The registry
Where signed scores are kept.
A delivery is a survey packaged up to be handed to somebody else. Each one is dated, hashed over its own contents, and signed when it is produced. Whoever produced a score puts it here, and whoever needs to read it takes it from here, so the evidence exists in one place while the decisions people build on it stay their own.
The registry, read out
A delivery, as the registry serves it.
What a delivery carries: the score, where it falls on the fixed band scale, how each lens contributed to it, and the rows that say where it came from and whether anything has been touched since.
What the registry holds
What the registry holds.
Signed CAI-delivery packages
Every delivery is dated, hashed over its own contents and signed at the moment it is produced. A package can be handed on as many times as it needs to be, and the signature and the hash travel with it, so the last person to receive it can check it exactly as easily as the first.
The public record
Open surveys of real repositories, readable in full. A record is published either because whoever commissioned it chose to publish, or because it was produced under terms that publish by design. The canonical signed records live here. Maintainers: if your project is listed and you would rather it were not, write to the people who maintain the standard. A person answers, and removal is honoured.
Who can read what
Whoever holds a record decides who else may read it, and can grant access to a named person or company. Anyone who needs access can ask for it. Every grant is recorded, so who was given access, and when, can be checked later.
Why a seller can hand over their own score.
A delivery is signed by the issuer and content-hashed at the moment it is produced, so whoever receives it can tell it has not been altered on the way. That is what makes a shared package believable: a seller can hand a buyer their own survey because altering it would break the signature and the hash.
What the registry is.
The registry API (api.codeassuranceindex.info) serves push, pull and access grants to any implementation publishing under the standard. A published record is readable by anyone, and a restricted one is readable by the parties granted access, so either way a score can be followed back to where it came from.
Holding a delivery? Check it.
Software that uses CAI → /implementations