy entry), the signing-action rows with the member and credential cleared, the meter, and a certificate of counts and digests", "passed": true }, { "title": "it is not behind any switch: with the platform switch unset and the tenant's setting off, the copy is still deleted", "passed": true }, { "title": "a confirmed export is not enough while the cancel window is open; after it ends the deletion runs, with the global switch off, and the certificate names the export", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-520", "kind": "claim", "statement": "A regulator, auditor or buyer downloads a dossier with a single-use link, with no account and no key; a failed download does not spend the link.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "no session and no role: the zip arrives with the right headers; the class is on the tenant log; the second try is the uniform 404", "passed": true }, { "title": "a fault while the zip streams: the link is put back and the log row removed", "passed": true }, { "title": "no console string says the download needs the owner's session or an account", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-521", "kind": "claim", "statement": "A dossier fetched through a link carries no plot or quantity opening, and the recipient class is recorded on the link and in the unsealed disclosure log, never in a sealed record.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the owner's disclosure list shows the download with its class and no opening", "passed": true }, { "title": "the schema is strict: a class outside the list and a field outside the schema are both refused", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-522", "kind": "claim", "statement": "An attestation is committed under the lot it speaks about, so an attester's fail dropped from a file reads incomplete. An attestation delivered to the lot's holder through the platform is recorded in the holder's own chain, and a file that then drops the attestation with its count, the attester's segment, or the attester's day root that includes it reads incomplete. This holds for the day roots the file includes: a file whose builder cuts the trailing day root of the holder or of the certifier (the general limit on a party's day roots that are not in the file, which the check's list of what it does not establish states) can still drop a delivered attestation without trace. Limit, stated once: an attestation that never reached a holder in the file through the platform can be left out of a file with its count, and nothing in the file says so; the check's list of what it does not establish says this.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the day root commits the attester's attestations under X and Y, never the party leaf", "passed": true }, { "title": "the holder drops the attester's 'fail': lot_records_missing, incomplete", "passed": true }, { "title": "K1.2: the fail stripped with the certifier's entry for X, under selective, no label and complete_range: with the grower's receipt never verified (attestation_receipt_unmet); with none, the V32 limit", "passed": true }, { "title": "K10.2: two certifiers, A passes and B fails; B's fail stripped with its entry: with the receipts never verified; with none, the V32 limit", "passed": true }, { "title": "K9.2: the certifier's segment carried as a pack segment, stripped the same way before it was passed on: with the receipt never verified; with none, the V32 limit", "passed": true }, { "title": "the attester's segment removed whole: incomplete, attestation_receipt_unmet", "passed": true }, { "title": "the attestation stripped with its entry, under selective, no label and complete_range: incomplete, attestation_receipt_unmet", "passed": true }, { "title": "the day root of the day of the attestation (day 2) dropped, with or without the attestation: incomplete, attestation_receipt_unmet", "passed": true }, { "title": "LIMIT: an attestation that no receipt names, stripped with its entry, reads verified; shown, it reads attestation_unreceipted; item 10 of the list says so", "passed": true }, { "title": "the holder's dossier reads verified with the receipt met; stripped of the attestation it reads incomplete, attestation_receipt_unmet", "passed": true }, { "title": "GENUINE: the genuine file with the certifier's fail reads verified, and the fail contests the origin", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-523", "kind": "claim", "statement": "The day-root job reports a day root built without its time-stamp quorum: it is still sealed, counted, and named on the tenant's line.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "not met, one authority answered: the root is still sealed, counted, and the tenant's one line says QUORUM NOT MET", "passed": true }, { "title": "not met, none answered: the root is still sealed, counted, and the tenant's one line says QUORUM NOT MET", "passed": true }, { "title": "met: two authorities, quorum.met \"true\", a plain built line and no count", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-524", "kind": "claim", "statement": "The offline checker and its command-line wrapper require nothing outside Node's own modules, and a software bill of materials for the Provenance code is generated offline.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "SBOM-1 the checker and its CLI wrapper have zero non-core requires", "passed": true }, { "title": "SBOM-2 the detector fires on a non-core require and ignores core ones", "passed": true }, { "title": "SBOM-3 the output is structurally valid CycloneDX 1.5", "passed": true }, { "title": "SBOM-4 two builds with the same date are identical", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-525", "kind": "claim", "statement": "A webhook is delivered to the addresses just vetted, with the destination's own name checked on its certificate; a second name lookup cannot move the delivery to another address.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the request is made to the addresses just vetted", "passed": true }, { "title": "a second resolution cannot change the address used: the request is pinned to what was vetted", "passed": true }, { "title": "it connects to the vetted address, with the URL's host name as Host and server name, and delivers the body", "passed": true }, { "title": "a second resolution cannot change the address used: the resolver answers a private address and is never asked", "passed": true }, { "title": "a certificate that does not name the host is refused, and nothing is delivered", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-526", "kind": "claim", "statement": "A webhook destination may use port 443 only; any other port is refused when it is registered and never requested afterwards.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "only port 443 is allowed: none or an explicit 443 pass, any other port is refused", "passed": true }, { "title": "a port other than 443 is refused with the same message and nothing is stored", "passed": true }, { "title": "a stored URL with a port other than 443 is not requested", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-527", "kind": "claim", "statement": "Literal addresses in reserved ranges (shared address space, documentation and benchmarking ranges, multicast, the reserved block, unique-local, site-local and translated IPv6 forms) are refused, whatever form a URL parser normalises them to.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "literal addresses are judged directly, including the forms a URL parser normalises", "passed": true }, { "title": "http, loopback, link-local, private, IPv4-mapped and .internal destinations are refused and nothing is stored", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-528", "kind": "claim", "statement": "The machine API is frozen once a leaving export is confirmed: every write is refused with leaving_in_progress and nothing is sealed, so no record is made that would be deleted unexported.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a tenant whose request is confirmed: all four POSTs are 409 leaving_in_progress in the router's error shape, and nothing is sealed", "passed": true }, { "title": "a tenant whose request is deleting: all four POSTs are 409 leaving_in_progress in the router's error shape, and nothing is sealed", "passed": true }, { "title": "unaffected: no request, a prepared one, a cancelled one, and another tenant's key while this one is frozen", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-529", "kind": "claim", "statement": "A cancel cannot race the deletion: the deletion claims the request in one atomic step, a cancel after the claim loses, a cancel that lands first is honoured, and a run that stopped after the claim is resumed.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a cancel after the claim loses: the request is deleting, cancel is false, and the deletion carries on", "passed": true }, { "title": "a cancel that lands first is honoured: the deletion finds nothing confirmed and is not ready", "passed": true }, { "title": "a cancel that lands between the readiness step and the ledger append loses cleanly, through TenantDeletionService", "passed": true }, { "title": "a run that stopped after the claim is resumed, not refused", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-530", "kind": "claim", "statement": "A tenant with no Provenance data gets no Provenance deletion artefacts: no ledger entry or file, no certificate, and its DID keys are left to the general tenant deletion.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "no ledger entry or file, no certificate, and its DID keys are neither revoked nor destroyed", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-531", "kind": "claim", "statement": "A confirmed leaving request can be cancelled at any time until the deletion claims it, whether or not the cancel window has ended; cancelling the tenant's scheduled deletion lifts the freeze of a confirmed export, and ends a request the deletion has claimed only while no leaving entry exists in the erasure ledger (any entry on the leaving basis counts as deletion begun); an unreadable ledger, a failed check or an operator-run deletion in progress refuses the cancel.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a confirmed request can be cancelled at any time before the deletion claims it, the window ended or not; a new export may replace it too", "passed": true }, { "title": "cancelling the tenant's scheduled deletion lifts the freeze of a confirmed export whose window has passed (TenantDeletionService.cancelDeletion)", "passed": true }, { "title": "cancelling the scheduled deletion does not cancel a request the deletion has already claimed", "passed": true }, { "title": "once the deletion has claimed the request a new export is 409 export_locked and cancel is false; before that, with the window over, both still work", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "PRIV-20", "kind": "privacy", "statement": "Webhook bodies carry no personal data: canary values entered through the participant register and the plots, run through lots, a correction, a day root and an erasure, appear in no webhook body, and every body is the six-key allow-list.", "status": "Built", "result": "PASSING", "tests": [ { "title": "the canary entered through the register and the plots, run through lots, a correction, a day root and an erasure, is in no webhook body, and every body is the six-key allow-list", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-532", "kind": "claim", "statement": "On the owner console's leaving screen, an export that includes the salts is sent only after the salts warning is acknowledged and the step-up confirmed; an export without them asks for no warning.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "with the salts: the warning shown is d_undo, nothing is sent until it is acknowledged and the step-up Confirm, and the POST names the key", "passed": true }, { "title": "without the salts: no warning to acknowledge, and the POST asks for none", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-533", "kind": "claim", "statement": "Leaving is confirmed only by typing the export's fingerprint after downloading it: a malformed or wrong figure is refused in plain words, the right one confirms and freezes, and the owner then has seven days to cancel.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "download, then the typed figure: a malformed one is refused on the page, a wrong one by the server in plain words, the right one confirms and freezes", "passed": true }, { "title": "the English says what the operator ruled: export first, seven days to cancel, read-only from confirming, buyers keep their copies", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-534", "kind": "claim", "statement": "A cancel is asked for first and sent only on its Confirm; it stays possible until the deletion begins, even after the window, and a cancel the deletion reached first says so plainly.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "cancel: asked first, sent only on its Confirm with the CSRF token, then nothing is under way and the freeze is lifted", "passed": true }, { "title": "the window has ended: still cancellable until the deletion begins; once deleting, nothing is offered", "passed": true }, { "title": "a cancel the deletion got to first says so, plainly", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-535", "kind": "claim", "statement": "A step captured offline is accepted only within bounds: no more than five minutes ahead of the platform's clock and no older than 14 days by default; it is sealed with the device's capture time, marked queued, beside the platform's own time of sealing.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a capture time more than five minutes ahead is refused; four minutes ahead is sealed", "passed": true }, { "title": "older than 14 days is refused by default; 13 days is sealed, with captured_at and capture_mode queued and decided_at the platform's own", "passed": true }, { "title": "the refusal names captured_at", "passed": true }, { "title": "a queued capture exactly 5 minutes after decided_at is valid; 5 minutes and 1 ms after is unreadable with the schema's message", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-536", "kind": "claim", "statement": "One capture identifier seals once: a repeat within the claim replays the same receipt, a repeat after the claim has expired is still answered from the sealed record, and two requests at once seal one record.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the same request twice within the claim: 201 then 200 replay with the same receipt, one record", "passed": true }, { "title": "after the 24 hour claim has expired the capture_key column still answers: 200 with the existing receipt, one record", "passed": true }, { "title": "two requests at once seal one record", "passed": true }, { "title": "after expiry the same UUID on another lot is refused by the column (409 duplicate_capture)", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-537", "kind": "claim", "statement": "Queued mode is set only by the queued capture route: the online route and the machine API cannot name a capture mode, time or key.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the online steps route refuses a body naming capture_mode or captured_at, and seals online", "passed": true }, { "title": "stepService refuses any capture mode, capture time or capture key unless all three come together", "passed": true }, { "title": "the machine API never passes a capture mode, time or key: no source under api-v1 or the ingest names them", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-538", "kind": "claim", "statement": "A queued step sent under a lapsed standing authorisation is refused with the reason and seals nothing; the device keeps it, and the retry after renewal seals it with the original capture time. A confirmed leaving request freezes the route, and the limit is 120 an hour per tenant.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "403 not_authorised_to_sign with the reason, nothing sealed, the claim given back; the retry after renewal seals with the old captured_at", "passed": true }, { "title": "a confirmed leaving request freezes the route: 409 leaving_in_progress, nothing sealed", "passed": true }, { "title": "the limit is 120 an hour per tenant: the 121st is 429 and another tenant is not affected", "passed": true }, { "title": "a refusal for no standing authorisation keeps the item, names the reason, and a later send seals it", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-539", "kind": "claim", "statement": "The offline capture worker never answers a request to the platform's API from its cache, deletes only its own caches, and uses no push or background sync.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a GET to /api/ is never answered by the worker, even when a cache holds that path", "passed": true }, { "title": "install keeps every listed file in this version's cache and activation deletes only older provenance-capture- caches", "passed": true }, { "title": "the worker listens for install, activate and fetch only: no push, no background sync, no message", "passed": true }, { "title": "the precache list has no /api/ path and every entry is a file under public/", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-540", "kind": "claim", "statement": "The capture device keeps only the step's closed fields and digests, never a label, salt or geometry; a queued step is sent once, in order, with its original capture time, and a signed-out session never clears the queue.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "a source scan finds no local_label, salt, geometry or canonical_bytes in either file", "passed": true }, { "title": "the step whitelist drops every field outside the closed set", "passed": true }, { "title": "offline: the page and the queue render after a reload with the network gone, a step is saved, then sent exactly once when the network returns", "passed": true }, { "title": "a signed-out session shows the sign-in link with the return address and clears nothing", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-541", "kind": "claim", "statement": "The offline check prints a record's capture time beside its sealing time when they differ by more than 15 minutes, and says the device's clock was not checked.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the capture-time line: printed past 15 minutes either way, in any mode, with both times; not printed within 15 minutes", "passed": true }, { "title": "the queued capture prints the device time and the sealing time, two hours apart, and says the device's clock was not checked", "passed": true }, { "title": "reads verified and prints the device time and the sealing time", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-542", "kind": "claim", "statement": "An attestation is delivered to the lot's holder through the mailbox only when the holder has named the attester, and the attester gets the same answer whether or not any holder exists.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "an attester the holder has not named goes to the sink: nothing lands, the answer is the same word, the sink row carries nothing", "passed": true }, { "title": "the same non-delivery work for a lot nobody holds, an unnamed attester and a holder with Provenance off", "passed": true }, { "title": "the answer has the same shape and status whether or not any tenant holds the lot", "passed": true }, { "title": "a notice for a lot held by HOLD never lands in another tenant's mailbox, even one that names the attester and holds a lot of its own", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-543", "kind": "claim", "statement": "A delivered attestation is recorded in the holder's own chain as a receipt the holder cannot decline, with no action by the holder; no notice is released before its receipt exists.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "sweeps deliver the notice, the receipt appears in the holder's chain with no holder action, the pack is stored, and the dossier carries both", "passed": true }, { "title": "queueing is idempotent per attestation and the holder is never asked: no route was called, no signing action row exists", "passed": true }, { "title": "a notice not yet receipted gets no pack: the attester's pack waits (no_holder) and nothing lands in the holder's mailbox", "passed": true }, { "title": "the field set is closed: exactly lot_ref, attester_did, attestation_receipt_sha256, delivery_id and the common lot-record fields", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-544", "kind": "claim", "statement": "The attester's segment travels with the holder's dossier and its packs: no dossier is built while a notice is not yet receipted, and after 48 hours without the pack the file is built without that segment and reads incomplete.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "no dossier while a notice is not receipted; none while a pack is under 48 hours old; after 48 hours the file is built without the attester's segment", "passed": true }, { "title": "the segment pack waits for the same gate and goes once it clears", "passed": true }, { "title": "ROUND 10: the attester's segment for lot A is accepted in a file for X derived from A, onward to a third party; a strip with a receipt naming it is refused (attestation_receipt_unmet)", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-545", "kind": "claim", "statement": "The pack reader and the offline checker hold every receipt to finding the attestation it names shown in the attester's segment with a passing proof; otherwise the file reads incomplete.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the attester's segment removed whole: incomplete, attestation_receipt_unmet", "passed": true }, { "title": "the attestation stripped with its entry, under selective, no label and complete_range: incomplete, attestation_receipt_unmet", "passed": true }, { "title": "the attestation kept but its inclusion proof removed, in a segment shown as a selection: not met", "passed": true }, { "title": "an attester segment is refused when it lacks the attestation the holder's receipt names, or carries it without its proof", "passed": true }, { "title": "the holder's dossier reads verified with the receipt met; stripped of the attestation it reads incomplete, attestation_receipt_unmet", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-546", "kind": "claim", "statement": "The certifier route is for the owner only, with a step-up spent once; a moderator, a machine session and a platform admin are refused, and a lot the certifier holds itself is refused with one fixed answer.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "an owner with a fresh step-up seals an attestation about another tenant's lot; the answer is closed", "passed": true }, { "title": "a moderator is 403 and seals nothing", "passed": true }, { "title": "a machine session is 403 and seals nothing", "passed": true }, { "title": "a platform admin is the uniform 404 and seals nothing", "passed": true }, { "title": "a step-up is spent by one attestation; the same one cannot be replayed", "passed": true }, { "title": "a lot_ref this tenant holds itself is refused with one fixed answer, nothing is sealed, and the step-up is given back", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-547", "kind": "claim", "statement": "The certifier panel in the owner console never offers a scheme digest or a salted fingerprint, and says why at the form.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "the panel never offers a scheme digest or a salted fingerprint, and says why at the form", "passed": true }, { "title": "Confirm then step-up then send: the body is the closed fields exactly, the list shows it, and the wording after is plain", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-548", "kind": "claim", "statement": "While the old mailbox index exists, attestation work is refused with one code-only line and nothing is lost; once it is dropped the work goes ahead.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "old index present: queueing, the attester sweep and the holder sweeps are refused with one code-only line, and no row is lost or swallowed", "passed": true }, { "title": "the guard rechecks after a refusal: once the old index is dropped (and the recheck time passed) the work goes ahead", "passed": true }, { "title": "migrated (the old index dropped, the new one there): both attestations queue, deliver and are receipted", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-549", "kind": "claim", "statement": "A received attestation raises the webhook event provenance.attestation.received with the closed payload, and nothing of either tenant's rows, labels, salts or the finding leaves in a notice, a pack, a mailbox row or a webhook body.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "eventFor maps the receipt to its event and no other kind to it; payloadFor accepts it", "passed": true }, { "title": "nothing of either tenant's rows, labels, salts or the finding leaves in a notice, a pack, a mailbox row or a webhook body", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-550", "kind": "claim", "statement": "Confirming a leaving export emails the confirming owner once, with the request id, the fingerprint typed, the end of the seven days, the read-only state and how to cancel; a failed send never fails the confirmation.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "one email to the confirming owner when the export is CONFIRMED: request id, the fingerprint typed, the end of the seven days, read-only, how to cancel; none before", "passed": true }, { "title": "the queue refusing the job never fails the confirmation: confirmed, the answer is the same, one code-only log line", "passed": true }, { "title": "a wrong fingerprint confirms nothing and sends nothing", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-551", "kind": "claim", "statement": "The day-root, archive-root and handover jobs skip a tenant whose leaving request is confirmed or being deleted, and serve it again once the request is cancelled; a request only prepared or downloaded, or cancelled, does not freeze them.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "confirmed: the tenant is skipped (counted, one code-only line), nothing is signed or changed, the other tenant is still served; cancelled, it is served again", "passed": true }, { "title": "deleting: the tenant is skipped (counted, one code-only line), nothing is signed or changed, the other tenant is still served; cancelled, it is served again", "passed": true }, { "title": "prepared and downloaded requests do not freeze the sweep", "passed": true }, { "title": "confirmed: counted as skipped, one code-only line, no signer asked, no root written; another tenant is still sealed", "passed": true }, { "title": "deleting: counted as skipped, one code-only line, no signer asked, no root written; another tenant is still sealed", "passed": true }, { "title": "prepared is not frozen: the root is sealed as usual; and a cancel releases a frozen tenant", "passed": true }, { "title": "cancelled is not frozen: the root is sealed as usual; and a cancel releases a frozen tenant", "passed": true }, { "title": "confirmed: counted as skipped with one code-only line, no signer asked, nothing written; released when cancelled", "passed": true }, { "title": "deleting: counted as skipped with one code-only line, no signer asked, nothing written; released when cancelled", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-552", "kind": "claim", "statement": "After a skipped stretch the day-root job catches up once: one root dated the day of the oldest uncovered record, reaching back at most fourteen days, then yesterday's; empty days get none. Without an outside stamp the catch-up root is still sealed once the ordinary grace has passed, said so in the root, and a deferred catch-up does not hold back yesterday's root. Limit, stated once: the catch-up root carries the date of the oldest uncovered record but covers every record by sequence up to the moment it is sealed.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "frozen on D..D+2, cancels: the next run seals ONE catch-up root dated the day of the oldest uncovered record, covering them all, then yesterday; the empty days between get none", "passed": true }, { "title": "a tenant that is not behind gets only its ordinary root; one with nothing uncovered gets no catch-up root", "passed": true }, { "title": "the catch-up reaches back at most 14 days: when even the oldest uncovered record is older, only the ordinary root is sealed (it covers them all)", "passed": true }, { "title": "a frozen tenant is not caught up while frozen, and another tenant is", "passed": true }, { "title": "S4: with no outside stamp from any authority the catch-up root is still sealed (operator_attested, past its grace, said so in the root); yesterday's own root, still inside its grace, waits", "passed": true }, { "title": "S4: a catch-up that is deferred (an attest that says so) defers ONLY itself: yesterday's root is sealed and covers the same records", "passed": true } ], "last_checked": "2026-10-14" }, { "id": "CLM-553", "kind": "claim", "statement": "Cancelling or reactivating a tenant's deletion ends a leaving request the deletion has claimed only while no leaving entry exists in the erasure ledger (any entry on the leaving basis, the register step's included, counts as deletion begun; an entry on another basis does not); an unreadable ledger store or a failed check refuses in plain words, and so does an operator-run deletion in progress.", "status": "Beta", "result": "PASSING", "tests": [ { "title": "plan row 5.7b: a request the deletion CLAIMED but has done no work on is released when the tenant's deletion is cancelled: the tenant is active and not frozen for ever", "passed": true }, { "title": "S2: a ledger entry on another basis (a request to erase one participant) is not the deletion having begun", "passed": true }, { "title": "S1: a REAL unreadable ledger store (the directory path runs through a file) with no entry found refuses, in plain words; readable again, it releases", "passed": true }, { "title": "releaseForRestoredTenant: ends prepared, downloaded and confirmed requests; refuses a deleting one when the ledger entry exists or cannot be read; does nothing for a tenant with no request", "passed": true }, { "title": "a deletion running now (the guard set within the hour): 409 deletion_in_progress, the tenant and its request untouched; a stale guard does not block", "passed": true }, { "title": "deletion work begun (a leaving entry in the ledger, step 0 only): 409 provenance_deletion_begun and nothing changes", "passed": true }, { "title": "a claimed request with no work begun is released: the tenant is active and not frozen", "passed": true }, { "title": "the check failing refuses: 503 provenance_release_failed and the tenant stays pending deletion", "passed": true }, { "title": "an unreadable ledger store with no entry found refuses (409 provenance_ledger_unreadable)", "passed": true } ], "last_checked": "2026-10-14" } ] }