PPA certification framework: levels, assessment matrix and identity assurance

[coodos]

Description of change

Implements the PPA certification framework: six levels (L0–L5) scored from sixteen independently recorded assurance dimensions, plus identity assurance per accountable actor.

The level is calculated, not picked. The reviewer works through the matrix in a drawer; the level is the geometric mean of the per-dimension levels, capped by the identity floor (L0 needs IAL2, L1–L2 IAL3, L3–L5 IAL4). The calculation is shown with the weakest dimension named. A reviewer may still award something else, but that is behind a disclosure and requires a written justification, and both the computed and awarded level are signed into the certificate.

Nine of the sixteen rows answer themselves from evidence already verified — the release proof, the repository, attested deployments, and signed eReputation references. Identity assurance is derived from binding documents: an id_document gives IAL3, three attestations from passport-verified people give IAL4, and the weakest actor caps the release.

Findings are published as a new PlatformAssessment record in the reviewed platform's eVault alongside the certificate, so a later reader can inspect the evidence rather than trusting the headline level — which is what the framework asks for.

Also publishes Certification Level and Identity Assurance Level as ontology schemas, following the Domain precedent.

Issue Number

n/a

Type of change

New

How the change has been tested

• pnpm --filter ppa test — 20 passed. Covers the scoring rules (a weak row drags but does not pin; a single L0 row does not collapse the score; the identity floor caps independently; an unanswered dimension blocks) and identity derivation (each IAL tier, one-level-deep attester resolution, a mutual attestation terminating, an unreadable vault staying IAL1).
• Derivation checked against live data: the congo-basin author resolves to IAL3 from a real id_document, which correctly caps that release at L2.
• eReputation queried live at ereputation.w3ds.metastate.foundation; reference counts feed the three reputation rows.
• Override guard exercised by posting a grant above the calculated level with no justification, which is refused.
• pnpm --filter ppa check and build pass; the ontology service boots and serves all 36 schemas.

Change checklist

• I have ensured that the CI Checks pass locally
• I have removed any unnecessary logic
• My code is well documented
• I have signed my commits
• My code follows the pattern of the application
• I have self reviewed my code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 70f27d40-87cd-4148-a67b-fbaab107a62b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coodos]

Description of change

Implements the PPA certification framework: six levels (L0–L5) scored from sixteen independently recorded assurance dimensions, plus identity assurance per accountable actor.

The level is calculated, not picked. The reviewer works through the matrix in a drawer; the level is the geometric mean of the per-dimension levels, capped by the identity floor (L0 needs IAL2, L1–L2 IAL3, L3–L5 IAL4). The calculation is shown with the weakest dimension named. A reviewer may still award something else, but that is behind a disclosure and requires a written justification, and both the computed and awarded level are signed into the certificate.

Nine of the sixteen rows answer themselves from evidence already verified — the release proof, the repository, attested deployments, and signed eReputation references. Identity assurance is derived from binding documents: an id_document gives IAL3, three attestations from passport-verified people give IAL4, and the weakest actor caps the release.

Findings are published as a new PlatformAssessment record in the reviewed platform's eVault alongside the certificate, so a later reader can inspect the evidence rather than trusting the headline level — which is what the framework asks for.

Also publishes Certification Level and Identity Assurance Level as ontology schemas, following the Domain precedent.

Issue Number

n/a

Type of change

New

How the change has been tested

• pnpm --filter ppa test — 20 passed. Covers the scoring rules (a weak row drags but does not pin; a single L0 row does not collapse the score; the identity floor caps independently; an unanswered dimension blocks) and identity derivation (each IAL tier, one-level-deep attester resolution, a mutual attestation terminating, an unreadable vault staying IAL1).
• Derivation checked against live data: the congo-basin author resolves to IAL3 from a real id_document, which correctly caps that release at L2.
• eReputation queried live at ereputation.w3ds.metastate.foundation; reference counts feed the three reputation rows.
• Override guard exercised by posting a grant above the calculated level with no justification, which is refused.
• pnpm --filter ppa check and build pass; the ontology service boots and serves all 36 schemas.

Change checklist

• I have ensured that the CI Checks pass locally
• I have removed any unnecessary logic
• My code is well documented
• I have signed my commits
• My code follows the pattern of the application
• I have self reviewed my code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 70f27d40-87cd-4148-a67b-fbaab107a62b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coodos]

Description of change

Implements the PPA certification framework: six levels (L0–L5) scored from sixteen independently recorded assurance dimensions, plus identity assurance per accountable actor.

The level is calculated, not picked. The reviewer works through the matrix in a drawer; the level is the geometric mean of the per-dimension levels, capped by the identity floor (L0 needs IAL2, L1–L2 IAL3, L3–L5 IAL4). The calculation is shown with the weakest dimension named. A reviewer may still award something else, but that is behind a disclosure and requires a written justification, and both the computed and awarded level are signed into the certificate.

Nine of the sixteen rows answer themselves from evidence already verified — the release proof, the repository, attested deployments, and signed eReputation references. Identity assurance is derived from binding documents: an id_document gives IAL3, three attestations from passport-verified people give IAL4, and the weakest actor caps the release.

Findings are published as a new PlatformAssessment record in the reviewed platform's eVault alongside the certificate, so a later reader can inspect the evidence rather than trusting the headline level — which is what the framework asks for.

Also publishes Certification Level and Identity Assurance Level as ontology schemas, following the Domain precedent.

Issue Number

n/a

Type of change

New

How the change has been tested

• pnpm --filter ppa test — 20 passed. Covers the scoring rules (a weak row drags but does not pin; a single L0 row does not collapse the score; the identity floor caps independently; an unanswered dimension blocks) and identity derivation (each IAL tier, one-level-deep attester resolution, a mutual attestation terminating, an unreadable vault staying IAL1).
• Derivation checked against live data: the congo-basin author resolves to IAL3 from a real id_document, which correctly caps that release at L2.
• eReputation queried live at ereputation.w3ds.metastate.foundation; reference counts feed the three reputation rows.
• Override guard exercised by posting a grant above the calculated level with no justification, which is refused.
• pnpm --filter ppa check and build pass; the ontology service boots and serves all 36 schemas.

Change checklist

• I have ensured that the CI Checks pass locally
• I have removed any unnecessary logic
• My code is well documented
• I have signed my commits
• My code follows the pattern of the application
• I have self reviewed my code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 70f27d40-87cd-4148-a67b-fbaab107a62b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coodos]

Description of change

Implements the PPA certification framework: six levels (L0–L5) scored from sixteen independently recorded assurance dimensions, plus identity assurance per accountable actor.

The level is calculated, not picked. The reviewer works through the matrix in a drawer; the level is the geometric mean of the per-dimension levels, capped by the identity floor (L0 needs IAL2, L1–L2 IAL3, L3–L5 IAL4). The calculation is shown with the weakest dimension named. A reviewer may still award something else, but that is behind a disclosure and requires a written justification, and both the computed and awarded level are signed into the certificate.

Nine of the sixteen rows answer themselves from evidence already verified — the release proof, the repository, attested deployments, and signed eReputation references. Identity assurance is derived from binding documents: an id_document gives IAL3, three attestations from passport-verified people give IAL4, and the weakest actor caps the release.

Findings are published as a new PlatformAssessment record in the reviewed platform's eVault alongside the certificate, so a later reader can inspect the evidence rather than trusting the headline level — which is what the framework asks for.

Also publishes Certification Level and Identity Assurance Level as ontology schemas, following the Domain precedent.

Issue Number

n/a

Type of change

New

How the change has been tested

• pnpm --filter ppa test — 20 passed. Covers the scoring rules (a weak row drags but does not pin; a single L0 row does not collapse the score; the identity floor caps independently; an unanswered dimension blocks) and identity derivation (each IAL tier, one-level-deep attester resolution, a mutual attestation terminating, an unreadable vault staying IAL1).
• Derivation checked against live data: the congo-basin author resolves to IAL3 from a real id_document, which correctly caps that release at L2.
• eReputation queried live at ereputation.w3ds.metastate.foundation; reference counts feed the three reputation rows.
• Override guard exercised by posting a grant above the calculated level with no justification, which is refused.
• pnpm --filter ppa check and build pass; the ontology service boots and serves all 36 schemas.

Change checklist

• I have ensured that the CI Checks pass locally
• I have removed any unnecessary logic
• My code is well documented
• I have signed my commits
• My code follows the pattern of the application
• I have self reviewed my code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 70f27d40-87cd-4148-a67b-fbaab107a62b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coodos]

Description of change

Implements the PPA certification framework: six levels (L0–L5) scored from sixteen independently recorded assurance dimensions, plus identity assurance per accountable actor.

The level is calculated, not picked. The reviewer works through the matrix in a drawer; the level is the geometric mean of the per-dimension levels, capped by the identity floor (L0 needs IAL2, L1–L2 IAL3, L3–L5 IAL4). The calculation is shown with the weakest dimension named. A reviewer may still award something else, but that is behind a disclosure and requires a written justification, and both the computed and awarded level are signed into the certificate.

Nine of the sixteen rows answer themselves from evidence already verified — the release proof, the repository, attested deployments, and signed eReputation references. Identity assurance is derived from binding documents: an id_document gives IAL3, three attestations from passport-verified people give IAL4, and the weakest actor caps the release.

Findings are published as a new PlatformAssessment record in the reviewed platform's eVault alongside the certificate, so a later reader can inspect the evidence rather than trusting the headline level — which is what the framework asks for.

Also publishes Certification Level and Identity Assurance Level as ontology schemas, following the Domain precedent.

Issue Number

n/a

Type of change

New

How the change has been tested

• pnpm --filter ppa test — 20 passed. Covers the scoring rules (a weak row drags but does not pin; a single L0 row does not collapse the score; the identity floor caps independently; an unanswered dimension blocks) and identity derivation (each IAL tier, one-level-deep attester resolution, a mutual attestation terminating, an unreadable vault staying IAL1).
• Derivation checked against live data: the congo-basin author resolves to IAL3 from a real id_document, which correctly caps that release at L2.
• eReputation queried live at ereputation.w3ds.metastate.foundation; reference counts feed the three reputation rows.
• Override guard exercised by posting a grant above the calculated level with no justification, which is refused.
• pnpm --filter ppa check and build pass; the ontology service boots and serves all 36 schemas.

Change checklist

• I have ensured that the CI Checks pass locally
• I have removed any unnecessary logic
• My code is well documented
• I have signed my commits
• My code follows the pattern of the application
• I have self reviewed my code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 70f27d40-87cd-4148-a67b-fbaab107a62b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coodos]

Description of change

Implements the PPA certification framework: six levels (L0–L5) scored from sixteen independently recorded assurance dimensions, plus identity assurance per accountable actor.

The level is calculated, not picked. The reviewer works through the matrix in a drawer; the level is the geometric mean of the per-dimension levels, capped by the identity floor (L0 needs IAL2, L1–L2 IAL3, L3–L5 IAL4). The calculation is shown with the weakest dimension named. A reviewer may still award something else, but that is behind a disclosure and requires a written justification, and both the computed and awarded level are signed into the certificate.

Nine of the sixteen rows answer themselves from evidence already verified — the release proof, the repository, attested deployments, and signed eReputation references. Identity assurance is derived from binding documents: an id_document gives IAL3, three attestations from passport-verified people give IAL4, and the weakest actor caps the release.

Findings are published as a new PlatformAssessment record in the reviewed platform's eVault alongside the certificate, so a later reader can inspect the evidence rather than trusting the headline level — which is what the framework asks for.

Also publishes Certification Level and Identity Assurance Level as ontology schemas, following the Domain precedent.

Issue Number

n/a

Type of change

New

How the change has been tested

• pnpm --filter ppa test — 20 passed. Covers the scoring rules (a weak row drags but does not pin; a single L0 row does not collapse the score; the identity floor caps independently; an unanswered dimension blocks) and identity derivation (each IAL tier, one-level-deep attester resolution, a mutual attestation terminating, an unreadable vault staying IAL1).
• Derivation checked against live data: the congo-basin author resolves to IAL3 from a real id_document, which correctly caps that release at L2.
• eReputation queried live at ereputation.w3ds.metastate.foundation; reference counts feed the three reputation rows.
• Override guard exercised by posting a grant above the calculated level with no justification, which is refused.
• pnpm --filter ppa check and build pass; the ontology service boots and serves all 36 schemas.

Change checklist

• I have ensured that the CI Checks pass locally
• I have removed any unnecessary logic
• My code is well documented
• I have signed my commits
• My code follows the pattern of the application
• I have self reviewed my code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 70f27d40-87cd-4148-a67b-fbaab107a62b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coodos]

Description of change

Implements the PPA certification framework: six levels (L0–L5) scored from sixteen independently recorded assurance dimensions, plus identity assurance per accountable actor.

The level is calculated, not picked. The reviewer works through the matrix in a drawer; the level is the geometric mean of the per-dimension levels, capped by the identity floor (L0 needs IAL2, L1–L2 IAL3, L3–L5 IAL4). The calculation is shown with the weakest dimension named. A reviewer may still award something else, but that is behind a disclosure and requires a written justification, and both the computed and awarded level are signed into the certificate.

Nine of the sixteen rows answer themselves from evidence already verified — the release proof, the repository, attested deployments, and signed eReputation references. Identity assurance is derived from binding documents: an id_document gives IAL3, three attestations from passport-verified people give IAL4, and the weakest actor caps the release.

Findings are published as a new PlatformAssessment record in the reviewed platform's eVault alongside the certificate, so a later reader can inspect the evidence rather than trusting the headline level — which is what the framework asks for.

Also publishes Certification Level and Identity Assurance Level as ontology schemas, following the Domain precedent.

Issue Number

n/a

Type of change

New

How the change has been tested

• pnpm --filter ppa test — 20 passed. Covers the scoring rules (a weak row drags but does not pin; a single L0 row does not collapse the score; the identity floor caps independently; an unanswered dimension blocks) and identity derivation (each IAL tier, one-level-deep attester resolution, a mutual attestation terminating, an unreadable vault staying IAL1).
• Derivation checked against live data: the congo-basin author resolves to IAL3 from a real id_document, which correctly caps that release at L2.
• eReputation queried live at ereputation.w3ds.metastate.foundation; reference counts feed the three reputation rows.
• Override guard exercised by posting a grant above the calculated level with no justification, which is refused.
• pnpm --filter ppa check and build pass; the ontology service boots and serves all 36 schemas.

Change checklist

• I have ensured that the CI Checks pass locally
• I have removed any unnecessary logic
• My code is well documented
• I have signed my commits
• My code follows the pattern of the application
• I have self reviewed my code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 70f27d40-87cd-4148-a67b-fbaab107a62b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coodos]

Description of change

Implements the PPA certification framework: six levels (L0–L5) scored from sixteen independently recorded assurance dimensions, plus identity assurance per accountable actor.

The level is calculated, not picked. The reviewer works through the matrix in a drawer; the level is the geometric mean of the per-dimension levels, capped by the identity floor (L0 needs IAL2, L1–L2 IAL3, L3–L5 IAL4). The calculation is shown with the weakest dimension named. A reviewer may still award something else, but that is behind a disclosure and requires a written justification, and both the computed and awarded level are signed into the certificate.

Nine of the sixteen rows answer themselves from evidence already verified — the release proof, the repository, attested deployments, and signed eReputation references. Identity assurance is derived from binding documents: an id_document gives IAL3, three attestations from passport-verified people give IAL4, and the weakest actor caps the release.

Findings are published as a new PlatformAssessment record in the reviewed platform's eVault alongside the certificate, so a later reader can inspect the evidence rather than trusting the headline level — which is what the framework asks for.

Also publishes Certification Level and Identity Assurance Level as ontology schemas, following the Domain precedent.

Issue Number

n/a

Type of change

New

How the change has been tested

• pnpm --filter ppa test — 20 passed. Covers the scoring rules (a weak row drags but does not pin; a single L0 row does not collapse the score; the identity floor caps independently; an unanswered dimension blocks) and identity derivation (each IAL tier, one-level-deep attester resolution, a mutual attestation terminating, an unreadable vault staying IAL1).
• Derivation checked against live data: the congo-basin author resolves to IAL3 from a real id_document, which correctly caps that release at L2.
• eReputation queried live at ereputation.w3ds.metastate.foundation; reference counts feed the three reputation rows.
• Override guard exercised by posting a grant above the calculated level with no justification, which is refused.
• pnpm --filter ppa check and build pass; the ontology service boots and serves all 36 schemas.

Change checklist

• I have ensured that the CI Checks pass locally
• I have removed any unnecessary logic
• My code is well documented
• I have signed my commits
• My code follows the pattern of the application
• I have self reviewed my code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 70f27d40-87cd-4148-a67b-fbaab107a62b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}