GoodShyt Group Inc.

San Francisco CA US deonte@goodshyt.fun https://orcid.org/0009-0005-8586-3650

agentic systems verification assurance stages government fail-closed non-collapse promotion boundaries Government and critical-infrastructure relying parties require explicit boundaries between successive assurance claims. This document defines Verification Promotion Boundaries (VPB) as a protocol-neutral profile that prevents verification evidence obtained at one stage from being silently promoted to a stronger claim. The stages are REGISTERED, SPEC_VALIDATED, LOCAL_CONFORMANT, INDEPENDENTLY_REPRODUCED, SECURITY_TESTED, and RELEASE_ELIGIBLE. A local PASS does not imply independent reproduction; an independent reproduction does not imply security testing; and no stage implies endorsement by any standards body or government agency. The profile further distinguishes subject evidence (negative findings against the tested artifact) from verifier evidence (positive findings that the verification system correctly detected defects). Arithmetic and protocol preconditions, including on-curve validation before metamorphic fixtures, are mandatory before any promotion. This document is intended for high-assurance government deployments and is not a U.S. Government standard.

Introduction Agentic systems present a verification problem distinct from conventional software: successful execution of one test suite can be misread as evidence of readiness for a higher assurance claim. Government relying parties operating under zero-trust principles and high-impact AI policies require that each promotion step be explicit, independently attested, and fail-closed. This document formalizes Verification Promotion Boundaries. The central invariant is that verification evidence at level L_i does not authorize a claim at level L_{i+1}. In particular, detection of a specification defect by a verifier constitutes negative evidence for the tested subject and positive evidence for the verifier. This dual semantics is essential for government audit and accountability. The profile is designed to compose with existing identity, authorization, evidence, and revocation mechanisms. It does not replace them. It constrains the claims that may be made from their outputs.

Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals.

Assurance Stages and Promotion Boundaries A conforming relying party MUST maintain the following ordered stages. Promotion from one stage to the next requires an independent attestation that the required predicates for the higher stage have been satisfied. No stage may be skipped.

1. REGISTERED: The specification, schema, and initial test corpus are published with digests.
2. SPEC_VALIDATED: The specification is syntactically valid and free of known internal contradictions (including arithmetic counter-examples).
3. LOCAL_CONFORMANT: An implementation passes the published positive and negative vectors under a controlled environment. The implementation under test MUST NOT generate its own expected results.
4. INDEPENDENTLY_REPRODUCED: A second party, using an independent implementation or clean-room environment, reproduces the LOCAL_CONFORMANT result and records the environment digest.
5. SECURITY_TESTED: Authorized penetration testing, fault injection, and adversarial evaluation have been completed and their findings incorporated or accepted with residual risk.
6. RELEASE_ELIGIBLE: All prior stages are satisfied, provenance is signed, and a human approval authority independent of the implementation authors has recorded acceptance.

A local PASS MUST NOT be treated as satisfying an INDEPENDENTLY_REPRODUCED or SECURITY_TESTED requirement. An UNKNOWN or INDETERMINATE result at any required predicate MUST prevent promotion.

Dual Evidence Semantics When a verifier detects a defect in a published specification or test vector (for example, an elliptic-curve point that does not satisfy the declared curve equation), the resulting evidence record MUST be classified as:

• Negative evidence against the tested subject (the draft or implementation that published the invalid vector).
• Positive evidence for the verifier (the verification system correctly rejected the invalid input).

This classification prevents a successful defect detection from being collapsed into a claim that the subject has passed, and it provides an auditable record for government oversight.

Mandatory Preconditions Before any metamorphic or higher-order fixture is executed, the following preconditions MUST hold and be recorded:

1. All published elliptic-curve parameters have a non-zero discriminant.
2. Every published affine point satisfies the curve equation over the declared field.
3. Negative vectors (off-curve points, wrong field, singular curve) are present and cause rejection.
4. The implementation under test does not supply the expected outputs for the vectors it is being tested against.

Failure of any precondition MUST result in INDETERMINATE for the current stage and MUST prevent promotion.

Promotion Receipt A Promotion Receipt is an integrity-protected, non-bearer record that binds the source stage, target stage, evidence digests, environment digest, independent observer identifiers, and the decision (PROMOTED or BLOCKED). Possession of a Promotion Receipt MUST NOT be treated as authorization to execute any action outside the declared assurance claim.

Government Deployment Considerations This profile is vendor-neutral and may be used by agencies implementing zero-trust architecture, high-impact AI risk management, or secure software development frameworks. It does not constitute a U.S. Government standard or imply endorsement by any agency. Deployments SHOULD pin the applicable policy identifiers (for example, current OMB memoranda or NIST publications) outside the protocol core so that policy updates do not require protocol changes. For high-impact agent actions, a relying party SHOULD require at least INDEPENDENTLY_REPRODUCED before production admission and SECURITY_TESTED before high-consequence authorization.

Security Considerations Threats include circular testing (implementation generates its own expected values), silent promotion of local results, suppression of negative evidence, and treatment of a Promotion Receipt as a bearer credential. The independent observer and human approval roles MUST be distinct from the authors of the implementation under test. Arithmetic preconditions are security-relevant because an off-curve point can invalidate all subsequent group-law claims.

IANA Considerations This document has no IANA actions.

Normative References Informative References