Graded Conformance turns the verification methods of §22 into an assurance instrument. §22 specifies how an implementation demonstrates that a requirement holds; §23 specifies what the demonstration yields when conformance is reported not as a single pass/fail bar but as a position on a spectrum — a floor, a ceiling, and the nameable delta between them. This is the resolution of §22's deferred binary-vs-graded question: ZTG conformance is graded. The methods §22 defines are stable under that choice; §23 is where the grade they produce is defined.
Operational Questions #
§23, like §22, is not mapped to one of the seven operational questions; it is the section that states what a conformance claim asserts once the seven are individually demonstrable. Its subject is the shape of the guarantee: that an implementation's conformance is a graded statement of the architecture's maximum guarantee and how much of that maximum a given deployment realizes — not a checkmark. Its discipline is that a grade which cannot separate what the architecture can guarantee from what the deployment has operated is not a conformance claim but a marketing one.
Normative #
Conformance to ZTG is graded, not binary. A conformance claim states a position on a spectrum whose floor is execution governance and whose ceiling is the maximal guarantee the architecture commits to. The spectrum is graded by which attack classes a deployment is designed to survive — the laundering channels enumerated in the framework's threat model — so that the delta between two claims is a specific, nameable set of adversaries rather than a vague "more assurance."
The Floor #
The floor is execution governance, defined not by having a boundary but by the attack class a boundary must survive to earn the name: spontaneous defection / trust-decay-across-regime-shift. A deployment is execution governance iff (a) the bound on effects that can reach the world does not depend on the model's good behavior; (b) the bound holds no ambient authority around it, so the registered surface is the only reachable route by construction (structural closure, ZTG-3); and (c) it produces enough external, non-self-authored record (ZTG-0a) to demonstrate (a) and (b) over the enumerated effect surface. The floor is the irreducible core — ZTG-1 + ZTG-3 + ZTG-0a jointly — and these three do not grade independently. Full development in the design note (§1); this section carries the floor by reference and does not restate its derivation.
Survival Is Three-Valued #
A grade reports, per attack class, one of three states: closed (the class is survived under complete mediation), bounded (survived only to a named, non-zero residual), or open (not survived). A grade that claims "survives X" when it only bounds X to a residual is floor-washing; the instrument MUST report the residual, not a checkmark. Some classes never reach closed and are inherently bounded (e.g. hollow ratification — attribution, not attentiveness).
The Grade Is a Frontier Over a Partial Order #
Attack classes form a partial order, not a flat menu: surviving a downstream class requires its upstream preconditions closed. A grade is therefore a frontier over that dependency graph, and a claim MUST NOT report a downstream class as survived while an upstream precondition it depends on is open.
Ceiling and Coverage Are Distinct Deltas #
A conformance claim MUST state two things and MUST NOT conflate them:
- the ceiling delta — which attack classes, and at what strength, the architecture commits to at all; and
- the coverage delta — how completely a given deployment realizes them.
A low ceiling cannot be operated into strength, and a high ceiling is not a realized guarantee. The reachable-unregistered channel set is a coverage matter, borne by the deployer: the mechanism's no-ambient-authority (floor (b)) relocates and shrinks it but does not close it, and per §22 the gate cannot self-certify its own enumeration completeness (it produces no evidence for what bypasses it). Enumeration completeness and the scope of a claim are therefore handled by §22 (Scope and Partial Conformance), and a grade inherits that scope statement rather than restating it. Silent scope limitation is a conformance defect there and here.
The Grade Unit #
A grade is reported per-invariant. The system of record is a survival frontier per invariant (closed / bounded / open over the channel partial order). Named tiers are a derived view over those frontiers and MUST NOT be reported as a substitute for them — the same discipline ZTG-0a applies to metrics-vs-record (§5): a tier is a downstream summary of the frontier, never the record itself.
A named tier T is a defined cut over the partial order: an implementation is at tier T iff, for every attack class up to T's frontier, survival is at least bounded, with closed where T claims closure, and no downstream class is claimed while an upstream precondition it depends on is open. A tier claim inherits the ceiling/coverage split and the §22 scope statement — it states the tier the architecture reaches and the coverage a deployment realizes against it, and MUST NOT report a tier the deployment's coverage does not support.
Further Considerations #
The conformance ledger and the underwriting instrument are the same document. Because the ceiling is the failure profile of a diligent operator — bounded, evidenced, attributable — rather than superhuman correctness, conformance grade tracks risk grade: the floor is insurable at all (bounded but coarse), the ceiling is finely priceable and settlement-capable, and the min→max climb is the curve a control warranty prices. Widening reach and pricing the delta are the same move.
Referee posture. Defining the floor as a category — execution governance, earned by surviving a named attack class — means other implementations can conform to it. This is a standards-author position, not a product moat by exclusion; the moat is the reference implementation at the ceiling plus ownership of the conformance instrument, not gatekeeping of the floor.
Relationship to §22. §22's methods are indifferent to grading: a reachability argument, a reproduction corpus, an injection result establish a property whether that property is scored pass/fail or placed on a frontier. §23 depends on §22 for how each survival claim is demonstrated; it adds only how the demonstrated claims compose into a grade.
How We Do It #
Constable is the maximal instance — the ceiling reference implementation against which the delta is measured, not the definition of the floor. Its tainting property (no stochastic-derived value enters the authorization path unless adopted by a human) is the ceiling on the stochastic-containment axis; its full survival frontier across the threat model is the worked ceiling the design note develops (§6–§7). A Constable deployment's own conformance claim states its coverage against that ceiling per the scope discipline of §22.