# PHC conformance plan

**Draft 0.1 · 14 October 2026 · All cases below: `not_run`**

This is a planned acceptance program for the [candidate specification](SPECIFICATION.md), not an executed harness or certificate. There are no PHC-qualified implementations established by this package. The existing 32 offline v0.4 fixtures check their existing parser contracts. Historical synthetic application, browser, PostgreSQL and container evidence has its own scope. It does not pass the new cases or the original 52 design/108 service cases, CP plan or PG plan.

## 1. Profiles to implement and test

Profiles compose; passing a smaller profile does not imply passing a larger one. Every claimed profile includes all applicable core authority, restriction, lifecycle and evidence requirements.

| Proposed profile | Scope | Required evidence beyond static shape |
|---|---|---|
| PHC Semantic Exchange | Export/import of selected records, provenance, rules and lifecycle | Independently implemented exporter/importer, exact mapping report and round-trip allow/deny equivalence |
| PHC Governed Service | Current read/contribution/review and persona behavior | Direct API tests against real policy/storage boundaries, including race and isolation probes |
| PHC Transport Binding | One exact MCP era or HTTPS binding | Credential/resource/continuation checks and equivalent decisions across claimed transports |
| PHC Managed Custody | Authorized service decryption and controlled processing routes | Runtime roles, key separation, encryption handling, egress and log inspection |
| PHC Sensitive Qualification | Policy-required exact release/runtime and current trust checks | Missing/mismatched/revoked evidence denial plus verified sender constraint where required |
| PHC Controlled Local | Local model/tools under an enforced boundary | Pinned runtime, secret isolation and observed denial of hosted fallback/egress |
| PHC Recovery | Restore/promotion without authority or content resurrection | Fault-injected fencing, lifecycle/safety reconciliation and old-generation rejection |
| PHC Confidential or Provider-Blind | Separate future custody profiles | Complete threat model and key/attestation/search/recovery evidence; neither follows from managed encryption |

An implementation may advertise a bounded subset, but cannot claim a feature whose required cases are absent or unsupported. A receiver that safely rejects an unknown restriction can pass that negative test while remaining unqualified to accept the restricted material.

## 2. Synthetic lab and evidence

Use invented Alex and Blair accounts, a distinct employer tenant, Learning and Work personas, two independent client registrations, an optional controlled local runner, a registered source and an explicitly forbidden destination. Include a confirmed reported learning goal, an unconfirmed inference, a stale observation, a disputed claim, a deleted record, a derived summary, an edge with a protected endpoint and an employer-controlled record. Seed unique forbidden-field canaries in each isolation boundary.

Implement a controlled clock where allowed, deterministic issuer/key fixtures, source resolver, identity mapper, versioned policy engine, query/disclosure recorder, lifecycle fault injector and egress sink. Test denial by direct calls that bypass model cooperation. Use a separate test database and disposable synthetic state. Keep production data and credentials out of the harness.

Each run manifest must identify repository commit and dirty state; implementation and adapter digests; exact format/schema/capability versions; test and fixture digests; identity issuer/client/resource configuration; policy and trust versions; dependency/runtime/OS/database versions; provider API/model/account/region where relevant; protocol era; custody mode; clock/fault settings; start/end times; expected and actual results; per-case evidence references; and pass/fail/blocked/not-run counts. Secret values and customer payloads are excluded. Signed results still require trusted execution/collection and an explicit reviewer assessment.

## 3. Planned case catalog

All rows are `not_run`. These scenarios require service-level evidence; local unit tests are reported separately.

| Case | Requirements | Setup and action | Required deterministic result and evidence |
|---|---|---|---|
| PHC-T01 Shape and bounds | R02 | Submit duplicate keys, invalid times, oversized/deep objects and ambiguous IDs | Reject before activation; bounded resource use, exact parser failures and no content publication |
| PHC-T02 Semantic round trip | R02–R05, R14–R15 | Export a goal with source, confirmation, dates and rule; import and re-export through independent code | Preserve meaning/restrictions or explicitly block; compare normalized meaning and decision matrix, not byte equality of local IDs |
| PHC-T03 Unknown mandatory rule | R07–R08 | Add a required unknown capability and attempt retry/downgrade | No disclosure or activation; no conversion to preference text; capture compatibility report |
| PHC-T04 Unsupported enforceable boundary | R07–R08 | Require local-only processing at a receiver with hosted inference | Reject activation/use despite valid syntax and consent; egress sink receives no payload |
| PHC-T05 Optional preference | R06, R08 | Receiver omits a supported-as-optional response-style preference | Omission reported; access decisions and mandatory semantics unchanged |
| PHC-T06 Identity ambiguity | R01, R09, R15 | Same email/display name with different issuer/subject; import competing mappings | No automatic merge or ownership transfer; quarantine and authorized mapping evidence |
| PHC-T07 Credential separation | R09–R10 | Present source token, ID token, wrong audience/issuer and another client's credential | Protected operation denied; no credential echo or token forwarding |
| PHC-T08 Recipient, expiry and replay | R02, R14–R16 | Wrong recipient key/binding, expired bundle and repeated accepted bundle | No duplicate activation; wrong/expired admission rejected; cryptographic and semantic outcomes recorded separately |
| PHC-T09 Persona laundering | R06–R07 | Associate employer record with Personal; copy/remove original persona | Employer/export restrictions persist and forbidden transfer denied |
| PHC-T10 Confirmation is not sharing | R04, R11 | Confirm an inferred proposal inside a topic already selected by a client | Inference/provenance retained; no new client read without reviewed applicable authority |
| PHC-T11 Independent operations | R01, R10–R11 | Reader proposes; contributor reads; external client confirms or exports | Each missing authority denied by service; allowed control operations still work |
| PHC-T12 Contribution replay and races | R11–R12 | Duplicate idempotency key, changed payload, stale proposal version and competing correction | One proposal on exact retry; changed/stale requests conflict; atomic canonical/outbox evidence |
| PHC-T13 Prompt/source attack | R03, R09, R11 | Proposal contains commands and an internal-network evidence/key URL | Text is data; no tool execution or arbitrary fetch; source stays attributed/unverified |
| PHC-T14 Graph isolation | R05 | Authorized edge with hidden endpoint, hidden edge with visible endpoints; request counts/traversal | No protected labels, existence, counts or unauthorized traversal in structured/text/error output |
| PHC-T15 Derivation intersection | R05, R07 | Build summary from incompatible purpose/route restrictions; omit a dependency version | Ineligible derivative; no stripping restrictions or treating unknown lineage as public |
| PHC-T16 Correction/deletion race | R05, R10, R12 | Change/delete parent after retrieval starts and before output publishes | No newly disclosed stale derivative; expected version and publication-boundary evidence |
| PHC-T17 Revocation/current-state outage | R10 | Revoke grant during stream/job; interrupt current-state dependency | No publication beyond declared tested bound; expired lease fails closed; measured timestamps |
| PHC-T18 Quarantine isolation | R15 | Import confirmed record with unresolved classification/source identity | No general search/summary/graph/count exposure; only authorized review preview; no inherited grant |
| PHC-T19 Credential/grant export | R02, R14–R15 | Seed secrets in internal credential stores and old grants in local authority state | Allowlisted export contains neither; deliberately prohibited structured import rejected; limits of prose-secret detection reported |
| PHC-T20 Partial import closure | R08, R15 | Unsupported rule on one parent of an otherwise supported summary | Default atomic rejection; any claimed partial mode rejects the dependent component and reports omissions |
| PHC-T21 Lifecycle rollback | R12–R13 | Apply older snapshot, missing safety interval, mismatched checkpoint namespace | No resurrection; affected state closed; scoped sequence and gap evidence |
| PHC-T22 Notices | R13, R18 | Duplicate/forged/wrong-recipient deletion notice; delivery acknowledgment only | Correct deduplication and denial; delivery never displayed as verified deletion completion |
| PHC-T23 Crypto vectors | R16, R19 | Cross-language canonicalization/sign/encrypt plus tamper, wrong key, algorithm confusion and critical-parameter failures | Exact accepted bytes/algorithms and expected failures; no unsafe fallback; vetted library versions recorded |
| PHC-T24 Transport parity | R10, R17–R18 | Same permitted/forbidden request via each claimed MCP era and HTTPS; stale continuation | Equivalent policy decisions; fallback text leaks nothing; continuation bound to original authority |
| PHC-T25 Qualification changes | R20 | Valid qualification without grant; changed release/model/method; stale/revoked issuer | Denial where any required condition fails; self-declared digest cannot replace required runtime proof |
| PHC-T26 Custody claim | R16 | Inspect searchable vectors, runtime plaintext/key paths and inference egress | Claim matches actual trust boundary; managed search cannot pass provider-blind profile |
| PHC-T27 Recovery partition | R13 | Lose primary connectivity with uncertain fencing and unacknowledged safety events | Recovery serves no affected context; promotion only after proven barriers; old-generation credentials rejected |
| PHC-T28 Metadata and receipts | R08, R18 | Unauthenticated discovery and cross-client receipt lookup | Only nonpersonal capabilities public; no hidden object existence or unrelated client activity |
| PHC-T29 Legacy compatibility | R19 | Exercise an existing format parser with its original fixtures and new PHC-only objects | Original outcomes preserved; incompatible PHC objects rejected; loss map explicit |
| PHC-T30 Human understanding | R04, R06, R13 | Observe synthetic review/share/expiry/persona tasks in web and later native UI | Record comprehension errors and task outcomes; no claim of accessibility or production service enforcement from this study |

## 4. Acceptance rules

Every required deterministic case must pass for the exact claimed profile. A protected canary disclosure, wrong-subject operation, silent confirmation/sharing, unauthorized fallback or resurrection of revoked/deleted state blocks qualification. A missing test harness is `not_run`; unavailable mandatory capability is `blocked`; an executed mismatch is `failed`. None is counted as passed or removed from the denominator.

Generative extraction and usefulness studies require separately stated prompts, models, repetitions, samples, scoring criteria and denominators. They do not replace deterministic access tests. A successful result for one API route or model does not establish support in its consumer application. Report synthetic lab, live-provider synthetic, native/accessibility and production assurance separately.

At least two endpoints with genuinely independent implementation of import/export semantics must exercise the interchange profile. Independence and any shared libraries must be disclosed. An exporter and importer using the same serializer, or two adapters over one service, can supply useful development evidence but do not satisfy the independent interoperability gate. Independent technical/security review is a separate gate from implementer self-review.

## 5. First executable slice

After semantic/version review, implement schemas and fixtures for PHC-T01–T06, T08, T18–T20 and T29; use deterministic synthetic identity/policy fixtures and make their limits explicit. Then connect real governed service boundaries for authorization/lifecycle tests, followed by crypto and exact transport qualification. Recovery, stronger custody and DCER profiles follow their own prerequisites. All service integrations must preserve the same authority and confidentiality requirements.