Vertical AI Governance Stack v1.1 Draft Specification

1. Specification & Research Status

Status: Draft Specification — Formal Review Passed

The v1.1 specification has completed internal formal review, normative keyword auditing (RFC 2119 / RFC 8174), requirements traceability analysis, conformance harness validation, targeted mutation testing (7/7 mutants detected), and adversarial equivalence testing (5/5 attacks rejected). Independent human inter-rater validation is currently pending external execution.

Human Validation Status: External Evaluation Pending

Distribution packages (evaluator-A.zip and evaluator-B.zip) have been frozen and cryptographically pinned. Reproducibility claims (V1.1 CONFORMANCE ASSESSMENT REPRODUCIBILITY VALIDATED) will not be asserted until independent external human evaluations have been completed, returned, and scored post-hoc.

2. Pre-Registered Experimental State

To eliminate post-hoc bias and prevent retrospective specification adjustments, all experimental materials and acceptance criteria have been pre-registered prior to external evaluator exposure:

PRE-REGISTERED STATE

Cryptographically Sealed Research Pipeline

✓ Specification frozen before human evaluation — SHA-256: 329f851e1c5ae268fb5604dc8768308ee55fd60cbacbb88da2f8161c3f994804
✓ Test corpus frozen before human evaluation — 28 complete cases (6 Reference Base, 10 Synthetic Boundary, 7 Mutation, 5 Path B Adversarial)
✓ Expected outcomes sealed before human evaluation — Isolated in private pre-registration storage (sealed oracles & case coverage manifest)
✓ Acceptance criteria defined before human evaluation — Cohen's Kappa, inter-rater % agreement, and oracle alignment metrics
⏳ Human results pending — External execution with real independent human auditors in progress

3. Five-Tier Normative Hierarchy

The v1.1 specification establishes a strict 5-tier conceptual hierarchy separating normative properties from reference implementations:

Tier	Layer Name	Normative Status	Definition
Level 0	Governance Invariant	Mandatory Invariant	Probabilistic intelligence must never override deterministic authority.
Level 1	Proof Obligations	Normative Requirement	Seven verifiable execution properties (Authority, Identity, Scope, Integrity, Evidence, Outcome, Recovery).
Level 2	Conformance Requirements	Normative Criteria	22 explicit requirement criteria (RFC 2119 MUST/SHOULD/MAY clauses).
Level 3	Reference Architecture	Informative Pattern	Canonical 6-layer architecture (L1 Policy, L2 CVA, L3 Schema, L4 Gateway, L5 Audit, L6 Recovery).
Level 4	Reference Implementations	Informative Exemplar	Concrete software implementations (e.g. Envoy Wasm sidecars, OPA Rego engines, SPIFFE SVIDs).

4. Formal Requirements Matrix & Keyword Audit

The formal requirements matrix establishes 22 normative clauses. A non-overlapping keyword scanner audited all RFC 2119 keywords:

Normative Requirements

Simple MUST Clauses

Compound MUST NOT Clauses

Unmapped / Orphan Criteria

5. Dual Conformance Paths (Path A vs Path B)

v1.1 explicitly separates Path A (Physical Reference Topology) from Path B (Functional Equivalence):

PATH A / PHYSICAL TOPOLOGY

Path A: Direct Layer Replication

Architectures physically replicating components L1 through L6 as distinct containerized microservices or proxy sidecars.

PATH B / FUNCTIONAL EQUIVALENCE

Path B: Conformance by Equivalence

Alternative single-binary or sandbox architectures (e.g., Envoy Wasm proxy sidecar) demonstrating functional equivalence through verifiable cryptographic proof bundles.

6. Adversarial Falsification Review

To assert that Path B does not become a loophole for non-conformant implementations, 5 adversarial equivalence attacks were evaluated:

ADV-01 (Sidecar Direct Port Exposure): Exposed backend port 8080 alongside Wasm port 8443 → REJECTED (Fails REQ-CR-1).
ADV-02 (Logging-Only Advisory Gateway): Non-blocking OPA evaluation → REJECTED (Fails REQ-INV-01).
ADV-03 (TEE Remote Attestation without OAuth/RBAC): Hardware quote without user authority grant → REJECTED (Fails REQ-PO-AUTH).
ADV-04 (Post-Hoc Audit Signing): KMS signature 10 min post-execution without pre-hash → REJECTED (Fails REQ-PO-INT).
ADV-05 (Fallback Route Bypass): Legacy API endpoint bypassing Wasm filter → REJECTED (Fails REQ-CR-1, REQ-CR-6).

7. Internal Robustness Validation Results

Validation Metric	Target Threshold	Measured Result	Status
Executed Robustness Cases	28 Cases	28 Cases (6 Base + 10 Boundary + 7 Mutants + 5 Adversarial)	PASS
Targeted Mutation Detection Rate	100.0%	7 / 7 Targeted Mutants Detected	PASS
Path B Equivalence Attack Rejection	100.0%	5 / 5 False-Equivalence Attacks Rejected	PASS
Programmatic Profile Agreement	100.0%	Strict vs Property-Based Profile Agreement: 100.00%	PASS
Programmatic Cohen's Kappa	1.0000	1.0000 (Perfect Programmatic Consistency)	PASS
Human Inter-Rater Status	External Human Evaluation	Pending Real External Auditor Execution	PENDING

8. Human Validation Protocol & Checksums

Distribution packages for external evaluators have been anonymized, stripped of requirement IDs and interpretive language, and cryptographically pinned:

Distribution Archive	File Size	SHA-256 Checksum	Status
`evaluator-A.zip`	62,050 bytes	`2d8d301101125dbcc9d49a065a86a3271ace920f4e8b13116da5fc054ca02ebc`	VERIFIED & FROZEN
`evaluator-B.zip`	62,050 bytes	`4d45be74449d5223508cac41ab7f92d9a845bc2467036f23e53c25093aff891d`	VERIFIED & FROZEN

9. Research Progression Sequence

COLLECTION STATUS