Public assurance reports
Evidence, findings, limitations and disposition.
Released DDCAL reports identify the exact assessment target and claim, retain adverse and unresolved findings, state limitations and uncertainty, and link to public evidence where publication authority permits.
Report boundary: A public report is evidence of the assessment described in that report. It is not accreditation, certification, a guarantee of future versions, or authority to generalize beyond its stated scope.
Released
DDCAL-PA-001
First public worked assessment — an external public target with positive evidence and material adverse findings retained.
Microsoft Agent Framework — FIDES security subsystem
Target commit: edfe115ea06bca57ae5a123d0fac5b3fdda13603
Disposition: Claim partially supported — material adverse findings.
The assessment reproduced expected blocking and confidentiality controls, plus a fail-open path when required security context is absent and a configuration-sensitive integrity-override boundary.
Reproducibility
Exact targets, not moving branches.
Reports bind conclusions to immutable target revisions so later changes cannot silently alter what was assessed.
Protected method boundary
Transparent evidence without exposing the DDC engine.
Public reports expose the claim, evidence basis, findings and limitations needed to evaluate the conclusion. Proprietary DDC implementation details remain outside the public boundary.