Conformance and release gates
This is the planned product test matrix. The repository's current documentation checks do not implement these runtime tests.
| Area | Required cases |
|---|---|
| Artifact integrity | Valid signature, altered payload, wrong key, unsupported algorithm, duplicate fields |
| Context binding | Wrong operation, policy, network, token, recipient, amount, or caller |
| Replay and time | Reused operation, stale evidence, expired permission, ambiguous clock |
| Chain evidence | Failed transaction, reorganization, insufficient finality, inconsistent sources |
| DMT | Supported fields, unsupported fields, regex parity, activation/version mismatch, invalid reference |
| Selection | Changed candidate set, reroll, late input, duplicate item, biased mapping, source fallback |
| Availability | Missing evidence, timeouts, corrupt response, indexer behind requested height |
| Fetching | Private-address SSRF, redirect escape, large payload, nested data, malicious tool text |
| Privacy | Redaction, retention, no raw secret leakage in reports or logs |
| Consumer behavior | Valid artifact with FAIL; PASS rejected by local policy; INDETERMINATE never auto-accepted |
Reproducibility
Publish supported profile versions and positive/negative fixtures. A second implementation or independent process should reproduce both successful findings and appropriate rejection. Record the exact inputs and implementation version used for benchmarks.
Release gate
A product release needs tested behavior, dependency review, a security contact, explicit scope, accurate docs, and operator-controlled pilot evidence. High-risk features need independent security review before economic use. A green documentation CI badge does not mean the verifier is secure.
For hosted services, test downtime, duplicate charging, recovery, queue limits, source outages, and reorg invalidation. For installers, test pinned release integrity and no unexpected wallet or credential access.
<!-- p21-source-payment-v08 -->
Additional source and payment conformance cases
Test duplicate names and duplicate field/pattern signatures, unsupported fields or regex semantics, incorrect inscription content, mismatched source hashes, incomplete registry history, wrong network and source reorganization. Test nonce-only/known-source claims, post-source commitments, changed ordering or weights, request-ID/context grinding, retries and withheld outcomes.
For native NAT, test the wrong deployment/ticker/network/recipient, a UNAT-only transfer, a created but unexecuted transfer inscription, partial/late/overpayment, stale or lagging observations, conflicting indexes, insufficient confirmations, duplicate event crediting, concurrent reservations, caller mismatch, refund replay and reorganization after credit use. Exercise the same request independently through the USDC rail. A synthetic policy test is not a real-funds settlement test.
[1] https://digital-matter-theory.gitbook.io/digital-matter-theory/introduction/digital-elements/.element-registry
[2] https://github.com/Trac-Systems/ord-tap/blob/b8f6ea35cf6b9d405d4db7c58555e3c8ab33e8cd/src/index/updater/inscription_updater/tap/ops/dmt_element.rs
[3] https://digital-matter-theory.gitbook.io/digital-matter-theory/introduction/nat-use-cases/usdnat-method-1-live
[4] https://digital-matter-theory.gitbook.io/digital-matter-theory/introduction/non-arbitrary-tokens-nats/nat-token-transfer
[5] https://docs.x402.org/core-concepts/network-and-token-support
[6] https://github.com/Trac-Systems/ord-tap/blob/b8f6ea35cf6b9d405d4db7c58555e3c8ab33e8cd/README.md
[7] https://arxiv.org/abs/1605.04559
<!-- p21-enforcement-v10 -->
Enforcement and counterparty-accountability cases
Before adversarial production use, add fixtures for: authorization action-digest substitution; wrong request/policy/network/asset/recipient/amount; expired authorization; reused nonce; state becoming stale between evaluation and signing; an agent attempting an alternate signing path; consumer-policy changes after commitment; signed REJECT after deterministic PASS; private-policy inputs that must yield UNRESOLVED; two incompatible valid consumer decisions; settlement remaining confirmed despite rejection; and threshold signer refusal after a P21 FAIL.
For TAP enforcement, test 2-of-2 authority+policy signing, missing/invalid policy signature, threshold replay/expiry/nonce behavior, lock/HTLC/escrow refund paths and activation/version mismatches. These are conformance requirements, not claims that the current repository already implements a production signer.