Provenance and evidence: conformance
How an implementer in provenance and evidence demonstrates conformance: a self-assessment against the rules, clauses evaluated from evidence, attestations and a generated report. Each result names its evaluator and the time of evaluation, and each artefact is identified by a UNI (Unique Nexus Identifier).
- Nexus Standards: NS-3, NS-3b, NS-11.
- Open standards: PROV-O: The PROV Ontology; in-toto Attestation Framework; Verifiable Credentials Data Model v2.0; RFC 9162 Certificate Transparency Version 2.0 (log structure); C2PA Technical Specification.
- Data and feeds: Software Heritage archive API; Rekor public transparency log.
- Couples with: Verified intelligence and transparency; Data and datasets; Decision records and accountability.
Summary
- 01Self-assessmentagainst the rules
- 02Clause setNS-10
- 03Evidencereferenced, not embedded
- 04AttestationNS-11, named evaluator
- 05Reportgenerated from results
- Nexus Standards
- 3
- NS-3, NS-3b, NS-11
- Open standards
- 5
- named, never copied
- Data and feeds
- 2
- listed for reference
- Couplings
- 3
- with other areas
Standards listed in the cross-cutting capabilities tier
The programme areas of this tier against the standards they list in the registry; the row for this area sets the initial scope of a self-assessment.
Coverage matrixA filled cell indicates that the area lists the standard in the registry. Status terms are those of the registry.
Conformance to NS-0
An implementation conforms to NS-0 when it:
- names the canonical repository and the versions of the standards it applies;
- does not fork a registry;
- runs the repository validator, or an equivalent, on the copies of the registries it uses;
- records its implementation status per standard in
registry/consumers.yamltruthfully;and - carries the honesty fields (
legalState,claimCeiling,status) on every record it publishes.
Conformance to NS-0 is a statement by the implementation, verifiable under NS-11. It is not a certification by the Secretariat or by the Global Standards Council.
Initial self-assessment for provenance and evidence
The first rules of each applicable standard. A self-assessment is a statement by the implementer, verifiable under NS-11.
| Rule | Requirement | Standard |
|---|---|---|
NS11-R1 | A conformance statement shall rest on an attestation, and an attestation shall name an evaluator, a mandate, evidence references and a digest. | NS-11 |
NS11-R2 | Under zero trust, subject and evaluator shall be distinct, and production evaluations shall run outside the subject’s trust boundary. | NS-11 |
NS11-R3 | Missing or unresolvable evidence shall yield INDETERMINATE or REFUSED, never PASS (NS0-P12). | NS-11 |
Attestations
One attestation is recorded per clause, per subject, per evaluation (AT category, append-only). Results: PASS; FAIL; INDETERMINATE (evidence missing or unresolvable); NOT_APPLICABLE (the subject was outside the clause’s selectors at that instant); REFUSED (the evaluator lacked a mandate or the evidence was not accessible; the refusal is itself recorded). An attestation carries a canonical digest and, optionally, a signature; certifiesTruth is always false. A later attestation supersedes an earlier one for the same clause and subject, and the history is kept.
Crosswalks: an attestation can be exported as a W3C Verifiable Credential under the Verifiable Credentials Data Model 2.0 (subject: the contextual UNI; issuer: the evaluator; evidence: the refs), as an in-toto attestation (for software subjects) or as a PROV-O activity (NS-3b). The Nexus attestation remains the key and the record of truth.
Monitoring
Monitoring is continuous evaluation together with observation records. For each bound policy and context, the monitoring service records (a) the latest attestation per clause, (b) coverage (which clauses have no current attestation, and why), (c) drift (a change in a subject’s records that invalidates an attestation) and (d) the availability of evaluators and evidence sources. Monitoring records are observations with record UNIs. Dashboards and panels are projections of them and show the timestamp and the evaluator for every value; no verdict is stored.
Reporting
A conformance report for a context is generated, not written: policy by policy and clause by clause, with attestation UNIs, evidence refs, conformance levels (NS-10 section 3) and the honesty fields. Reports are catalogued artefacts (RP) and may be published (NS-8) only when their legalState allows. A report does not say "certified" or "compliant" except when it quotes an authority decision by reference.
Display of conformance statements
A context (NS-9) or artefact claims a relation to an external standard only through a clause set (NS-10) that cites that standard and is evaluated (NS-11). The claim is displayed as "implements clauses derived from <standard> (n of m with a current PASS)", with attestation UNIs. It is never displayed as "compliant with" or "certified to" unless a decision of the body entitled to say so is referenced. Where a body operates its own certification, conformance under the Nexus Standards is explicitly not that certification.
Questions and answers.
How does a conformance report in provenance and evidence relate to the decisions of other bodies?
What happens when evidence is missing?
Around provenance and evidence.
Shape the standards for provenance and evidence.
Governments, regulators, standards bodies, industry, academia and communities are invited to shape the catalogue ahead of its first official release, targeted for 2030: comment on a draft, propose a change, join a working group or host a field exercise.
Status and use. The Nexus Standards are proposed standards developed through an open process under NS-13 and published for voluntary use; they do not constitute certification, accreditation or regulatory approval, and adoption remains a decision of the Global Standards Council and, in each country, of its National Standards Council. A UNI (Unique Nexus Identifier) identifies an artefact; it does not certify it. Names of standards bodies and their standards belong to their stewards and are used only to identify the documents; no text of an external standard is reproduced here. Nexus Standards is not affiliated with, endorsed by or certified by any standards body named here.
Licences: CC BY 4.0 for standards text, registries, schemas and data; Apache-2.0 for reference code. External standards are cited by name, number and link under their own licences. Third-party data, libraries and fonts keep their own licences: see Third-party notices.