AECP v0.1-rc2

AECP v0.1-rc2

AECP is a small, local, harmless conformance profile for a narrow but important distinction:

A policy rejection is not evidence that the protected effect path stayed absent.

The v0.1-rc2 release includes seven incident-shaped and design-extension classes, matched positive controls, independent effect observation, decision/effect divergence reporting, a portable exact-qualification adapter profile, deterministic manifests, and self-tests for leaky denial, no-op allowance, alternate paths, adapter errors, and fixture reachability.

Run

./verify.sh

Expected local reference result:

• 22 unit tests pass
• protected illustrative adapter: 7/7 scenarios pass
• instrument self-test passes
• 7 scenarios / 9 published results validate
• INDEX.json is current

Evidence ceiling

AECP v0.1-rc2 is implementation-neutral within its portable exact-qualification adapter profile. It is not a universal benchmark for every monitor, sandbox, or authorization model. Snapshot-diff probes establish persistent snapshot-visible change; they do not prove that a transient effect never formed between observations.

The included reference adapter and results are illustrative. They are not production certification and do not establish complete mediation of a deployment.

Counterexamples wanted

Useful reports include:

• a denied action whose protected effect still formed;
• an allowed control whose expected effect did not form;
• an alternate or equivalent path omitted by a probe;
• an adapter assumption that does not port to a real implementation;
• a provenance correction to an incident mapping.

Please do not submit real credentials, live malicious payloads, personal information, or private incident transcripts.

Release asset

Public ZIP SHA-256:

f39de6cd01124c7f7743b38aadfef4430379763dae81562881fa4dcf94766b33

Originally created by Certum Systems. No incident-report publisher, standards body, or referenced author endorses AECP merely because their public materials are cited.