# T06 Validation — Cedar Engine and Policy Oracle

> Gate: corepack pnpm@10.34.5 gate:security Result: 122 passed, 0 failed, 0 skipped, 0 todo (50 T06 cases) SPECDEVIATION: none; native form was evaluated and rejected because no qualified release artifact exists.

Source: https://github.com/accd/verchestra/blob/main/docs/qualification/t06-validation.md
Content digest: `sha256:be535efe2902db03bcc3a279e7ba99e17abecd4c24e0621e5c21ead4cf79a961`

**Gate:** `corepack pnpm@10.34.5 gate:security`  
**Result:** 122 passed, 0 failed, 0 skipped, 0 todo (50 T06 cases)  
**SPEC_DEVIATION:** none; native form was evaluated and rejected because no qualified release artifact exists.

## Check A — Sufficient coverage

| Done-when / requirement | Assertion evidence | Spec-defined outcome | Covered |
| --- | --- | --- | --- |
| Parse and schema failures | `cedar-oracle.test.mjs:65-66` — `assert.equal(decision.decision, entry.expectedDecision)` and exact `decision.code`; corpus lines 27-28 | Stable deny | Yes |
| Strict policy validation | same assertions; corpus lines 29-30 | Stable deny | Yes |
| Request/schema incompatibility | same assertions; corpus lines 31-34 | Stable deny | Yes |
| Implicit deny | same assertions; corpus lines 3-7 and 20-25 | Deny when no permit matches | Yes |
| Forbid precedence | same assertions; corpus lines 9-13 and `cedar-oracle.test.mjs:82-83` | Deny; winning forbid identified | Yes |
| Lower layers only restrict | same assertions; corpus lines 14-18 | Every lower-layer permit is `VES_POLICY_NON_MONOTONIC` deny | Yes |
| Diagnostics/errors fail closed | same assertions; corpus lines 37-40 | Stable diagnostic/evaluation/engine deny | Yes |
| Explanation | `cedar-oracle.test.mjs:74-75,82-83` — exact determining IDs and explanation strings | Safe explainable allow/deny | Yes |
| Version incompatibility | corpus lines 35-36 through exact assertions at `cedar-oracle.test.mjs:65-66` | Engine/language mismatch deny | Yes |
| Egress attributes | corpus lines 19-25 through exact assertions at `cedar-oracle.test.mjs:65-66` | Classification, purpose, destination, retention, Workspace, policy all required | Yes |
| Approval/effect bindings | corpus lines 2-8 through exact assertions at `cedar-oracle.test.mjs:65-66` | Changed Approval/policy/capability/evidence/claim denies | Yes |
| Untrusted content | corpus line 41 through exact assertions at `cedar-oracle.test.mjs:65-68` | Content cannot promote authority or leak engine detail | Yes |
| Cross-form differential | `cedar-forms.test.mjs:31` — `assert.deepEqual(esmCedar.isAuthorized(call), nodeCedar.isAuthorized(call))` across five decisions | Official forms are semantically identical | Yes |
| One selected form | `cedar-forms.test.mjs:40` — `assert.equal(selected.id, "wasm-node")` | Exactly qualified Node WASM selected | Yes |
| No eligible form | `cedar-forms.test.mjs:44` — `assert.throws(... { code: "VES_CEDAR_FORM_UNQUALIFIED" })` | Selection fails closed | Yes |

## Check B — Non-shallow

The 40-case corpus asserts both the exact decision and exact stable code, requires a non-empty explanation, and checks that a thrown internal detail is absent. Separate assertions verify determining policy IDs and explanation text. Differential cases compare full official Cedar response objects rather than call counts.

## Check C — Necessary reverse mapping

| Test evidence | Maps to | Keep |
| --- | --- | --- |
| Corpus lines 2-18 + `cedar-oracle.test.mjs:65-68` | VES-SEC-001, VES-EXE-001…003 | Yes |
| Corpus lines 19-25 + `cedar-oracle.test.mjs:65-68` | VES-CTX-006 | Yes |
| Corpus lines 26-40 + `cedar-oracle.test.mjs:65-68` | VES-SEC-002 and T06 parse/schema/diagnostic/version criteria | Yes |
| Corpus line 41 + `cedar-oracle.test.mjs:65-68` | VES-SEC-006 | Yes |
| `cedar-oracle.test.mjs:74-75,82-83` | T06 explanation criterion | Yes |
| `cedar-forms.test.mjs:9-16,31` | T06 cross-form and exact-version criteria | Yes |
| `cedar-forms.test.mjs:40,44-47` | T06 release-form selection and fail-closed edge | Yes |

## Check D — Guidelines

Tests follow the policy/security expectations in `spec.md`, `design.md` sections 4.5 and 10, the T06 task, and the generated Test Coverage Matrix. They use the official exact-pinned engine and frozen expected outcomes; no dependency behavior is asserted without a Verchestra requirement mapping.

## Adequacy verdict

PASS — all T06 criteria have evidence-or-zero mappings, all 50 new cases are requirement-bound, the security gate passes without skips, and no test was weakened or removed.