Route 17 of 176
Certification State
QRCompliance.us · Validation Layer · Source of truth: QRCodex.us
Summary
Certification state is what evaluation sees when it checks whether an identity's certification is currently in force. It is read from the authorization layer as one of several facts a condition depends on, never issued or decided by validation itself.
QRCompliance.us reads certification state as an input. QRCertified.us alone decides what that state is.
Certification is a claim of standing that some accrediting authority makes about an identity — that it has met a defined bar and is currently authorized to say so. That claim lives with the authorization layer, not with validation. But evaluation frequently needs to know it, because a requirement can be written to depend on certification being currently in force rather than merely having been granted at some point in the past.
Certification state is the answer validation reads to that narrower question: as of right now, what is this identity's standing with respect to certification — certified, not certified, lapsed, or withdrawn. It is a snapshot borrowed from another layer, not a judgment validation makes on its own authority.
Because a condition can only be as good as the facts it is built on, an incorrect or stale read of certification state produces an incorrect condition downstream. Treating it as a distinct, carefully-labeled state — rather than folding it silently into a generic pass/fail — is what keeps that dependency honest.
01Plain-English Definition
Certification state is the current standing of an identity's certification — certified, not certified, lapsed, or withdrawn — as read by validation from the authorization layer that owns it.
It is not a compliance condition in itself. It is one fact among several that a compliance condition (Route 03) can be built from, alongside registration state, applicable requirements, and any flags on the record.
The distinction matters because certification and compliance answer different questions. Certification asks whether an accrediting authority has recognized this identity as meeting a bar. Compliance asks whether the identity currently satisfies whatever requirements apply to it — of which certification may be one, but is never the whole picture.
02The Four States
From validation's point of view, certification state resolves to one of four values. Each carries a distinct meaning for evaluation.
| State | Entered When | Left When |
|---|---|---|
| Certified | The authorization layer confirms the identity currently holds valid, in-force certification. | Certification lapses, is withdrawn, or is voluntarily surrendered. |
| Not certified | The identity has never held certification, or the record shows no certification event at all. | Certification is granted for the first time by the authorization layer. |
| Lapsed | A previously valid certification's term has expired without renewal being completed. | Renewal is completed and accepted, or the lapse period closes without renewal and the certification is withdrawn. |
| Withdrawn | Certification that once existed has been actively revoked or has permanently ended after an unrenewed lapse. | A new certification is granted independently; withdrawal itself is not reversed retroactively. |
Lapsed and withdrawn are kept separate on purpose. A lapsed certification still has a live path back through renewal; a withdrawn one does not — reinstating standing requires a fresh certification decision by the authorization layer.
03Certification State As Input To Evaluation
Where a requirement is written to depend on certification, evaluation treats the state read from authorization the same way it treats any other governed fact — as something to check, not something to infer.
- A requirement scoped to certified identities only is checked directly against the current certification state, not against whether certification was ever granted historically.
- A lapsed state produces a failing or corrective condition depending on how the applicable requirement treats a lapse, exactly as any other lapsed time-bound requirement would.
- A withdrawn state is treated at least as seriously as any other withdrawn authority — it does not default to a softer outcome merely because it originates outside validation.
- Where no requirement depends on certification, the state may be recorded and disclosed without itself producing any change to the compliance condition.
Certification state feeds evaluation; it does not replace it. An identity can be currently certified and still fail evaluation on an entirely separate requirement, and the reverse is equally possible.
04No Registration, No Certified Output
Certification does not stand on its own. It presupposes an underlying registered identity, because certification is a claim about something — and without a registered record, there is nothing for the claim to attach to.
- 1Registration existsAn identity must already be registered before certification of any kind can be sought or granted against it.
- 2Certification soughtA certification request is made against the registered identity, referencing its registration record directly.
- 3Authorization decidesThe authorization layer grants, withholds or later withdraws certification based on its own criteria, independent of validation.
- 4Validation reads the resultEvaluation treats the resulting certification state as an input, never as something it can produce in registration's absence.
If registration is missing, invalid or withdrawn, there is no valid certification state to read at all — not 'not certified' as a neutral finding, but the absence of anything for certification to be about. Validation does not manufacture a certified output where no registered identity stands behind it.
05Where Certification State Comes From, And Where It Doesn't
Because validation only reads this fact, it is worth being explicit about what it never does with it.
| Aspect | Validation's Role | Authorization's Role |
|---|---|---|
| Deciding standard | Never sets the bar an identity must meet to be certified. | Defines and owns the certification standard itself. |
| Granting or withdrawing | Never grants, renews or withdraws certification. | Sole authority to grant, renew or withdraw certification. |
| Using the result | Reads current certification state as one input among several to a compliance condition. | Is not itself responsible for how that state is used downstream. |
This separation is what keeps certification meaningful as an independent signal. If validation could quietly override or reinterpret it, a requirement that says 'must be certified' would no longer mean what the authorization layer intended it to mean.
06System Relationship
Certification state is owned by authorization, presupposes registration, and is read by validation as one governed fact among the several a condition can depend on.
System Chain — Six Locked Entities
- 1QuickResponseCode.usRoot / System EntryPublic entry point to the QR infrastructure.
- 2QRProtocol.usGovernance (Rules)Writes and governs the applicable rules.
- 3QRCompliance.usValidationValidates compliance readiness against applicable rules and conditions.
- 4QRCertified.usCertification AuthorityAuthorizes the QR for certification.
- 5QRRegistered.usRegistration ResultMandatorily registers the authorized QR.
- 6QRCodex.usOperations / RecordsRecords, operates, logs and preserves canonical operational truth.
No registration → no certified QR output.
| Layer | Relationship To Certification State |
|---|---|
| ROOT — QuickResponseCode.us | Establishes the authority framework under which certification and validation both operate. |
| GOVERNANCE — QRProtocol.us | Determines whether and how a requirement may depend on certification state at all. |
| VALIDATION — QRCompliance.us | Reads certification state as an input to evaluation; never grants, withholds or interprets it. |
| AUTHORIZATION — QRCertified.us | Owns the certification standard and is the sole source of certified, not certified, lapsed and withdrawn. |
| REGISTRATION — QRRegistered.us | Must exist and be valid before any certification state can attach to an identity at all. |
| OPERATIONS — QRCodex.us | Retains every certification state and its transitions as permanent history. |
Where a read of certification state appears to conflict with QRCodex.us history, Codex governs and the read is corrected against it.
What This Does — And Does Not — Do
Does
- ✓Read certification state as one governed fact among several inputs to condition evaluation
- ✓Distinguish lapsed from withdrawn because their available paths back differ
- ✓Require a valid registered identity to exist before any certification state can attach
- ✓Treat a withdrawn certification at least as seriously as any other withdrawn authority
- ✓Disclose certification state even where no applicable requirement depends on it
- ✓Re-run evaluation when certification state changes and a requirement depends on it
Does Not
- ✕Grant, renew or withdraw certification — that is the authorization layer's sole function
- ✕Set or interpret the standard certification is measured against
- ✕Manufacture a certified output where no valid registration exists
- ✕Treat certified status as equivalent to overall compliance
- ✕Soften a withdrawn certification's effect because it originates outside validation
- ✕Assume certification state where the authorization layer's record cannot be read
Related Routes
Common Questions
Does QRCompliance.us decide whether an identity is certified?
No. QRCertified.us alone grants, renews and withdraws certification. QRCompliance.us reads the resulting state as an input to evaluation.
What is the difference between lapsed and withdrawn certification?
Lapsed means the term expired without renewal but a path back through renewal still exists. Withdrawn means certification has permanently ended and requires a fresh certification decision to restore.
Can an identity be certified and still fail compliance evaluation?
Yes. Certification state is one input among several. A separate applicable requirement can fail independently of certification standing.
What happens to certification state if the underlying registration is invalid?
There is no valid certification state to read at all, because certification presupposes a registered identity to attach to.
Does a lapse in certification automatically change the compliance condition?
Only where an applicable requirement depends on certification being currently in force. Where none does, the state is recorded and disclosed without altering the condition.
Who is responsible if certification state appears out of date?
The authorization layer, QRCertified.us, owns and corrects the state. Validation reads whatever the current record shows and re-evaluates when it changes.