open-standards/sandbox/spec/conformance.md

Conformance

Normative companion to SPEC.md §10. RFC 2119 keywords apply.

A host is conformant if, for every isolation tier it advertises, it satisfies every REQUIRED clause of SPEC.md §1–§7 and round-trips the conformance vectors in ../conformance/. A conforming host MUST pass the full pack with no skips for its advertised tiers. The vectors — not any brand — define what is correct.

Vector classes

C1 — Canonicality

The content addressing (b3: + base64url over BLAKE3-256) and the canonical forms (det-CBOR for the receipt core, JCS for the attestation core) are reproduced byte-for-byte. A unit descriptor, a grant set, a receipt core, and an attestation core each address to the fixed ContentId in the vector. No float appears in any canonical form.

C2 — Capability enforcement (deny-by-default)

Given the canonical grant set, the Enforcer returns the fixed allow/deny decision for each query in the vector, including the negatives: a dispatch to an ungranted device class is denied; a write to a read-only path is denied; an egress to an unlisted endpoint is denied; a kv access outside granted prefixes is denied; a host service that was not granted is denied. The empty grant set denies everything.

C3 — Receipt integrity and per-device provenance

A receipt round-trips through its JCR-1 envelope to byte-identical bytes and verifies under the steward key. The per-device records sum to total (field-wise), total.measured_uj is present iff every used class carries one, and the (provenance, measured_uj) coupling holds for every record (HwShunt ⇒ present, Estimator ⇒ absent). The pack includes adversarial negatives: an accelerator run that folds GPU energy into the CPU record (rejected), a HwShunt record with no measured_uj (rejected), an Estimator record carrying a measured_uj (rejected), a total that does not equal the device sum (rejected).

C4 — Attestation signing and verification

An attestation core canonicalizes to the fixed JCS bytes and produces the fixed Ed25519 signature under the known signing key; verification accepts it and rejects a single-bit mutation of any field. The attestation's devices classes match the bound receipt's devices classes. A journal_root present in the attestation replays Consistent against the vector's journal; a tampered journal replays Diverged.

C5 — Tier minimization

Given a grant set, the host selects the lowest tier whose guarantees satisfy it (the maximum of the per-grant minimums in tiers.md). The pack fixes the required tier for a set of grant sets: CPU-only trusted → S0/S1; untrusted code → S2; accelerator via brokered interface → S2; multi-tenant → S3; accelerator via direct assignment → S5; confidential → S6. A host that runs above or below the required tier fails C5.

C6 — Durable run records (§13)

A run record chains execute → suspend → resume segments; the head advances and recomputes from genesis. Resuming a snapshot that differs from the one recorded at suspension is refused, as is an execution while parked or an append after close. Idle energy accumulates across parks; a tampered segment (via the wire form) fails verification.

C7 — Environment manifest (§14)

A devcontainer.json ingests to a canonical, content-addressed manifest whose address is invariant to key order and whitespace. Fields that execute commands or widen the sandbox are refused, and unknown fields are refused rather than silently dropped. A resume offering a drifted manifest address is refused.

C8 — Content-addressed process control (§5.5)

Process control decides on the BLAKE3 of the executable's bytes. A denylisted hash is refused regardless of the binary's name (survives rename / move / wrapper) and overrides every allow rule; when a hash allowlist is set it is authoritative over names; exec is still required.

C9 — Warm pools (§15)

A claim attributes the slot's accrued idle energy to the run and is refused unless the slot's environment address matches. An evicted unclaimed slot records its idle energy as overhead, never zero. The pool's total idle energy equals claimed + overhead + pending — nothing hidden.

C10 — Fleet records (§16)

Every item in a fleet proves against the merkle aggregate root with a logarithmic proof, across odd and even leaf counts. A foreign item on a real proof path fails to verify, and any change to a leaf changes the root.

Adversarial obligation

The most valuable vectors are negatives — runs a conformant host must reject. A standard whose vectors only assert the happy path certifies nothing. The committed pack (../conformance/v1/negative.json) carries a C-neg class the harness asserts is rejected:

• a HwShunt reading with no measured figure, an Estimator carrying one, a total that does not equal the device sum, and a measured-coverage mismatch (SPEC §6);
• an attestation that omits an accelerator the receipt metered (SPEC §7.2), and an S6 attestation without TEE evidence (SPEC §7.6);
• a replay journal that diverges and one that is truncated — neither may compare Consistent (SPEC §8);
• a mid-run grant-set mutation, whose before/after content addresses MUST differ so a host can detect it (SPEC §1.2).

Growing this set (tier-minimization violations, anti-evasion probing) is the highest-value contribution to this directory (see ../CONTRIBUTING.md).

Running the pack

The reference harness (sandbox-conformance) loads the vectors and checks each class; the sandbox CLI exposes it as sandbox conformance. A run that skips a class for an advertised tier is a fail, not a pass: silent truncation reads as "covered" when it is not.