Conformance Framework

Conformance assurance levels

Five cumulative levels, CAL-1 through CAL-5, define what a conformance claim covers and which evidence supports it.

Levels are cumulative: each level includes every criterion of the levels below it. A claim at any level names the exact release, corpus, family, and axes it covers.

CAL-2 establishes the operational form of formal verification: the executable model checks every release.

Level definitions

Each level adds an evidence class on top of the previous one.

  • CAL-1 — Scenario-Tested. The implementation passes the declared corpus deterministically, with typed observations and canonical tokens in force.
  • CAL-2 — Model-Checked. Every release is differentially compared against the executable formal model on all required axes; counterexample packs are secret-safe and replayable; the gate runs in CI.
  • CAL-3 — Formally Anchored. Every required axis reaches Checked maturity — golden vectors, closed symbolic proofs, and a recorded model review back each promotion. A regression on a required axis yields a hard Violated verdict.
  • CAL-4 — Crypto-Bound. The cryptographic assumptions behind the model are extracted, cited, and bound to the shipped code surfaces; open theorem gaps are recorded in checked registries.
  • CAL-5 — Production-Assured. Side-channel analysis, secret-lifecycle audits, platform attestation, RNG source review, interop vectors, and operational crash-recovery evidence complete the production claim.

Maturity ladder

Axis maturity states how trustworthy the comparison on an axis is. Promotion to Checked is a recorded, evidence-backed decision: golden-vector coverage on both adapters, a closed symbolic proof for the invariant, and a recorded model review with a named reviewer.

Axis maturity
text
NotChecked -> FixtureOnly -> ProofOpen -> ModelReviewed -> Checked

Assessment requirements per level

CAL-1 and CAL-2 admit self-assessment, with independent assessment recommended at CAL-2. CAL-3 and above require an independent assessor; CAL-4 adds cryptographic review; CAL-5 adds annual surveillance alongside per-release continuous conformance.