Conformance profiles
Draft - coming soon
These conformance profiles are a draft proposal. The formal profile ladder is still being finalized and is not yet a published standard.
Profiles let a producer or viewer declare exactly which guarantees it provides. Each profile is a strict superset of the one below it.
Profile ladder
| Profile | Name | Requires |
|---|---|---|
| L1 | Container | Safe constrained-ZIP parsing, declared object table |
| L2 | Integrity | L1 + per-object SHA-256 manifest verification |
| L3 | Authenticity | L2 + Ed25519 signature verification, signer resolution |
| L4 | Provenance | L3 + hash-linked revision chain validation |
| L5 | Transparency | L4 + ledger inclusion & consistency proofs |
| X1 | Access | L5 + envelope decryption, policy evaluation |
| X2 | Compartmented | X1 + per-compartment keys, lease enforcement |
Producer vs. viewer conformance
- A producer at a profile must emit all objects that profile requires.
- A viewer at a profile must verify all checks that profile defines and fail closed on any mandatory failure.
Declaring a profile
The package manifest's profile field declares the highest profile the producer
targeted. Viewers verify against the profile they support and report any gap.
Validate your implementation against the test vectors and review the certification requirements.