The Sovereignty Foundation
The Conformance Corpus
The testable definition of AGI conformance — thirty cells, honestly versioned — none independently reproduced
Conformance to the AGI Standard is not a policy judgment — an implementation passes the corpus or it does not. Each requirement has one test cell; each cell is a sealed, pre-registered, content-addressed unit following the bench-cell methodology the Foundation already uses for its own published measurements. The table is generated from this file; the page cannot drift from it. Status vocabulary: PASSING means the reference implementation satisfies the cell — one implementation, one run, recorded below. It does not mean independently reproduced. REPRODUCED requires an independent implementation; RATIFIED requires two. No cell is reproduced or ratified today. WISP cells added 2026-08-31, independently of the Standard's own numbering.
What the statuses mean, precisely. Reference pass is the reference implementation satisfying the cell — one implementation, one run, the command and date recorded on the cell. It is not a claim of independent reproduction. Partial is a cell the reference implementation does not fully satisfy, with the shortfall named and linked to the delta that records it. Scaffolded cells have runner instructions but no sealed inputs; specified cells await harness authoring; the Defense-in-Depth cells are a documented authoring gap, deferred until those requirements mature.
No cell in this corpus has been independently reproduced, and none has been ratified. Ratification requires two independent reproductions, and the venue for them — Proving Grounds — has not opened its reproduction quests. Every result below therefore carries its reproduction ledger: independent runs 0 · ratifications 0 of 2. That accounting is deliberate. A corpus that versions its own completeness is worth more than one that reads as finished.
The cells
A corpus of 10,000 governance decisions. Verifies (a) each chain hash is correctly computed from predecessor + current content, (b) modifying decision #5,000 invalidates #5,001–#10,000, (c) full-chain verification completes in bounded time and memory.
Pass: Chain matches expected hashes for all 10,000 records. Modification simulation correctly invalidates all downstream records. Verification completes in under 5 seconds and 100 MB memory.
10,000 decisionsA fixed input corpus executed on three hardware substrates — Apple M-series, x86_64 with AVX-512, ARM64 Neoverse — over 10,000 iterations each.
Pass: All 30,000 outputs bit-identical across substrates and iterations. No I/O or clock-read system calls observed during the inference critical path.
30,000 outputs across 3 substrates10,000 operation requests with varied token configurations: valid, expired, replayed, missing signature, wrong scope, future-dated.
Pass: All valid tokens lead to execution; all invalid tokens lead to rejection; every rejection reason recorded in the audit ledger; no false positives or false negatives.
10,000 requests10,000 decisions across 100 distinct identity manifolds; verifies identity A's decisions are not retrievable by queries authorized for identity B without explicit cross-identity authorization.
Pass: Identity-binding enforced for all 10,000 decisions. Cross-identity retrieval blocked without authorization. Cross-identity authorization properly logged.
10,000 decisions / 100 manifoldsran 2026-08-31 · SF-WISP-STD-001 reference, wisp-reference
independent runs 0 · ratifications 0 of 2 · Proving Grounds — reproduction quests not yet open
10,000 operation requests under failure conditions: no token, malformed input, timeout, internal error.
Pass: All denied. No state changes observable in any failure case. Failure reason recorded in the audit ledger.
10,000 requests10,000 inputs probing the dead zone: 10% clearly above the strict threshold, 10% clearly below the relaxed threshold, 40% within the dead zone, 40% oscillating near the boundary.
Pass: No flapping within the dead zone. Transitions only on appropriate threshold crossings. Deterministic across reproductions.
10,000 inputsAttestation requests for (a) population membership without identity disclosure, (b) authorization possession without authority-detail disclosure, (c) behavioral-envelope membership without behavior disclosure.
Pass: All valid attestations succeed. No information disclosed beyond the claim. Attestations non-transferable. Failed attestations do not leak the failure reason.
three attestation classesAttempts to modify, delete, and reorder persisted records using all available ledger interfaces.
Pass: No such operation succeeds. Query results include cryptographic completeness proof. Soft-delete, where implemented, is itself an append-only entry.
all ledger interfacesEnumerate components, identify the four boundaries (Evaluator, Minter, Enforcement Gate, Audit Ledger), simulate compromise of each in turn, verify no cross-boundary forgery becomes possible.
Pass: At least four distinct boundaries. Distinct key material for each. Compromise simulation does not enable cross-boundary forgery. Cross-boundary communication uses only independently verifiable artifacts.
4 boundaries × compromise simulationExtract recorded inputs + sealed policy + sealed configuration from a recorded decision set; an independent verifier with no access to the original runtime re-executes.
Pass: Bit-identical Decision Results for all sampled decisions. Policy-hash and configuration-hash changes each correctly invalidate prior decisions for re-execution.
sampled decision set + independent verifierMint 1,000 Capability Tokens at standard parameters; measure CPU time and memory per mint; attempt parallel minting at scales that would defeat cost imposition.
Pass: Minting requires ≥100 ms CPU at standard parameters, or ≥16 MiB memory for memory-hard proof-of-work. Cost reproducible on equivalent hardware. Parallel minting beyond the parameter budget does not reduce per-token cost. Cost configurable to scale with threat level.
1,000 mintsDeferred until the Defense-in-Depth requirements mature beyond EXPERIMENTAL.
Deferred until the Defense-in-Depth requirements mature beyond EXPERIMENTAL.
Deferred until the Defense-in-Depth requirements mature beyond EXPERIMENTAL.
Deferred until the Defense-in-Depth requirements mature beyond EXPERIMENTAL.
Deferred until the Defense-in-Depth requirements mature beyond EXPERIMENTAL.
construction is attempted with each shape
Pass: Refused without a contextual element; constructs with one.
reference implementation test suiteran 2026-08-31 · SF-WISP-STD-001 reference, wisp-reference
independent runs 0 · ratifications 0 of 2 · Proving Grounds — reproduction quests not yet open
three frozen vectors, decoded and re-encoded; one byte flipped
Pass: Bytes reproduced exactly; identifier moves on any change.
reference implementation test suiteran 2026-08-31 · SF-WISP-STD-001 reference, wisp-reference
independent runs 0 · ratifications 0 of 2 · Proving Grounds — reproduction quests not yet open
a declining trust trajectory walked through all four
Pass: Permit, delay, escalate and deny each reached.
reference implementation test suiteran 2026-08-31 · SF-WISP-STD-001 reference, wisp-reference
independent runs 0 · ratifications 0 of 2 · Proving Grounds — reproduction quests not yet open
each default exercised with nothing configured
Pass: Every default refuses. Not met: the role-visibility check admits on an empty allow-list (D-07), so this cell is partial until that default is reversed.
reference implementation test suiteran 2026-08-31 · SF-WISP-STD-001 reference, wisp-reference · blocked by D-07
independent runs 0 · ratifications 0 of 2 · Proving Grounds — reproduction quests not yet open
verification given only the token and a clock
Pass: Verifies; a token for another object is refused.
reference implementation test suiteran 2026-08-31 · SF-WISP-STD-001 reference, wisp-reference
independent runs 0 · ratifications 0 of 2 · Proving Grounds — reproduction quests not yet open
dense sweep of the encoder domain, ~17M points
Pass: Worst deviation within the declared tolerance.
reference implementation test suiteran 2026-08-31 · SF-WISP-STD-001 reference, wisp-reference
independent runs 0 · ratifications 0 of 2 · Proving Grounds — reproduction quests not yet open
decay evaluated across the elapsed-time domain
Pass: Halves at one half-life; monotonic; zero on a backwards clock.
reference implementation test suiteran 2026-08-31 · SF-WISP-STD-001 reference, wisp-reference
independent runs 0 · ratifications 0 of 2 · Proving Grounds — reproduction quests not yet open
each incommensurable case attempted
Pass: Absence reported; never a numeric score.
reference implementation test suiteran 2026-08-31 · SF-WISP-STD-001 reference, wisp-reference
independent runs 0 · ratifications 0 of 2 · Proving Grounds — reproduction quests not yet open
a fixed trajectory run twice
Pass: Bit-identical scores, verdicts and chain tip.
reference implementation test suiteran 2026-08-31 · SF-WISP-STD-001 reference, wisp-reference
independent runs 0 · ratifications 0 of 2 · Proving Grounds — reproduction quests not yet open
refusals recorded, modules swapped, mode tightened
Pass: Refusals present; configuration bound into each entry.
reference implementation test suiteran 2026-08-31 · SF-WISP-STD-001 reference, wisp-reference
independent runs 0 · ratifications 0 of 2 · Proving Grounds — reproduction quests not yet open
a comparison module returning a cosine of 3.0 is plugged in
Pass: Policy reached permit; gate forced deny; token withheld.
reference implementation test suiteran 2026-08-31 · SF-WISP-STD-001 reference, wisp-reference
independent runs 0 · ratifications 0 of 2 · Proving Grounds — reproduction quests not yet open
a degraded object round-trips with a distinct encoding, is refused without a policy, faces a raised bar with one, and leaves a degraded-arm witness in the ledger
Pass: Distinct encoding; refusal by default; marginal permit demoted to delay under the raise; strong degraded object still permits; SIG-T05/degraded witness recorded.
reference implementation test suiteran 2026-08-31 · SF-WISP-STD-001 reference, wisp-reference
independent runs 0 · ratifications 0 of 2 · Proving Grounds — reproduction quests not yet open
objects sharing an element, traversed both ways
Pass: Forward reaches every constituent; reverse names every carrier.
reference implementation test suiteran 2026-08-31 · SF-WISP-STD-001 reference, wisp-reference
independent runs 0 · ratifications 0 of 2 · Proving Grounds — reproduction quests not yet open
erase one object from a five-object store; the certificate verifies standalone; a dropped certificate breaks the chain visibly; all three absence arms exercised including the erasure that empties the store
Pass: Certificate verifies with no store access; reveals identifiers, never contents; tampering with claim, root, or adjacency each refused; ledger chain intact. Scope note: this cell exercises the erasure certificate only; consent scopes and retention classification remain unimplemented, which is why the requirement keeps its MAY.
reference implementation test suiteran 2026-08-31 · SF-WISP-STD-001 reference, wisp-reference
independent runs 0 · ratifications 0 of 2 · Proving Grounds — reproduction quests not yet open
The evidence, by shape
Three data shapes carry the whole program: a cell’s pre-registered scenario, committed before any run; the proof witness each gated computation emits; and the governance ledger line the audit chain is built from. None are mockups — the scenario below is the live file in the tc-agi-1 scaffold, and the witness and ledger shapes are the reference implementation’s own formats.
{
"cell": "tc-agi-1-audit-chain",
"requirement": "AGI-1",
"tier": "CORE",
"cell_version": "0.1-draft",
"corpus_version": "0.2-draft",
"standard_version": "1.0-wd.2",
"scenario": "A corpus of 10,000 governance decisions. Verifies (a) each chain hash is correctly computed from predecessor + current content, (b) modifying decision #5,000 invalidates #5,001\u2013#10,000, (c) full-chain verification completes in bounded time and memory.",
"pass_criteria": "Chain matches expected hashes for all 10,000 records. Modification simulation correctly invalidates all downstream records. Verification completes in under 5 seconds and 100 MB memory.",
"corpus_size": "10,000 decisions",
"status": "PRE-REGISTERED \u2014 inputs not yet sealed; no manifest.sha256 until they are.",
"publication": "WITHHELD pending peer review of the Standard and ratification of the programme (2026-09-15). Not offered as a runnable conformance suite."
}
{
"sig": "SIG-V03", — the invariant this witness attests
"input_hash": "1f2a…16 bytes", — BLAKE3-128 of canonical input
"output_hash": "9c04…16 bytes", — BLAKE3-128 of canonical output
"predicate_value": 0.9731, — must lie within bounds
"bound_low": -1.000001,
"bound_high": 1.000001,
"timestamp_ms": 1747008000000
}
// a third party with the same input and output reproduces this witness byte-for-byte;
// the sealed ledger's Merkle root lands in a .jsonl.root sidecar
{"chain_position": 4999, "decision": "Approve", "input_hash": "e3b0…", "hash": "a11f…"}
{"chain_position": 5000, "decision": "Deny", "input_hash": "7d21…", "hash": "c58e…"}
// hash = BLAKE3(previous ∥ position ∥ timestamp ∥ input_hash ∥ decision) — the record
// TC-AGI-1 tampers with, then watches every later hash fail
Known Deltas
Pre-registration culture applied to the Foundation first: the deltas below are what an independent reviewer would find, disclosed before certification of anyone — including the reference implementation — is offered.
The Standard's proposed token element "a cryptographic signature from a key authorized for issuance" is realized as hash-chain preimage possession, not an asymmetric signature; the identity envelope's signature field is an unpopulated placeholder.
Disposition — Documented deviation. The chain-anchor-plus-preimage-burn construction satisfies the semantic property (unforgeable issuance binding, independent verification) through a different primitive; whether the Standard should accept it as equivalent or mandate a signature algorithm from Appendix B.2 is an open Working Group question.
The fixed-point decision path is real and invariant-guarded, but no automated harness proves bit-identity across the three named substrates; float conversion at ingress/egress depends on caller discipline.
Disposition — TC-AGI-2 cannot pass until the harness exists. Scaffolded cell documents the gap; harness authoring is scheduled corpus work.
The Float/Deterministic/Locked mode triad exists and is tested, but the default is Float and no CI test proves Deterministic mode rejects float stages end-to-end.
Disposition — Reference-implementation hardening item; conformance runs pin the mode explicitly.
Warrant decay is implemented twice — f32 over epoch-milliseconds and f64 over Kronos ticks — which cannot agree bit-for-bit, in tension with AGI-2.
Disposition — Consolidation item; the certification narrative cites the lexicon Warrant as canonical until unified.
Zone separation is real (separate daemons, sockets, mTLS, a single execution privilege point) but no Zone or TrustBoundary type exists in code; the mapping from components to the Standard's four boundaries is asserted in documentation.
Disposition — Disclosed. The four-boundary mapping (Evaluator=SAGE, Minter=Knox, Enforcement Gate=Aegis, Audit Ledger=Canon/Owl) is stated explicitly in the conformance narrative rather than cited from a type system.
Filed Claim 23 (spec. SYS-9) recites three security zones. The fourth boundary — the Audit Ledger — is supported by the self-contained observability and memory nodes (Claims 41, 273–279, 313(j)) but is not claimed as a physically separate fourth zone.
Disposition — Disclosed with the argument shown; the delta is a claims-drafting fact, not an implementation gap.
The role-visibility check passes when the allow-list is empty — a deliberate ergonomic default that contradicts the fail-closed posture.
Disposition — Reference-implementation hardening item; flagged for reversal before any conformance run.
What exists is hash commitment, locality-sensitive hashing, and similarity-score-only disclosure — minimal-disclosure attestation, not cryptographic privacy. The LSH constructor is also not yet bound to the warrant's probabilistic hemisphere in the canonical crate.
Disposition — AGI-7 is FORWARD-LOOKING precisely for this reason; the requirement invites contribution and the estate gap is acknowledged.
The observability engine's JSONL streams are append-only but carry no hash chain; the chained ledgers are the governance and execution chains.
Disposition — Scope statement: AGI-8 conformance is claimed for governance-decision ledgers; observability streams are defense-in-depth recording, chain-linking scheduled.
The content-addressed SIG anchor on disk predates its writer's status field; all 668 entries lack the curation status the sidecar tracks.
Disposition — Regenerate before the anchor is cited as authoritative in any sealed conformance artifact.
An implementation either passes the tests or it does not.
Starting with ours.