RFC-0008: Conformance reports and the certification path

Status: proposed, 2026-10-04. Kind: new schema outside Core; a document; tooling. Safety relevant: yes (claims of safety conformance).

Problem #

A maker can run tools/run_conformance.py and say "we pass", but there is no record that says which class, which vectors, which tool version, on what, when, and who checked. The registry has a conformance field with no defined content. Certification needs a path from a self-made claim to an independent mark.

Proposal #

1. **schemas/conformance.schema.json** with:
   • **ConformanceReport**: core version, conformance class (recipe_publisher, executor, catalog, agent, verifier) or profile (humanitarian:H1…), subject (vendor, model, firmware or tool and version), suites run with totals and failed vector ids, the hash of the vector set used, the tool version and repository commit, date, status (self_declared, verified, certified), verifier or certifier (an organization), and a signature by the publisher (required; verified and certified reports also name the verifier);
   • **ProfileVector**: the vector format for profile suites (kind is any lower-case token), so Core's ConformanceVector enum stays frozen.
2. Tooling: run_conformance.py --report out.json writes a ConformanceReport; profile vectors live in conformance/profiles/ and run with the Core vectors.
3. The path (docs/CERTIFICATION.md):
   • self-declared: the maker publishes a report and its hash in its capabilities document or registry entry;
   • verified: a registry operator reproduces the run against the published vectors and counter-signs;
   • certified: an independent certifier runs the suite plus hardware and safety-case checks and grants the mark. The mark and its rules move to the foundation with the trademark (GOVERNANCE.md).
4. Honesty rule: a report that fails any vector of a class may not claim that class; the registry shows the report, not a badge.

Alternatives considered #

• Badges without reports. Rejected: unverifiable.
• **Put ConformanceReport in core.schema.json.** Deferred to Core 1.0 to keep 0.2 frozen; it lives in its own schema until then.

Migration #

Additive. Registry entries may reference report hashes.

Open questions #

1. Which certifiers to approach first: see the action plan's review program (UL Solutions or TÜV for a gap analysis). No certifier is named as a partner until one agrees.
2. Should verified reports expire? Proposal: yes, with each Core minor version.