Overview

Informative. SPEC.md controls.

The question

Is the control in production the same control that was proven?

Proof of State is the claim that a deployed control is in the same state as the control a proof was produced against: its DUT Fingerprint (version, configuration, policy, rule and signature sets and, for AI controls, model identifier, system prompt and tool permissions), captured independently of the Provider in production, equals the fingerprint bound to the proof. It is what lets a buyer carry a proof from the test into production.

Why it matters

A proof of last month's configuration says nothing about today's. A buyer, insurer or regulator relying on a proof of efficacy also needs this question answered, and answered by evidence the measured party did not produce.

What it is not

• It is not Proof of Efficacy. State says nothing changed; it does not say the control works.
• It is not a configuration-compliance scan against a benchmark; it compares against the proven state only.

The three answers

• proven: Every Production Capture in the declared period equals the Proven State.
• refuted: Any Production Capture differs from the Proven State.
• insufficient: No Production Capture in the declared period, or the capture party is not independent of the Provider.