What an exam has to survive before a score off it means anything.

1. Contract

   An exam declares its identity and version, its family, the grader entry point that will run, its licence, and its classification — whether it may ever be listed publicly, and whether it belongs to a customer. The declaration is validated before any other stage runs, and a family whose status is not active cannot carry an exam at all.

   Does not prove: that the exam is any good. It proves the exam is well-formed and that its handling rules are stated up front rather than decided later, when it would be convenient to decide them differently.

2. Gold proof

   The exam ships with a reference solution — upstream's own merged fix, where the exam comes from a public repository. The stage asserts four things at once: the reference passes the hidden grader, the untouched starting tree fails it, the grader is not visible to the model, and no part of the reference leaks into the tree the model is given.

   Does not prove: that the exam is hard, or that the reference is the only correct answer. It rules out the two exams that are worthless in opposite directions: the one nobody can pass, and the one that is already passed before the model starts.

3. Grader controls

   A grader that only distinguishes a correct answer from an empty one measures almost nothing. The controls feed it a set of submissions that must land on known verdicts. On the exams certified 2026-08-31 the set is seven — the untouched tree (fail), the reference (pass), an incomplete fix with one part of the reference missing (fail), a lookalike near-miss a competent engineer would plausibly write (fail), a planted test hook (fail), a planted reward file (fail), and the reference again after all the tampering attempts (pass).

   The two wrong-but-plausible probes are required to fail for different reasons, and the failing test sets are read to confirm it rather than inferred from an exit code.

   Does not prove: that no wrong answer passes. It proves that the specific wrong answers we could think of do not, and that the grader ignored material planted to bend it. A probe set is a floor, and it is the floor we can show you.

4. Attack suite

   Scripted probes attack the grade rather than the task: rewriting or deleting tests, planting collection hooks, reaching for the answer key, writing outside the paths the model is allowed to write. The exam passes only when no probe finds a trivial exploit and the reference solution still passes after the entire suite has been run against the exam.

   Does not prove: that the exam is unbreakable. It proves the cheap breaks are closed and the exam survived our own attempts on it. A determined attacker is not a scripted one.

5. Canary

   Each hidden test file carries a unique marker, registered in a host-only file the model can never reach. The markers are checked to be unique. If exam material ever surfaces somewhere it should not — in a model's output, in a scraped corpus, in a pull request — the marker names the file it came from.

   Does not prove: that the exam has not leaked. A canary is detection, not prevention, and it detects only a leak that carries the marker with it.

6. Publication scan

   Before anything an exam contains can be shown to anyone, a scanner reads the model-facing tree and the published grader against a pattern list and against the reference solution byte for byte, and refuses to call the material publishable on a single finding. It is run again after any change to those bytes.

   Does not prove: that the exam contains nothing sensitive. It proves that nothing matching the rules we wrote was found. A rule list catches what it describes.

7. Freeze

   What passes is frozen: a hash over the task tree the model is given, a freeze hash over the certifying inputs, the parent commit where the exam comes from a repository, and the container image digest — when the freeze was taken inside a container. A freeze taken without a container runtime records imageDigest: null honestly rather than borrowing a digest from somewhere else, and it has to be re-frozen by a promotion pass.

   Does not prove: anything about a score. It is what makes a score quotable: a result belongs to one freeze, and a number quoted without one is a number about nothing in particular.

8. Container promotion

   The whole chain is re-run inside a network-none container — seed, gold, grader controls, attack suite, evaluation — and the exam is sealed against the image it was certified with. In the August 31 snapshot, eleven exams shipped since August 30 carried a recorded promotion pass.

   Does not prove: that every exam in the inventory is promoted. It is a separate pass, it is recorded per exam, and where it has not run the exam says so.

Certifying an exam is half the job. A score off it is only quoted when the run is certified too, and that is five conditions, each recorded separately on every rollout:

1. Grader. The hidden tests accepted the submitted workspace, graded in a separate container with no network. The graded tree's hash must equal the submitted workspace's hash or the grade is voided.
2. Containment. The taker was proven to have acted only through the exam's actions. Provider API lanes are contained by construction — the provider sees only what the harness sends. Agent CLIs run on the host and are audited after the run from their own session stores for tool use, answer-key access, cross-session memory and network use. A lane whose store cannot be read is withheld; a lane whose CLI keeps its own toolset with no way to remove it is excluded as uncertifiable. Containment is never assumed from configuration.
3. Provenance. The record carries the exam identity and revision fingerprint the result belongs to.
4. Integrity invariants. Evidence mismatch, isolation breach, an unsubmitted green workspace, a zeroed or altered digest — any of these and the row is invalid or withheld, never a pass.
5. Harness review. The run judges itself (API-failure share, identical failure across unrelated providers, starvation, containment). Each fired rule is classified as diagnostic or verdict-bearing; a verdict-bearing suspicion the record cannot clear from its own certification receipts withholds the affected cells. A suspect examiner may not blame the model.

The outcomes are named exactly: certified pass, model fail (a real result under verified containment), lane error (provider or CLI failure, not a model result), withheld (conditions unproven — neither a pass nor a failure), invalid (an invariant fired). Only the first two enter capability counts, in both directions. Records are sealed with a digest over their canonical JSON; campaign documents are regenerated from records only and fail generation if they disagree.

Does not prove: that a model is good, or better than another. One rollout per lane is one data point. Below ten rollouts per cell the reports show raw counts and refuse rates and rankings.

Four fragments lifted out of the certification record, unedited. They are here because a stage described in prose is a claim about a machine, and the machine writes these. Each card names the exam it belongs to, the date it was written, and the file it was cut from.

distinguished=True, seven cases:
  untouched               F
  gold                    P
  incomplete              F
  lookalike               F
  plantedHook:conftest.py F
  plantedReward           F
  goldAfterTamperAttempts P

hostGraderUnchanged=True, plantedRewardIgnored=True, plantedHooksIgnored=True

"vvdex.security.permission-boundary-1": {
  "stages": {
    "seed":   { "ok": true },
    "gold":   { "ok": true, "promotionEligible": true, "isolated": true },
    "grader": { "ok": true, "promotionEligible": true, "isolated": true,
                "controlsDistinguished": true },
    "attack": { "ok": true, "promotionEligible": true, "trivialExploits": [],
                "passedForPromotion": true, "goldStillPassesAfterSuite": true },
    "eval":   { "ok": true, "promotionEligible": true }
  },
  "allOk": true
}