Provenance is not conformance

A conformance layer over a published standard, whose whole design is that an absent answer is a finding rather than a silence.

Vault 2wzct4k7 · on the sgit.ai ladder this is the standard, the evidence and the policy. The read key is printed on the vault’s own page and is the whole credential; it is not repeated here, because a credential copied is a credential that goes stale somewhere.

Why this one is here

It supplies this site's second cross-vault finding, and it is the only one of the four that makes a claim neither of the graphs it joins could make alone.

The reading

Two verbs in two graphs, never traversed in one query without the query naming which it used, and the rule is enforced by a test rather than described in a document.

tests/test_conformance.py::test_two_edge_rule is red if a layer edge ever reaches a source_observation.

Unevidenced is a state and it is the default, so an absent row can never be read as compliance.

Unevidenced is a state, and it is the default.

Which is why the first build of one subject across all 53 controls comes out almost entirely unevidenced, and why that is the designed answer.

2 evidenced, 48 unevidenced, 3 contradicted

Levels are computed rather than asserted, and one consequence falls straight out: a control whose only requirement is third-party testing cannot be climbed by talking about yourself.

six controls whose only requirement is third-party testing cannot leave level 0 on a self-report

Time is the thing that breaks the policy, with nobody editing anything.

At 2027-01-15, with nothing edited by anybody, the single condition has expired and the policy has 53 exclusions.

And it declines to overreach about what it has proved.

that any control is in place: it proves what was attested, at what tier, and when it expires

The explorer states its own arithmetic in its header rather than in a footnote.

Both graphs are loaded — the catalogue's 2788 nodes and 11610 edges, and the conformance layer's 182 and 414

Every edge type across both graphs has a named inverse, and every node is tied to the bytes it came from.

41 edge types across both graphs

It publishes seventeen findings about itself, and the sharpest undercut the ambition it was built with.

the join needs an authored class map — it is not hand-free as the brief hoped.

A stale acceptance is a first-class result: all three recorded acceptances come back stale, not because anyone withdrew them but because the evidence underneath them moved.

An acceptance is never edited here; its basis is captured at the moment of the decision and is allowed to go out of date on its own.

What it says about itself