cert-fabric
Conduir Modularity Certification-as-a-Service — the substrate's immune system.
Validates that a service is independently buildable, deployable, and substitutable per the Prime Directive (../delivery/MODULARITY-CERT-FRAMEWORK-V1-ARCHITECTURE-REVIEW-2026-05-22.md):
"We accept a slightly higher architectural cost today to ensure total component swappability tomorrow."
Quickstart (local CLI)
cd services/cert-fabric
python3 -m venv .venv && source .venv/bin/activate
pip install -e ".[dev,production]"
# Run against a service manifest
cert-fabric run \
--manifest ../llm-gateway/cert.manifest.yaml \
--service-root ../llm-gateway \
--out /tmp/cert-runs \
--local --skip-provenance --skip-vuln-scan
# View a verdict
cert-fabric show-verdict <run_id>
# Run the adversarial self-test matrix (7 modes per v8.1 §7.2)
cert-fabric self-testQuickstart (FastAPI service)
# Local
uvicorn cert_fabric.api.server:app --host 0.0.0.0 --port 48030
# Docker
docker build -t cert-fabric:local services/cert-fabric/
docker run -p 48030:48030 cert-fabric:local
# Full stack with Postgres ledger
docker compose -f services/cert-fabric/docker-compose.fragment.yml up -dAPI surface (see ARCHITECTURE.md §API):
| Endpoint | Purpose |
|---|---|
POST /api/v1/cert/run | Submit a cert run; returns run_id + polling URLs |
GET /api/v1/cert/run/{id}/status | Phase + percent complete |
GET /api/v1/cert/run/{id}/verdict | Final verdict.json |
GET /api/v1/cert/{service}/latest | Most-recent verdict for a service |
GET /api/v1/cert/{service}/history | Verdict history (cohort dashboard source) |
POST /api/v1/cert/self-test/replay | Run adversarial self-test matrix |
GET /healthz | Liveness |
GET /readyz | Readiness (verifies ledger reachable) |
GET /metrics | Prometheus-style metrics |
What it produces
For every cert run:
<out>/<service>/<run_id>/
├── manifest.copy.yaml # the manifest as submitted
├── runner_isolation.json # scorched-earth env + Docker prefixes (v8.1 §6.6)
├── stage1-static-gates.json # R-1..R-7 results
├── stage2-provenance.json # cosign verify-attestation result
├── stage3-test-results.json # Bucket A-E + R-8 outcomes
├── stage4-vuln-scan.json # Trivy/Grype CVE findings
├── stage6-sealing.json # Cosign sign + attestation diagnostics
├── stage8-teardown.json # Docker hygiene verification
├── tests/ # JUnit XMLs per bucket
├── verdict.json # canonical 10-clause + 0-100 score
├── proof_manifest.sha256 # SHA-256 of every artifact
└── proof_manifest.attestation.json # Cosign attestation, SLSA in-toto v1 predicatesha256sum -c proof_manifest.sha256 re-verifies the bundle's integrity.cosign verify-attestation --type https://conduir.dev/cert-fabric/v2 ... re-verifies authenticity.
What it certifies
The 10-clause verdict (v8.1 §6.1):
| Clause | Weight | Source |
|---|---|---|
fresh_env | 10 | Stage 2 provenance verified |
service_local_infra | 10 | Bucket B PASS with only local infra |
no_sibling_dependency | 10 | R-1/R-3 static + Bucket B clean |
substitutability | 15 | Bucket D + behavioral parity |
boundary | 10 | Bucket A structural |
boundary_integrity | 15 | R-1..R-8 (static + R-8 runtime DB) |
operational | 10 | /health, /ready, /metrics, OpenAPI |
pr_isolation | 5 | Server-derived PR diff scope |
deployability | 10 | 7 sub-gates: semver, Cosign, SBOM, vuln_scan, CI, etc. |
contract_compatibility | 5 | N-1 backward compat |
PASS bar: all applicable hard gates PASS AND maturity score ≥ 80. Score never overrides a failed hard gate.
How to onboard a service
1. Author services/<svc>/cert.manifest.yaml (~20 lines; see llm-gateway example (../llm-gateway/cert.manifest.yaml)).
2. Add tests in services/<svc>/tests/bucket_a/, bucket_b/, bucket_c/, bucket_d/ (and optionally bucket_e/).
3. Add services/<svc>/score.yaml declaring backing resources.
4. Submit: cert-fabric run --manifest services/<svc>/cert.manifest.yaml --service-root services/<svc>/.
5. Triage the verdict; iterate.
See RUNBOOK.md (RUNBOOK.md) for operator-side procedures (deployment, secrets, monitoring, incident response).
Authority
- Spec:
delivery/MODULARITY-CERT-FRAMEWORK-V1-ARCHITECTURE-REVIEW-2026-05-22.md(../../delivery/MODULARITY-CERT-FRAMEWORK-V1-ARCHITECTURE-REVIEW-2026-05-22.md) (v8.1 RC + v7.1 patch) - Deploy contract:
contracts/MODULAR-DEPLOYMENT-CONTRACT.v0.md(../../contracts/MODULAR-DEPLOYMENT-CONTRACT.v0.md) §5 (semver, Cosign, SBOM, STOP-THE-LINE) - Adversarial framework: framework doc §13
Version
- Current: v0.2.0 (production-grade)
- Schema: v2 (10 clauses, 0-100 maturity score, hard-gates-override-score invariant)
- Predicate type:
https://conduir.dev/cert-fabric/v2