FPF Reference

    C.3.A:Annex B - Assurance lanes and evidence design [A/I]

    Preface node heading:c-3-a-annex-b-assurance-lanes-and-evidence-design-a-i:45689

    What this page is

    This is generated FPF reference text from the specification preface or supporting sections. It helps interpret FPF; it is not FPF Reference product documentation.

    Methodology

    Use it to understand how the specification wants to be read, then return to a route, pattern, or work packet for active work. Cite generated IDs only when the wording changes the task decision.

    Content

    C.3.A:B.1 What typed assurance adds [I]

    VA can prove a claim quantified over an exact declared kind; LA can exercise exact candidates and boundary cases under pinned editions and slices; TA can qualify the tools used to produce support. None of those lanes turns evidence existence into classification truth.

    C.3.A:B.2 Normative obligations

    EA-1 (Declaration and candidate binding). Every VA/LA artifact SHALL cite the governed claim, exact quantified kind and signature edition, and assumed Scope. Candidate-specific evidence SHALL additionally name each exact candidate and its four-input judgment.

    EA-2 (Subkind coverage). A claim over kind k SHALL justify coverage over relevant obtaining subkind relations and paired signature editions. RoleMask rows may cover named procedural uses but SHALL NOT silently stand in for a stable subkind.

    EA-3 (Three values in evidence use). A test, observation, or proof may support a classification assertion. An unavailable evidence dependency yields unknown; failed evidence retrieval MUST NOT be recorded as candidate false.

    EA-4 (Independent unions). SpanUnion SHALL include a support-line independence account and preserve per-line candidate judgments and bridge consequences.

    EA-5 (Bridges). Cross-context evidence use SHALL recover Scope Bridge separately from KindBridge relation/assertion, use the independently authored target declaration, and evaluate target candidates afresh. Consequences affect R only.

    EA-6 (Freshness). Evidence windows and tool/declaration editions SHALL be explicit and tied to the governed slice. Expiry causes refusal or unknown at the predicate it disables; it does not widen Scope.

    EA-7 (TA separation). Tool qualification SHALL remain distinct from content proof, candidate facts, classification judgment, and receiving disposition.

    EA-8 (No scope-by-wording). More general wording, more matching candidates, or additional evidence-matrix rows SHALL NOT widen G. A ΔG+ change requires the new support or sufficiently congruent bridge basis required by A.2.6; otherwise retain or narrow the declared Scope.

    C.3.A:B.3 Evidence matrix [I]

    RowsColumnsCell content
    exact kind/subkind signature editions or RoleMask declaration editionsexact context slices with versions and Gamma_timeexact candidate(s) when current, judgment values, evidence units and support relations, freshness, bridge/assertion references, and receiving use

    Rows plan declared distinctions; they do not classify every candidate. A proof-only row may remain declaration-level when it genuinely proves a universal claim. A test or monitoring row becomes candidate-bearing and records exact judgments for the exercised candidates.

    C.3.A:B.4 VA lane [A/I]

    • VA-1. A proof carrier SHALL cite the exact claim, quantified kind, KindSignature edition, and assumed scope slices.
    • VA-2. A proof of a universal claim need not invent a candidate; application to an actual candidate uses Guard_CandidateUse separately.
    • VA-3. Cross-context proof reliance SHALL recover both bridge channels, the target declaration, loss, and R consequences.
    • VA-4. Tool-kernel qualification belongs to TA and does not raise the declaration's F or candidate truth.

    Example: a proof over PassengerCarSignature@v4 assumes a dry-road slice. Reuse at Plant-B requires bridge/scope settlement. Application to VIN-17 then uses the Plant-B target signature and exact target judgment.

    C.3.A:B.5 LA lane [A/I]

    • LA-1. Each test or monitoring campaign SHALL state row declaration editions, slice columns, exact tested candidates, and their judgments.
    • LA-2. Boundary probing SHALL distinguish criterion boundaries from Scope boundaries.
    • LA-3. A KindBridge assertion that records collapsed distinctions SHALL lead to explicit coverage repair; it does not alter target truth.
    • LA-4. Freshness and SpanUnion independence SHALL remain explicit.

    Example: rows PassengerCar and LightTruck use pinned signature editions; columns cover dry/wet slices. The tested VINs are exact candidates. A missing sensor dependency for one VIN yields unknown, not a negative vehicle classification.

    C.3.A:B.6 TA lane [A/I]

    Qualify provers, checkers, measurement pipelines, and classifiers separately. A classifier output can support an assertion about J; the tool neither becomes the candidate nor makes the governed criterion hold. Version drift may make the support unavailable and hence produce unknown for a candidate-bearing use.

    • TA-1. Every tool whose qualification is relied on by VA or LA SHALL identify its exact version and qualification status, and the receiving guard SHALL recover that declaration when the reliance is current.
    • TA-2. Missing or weaker tool qualification MUST NOT be hidden by lowering the owning episteme's F or widening G. The receiving policy may require additional independent support, reduce or condition R, or refuse the use while preserving the exact unavailable-support reason.

    C.3.A:B.7 Evidence guards

    Guard_EvidencePlan_Typed SHALL check exact row declaration editions, exact slice columns, bridge/assertion needs, candidate-selection policy, freshness, independence, and TA declarations. Planning rows do not count as candidate judgments.

    Guard_EvidenceAttach_Typed SHALL bind every evidence unit to its exact claim/use, row declaration, slice, exact candidate when current, judgment value, support relation, freshness, and bridge consequences. It SHALL preserve unknown and the separate attach/refuse disposition.

    C.3.A:B.8 Anti-patterns and remedies

    Anti-patternRemedy
    one golden case stands for a kindstate the declaration-level claim and plan explicit subkind/boundary coverage
    a matrix row is treated as classificationname exact candidates and judgments in candidate-bearing cells
    “latest data”pin freshness and time policy
    trusted tool substitutes for content supportkeep TA separate and recover the governed candidate facts/support
    bridge presence substitutes for target evaluationuse the independent target declaration and fresh target judgment

    C.3.A:B.9 End-to-end example [I]

    A two-plant braking claim pins the PassengerCar declaration and Plant-A scope. VA proves the quantified claim over that declaration. LA tests exact VINs in dry/wet slices and records their judgments. TA identifies tool versions. Plant-B reuse recovers both bridges, the target declaration, loss and R consequences; each Plant-B candidate is evaluated afresh before evidence is attached.

    Last Updated: 2026-07-28 — upstream FPF commit 17edd955 (github.com/ailev/FPF)