CEDARtools.Forge assurance boundary

CEDARtools.Forge separates generation from deterministic acceptance checks: what the gate can establish, what remains outside, what convergence means.

Last technically reviewed 2026-08-16Evidence basis: Engineering analysis

That architecture removes one important self-grading path, but it does not make the complete development process self-verifying.

What the gate can establish

The gate can establish that the recorded artifacts satisfy the versioned checks encoded in the gate: successful builds, named tests, static rules, coverage thresholds, timing limits and other deterministic acceptance criteria.

What remains outside the gate

The gate cannot establish the correctness or completeness of unstated requirements, the adequacy of a faulty test oracle, the absence of a shared misconception, correct behavior in an omitted environment, or properties not represented by its observations and rules.

The deterministic gate blocks what its checks can see; the five failure classes around the loop are the reason human approval stays in the picture.

Required independence controls

Acceptance-policy ownership is separated from artifact generation. Changes to tests, thresholds and oracles are reviewed and versioned; the generator cannot modify them. Designated architectural, safety and security decisions require human approval. Independent analyses are used where common model or data dependencies could produce correlated errors. A run that does not enforce this separation is not described as independent verification.

Model and tool assurance

The assurance relevance of a model or agent depends on its role and on downstream error detection. Forge* records model/provider identity and the artifacts produced, but a project must still determine whether the model, gate and other tools require qualification, validation or compensating verification for the intended use.

Meaning of convergence

Convergence means that the named gate passed for the recorded requirements, artifacts and configuration. It is not a claim that every intended requirement was stated or that the complete system is defect-free.