11. Conformance

This section is normative.

An implementation claims conformance for a role and, as a producer, for a level, for example “OIS 0.1 Producer, Level 2”.

11.1 Roles

• Producer: emits records that validate against Appendix B, satisfies the integrity rules of section 5 for the records it creates, and computes digests as section 6.4 requires.
• Consumer: accepts valid records, applies the stale evidence rule (section 6.3), ignores unknown extensions and verifies signatures where present (section 8.3).
• Validator: checks a record, bundle or passport against Appendix B and against every rule of section 5 that can be checked from the records at hand. It reports each violation with its rule identifier (R1 to R15).

Validators report at three levels. A violation means a MUST is broken and the input does not conform. A warning means a rule asks for a report while the input still conforms (R8, R12 and R13). An info report points to a SHOULD that is not followed. The conformance test suite tags every invalid fixture with the expected level and rule.

11.2 Producer levels

Level	Name	Requirements	Typical producer
1	Observe	Emits artifact and evidence records for its own outputs. derivedFrom MAY be unknown.	An adapter that reads JUnit XML results
2	Intent-aware	Level 1, plus: reads intents, references criteria explicitly, records context completely for the artifacts it produces, and sets derivedFrom to unknown only for test artifacts it did not produce.	A test agent that generates tests from criteria
3	Attested	Level 2, plus: carries an identity, signs the bundles and passports it emits with DSSE under that identity, includes artifacts only in bundles that also carry the signature of each artifact’s contextRecordedBy actor (R12; a DSSE envelope accepts several signatures), and SHOULD record signatures in a transparency log.	A platform or tool with native OIS support

11.3 Conformance test suite

The public repository provides a conformance test suite of valid and invalid fixtures. Each invalid fixture names the rule it violates.

• A validator conforms if it accepts every valid fixture and rejects every invalid fixture with the correct rule identifier.
• A producer demonstrates conformance by passing its output through a conforming validator, for the level it claims.

11.4 Quick start for Level 1 (informative)

A Level 1 adapter, for example one that reads JUnit XML from an existing pipeline, needs five things. Everything else can wait.

1. One actor record for the adapter itself: kind tool, name, version.
2. One actor record for the existing test suite: kind tool, named for the team that owns the tests, used as producedBy while the real authors are unknown.
3. One characterization intent per test suite: status draft, one criterion per test case with notation: text, the test name as statement and kind: functional. It describes what the suite checks today and becomes an approved intent once a human has reviewed it.
4. One artifact record per test file: kind test, location (repository at commit), path, digest (sha256 of the file), producedBy from step 2.
5. One evidence record per test result: criterion from step 3, test from step 4, derivedFrom: unknown, result, observedAt, recordedBy from step 1.

This gives a complete, valid bundle after one pipeline run. Intent coverage will be zero until intents are approved and tests are derived from them, which is the honest baseline for an existing system.