A compliance certificate should be checkable by anyone Draft

The problem

A gas safety record, an electrical installation condition report and a boiler service certificate are all documents somebody will rely on later — a letting agent, a council, an insurer, a court. Today each is a PDF made by one vendor's software, in that vendor's own shape, and there is no way to ask a question of it. You cannot check whether the landlord's address is really there rather than "as above". You cannot tell whether the file in your hand is the file that was issued. And when a landlord changes software, the data does not come with them.

This standard exists because that is about to matter much more than it does today. The Renters' Rights Act creates a national database of private rented property, and the requirements for uploading compliance certificates to it are not yet settled. There is currently no interoperable machine-readable format for any of these documents.

What it defines

Three things, and only three.

1. A record. A small JSON object holding the particulars the law actually names — the premises, the duty holder, the competent person, the date, and what was found. Nothing in it names a vendor.
2. A way to hash it. RFC 8785 canonical JSON, then SHA-256, with the rules pinned tightly enough that two independent implementations agree byte for byte. Nine published test vectors prove it.
3. Criteria you can run. Machine-testable conformance at three levels: does it contain what the law names, can a non-expert read it, can you prove later what was issued and to whom.

The document is not the record

This is the part worth arguing about, so it is stated plainly.

If a certificate's identity is the bytes of one PDF, then that rendering becomes the legal record. The layout can never be corrected. The PDF library is pinned for ever. A document with a genuine mistake in it can never be repaired, because repairing it makes it read as tampered.

If the identity is a canonical form of the data, all of that goes away. A PDF, a web page and a printout of the same record are equally valid, because none of them is the record. A vendor can redesign their certificate on a Tuesday without invalidating anything they have ever issued.

Honest about where this is

This draft was written and published by CertBox, which makes compliance certificate software for tradespeople. The implementation came first; this specification describes something already running. Authorship is not ownership — nothing in the record format names a vendor, the licence permits anyone to implement or fork it, and governance is an open question.

This is a draft, published for comment, by one vendor who wrote a working implementation first. It has not been through a standards body. It has no other implementers yet. Its conformance criteria are testable, which means the vendor who wrote them fails some of them today — the criteria are a public scoreboard, not a marketing claim, and the first published conformance figures will show that.

A standard whose conformance is self-asserted prose is a blog post. What makes this one testable is that the record format, the hashing rules and the criteria all ship as running code with published vectors, so any disagreement can be localised to a rule rather than argued about.

Read it

• The specification, version 1 — the record, the canonicalisation rules, and the conformance criteria.
• Test vectors — nine records with their canonical form and expected hash, including the awkward cases where implementations actually disagree.

Comment on it

Wanted especially from other software vendors, letting agents, and anyone working on the private rented sector database. The open questions are listed at the end of the specification, and they are genuinely open.