docs(cac): publish CAC Certification Specification v1.0 and quickstart

[BrianCLong]

Motivation

• Formalize Cognitive Admissibility as an external, normative certification standard that is implementable by vendors, auditors, and regulators.
• Freeze the determinism/evidence contract for decision pipelines so admissibility checks can be enforced in CI and used as procurement/audit criteria.
• Provide a clear, machine-executable evaluation protocol and artifact schemas to enable automated certification and revocation semantics.

Description

• Add docs/cac/CAC_SPEC_v1.md, a standards-grade specification (RFC-style) defining Abstract, Definitions, System Requirements, CACert requirements, Evaluation Protocol, normative JSON Schemas (report.json, metrics.json, decision_trace.json, failure_case.json, cacert.json), CI/CD enforcement checks, security considerations, governance model, conformance levels, and appendix examples.
• Add docs/cac/CAC_QUICKSTART.md, a minimal implementation guide listing required deterministic artifacts, CI gate contract, determinism rules, and the path to Level 3 (full CAC) compliance.
• Specify mandatory CI checks (admissibility_check, reproducibility_check, evidence_integrity_check), binary PASS/FAIL CACert semantics, revocation conditions, and a maximum certificate validity of 365 days.
• Commit and prepare PR payload: files created and committed as docs(cac): publish CAC Certification Specification v1.0 and PR metadata included for review and integration into Summit quality gates.

Testing

• No automated unit or integration tests were executed because this change is documentation-only; the commit and file creation succeeded.
• The specification defines the automated checks that must be implemented in CI (admissibility_check, reproducibility_check, evidence_integrity_check) and those checks are the required automated tests for future implementation and certification runs.
• Recommend running the repository standard validation (for implementation artifacts) such as pnpm test and make golden-path after implementing the enforcement tooling described in the spec.

---

Codex Task

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[coderabbitai]

Warning

Rate limit exceeded

@BrianCLong has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 5 minutes and 37 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 5 minutes and 37 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 210e4235-06b8-40bb-9c6c-8f03c03cb18e

📥 Commits

Reviewing files that changed from the base of the PR and between ff4ddf6 and b32bfbb.

📒 Files selected for processing (2)

• docs/cac/CAC_QUICKSTART.md
• docs/cac/CAC_SPEC_v1.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/generate-cac-certification-specification-v1.0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b32bfbbcd0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep CACert verdict enum binary

Section 4.1 defines CACert verdicts as strictly PASS/FAIL (line 89), but the normative cacert.json schema permits REVOKED, which creates a spec contradiction that can split implementations and CI validators on what constitutes a valid certificate state. Align the schema and normative text (e.g., model revocation in a separate status field or separate revocation record) so conformance checks are unambiguous.

Useful? React with 👍 / 👎.