1"use strict";(globalThis.webpackChunkdocs_new=globalThis.webpackChunkdocs_new||[]).push([[3742],{28453:(e,s,t)=>{t.d(s,{R:()=>d,x:()=>c});var n=t(96540);const r={},i=n.createContext(r);function d(e){const s=n.useContext(i);return n.useMemo(function(){return"function"==typeof e?e(s):{...s,...e}},[s,e])}function c(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:d(e.components),n.createElement(i.Provider,{value:s},e.children)}},91051:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>l,contentTitle:()=>c,default:()=>a,frontMatter:()=>d,metadata:()=>n,toc:()=>h});const n=JSON.parse('{"id":"pti/conformance/conformance-tests","title":"Conformance Tests","description":"PTI conformance test categories and checklists.","source":"@site/docs/pti/conformance/conformance-tests.md","sourceDirName":"pti/conformance","slug":"/pti/conformance/conformance-tests","permalink":"/docs/pti/conformance/conformance-tests","draft":false,"unlisted":false,"tags":[],"version":"current","sidebarPosition":4,"frontMatter":{"sidebar_position":4,"title":"Conformance Tests","description":"PTI conformance test categories and checklists."},"sidebar":"ptiSidebar","previous":{"title":"Certification Guide","permalink":"/docs/pti/conformance/certification-guide"},"next":{"title":"PTI Implementation Badges","permalink":"/docs/pti/conformance/implementation-badges"}}');var r=t(74848),i=t(28453);const d={sidebar_position:4,title:"Conformance Tests",description:"PTI conformance test categories and checklists."},c="PTI Conformance Tests",l={},h=[{value:"Test methodology",id:"test-methodology",level:2},{value:"Test environment",id:"test-environment",level:2},{value:"Category A. Architecture (RFC-001)",id:"category-a-architecture-rfc-001",level:2},{value:"Category B. Trust Contexts (RFC-002)",id:"category-b-trust-contexts-rfc-002",level:2},{value:"Category C. Trust Events (RFC-003)",id:"category-c-trust-events-rfc-003",level:2},{value:"Category D. Trust Lookup API (RFC-004)",id:"category-d-trust-lookup-api-rfc-004",level:2},{value:"Category E. Trust Graph (RFC-005)",id:"category-e-trust-graph-rfc-005",level:2},{value:"Category F. Trust Exchange (RFC-006, Enterprise+ optional / Government mandatory)",id:"category-f-trust-exchange-rfc-006-enterprise-optional--government-mandatory",level:2},{value:"Category G. Governance (RFC-007)",id:"category-g-governance-rfc-007",level:2},{value:"Category H. Security (RFC-008)",id:"category-h-security-rfc-008",level:2},{value:"Category I. Privacy (RFC-009)",id:"category-i-privacy-rfc-009",level:2},{value:"Category J. Versioning (RFC-010)",id:"category-j-versioning-rfc-010",level:2},{value:"Category K. Identity Resolution (RFC-011)",id:"category-k-identity-resolution-rfc-011",level:2},{value:"Category L. Trust Evidence (RFC-012)",id:"category-l-trust-evidence-rfc-012",level:2},{value:"Category M. Edge profile (Edge only)",id:"category-m-edge-profile-edge-only",level:2},{value:"Test reporting template",id:"test-reporting-template",level:2},{value:"Continuous conformance",id:"continuous-conformance",level:2},{value:"Related",id:"related",level:2}];function o(e){const s={a:"a",code:"code",h1:"h1",h2:"h2",header:"header",input:"input",li:"li",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,i.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(s.header,{children:(0,r.jsx)(s.h1,{id:"pti-conformance-tests",children:"PTI Conformance Tests"})}),"\n",(0,r.jsx)(s.p,{children:"This document defines test categories, pass criteria, and checklists for PTI self-assessment and accredited certification. Tests reference normative RFC requirements."}),"\n",(0,r.jsx)(s.h2,{id:"test-methodology",children:"Test methodology"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Type"}),(0,r.jsx)(s.th,{children:"Tooling"}),(0,r.jsx)(s.th,{children:"Who runs"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.strong,{children:"Automated contract"})}),(0,r.jsx)(s.td,{children:"OpenAPI-driven HTTP tests, JSON Schema validation"}),(0,r.jsx)(s.td,{children:"CI + lab"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.strong,{children:"Automated negative"})}),(0,r.jsx)(s.td,{children:"Fuzzing, entitlement bypass attempts"}),(0,r.jsx)(s.td,{children:"Lab"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.strong,{children:"Manual procedural"})}),(0,r.jsx)(s.td,{children:"DSAR walkthrough, key rotation drill"}),(0,r.jsx)(s.td,{children:"Lab + operator"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.strong,{children:"Soak / performance"})}),(0,r.jsx)(s.td,{children:"Load on lookup path"}),(0,r.jsx)(s.td,{children:"Enterprise+ optional"})]})]})]}),"\n",(0,r.jsxs)(s.p,{children:["Pass criterion: ",(0,r.jsx)(s.strong,{children:"100% mandatory tests pass"})," for declared profile. Optional capabilities tested only if claimed."]}),"\n",(0,r.jsx)(s.h2,{id:"test-environment",children:"Test environment"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Sandbox tenant with seed data kit ",(0,r.jsx)(s.code,{children:"pti-test-fixtures-v1"})]}),"\n",(0,r.jsxs)(s.li,{children:["At least three subjects: ",(0,r.jsx)(s.code,{children:"pti_test_alpha"}),", ",(0,r.jsx)(s.code,{children:"pti_test_beta"}),", ",(0,r.jsx)(s.code,{children:"pti_test_gamma"})]}),"\n",(0,r.jsx)(s.li,{children:"Two producers with disjoint context entitlements"}),"\n",(0,r.jsx)(s.li,{children:"One consumer with partial context entitlement (for negative tests)"}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"category-a-architecture-rfc-001",children:"Category A. Architecture (RFC-001)"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"ID"}),(0,r.jsx)(s.th,{children:"Test"}),(0,r.jsx)(s.th,{children:"Pass criteria"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"A-01"}),(0,r.jsx)(s.td,{children:"Role separation"}),(0,r.jsx)(s.td,{children:"Producer credential cannot call consumer-only endpoints"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"A-02"}),(0,r.jsx)(s.td,{children:"Lifecycle ingest\u2192lookup"}),(0,r.jsx)(s.td,{children:"Event accepted \u2192 outcome updates \u2192 report references event"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"A-03"}),(0,r.jsx)(s.td,{children:"Fail-closed policy"}),(0,r.jsxs)(s.td,{children:["Disabled context ingest returns ",(0,r.jsx)(s.code,{children:"context_not_enabled"})]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"A-04"}),(0,r.jsx)(s.td,{children:"Sandbox isolation"}
1),(0,r.jsx)(s.td,{children:"Sandbox report IDs invalid in production verify"})]})]})]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Checklist:"})}),"\n",(0,r.jsxs)(s.ul,{className:"contains-task-list",children:["\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","A-01 pass"]}),"\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","A-02 pass"]}),"\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","A-03 pass"]}),"\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","A-04 pass"]}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"category-b-trust-contexts-rfc-002",children:"Category B. Trust Contexts (RFC-002)"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"ID"}),(0,r.jsx)(s.th,{children:"Test"}),(0,r.jsx)(s.th,{children:"Pass criteria"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"B-01"}),(0,r.jsx)(s.td,{children:"Primary catalogue"}),(0,r.jsxs)(s.td,{children:["All claimed primaries validate ",(0,r.jsx)(s.code,{children:"context_id"})," format"]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"B-02"}),(0,r.jsx)(s.td,{children:"Lens rejection on ingest"}),(0,r.jsxs)(s.td,{children:["Event with lens ",(0,r.jsx)(s.code,{children:"context_id"})," rejected at ingest"]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"B-03"}),(0,r.jsx)(s.td,{children:"Isolation"}),(0,r.jsx)(s.td,{children:"Lending event does not alter merchant score"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"B-04"}),(0,r.jsx)(s.td,{children:"Consumer entitlement"}),(0,r.jsxs)(s.td,{children:["Lookup with non-entitled context returns ",(0,r.jsx)(s.code,{children:"context_not_entitled"})]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"B-05"}),(0,r.jsx)(s.td,{children:"Lens derivation flag"}),(0,r.jsxs)(s.td,{children:["Lens outcomes show ",(0,r.jsx)(s.code,{children:"derived: true"})," in evidence"]})]})]})]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Checklist:"})}),"\n",(0,r.jsxs)(s.ul,{className:"contains-task-list",children:["\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","B-01 through B-05 pass"]}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"category-c-trust-events-rfc-003",children:"Category C. Trust Events (RFC-003)"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"ID"}),(0,r.jsx)(s.th,{children:"Test"}),(0,r.jsx)(s.th,{children:"Pass criteria"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"C-01"}),(0,r.jsx)(s.td,{children:"Required fields"}),(0,r.jsxs)(s.td,{children:["Missing ",(0,r.jsx)(s.code,{children:"event_type"})," \u2192 400 validation error"]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"C-02"}),(0,r.jsx)(s.td,{children:"Idempotency"}),(0,r.jsxs)(s.td,{children:["Duplicate ",(0,r.jsx)(s.code,{children:"idempotency_key"})," returns same ",(0,r.jsx)(s.code,{children:"event_id"}),", single graph edge"]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"C-03"}),(0,r.jsx)(s.td,{children:"occurred_at bounds"}),(0,r.jsx)(s.td,{children:"Event 11 years old rejected"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"C-04"}),(0,r.jsx)(s.td,{children:"Prohibited payload"}),(0,r.jsx)(s.td,{children:"PAN in payload rejected"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"C-05"}),(0,r.jsx)(s.td,{children:"Channel attribution"}),(0,r.jsxs)(s.td,{children:["Webhook-delivered event has ",(0,r.jsx)(s.code,{children:"ingest_channel: webhook"})]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"C-06"}),(0,r.jsx)(s.td,{children:"Compensating event"}),(0,r.jsx)(s.td,{children:"Reversal event adjusts outcome with audit trail"})]})]})]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Checklist:"})}),"\n",(0,r.jsxs)(s.ul,{className:"contains-task-list",children:["\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","C-01 through C-06 pass"]}),"\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","CSV batch reports row errors without silent drop (Enterprise+)"]}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"category-d-trust-lookup-api-rfc-004",children:"Category D. Trust Lookup API (RFC-004)"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"ID"}),(0,r.jsx)(s.th,{children:"Test"}),(0,r.jsx)(s.th,{children:"Pass criteria"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"D-01"}),(0,r.jsx)(s.td,{children:"Search strong ID"}),(0,r.jsxs)(s.td,{children:["Returns ",(0,r.jsx)(s.code,{children:"pti_test_alpha"})," at confidence \u2265 0.95"]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"D-02"}),(0,r.jsx)(s.td,{children:"Ambiguous weak ID"}),(0,r.jsxs)(s.td,{children:["Returns ",(0,r.jsx)(s.code,{children:"ambiguous"})," without auto-select"]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"D-03"}),(0,r.jsx)(s.td,{children:"Generate detailed"}),(0,r.jsxs)(s.td,{children:["Response includes scores, drivers, ",(0,r.jsx)(s.code,{children:"trust_evidence"})]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"D-04"}),(0,r.jsx)(s.td,{children:"Consent gate"}),(0,r.jsxs)(s.td,{children:["Missing ",(0,r.jsx)(s.code,{children:"consent_ref"})," returns ",(0,r.jsx)(s.code,{children:"consent_required"})," when policy on"]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"D-05"}),(0,r.jsx)(s.td,{children:"Tier enforcement"}),(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"screening_dossier"})," without entitlement fails"]}
1)]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"D-06"}),(0,r.jsx)(s.td,{children:"Report immutability"}),(0,r.jsxs)(s.td,{children:["Second ",(0,r.jsx)(s.code,{children:"reports.get"})," returns identical manifest hash"]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"D-07"}),(0,r.jsx)(s.td,{children:"Async handling"}),(0,r.jsxs)(s.td,{children:["If 202 returned, ",(0,r.jsx)(s.code,{children:"status_url"})," resolves to terminal state"]})]})]})]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Checklist:"})}),"\n",(0,r.jsxs)(s.ul,{className:"contains-task-list",children:["\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","D-01 through D-07 pass"]}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"category-e-trust-graph-rfc-005",children:"Category E. Trust Graph (RFC-005)"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"ID"}),(0,r.jsx)(s.th,{children:"Test"}),(0,r.jsx)(s.th,{children:"Pass criteria"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"E-01"}),(0,r.jsx)(s.td,{children:"Orphan rejection"}),(0,r.jsx)(s.td,{children:"Internal ingest cannot create event without subject link"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"E-02"}),(0,r.jsx)(s.td,{children:"Explain outcome"}),(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"explain_outcome"})," lists source events matching drivers"]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"E-03"}),(0,r.jsx)(s.td,{children:"Signal versioning"}),(0,r.jsxs)(s.td,{children:["Reprocessing creates new ",(0,r.jsx)(s.code,{children:"signal_id"}),", preserves old"]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"E-04"}),(0,r.jsx)(s.td,{children:"Point-in-time"}),(0,r.jsxs)(s.td,{children:["Historical ",(0,r.jsx)(s.code,{children:"report_id"})," reconstructs same scores"]})]})]})]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Checklist:"})}),"\n",(0,r.jsxs)(s.ul,{className:"contains-task-list",children:["\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","E-01 through E-04 pass"]}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"category-f-trust-exchange-rfc-006-enterprise-optional--government-mandatory",children:"Category F. Trust Exchange (RFC-006, Enterprise+ optional / Government mandatory)"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"ID"}),(0,r.jsx)(s.th,{children:"Test"}),(0,r.jsx)(s.th,{children:"Pass criteria"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"F-01"}),(0,r.jsx)(s.td,{children:"Package signature"}),(0,r.jsx)(s.td,{children:"Valid package verifies; tampered bytes fail"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"F-02"}),(0,r.jsx)(s.td,{children:"Foreign PTI-ID format"}),(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"pti_x@op_test"})," parsed correctly"]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"F-03"}),(0,r.jsx)(s.td,{children:"Revocation"}),(0,r.jsxs)(s.td,{children:["Revoked ",(0,r.jsx)(s.code,{children:"manifest_id"})," returns ",(0,r.jsx)(s.code,{children:"verification_status: revoked"})]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"F-04"}),(0,r.jsx)(s.td,{children:"Fail closed"}),(0,r.jsx)(s.td,{children:"Invalid signature excludes package from consumer fields"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"F-05"}),(0,r.jsx)(s.td,{children:"PRL polling"}),(0,r.jsx)(s.td,{children:"Simulated revocation visible within SLA"})]})]})]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Checklist:"})}),"\n",(0,r.jsxs)(s.ul,{className:"contains-task-list",children:["\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","F-01 through F-05 pass (if exchange claimed)"]}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"category-g-governance-rfc-007",children:"Category G. Governance (RFC-007)"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"ID"}),(0,r.jsx)(s.th,{children:"Test"}),(0,r.jsx)(s.th,{children:"Pass criteria"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"G-01"}),(0,r.jsx)(s.td,{children:"Consent withdraw"}),(0,r.jsx)(s.td,{children:"Lookup blocked within 15 minutes after withdraw"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"G-02"}),(0,r.jsx)(s.td,{children:"Audit append-only"}),(0,r.jsx)(s.td,{children:"Tamper attempt detected"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"G-03"}),(0,r.jsx)(s.td,{children:"Deletion propagation"}),(0,r.jsx)(s.td,{children:"Erased subject's events removed from new reports"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"G-04"}),(0,r.jsx)(s.td,{children:"Adverse action fields"}),(0,r.jsx)(s.td,{children:"Detailed report drivers ordered with weights"})]})]})]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Checklist:"})}),"\n",(0,r.jsxs)(s.ul,{className:"contains-task-list",children:["\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","G-01 through G-04 pass"]}),"\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0}
1)," ","DSAR export within published SLA (Enterprise+)"]}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"category-h-security-rfc-008",children:"Category H. Security (RFC-008)"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"ID"}),(0,r.jsx)(s.th,{children:"Test"}),(0,r.jsx)(s.th,{children:"Pass criteria"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"H-01"}),(0,r.jsx)(s.td,{children:"TLS version"}),(0,r.jsx)(s.td,{children:"TLS 1.1 rejected"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"H-02"}),(0,r.jsx)(s.td,{children:"Scoped credential"}),(0,r.jsx)(s.td,{children:"Consumer key cannot ingest events"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"H-03"}),(0,r.jsx)(s.td,{children:"Rate limit"}),(0,r.jsx)(s.td,{children:"Search enumeration triggers throttle"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"H-04"}),(0,r.jsx)(s.td,{children:"Webhook replay"}),(0,r.jsx)(s.td,{children:"Old timestamp signature rejected"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"H-05"}),(0,r.jsx)(s.td,{children:"Key rotation"}),(0,r.jsxs)(s.td,{children:["Dual ",(0,r.jsx)(s.code,{children:"kid"})," acceptance during overlap window"]})]})]})]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Checklist:"})}),"\n",(0,r.jsxs)(s.ul,{className:"contains-task-list",children:["\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","H-01 through H-05 pass"]}),"\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","Pen test report < 12 months old (Enterprise+)"]}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"category-i-privacy-rfc-009",children:"Category I. Privacy (RFC-009)"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"ID"}),(0,r.jsx)(s.th,{children:"Test"}),(0,r.jsx)(s.th,{children:"Pass criteria"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"I-01"}),(0,r.jsx)(s.td,{children:"Purpose logging"}),(0,r.jsxs)(s.td,{children:["Audit contains ",(0,r.jsx)(s.code,{children:"purpose_code"})," per lookup"]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"I-02"}),(0,r.jsx)(s.td,{children:"Minimization basic"}),(0,r.jsx)(s.td,{children:"Basic tier has no raw producer payload"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"I-03"}),(0,r.jsx)(s.td,{children:"Cross-border block"}),(0,r.jsx)(s.td,{children:"Disallowed region transfer fails closed"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"I-04"}),(0,r.jsx)(s.td,{children:"DSAR completeness"}),(0,r.jsx)(s.td,{children:"Export includes lookups and consents"})]})]})]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Checklist:"})}),"\n",(0,r.jsxs)(s.ul,{className:"contains-task-list",children:["\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","I-01 through I-04 pass"]}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"category-j-versioning-rfc-010",children:"Category J. Versioning (RFC-010)"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"ID"}),(0,r.jsx)(s.th,{children:"Test"}),(0,r.jsx)(s.th,{children:"Pass criteria"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"J-01"}),(0,r.jsx)(s.td,{children:"Unknown field tolerance"}),(0,r.jsx)(s.td,{children:"Client ignores new optional field without error"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"J-02"}),(0,r.jsx)(s.td,{children:"Deprecation header"}),(0,r.jsxs)(s.td,{children:["Sunset endpoint returns ",(0,r.jsx)(s.code,{children:"Deprecation"})," header"]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"J-03"}),(0,r.jsx)(s.td,{children:"Schema version"}),(0,r.jsxs)(s.td,{children:["Report includes ",(0,r.jsx)(s.code,{children:"schema_version"})]})]})]})]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Checklist:"})}),"\n",(0,r.jsxs)(s.ul,{className:"contains-task-list",children:["\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","J-01 through J-03 pass"]}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"category-k-identity-resolution-rfc-011",children:"Category K. Identity Resolution (RFC-011)"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"ID"}),(0,r.jsx)(s.th,{children:"Test"}),(0,r.jsx)(s.th,{children:"Pass criteria"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"K-01"}),(0,r.jsx)(s.td,{children:"Entity binding stability"}),(0,r.jsxs)(s.td,{children:["Same ",(0,r.jsx)(s.code,{children:"entity_id"})," always maps same ",(0,r.jsx)(s.code,{children:"pti_id"})]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"K-02"}),(0,r.jsx)(s.td,{children:"Confidence threshold"}),(0,r.jsx)(s.td,{children:"0.70 confidence does not auto-link"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"K-03"}),(0,r.jsx)(s.td,{children:"Conflict block"}),(0,r.jsx)(s.td,{children:"Conflicting strong IDs route to review, no merge"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"K-04"}
1),(0,r.jsx)(s.td,{children:"External route"}),(0,r.jsxs)(s.td,{children:["Unknown subject returns ",(0,r.jsx)(s.code,{children:"external_route"})," when entitled"]})]})]})]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Checklist:"})}),"\n",(0,r.jsxs)(s.ul,{className:"contains-task-list",children:["\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","K-01 through K-04 pass"]}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"category-l-trust-evidence-rfc-012",children:"Category L. Trust Evidence (RFC-012)"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"ID"}),(0,r.jsx)(s.th,{children:"Test"}),(0,r.jsx)(s.th,{children:"Pass criteria"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"L-01"}),(0,r.jsx)(s.td,{children:"Manifest signature"}),(0,r.jsx)(s.td,{children:"Valid EdDSA/RSA verify on canonical JSON"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"L-02"}),(0,r.jsx)(s.td,{children:"Verification endpoint"}),(0,r.jsxs)(s.td,{children:["QR token resolves ",(0,r.jsx)(s.code,{children:"valid"})]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"L-03"}),(0,r.jsx)(s.td,{children:"Redaction"}),(0,r.jsxs)(s.td,{children:["Non-entitled context events absent from ",(0,r.jsx)(s.code,{children:"sources"})]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"L-04"}),(0,r.jsx)(s.td,{children:"Lens metadata"}),(0,r.jsxs)(s.td,{children:["Derived contexts include ",(0,r.jsx)(s.code,{children:"feeds_from"})]})]})]})]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Checklist:"})}),"\n",(0,r.jsxs)(s.ul,{className:"contains-task-list",children:["\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","L-01 through L-04 pass"]}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"category-m-edge-profile-edge-only",children:"Category M. Edge profile (Edge only)"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"ID"}),(0,r.jsx)(s.th,{children:"Test"}),(0,r.jsx)(s.th,{children:"Pass criteria"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"M-01"}),(0,r.jsx)(s.td,{children:"Offline queue"}),(0,r.jsx)(s.td,{children:"Events ingested offline sync without duplication"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"M-02"}),(0,r.jsx)(s.td,{children:"Conflict resolution"}),(0,r.jsx)(s.td,{children:"Documented conflict yields deterministic outcome"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"M-03"}),(0,r.jsx)(s.td,{children:"Hub verify"}),(0,r.jsxs)(s.td,{children:["Edge ",(0,r.jsx)(s.code,{children:"report_id"})," verifiable via hub"]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:"M-04"}),(0,r.jsx)(s.td,{children:"Deferred erasure"}),(0,r.jsx)(s.td,{children:"Erasure propagates within 72h of sync"})]})]})]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Checklist:"})}),"\n",(0,r.jsxs)(s.ul,{className:"contains-task-list",children:["\n",(0,r.jsxs)(s.li,{className:"task-list-item",children:[(0,r.jsx)(s.input,{type:"checkbox",disabled:!0})," ","M-01 through M-04 pass"]}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"test-reporting-template",children:"Test reporting template"}),"\n",(0,r.jsx)(s.pre,{children:(0,r.jsx)(s.code,{className:"language-markdown",children:"## PTI Conformance Test Report\n\n- Operator: \n- Profile: \n- Spec version: \n- Date: \n\n| Category | Pass | Fail | N/A |\n|----------|------|------|-----|\n| A Architecture | | | |\n| \u2026 | | | |\n\nMandatory failures: \nRemediation plan: \nSigned by: \n"})}),"\n",(0,r.jsx)(s.h2,{id:"continuous-conformance",children:"Continuous conformance"}),"\n",(0,r.jsxs)(s.p,{children:["Implementers ",(0,r.jsx)(s.strong,{children:"SHOULD"})," run categories A, C, D, L on every release candidate in CI. Full suite ",(0,r.jsx)(s.strong,{children:"SHOULD"})," run quarterly."]}),"\n",(0,r.jsx)(s.h2,{id:"related",children:"Related"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.a,{href:"/docs/pti/conformance/certification-guide",children:"Certification guide"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.a,{href:"/docs/pti/conformance/profiles",children:"Conformance profiles"})}),"\n"]})]})}function a(e={}){const{wrapper:s}={...(0,i.R)(),...e.components};return s?(0,r.jsx)(s,{...e,children:(0,r.jsx)(o,{...e})}):o(e)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.