Network Working Group D. O. Watts Internet-Draft GoodShyt Group Inc. Intended status: Informational 21 October 2026 Expires: 24 April 2027 Verification Promotion and Agent Assurance Appraisal Profile draft-watts-rats-verification-promotion-appraisal-00 Abstract This document maps protocol-verification evidence and the WIVL assurance-stage model onto the RATS architecture. It defines appraisal requirements for SPEC_VALIDATED, LOCAL_CONFORMANT, INDEPENDENTLY_REPRODUCED, and SECURITY_TESTED results while preserving unknown evidence and requiring arithmetic preconditions for mathematical test vectors. An attestation result reports bounded assurance; it is not an authorization grant or production-release decision. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 24 April 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. Watts Expires 24 April 2027 [Page 1] Internet-Draft Verification Appraisal October 2026 This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Requirements Language . . . . . . . . . . . . . . . . . . . . 2 2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 3. RATS Role Mapping . . . . . . . . . . . . . . . . . . . . . . 3 4. Verification Stages . . . . . . . . . . . . . . . . . . . . . 3 5. Evidence Claims . . . . . . . . . . . . . . . . . . . . . . . 3 6. Appraisal Policy . . . . . . . . . . . . . . . . . . . . . . 3 7. Attestation Result Mapping . . . . . . . . . . . . . . . . . 4 8. Independent and Multiple Verifiers . . . . . . . . . . . . . 4 9. Conformance and Falsification Cases . . . . . . . . . . . . . 5 10. Security Considerations . . . . . . . . . . . . . . . . . . . 5 11. Privacy Considerations . . . . . . . . . . . . . . . . . . . 5 12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 5 13. Normative References . . . . . . . . . . . . . . . . . . . . 5 14. Informative References . . . . . . . . . . . . . . . . . . . 6 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 6 1. Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals. 2. Introduction The RATS architecture [RFC9334] separates Evidence produced by an Attester, appraisal by a Verifier, and trust decisions by a Relying Party. WIVL uses a similar separation for software and protocol assurance stages. This document defines a profile for representing protocol-verification evidence as attestation evidence and for appraising that evidence into a bounded assurance stage. This profile does not claim that passing a software test proves model safety, operational authorization, or production readiness. It standardizes what evidence is required before a Verifier can report a specific verification stage. Watts Expires 24 April 2027 [Page 2] Internet-Draft Verification Appraisal October 2026 3. RATS Role Mapping Attester The characterized build or test environment that emits evidence about the implementation, procedure, vectors, environment, and results. Verifier The party that appraises the evidence against an appraisal policy and emits an Attestation Result. Relying Party The party deciding whether the reported assurance stage is sufficient for a local use. Reference Values and Endorsements Expected vector digests, procedure digests, approved implementation identifiers, release metadata, or other trusted inputs used by the appraisal policy. 4. Verification Stages The ordered stages are REGISTERED, SPEC_VALIDATED, LOCAL_CONFORMANT, INDEPENDENTLY_REPRODUCED, and SECURITY_TESTED. RELEASE_ELIGIBLE is intentionally not an attestation stage because release approval is a relying-party governance decision. No stage implies a later stage. In particular, LOCAL_CONFORMANT MUST NOT be appraised as INDEPENDENTLY_REPRODUCED unless the evidence identifies an independent reproducing producer and implementation. 5. Evidence Claims Evidence for this profile includes: subject digest, implementation digest, verification-procedure digest, vector-set digest, environment digest, toolchain versions, result digest, per-check outcomes, producer identifier, and timestamps or freshness evidence appropriate to the attestation mechanism. Where the procedure includes finite-field or elliptic-curve test vectors, the appraisal policy SHOULD require arithmetic preconditions before considering higher-level metamorphic relations. At minimum, declared curve parameters must be non-singular and each declared affine point must satisfy the curve equation before group-law results are admitted as evidence. 6. Appraisal Policy 1. Validate evidence integrity and freshness according to the selected RATS mechanism. Watts Expires 24 April 2027 [Page 3] Internet-Draft Verification Appraisal October 2026 2. Confirm the subject, procedure, vector-set, and environment digests against trusted reference inputs. 3. For SPEC_VALIDATED, require all declared specification preconditions to be internally consistent and required vector inputs to be valid. 4. For LOCAL_CONFORMANT, additionally require all mandatory conformance checks to PASS in the characterized environment. 5. For INDEPENDENTLY_REPRODUCED, require a producer distinct from the original producer and evidence that the reproducing implementation is independently controlled. The verifier MUST NOT infer independence from a second run of the same implementation by the same producer. 6. For SECURITY_TESTED, require evidence of the deployment-defined authorized security-testing and fault-injection obligations in addition to independent reproduction. 7. If any required fact is unknown or unverifiable, the verifier MUST report a result that does not exceed the strongest stage actually established. 7. Attestation Result Mapping The assurance stage can be carried as an application-specific result alongside the trustworthiness information defined by current RATS work such as AR4SI [I-D.rats-ar4si] or EAT Attestation Results [I-D.rats-ear]. This version does not define a new registered EAT claim. A result SHOULD also identify the appraisal-policy digest, evidence digest, verifier identity, and unresolved conditions. A Relying Party MUST apply its own policy; an Attestation Result is not an authorization credential. 8. Independent and Multiple Verifiers Deployments MAY use multiple verifiers, including the interaction patterns explored by [I-D.rats-multi]. Multiple-verifier use does not automatically establish independent reproduction: the underlying evidence producers and implementations must also satisfy the independence policy. Watts Expires 24 April 2027 [Page 4] Internet-Draft Verification Appraisal October 2026 9. Conformance and Falsification Cases An implementation is non-conformant if it promotes a local result to independent reproduction without independent evidence, ignores a failed specification precondition, treats an invalid elliptic point as valid evidence for a group-law test, promotes UNKNOWN evidence, or treats an Attestation Result as permission to execute without a separate authorization decision. 10. Security Considerations Threats include circular evidence generation, self-attestation, reference-value substitution, environment spoofing, stale results, toolchain substitution, selective omission of failed vectors, and independence fraud. Security-critical expected values SHOULD come from a source independent of the implementation under test. The appraisal policy SHOULD bind all evidence to immutable digests and preserve failed or indeterminate outcomes. 11. Privacy Considerations Verification evidence can expose software versions, deployment configuration, test environments, vulnerability findings, and organizational relationships. Profiles SHOULD minimize evidence disclosure and use digests or controlled references where the Relying Party does not require raw evidence. 12. IANA Considerations This document has no IANA actions. A future revision can request claim or media-type registrations if a working-group encoding is selected. 13. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", RFC 2119, March 1997, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", RFC 8174, May 2017, . [RFC9334] Birkholz, H., Thaler, D., Richardson, M., Smith, N., and W. Pan, "Remote ATtestation procedureS (RATS) Architecture", RFC 9334, January 2023, . Watts Expires 24 April 2027 [Page 5] Internet-Draft Verification Appraisal October 2026 14. Informative References [I-D.rats-ar4si] Voit, E., Birkholz, H., Hardjono, T., Fossati, T., and V. Scarlata, "Attestation Results for Secure Interactions", Work in Progress, Internet-Draft, draft-ietf-rats-ar4si- 10, May 2026, . [I-D.rats-ear] Fossati, T., Voit, E., Trofimov, S., and H. Birkholz, "EAT Attestation Results", Work in Progress, Internet-Draft, draft-ietf-rats-ear-04, May 2026, . [I-D.rats-multi] "Remote Attestation with Multiple Verifiers", Work in Progress, Internet-Draft, draft-ietf-rats-multi-verifier- 00, May 2026, . [I-D.watts-vpb] Watts, D. O., "Verification Promotion Boundaries for Protocol Implementations", Work in Progress, Internet- Draft, draft-watts-verification-promotion-boundaries-00, October 2026, . [I-D.watts-vdq] Watts, D. O., "Verification Defect Quarantine for Protocol Conformance Systems", Work in Progress, Internet-Draft, draft-watts-verification-defect-quarantine-00, October 2026, . [I-D.watts-haace] Watts, D. O., "High-Assurance Agent Control Envelope", Work in Progress, Internet-Draft, draft-watts-high- assurance-agent-control-envelope-00, October 2026, . Author's Address Deonte O'dell Watts GoodShyt Group Inc. San Francisco, CA United States of America Watts Expires 24 April 2027 [Page 6] Internet-Draft Verification Appraisal October 2026 Email: deonte@goodshyt.fun URI: https://orcid.org/0009-0005-8586-3650 Watts Expires 24 April 2027 [Page 7]