Conformance Checklist

Informative summary of the MUST requirements in SPEC.md. A run that fails any item does not conform to PP-SPEC-083.

Principles and coverage (Sections 4, 5)

[ ] Every component, party, interface, path, and Subject in the run has an Identity in the Identity Manifest
[ ] Every record's emitter is a Keyed Identity and the record is signed by it
[ ] No Subject (SUT, DUT, CUT, AUT) is issued a signing key by the run
[ ] Every Subject is a Fingerprinted Identity with an independently captured fingerprint
[ ] Every kind outside Section 5 is declared with an x- prefix, its Owner, and its certifier

[ ] Exactly one Arena Identity per arena instance, registered before the first release and bound to a Time Anchor pulse
[ ] Every component the Arena Operator runs is certified by the Arena Identity
[ ] Witness, Registry, Time Anchor, and reproof Party Sets hold Independent Roots, never certified by the arena
[ ] A run whose Witness is arena-certified says so

[ ] Every Identity Record names its Owner and the Owner's Root Identity
[ ] No change of Owner during a run
[ ] No private key on any disk, image, snapshot, or template of the environment under test
[ ] Private keys never exported to components
[ ] Every Identity Record and revocation registered and retained
[ ] Every record carries emitter and is verifiable from the record, the Identity Records, and the Registry alone
[ ] Components authenticate each other by key before exchanging anything a record depends on

[ ] Every Identity Record states its Integration Points and record kinds
[ ] Records outside Scope recorded as scope_violation and treated as invalid
[ ] No Scope widened during a run
[ ] AUT Delegated Credentials minted per run, bound to the Declared Policy hash, recorded by digest, revoked at teardown

[ ] Every result carries subject Identity IDs at its attribution level
[ ] Asserted and captured Subject identity compared; differences recorded as identity_mismatch
[ ] Every release names its release driver or attacker agent
[ ] Every Capture Record names its ingress, egress, or interface Identity; every result lists its pipes
[ ] Every record carries its Arena Identity ID

[ ] Identity Manifest registered with the commitment root before release
[ ] All arena Identities and Delegated Credentials revoked and registered before teardown
[ ] Final manifest root carried in the result record
[ ] Every Assay of a reproof runs under a new Arena Identity; Subjects compared by fingerprint, never by instance
[ ] Compromised Identities marked at once; their later records rejected