# ADCR 0.1.0: MUST coverage by the test vectors

SPEC.md has 66 numbered rules. 62 of them carry at least one MUST, MUST NOT or REQUIRED; PRF-02 uses the word only as a noun. This file says, for each of those 62 rules, which published vector cases exercise it.

How to read it:

- **Positive** names a case where the rule is met and the reference verifier checks it. **Negative** names a case built to break the rule, with the finding the verifier must report. Each negative case outside `interactions_v1` breaks one rule, and the `interactions_v1` cases break two; `generate_vectors.py` refuses to write a case whose findings differ from the ones it declares. `anchor_coverage_misstated` also reports the informational `unanchored_tail` that its misstated coverage leaves.
- **Producer-attested** means the rule, or the named part of it, is about how the producer works (a process, a key, a store, an interface, a profile, the meaning of a value), which no export file can show. A judge checks it against the producer's profile (PRF-01) and its own evidence, not against the vectors.

Totals for this version: 57 rules have a positive and a negative case; 5 are producer- or verifier-attested; none is left without a vector. The `profile_v1` suite checks a producer profile (PRF-01) and an export against it, which turns the published parts of REC-20, CMT-05, CMT-06 and PRF-01 into tested fields; what those fields claim about the producer's processes is still attested. Every finding name in EXP-04 has a case except `anchor_token_not_checked`, which describes the verifier's environment, not the export: `adcr_verify.py --openssl <a LibreSSL binary>` reports it on any case that carries a token, while `run_vectors.py` given such a binary skips every case that carries a token and pins trust anchors instead of passing it. The timestamp tokens are real RFC 3161 tokens from a test authority (`vectors/keys/`), except in the three cases that break a token on purpose (`anchor_token_parse`, `anchor_token_status_rejected`, `anchor_token_signature`); `openssl ts -verify` agrees with the reference verifier on every token case.

## Record (REC)

| Rule | Positive | Negative | Producer-attested part |
|---|---|---|---|
| REC-01 | every `*_valid` case (the chain hash is over the RFC 8785 form) | `record_float_number`, `record_integer_too_large` (`invalid_value`) | |
| REC-02 | every `*_valid` case | `record_rulebook_wrong`, `export_rulebook_wrong` (`invalid_value`) | |
| REC-03 | every `*_valid` case | `record_id_missing` (`required_field_missing`), `record_id_duplicate` (`invalid_value`) | uniqueness across exports |
| REC-04 | every `*_valid` case | `record_occurred_at_malformed` (`invalid_value`), `export_clock_source_incomplete`, `export_envelope_field_missing` (`required_field_missing`) | that the clock was synchronised to the declared reference |
| REC-05 | `record_valid` (an unregistered `event_type` read as `decision`); the `*_valid` cases together carry all eleven values | `record_event_type_unknown_missing_decision_fields` (`required_field_missing`) | |
| REC-06 | every `*_valid` case | `record_account_id_mismatch` (`invalid_value`) | that the identifiers name the right organisations |
| REC-07 | every `*_valid` case; `record_valid` (an `anchor_failed` record and a `legal_hold` record without one) | `record_deciding_system_missing`, `record_write_failure_deciding_system_missing` (`required_field_missing`), `record_deciding_system_is_checker` (`invalid_value`) | that `version` is the provider's model identifier |
| REC-08 | every `*_valid` case; `rights_valid` (`subject`) | `record_person_in_clear`, `record_person_key_version_missing`, `oversight_reviewer_in_clear`, `rights_subject_in_clear` (`person_in_clear`) | a direct identifier hidden in a field that is not a person field, unless it has the shape of an e-mail address |
| REC-09 | | | producer-attested: whether the person is an employee is not visible in an export; its consequence is vectored under RGT-02 |
| REC-10 | every `*_valid` case | `record_content_present`, `interactions_person_and_content` (`content_present`) | content carried under a name section 7 does not list |
| REC-11 | every `*_valid` case | `record_correlation_id_missing`, `record_commitment_key_version_missing` (`required_field_missing`) | |
| REC-12 | `record_valid` (`source_ref`) | `record_source_ref_not_a_locator` (`invalid_value`) | whether a well-formed locator still reveals content |
| REC-13 | `record_valid` (`special_category`, `art4a_basis_ref`) | `record_data_categories_missing` (`required_field_missing`) | that the labels are right; whether Article 4a applies |
| REC-14 | every `*_valid` case; `record_valid` (`native_result`) | `record_verdict_invalid` (`invalid_value`) | the mapping from the provider's native result |
| REC-15 | `law_valid` | `law_rule_set_undigested` (`provision_unchecked`), `law_rule_set_missing_no_rule_fired` (`required_field_missing`) | |
| REC-16 | `record_valid` (`reason_codes`, `confidence`) | `record_reason_code_free_text`, `record_float_number` (`invalid_value`) | |
| REC-17 | `record_valid` (claimed and rejected exemptions, a `classification` record) | `record_exemption_rejected_without_reason`, `record_classification_incomplete` (`required_field_missing`) | |
| REC-18 | `record_valid` (a `fallback` object, `fallback`, `logging_failure` and `opt_out` records) | `record_fallback_incomplete`, `record_logging_failure_kind_missing` (`required_field_missing`) | that every failure was detected and recorded |
| REC-19 | every `*_valid` case; `record_valid` (a `legal_hold` record) | `record_required_field_missing`, `record_legal_hold_incomplete` (`required_field_missing`), `record_legal_hold_on_retention` (`invalid_value`), `profile_retention_class_undefined` (`profile_mismatch`) | the erasure process, and that held records were in fact kept |
| REC-20 | `profile_valid` (a high-risk class of 184 days) | `profile_high_risk_period_short` (`invalid_value`) | that a class marked not high-risk holds no high-risk records; the period the data protection assessment justifies |

## Law (LAW)

| Rule | Positive | Negative | Producer-attested part |
|---|---|---|---|
| LAW-01 | every `*_valid` case | `law_rule_id_reassigned` (`invalid_value`) | reassignment across exports (the rule index shows it) |
| LAW-02 | `law_valid` (an EU ELI with `consolidated_eli`, and a national provision with `url`) | `law_provision_unchecked`, `law_eli_malformed`, `law_consolidated_eli_malformed` (`provision_unchecked`) | |
| LAW-03 | every `*_valid` case | `law_citation_missing` (`provision_unchecked`) | that the citation matches the provision |
| LAW-04 | every `*_valid` case | `law_rule_set_undigested` (`provision_unchecked`) | the rule page and the approval record |
| LAW-05 | `law_valid` (`caller_asserted_provision` kept apart) | `law_caller_asserted_presented_as_checked` (`provision_unchecked`) | |
| LAW-06 | every `*_valid` case (records with empty `rules_fired` carry `rule_set`) | `law_rule_set_missing_no_rule_fired` (`required_field_missing`) | |
| LAW-07 | `rights_valid` | `rights_legal_basis_missing` (`required_field_missing`), `rights_legal_basis_unchecked` (`provision_unchecked`), `rights_art22_exception_invalid` (`invalid_value`) | whether Article 22 applies |
| LAW-08 | every `*_valid` case; `law_valid` (`annex_iii_point`) | `law_purpose_ref_missing` (`required_field_missing`) | whether the system is listed in Annex III |

## Chain and anchor (CHN, ANC)

| Rule | Positive | Negative | Producer-attested part |
|---|---|---|---|
| CHN-01 | `chain_valid` | `chain_gap_mid` (`sequence_gap`), `chain_duplicate_seq` (`sequence_duplicate`), `chain_link_break`, `interactions_reorder` (`link_break`) | |
| CHN-02 | `chain_valid` | `chain_hash_mismatch`, `interactions_edit_and_truncation` (`hash_mismatch`), `chain_alg_wrong` (`invalid_value`) | |
| CHN-03 | `chain_valid` | `chain_unchained_after_start` (`unchained_after_chain_start`) | a single writer in one transaction |
| CHN-04 | `chain_valid` | `chain_backdated`, `interactions_reorder` (`backdated`) | |
| CHN-05 | `export_valid` (`signatures` declared) | `export_signature_undeclared` (`required_field_missing`) | the signature itself, which the account checks with its own key; a qualified seal |
| ANC-01 | `anchor_valid` and every other `*_valid` case | `anchor_mismatch` (`anchor_mismatch`), `anchor_tail_truncated` (`truncated_tail`), `anchor_statement_carries_commitment` (`content_present`), `anchor_missing` (`no_anchor`), `anchor_tail_unanchored` (`unanchored_tail`) | the cadence |
| ANC-02 | `anchor_valid` and every other `*_valid` case (real RFC 3161 tokens) | `anchor_token_parse` (`anchor_token_parse`), `anchor_token_status_rejected`, `anchor_token_status_expired_signer` (`anchor_token_status`), `anchor_token_imprint` (`anchor_token_imprint`), `anchor_token_signature` (`anchor_token_signature`), `anchor_token_untrusted_root` (`anchor_token_trust`), `anchor_no_trust_anchors` (verdict `refused`) | that the pinned anchor comes from an EU trusted list (the vectors pin a test root) |
| ANC-03 | | | producer-attested: the write-once store and the certificate chains |
| ANC-05 | `record_valid` (`logging_failure` with `failure_kind: anchor_failed`) | `record_logging_failure_kind_missing` (`required_field_missing`) | the alarm and the retry |

## Commitments and pseudonyms (CMT)

| Rule | Positive | Negative | Producer-attested part |
|---|---|---|---|
| CMT-01 | every `*_valid` case (`alg: hmac-sha256-1`) | `record_commitment_unkeyed` (`invalid_value`) | that the value was computed with the account key |
| CMT-02 | every `*_valid` case (`p1:` form); `profile_valid` (both domain tags) | `record_person_in_clear` (`person_in_clear`), `profile_domains_overlap` (`invalid_value`) | that the stated tags are the ones the keyed function uses |
| CMT-03 | | | producer-attested: key entropy, storage and interfaces |
| CMT-04 | every `*_valid` case | `record_commitment_key_version_missing` (`required_field_missing`), `record_person_key_version_missing` (`person_in_clear`) | rotation |
| CMT-05 | `profile_valid` (`copies`) | `profile_copies_incomplete` (`required_field_missing`) | that a destruction in fact completes in every copy by the stated day |
| CMT-06 | `profile_valid` (`verification_interface_url`) | `profile_field_missing` (`required_field_missing`) | that the interface answers and neither stores nor logs the text |

## Oversight (OVS)

| Rule | Positive | Negative | Producer-attested part |
|---|---|---|---|
| OVS-01 | `oversight_valid` (`accepted`, `overridden` with `outcome_ref`, `stopped`, `verified`) | `oversight_field_missing`, `oversight_outcome_ref_missing` (`required_field_missing`), `oversight_action_invalid` (`invalid_value`), `oversight_reviewer_in_clear` (`person_in_clear`) | that the reviewer held the authority named |
| OVS-02 | `oversight_valid` | `oversight_merged_into_decision`, `oversight_proposal_not_decision` (`invalid_value`), `oversight_proposal_unresolved` (`reference_unresolved`, verdict `unverified`), `interactions_unresolved_and_invalid` (both) | |
| OVS-03 | `oversight_valid` (identification, two verifications, then the acting record) | `oversight_dual_verification_missing`, `oversight_dual_verification_same_reviewer` (`dual_verification_missing`) | whether Article 14(5) applies (`annex_iii_point`) |
| OVS-04 | `oversight_valid` (`decision_mode: human`, `human_decider`) | `oversight_human_decider_missing` (`required_field_missing`) | whether the law reserves the decision to a human |
| OVS-05 | `oversight_valid` (aggregate counts), `oversight_reviewer_rates_for_evaluation` (per-reviewer counts under `export_purpose: oversight_evaluation`) | `oversight_reviewer_rates_exposed` (`reviewer_rates_exposed`) | interfaces other than the export |

## Rights (RGT)

| Rule | Positive | Negative | Producer-attested part |
|---|---|---|---|
| RGT-01 | `rights_valid` | `rights_decision_mode_missing` (`required_field_missing`), `rights_decision_mode_invalid` (`invalid_value`) | that the deployer's process set the value |
| RGT-02 | `rights_valid` (an employee with `workers_informed_at`) | `rights_notice_missing`, `rights_notice_given_incomplete`, `rights_employee_workers_not_informed` (`required_field_missing`) | that the notice was in fact given |
| RGT-03 | `rights_valid` (a request and a rectified answer) | `rights_contest_response_incomplete`, `rights_contest_rectified_without_date` (`required_field_missing`), `rights_contest_unresolved` (`reference_unresolved`) | |
| RGT-04 | `rights_valid` | `rights_explanation_inputs_missing`, `rights_explanation_incomplete` (`required_field_missing`), `rights_explanation_factor_value` (`invalid_value`) | capture at decision time |
| RGT-05 | `rights_valid` | `rights_withheld_without_escrow` (`required_field_missing`) | |
| RGT-06 | `rights_valid` | `rights_incident_incomplete` (`required_field_missing`) | |
| RGT-07 | `rights_valid` | `rights_notice_record_incomplete` (`required_field_missing`), `rights_notice_kind_invalid` (`invalid_value`) | |

## Export and verification (EXP)

| Rule | Positive | Negative | Producer-attested part |
|---|---|---|---|
| EXP-01 | every `*_valid` case | `export_envelope_field_missing`, `export_clock_source_incomplete` (`required_field_missing`), `export_chain_summary_misstated`, `anchor_coverage_misstated`, `export_rulebook_wrong` (`invalid_value`) | |
| EXP-02 | `chain_valid` | `chain_pre_chain_labelled`, `interactions_pre_chain_and_unanchored_tail` (`pre_chain`, verdict never `verified`) | |
| EXP-03 | | | verifier property: the reference verifier runs offline on the export, the pinned trust anchors and OpenSSL; no vector can show it |
| EXP-04 | every case (verdict and named findings) | every negative case above | |
| EXP-05 | every `*_valid` case (the export stays content-free) | `export_content_in_envelope` (`content_present`) | the attachment and its check against the commitments (CMT-06) |

## Profiles (PRF)

| Rule | Status |
|---|---|
| PRF-01 | `profile_valid`; negatives `profile_field_missing` (`required_field_missing`), `profile_event_type_unlisted`, `profile_reason_code_unlisted`, `profile_clock_source_differs`, `profile_producer_differs` (`profile_mismatch`); attested: that the profile is true |
| PRF-03 | producer-attested: a claim is reproduced by a third party from the vectors and the profile |

## Counting

- Positive and negative (57): REC-01 to REC-08, REC-10 to REC-20, LAW-01 to LAW-08, CHN-01 to CHN-05, ANC-01, ANC-02, ANC-05, CMT-01, CMT-02, CMT-04 to CMT-06, OVS-01 to OVS-05, RGT-01 to RGT-07, EXP-01, EXP-02, EXP-04, EXP-05, PRF-01.
- Attested (5): REC-09, ANC-03, CMT-03 (the producer); EXP-03 (the verifier); PRF-03 (the third party who reproduces a claim).

A rule with a negative case may still have parts that only the producer can attest; the tables name them.

## Citations verified (October 2026)

The legal citations in SPEC.md were checked against the official texts on 15 October 2026, fetched from the Publications Office of the European Union (`http://publications.europa.eu/resource/celex/<CELEX>`, the same documents EUR-Lex serves at `https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:<CELEX>`). Standards, guidance and national sources (NIST, ISAE, IDW, ETSI, BSI, BaFin, AESIA, EDPB, WP29, CNIL, BetrVG, KI-MIG, Logius, the Danish agency) were not re-checked and are cited as before.

Corrected in this version:

| Was | Now | Why | Source (CELEX) |
|---|---|---|---|
| PLD called "Regulation (EU) 2024/2853" (NOTICE.md) | Directive (EU) 2024/2853 | the act is a Directive | 32024L2853 |
| AI Act Art 74(12) for access to logs (REC-12 and export rows) | Art 21(2) only | 74(12) covers documentation and data sets, not logs | 32024R1689 |
| CHN-05 "presumption of origin under Art 35(2) or Article 45l" | Art 35(2), qualified electronic seal only; Art 45k(2) named as qualified ledgers only | 45l sets requirements for qualified ledgers; 45k(2) presumes order and integrity for qualified ledgers only; 35(2) applies to qualified seals | 02014R0910-20241018 |
| Chain row: eIDAS "Art 45k(2), 45l" and AI Act "Art 73(6)" | Art 45k(2) with the qualified-ledger limit; 73(6) dropped from the chain row (kept for `deciding_system`) | 73(6) bars altering the AI system during an incident investigation, not the logs | 02014R0910-20241018, 32024R1689 |
| RGT-02 and notice row: PWD Art 11(1) | PWD Art 9(1) and 9(3) | Art 11 is human review; the duty to inform is Art 9 | 32024L2831 |
| `decision_mode` row: PWD Art 11(1) | PWD Art 9(1)(b)(ii) | Art 9(1)(b)(ii) names the decisions taken or supported by the systems | 32024L2831 |
| Clock row: "RTS 6 (2017/589) Annex II" | RTS 25, Delegated Regulation (EU) 2017/574, Arts 1-4 | Annex II of 2017/589 is the order-record format; clock synchronisation is RTS 25 | 32017R0589, 32017R0574 |
| Retention row: "RTS 6 Art 28 (5 years)" | Art 28(3), high-frequency trading order records | the five-year duty is in paragraph 3 and covers HFT firms | 32017R0589 |
| `legal_basis` row: CCD Art 18(8) | dropped | 18(8) is the right to human intervention, not a legal basis; it stays on the contest row | 32023L2225 |
| Notice row: CCD Art 18(9), Art 13 | same articles, with their scope: 18(9) on rejection after an automated assessment, 13 for personalised offers | narrower than the row implied | 32023L2225 |
| Clock row: AI Act Art 12(3)(a) | same, scoped to start and end of each use, remote biometric identification | 12(3) covers Annex III point 1(a) systems only | 32024R1689 |

Checked and correct as cited:

| Citation | Source (CELEX) |
|---|---|
| AI Act Arts 3(49), 6(3), 12(1), 12(2)(a)-(c), 12(3)(c)-(d), 13(3)(b)(iv), 13(3)(f), 14(4)(b), 14(4)(d)-(e), 14(5), 19(1), 21(2), 26(2), 26(5), 26(6), 26(7), 26(11), 73(6) (for `deciding_system`), 86(1), Annex IV 1(a) and 1(c), Recital 71 | 32024R1689 |
| eIDAS Art 35(2), 41(2), 45l(1)(b) as a requirement for qualified ledgers | 02014R0910-20241018 |
| Implementing Regulation (EU) 2025/1929 (qualified time stamps) | 32025R1929 |
| Implementing Regulation (EU) 2025/2531, REQ-7.5-03 (qualified electronic ledgers) | 32025R2531 |
| Regulation (EU) 2026/1744 (inserts AI Act Art 4a, replaces Art 72(3)) | 32026R1744 |
| PLD Arts 9 (disclosure of evidence) and 10 (burden of proof) | 32024L2853 |
| GDPR Arts 15(1)(b), 15(1)(h), 15(3), 15(4), 17(3)(b), 17(3)(e), 22(2)(a)-(c), 22(3), 22(4), 25(1), 30(1)(b), (c), (f), 32(1)(a)-(b) | 32016R0679 |
| PWD Arts 7, 9(1)(b)(iii), 10(1), 10(2), 10(4), 10(5), 11(2)-(3) | 32024L2831 |
| CCD Art 18(8)(c), Recital 56 | 32023L2225 |
| DORA RTS (Delegated Regulation (EU) 2024/1774) Art 12(2)(a), (c), (d), (e), (f), Art 23(3), 23(4)(a)-(b) | 32024R1774 |
| NIS2 Implementing Regulation (EU) 2024/2690, Annex points 3.2.3, 3.2.3(k), 3.2.5, 3.2.6 | 32024R2690 |
| CRA (Regulation (EU) 2024/2847) Annex I Part I (2)(l) | 32024R2847 |
| MiFID II (Directive 2014/65/EU) Art 16(7) | 32014L0065 |
| CJEU C-203/22 paras 59, 61, 62, 63 and operative points 1 and 2 | 62022CJ0203 |
| CJEU C-634/21 para 66 and operative part | 62021CJ0634 |

EUR-Lex refused automated fetching from the tooling used; no citation above rests on memory.