{
  "tool_id": "art-387-pqc-deadline-ladder-calculator",
  "note": "golden_hash filled by golden-parity.test.mjs --update. Vectors 1-3 are the required boundary set: one day before, exactly on, and one day after the key_establishment_deadline (2030-12-31), same single row. Vector 4 covers the remaining branches (firmware exclusive-use deadline, existing-federal key-establishment ladder, a new NSS deployment landing after its own binding deadline, and an invalid date). Vector 5 is the zero-row finite-gate edge.",
  "vectors": [
    {
      "name": "key_establishment_boundary_day_before",
      "description": "reference_date is one day before the default key_establishment_deadline (2030-12-31): days_remaining=1, imminent, not past due.",
      "policy_parameters": {
        "reference_date": "2030-12-30",
        "inventory": [
          {
            "row_id": "KE-1",
            "system_class": "commercial-fin",
            "asset_type": "key-establishment",
            "deployment_date": "2024-01-01",
            "fips_140_2_certified": false
          }
        ]
      },
      "output_payload": {
        "reference_date": "2030-12-30",
        "rows": [
          {
            "row_id": "KE-1",
            "system_class": "commercial-fin",
            "asset_type": "key-establishment",
            "deployment_date": "2024-01-01",
            "applicable_deadline": "2030-12-31",
            "earliest_binding_constraint": "key_establishment_deadline",
            "days_remaining": 1,
            "fips_140_2_certified": false,
            "fips_140_2_historical_exposure": false,
            "flags": [
              "DEADLINE_IMMINENT"
            ]
          }
        ],
        "summary": {
          "row_count": 1,
          "past_due_count": 0,
          "imminent_count": 1,
          "fips_exposure_count": 0,
          "invalid_row_count": 0
        },
        "policy_deadlines_used": {
          "new_deployment_signing_deadline": {
            "date": "2027-01-01",
            "source": "NSA CNSSP-15 / CNSA 2.0 Advisory: new NSS deployments and exclusive-use software/firmware signing must adopt CNSA 2.0 by 2027-01-01."
          },
          "key_establishment_deadline": {
            "date": "2030-12-31",
            "source": "NSA CNSA 2.0 migration timeline: NSS key-establishment transition to be complete by 2030-12-31."
          },
          "signature_deadline": {
            "date": "2031-12-31",
            "source": "NSA CNSA 2.0 migration timeline: NSS signature transition to be complete by 2031-12-31."
          },
          "cnsa_exclusive_deadline": {
            "date": "2033-12-31",
            "source": "NSA CNSA 2.0 migration timeline: NSS systems CNSA-2.0-exclusive by 2033."
          },
          "fips_140_2_historical_date": {
            "date": "2026-09-21",
            "source": "NIST: FIPS 140-2 validated-module certificates move to the Historical list on 2026-09-21."
          }
        },
        "note": "DECISION-SUPPORT DRAFT, findings asserted. Not legal advice, not a compliance determination, not an audit. Computes what the declared deadlines imply for the supplied inventory only."
      },
      "compliance_flags": [
        "DEADLINE_IMMINENT"
      ],
      "golden_hash": "e60b21873f5c034a5c8820b5bbc08d9b350e57bbc8dc42f1ff6041e9ca5c7407"
    },
    {
      "name": "key_establishment_boundary_exact",
      "description": "reference_date lands exactly on the key_establishment_deadline: days_remaining=0, imminent (0 is within the window), not past due.",
      "policy_parameters": {
        "reference_date": "2030-12-31",
        "inventory": [
          {
            "row_id": "KE-1",
            "system_class": "commercial-fin",
            "asset_type": "key-establishment",
            "deployment_date": "2024-01-01",
            "fips_140_2_certified": false
          }
        ]
      },
      "output_payload": {
        "reference_date": "2030-12-31",
        "rows": [
          {
            "row_id": "KE-1",
            "system_class": "commercial-fin",
            "asset_type": "key-establishment",
            "deployment_date": "2024-01-01",
            "applicable_deadline": "2030-12-31",
            "earliest_binding_constraint": "key_establishment_deadline",
            "days_remaining": 0,
            "fips_140_2_certified": false,
            "fips_140_2_historical_exposure": false,
            "flags": [
              "DEADLINE_IMMINENT"
            ]
          }
        ],
        "summary": {
          "row_count": 1,
          "past_due_count": 0,
          "imminent_count": 1,
          "fips_exposure_count": 0,
          "invalid_row_count": 0
        },
        "policy_deadlines_used": {
          "new_deployment_signing_deadline": {
            "date": "2027-01-01",
            "source": "NSA CNSSP-15 / CNSA 2.0 Advisory: new NSS deployments and exclusive-use software/firmware signing must adopt CNSA 2.0 by 2027-01-01."
          },
          "key_establishment_deadline": {
            "date": "2030-12-31",
            "source": "NSA CNSA 2.0 migration timeline: NSS key-establishment transition to be complete by 2030-12-31."
          },
          "signature_deadline": {
            "date": "2031-12-31",
            "source": "NSA CNSA 2.0 migration timeline: NSS signature transition to be complete by 2031-12-31."
          },
          "cnsa_exclusive_deadline": {
            "date": "2033-12-31",
            "source": "NSA CNSA 2.0 migration timeline: NSS systems CNSA-2.0-exclusive by 2033."
          },
          "fips_140_2_historical_date": {
            "date": "2026-09-21",
            "source": "NIST: FIPS 140-2 validated-module certificates move to the Historical list on 2026-09-21."
          }
        },
        "note": "DECISION-SUPPORT DRAFT, findings asserted. Not legal advice, not a compliance determination, not an audit. Computes what the declared deadlines imply for the supplied inventory only."
      },
      "compliance_flags": [
        "DEADLINE_IMMINENT"
      ],
      "golden_hash": "bfd7f8e5a16000301adafe6764d1c2406e1c9093b2d25d90fb7a86f553e051a2"
    },
    {
      "name": "key_establishment_boundary_day_after",
      "description": "reference_date is one day past the key_establishment_deadline: days_remaining=-1, past due (this is the off-by-one case that matters on a compliance deadline).",
      "policy_parameters": {
        "reference_date": "2031-01-01",
        "inventory": [
          {
            "row_id": "KE-1",
            "system_class": "commercial-fin",
            "asset_type": "key-establishment",
            "deployment_date": "2024-01-01",
            "fips_140_2_certified": false
          }
        ]
      },
      "output_payload": {
        "reference_date": "2031-01-01",
        "rows": [
          {
            "row_id": "KE-1",
            "system_class": "commercial-fin",
            "asset_type": "key-establishment",
            "deployment_date": "2024-01-01",
            "applicable_deadline": "2030-12-31",
            "earliest_binding_constraint": "key_establishment_deadline",
            "days_remaining": -1,
            "fips_140_2_certified": false,
            "fips_140_2_historical_exposure": false,
            "flags": [
              "DEADLINE_PAST_DUE"
            ]
          }
        ],
        "summary": {
          "row_count": 1,
          "past_due_count": 1,
          "imminent_count": 0,
          "fips_exposure_count": 0,
          "invalid_row_count": 0
        },
        "policy_deadlines_used": {
          "new_deployment_signing_deadline": {
            "date": "2027-01-01",
            "source": "NSA CNSSP-15 / CNSA 2.0 Advisory: new NSS deployments and exclusive-use software/firmware signing must adopt CNSA 2.0 by 2027-01-01."
          },
          "key_establishment_deadline": {
            "date": "2030-12-31",
            "source": "NSA CNSA 2.0 migration timeline: NSS key-establishment transition to be complete by 2030-12-31."
          },
          "signature_deadline": {
            "date": "2031-12-31",
            "source": "NSA CNSA 2.0 migration timeline: NSS signature transition to be complete by 2031-12-31."
          },
          "cnsa_exclusive_deadline": {
            "date": "2033-12-31",
            "source": "NSA CNSA 2.0 migration timeline: NSS systems CNSA-2.0-exclusive by 2033."
          },
          "fips_140_2_historical_date": {
            "date": "2026-09-21",
            "source": "NIST: FIPS 140-2 validated-module certificates move to the Historical list on 2026-09-21."
          }
        },
        "note": "DECISION-SUPPORT DRAFT, findings asserted. Not legal advice, not a compliance determination, not an audit. Computes what the declared deadlines imply for the supplied inventory only."
      },
      "compliance_flags": [
        "DEADLINE_PAST_DUE"
      ],
      "golden_hash": "385783277c3a85157184db9481329754671947fa9a7582538c29247052f9fa33"
    },
    {
      "name": "branch_coverage_firmware_nss_fips_invalid",
      "description": "Four rows exercise the remaining branches: firmware always uses the exclusive-use signing deadline; an existing federal key-establishment system rides the ladder and is separately FIPS-140-2-exposed (reference_date is after the 2026-09-21 Historical-list transition); a new NSS signature deployment (deployment_date after reference_date) is held to the near-term new-deployment deadline rather than the later signature ladder, and that deadline has already passed relative to reference_date; a malformed deployment_date resolves to the finite gate (INVALID_DATE, no NaN).",
      "policy_parameters": {
        "reference_date": "2026-10-01",
        "inventory": [
          {
            "row_id": "FW-1",
            "system_class": "nss",
            "asset_type": "firmware",
            "deployment_date": "2020-01-01",
            "fips_140_2_certified": false
          },
          {
            "row_id": "KE-FED",
            "system_class": "federal",
            "asset_type": "key-establishment",
            "deployment_date": "2015-05-05",
            "fips_140_2_certified": true
          },
          {
            "row_id": "NSS-NEW-SIG",
            "system_class": "nss",
            "asset_type": "signature",
            "deployment_date": "2031-06-01",
            "fips_140_2_certified": false
          },
          {
            "row_id": "BAD-DATE",
            "system_class": "commercial-fin",
            "asset_type": "signature",
            "deployment_date": "not-a-date",
            "fips_140_2_certified": false
          }
        ]
      },
      "output_payload": {
        "reference_date": "2026-10-01",
        "rows": [
          {
            "row_id": "FW-1",
            "system_class": "nss",
            "asset_type": "firmware",
            "deployment_date": "2020-01-01",
            "applicable_deadline": "2027-01-01",
            "earliest_binding_constraint": "new_deployment_signing_deadline",
            "days_remaining": 92,
            "fips_140_2_certified": false,
            "fips_140_2_historical_exposure": false,
            "flags": [
              "DEADLINE_IMMINENT"
            ]
          },
          {
            "row_id": "KE-FED",
            "system_class": "federal",
            "asset_type": "key-establishment",
            "deployment_date": "2015-05-05",
            "applicable_deadline": "2030-12-31",
            "earliest_binding_constraint": "key_establishment_deadline",
            "days_remaining": 1552,
            "fips_140_2_certified": true,
            "fips_140_2_historical_exposure": true,
            "flags": [
              "FIPS_140_2_HISTORICAL_EXPOSURE"
            ]
          },
          {
            "row_id": "NSS-NEW-SIG",
            "system_class": "nss",
            "asset_type": "signature",
            "deployment_date": "2031-06-01",
            "applicable_deadline": "2027-01-01",
            "earliest_binding_constraint": "new_deployment_signing_deadline",
            "days_remaining": 92,
            "fips_140_2_certified": false,
            "fips_140_2_historical_exposure": false,
            "flags": [
              "DEADLINE_IMMINENT"
            ]
          },
          {
            "row_id": "BAD-DATE",
            "system_class": "commercial-fin",
            "asset_type": "signature",
            "deployment_date": "not-a-date",
            "applicable_deadline": null,
            "earliest_binding_constraint": null,
            "days_remaining": null,
            "fips_140_2_certified": false,
            "fips_140_2_historical_exposure": false,
            "flags": [
              "INVALID_DATE"
            ]
          }
        ],
        "summary": {
          "row_count": 4,
          "past_due_count": 0,
          "imminent_count": 2,
          "fips_exposure_count": 1,
          "invalid_row_count": 1
        },
        "policy_deadlines_used": {
          "new_deployment_signing_deadline": {
            "date": "2027-01-01",
            "source": "NSA CNSSP-15 / CNSA 2.0 Advisory: new NSS deployments and exclusive-use software/firmware signing must adopt CNSA 2.0 by 2027-01-01."
          },
          "key_establishment_deadline": {
            "date": "2030-12-31",
            "source": "NSA CNSA 2.0 migration timeline: NSS key-establishment transition to be complete by 2030-12-31."
          },
          "signature_deadline": {
            "date": "2031-12-31",
            "source": "NSA CNSA 2.0 migration timeline: NSS signature transition to be complete by 2031-12-31."
          },
          "cnsa_exclusive_deadline": {
            "date": "2033-12-31",
            "source": "NSA CNSA 2.0 migration timeline: NSS systems CNSA-2.0-exclusive by 2033."
          },
          "fips_140_2_historical_date": {
            "date": "2026-09-21",
            "source": "NIST: FIPS 140-2 validated-module certificates move to the Historical list on 2026-09-21."
          }
        },
        "note": "DECISION-SUPPORT DRAFT, findings asserted. Not legal advice, not a compliance determination, not an audit. Computes what the declared deadlines imply for the supplied inventory only."
      },
      "compliance_flags": [
        "DEADLINE_IMMINENT",
        "FIPS_140_2_HISTORICAL_EXPOSURE",
        "INVALID_DATE"
      ],
      "golden_hash": "ea2ee7b148333ed842a3f6e4c9cc7e2f4fe908f0a373ee906faba026b5f8da39"
    },
    {
      "name": "zero_row_edge",
      "description": "Empty inventory: finite gate holds, every summary counter is 0, not NaN or undefined.",
      "policy_parameters": {
        "reference_date": "2026-07-18",
        "inventory": []
      },
      "output_payload": {
        "reference_date": "2026-07-18",
        "rows": [],
        "summary": {
          "row_count": 0,
          "past_due_count": 0,
          "imminent_count": 0,
          "fips_exposure_count": 0,
          "invalid_row_count": 0
        },
        "policy_deadlines_used": {
          "new_deployment_signing_deadline": {
            "date": "2027-01-01",
            "source": "NSA CNSSP-15 / CNSA 2.0 Advisory: new NSS deployments and exclusive-use software/firmware signing must adopt CNSA 2.0 by 2027-01-01."
          },
          "key_establishment_deadline": {
            "date": "2030-12-31",
            "source": "NSA CNSA 2.0 migration timeline: NSS key-establishment transition to be complete by 2030-12-31."
          },
          "signature_deadline": {
            "date": "2031-12-31",
            "source": "NSA CNSA 2.0 migration timeline: NSS signature transition to be complete by 2031-12-31."
          },
          "cnsa_exclusive_deadline": {
            "date": "2033-12-31",
            "source": "NSA CNSA 2.0 migration timeline: NSS systems CNSA-2.0-exclusive by 2033."
          },
          "fips_140_2_historical_date": {
            "date": "2026-09-21",
            "source": "NIST: FIPS 140-2 validated-module certificates move to the Historical list on 2026-09-21."
          }
        },
        "note": "DECISION-SUPPORT DRAFT, findings asserted. Not legal advice, not a compliance determination, not an audit. Computes what the declared deadlines imply for the supplied inventory only."
      },
      "compliance_flags": [],
      "golden_hash": "1c738d6f1b1b8376b40284af1ce7b7e1e752af57825787f215dc7621b187b663"
    }
  ]
}