CertentIQ / Internal engineering evidence
A reproducible account of what repository tests are designed to check, what a passing regression means, and which production and assurance questions remain outside that evidence.
01 / Status
This is an internal regression-evidence statement for the reviewed repository revision. It records test intent and reproducibility without turning automated results into an institutional or deployment-wide assurance conclusion.
Engineering evidence produced and reviewed by the operator.
Code, contracts, fixtures, defaults, and tests in the identified build.
Infrastructure and operational controls require separate evidence.
No third-party audit or conformity conclusion is represented.
02 / Evidence register
Each area has a defined repository test surface. Passing means those assertions completed for that revision and environment; it does not extend beyond the named scope.
Token validation, issuer and audience checks, session expiry, protected routes, and revocation behavior.
test_auth.py, test_session_cookie.py, test_gateway_routes.pyIdentity proofing, operator device security, production key custody, or complete access governance.
Action scopes, admin exposure defaults, trusted-proxy handling, and route-level access decisions.
test_scope_enforcement.py, test_audit_fixes_standard_path.py, test_gateway_routes.pyNetwork segmentation, infrastructure IAM, privileged-access operations, or every integration path.
Path containment, allowed tool behavior, preservation rules, egress policy, and external-tool protocol handling.
test_tool_sandbox.py, test_external_tool_protocol.py, task-specific testsOperating-system isolation, container escape resistance, tenant separation, or deployment hardening.
Audit-chain validation, signed public records, JWKS verification, canonicalization, revocation, and tamper rejection.
test_audit_chain.py, test_leaderboard.py, test_independent_verify.pyImmutable retention, complete event capture, legal non-repudiation, evaluator independence, or behavioral validity.
Provider-failure suppression, battery integrity, task governance, adaptive trials, security gates, and result expiry.
test_task_governance.py, test_anti_gaming.py, test_evidence_context.pyMeasurement validity, production predictive value, scorer correctness outside reviewed fixtures, or cross-version comparability.
Security headers, content policy, static routing, protected pages, injection sinks, and withdrawn-claim behavior.
test_security_headers.py, test_gateway_routes.py, test_public_claim_language.pyClient device security, extension behavior, upstream compromise, CDN configuration, or every browser implementation.
Supported storage backends, atomic mutations, registration claims, replay controls, and concurrent state updates.
test_storage_backend.py, test_storage_concurrency.py, route transaction testsProduction backup recovery, capacity, multi-region consistency, database administration, or disaster recovery.
03 / Reproduce
A report should point to the revision, environment, command, output, and retained artifacts. A green test run is engineering evidence for those assertions, not an external approval.
Checks route status, security headers, public wording, and withdrawal behavior.
pytest -q tests/test_public_claim_language.py tests/test_security_headers.py tests/test_gateway_routes.pyChecks signed entries, independent verification, evidence context, and governance gates.
pytest -q tests/test_leaderboard.py tests/test_independent_verify.py tests/test_evidence_context.py tests/test_task_governance.pyRuns the complete available test suite for the checked-out revision and configured environment.
pytest -q04 / Change rule
Results must remain attached to the exact revision and environment that produced them.
Use the security-control inventory for implementation and mapping details, or review the evaluation methodology applied to configured agent systems.