{ "$note": "ACAM machine-readable core (the enums, the nine-cell computation table, the cap catalog, and the dominance rules as data). One release unit with acam/ACAM-SPEC.md; the two version together. Keys are recursively sorted (deterministic byte form); ASCII only. Rung ceilings use ladder order; 'cap at X' means computed rung = min(rung, X). Failure tokens are not rungs: they are absorbing elements in every rollup operator.", "acam_version": "0.1.0-draft", "assurance_basis": { "enum": [ "S", "F", "R" ], "labels": { "F": "facilitated", "R": "apeiris-reviewed", "S": "self-assessed" }, "rules": [ { "enforcement": "schema required", "rule_id": "AB-1", "statement": "assurance_basis is a required field inside the signed payload." }, { "enforcement": "the basis travels on every verdict node in verifier output, not only the header", "rule_id": "AB-2", "statement": "A conforming verifier or renderer must refuse to render any verdict without co-rendering its basis." }, { "enforcement": "the closed enums in this file are the complete token set; the contract gate rejects additions", "rule_id": "AB-3", "statement": "The basis is never baked into the verdict token (control state is not engagement metadata)." }, { "enforcement": "label computed from effective_rung + assurance_basis, both present in every projection per AB-2", "rule_id": "AB-4", "statement": "effective under Tier S is self-attested effectiveness and is labeled as such wherever rendered." } ] }, "cap_rules": [ { "condition": "Every workpaper for the control has procedure_performed = none-assertion-only.", "consequence": "rung <= mapped", "rule_id": "CAP-01", "source_section": "plan 3; SPEC 10.1" }, { "condition": "Any workpaper cited for documented or above has an empty observation.", "consequence": "workpaper disqualified; rung recomputed without it", "rule_id": "CAP-02", "source_section": "plan 3; SPEC 10.1" }, { "condition": "validation_objective concerns operation and no operating evidence item is automated-class or third-party-class.", "consequence": "rung <= design-effective", "draft_decision": "D-4", "rule_id": "CAP-03", "source_section": "plan 3; SPEC 10.2" }, { "condition": "contradictory_or_limiting_observations absent (not even nil) on any control.", "consequence": "dossier fails validation", "rule_id": "CAP-04", "source_section": "plan 3; SPEC 10.4" }, { "condition": "Sample size below the published minimum-n for the control's frequency/risk key.", "consequence": "rung <= tested", "rule_id": "CAP-05", "source_section": "plan 4; SPEC 11.2" }, { "condition": "population_enumeration_basis missing on a population-governing control.", "consequence": "rung <= documented", "rule_id": "CAP-06", "source_section": "plan 4; SPEC 11.1" }, { "condition": "selection_method = management-selected, or judgmental-with-rationale with no recorded rationale.", "consequence": "rung <= tested", "draft_decision": "D-2", "rule_id": "CAP-07", "source_section": "plan 4; SPEC 11.2" }, { "condition": "Any sampling deviation on a blocking control.", "consequence": "tested-exception until an extended-testing sub-record is appended", "rule_id": "CAP-08", "source_section": "plan 4; SPEC 11.2" }, { "condition": "Operating evidence dated outside assessment_window (rule W1).", "consequence": "item inadmissible for tested/effective; no override", "rule_id": "CAP-09", "source_section": "plan 4; SPEC 11.3" }, { "condition": "Design evidence predating the window by more than 90 days, or by 90 days or less without recorded justification (rule W2).", "consequence": "item inadmissible", "rule_id": "CAP-10", "source_section": "plan 4; SPEC 11.3" }, { "condition": "Evidence item stale under the freshness table.", "consequence": "item unsatisfied; rung recomputed without it", "rule_id": "CAP-11", "source_section": "plan 4; SPEC 11.4" }, { "condition": "Interview notes are the sole support on a blocking control.", "consequence": "support insufficient; rung recomputed as if unevidenced; non-overridable", "rule_id": "CAP-12", "source_section": "plan 4; SPEC 11.4" }, { "condition": "Any freshness override applied (where the table permits one).", "consequence": "override counted on the dossier cover; W1 and CAP-12 never appear in any override count", "rule_id": "CAP-13", "source_section": "plan 4; SPEC 11.4" }, { "condition": "population_enumeration_basis = interview-assertion, or no independent corroborating count where one was obtainable.", "consequence": "affected controls <= documented", "rule_id": "CAP-14", "source_section": "plan 14 B2; SPEC 11.1" }, { "condition": "A declared variance is absent, out-of-enum, arithmetically unaccounted, or unevidenced.", "consequence": "treated as missing enumeration basis (<= documented); exception class population-reconciliation fires", "rule_id": "CAP-15", "source_section": "plan 14 B2; SPEC 11.1" }, { "condition": "digest_scope = metadata-only.", "consequence": "item never counts toward content-integrity (gating) coverage", "rule_id": "CAP-16", "source_section": "plan 13/14 B10; SPEC 10.3" }, { "condition": "digest_scope = metadata-only without a digest_unavailable_reason consistent with component_operator.", "consequence": "digest inadmissible; exception class digest-scope-miscount fires", "rule_id": "CAP-17", "source_section": "plan 14 B10; SPEC 10.3" }, { "condition": "Boundary-limited system (provider-held bytes) in scope.", "consequence": "admitted with mandatory scope-limitation record; rung <= tested", "draft_decision": "D-3", "rule_id": "CAP-18", "source_section": "plan 14 B10; SPEC 10.3" }, { "condition": "Three-part digest fraction (hashed / metadata-with-declared-reason / unaccounted) does not sum to the declared evidence inventory.", "consequence": "dossier fails validation (schema constraint)", "rule_id": "CAP-19", "source_section": "plan 14 B10; SPEC 10.3" }, { "condition": "Obligation-to-control edge with undeclared sufficiency_relation.", "consequence": "fail-closed min operator for that obligation; status relation-undeclared recorded (distinct from insufficiently-evidenced)", "rule_id": "CAP-20", "source_section": "plan 5; SPEC 14.1" }, { "condition": "Framework curation coverage below the published per-framework threshold.", "consequence": "obligation rollup suppressed for that framework; bulk heuristics may only tighten", "rule_id": "CAP-21", "source_section": "plan 13; SPEC 14.1" }, { "condition": "claimed_rung present with no qualifying evidence.", "consequence": "effective_rung = mapped; claim retained and rendered beside it", "rule_id": "CAP-22", "source_section": "plan 0 decision 8; SPEC 8" }, { "condition": "Conflicts declaration unanswered (any question).", "consequence": "dossier fails validation", "rule_id": "CAP-23", "source_section": "plan 6; SPEC 15.2" }, { "condition": "Corpus release at signature not current.", "consequence": "corpus_currency = stale-at-signature + scoped version delta stamped on cover; ineligible for Apeiris review absent published justification", "rule_id": "CAP-24", "source_section": "plan 6; SPEC 12.2" }, { "condition": "Wall clock past dossier_expires (assessment_window.end + 12 months), or any operating evidence stale.", "consequence": "verifier state expired / stale per the state lattice; stale operating evidence can never render ok", "rule_id": "CAP-25", "source_section": "plan 4 and 13; SPEC 12.1" } ], "design_of_record": "COVERAGE_ASSESSMENT_PLAN.md", "dominance_rules": [ { "enforcement": "Rollup operators treat the exception as an absorbing element; the verifier recomputes every rollup and fails conformance on a masked exception.", "rule_id": "DOM-1", "source_section": "SPEC 7.3; plan 2", "statement": "A recorded tested-exception on a control with blocking_effect blocks-deployment or blocks-runtime-action dominates every rollup it touches; it is never masked by a sibling's higher rung." }, { "enforcement": "Same absorbing-element operator path.", "rule_id": "DOM-2", "source_section": "SPEC 7.3; plan 13", "statement": "evaluation-impaired dominates identically to tested-exception in every rollup." }, { "enforcement": "Exception record has no mutable status field; remediation sub-records reference it; verifier rejects a decreasing exception count without a restatement record.", "rule_id": "DOM-3", "source_section": "SPEC 7.3; plan 13", "statement": "Exceptions are append-only and immutable; remediation is an append-only sub-record rendered alongside the exception, never a rung; no state transition erases a recorded failure." }, { "enforcement": "Scorecard schema carries mandatory failure-token count fields.", "rule_id": "DOM-4", "source_section": "SPEC 7.3, 14.2", "statement": "A failure token dominates any computed rung in any aggregate; every aggregate rendering must surface failure-token counts." } ], "draft_decisions": [ { "id": "D-1", "question": "Nine-cell cell 4: tested-held with design not-evaluated computes the documentation floor rather than a distinct marker." }, { "id": "D-2", "question": "CAP-07 ceiling for management-selected / unrationalized judgmental selection is tested (plan says 'capped' without naming the rung)." }, { "id": "D-3", "question": "CAP-18 verdict cap for boundary-limited systems is tested." }, { "id": "D-4", "question": "CAP-03 reliability-floor consequence is a design-effective ceiling." }, { "id": "D-5", "question": "Draft variance_reason enum values (finalized in A2)." }, { "id": "D-6", "question": "evaluation-impaired modeled as an overriding per-control condition with a reason enum (3x3 sub-states preserved) rather than a fourth value of each sub-state." } ], "enums": { "component_operator": [ "self", "subservice-carved-out", "subservice-inclusive" ], "countersign_semantics": [ "assembled", "reviewed", "accountable" ], "digest_scope": [ "full-artifact", "chunked-merkle", "metadata-only" ], "digest_unavailable_reason": [ "third-party-custody", "api-only-access", "subservice-carved-out", "legal-restriction" ], "dossier_status": [ "draft", "final" ], "enumeration_basis": [ "provider-api-export", "registry-export", "cmdb-export", "financial-system-tie", "interview-assertion", "estimate" ], "impairment_reason": [ "access-denied", "evidence-nonexistent", "third-party-refused", "scope-limitation" ], "procedure_performed": [ "inspection", "observation", "inquiry", "reperformance", "recalculation", "confirmation", "none-assertion-only" ], "procedure_performed_alternative": "execution_log_ref (machine-attested execution-log reference; exactly one of the enum value or the reference must be present)", "reliability_rank": [ "automated", "third-party", "human-contemporaneous", "attested" ], "review_extent": [ "none", "administrative", "procedure-reperformance", "full-reperformance" ], "selection_method": [ "full-population", "random", "systematic", "haphazard", "judgmental-with-rationale", "management-selected" ], "variance_reason": [ "timing-difference", "scope-boundary-difference", "decommissioned-not-yet-removed", "provisioning-in-flight", "duplicate-record", "source-refresh-lag", "classification-difference" ], "variance_reason_note": "Draft values (decision D-5, finalized in A2); there is deliberately no 'other' value - an untypeable variance fires exception class population-reconciliation (CAP-15)." }, "failure_tokens": [ "tested-exception", "ineffective", "evaluation-impaired" ], "impairment": { "field": "evaluation_impaired", "reason_enum": [ "access-denied", "evidence-nonexistent", "third-party-refused", "scope-limitation" ], "semantics": "Recorded per-control condition with mandatory reason; overrides the nine-cell result; dominates rollups exactly as tested-exception does (DOM-2).", "source_section": "SPEC 7.3; plan 13" }, "ladder": [ "not-covered", "mapped", "documented", "design-effective", "tested", "effective" ], "legacy_migration": { "maturity_scale": { "defined": "documented", "developing": "documented", "initial": "mapped", "managed": "tested", "none": "not-covered", "optimizing": "effective" }, "note": "Migrated values are claimed rungs only (R-2); managed and optimizing arrive as claimed tested / claimed effective and render effective_rung = mapped until evidence qualifies (CAP-22)." }, "license": "CC BY 4.0", "nine_cell_table": [ { "cell": 1, "design": "not-evaluated", "notes": "Documentation floor: not-covered / mapped / documented per workpaper state; never above documented.", "operating": "not-tested", "result": "floor" }, { "cell": 2, "design": "evaluated-sound", "notes": "Type I state: design evaluated sound, operation untested.", "operating": "not-tested", "result": "design-effective" }, { "cell": 3, "design": "evaluated-deficient", "notes": "Deficient design fails without waiting for an operating test; carries consequence classes.", "operating": "not-tested", "result": "ineffective" }, { "cell": 4, "design": "not-evaluated", "notes": "Operating result recorded but cannot raise the rung past the missing design evaluation (fail-closed against rung-skipping). Draft decision D-1.", "operating": "tested-held", "result": "floor" }, { "cap_evaluation": true, "cell": 5, "design": "evaluated-sound", "notes": "Success path; the cap catalog is then evaluated - any applicable cap reduces to tested or lower (cap_evaluation: true).", "operating": "tested-held", "result": "effective" }, { "cell": 6, "design": "evaluated-deficient", "notes": "A held test on a deficient design does not achieve the objective; held result retained.", "operating": "tested-held", "result": "ineffective" }, { "cell": 7, "design": "not-evaluated", "notes": "Exceptions issue regardless of design-evaluation state.", "operating": "tested-exception", "result": "tested-exception" }, { "cell": 8, "design": "evaluated-sound", "notes": "Sound design, failed operation: the canonical operating exception.", "operating": "tested-exception", "result": "tested-exception" }, { "cell": 9, "design": "evaluated-deficient", "notes": "Both axes failed; token is ineffective; the operating exception is retained and still dominates rollups (never absorbed).", "operating": "tested-exception", "result": "ineffective" } ], "outcome_invariance": { "invariant": "No signed artifact class may exist, in any lane or tier, that only ever renders favorably; every artifact class carries adverse states of identical prominence, the shared exception-class vocabulary, and expiry/revocation semantics; no subscription may be structured such that unfavorable outputs are a churn event with a dollar value.", "source_section": "SPEC 16.1; plan invariant 9" }, "prohibited_terms": [ "independence", "independent review", "independent validation", "certified", "certification", "compliant", "compliance determination", "conformity assessment", "CE marking", "audit opinion", "attestation", "material", "material weakness", "significant deficiency", "guarantees", "complete coverage", "passed", "receipt" ], "prohibited_terms_note": "Applies to ACAM artifact language and artifact-class naming (SPEC 16.4), including near-neighbor variants; 'passed'/'receipt' scope is the validation-log register (VL-4). Watch-list (flag, not block): 'effective challenge'. The one permitted use of 'independent' is inside the verbatim quality claim of SPEC section 1.", "rendering_rules": [ { "enforcement": "CAP-22; claimed_rung and effective_rung are separate recorded fields; the verifier recomputes effective_rung and ignores claimed_rung.", "rule_id": "R-1", "source_section": "SPEC 8", "statement": "A claimed rung with no qualifying evidence renders its effective state as mapped, with the claim retained visibly beside it." }, { "enforcement": "legacy_migration map; versioned storage keys.", "rule_id": "R-2", "source_section": "SPEC 8", "statement": "Legacy scale values migrate deterministically and arrive as claimed rungs only; migrated state never populates effective_rung." } ], "review_record": { "class_discipline": "machine-decidable, mutually exclusive, severity-free (procedure-derived consequence classes only; assessor-assigned severity prohibited), traceable to procedure IDs; predicates, consequence-class derivation, worked examples, and the completion-status binding are published in acam/ACAM-EXCEPTIONS.md + acam/acam-exceptions.json; the procedure register is acam/acam-procedures.json (A3)", "completion_status": [ "procedures-completed", "procedures-completed-with-scope-limitation", "unable-to-complete", "expired", "revoked" ], "exception_classes": [ { "class": "schema-or-type", "id": 1 }, { "class": "corpus-anchor-version-hash", "id": 2 }, { "class": "signature-or-identity", "id": 3 }, { "class": "population-reconciliation", "id": 4, "note": "fires on absent, out-of-enum, arithmetically-unaccounted, or unevidenced variance" }, { "class": "unsupported-enumeration-basis", "id": 5 }, { "class": "sample-below-minimum-uncapped", "id": 6 }, { "class": "assertion-only-uncapped", "id": 7 }, { "class": "reliability-floor-breach", "id": 8 }, { "class": "ipe-basis-absent", "id": 9 }, { "class": "digest-scope-miscount", "id": 10, "note": "fires both directions (over- and under-counted coverage)" }, { "class": "window-or-freshness", "id": 11 }, { "class": "disclosure", "id": 12 } ], "exceptions_file": "acam/acam-exceptions.json", "machine_token": "apeiris:dossier-conformance-check:v1", "procedures_file": "acam/acam-procedures.json", "record_types_displayed_never_counted": [ "observation", "scope-limitation" ], "scope": "dossier conformance only, never control effectiveness", "source_section": "SPEC 16.3; round-3 B3", "zero_case_rendering": "count only - '0 of 12 exception classes triggered across N procedures' - never an enum token" }, "rollup": { "rules": [ { "rule_id": "RO-1", "source_section": "SPEC 14.1", "statement": "Undeclared relation implies fail-closed min; relation-undeclared is recorded distinctly from insufficiently-evidenced." }, { "rule_id": "RO-2", "source_section": "SPEC 14.1", "statement": "Obligation rollups are suppressed below the published per-framework curation-coverage threshold; bulk heuristics may only tighten." }, { "rule_id": "RO-3", "source_section": "SPEC 14.1", "statement": "Failure-token dominance applies inside every operator; max over alternatives never masks an exception on a blocking control." } ], "sufficiency_relation": { "alternative": "max", "cumulative": "min", "partial-contribution": "n-of-m-fraction", "undeclared": "min (fail-closed, CAP-20)" } }, "scorecard_rules": [ { "enforcement": "headline field is computed, not authored", "rule_id": "SC-1", "statement": "Verdict-distribution shape is primary; the headline is the ratio: X of Y in-scope obligations have evidence behind their mapping." }, { "enforcement": "percent field cannot validate without its numerator/denominator/scope-enumeration siblings", "rule_id": "SC-2", "statement": "Percentages ship only with scope enumeration, absolute numerator/denominator display, a scope-change line item on reassessment, and out_of_scope_with_rationale on the cover." }, { "enforcement": "closed schema has no such field; contract gate rejects additions", "rule_id": "SC-3", "statement": "No synthetic index; no single blended score exists in the vocabulary." }, { "enforcement": "mandatory fields (DOM-4)", "rule_id": "SC-4", "statement": "Failure-token counts render on every scorecard." } ], "spec": "acam/ACAM-SPEC.md", "sub_states": { "design": [ "not-evaluated", "evaluated-sound", "evaluated-deficient" ], "operating": [ "not-tested", "tested-held", "tested-exception" ] }, "validation_log": { "class_name": "automated validation log - not reviewed", "flags": { "not-for-relying-party-use": true }, "outcome_symmetry": "a failed run emits an identically prominent log, classed by the same exception vocabulary", "prohibited_in_name_filename_first_line": [ "passed", "receipt" ], "signature": "client-key signed; optional Apeiris counter-timestamp from a dedicated high-volume intermediate; never an Apeiris issuer signature", "source_section": "SPEC 16.2; round-3 B1" }, "verifier_states": { "enum": [ "ok", "stale", "unresolved", "expired" ], "expiry_arithmetic": "dossier_expires = assessment_window.end + 12 months (computed, never authored)", "lattice": "Per-target state is the minimum (most restrictive) of the freshness state and the expiry state; stale operating evidence can never render ok.", "source_section": "SPEC 12.1" }, "versioning": { "compatibility": { "assessment_window_max_months": 12, "minimum_support_after_successor_months": 24, "post_window_verifier_life_months": 12, "rule": "A verifier must verify any unexpired dossier under the dossier's pinned ACAM version; every MAJOR/MINOR release remains supported for verification for at least 24 months after its successor ships." }, "release_act": "Any change to an enum, cap rule, the nine-cell table, a dominance rule, the minimum-n table, or the freshness table is a new ACAM version; breaking changes require a MAJOR bump (contract-diff gate pattern).", "release_unit": [ "acam/ACAM-SPEC.md", "acam/acam-core.json", "acam/ACAM-SAMPLING.md", "acam/acam-sampling.json", "acam/ACAM-EXCEPTIONS.md", "acam/acam-exceptions.json", "acam/acam-procedures.json", "acam/ACAM-CONFLICTS.md", "acam/acam-conflicts.json", "acam/ACAM-ENTITY-RISK.md", "acam/acam-entity-risk.json", "acam/acam-phrasebook.json" ], "scheme": "semver" } }