Reference
Assess an implementation independently
Apply the published requirements to an exact capability, retain the evidence, and separate local checks from full operating assessment.
Conformance is scoped evidence
Any compatible implementation can be assessed without a Bankeiz account, purchase, permission or badge. Apply the same published requirements to the exact receiver role, capability, build, rail, trust roots/policy, runtime and device path. A package name, schema-valid report or successful sandbox cannot stand in for actual financial and protected-custody evidence.
| Result | What it establishes |
|---|---|
| Engineering checks | Assertions at the recorded source/build and fixture scope. |
| Public integration contract | The synthetic language-neutral adapter testbench and exact transcript. |
| Independent operating assessment | Accepted evidence for every applicable control on the actual assessed implementation/environment. |
Run the local engineering tools
npm run release:check
npm run receiver:check
node scripts/conformance-reference.mjs
node scripts/conformance-contract.mjs --adapter node scripts/conformance-adapter.mjs
node scripts/conformance-contract.mjs --verify transcript.json
node scripts/conformance-contract.mjs --verify credential.pngThe selected adapter runner performs bounded synthetic request/response cases. A proof-bearing credential PNG is canonically verified before its holder/artwork/evidence projection. These local results do not authorize credit or qualify an institution’s production custody. Keep the transcript and source/resource hashes with their original scope.
Perform the complete assessment
- Scope the implementation
Record source/build/resource hashes, adapter, roots/policy, rails, realm, hardware and versions.
- Read each applicable requirement
Use exact original units, current heads and verified causal coordinates. Justify non-applicability normatively.
- Exercise positive and refusal cases
Include wrong recipient/rail, altered proof, missing parents, concurrency, stale heads and interruption/restart.
- Retain independent evidence
Keep complete originals, source heads, exact consent/requests, accepted/refused results and protected-device evidence.
- Review and record findings
An independent reviewer resolves the sources and actual observations, then accepts or rejects each control with rationale.
- Remediate and rerun
Append corrected evidence without hiding the old finding or abandoning an unknown operation.
Use the correct report format
| Format | Purpose |
|---|---|
| receiz.bank.external-assessment.v1 | Partial automated gap review; use conformance-report.template.json. |
| receiz.bank.independent-assessment.v1 | Full manual/physical reviewer program with sixteen controls; use the independent-assessment template/schema. |
The complete record explicitly is not machine proof. Automated report upload does not establish every host/hardware/independent fact: the implementation deliberately keeps completeIndependentEvidenceEstablished false. Missing or unsupported required evidence remains missing-proof. Do not feed the full reviewer template to the partial CLI and describe a schema check as complete conformance.
Publish exact scope and limitations
Conclude conforming for the assessed capability only after every applicable control has accepted evidence and exclusions have justified applicability. Otherwise state does not pass or conformance not demonstrated with the concrete missing/invalid/violating evidence. Publish safe scope, hashes, procedures and authorized references; private originals stay under protected custody. Reassess affected controls after package, host, custody or execution changes.
Implementation sources
Inspect the exact path.
Source links retain revision 6c5d582. Read the documented operation and assessment scope alongside its code.