{ "suite": "record", "schema": "gavr-record-1.0.json", "description": "Record documents and the verdict a conforming implementation must reach. `expect.rules` names the catalogue rules the document breaks. Whether a stock JSON Schema validator catches a case is NOT stated here: it is derived from each rule's `expressed` flag in the catalogue, so this corpus proves the flag rather than restating it. Cases marked COMPANION RULE are the ones a validator accepts and the registry refuses, which is the gap this corpus exists to make visible.", "cases": [ { "id": "accept-published-minimal", "note": "The smallest record that says something: one identifier, one container, one description.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "accept-reserved-without-container", "note": "A reservation carries no content, so the absence of an owner container is not a defect (GAVR-R-001 does not apply).", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "RESERVED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z" }, "expect": { "valid": true } }, { "id": "accept-gavlr-at-depth-two", "note": "A local identifier whose path IS the delegation chain, within the network depth cap.", "input": { "schemaVersion": "1.0", "id": "GAVLR-42-7-A7K2QX", "identifiers": [ { "namespace": "GAVLR", "value": "GAVLR-42-7-A7K2QX", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "accept-several-identifiers-in-one-namespace", "note": "Two CNAs assigning a CVE each is the ordinary case. The duplicate is RETAINED and the role says which to cite; a test-registry identifier occupies its own slot.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" }, { "namespace": "CVE", "value": "CVE-2026-0001", "environment": "prod", "role": "CANONICAL" }, { "namespace": "CVE", "value": "CVE-2026-0002", "environment": "prod", "role": "DUPLICATE" }, { "namespace": "CVE", "value": "CVE-2026-9999", "environment": "test", "role": "CANONICAL" }, { "namespace": "GHSA", "value": "GHSA-aaaa-bbbb-cccc", "environment": "prod", "role": "CANONICAL" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "accept-withdrawn-with-timestamp", "note": "A withdrawal that says when.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "WITHDRAWN", "disputed": false, "wasWithdrawnOnce": true, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "withdrawnAt": "2026-02-01T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "accept-markdown-with-html-inside-a-fence", "note": "The fence exemption is load-bearing: an advisory about markup injection has to be able to SHOW the offending markup.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/markdown; variant=gfm", "value": "The parser mishandles `\n```\n\nSee [the advisory](https://example.com/a) or mail .", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "accept-backported-fix", "note": "A fix backported to an older maintenance branch. GHSA forbids a fixed version below the range and so cannot express this at all.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "affected": [ { "identity": { "packageName": "acme-parser", "ecosystem": "npm" }, "defaultStatus": "unknown", "ranges": [ { "introduced": { "version": "1.0.0", "inclusive": true }, "fixed": { "version": "1.4.7", "inclusive": false }, "status": "affected", "versionType": "semver" }, { "introduced": { "version": "2.0.0", "inclusive": true }, "fixed": { "version": "2.3.1", "inclusive": false }, "status": "affected", "versionType": "semver" } ] } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "accept-exclusive-lower-and-inclusive-upper-bound", "note": "> 1.0.0, <= 2.0.0. CVE 5 can express neither bound, so converters invent a version nobody released.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "affected": [ { "identity": { "repository": "https://github.com/acme/tool" }, "defaultStatus": "unaffected", "ranges": [ { "introduced": { "version": "1.0.0", "inclusive": false }, "fixed": { "version": "2.0.0", "inclusive": true }, "status": "affected" } ] } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "accept-affected-versions-unknown", "note": "Affected, but which versions is not established. Open as a CVE schema issue since 2023 and today written as prose or not at all.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "affected": [ { "identity": { "vendor": "acme", "product": "gateway" }, "defaultStatus": "unknown", "ranges": [ { "status": "affected-versions-unknown" } ] } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "refuse-published-without-owner-container", "note": "A record that is not a reservation and says nothing.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-001" ] } }, { "id": "refuse-disputed-without-reason", "note": "DISPUTED-forever starts with a flag nobody has to justify.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": true, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-002" ] } }, { "id": "refuse-withdrawn-without-timestamp", "note": "The timestamp is what the public trail renders.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "WITHDRAWN", "disputed": false, "wasWithdrawnOnce": true, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-003" ] } }, { "id": "refuse-two-primary-identifiers", "note": "COMPANION RULE: draft-07 has no maxContains, so a stock validator ACCEPTS this and the registry refuses it.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" }, { "namespace": "CVE", "value": "CVE-2026-0001", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-004" ] } }, { "id": "refuse-primary-that-is-not-the-records-own-id", "note": "COMPANION RULE: JSON Schema cannot compare an array item against a sibling scalar.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "CVE", "value": "CVE-2026-0001", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-005" ] } }, { "id": "refuse-two-canonical-in-one-namespace-and-environment", "note": "COMPANION RULE: 'which CVE is this' would have two answers. Note the accepted case above, where the second CVE is a DUPLICATE.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" }, { "namespace": "CVE", "value": "CVE-2026-0001", "environment": "prod", "role": "CANONICAL" }, { "namespace": "CVE", "value": "CVE-2026-0002", "environment": "prod", "role": "CANONICAL" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-006" ] } }, { "id": "refuse-namespace-with-no-citable-identifier", "note": "COMPANION RULE: a namespace holding nothing but history names no identifier at all.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" }, { "namespace": "CVE", "value": "CVE-2026-0001", "environment": "prod", "role": "SUPERSEDED" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-007" ] } }, { "id": "refuse-malformed-identifier", "note": "Outside the alphabet. Expressible as a pattern, so a stock validator catches it.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8!", "identifiers": [], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-008" ] } }, { "id": "refuse-identifier-using-a-crockford-confusable", "note": "O is not in the alphabet; it folds to 0 on normalisation and is not accepted verbatim.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXRO", "identifiers": [], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-008" ] } }, { "id": "refuse-gavlr-beyond-the-delegation-depth-cap", "note": "Depth 4 against a network maximum of 3. Bounding resolution cost is what stops a delegation chain being a denial of service.", "input": { "schemaVersion": "1.0", "id": "GAVLR-1-2-3-4-A7K2QX", "identifiers": [], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-008" ] } }, { "id": "refuse-gavlr-segment-too-large-to-represent", "note": "COMPANION RULE: a regex accepts a decimal run of any length. Parsed as a number this resolves to a DIFFERENT registry than the one written down.", "input": { "schemaVersion": "1.0", "id": "GAVLR-99999999999999999999-A7K2QX", "identifiers": [], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-009" ] } }, { "id": "refuse-description-list-with-no-primary", "note": "A reader that understands no listed language has no defined fallback.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser." } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-010" ] } }, { "id": "refuse-description-list-with-two-primaries", "note": "COMPANION RULE: `contains` gives the lower bound; the upper bound needs maxContains, which draft-07 does not have.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true }, { "lang": "de", "format": "text/plain", "value": "Ein Pufferueberlauf im Konfigurationsparser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-011" ] } }, { "id": "refuse-duplicate-language-tag", "note": "COMPANION RULE: uniqueItems compares whole items, so two entries differing only in value satisfy it while both claim to be the English text.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true }, { "lang": "en", "format": "text/plain", "value": "A second English text." } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-012" ] } }, { "id": "refuse-raw-html-in-markdown", "note": "COMPANION RULE: records are served by mirrors and node agents this project does not supervise, so 'our renderer sanitises' is a promise about one renderer.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/markdown; variant=gfm", "value": "The parser mishandles in a nested block.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-013" ] } }, { "id": "refuse-image-in-markdown", "note": "COMPANION RULE: a remote image loads when the record is READ, so it reports who is reading the advisory and when, including during an embargo.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/markdown; variant=gfm", "value": "The call graph:\n\n![call graph](https://example.com/graph.png)", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-013" ] } }, { "id": "refuse-relative-link-in-markdown", "note": "COMPANION RULE: a record has no single base URL, so the same signed bytes would resolve somewhere different on every host serving them.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/markdown; variant=gfm", "value": "See [the advisory](/advisories/12).", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-013" ] } }, { "id": "refuse-disallowed-link-scheme-in-markdown", "note": "COMPANION RULE: only https:, http: and mailto: are permitted.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/markdown; variant=gfm", "value": "See [the advisory](javascript:alert(1)).", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-013" ] } }, { "id": "refuse-product-with-no-identity", "note": "A vendor alone names no product. At least one of purl, cpes, repository, product or packageName.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "affected": [ { "identity": { "vendor": "acme" }, "defaultStatus": "affected", "ranges": [] } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-014" ] } }, { "id": "refuse-unaffected-range-with-no-reason", "note": "The OpenSSL 3.1.8 case: excluded because the branch was end of life, so the affected list silently encoded support policy.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "affected": [ { "identity": { "packageName": "acme-parser", "ecosystem": "npm" }, "defaultStatus": "affected", "ranges": [ { "introduced": { "version": "3.1.0", "inclusive": true }, "status": "unaffected" } ] } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-015" ] } }, { "id": "refuse-affected-versions-unknown-carrying-bounds", "note": "The status asserts the range is not established, so stating it contradicts the claim.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "affected": [ { "identity": { "packageName": "acme-parser", "ecosystem": "npm" }, "defaultStatus": "unknown", "ranges": [ { "introduced": { "version": "1.0.0", "inclusive": true }, "status": "affected-versions-unknown" } ] } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-016" ] } }, { "id": "refuse-qualitative-score-with-no-value", "note": "An unattributed or unstated score cannot be argued with.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "severity": [ { "scale": "QUALITATIVE", "author": { "kind": "AUTHORITY", "id": "acme" } } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-017" ] } }, { "id": "refuse-cvss-score-with-no-vector", "note": "A CVSS number without its vector cannot be rechecked by anybody.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "severity": [ { "scale": "CVSS_V3_1", "score": 7.5, "author": { "kind": "AUTHORITY", "id": "acme" } } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-018" ] } }, { "id": "refuse-epss-with-no-score", "note": "EPSS is a probability; the vector field means nothing for it.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "severity": [ { "scale": "EPSS", "author": { "kind": "AUTHORITY", "id": "acme" } } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-019" ] } }, { "id": "accept-two-conflicting-severities-with-a-precedence-rule", "note": "NVD and CNAs disagree on a third or more of dual-scored CVEs. Both scores are retained with their authors and the record states which wins, so a parser can act on the precedence instead of reading policy prose.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "severity": [ { "scale": "CVSS_V3_1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score": 9.8, "author": { "kind": "AUTHORITY", "id": "acme" } }, { "scale": "CVSS_V3_1", "vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N", "score": 2.5, "author": { "kind": "PUBLISHER", "id": "nvd" }, "rationale": "Local attack vector only; network reachability requires a non-default configuration." } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "severityPrecedence": { "preferredAuthor": { "kind": "AUTHORITY", "id": "acme" }, "order": [ "CVSS_V4_0", "CVSS_V3_1" ] }, "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "refuse-upgrade-remediation-with-no-version", "note": "'Upgrade' with no target is the advice a consumer cannot act on.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "remediations": [ { "kind": "upgrade" } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-020" ] } }, { "id": "refuse-patch-commit-remediation-with-no-commit", "note": "Only ~4.7% of CVE records carry any patch information; a commit field nobody filled in is how.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "remediations": [ { "kind": "patch-commit" } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-021" ] } }, { "id": "refuse-detection-artifact-with-neither-content-nor-url", "note": "A rule nobody can fetch or run.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "detection": [ { "kind": "semgrep", "intrusiveness": "passive" } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-022" ] } }, { "id": "accept-remediation-and-detection", "note": "What a consumer actually acts on.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "detection": [ { "kind": "version-probe", "url": "https://example.com/probe.yaml", "description": "Passive banner check.", "intrusiveness": "passive" } ], "remediations": [ { "kind": "upgrade", "fixedVersion": "2.3.1" } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "accept-peer-and-contributor-containers", "note": "Four parties on one record, each speaking for itself. A second accredited authority (peer) and an unaccredited researcher (contributor) sit beside the owner and a data publisher, all in one document, none of them editing anybody else's words. This is the whole point of the container model, and it is what a merged-narrative format cannot represent at all.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "AUTHORITY", "id": "gnea-partner" }, "role": "peer", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "We reproduced this against 2.3.0 and consider the parser reachable without authentication.", "primary": true } ], "peerStanding": { "basis": "independent-analysis" } }, { "author": { "kind": "USER", "id": "researcher-9", "displayName": "A. Researcher" }, "role": "contributor", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "Originally reported to the vendor on 2025-11-02.", "primary": true } ], "vouching": { "verificationBasis": "unverified" } }, { "author": { "kind": "PUBLISHER", "id": "GNDP-9" }, "role": "publisher", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "Enriched with downstream package mappings.", "primary": true } ], "enrichment": { "method": "manual-analysis" } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "refuse-user-container-claiming-root", "note": "COMPANION RULE. An individual with no accreditation, presenting as an accrediting body intervening on the record. Every public surface renders containers by ROLE, so this reads as a sanction by a GNTLR; rendering the AUTHOR accurately does not help, because the author is accurate and the role is the lie.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "id": "root-1", "author": { "kind": "USER", "id": "someone@example.com" }, "role": "root", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "intervention": { "basis": "unresponsive-owner", "accreditationPath": [ "gnr-eu", "acme" ] } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-023" ] } }, { "id": "refuse-publisher-container-claiming-owner", "note": "COMPANION RULE. A data publisher claiming to be the record's own authority. `owner` is a position in the accreditation graph and a GNDP does not hold one. Both rules fire, unavoidably: a PUBLISHER cannot claim the owner role without also failing to be the record's declared owner, since the owner is an accredited authority. The pair is the honest verdict rather than a case that stopped being minimal.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "PUBLISHER", "id": "gndp-partner" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-023", "GAVR-R-038" ] } }, { "id": "refuse-authority-container-claiming-contributor", "note": "COMPANION RULE. The mirror image, and the reason the table is total rather than a list of forbidden pairs: `contributor` is DEFINED as a party with no accreditation, so an accredited body claiming it is disclaiming its own accreditation on the record.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "contributor", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "vouching": { "verificationBasis": "unverified" } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-023" ] } }, { "id": "refuse-primary-description-addressed-to-a-restricted-audience", "note": "The primary entry is what a surface renders when it has room for one, so a record whose primary is internal has no headline text any public surface may show -- and every consumer then falls back to picking an array element, which is the guesswork the primary flag exists to remove.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "audience": "internal", "value": "What the reporter actually told us.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-024" ] } }, { "id": "accept-a-restricted-entry-beside-a-public-primary", "note": "The audience discriminator is only useful if a record can carry both, and the same language twice is the ordinary case: the uniqueness rule is keyed on language AND audience for exactly this.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "audience": "public", "value": "A stack overflow in the configuration parser.", "primary": true }, { "lang": "en", "format": "text/plain", "audience": "coordinating-parties", "value": "Reproduction steps are with the coordinator." } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "refuse-an-other-timeline-event-with-no-note", "note": "COMPANION-FREE. `other` exists because a CVE timeline entry is free text with no event type, so a closed set with no generic member could not import one at all. Without a note it records that something happened and refuses to say what, which is worse than the entry's absence.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "timeline": [ { "event": "other", "at": "2026-01-02T00:00:00Z" } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-025" ] } }, { "id": "accept-an-other-timeline-event-that-says-what-happened", "note": "The member earning its place: a real free-text source entry, carried without inferring an event from prose.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "timeline": [ { "event": "other", "at": "2026-01-02T00:00:00Z", "note": "The vendor's legal team was informed." } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "refuse-an-other-remediation-with-no-description", "note": "Every other remediation kind makes a SPECIFIC claim -- upgrade needs a version, patch-commit needs a commit -- which is the whole value of the set. `other` makes none, so a bare one says there is a remedy and refuses to say what.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "remediations": [ { "kind": "other" } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-026" ] } }, { "id": "accept-an-other-remediation-that-describes-itself", "note": "Where CVE's prose `solutions` field finally lands: previously it had no member to map onto and an importer had to drop the only remediation a record carried.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "remediations": [ { "kind": "other", "description": [ { "lang": "en", "format": "text/plain", "audience": "public", "value": "Rotate the affected credentials and re-enrol the device.", "primary": true } ] } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "accept-an-x-extension-on-a-container", "note": "A container is one party's own statement, so an unknown key inside one is that party saying something extra -- the only place where 'ignore what you do not understand' is a safe instruction. A consumer MUST preserve it verbatim when re-serialising, because the document is canonicalised and signed.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "x_acme_internal_ticket": "SEC-4412" } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "refuse-an-unknown-container-key-without-the-prefix", "note": "The prefix is what keeps the extension point from becoming a passthrough: without it a typo in a known field name is silently accepted as data rather than reported, which is the failure mode an open object has and a closed one does not.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "descriptons": [] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-027" ] } }, { "id": "accept-root-container-with-grounds", "note": "A root intervening properly: an accrediting body, its grounds, the chain proving it sits above the owner, and a stated appeal route. The accreditation path is what lets a mirror check the standing offline, which was the one part of an intervention that previously required a query to the registry.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "id": "root-1", "author": { "kind": "AUTHORITY", "id": "gnr-eu" }, "role": "root", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "intervention": { "basis": "factual-error", "accreditationPath": [ "gntlr-global", "gnr-eu", "acme" ], "restrictionId": "restriction-4417", "appealable": true, "appealDeadline": "2026-03-01T00:00:00Z", "ownerNotifiedAt": "2026-01-03T00:00:00Z", "expiresAt": "2026-06-01T00:00:00Z" } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "accept-root-intervention-carrying-a-correction", "note": "An accrediting body upholding a formal dispute: it states the grounds, the corrected severity, and which container's claims the correction replaces. Without this a root could sanction the owner for a factually wrong record and had no way to say what was right, while any accredited peer could, being unconstrained. `corrects` is what gives a consumer machine-readable precedence rather than leaving it to guess whether a root's score outranks the owner's.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1" }, { "author": { "kind": "AUTHORITY", "id": "gnr-eu" }, "role": "root", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "intervention": { "basis": "factual-error", "accreditationPath": [ "gntlr-global", "gnr-eu", "acme" ], "restrictionId": "restriction-4417", "appealable": true, "appealDeadline": "2026-03-01T00:00:00Z", "ownerNotifiedAt": "2026-01-03T00:00:00Z", "expiresAt": "2026-06-01T00:00:00Z", "corrects": [ "owner-1" ] }, "id": "root-1", "severity": [ { "scale": "CVSS_V3_1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "score": 7.5, "author": { "kind": "AUTHORITY", "id": "gnr-eu" } } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "refuse-intervention-on-a-non-root-container", "note": "A data publisher attaching a root's grounds block. It is not an accrediting body and has no standing to intervene, so the block is a claim it cannot make; without the gating it would render beside a real intervention as though it were one.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "id": "root-1", "author": { "kind": "PUBLISHER", "id": "cisa" }, "role": "publisher", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "intervention": { "basis": "unresponsive-owner", "accreditationPath": [ "gnr-eu", "acme" ] }, "enrichment": { "method": "manual-analysis" } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-028" ] } }, { "id": "accept-root-container-without-an-intervention", "note": "An accrediting body attaching a container that is not a sanction. Requiring the intervention block made the role near-mute: the only thing a root could say about a record was that it was acting against it. A root is a party, and intervening is something it sometimes does. What keeps this from being a governance tier making assessments is GAVR-R-034, which withholds every claim key from it.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "AUTHORITY", "id": "gnr-eu" }, "role": "root", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "accept-root-container-recording-a-review", "note": "An accrediting body recording that it examined a record in its subtree and found nothing wrong. While a root container had to be an intervention this had no expression at all, so the only way to report finding nothing wrong was to act as though something was. It reuses the reviewer's block rather than getting one of its own; the `root` role is what says in what capacity the reviewing party spoke.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "AUTHORITY", "id": "gnr-eu" }, "role": "root", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "review": { "verdict": "endorsed", "scope": [ "whole-record" ] } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "refuse-intervention-other-without-a-note", "note": "COMPANION-ADJACENT. A basis of 'other' with nothing beside it records that a root acted and refuses to say what the grounds were, which is worse than the field's absence because it looks like an answer. Same obligation an 'other' timeline event carries.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "id": "root-1", "author": { "kind": "AUTHORITY", "id": "gnr-eu" }, "role": "root", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "intervention": { "basis": "other", "accreditationPath": [ "gnr-eu", "acme" ] } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-030" ] } }, { "id": "refuse-unappealable-intervention-with-no-reason", "note": "A root switching off review by assertion. Immediate effect is defensible only because the decision behind it can be appealed, so an intervention that is not appealable has to say which door closed it: a deadline that has passed, or an appeal already decided.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "id": "root-1", "author": { "kind": "AUTHORITY", "id": "gnr-eu" }, "role": "root", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "intervention": { "basis": "safety", "accreditationPath": [ "gnr-eu", "acme" ], "appealable": false } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-031" ] } }, { "id": "refuse-intervention-with-no-container-id", "note": "A sanction nothing can point at. `id` is optional on a container and an appeal decision names its target with a required `appealedContainerId`, so an intervention carrying no id is one no reversal and no dismissal could ever be recorded against. Immediate effect is defensible only because the decision can afterwards be reviewed, so this closes that door silently -- which is the thing GAVR-R-031 already refuses to let `appealable: false` do.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "AUTHORITY", "id": "gnr-eu" }, "role": "root", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "intervention": { "basis": "scope-violation", "accreditationPath": [ "gnr-eu", "acme" ] } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-046" ] } }, { "id": "accept-peer-container-with-standing", "note": "A coordinating CSIRT contesting one specific claim rather than the whole record. `contests` points at a container id, not an array index, because indices move whenever anything before them is added. Without a standing this would be indistinguishable from an unrelated authority's container.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1" }, { "author": { "kind": "AUTHORITY", "id": "cert-bund" }, "role": "peer", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "peerStanding": { "basis": "coordinator", "ownerContactedAt": "2026-01-01T09:00:00Z" }, "coordination": { "status": "in-progress" }, "id": "peer-1", "contests": [ { "containerId": "owner-1", "path": "severity", "note": "we score this 9.8, not 5.3" } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "refuse-peer-container-without-standing", "note": "An accredited body contributing to somebody else's record without saying what it is to that record. Same rule as a root's missing grounds: a role-scoped block that defines a role is required on it, or the field solves nothing because most parties would omit it.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "AUTHORITY", "id": "cert-bund" }, "role": "peer", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-029" ] } }, { "id": "refuse-peer-standing-on-a-contributor", "note": "An unaccredited individual claiming a peer's standing. `peer` is an accredited position, so the block is a claim this party cannot make, and rendering the author accurately would not help: the author is accurate and the standing is the lie.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "USER", "id": "jo@example.com" }, "role": "contributor", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "peerStanding": { "basis": "coordinator" }, "vouching": { "verificationBasis": "unverified" } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-028" ] } }, { "id": "refuse-peer-standing-other-without-a-note", "note": "A standing of 'other' claims a relationship to the record and refuses to name it, which reads as an answer while carrying none. Same obligation an 'other' timeline event and an 'other' intervention basis both carry.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "AUTHORITY", "id": "cert-bund" }, "role": "peer", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "peerStanding": { "basis": "other" } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-032" ] } }, { "id": "refuse-coordination-on-a-registry-container", "note": "The registry stating how coordinated a disclosure was. It accepts and countersigns records; it is not a party to the coordination and has no vantage point on it. `coordination` is shared by the owner and a peer and by nobody else.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "REGISTRY", "id": "gr" }, "role": "registry", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "coordination": { "status": "coordinated" }, "appealDecision": { "appealId": "appeal-2026-11", "decidedAt": "2026-02-01T00:00:00Z", "appealedContainerId": "root-1", "disposition": "upheld" } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-028" ] } }, { "id": "accept-publisher-enrichment-with-method", "note": "A data publisher adding an assessment to a record it does not own, saying how it produced it and what the claim rests on. `method` is what lets a consumer weigh this against the owner's own assessment; without it a human decision and a model output render identically.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1" }, { "author": { "kind": "PUBLISHER", "id": "cisa" }, "role": "publisher", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "id": "peer-1", "enrichment": { "method": "manual-analysis", "derivedFrom": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "confidence": { "level": "high", "basis": "vendor-confirmed" } } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "refuse-publisher-container-without-enrichment", "note": "A GNDP adding claims and not saying how it reached them. Left optional the containers produced at the greatest scale would be precisely the ones that omit it, which is why the block is required rather than encouraged.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1" }, { "author": { "kind": "PUBLISHER", "id": "cisa" }, "role": "publisher", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "id": "peer-1" } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-029" ] } }, { "id": "refuse-enrichment-method-other-without-a-note", "note": "A method of 'other' defeats the only purpose the field has: a consumer still cannot weigh the claim, and now believes the question has been answered.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1" }, { "author": { "kind": "PUBLISHER", "id": "cisa" }, "role": "publisher", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "id": "peer-1", "enrichment": { "method": "other" } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-033" ] } }, { "id": "refuse-enrichment-on-an-owner-container", "note": "The record's own authority presenting its own account as third-party enrichment. `enrichment` describes what a party added to somebody else's record; on the owner it is a category error that would let a reader discount the owner's own words as derived.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1" }, { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "id": "peer-1", "enrichment": { "method": "automated" } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-028" ] } }, { "id": "refuse-contributor-container-without-vouching", "note": "A lone researcher's container with nothing saying what the vouching party checked. VOUCHED custody proves somebody vouched; it does not say on what grounds, and this is the container whose weight a reader can least judge from the author alone. `unverified` is a truthful value, so stating it is cheap.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1" }, { "author": { "kind": "USER", "id": "jo@example.com" }, "role": "contributor", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "id": "peer-1" } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-029" ] } }, { "id": "accept-registry-container-upholding-an-appeal", "note": "The registry undoing an intervention after upholding an appeal. It already composed and signed such a revision, with no structural way to say what it reversed or under which appeal -- so it read as the registry making a claim of its own about the vulnerability.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "REGISTRY", "id": "gr" }, "role": "registry", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "appealDecision": { "appealId": "appeal-2026-11", "decidedAt": "2026-02-01T00:00:00Z", "appealedContainerId": "root-1", "disposition": "upheld" } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "accept-registry-container-dismissing-an-appeal", "note": "The registry recording that an appeal against an intervention was heard and refused. This had no expression at all while the block was called `reversal` and could only mean upholding, so an intervention that was challenged and survived read exactly like one nobody had ever questioned. The intervention stays in force; what the container adds is that it was tested.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "REGISTRY", "id": "gr" }, "role": "registry", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "appealDecision": { "appealId": "appeal-2026-11", "decidedAt": "2026-02-01T00:00:00Z", "appealedContainerId": "root-1", "disposition": "dismissed" } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "accept-registry-container-without-an-appeal-decision", "note": "The registry attaching a container that is not a reversal. Accepting, countersigning, excising under an order and dismissing an appeal are all acts it performs; requiring the reversal block made every one of them invisible in the document.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "REGISTRY", "id": "gr" }, "role": "registry", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "refuse-registry-container-asserting-severity", "note": "The registry scoring a vulnerability. It accepts and countersigns records; it does not assess them, and a CVSS score in a registry container is a claim it has no standing for on the one surface a consumer is most likely to read as authoritative.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "REGISTRY", "id": "gr" }, "role": "registry", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "severity": [ { "scale": "CVSS_V3_1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "author": { "kind": "REGISTRY", "id": "gr" } } ], "appealDecision": { "appealId": "appeal-2026-11", "decidedAt": "2026-02-01T00:00:00Z", "appealedContainerId": "root-1", "disposition": "upheld" } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-034" ] } }, { "id": "refuse-root-container-asserting-severity", "note": "An accrediting body scoring the vulnerability on a container that is NOT an intervention. A root governs the record; it assesses only when it acts on one, with grounds and an appeal route. Filing a score in passing would make the governance tier a competing assessor under an attribution a consumer weighs heavily.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "AUTHORITY", "id": "gnr-eu" }, "role": "root", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "severity": [ { "scale": "CVSS_V3_1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "author": { "kind": "REGISTRY", "id": "gr" } } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-045" ] } }, { "id": "accept-owner-rejecting-a-peer-container", "note": "The veto the container model promises, as the OWNER'S own signed claim. The peer's container and its signature are untouched, so a reader sees both what was said and that the owner refuses it -- which is the whole disagreement, and is more than a status flag could carry. A status could not be written at all: `status` is inside the peer's signing pre-image.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1", "contests": [ { "containerId": "peer-1", "disposition": "rejected", "note": "we could not reproduce this and do not accept it" } ] }, { "author": { "kind": "AUTHORITY", "id": "cert-bund" }, "role": "peer", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "id": "peer-1", "peerStanding": { "basis": "independent-analysis" } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "refuse-a-peer-rejecting-a-container", "note": "A peer refusing somebody else's container. Rejection is the owner's veto; a peer asserting it would be claiming a power over a record it does not own, on a surface that renders the refusal as though it stuck. A peer disputes.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1" }, { "author": { "kind": "AUTHORITY", "id": "cert-bund" }, "role": "peer", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "peerStanding": { "basis": "coordinator", "ownerContactedAt": "2026-01-01T09:00:00Z" }, "coordination": { "status": "in-progress" }, "id": "peer-1", "contests": [ { "containerId": "owner-1", "disposition": "rejected" } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-035" ] } }, { "id": "accept-a-root-disputing-a-claim", "note": "An accrediting body recording that it disagrees with a specific claim, alongside the intervention that states its grounds. A root has standing over the record, so its disagreement is worth seeing; `dispute` leaves both statements standing, which is the point of the block.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1" }, { "author": { "kind": "AUTHORITY", "id": "gnr-eu" }, "role": "root", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "intervention": { "basis": "factual-error", "accreditationPath": [ "gntlr-global", "gnr-eu", "acme" ], "restrictionId": "restriction-4417", "appealable": true, "appealDeadline": "2026-03-01T00:00:00Z", "ownerNotifiedAt": "2026-01-03T00:00:00Z", "expiresAt": "2026-06-01T00:00:00Z" }, "id": "root-1", "contests": [ { "containerId": "owner-1", "disposition": "disputed", "note": "The affected range names a version that was never released." } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "refuse-a-root-rejecting-a-container", "note": "An accrediting body refusing the owner's own container. Rejection is the owner's veto and stays with the party accountable for the record. A root that wants a claim gone has `intervention`, which is attributed and appealable; a plain contest carries no accreditation path, so a mirror could not check that the rejecting party sits above the owner at all. A root disputes.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1" }, { "author": { "kind": "AUTHORITY", "id": "gnr-eu" }, "role": "root", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "intervention": { "basis": "factual-error", "accreditationPath": [ "gntlr-global", "gnr-eu", "acme" ], "restrictionId": "restriction-4417", "appealable": true, "appealDeadline": "2026-03-01T00:00:00Z", "ownerNotifiedAt": "2026-01-03T00:00:00Z", "expiresAt": "2026-06-01T00:00:00Z" }, "id": "root-1", "contests": [ { "containerId": "owner-1", "disposition": "rejected", "note": "The affected range names a version that was never released." } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-035" ] } }, { "id": "refuse-contests-on-a-publisher-container", "note": "A data publisher contesting a claim. It enriches records rather than adjudicating them; disagreement between parties is the owner's and a peer's to state, and a GNDP that thinks a claim is wrong publishes its own enrichment beside it.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1" }, { "author": { "kind": "PUBLISHER", "id": "cisa" }, "role": "publisher", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "id": "peer-1", "contests": [ { "containerId": "owner-1" } ], "enrichment": { "method": "automated" } } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-028" ] } }, { "id": "refuse-a-foreign-redaction-on-a-judgement-reason", "note": "A tombstone naming somebody else's container for a reason that is a judgement about what should have been said. Reaching into another party's signed words is defensible only where retention IS the harm; a party who thinks a statement was unwise has `contests`, which leaves both statements standing and attributable.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1" }, { "author": { "kind": "AUTHORITY", "id": "cert-bund" }, "role": "peer", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "peerStanding": { "basis": "coordinator", "ownerContactedAt": "2026-01-01T09:00:00Z" }, "coordination": { "status": "in-progress" }, "id": "peer-1" } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "redactions": [ { "path": "containers[0].descriptions[0].value", "reason": "operational-risk", "redactedBy": { "kind": "AUTHORITY", "id": "acme" }, "redactedAt": "2026-01-03T00:00:00Z", "containerId": "peer-1" } ], "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-036" ] } }, { "id": "accept-a-foreign-redaction-on-a-harm-now-reason", "note": "The same tombstone with a reason that does justify overriding the author. A live credential compounds by the minute, so the removal takes effect at once and is appealable.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1" }, { "author": { "kind": "AUTHORITY", "id": "cert-bund" }, "role": "peer", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "peerStanding": { "basis": "coordinator", "ownerContactedAt": "2026-01-01T09:00:00Z" }, "coordination": { "status": "in-progress" }, "id": "peer-1" } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "redactions": [ { "path": "containers[0].descriptions[0].value", "reason": "leaked-credential", "redactedBy": { "kind": "AUTHORITY", "id": "acme" }, "redactedAt": "2026-01-03T00:00:00Z", "containerId": "peer-1" } ], "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "accept-an-own-redaction-on-a-judgement-reason", "note": "The same judgement reason with no `containerId`: the redaction stayed inside the record's own fields, so nobody else's signature was broken and the narrower reason set does not apply. Proves the gate is keyed on the pointer rather than on the reason alone.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1" }, { "author": { "kind": "AUTHORITY", "id": "cert-bund" }, "role": "peer", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "peerStanding": { "basis": "coordinator", "ownerContactedAt": "2026-01-01T09:00:00Z" }, "coordination": { "status": "in-progress" }, "id": "peer-1" } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "redactions": [ { "path": "containers[0].descriptions[0].value", "reason": "operational-risk", "redactedBy": { "kind": "AUTHORITY", "id": "acme" }, "redactedAt": "2026-01-03T00:00:00Z" } ], "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "refuse-a-published-record-that-names-no-owner", "note": "Ownership was optional while the owner's words lived in their own field. With the owner one container among many, a record that declares no owner has nothing to check a container claiming \"owner\" against, and declaring ownership later would make the record permanently invalid with no path back.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1" }, { "author": { "kind": "AUTHORITY", "id": "cert-bund" }, "role": "peer", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "peerStanding": { "basis": "coordinator", "ownerContactedAt": "2026-01-01T09:00:00Z" }, "coordination": { "status": "in-progress" }, "id": "peer-1" } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z" }, "expect": { "valid": false, "rules": [ "GAVR-R-037" ] } }, { "id": "refuse-an-owner-container-somebody-else-authored", "note": "The cardinality the cna field used to give structurally. Several owner containers are permitted and all of them are the owner's words; one claiming the role for anybody else would put statements in the owner's mouth on every surface that renders by role.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "not-the-owner" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1" }, { "author": { "kind": "AUTHORITY", "id": "cert-bund" }, "role": "peer", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "peerStanding": { "basis": "coordinator", "ownerContactedAt": "2026-01-01T09:00:00Z" }, "coordination": { "status": "in-progress" }, "id": "peer-1" } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-038" ] } }, { "id": "accept-several-containers-from-the-one-owner", "note": "No cap, by decision: a party may attach as many containers as it likes and consumers read them all. All of these are the owner’s own words, which is coherent.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-1" }, { "author": { "kind": "AUTHORITY", "id": "cert-bund" }, "role": "peer", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "This record is disputed upstream and minting is suspended.", "primary": true } ], "peerStanding": { "basis": "coordinator", "ownerContactedAt": "2026-01-01T09:00:00Z" }, "coordination": { "status": "in-progress" }, "id": "peer-1" }, { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ], "id": "owner-2" } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "accept-a-reviewer-endorsement", "note": "A signed container carrying no claims IS the endorsement. That only became expressible once containers were individually signed; before, it was indistinguishable from a party with nothing to say.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "owner": { "kind": "AUTHORITY", "id": "acme" }, "createdAt": "2026-08-01T00:00:00.000Z", "updatedAt": "2026-08-16T00:00:00.000Z", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "AUTHORITY", "id": "cert-bund" }, "role": "reviewer", "review": { "verdict": "endorsed", "scope": [ "reproduction", "severity" ] } } ] }, "expect": { "valid": true } }, { "id": "refuse-a-review-that-withholds-its-reason", "note": "A reservation or a refusal that says nothing is unactionable: the reader learns a body disagrees and not on what, which is worse than silence because it carries the weight of a review.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "owner": { "kind": "AUTHORITY", "id": "acme" }, "createdAt": "2026-08-01T00:00:00.000Z", "updatedAt": "2026-08-16T00:00:00.000Z", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "AUTHORITY", "id": "cert-bund" }, "role": "reviewer", "review": { "verdict": "not-endorsed", "scope": [ "whole-record" ] } } ] }, "expect": { "valid": false, "rules": [ "GAVR-R-039" ] } }, { "id": "refuse-a-reviewer-carrying-its-own-severity", "note": "A reviewer endorses; it does not assess. A review carrying a score is a second opinion wearing an endorsement's clothes, and a consumer merging containers would read it as agreement with the owner.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "owner": { "kind": "AUTHORITY", "id": "acme" }, "createdAt": "2026-08-01T00:00:00.000Z", "updatedAt": "2026-08-16T00:00:00.000Z", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "AUTHORITY", "id": "cert-bund" }, "role": "reviewer", "review": { "verdict": "endorsed", "scope": [ "severity" ] }, "severity": [ { "scale": "CVSS_V3_1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "score": 7.5, "author": { "kind": "AUTHORITY", "id": "acme" } } ] } ] }, "expect": { "valid": false, "rules": [ "GAVR-R-034" ] } }, { "id": "accept-a-translation", "note": "It points at a container id rather than an index, so a translation cannot drift onto a different party's words when a container is added.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "owner": { "kind": "AUTHORITY", "id": "acme" }, "createdAt": "2026-08-01T00:00:00.000Z", "updatedAt": "2026-08-16T00:00:00.000Z", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "id": "t1", "author": { "kind": "TOOL", "id": "deepl" }, "role": "translator", "descriptions": [ { "lang": "de", "format": "text/plain", "value": "Ein Pufferueberlauf im Konfigurationsparser.", "primary": true } ], "translation": { "sourceContainerId": "owner-1", "sourceLang": "en", "targetLang": "de", "method": "machine-post-edited" } } ] }, "expect": { "valid": true } }, { "id": "refuse-a-translator-carrying-its-own-claims", "note": "A translator restates somebody else's words, so a claim of its own is a mistranslation presented as an assessment -- and the reader least able to catch it is the one who needed the translation.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "owner": { "kind": "AUTHORITY", "id": "acme" }, "createdAt": "2026-08-01T00:00:00.000Z", "updatedAt": "2026-08-16T00:00:00.000Z", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "TOOL", "id": "deepl" }, "role": "translator", "translation": { "sourceContainerId": "owner-1", "sourceLang": "en", "targetLang": "de", "method": "machine" }, "severity": [ { "scale": "CVSS_V3_1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "score": 7.5, "author": { "kind": "AUTHORITY", "id": "acme" } } ] } ] }, "expect": { "valid": false, "rules": [ "GAVR-R-034" ] } }, { "id": "accept-a-regulatory-act", "note": "A statutory act is not an assessment. The jurisdiction and the instrument are both required because either alone is unusable: an instrument with no jurisdiction cannot be located in any legal system, and a jurisdiction with no instrument is a claim of authority with nothing behind it.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "owner": { "kind": "AUTHORITY", "id": "acme" }, "createdAt": "2026-08-01T00:00:00.000Z", "updatedAt": "2026-08-16T00:00:00.000Z", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "REGULATOR", "id": "enisa" }, "role": "regulator", "regulatoryAction": { "jurisdiction": "EU", "instrument": "CRA Art. 14(1)", "reportReference": "ENISA-2026-00417", "deadline": "2026-08-18T00:00:00.000Z" } } ] }, "expect": { "valid": true } }, { "id": "refuse-a-regulator-carrying-claims", "note": "If one container could carry both a legal instrument and a score, a reader has no way to tell which half binds.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "owner": { "kind": "AUTHORITY", "id": "acme" }, "createdAt": "2026-08-01T00:00:00.000Z", "updatedAt": "2026-08-16T00:00:00.000Z", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "REGULATOR", "id": "enisa" }, "role": "regulator", "regulatoryAction": { "jurisdiction": "EU", "instrument": "CRA Art. 14(1)" }, "severity": [ { "scale": "CVSS_V3_1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "score": 7.5, "author": { "kind": "AUTHORITY", "id": "acme" } } ] } ] }, "expect": { "valid": false, "rules": [ "GAVR-R-034" ] } }, { "id": "refuse-a-translator-with-no-translation-block", "note": "A translation with no source pointer is untraceable to the words it claims to restate, which is the only thing that makes it checkable. The general form of GAVR-R-029.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "owner": { "kind": "AUTHORITY", "id": "acme" }, "createdAt": "2026-08-01T00:00:00.000Z", "updatedAt": "2026-08-16T00:00:00.000Z", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "TOOL", "id": "deepl" }, "role": "translator" } ] }, "expect": { "valid": false, "rules": [ "GAVR-R-029" ] } }, { "id": "accept-an-open-source-steward-standing", "note": "A steward and a vendor assert the same KIND of statement about software they ship, so this is what the standing enum is for. Not cosmetic: the CRA separates the two because the obligations differ.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "owner": { "kind": "AUTHORITY", "id": "acme" }, "createdAt": "2026-08-01T00:00:00.000Z", "updatedAt": "2026-08-16T00:00:00.000Z", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] }, { "author": { "kind": "AUTHORITY", "id": "some-foundation" }, "role": "peer", "peerStanding": { "basis": "open-source-steward" } } ] }, "expect": { "valid": true } }, { "id": "accept-ownership-transfer-retires-outgoing-container", "note": "The transfer names the container it retired, so the outgoing owner's words stay in the record BYTE-IDENTICAL and their signature keeps verifying. GAVR-R-038 skips it; the incoming owner's container is the live one. This is the shape every ownership transfer takes, and it needs no cooperation from the outgoing owner -- which is what makes a reassigned-by-root transfer implementable at all.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "id": "c1", "author": { "kind": "AUTHORITY", "id": "acme1" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "acme1's assessment.", "primary": true } ] }, { "id": "c2", "author": { "kind": "AUTHORITY", "id": "acme2" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "acme2's assessment.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme2" }, "ownershipHistory": [ { "from": { "kind": "AUTHORITY", "id": "acme1" }, "to": { "kind": "AUTHORITY", "id": "acme2" }, "at": "2026-01-02T00:00:00Z", "basis": "accepted", "retires": [ "c1" ] } ] }, "expect": { "valid": true } }, { "id": "refuse-transfer-that-retires-nothing", "note": "COMPANION RULE. Ownership moved and the outgoing owner's container was left claiming `owner`. Two live owner containers means a reader has to work out which of them is in force, which is exactly what `role: \"owner\"` exists to answer. The transfer must name what it retired.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "id": "c1", "author": { "kind": "AUTHORITY", "id": "acme1" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "acme1's assessment.", "primary": true } ] }, { "id": "c2", "author": { "kind": "AUTHORITY", "id": "acme2" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "acme2's assessment.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme2" }, "ownershipHistory": [ { "from": { "kind": "AUTHORITY", "id": "acme1" }, "to": { "kind": "AUTHORITY", "id": "acme2" }, "at": "2026-01-02T00:00:00Z", "basis": "accepted" } ] }, "expect": { "valid": false, "rules": [ "GAVR-R-038" ] } }, { "id": "refuse-retiring-a-container-the-record-does-not-carry", "note": "COMPANION RULE. `retires` exempts a container from GAVR-R-038, so an id listed before any container carries it is a standing permission to attach somebody else's container as an owner statement later. Requiring the target to exist means the exemption and the thing it exempts arrive together.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "id": "c2", "author": { "kind": "AUTHORITY", "id": "acme2" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "acme2's assessment.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme2" }, "ownershipHistory": [ { "from": { "kind": "AUTHORITY", "id": "acme1" }, "to": { "kind": "AUTHORITY", "id": "acme2" }, "at": "2026-01-02T00:00:00Z", "basis": "accepted", "retires": [ "c-does-not-exist" ] } ] }, "expect": { "valid": false, "rules": [ "GAVR-R-040" ] } }, { "id": "refuse-transfer-retiring-every-owner-container", "note": "COMPANION RULE. The incoming owner retired the outgoing owner's container and attached none of its own, so the record says nothing on behalf of the party now accountable for it. Separate from GAVR-R-001, which counts owner containers however they stand and which a stock validator can therefore still catch; this one depends on `ownershipHistory[].retires` and cannot be expressed in draft-07.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "id": "c1", "author": { "kind": "AUTHORITY", "id": "acme1" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "acme1's assessment.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme2" }, "ownershipHistory": [ { "from": { "kind": "AUTHORITY", "id": "acme1" }, "to": { "kind": "AUTHORITY", "id": "acme2" }, "at": "2026-01-02T00:00:00Z", "basis": "accepted", "retires": [ "c1" ] } ] }, "expect": { "valid": false, "rules": [ "GAVR-R-041" ] } }, { "id": "refuse-an-ownership-chain-that-ends-somewhere-else", "note": "COMPANION RULE. `ownershipHistory` decides which owner containers GAVR-R-038 checks, so a chain contradicting the declared owner is not a cosmetic inconsistency in the rendered provenance. Here the chain hands the record to acme3 while the record declares acme2.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "id": "c1", "author": { "kind": "AUTHORITY", "id": "acme2" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "the owner's assessment.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-06T00:00:00Z", "publishedAt": "2026-01-06T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme2" }, "ownershipHistory": [ { "from": { "kind": "AUTHORITY", "id": "acme1" }, "to": { "kind": "AUTHORITY", "id": "acme3" }, "at": "2026-01-02T00:00:00Z", "basis": "accepted" } ] }, "expect": { "valid": false, "rules": [ "GAVR-R-042" ] } }, { "id": "refuse-a-broken-ownership-chain", "note": "COMPANION RULE. The second entry takes over from acme9, but the first handed the record to acme2, so the chain records a handover nothing accounts for.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "id": "c1", "author": { "kind": "AUTHORITY", "id": "acme3" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "the owner's assessment.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-06T00:00:00Z", "publishedAt": "2026-01-06T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme3" }, "ownershipHistory": [ { "to": { "kind": "AUTHORITY", "id": "acme2" }, "at": "2026-01-02T00:00:00Z", "basis": "accepted" }, { "from": { "kind": "AUTHORITY", "id": "acme9" }, "to": { "kind": "AUTHORITY", "id": "acme3" }, "at": "2026-01-03T00:00:00Z", "basis": "accepted" } ] }, "expect": { "valid": false, "rules": [ "GAVR-R-043" ] } }, { "id": "refuse-an-ownership-entry-that-omits-from-mid-chain", "note": "COMPANION RULE. Only the genesis entry may omit `from`: there is nothing before it to be contiguous with. A later entry that omits it leaves the chain unjoined while looking well formed.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "id": "c1", "author": { "kind": "AUTHORITY", "id": "acme3" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "the owner's assessment.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-06T00:00:00Z", "publishedAt": "2026-01-06T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme3" }, "ownershipHistory": [ { "to": { "kind": "AUTHORITY", "id": "acme2" }, "at": "2026-01-02T00:00:00Z", "basis": "accepted" }, { "to": { "kind": "AUTHORITY", "id": "acme3" }, "at": "2026-01-03T00:00:00Z", "basis": "accepted" } ] }, "expect": { "valid": false, "rules": [ "GAVR-R-043" ] } }, { "id": "refuse-ownership-entries-out-of-order", "note": "COMPANION RULE. The chain is contiguous and correctly anchored, and still describes a history that could not have happened: the second transfer is dated before the first. Compared as instants rather than strings, since RFC 3339 permits an offset.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "id": "c1", "author": { "kind": "AUTHORITY", "id": "acme3" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "the owner's assessment.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-06T00:00:00Z", "publishedAt": "2026-01-06T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme3" }, "ownershipHistory": [ { "to": { "kind": "AUTHORITY", "id": "acme2" }, "at": "2026-01-05T00:00:00Z", "basis": "accepted" }, { "from": { "kind": "AUTHORITY", "id": "acme2" }, "to": { "kind": "AUTHORITY", "id": "acme3" }, "at": "2026-01-02T00:00:00Z", "basis": "accepted" } ] }, "expect": { "valid": false, "rules": [ "GAVR-R-044" ] } }, { "id": "accept-a-well-formed-ownership-chain", "note": "The other direction. A genesis entry with no `from`, two contiguous transfers after it, in order, ending at the declared owner. A root reassigning an abandoned record files this shape, with `basis: reassigned-by-root` on the entry it performed.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "id": "c1", "author": { "kind": "AUTHORITY", "id": "acme3" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "the owner's assessment.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-06T00:00:00Z", "publishedAt": "2026-01-06T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme3" }, "ownershipHistory": [ { "to": { "kind": "AUTHORITY", "id": "acme1" }, "at": "2026-01-01T00:00:00Z", "basis": "accepted" }, { "from": { "kind": "AUTHORITY", "id": "acme1" }, "to": { "kind": "AUTHORITY", "id": "acme2" }, "at": "2026-01-02T00:00:00Z", "basis": "accepted" }, { "from": { "kind": "AUTHORITY", "id": "acme2" }, "to": { "kind": "AUTHORITY", "id": "acme3" }, "at": "2026-01-03T00:00:00Z", "basis": "reassigned-by-root", "reason": "acme2 unresponsive for 180 days" } ] }, "expect": { "valid": true } }, { "id": "refuse-retiring-and-retaining-one-container", "note": "One container, one decision. `retires` says this statement is no longer current and `retains` says the incoming owner looked at it and deliberately left it standing; an entry claiming both is not a contradiction a reader can resolve. Refused rather than settled by precedence, because either precedence rule would silently discard half of what the party actually wrote.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "id": "c1", "author": { "kind": "AUTHORITY", "id": "acme1" }, "role": "owner", "descriptions": [ { "lang": "en", "value": "The outgoing owner's assessment.", "primary": true, "audience": "public", "format": "text/plain" } ], "status": "active" }, { "id": "c2", "author": { "kind": "AUTHORITY", "id": "acme2" }, "role": "owner", "descriptions": [ { "lang": "en", "value": "The incoming owner's assessment.", "primary": true, "audience": "public", "format": "text/plain" } ], "status": "active" } ], "owner": { "kind": "AUTHORITY", "id": "acme2" }, "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "ownershipHistory": [ { "to": { "kind": "AUTHORITY", "id": "acme1" }, "at": "2026-01-01T00:00:00Z", "basis": "accepted" }, { "from": { "kind": "AUTHORITY", "id": "acme1" }, "to": { "kind": "AUTHORITY", "id": "acme2" }, "at": "2026-01-02T00:00:00Z", "basis": "accepted", "retires": ["c1"], "retains": ["c1"] } ] }, "expect": { "valid": false, "rules": ["GAVR-R-049"] } }, { "id": "refuse-a-reassignment-that-states-no-grounds", "note": "A record taken from its owner without saying why. `reason` is optional in general, deliberately: a consensual handover is agreed between the two parties and its motive is theirs. A reassignment is the opposite case -- it happens over the outgoing owner's head, and neither the outgoing nor the incoming owner signed the revision that did it, so immediate effect is defensible only because the grounds are stated somewhere a reader can reach. The chain entry is the only place both actors can write: an `intervention` block is scoped to `role: \"root\"`, so a reassignment by the registry, whose containers are `registry`, could not state grounds that way at all.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "id": "c1", "author": { "kind": "AUTHORITY", "id": "acme2" }, "role": "owner", "descriptions": [ { "lang": "en", "value": "The owner's assessment.", "primary": true, "audience": "public", "format": "text/plain" } ], "status": "active" } ], "owner": { "kind": "AUTHORITY", "id": "acme2" }, "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-03T00:00:00Z", "ownershipHistory": [ { "to": { "kind": "AUTHORITY", "id": "acme1" }, "at": "2026-01-01T00:00:00Z", "basis": "accepted" }, { "from": { "kind": "AUTHORITY", "id": "acme1" }, "to": { "kind": "AUTHORITY", "id": "acme2" }, "at": "2026-01-02T00:00:00Z", "basis": "reassigned-by-registry" } ] }, "expect": { "valid": false, "rules": ["GAVR-R-048"] } }, { "id": "accept-a-promoted-provisional-identifier", "note": "The promotion case the GAVPR form exists for. The provisional id is SUPERSEDED and its namespace holds nothing citable, which GAVR-R-007 would refuse forever because a spent provisional id can never become citable again. Naming the successor is what makes promotion possible.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" }, { "namespace": "GAVPR", "value": "GAVPR-42-A7K2QX", "environment": "prod", "role": "SUPERSEDED", "supersededBy": "GAVR-A7K2QXR8" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": true } }, { "id": "refuse-a-successor-the-record-does-not-carry", "note": "A dangling supersededBy. Placed in a namespace that still holds a citable id so only GAVR-R-047 fires: the point is the unresolvable pointer, not the missing citable id.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" }, { "namespace": "CVE", "value": "CVE-2026-0001", "environment": "prod", "role": "CANONICAL" }, { "namespace": "CVE", "value": "CVE-2026-0002", "environment": "prod", "role": "SUPERSEDED", "supersededBy": "CVE-2026-9999" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-047" ] } }, { "id": "refuse-an-identifier-that-supersedes-itself", "note": "A cycle of one. It would otherwise satisfy the presence half of GAVR-R-047 while naming nothing.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" }, { "namespace": "CVE", "value": "CVE-2026-0001", "environment": "prod", "role": "CANONICAL" }, { "namespace": "CVE", "value": "CVE-2026-0002", "environment": "prod", "role": "SUPERSEDED", "supersededBy": "CVE-2026-0002" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-047" ] } }, { "id": "refuse-a-handover-to-a-successor-that-is-not-citable", "note": "The successor is present, so GAVR-R-047 is satisfied, but it is a DUPLICATE. A namespace may only hand its name over to an id somebody can actually quote, or a record could point its whole history at another historical entry and name nothing at all.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" }, { "namespace": "CVE", "value": "CVE-2026-0001", "environment": "prod", "role": "CANONICAL" }, { "namespace": "CVE", "value": "CVE-2026-0002", "environment": "prod", "role": "DUPLICATE" }, { "namespace": "GAVPR", "value": "GAVPR-42-A7K2QX", "environment": "prod", "role": "SUPERSEDED", "supersededBy": "CVE-2026-0002" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "containers": [ { "author": { "kind": "AUTHORITY", "id": "acme" }, "role": "owner", "descriptions": [ { "lang": "en", "format": "text/plain", "value": "A stack overflow in the configuration parser.", "primary": true } ] } ], "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-007" ] } }, { "id": "refuse-a-published-record-that-omits-containers-entirely", "note": "The absent key, not the empty array. `properties` is inert for a key that is not there, so the published schema accepted this while refusing `containers: []` -- a document a stock validator passed and the registry refuses, on a rule marked as expressed in the schema.", "input": { "schemaVersion": "1.0", "id": "GAVR-A7K2QXR8", "identifiers": [ { "namespace": "GAVR", "value": "GAVR-A7K2QXR8", "environment": "prod", "role": "PRIMARY" } ], "state": "PUBLISHED", "disputed": false, "wasWithdrawnOnce": false, "reviewState": "NONE", "createdAt": "2026-01-01T00:00:00Z", "updatedAt": "2026-01-02T00:00:00Z", "publishedAt": "2026-01-02T00:00:00Z", "owner": { "kind": "AUTHORITY", "id": "acme" } }, "expect": { "valid": false, "rules": [ "GAVR-R-001" ] } } ] }