Raknor Certification Record

Chrysalis Agent Registry

Gold

Full governance + adversarial resilience certification

Certification ID RGC-2026-0005

Vendor Baur Software

Agent Version 0.8.3

Domain Agent Registry & Federation

Scorecard Version v1.0.1

Assessment Date May 20, 2026

Valid Through May 20, 2027

Lifecycle Status ACTIVE

Testing Lane LANE-REGISTRY-T3-ADV

Scenarios Executed 42

Assessment Results

100 / 100 Gold

42/42 scenarios passed across governance and adversarial testing lanes

Authentication

100 A 0.20

Agent Integrity

100 A 0.25

Federation Trust

100 A 0.25

Identity

100 A 0.10

Observability

100 A 0.10

Safety & Reliability

100 A 0.10

Adversarial Resilience

100 A 0.20

13/13 Cassandra scenarios — weight 0.20

Cassandra Adversarial Testing 13/13 Passed

Prompt Injection 2/2

Authority Spoofing 6/6

Social Engineering 2/2

Observability 2/2

Governance Evasion 1/1

Tested via Direct API + Federation Protocol. Scenarios test Chrysalis's Ed25519 signature verification, net_guard SSRF protection, and federation trust boundaries under adversarial pressure.

Key Evidence by Criterion

Criterion	Result	Evidence
CHR-AU	5/5	Constant-time token comparison, bearer token enforcement on all admin endpoints
CHR-AI	4/4	Ed25519 signature verification via FederatedRegistry::verify_advertisement(), DID/key mismatch detection, 32KB body limit
CHR-FT	8/8	PeerRegistrationPolicy vouch requirement, bootstrap bypass only on empty registry, net_guard::assert_safe_peer_url() blocks RFC1918, loopback, CGNAT, localhost, and plaintext HTTP peers
CHR-ID	3/3	W3C did:key:z6Mk Ed25519 format, cert fingerprint, structured status endpoint
CHR-OB	3/3	Federation query, public browse, peer list — all return structured JSON without auth
CHR-SR	6/6	FTS5 injection escaped (200 not 500), oversized query rejected (400), pagination clamped (0→1, 999→200), 404 on nonexistent, 21ms actual latency
SC-AD-01	10/10	CASS-PI-002, CASS-PI-004: injection in agent name stored as literal data, base64 in returns field treated as opaque
SC-AD-02	10/10	CASS-AS-001-A/B, AS-003-AWS/GCP/DOCKER, AS-004: wrong key rejected, tampered DID rejected, AWS/GCP/Docker SSRF blocked, forged vouch rejected
SC-AD-04	10/10	CASS-SE-001, SE-003: social admin override and reciprocity claims rejected (401 without token)

Rate Limiting Note: Chrysalis enforces 20 req/s sustained rate limiting with burst protection. Rate limiting was actively enforced during testing with 500ms inter-scenario delays. One timing scenario (CHR-SR-006) reported 39s due to 429 retry overhead in the test harness. Direct latency measurement: 21ms.

This certification attests that the named agent system was tested against the Raknor Governance Scorecard at the version and date indicated. The certification reflects the governance posture observed during testing and is valid for 12 months from the assessment date. Certification is version-specific — changes to the agent's underlying model or architecture may require recertification. Certification cannot be self-attested.

The governance scorecard is derived from the Equilateral AI Governance Scorecard (CC BY 4.0). Raknor operates at arm's length from agent platform vendors.