Capability maturity contract

Assayra publishes one release-truth registry at GET /v1/capabilities. The commercial site, Control Tower, tenant entitlements, SDKs and live runtime use this contract. A route, UI page or passing sandbox fixture does not make a capability production-ready.

Maturity and claim levels

Maturity	Permitted claim	Runtime meaning
experimental	Internal research only	Cannot be tenant-enabled
preview	Functional sandbox or governed pilot	No general live traffic
ga	Supported live use in the named scope	Live only when prerequisites remain current
independently_assured	GA plus current independent evidence	Limited to the evidence report's exact scope

claimLevel is deliberately separate. It describes what Sales, the website, support and in-product copy may say: internal_only, sandbox_only, bounded_live, or independently_assured.

Example

{
  "schemaVersion": "2026-07-22",
  "modules": [
    {
      "id": "biometric_assurance",
      "maturity": "preview",
      "claimLevel": "sandbox_only",
      "supportedScope": "Functional sandbox and governed pilot use.",
      "exclusions": ["Unqualified countries, models and attack classes."],
      "livePrerequisites": [
        "canonical_release_contract",
        "tenant_region_data_class_encryption",
        "current_security_and_privacy_evidence",
        "country_pack_and_runtime_dependencies"
      ],
      "liveEligible": false
    }
  ]
}

SDK checks

const registry = await proofline.capabilities.list();
const biometric = registry.modules.find(
  item => item.id === "biometric_assurance"
);

if (!biometric?.liveEligible) {
  throw new Error("Biometric assurance is not live-eligible in this release");
}

Equivalent methods are client.capabilities() in Swift, Kotlin and React Native. Cache the response for no longer than five minutes and evaluate it again during deployment and periodically in production. Treat an unavailable registry as fail-closed for new journey activation.

Promotion and withdrawal

A module becomes live-eligible only after its code, security, privacy, residency, model/data, operations and UX acceptance evidence is current. If an evaluation expires, a dependency is withdrawn or an incident invalidates the scope, Control Tower can remove live eligibility without deleting tenant configuration. Existing cases remain auditable; new affected journeys stop or route to an explicitly configured safe fallback.