5. Relationships and integrity rules

This section is normative.

Records reference each other by URI. The rules below make those references checkable, above all the independence of a test from the code it verifies.

An evidence record points to a criterion, a test and the code under test. Because both artifacts name their producers, and the test names its context, a validator can check that the test came from a different actor and never saw the code.

Rule	Name	Requirement
R1	Approval	An intent version with status approved MUST be the subject of a decision with gate intent-approval and outcome approved, whose subjectDigest equals the intent’s digest. Its decidedBy actor SHOULD be human.
R2	Criterion references	Every criterion reference MUST resolve to a criterion with that key in that intent version.
R3	Evidence targets	test MUST reference an artifact of kind test. subject, if present, MUST reference an artifact of kind code or build.
R4	Derivation	derivedFrom MAY be intent only if the test artifact has a context that includes the referenced criterion, or any version of the same intent in which the criterion with that key has the same digest, and includes no artifact of kind code. A declared derivedFrom that contradicts R4 or R5 is a violation.
R5	Independence	derivedFrom MUST NOT be intent if the test and the subject were produced by actors with the same id, in any version.
R6	Complete context	If an artifact lists a context, the list MUST contain every record and artifact the producer was given. Consumers MAY conclude that the producer had no access to anything not listed.
R7	Stale evidence	Consumers MUST apply the stale evidence rule of section 6.3 before counting evidence for an intent version.
R8	Production data	Validators MUST report a warning when an evidence record lists an input dataset classified as production.
R9	Waivers	A decision with outcome waived MUST state a rationale and SHOULD be made by a human actor.
R10	Resolution	Within a bundle or passport, every reference MUST resolve to exactly one record. No two records MAY share an id (and version, for intents and actors) while differing in content, where content is compared without status and digest. A draft and its approved record therefore count as one record in two states.
R11	Revocation	Evidence that is the subject of an evidence-revocation decision MUST NOT be counted for any intent version. The revocation MUST carry a rationale; the evidence record itself stays unchanged.
R12	Context attestation	A context counts as attested only if contextRecordedBy differs from producedBy and the artifact record is carried in a bundle or passport signed by the contextRecordedBy actor. Otherwise validators MUST report the context as self-declared (warning), and consumers SHOULD give evidence with derivedFrom: intent that rests on it less weight.
R13	Open findings	Validators MUST report a warning when a passport lists an intent that a current finding with severity high or critical references, directly or through one of its criteria, and that finding is not resolved under R14.
R14	Finding chain	A finding MUST have at most one superseding record; validators MUST report a fork as a violation. A finding counts as resolved only if a decision with gate finding-resolution, outcome approved and the finding as subject exists, made by an actor that does not appear as producedBy, recordedBy or decidedBy in any record listed in resolvedBy.
R15	Passport intents	Every intent listed in a passport’s intents MUST be an approved version that is not withdrawn, and SHOULD be the latest approved version at issuedAt.

Validators check R1 to R5 and R8 to R15 from the records at hand. R6 cannot be checked mechanically and rests on the producer’s declaration, which is why signing (section 8.3) matters. R7 applies to consumers.