WIA Augmentation Safety standard

Conformance tiers

Implementations declare their conformance tier in the OpenAPI document via the x-wia-conformance-tier extension field. Three tiers are defined:

• Surface — accepted data formats; self-attested.
• Verified — annual third-party audit against the four PHASE documents.
• Anchored — continuous evidence package per Annex G; SBOM signed (CycloneDX 1.5 + Sigstore).

Standard documents

• PHASE 1 — Data Format
• PHASE 2 — API Interface
• PHASE 3 — Protocol
• PHASE 4 — Integration

Reference SDK: api/typescript/ · CLI tool: cli/augmentation-safety.sh · Press kit: press/.

Reference standards

This standard cites only ALLOW sources per the WIA citation policy: ISO/IEC, IEEE, RFC, W3C, and equivalent industry-recognized standards bodies. Schemas use JSON Schema 2020-12 and OpenAPI 3.1. Signatures use Sigstore (DSSE envelope, Rekor transparency log).

Versioning and deprecation

Implementations follow Semantic Versioning 2.0.0. Major version bumps require at least a 90-day overlap with the prior major version on every WIA-published reference implementation. Patch releases are editorial only.

Open governance

Issues and proposals are tracked at github.com/WIA-Official/wia-standards/issues with the augmentation-safety label. The WIA Standards working group reviews open issues at the start of every minor release cycle and publishes the resulting decision log alongside the release notes.

Implementation guide

Identity

Every implementation publishes a manifest containing a stable slug, a build digest (commit SHA or container image digest), and a link to the SBOM (CycloneDX 1.5 or SPDX 2.3). The manifest is signed using Sigstore (DSSE envelope) and the signing key is rotated per the deployment policy.

Conformance evidence

Conformance evidence consists of the test vector matrix (positive + negative vectors per normative requirement), the OpenAPI document checksum, and a signed manifest. Vendors publish the evidence bundle quarterly even when no source change has occurred so that consumers can detect environmental drift.

Profiles

Implementations declare an interoperability profile (e.g., single-tenant, multi-tenant, federated, air-gapped) in the manifest. Profiles are versioned with the same Semantic Versioning rules as the standard itself.

Negative-result reporting

Implementations MUST report negative results with the same fidelity as positive ones. A test that is skipped without a recorded justification is treated by auditors as a failure.

Schema evolution

Additive changes (new optional fields, new error codes) are non-breaking and require a minor version bump. Renaming or removing fields, even in error payloads, MUST trigger a major version bump and the deprecation procedure described in Annex H.

Audit retention

A 7-year retention window is sufficient to satisfy ISO/IEC 17065:2012 audit expectations in most jurisdictions. Some regulators require longer retention; in that case the deployment policy MUST extend the retention window rather than relying on the defaults.

Time synchronization

Sub-second deadlines depend on synchronized clocks. NTPv4 with stratum-2 servers is sufficient for most deadlines; PTP is recommended for sites that require deterministic interlocks.

Reference topology

The reference implementation topologies validated by the WIA Standards working group are: single-tenant edge, multi-tenant gateway, federated mesh, and air-gapped batch. Each topology ships with reference test vectors so that implementations can validate their deployment matches the canonical pattern. A topology change MUST be reflected in a new manifest signature; the prior topology's manifest remains valid for the deprecation window described in Annex H to preserve audit traceability.