panda-rpki-oss/docs/conformance-matrix.md

v0.1.0 conformance matrix

Unreleased additions

Behaviour	Standard reference	Implementation	Evidence
Detect changed hashes for overlapping delta serials within a session, warn and recover with a snapshot	RFC 9697 §§3–5	src/repository/sync/rrdp/, src/repository/storage/models_summary.rs	tests_parts/desynchronization.rs; tests/security_recovery_e2e.rs
Choose between valid fetched and cached TA certificates by later notBefore, earlier notAfter, then freshly fetched	TA tiebreaker draft -06 §2	src/cli/anchors.rs	anchors_tiebreaker_tests.rs; tests/security_recovery_e2e.rs

The RRDP hash window is the last successfully processed notification's delta references, retained across restarts. An old database without this window learns it on its next successful sync. Failed recovery keeps the previous baseline. No historical delta download is required for comparison. TA selection compares revalidated DER certificates; fixed TA inputs retain their explicit selection. The tiebreaker is a draft implementation. Failed-refresh fallback still follows ta-refresh-policy; see configuration.

Released v0.1.0 baseline

Behaviour	Standard reference	Implementation	Evidence
TAL syntax and TA public-key binding	RFC 8630 §2	src/validation/from_tal.rs, src/model/ta.rs	parser and synthetic integration tests
TA and issued CA profile/signature/resource checks	RFC 6487 §4	src/validation/, src/model/	profile unit tests and synthetic integration tests
Manifest profile, file hashes, and freshness checks	RFC 9286 §§4, 6	src/model/manifest.rs, src/validation/manifest.rs	manifest profile and validation unit tests
CRL profile and freshness checks	RFC 6487 §5	src/model/crl.rs, src/validation/	CRL profile and validation tests
ROA profile and payload checks	RFC 9582 §§3–4	src/model/roa.rs, src/validation/	ROA profile tests and synthetic CSV assertions
ASPA profile and provider-list checks	draft-ietf-sidrops-aspa-profile-21 §§2–4	src/model/aspa.rs, src/validation/	ASPA profile tests and synthetic VAP assertions
BGPsec router-certificate profile checks	RFC 8209 §3	src/model/router_cert.rs, src/validation/	router-certificate profile tests
CMS signed-object profile	RFC 6488 §§2–3; RFC 9589 §4	src/model/signed_object.rs	signed-object profile tests
RRDP notification, snapshot, delta/replace/withdraw and fallback	RFC 8182 §§3.4–3.5	src/repository/sync/rrdp.rs, src/repository/sync/repo.rs	snapshot/delta state-restart unit tests and synthetic Docker tests
RRDP direct-reference and redirect origin checks	RFC 9674 §3.2	src/repository/fetch/http.rs, src/repository/sync/rrdp.rs	cross-origin unit tests
Named TOML anchors with TAL/TA binding and aggregate output	RFC 8630 §2 for each TAL; aggregation is an implementation choice	src/cli/mod.rs, src/cli/validate.rs, src/runtime/	CLI parser checks and multi-TAL integration evidence
Bounded repository and object workers (default 8 each, shared across TALs)	operational support for the standard validation pipeline	src/scheduler/, src/runtime/	worker-pool unit tests
Resumable RRDP protocol state	RFC 8182 §3.4	src/repository/storage/, src/repository/sync/rrdp.rs	atomic state index and restart delta test
CCR manifest, ROA, ASPA, trust-anchor and router-key states	draft-ietf-sidrops-rpki-ccr-11 §§2–4	src/ccr/	encode/decode tests and integration artifacts
TA Constraints rule normalization and EE resource checks	draft-ietf-sidrops-constraining-rpki-trust-anchors-01 §§3–4	src/ta_constraints.rs, src/validation/	parser/normalization tests; constrained validation E2E
VRP CSV output	RFC 6810 data semantics	src/cli/validate.rs, src/runtime/	self-contained Docker E2E CSV/summary assertions

References identify the implemented profiles, not a certification of complete RFC compliance. Draft revisions are intentionally explicit and are not claims of compatibility with later revisions. The CLI uses HTTPS RRDP, requires local TALs, supports fixed or automatically refreshed TA certificates, and does not provide RTR. TAL files themselves are not automatically updated. CCR tests establish encoding and payload consistency, not independent revalidation of the entire trust chain by another relying party.

The worker pool and interval index are implementation mechanisms, not new wire protocols; their tests must also prove deterministic output and unchanged validation decisions. Only the released baseline table is in v0.1.0 scope. Adding a new source file or protocol feature requires a new row with a document revision, section, test, and reviewer decision.