Run and rejudge

A conformance run here is designed to be checked, not believed. The run writes an evidence bundle — a hash tree over the complete HTTP transcripts of every check — and anyone holding the bundle can replay the judging offline and get the same verdicts, or catch a tampered file. Trust travels as bytes, not as a PDF.

A run from this tool is advisory. It is unsigned, carries no attestation weight, and can never back a ConformanceAttestation. Attestation requires an Ed25519-signed run executed by a signing conformance service; this tool never signs. Never present an advisory run as certification or as anyone's endorsement.

The loop

1. Run. conformance run --self judges the built-in hermetic reference implementation — deterministic, loopback; it proves the suite itself. conformance run --target d.json judges the EPCIS 2.0 endpoint your descriptor names — your dev build, a vendor's sandbox.
2. Keep the bundle. --out run.json writes the evidence bundle. Auth headers are redacted at record time, so a run file is data you may share. Never edit one — the hash tree is the tamper seal.
3. Counterparty rejudges. conformance rejudge run.json needs no network and no access to the original target: it verifies the hash tree, replays all 18 checks from the recorded transcripts, and prints rejudge identical — or fails with the flips named.

Proof — the full loop, executed

Against the published epcis.dev@0.1.0:

$ npx epcis.dev conformance run --self --out run.json
advisory	ADVISORY — this run was produced locally and is unsigned.
	It carries no attestation weight and can never back a
	ConformanceAttestation. Attestation requires an Ed25519-signed
	run executed by a signing conformance service; this tool never
	signs.
run	advisory-bc1c86ed-2d6f-415e-bae0-f642ed96f990	suite=0.4.0
	target=epcis.dev reference implementation
pass	TCR-43.1
…
pass	TCR-54
pass	M121
pass	M122
state	passed	passed=18	failed=0	total=18
wrote	run.json

$ npx epcis.dev conformance rejudge run.json
signature	none	advisory run — carries no attestation weight
pass	TCR-43.1
pass	TCR-43.2
pass	TCR-43.3
pass	TCR-43.4
pass	TCR-53.1
pass	TCR-53.2
pass	TCR-53.3
pass	TCR-53.4
pass	TCR-53.5
pass	TCR-53.6
pass	TCR-53.7
pass	TCR-53.8
pass	TCR-53.9
pass	TCR-53.10
pass	TCR-53.11
pass	TCR-54
pass	M121
pass	M122
rejudge	identical
$ echo $?
0

(The advisory and run lines are single TSV lines on the wire; wrapped here for the page. The run transcript's 18 pass lines are elided once — the rejudge block shows all 18 replayed.) A rejudge mismatch — a flipped verdict, a missing check, a broken hash tree — exits 1 with the differences named, which is exactly the property that lets you accept a vendor's run file at face value: if it rejudges identical, the transcripts really produced those verdicts.

Machine mode mirrors the same facts: --json returns { signature, replayed, identical, missingChecks, flips, ok } — branch on identical, never on prose. The check taxonomy and pinned artefacts behind every verdict are on Reference — Conformance & pins.