IQ and OQ Outline (draft)
Goal: Have a starting point for your own installation and operational qualification of signing.
NOTE
Draft
This is an outline, not a script to sign off as it stands. Your QA writes the scripts, runs them on your workspace, your app and your login system, and decides what counts. Steps marked coming cannot be run until that part is built. Performance qualification, your process in daily use, is yours alone.
Installation qualification (IQ)
Confirm the workspace is set up as your validation says. Keep a screenshot or an API answer for each step.
| # | Confirm | Where | Pass |
|---|---|---|---|
| IQ-1 | The OpenX release under test | The change notices | The release and its notice are recorded in your validation file |
| IQ-2 | Provenance is provisioned in your subscription, in the region you chose | Environment -> Provenance | The badge reads Protected or Locked, as your validation says |
| IQ-3 | Retention periods and their basis | Environment -> Provenance | Each period and basis matches your records policy |
| IQ-4 | The storage level | Environment -> Provenance, Storage level | Locked, or Protected with a recorded reason |
| IQ-5 | Your login system is set up for the app | Environment -> App Identity | The directory your validation names is Configured |
| IQ-6 | The sign route is open only to that login system | API Manager access rules | A rule admits your login system on the sign route and no other |
| IQ-7 | Signers hold the sign right | Access configurations | Each signer holds Workspace.Provenance.Sign; no one else does |
| IQ-8 | The workspace's signature meanings | GET /ox-api/provenance/signature-meanings | The list matches your procedures |
| IQ-9 | The two-person rule, where you use it | The workspace's Provenance policy (set by an accepted proposal) | Set as your validation says |
| IQ-10 | The proof setting (coming) | Environment -> Provenance | The default and any stricter meanings match your validation |
| IQ-11 | Signature events, if you use them (coming) | Environment -> Provenance -> Signature events | Your HTTPS address is subscribed to the events you chose |
Operational qualification (OQ)
Run each case on a workspace whose records you are content to keep: a signature is permanent. Record the request, the answer and the record written (or that none was).
Your login system
| # | Run | Pass |
|---|---|---|
| OQ-1 | Start a signing login while already signed in | The login system asks for the password again. This is the step OpenX cannot check for you |
| OQ-2 | Read the ID token's claims after the forced login (claims only; never keep the whole token) | It carries the person's name, a login time that moved, and the nonce your app sent |
Signing (coming, wave 1)
| # | Run | Pass |
|---|---|---|
| OQ-3 | Sign a record with a login made for it (Nonce form) | One signature is written with the printed name, meaning, time, proof form and login time |
| OQ-4 | Post the same login again | Refused LOGIN_ALREADY_USED; nothing written |
| OQ-5 | Post a login made for record A to record B, or for Review as Approval | Refused LOGIN_NOT_FOR_THIS_RECORD; nothing written |
| OQ-6 | Post a login older than the freshness window | Refused LOGIN_TOO_OLD; nothing written |
| OQ-7 | Post another person's login | Refused LOGIN_NOT_THE_SIGNER; nothing written |
| OQ-8 | At a write-first site, sign with a challenge (Challenge form); then reuse the challenge | The first lands; the second is refused CHALLENGE_SPENT |
| OQ-9 | Sign three listed records in one batch; then change one record and try again | The first lands all three; the second writes nothing |
| OQ-10 | Look for each refusal above in the record | Each refusal is recorded once, with who, code, meaning and target |
Built today
| # | Run | Pass |
|---|---|---|
| OQ-11 | Sign with a digest that is not the record's current digest | Refused with 409; nothing written |
| OQ-12 | Sign with a meaning not on the list | Refused with 400; nothing written |
| OQ-13 | With the two-person rule on, sign the same ceremony twice as one person | Refused TWO_PERSON_SAME_SIGNER; nothing written |
| OQ-14 | Sign as a person without Workspace.Provenance.Sign | Refused ACCESS_RIGHT_REQUIRED; nothing written |
| OQ-15 | Read the signatures of a record | Each reads LinkCheck Intact with a Valid seal |
| OQ-16 | Export signatures as CSV and as JSON | Both carry the signature columns and the digest footer |
Evidence and checking (coming)
| # | Run | Pass |
|---|---|---|
| OQ-17 | Open a ceremony's certificate | Each signer's name, title, meaning, time with its zone, record, digest, link status and seal verdict are shown as text |
| OQ-18 | Run the verify tool on an export, with no network | Every signature reads Valid |
| OQ-19 | Change one byte in a copy of the export and run it again | That signature reads Changed |
| OQ-20 | Sign with events subscribed | One Signed event arrives, and its HMAC-SHA256 checks with your secret |
| OQ-21 | Sign as a job, an app or an AI call (wave 3) | Refused SIGNER_NOT_A_PERSON with its reason; nothing written |
Next steps
- Each control and its automated tests -> Trace
- What changed in this release -> Change notices