Appendix G Verification Tiers and Oracles

The edition uses a small set of labels consistently. They describe what was established; they are not interchangeable synonyms for “supported.”

“Test exists”, “test was registered”, “test ran”, and “oracle discriminated” are four separate statements. A skipped test is not a pass, a dry-run mutation is not a killed mutation, and an uploaded log is useful only when it identifies the binary, configuration, host, and observation that produced it.

For API shape, CNA’s policy names Microsoft XNA reference assemblies/XML as the target surface; xna4-spec is a searchable converted documentation corpus, not a live CNA gate and not an infallible substitute for the original assembly. For behavior, CNA’s checklist names FNA as the ordinary reference, while real XNA, a format specification, or a renderer API can outrank it for a narrower question. A project-authored expected value is an oracle only when its derivation is reviewable and independent of the code under test.

A useful renderer result records all of the following fields. Omitting one often changes the meaning of the claim.

This vector distinguishes, for example, a MinGW binary running through Wine and DXVK from a native MSVC/Direct3D run; a browser page loaded from an HTTP server from one opened as a local file; an Android APK that installs and presents a frame from its selected renderer; and an iOS source path from an actual signed device build. Those are all useful milestones, but they are not synonyms.

The tag contains 21 workflow files: 19 react to push or pull-request events, usually under path filters, and the Direct3D/GDI routes are dispatch-only. New source-level gates cover compatible native and Emscripten multi-renderer sets, platform/audio tuples, glTF, TinyGL, NanoVG, Apple and five C API records. The records do not build the final C library; a local exact-tag build reaches the adapter’s 49-versus-50 renderer-identity invariant and stops. Three automatic general/Input legs still stop during configuration because they pass the retired family token EASYGL instead of a public selector. Sanitizer, mutation, fuzz-named, and validation mechanisms exist, but their mere presence does not prove a tag workflow ran or enlarge the set of engaged routes. Chapter 73 is the dated path-by-path account.

The safe summary at this pin is therefore neither “CI absent” nor “CI complete”. Automatic browser harnesses, a Devices UBSan route, platform-specific jobs, and several narrow gates are declared; dead configure legs, dispatch-only Windows coverage, no code-coverage measurement, no continuous coverage-guided fuzzer, and a Direct2D mutation dry-run remain real too.

Before writing “works”, write a narrower sentence that answers six questions:

1. 1.

   What exact subject and revision were examined?

2. 2.

   Which build, renderer, platform, and host actually engaged?

3. 3.

   Where was behavior observed—return value, trace, readback, frame, file, or peer?

4. 4.

   What independent authority supplied the expected result?

5. 5.

   Which negative or perturbed case proves the check can fail?

6. 6.

   What artifact lets the next auditor reproduce or falsify the claim?

A claim that cannot yet answer all six can still be useful. Label it source-proven, compile-proven, runtime-observed, renderer-engaged, oracle-compared, pixel-verified, manually observed, historically recorded, blocked, unsupported, or not attempted. Do not silently promote one state to behavioral parity.