SHP Specifications

The Structured Hardening Project is defined through versioned specifications.

The website explains SHP.

The specifications define it.

Publication makes a document available. It does not, by itself, establish authority, platform support, certification eligibility, or service availability.

Those properties follow the applicable SHP governance rules.

A governed specification corpus

SHP does not treat every document as equivalent.

The specification corpus separates different kinds of authority and responsibility.

It includes documents governing areas such as:

• constitutional and project governance
• tier mathematics
• platform mathematics
• threat models
• control catalogues
• evidence
• verification
• certification decisions
• certification trust
• evaluation language
• platform admission
• implementation architecture

A document’s meaning depends on its defined role, lifecycle state, version, dependencies, and place within the SHP authority structure.

Authority is not inferred from publication

A document appearing in the public library does not automatically make it authoritative for every SHP purpose.

Authority follows the applicable SHP governance model.

Likewise:

• a draft does not become operative merely because it is published
• a historical document does not become current merely because it remains accessible
• a platform document does not establish platform support merely because it exists
• tooling or implementation material does not redefine normative requirements

The applicable current governance and specification set determines what controls.

Platform specifications

Platform-specific documents define requirements within explicit platform boundaries.

A supported platform may have its own:

• threat model
• platform mathematics
• control catalogues
• applicability rules
• Non-Negotiable Controls
• verification behaviour
• certification boundaries
• trust references
• admission record

Requirements must not be transferred automatically from one platform to another.

Platform support exists only through the applicable Active Platform Admission Record.

Publication alone does not establish support.

View Supported Platforms →

Lifecycle matters

Specifications have lifecycle state.

Current, draft, superseded, obsolete, and withdrawn documents must not be interpreted as though they have identical status.

Current specifications define presently applicable SHP requirements within their governed scope.

Historical specifications remain important because they preserve the meaning of earlier certification states and earlier versions of the standard.

A superseded document can therefore remain relevant without remaining current.

Versioning preserves meaning

Specifications are versioned.

A certification must remain interpretable against the specification versions applicable when it was issued.

Later changes must not silently rewrite the historical meaning of an earlier certification.

Where rules change, the new version governs prospectively according to the applicable amendment and lifecycle rules unless an explicitly governed security-critical rule requires different treatment.

Historical meaning must remain recoverable.

Amendments are controlled

Changes to SHP specifications are governed amendments.

Material changes and minor corrections or clarifications must remain distinguishable.

Version history, supersession, document identity, and historical interpretation must be preserved.

Silent replacement of normative meaning is incompatible with the SHP model.

Specifications and certification are different things

Specifications define the rules under which certification may occur.

They do not themselves issue certification.

Certification requires, as applicable:

1. a supported certification target
2. valid evidence
3. deterministic verification
4. satisfaction of applicable tier and Non-Negotiable Control rules
5. an eligible certification decision
6. issuance under SHP-controlled signing authority

The existence of a specification therefore does not mean that certification issuance is operationally available.

Understand SHP Certification →

Public specification library

The public library provides access to published SHP documents and their identifying metadata.

Published records may expose information such as:

• document title
• document identifier
• version
• lifecycle status
• authority classification
• publication date
• effective date
• supersession relationship
• cryptographic digest
• canonical artefact

These fields allow a reader to identify precisely which document is being examined.

Publication integrity

Where SHP publishes cryptographic digests, signatures, provenance, or other trust information, that information must correspond to the actual published artefact.

Placeholder hashes, fingerprints, identifiers, or signatures must never be presented as genuine trust information.

Publication provenance supports auditability.

It does not independently create normative authority.

Current, draft, and historical material

The library separates published material by lifecycle state.

Current material identifies published Active specifications.

Draft material identifies work that has not become operative merely through publication.

Historical material preserves superseded, obsolete, or withdrawn documents for auditability and historical interpretation.

These categories are not interchangeable.

The specifications control

Where explanatory website text and an applicable governing specification differ, the governing specification controls.

That boundary is deliberate.

The website should help people understand SHP without silently becoming a second specification system.

The SHP Standard →

How Verification Works →

Understand Certification →