# Run and rejudge

A conformance run here is designed to be **checked, not believed**. The
run writes an evidence bundle — a hash tree over the complete HTTP
transcripts of every check — and anyone holding the bundle can replay the
judging offline and get the same verdicts, or catch a tampered file. Trust
travels as bytes, not as a PDF.

**A run from this tool is advisory. It is unsigned, carries no attestation
weight, and can never back a ConformanceAttestation.** Attestation
requires an Ed25519-signed run executed by a signing conformance service;
this tool never signs. Never present an advisory run as certification or
as anyone's endorsement.

## The loop

1. **Run.** `conformance run --self` judges the built-in hermetic
   reference implementation — deterministic, loopback; it proves the
   suite itself. `conformance run --target d.json` judges the EPCIS 2.0
   endpoint your descriptor names — your dev build, a vendor's sandbox.
2. **Keep the bundle.** `--out run.json` writes the evidence bundle. Auth
   headers are redacted at record time, so a run file is data you may
   share. Never edit one — the hash tree is the tamper seal.
3. **Counterparty rejudges.** `conformance rejudge run.json` needs no
   network and no access to the original target: it verifies the hash
   tree, replays all 18 checks from the recorded transcripts, and prints
   `rejudge identical` — or fails with the flips named.

## Proof — the full loop, executed

Against the published `epcis.dev@0.1.0`:

```
$ npx epcis.dev conformance run --self --out run.json
advisory	ADVISORY — this run was produced locally and is unsigned.
	It carries no attestation weight and can never back a
	ConformanceAttestation. Attestation requires an Ed25519-signed
	run executed by a signing conformance service; this tool never
	signs.
run	advisory-bc1c86ed-2d6f-415e-bae0-f642ed96f990	suite=0.4.0
	target=epcis.dev reference implementation
pass	TCR-43.1
…
pass	TCR-54
pass	M121
pass	M122
state	passed	passed=18	failed=0	total=18
wrote	run.json

$ npx epcis.dev conformance rejudge run.json
signature	none	advisory run — carries no attestation weight
pass	TCR-43.1
pass	TCR-43.2
pass	TCR-43.3
pass	TCR-43.4
pass	TCR-53.1
pass	TCR-53.2
pass	TCR-53.3
pass	TCR-53.4
pass	TCR-53.5
pass	TCR-53.6
pass	TCR-53.7
pass	TCR-53.8
pass	TCR-53.9
pass	TCR-53.10
pass	TCR-53.11
pass	TCR-54
pass	M121
pass	M122
rejudge	identical
$ echo $?
0
```

(The `advisory` and `run` lines are single TSV lines on the wire; wrapped
here for the page. The run transcript's 18 pass lines are elided once —
the rejudge block shows all 18 replayed.) A rejudge mismatch — a flipped
verdict, a missing check, a broken hash tree — exits `1` with the
differences named, which is exactly the property that lets you accept a
vendor's run file at face value: if it rejudges `identical`, the
transcripts really produced those verdicts.

Machine mode mirrors the same facts: `--json` returns
`{ signature, replayed, identical, missingChecks, flips, ok }` — branch
on `identical`, never on prose. The check taxonomy and pinned artifacts
behind every verdict are on
[Reference — Conformance & pins](/docs/reference/conformance-pins/).

---

**Proof, not adjectives.** This build could not verify the gateway's test suite green, so no sentence on this page claims a passing run — the last verified run is recorded in the repository's own CI, not here. Live on this origin, no key: POST /translate, /validate, /hash. No conformance attestation has ever been issued. The dated ledger is /what-ships-today/.