Post-release surveillance found a real coverage gap: extension E17 was registered and emitted by one supported polymer-line controller, but the released conformance corpus exercised only its absent state. Two verifiers ignored a populated E17, one rejected it, and the remaining pools never received it.
Recovery is not achieved by adding one happy-path fixture. The team must reconcile the extension registry, profile rules, parser branches, appraisal policy and evidence archive, then prove that old evidence still produces the old meaning while the newly supported state produces the declared new meaning.
The Gold Standard is an evidence-continuity re-release: define the semantic delta, cover positive and negative states, replay old and new corpora through independent verifier builds, preserve the original signed evidence, and release only the smallest contract that all supported consumers can implement.
A practical orientation
Use this guide after semantic surveillance has opened the eleventh escalation around an extension-coverage gap. The worked example follows extension E17 across 840 evidence objects, four encodings, six verifier pools and two profile versions.
Choose a reading route
Work and transfer the repair
Chapters 7–9 calculate results and change encodings and versions.
Chapter contents
- 1. Freeze the eleventh-escalation claim
- 2. Reconcile registry identity, profile permission and local schema
- 3. Turn the support matrix into executable coverage
- 4. Preserve original evidence and derive replay artifacts
- 5. Define a semantic oracle before repairing parsers
- 6. Measure evidence continuity across the semantic delta
- 7. Worked example: the missing populated E17 branch
- 8. Transfer check: change encoding, order and profile version
- 9. Test wrapper, nesting and extension-boundary cases
- 10. Use the eleventh re-release gate
- 11. Limits, misconceptions and evidence checklist
- 12. FAQs and the next reading route
1. Freeze the eleventh-escalation claim
The claim is not that extensions are dangerous. It is that the released support matrix misrepresented E17: a populated, profile-permitted state was absent from the corpus and interpreted differently by supported verifiers. Freeze the affected profile, extension identifier, controller versions, encodings and relying-party consequence.
Keep unrelated claims, reference values and production material decisions outside the escalation. The recovery question is whether E17 can be covered and interpreted consistently without changing the meaning of already supported evidence.
- Named extension and profile.
- Observed producer and consumer versions.
- One relying-party consequence.
- Old semantic contract preserved.
- Unrelated claims out of scope.
2. Reconcile registry identity, profile permission and local schema
A registry entry establishes an identifier and authority; a profile says whether and how the extension may appear; a local schema says what a parser currently accepts. These layers can disagree. Treating the local schema as the registry merely converts an implementation gap into a false protocol rule.
Build one row per extension state: absent, empty where legal, populated-valid, populated-invalid, duplicate, wrong type, unknown extension and prohibited-by-profile. Record the expected parser state, appraisal state and reason family separately.
| Layer | Question | Evidence |
|---|---|---|
| Registry | Who owns the identifier? | Stable registry snapshot |
| Profile | Is the extension allowed or required? | Versioned profile text |
| Schema | Can this build parse it? | Executable validator |
| Policy | What does the value mean? | Appraisal rule |
| Relying party | What action follows? | Decision mapping |
3. Turn the support matrix into executable coverage
A checked spreadsheet cell is weak evidence. Link every claimed state to a signed or reproducibly generated fixture, expected result, verifier build and test receipt. Coverage is the number of exercised declared branches divided by the number of declared branches, not the number of extensions mentioned in documentation.
Retain negative controls. An invalid type that is accidentally accepted can be more dangerous than a valid extension that is rejected, because it gives the relying party a confident result from ambiguous evidence.
| State | Expected parser result | Expected appraisal |
|---|---|---|
| Absent and optional | Accept | Continue without E17 |
| Populated-valid | Accept | Apply declared rule |
| Populated-invalid type | Reject or indeterminate | No positive result |
| Unknown and allowed | Accept under profile rule | Ignore or retain as declared |
| Prohibited by profile | Reject | Profile violation |
4. Preserve original evidence and derive replay artifacts
Do not rewrite the original signed token to add or remove E17. Store its digest, signature-validation result, receipt time and authorised bytes. A replay artifact may decode, annotate or minimise the object, but it must link back to the original and identify every transformation.
RFC 9334 separates Evidence, appraisal and Attestation Results. Preserve that separation in the archive. A new verifier result is not a replacement for the evidence that produced the old result.
- Original signed evidence immutable.
- Replay derivation recorded.
- Evidence and result identifiers separate.
- Clock and nonce context retained.
- Authorised access and retention rules followed.
5. Define a semantic oracle before repairing parsers
The oracle is a table of expected states derived from the registry, profile and approved appraisal policy. It should not be generated by whichever verifier currently passes the most cases. Where the sources are silent, mark the state unresolved and stop rather than inventing a default.
Use two independent implementations or one implementation plus a manually reviewed reference interpreter for critical rows. Agreement is evidence only when they do not share the same parser and mapping library.
| Oracle field | Example | Why retained |
|---|---|---|
| Profile version | P11 | Scopes permission |
| E17 syntax | Unsigned integer 0–7 | Defines valid value |
| Unknown handling | Retain then ignore | Prevents false rejection |
| Invalid handling | Indeterminate | Prevents positive appraisal |
| Reason family | extension-invalid | Keeps audit meaning |
6. Measure evidence continuity across the semantic delta
Partition the corpus into legacy-without-E17, legacy-with-unknown-extensions, new-valid-E17 and new-invalid-E17. Legacy partitions should preserve their released results. New partitions should converge on the newly declared behavior. Report both case-level and branch-level coverage.
A repair that makes E17 pass while changing old unknown-extension handling is not continuous. Compare result, reason family and relying-party action, because the binary result can stay the same while the explanation or restriction path changes.
| Corpus partition | Continuity expectation | Failure meaning |
|---|---|---|
| Legacy without E17 | Exact released behavior | Regression |
| Legacy unknown extension | Profile rule unchanged | Overbroad parser change |
| New valid E17 | Declared appraisal | Coverage repaired |
| New invalid E17 | Safe refusal | Negative-control failure |
7. Worked example: the missing populated E17 branch
The old corpus has 720 objects and all six pools agree on 718. The two disagreements are known clock cases. The new 120-object E17 set contains 60 valid, 30 wrong-type, 20 prohibited-profile and 10 unknown-extension controls. Before repair, pools produce four distinct result vectors.
After registry and profile reconciliation, verifier builds V11a and V11b both accept all 60 valid cases, refuse all 50 invalid or prohibited cases with the declared state, and preserve the 720 legacy outcomes. One pool still maps extension-invalid to a generic fail rather than indeterminate; its relying-party action is the same, but reason continuity fails.
The mapping is repaired and replayed. Final complete-vector agreement is 838 of 840; the two retained clock cases remain explicitly outside the E17 claim. Branch coverage rises from 7 of 8 to 8 of 8, while the legacy-result delta remains zero.
| Measure | Before repair | After final replay |
|---|---|---|
| Declared branches exercised | 7 of 8 | 8 of 8 |
| Valid E17 convergence | 4 result vectors | 1 result vector |
| Invalid/prohibited safe refusal | 44 of 50 | 50 of 50 |
| Legacy result changes | Not yet measured | 0 of 720 |
| Reason-family disagreements | 37 | 0 |
8. Transfer check: change encoding, order and profile version
Encode the same permitted value in every allowed transport form and reorder unrelated claims. Meaning should remain invariant. Then change to a profile version that prohibits E17; the same bytes should produce a profile violation rather than silently inheriting the P11 decision.
Finally add an unknown E18 whose profile handling is explicitly tolerant. A parser patch written as “accept all extensions” will fail the prohibited case; a patch written as “reject every unknown” will fail the tolerant case. The transfer set distinguishes principled handling from a special-case E17 branch.
| Changed context | Expected invariant or change | Defect exposed |
|---|---|---|
| Allowed encoding | Same E17 meaning | Representation dependence |
| Claim order | Same meaning | Order-sensitive parser |
| Profile P11 → P10 | Declared prohibition | Version leakage |
| Unknown E18 | Profile-specific tolerance | Blanket accept/reject patch |
9. Test wrapper, nesting and extension-boundary cases
When evidence is wrapped or nested, record which layer owns E17 and which profile governs it. Do not hoist an inner claim into the outer result merely because names match. RFC 9999 provides a conceptual message wrapper model; it does not erase the need to preserve payload type and context.
Stress duplicate identifiers, nested unknowns, detached payloads and truncated objects. Every refusal should be bounded and explainable, without parser crashes or partial positive appraisals.
- Owning claims set explicit.
- Profile bound to the correct layer.
- Duplicate and truncation cases tested.
- No partial positive appraisal after parse failure.
- Native and canonical reasons retained.
10. Use the eleventh re-release gate
The gate requires registry and profile reconciliation, full declared-branch coverage, zero unexplained legacy delta, independent verifier convergence, negative-control success, evidence continuity and rollback. Release receipts must name the corpus, oracle, builds and profile versions.
The worked repair passes after the reason mapping is corrected. The two clock cases remain in a separate issue because bundling them would widen the semantic delta. The eleventh re-release therefore adds E17 coverage and nothing more.
| Gate | Required evidence | Worked result |
|---|---|---|
| Authority | Registry and profile agree | Pass |
| Coverage | 8 of 8 branches | Pass |
| Continuity | 0 legacy deltas | Pass |
| Safety | 50 of 50 refusals | Pass |
| Scope | Clock cases separate | Pass |
11. Limits, misconceptions and evidence checklist
Extension conformance does not prove that a polymer measurement is physically accurate or that a controller is safe. It proves only that declared evidence is parsed and appraised according to the supported contract. Unknown handling is profile-dependent, not universally accept or reject.
Preserve registry and profile snapshots, schemas, oracle, original evidence, derived fixtures, build identities, result vectors, reason mappings, exclusions, review minutes and rollback instructions. Reproduce the release packet in a clean verifier environment.
- No claim of physical material validity.
- Unknown does not mean invalid by default.
- Positive and negative branches both covered.
- Legacy meaning checked explicitly.
- Clean-environment replay required.
12. FAQs and the next reading route
Extension recovery is complete only when the new branch is covered and the old contract remains stable. That is why the evidence archive and reason mappings matter as much as the parser fix.
Read the Polymer Science root, the tenth re-release article and the post-release surveillance article before this guide. The Gold Standard parent and How X Works hub connect the method to a wider habit: separate layers, preserve evidence and test transfer.
Why not accept every extension and ignore what is unknown?
A profile may prohibit an extension or require specific handling. Blanket acceptance can turn invalid evidence into a positive appraisal.
Why keep old evidence after re-release?
It proves continuity, supports later audit and lets reviewers distinguish a new semantic branch from an unintended change to legacy behavior.
Does complete branch coverage guarantee every implementation is correct?
No. It strengthens the declared contract test but cannot exhaust all encodings, resource limits or future profile combinations. Limits and supported versions must remain explicit.
Continue through the verified ecosystem
- The Gold Standard of Polymer Science subject root
- The Gold Standard of Education: Learning Transfers into Life
- How X Works hub
- Post-Tenth-Re-Release Semantic Surveillance, Contract-Coverage Drift and Eleventh-Escalation Gates
- Tenth-Escalation Recovery, Semantic-Contract Reconciliation and Evidence-Continuity Tenth Re-Release
Sources and scope note
- RFC 9334 — Remote ATtestation procedureS Architecture — used for the separation of Evidence, verifier appraisal, policies and Attestation Results.
- RFC 9711 — Entity Attestation Token — used for claim registries, profiles, unknown claims, new claims and constrained permitted formats.
- RFC 9999 — RATS Conceptual Message Wrapper — used for wrapper and nested-payload context without collapsing evidence layers.
E17, the controller estate, corpus and numerical results are original teaching examples. The RFCs define relevant attestation architecture and token semantics; they do not certify a polymer process or controller.