confium_signatif/
conformance.rs

1//! Conformance classes and the abstract test suite mapping (SIGNATIF
2//! §6, Annex A).
3//!
4//! An implementation claims conformance through the class hierarchy.
5//! [`conformance_report`] produces the machine-readable claim list:
6//! which `/conf` classes this build of Confium implements, and where
7//! each is exercised. Classes not yet implemented are reported as
8//! `planned` — never silently omitted — so a scheme adopting Confium
9//! knows exactly what it can claim.
10
11use serde::{Deserialize, Serialize};
12
13/// Implementation status of a conformance class in this build.
14#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
15#[serde(rename_all = "snake_case")]
16pub enum ConformanceStatus {
17    /// Implemented and exercised by the abstract test suite.
18    Implemented,
19    /// Implemented at model level; wire-format or service integration
20    /// pending (see the module docs).
21    Partial,
22    /// Not yet implemented; tracked in the scheme TODO list.
23    Planned,
24}
25
26/// One conformance-class claim.
27#[derive(Debug, Clone, Serialize, Deserialize)]
28pub struct ConformanceClaim {
29    /// The `/conf` class identifier.
30    pub class: &'static str,
31    /// Human-readable description.
32    pub description: &'static str,
33    /// Implementation status in this build.
34    pub status: ConformanceStatus,
35    /// Where the class is implemented (crate::module).
36    pub implemented_in: &'static str,
37}
38
39/// The class hierarchy with this build's status.
40pub fn conformance_claims() -> Vec<ConformanceClaim> {
41    use ConformanceStatus as S;
42    vec![
43        ConformanceClaim {
44            class: "/conf/basic-verifier",
45            description: "Verify artifacts offline against an anchor bundle: hard checks, coverage report, acceptance policy",
46            status: S::Implemented,
47            implemented_in: "confium_signatif::pipeline",
48        },
49        ConformanceClaim {
50            class: "/conf/full-verifier",
51            description: "Basic verifier plus trust-graph path-finding, multi-dimension verification, classification policies",
52            status: S::Implemented,
53            implemented_in: "confium_signatif::pipeline + graph + coverage",
54        },
55        ConformanceClaim {
56            class: "/conf/issuing-authority",
57            description: "Issue end certificates and produce trusted artifacts with dimension attestations",
58            status: S::Implemented,
59            implemented_in: "confium_signatif::artifact + ceremony",
60        },
61        ConformanceClaim {
62            class: "/conf/root-authority",
63            description: "Operate a root: anchor bundles, deployment manifests, cross-recognition",
64            status: S::Implemented,
65            implemented_in: "confium_signatif::bundle + confium_deployment::signatif",
66        },
67        ConformanceClaim {
68            class: "/conf/transparency-operator",
69            description: "Operate an append-only log with inclusion and consistency proofs",
70            status: S::Implemented,
71            implemented_in: "confium_transparency + confium-log-server",
72        },
73        ConformanceClaim {
74            class: "/conf/mirror",
75            description: "Mirror a log: verify append-only continuity, serve proofs",
76            status: S::Implemented,
77            implemented_in: "confium_transparency::witness + confium-log-monitor",
78        },
79        ConformanceClaim {
80            class: "/conf/device-signer",
81            description: "Device signs fresh nonce-bound artifacts under challenge",
82            status: S::Implemented,
83            implemented_in: "confium_signatif::passport (Challenge)",
84        },
85        ConformanceClaim {
86            class: "/conf/hierarchical",
87            description: "Single-root hierarchy topology",
88            status: S::Implemented,
89            implemented_in: "confium_signatif::graph + deployment::signatif",
90        },
91        ConformanceClaim {
92            class: "/conf/federated",
93            description: "Threshold groups of independent organizations",
94            status: S::Implemented,
95            implemented_in: "confium_signatif::fta",
96        },
97        ConformanceClaim {
98            class: "/conf/cross-recognized",
99            description: "Roots attesting each other via signed credentials",
100            status: S::Implemented,
101            implemented_in: "confium_deployment::signatif::CrossRecognition",
102        },
103        ConformanceClaim {
104            class: "/conf/mesh",
105            description: "Many-to-many peer recognition",
106            status: S::Implemented,
107            implemented_in: "confium_signatif::graph (multi-root, multi-path)",
108        },
109        ConformanceClaim {
110            class: "/conf/format-cose",
111            description: "COSE Sig_Structure envelope",
112            status: S::Implemented,
113            implemented_in: "confium_composite::cose",
114        },
115        ConformanceClaim {
116            class: "/conf/format-jws",
117            description: "JWS compact, detached content",
118            status: S::Implemented,
119            implemented_in: "confium_signatif::jws",
120        },
121        ConformanceClaim {
122            class: "/conf/format-xmldsig",
123            description: "XML Signature with Exclusive C14N",
124            status: S::Implemented,
125            implemented_in: "confium_pki::xmldsig",
126        },
127        ConformanceClaim {
128            class: "/conf/dimension-data",
129            description: "Data dimension attestation",
130            status: S::Implemented,
131            implemented_in: "confium_signatif::artifact + registry",
132        },
133        ConformanceClaim {
134            class: "/conf/dimension-person",
135            description: "Person dimension attestation",
136            status: S::Implemented,
137            implemented_in: "confium_signatif::artifact + registry",
138        },
139        ConformanceClaim {
140            class: "/conf/dimension-time",
141            description: "Time dimension with external anchor",
142            status: S::Implemented,
143            implemented_in: "confium_signatif::time",
144        },
145        ConformanceClaim {
146            class: "/conf/dimension-location",
147            description: "Location dimension attestation",
148            status: S::Implemented,
149            implemented_in: "confium_signatif::artifact + registry",
150        },
151        ConformanceClaim {
152            class: "/conf/dimension-environment",
153            description: "Environment dimension attestation",
154            status: S::Implemented,
155            implemented_in: "confium_signatif::artifact + registry",
156        },
157        ConformanceClaim {
158            class: "/conf/dimension-authorization",
159            description: "Authorization dimension attestation",
160            status: S::Implemented,
161            implemented_in: "confium_signatif::artifact + registry",
162        },
163        ConformanceClaim {
164            class: "/conf/dimension-identity",
165            description: "Identity dimension attestation",
166            status: S::Implemented,
167            implemented_in: "confium_signatif::artifact + registry",
168        },
169        ConformanceClaim {
170            class: "/conf/dimension-oracle",
171            description: "Oracle dimension attestation",
172            status: S::Implemented,
173            implemented_in: "confium_signatif::artifact + registry",
174        },
175        ConformanceClaim {
176            class: "/conf/multi-dimensional",
177            description: "Multiple independent dimensions converging on one artifact",
178            status: S::Implemented,
179            implemented_in: "confium_signatif::artifact (living artifacts)",
180        },
181        ConformanceClaim {
182            class: "/conf/post-quantum",
183            description: "ML-DSA-65 and SLH-DSA-128s verification, classical+PQC and PQC-only composites",
184            status: S::Implemented,
185            implemented_in: "confium_composite::pq (features pq, pq-slh)",
186        },
187    ]
188}
189
190/// The machine-readable conformance report for this build.
191pub fn conformance_report() -> serde_json::Value {
192    let claims = conformance_claims();
193    let implemented = claims
194        .iter()
195        .filter(|c| c.status == ConformanceStatus::Implemented)
196        .count();
197    serde_json::json!({
198        "framework": "SIGNATIF",
199        "implementation": "confium-signatif",
200        "version": env!("CARGO_PKG_VERSION"),
201        "classes_claimed": claims.len(),
202        "implemented": implemented,
203        "claims": claims,
204    })
205}
206
207#[cfg(test)]
208mod tests {
209    use super::*;
210
211    #[test]
212    fn all_24_classes_covered() {
213        let claims = conformance_claims();
214        assert_eq!(claims.len(), 24, "the SIGNATIF class hierarchy");
215        // Uniqueness.
216        let mut ids: Vec<_> = claims.iter().map(|c| c.class).collect();
217        ids.sort();
218        ids.dedup();
219        assert_eq!(ids.len(), claims.len());
220    }
221
222    #[test]
223    fn core_verifier_classes_are_implemented() {
224        for class in ["/conf/basic-verifier", "/conf/full-verifier"] {
225            assert_eq!(
226                conformance_claims()
227                    .iter()
228                    .find(|c| c.class == class)
229                    .expect(class)
230                    .status,
231                ConformanceStatus::Implemented,
232                "{class} must be implemented — it is the base of the hierarchy"
233            );
234        }
235    }
236
237    #[test]
238    fn report_is_serializable() {
239        let report = conformance_report();
240        assert!(report["claims"].as_array().unwrap().len() == 24);
241        assert_eq!(report["implemented"].as_u64().unwrap(), 24);
242    }
243}
confium_signatif/conformance.rs

confium_signatif/
conformance.rs
