Tooling

CLI and CI gates

The dvm-conformance toolchain runs the corpus, renders attestations, verifies artifacts, and maps verdicts to normative process exit codes.

The command-line contract is part of the framework's interface specification: operations, gate profiles, and exit codes are normative, so pipelines and scripts consume conformance results uniformly across implementations.

Command contract

Five operations cover the run, inspection, attestation, and verification surfaces.

dvm-conformance
text
dvm-conformance run    --corpus <dir> --family <id>
                       --gate dev|release|production --out <dir>
dvm-conformance check  <scenario.dvms> --family <id>
dvm-conformance report <out-dir>
dvm-conformance attest <out-dir> --level CAL-1..CAL-5
dvm-conformance verify <report.json|counterexample.json>

exit codes:
  0  conformant under the selected gate profile
  1  violated on a blocking axis
  2  indeterminate on a required axis (blocking under release/production)
  3  framework error (manifest, token, projection, nondeterminism)

Gate profiles

Gate profiles map verdicts to blocking behaviour per pipeline stage.

  • dev — blocks on Violated; annotates required-axis Indeterminate for triage.
  • release — blocks on Violated and on required-axis Indeterminate, missing release obligations, and blocked axis promotions.
  • production — release behaviour, plus blocking gate policies required on every required axis.

CI integration

A CAL-2+ pipeline runs the corpus on every change to the protected branch and on every release build, executes the determinism gate — the corpus twice with identical observation roots — uploads reports and counterexample packs as retained artifacts, and surfaces the per-axis table in change review.

Where the formal toolchain is heavyweight, two lanes split the work: the full lane runs the formal oracle from a cached compiled definition; the fast lane records formal axes as NotRun, which reports as Indeterminate on required axes. Lane identity is part of the recorded result.

Verification surface

verify operates on the artifact alone: it recomputes content addresses, replays the verdict from embedded observations, and checks the secret-safety property of counterexample packs. Independent parties — assessors, relying institutions — run it offline against the evidence bundle.