# Sovereign Circuit Grading Rubric

**Version** SCGR1/1.0 · **Status** Draft for review · **Date** 29 August 2026
**`rubric_hash`** `91ffd02632bdaa504bd33fad2e77466dd649f2fad44f066e02a480634a336f79`

> **Not legally reviewed. Thresholds are not calibrated.** The numbers in this
> document are defensible starting points, not empirical findings. Section 9
> states plainly what is unresolved. Nothing here is an offer, an appraisal, or
> a warranty.

Companion to the [Dual Attestation Protocol](SPEC.md) (SCDA1). That protocol
settles a price. This rubric produces the description that the price is a price
*of*.

---

## 1. Why this exists

The Dual Attestation Protocol makes it impossible for either party to move
their number after seeing the other party's number. That is worth something
only if both parties are pricing the same described object.

They are not, by default. Ask two competent inspectors to grade the same
laptop and you will get two different answers, and neither of them is lying.
The reason is in the vocabulary. The R2v3 standard — the certification that
serious ITAD facilities actually hold — sorts equipment into cosmetic
categories C1 through C9 using phrases like *minor scratches*, *light
scratches*, and *scratches*. The published analysis of the standard's own
second draft flags exactly this: those terms "do not have well-defined
status."

You cannot hash an adjective. A commitment scheme built on *"Used Good, I'd
say"* commits to nothing.

So this rubric never asks an inspector for an adjective. It asks for counts
against defined thresholds and readings taken off the machine, and then
**derives** the category. The adjective is an output.

### 1.1 What this buys

- Two inspectors with the same unit produce the same grade, or they produce
  different **counts** — which is a fact you can go and re-measure, not an
  opinion you have to arbitrate.
- A grade dispute reduces to an observation dispute. Observation disputes are
  answerable with a ruler, a screenshot, and a SMART dump.
- The grade can be committed to cryptographically, which is what lets it bind
  into a price attestation.
- Most disagreements turn out not to matter, and the rubric can prove which
  ones those are. See section 7.

### 1.2 What it does not buy

It does not make grading objective. Someone still has to decide whether that
mark is a scratch or a smudge, and whether it is 9mm or 11mm. The rubric moves
the subjectivity down to the smallest unit it can and then makes the remaining
judgement calls **individually contestable** instead of bundled into one
unfalsifiable letter. That is a real improvement and it is not the same thing
as objectivity.

---

## 2. Relationship to R2v3

Two of the three axes are adopted from the R2v3 R2 Equipment Categorization
(REC) **verbatim**, deliberately.

| Axis | Source | Range |
|---|---|---|
| **F** — Function | R2v3 REC functional categories | F0–F6 |
| **C** — Cosmetic | R2v3 REC cosmetic categories | C0–C9 |
| **S** — Sovereign | New in this rubric | S0–S4 |

A Sovereign Circuit grade is therefore legible to any R2-certified facility
without translation. `F5/C6/S3` says "Refurbished, Used Excellent" to an ITAD
buyer who has never heard of this program, and adds a third letter they can
ignore.

**S is the axis this program adds, and it is the one that decides placement.**
R2v3 grades whether a machine works and how it looks. It says nothing at all
about whether the machine can be *defended* — whether it has a hardware root of
trust, whether its firmware is still receiving fixes, whether its DMA-capable
ports can be shut. For a program whose entire premise is placing used hardware
inside a security envelope, that is the thing that matters most, and the
standard is silent on it.

---

## 3. The observation sheet

66 fields. Every field is declared in the registry below and nothing outside
the registry may be recorded. The registry is hashed into `rubric_hash`, so the
sheet in the inspector's hand is provably the sheet the grade was derived from.

### 3.1 Field classes

**Class M — machine-read.** SMART counters, battery capacity, TPM version,
test-suite results. Read off the device, not off a judgement.

**Class H — human-observed.** Counts of visible defects, presence of damage,
completeness.

The distinction is not cosmetic. It determines what happens when two parties
disagree, and the rules are completely different — see section 7.2.

### 3.2 Tolerances

The `tol` column is the largest difference between two independent observers
that the rubric will treat as two careful people looking at the same scuff. It
is **not** a claim that differences inside it are meaningless. Class M fields
have no tolerance at all.

### 3.3 Registry

| Field | Class | Type | Tol | Definition |
|---|---|---|---|---|
| `all_hardware_pass` | M | bool | — | Full hardware test suite |
| `audio_pass` | M | bool | — | Output and input verified |
| `backlight_uniform` | H | bool | — | No visible bleed or blotching |
| `battery_cycles` | M | int | 0 | Reported charge cycles |
| `battery_design_mwh` | M | int | 0 | Rated capacity when new, mWh |
| `battery_full_charge_mwh` | M | int | 0 | Present full-charge capacity, mWh |
| `battery_present` | M | bool | — | Battery installed |
| `bt_pass` | M | bool | — | Pairs and sustains a link |
| `camera_pass` | M | bool | — | Captures at rated resolution |
| `cleaned_labels_removed` | H | bool | — | Cleaned, non-original labels off |
| `cpu_microcode_current` | M | bool | — | Current microcode revision |
| `critical_parts_missing` | H | bool | — | Parts required to operate |
| `dents_ge_2mm` | H | int | 1 | Deformations >=2mm in any dimension |
| `dents_ge_6mm` | H | int | 0 | Deformations >=6mm ('heavy') |
| `discolored_zones_ge_10mm` | H | int | 1 | Faded/discolored areas >=10mm |
| `display_dead_pixels` | M | int | 0 | Permanently unlit subpixels |
| `display_delamination` | H | bool | — | Coating or bonding separation |
| `display_scratches_ge_5mm` | H | int | 1 | Panel scratches >=5mm, white field |
| `display_stuck_pixels` | M | int | 0 | Permanently lit subpixels |
| `dma_ports_lockable` | M | bool | — | DMA-capable ports can be disabled |
| `ecc_memory` | M | bool | — | Error-correcting memory |
| `firmware_latest_applied` | M | bool | — | Latest vendor firmware applied |
| `full_disk_encryption` | M | bool | — | FDE enabled at placement |
| `hinge_damaged` | H | bool | — | Hinge bent, seized or detached |
| `hinge_play_mm` | H | int | 1 | Lid deflection at 90 degrees, mm |
| `housing_cracked` | H | bool | — | Any through-crack in the housing |
| `iommu_present` | M | bool | — | VT-d / AMD-Vi present and enabled |
| `key_functions_pass` | M | bool | — | R2v3 F3 key-function test set |
| `keys_legend_worn` | H | int | 2 | Keycaps with illegible legends |
| `keys_missing` | H | int | 0 | Absent keycaps |
| `label_residue_zones` | H | int | 1 | Adhesive or tag residue areas |
| `latch_broken` | H | bool | — | Latch non-functional |
| `missing_parts` | H | list | — | Bezels, feet, covers, panels, keys |
| `oem_parts_only` | H | bool | — | All replacements OEM original |
| `os_licensed_configured` | M | bool | — | Licensed OS loaded, configured |
| `packaging` | H | enum | — | none | generic | original |
| `ports_failed` | M | int | 0 | Ports failing loopback or device test |
| `ports_total` | M | int | 0 | Count of external ports |
| `posts` | M | bool | — | Completes power-on self test |
| `power_on_hours` | M | int | 0 | SMART 9 |
| `ram_test_pass` | M | bool | — | Full-pass memory test, no errors |
| `restored_to_like_new` | H | bool | — | Cosmetically repaired, no blemishes |
| `scratches_ge_10mm` | H | int | 2 | External scratches >=10mm long |
| `scratches_ge_25mm` | H | int | 1 | External scratches >=25mm long |
| `secure_boot_capable` | M | bool | — | Firmware supports Secure Boot |
| `secure_boot_enabled` | M | bool | — | Secure Boot currently enforced |
| `smart_187` | M | int | 0 | Reported uncorrectable errors |
| `smart_188` | M | int | 0 | Command timeout |
| `smart_197` | M | int | 0 | Current pending sector count |
| `smart_198` | M | int | 0 | Offline uncorrectable |
| `smart_5` | M | int | 0 | Reallocated sector count |
| `software_test_results_available` | M | bool | — | Test log retained |
| `storage_present` | M | bool | — | Storage device installed |
| `storage_type` | M | enum | — | none | hdd | sata_ssd | nvme |
| `supported_os_available` | M | bool | — | A vendor-supported OS will run |
| `thermal_throttle_observed` | M | bool | — | Throttled under 15-min load |
| `tpm_version` | M | enum | — | none | 1.2 | 2.0 |
| `trackpad_pass` | M | bool | — | Tracks across full surface |
| `uefi_not_legacy` | M | bool | — | Boots UEFI, not legacy BIOS/CSM |
| `unused` | H | bool | — | Never placed into service |
| `vendor_support_active` | M | bool | — | Vendor still issues firmware fixes |
| `warranty_attached` | H | bool | — | Program warranty issued with unit |
| `wifi_pass` | M | bool | — | Associates and passes throughput test |
| `wipe_certificate_id` | M | str | — | Certificate identifier, or empty |
| `wipe_standard` | M | enum | — | none | clear | purge (NIST SP 800-88r2) |
| `wipe_verified` | M | bool | — | Sanitization independently verified |

### 3.4 Measurement conditions

Counts are not reproducible unless the conditions are fixed.

- **Ambient** — approximately 500 lux diffuse, no direct specular source.
- **Distance** — 50 cm, unaided vision, corrective lenses permitted.
- **Chassis** — unpowered, lid closed for the top surface, lid open at 90° for
  the interior. Count each defect once.
- **Display** — powered, full-white field, then full-black field. Panel
  scratches counted on white; backlight uniformity assessed on black.
- **Dents** — measured at the widest dimension of the deformation, not the
  discoloration around it.
- **Scratches** — measured along the longest continuous run. A scratch crossing
  a panel seam counts as one.
- **Hinge play** — lid at 90°, measured deflection at the top edge under light
  finger pressure.

A defect that qualifies at more than one threshold is counted at every
threshold it meets. A 30mm scratch increments both `scratches_ge_10mm` and
`scratches_ge_25mm`.

---

## 4. Cosmetic derivation (C)

Evaluated top-down. The unit receives the **highest** category whose predicates
it fully satisfies. Every predicate is a count against a threshold.

| Code | Label | Binding predicates |
|---|---|---|
| **C9** | New Open Box | unused, pristine, original packaging opened |
| **C8** | Unused | unused, pristine, packaging not original |
| **C7** | Certified Pre-Owned | restored to like-new, pristine, warranty attached |
| **C6** | Used Excellent | no dents; ≤2 scratches ≥10mm; no scratches ≥25mm; no display scratches; no discoloration; no residue; cleaned; nothing missing; no structural damage |
| **C5** | Used Very Good | no heavy dents; ≤2 dents ≥2mm; ≤1 scratch ≥25mm; ≤1 discolored zone; ≤1 display scratch; nothing missing; no structural damage |
| **C4** | Used Good | no heavy dents; ≤5 dents ≥2mm; ≤1 key missing; nothing missing; no structural damage |
| **C3** | Used Fair | ≤3 heavy dents; no critical parts missing |
| **C2** | Used Poor | heavy damage prevalent |
| **C1** | Damaged | housing cracked through, or critical parts missing |
| **C0** | Not categorized | not evaluated |

"Pristine" means every visible-defect count is zero, nothing is missing, and
there is no structural damage.

---

## 5. Functional derivation (F)

| Code | Label | Requires |
|---|---|---|
| **F6** | Like New | hardware clean, licensed OS configured, test log retained, OEM parts only, battery ≥90% of design (or no battery) |
| **F5** | Refurbished | hardware clean, licensed OS configured, test log retained |
| **F4** | Hardware Functional | hardware clean, software not configured |
| **F3** | Key Functions Working | passes the key-function set |
| **F2** | Verified Specialty | per R2v3 Appendix D |
| **F1** | Collectible or Specialty | rare, unsupported, may have missing parts |
| **F0** | Not functional | does not POST, or fails key functions |

**Hardware clean** requires all of: full hardware suite passed, zero failed
ports, wifi/bluetooth/audio/camera/trackpad/memory all passed, no thermal
throttling under sustained load, no SMART failure indicators, no dead or stuck
pixels, nothing missing.

### 5.1 SMART indicators disqualify, they do not score

Backblaze's published analysis of its own drive fleet identifies five SMART
attributes that actually correlate with impending failure: 5 (reallocated
sectors), 187 (reported uncorrectable), 188 (command timeout), 197 (current
pending sectors) and 198 (offline uncorrectable).

A non-zero value in **any** of the five caps the unit at F3. It is not scored,
weighted, or traded off against condition. A drive that has begun to fail is
not a drive with a slightly lower grade, and a program that places storage
inside households does not get to be clever about this.

Power-on hours are recorded but are **not** themselves a defect. A 44,000-hour
drive with clean counters grades F6.

### 5.2 Battery

Health is `full_charge_mwh / design_mwh` as an integer percentage, rounded
half-up — the same rounding the price protocol uses, for the same reason.
Below 90% the unit cannot hold F6. A unit with no battery is not penalised;
the field reports `null`, which is not zero.

---

## 6. Sovereign derivation (S)

The axis R2v3 does not have.

| Code | Label | Requires |
|---|---|---|
| **S4** | Sovereign Full | TPM 2.0, Secure Boot **enforced**, UEFI, IOMMU, DMA ports lockable, firmware current, vendor support active, microcode current, FDE, sanitized to **Purge** |
| **S3** | Sovereign Standard | TPM 2.0, Secure Boot capable, UEFI, firmware current, FDE |
| **S2** | Sovereign Limited | UEFI, Secure Boot capable, FDE — but no TPM 2.0 |
| **S1** | Contained Only | legacy BIOS, or cannot enforce Secure Boot, or no FDE |
| **S0** | Not placeable | not sanitized, sanitization unverified, or no supported OS exists |

TPM 1.2 does not reach S3. Microsoft's own position is that 1.2 is
insufficient for Windows 11 and that the TPM 2.0 line is not moving; a rubric
that treated 1.2 as adequate would be writing cheques the OS vendor will not
honour.

### 6.1 Sanitization is a gate, not a grade

S0 is absolute. An unsanitized unit is not placeable at any tier, in any
cosmetic condition, at any price. GV-5 in section 8 is an immaculate,
fully-current, zero-defect machine that routes to recovery because its wipe was
not verified. Sanitization follows NIST SP 800-88 Rev. 2, which R2v3 requires.

---

## 7. Tiers, floors, and divergence

### 7.1 The floor applies at every tier

The program's claim is: **hardware is matched to the workload; protection is
not.** That sentence is only true if it is enforced. These conditions apply
identically at Tier A and Tier D:

- sanitization verified
- full-disk encryption enabled
- a vendor-supported operating system available

Fail any one and the unit routes to recovery regardless of everything else.
The test suite asserts this at every tier rather than asserting it in prose.

| Tier | Serves | Requires |
|---|---|---|
| **A** | Business and agency | S4, F5 |
| **B** | Small business, nonprofit, congregation | S3, F4 |
| **C** | Household adults | S2, F4 |
| **D** | Children — homework and coding lab | S2, F3 |
| **L** | Contained lab use only | S1 |
| **P** | Repair before placement | C2 |
| **R** | Recovery | anything else |

What descends the cascade is the **consequence** of compromise, never the
standard of defence. A child's homework machine has no corporate credentials
and no lateral path into an enterprise network. It does not have weaker
encryption.

**S1 is deliberately not placed with households or children.** A legacy-BIOS
machine with no Secure Boot chain cannot exclude firmware-level persistence,
and the difference between "we think it is clean" and "we can show it is
clean" is the entire program. S1 units go to contained lab use or to recovery.
This is a safety decision rather than a capability one, and the test suite
locks it so it cannot regress quietly.

Cosmetic condition does **not** choose a tier — C3 and C6 place identically.
But C1 and C2 are not descriptions of appearance. C1 is a cracked housing; C2
has critical parts missing. Those are durability findings wearing cosmetic
clothing, so they gate placement where ordinary wear does not.

### 7.2 Machine readings are not opinions

If two parties report different values for a Class M field, that is not a
disagreement about judgement. It means the device was altered between
readings, the wrong unit was read, or a reading is fabricated.

The round **voids**. The values are not averaged, not toleranced, and not
split. This check runs before anything else, and it voids even when the two
sheets happen to derive to the same grade — because the problem is not the
grade, it is that one of the two readings is not real.

### 7.3 Materiality — the rule that makes this usable

Two inspectors will disagree about whether that is three scratches or five.
Almost always it changes nothing.

So the rubric does not reconcile observations. It reconciles **grades**:

1. Class M conflicts → void.
2. Derive a grade from each sheet independently.
3. **If both derive to the same grade, the divergence is immaterial and the
   round proceeds.** However much the counts differ.
4. Only if the grades differ is anything escalated — and then only the
   *pivotal* fields: those which, substituted alone, move the grade.

`minimal_divergence_set` computes this. In RV-1 the two sheets differ on two
fields and nothing is escalated at all. In RV-2 they differ on one field and
that one field is named, so re-inspection is a single measurement rather than
a re-run of the whole sheet.

Because the cosmetic bands are **conjunctive** — every threshold must hold —
each field that crosses its own threshold flips the grade on its own. So a
material divergence usually returns *several* independently pivotal fields
rather than one, as in RV-4. The fallback that returns the entire differing set
exists for derivations where no single field is decisive; under v1.0's
conjunctive rules it is not reachable, and it is retained because a later
version with additive scoring would need it.

### 7.4 Unresolved divergence

If re-inspection does not resolve a material divergence, `conservative_merge`
takes the worse value for every differing field, producing the lowest grade
consistent with both sheets.

This is **not** a fair-value estimate and is not presented as one. It is a
deliberate tie-break against the party proposing the unit, and its purpose is
to make unresolved divergence unattractive rather than to be correct. Two
parties who cannot agree on what is physically in front of them should find
that expensive.

### 7.5 Ordering: grade before price

The grade must be agreed **before** the price commitment window opens.
Otherwise a party who can see where the price is heading has a reason to shade
their observations toward it.

```
  1. observe          both parties fill the sheet independently
  2. commit           SHA-256 over each sheet plus a nonce
  3. reveal           both sheets open
  4. reconcile        void / immaterial / material
  5. publish          grade_token fixed and published
  6. price commit     SCDA1 begins, policy_hash binds the grade_token
  7. price reveal     as SPEC.md sections 5 and 6
```

Steps 1–5 are this document. Steps 6–7 are SPEC.md. The `grade_token` is
committed over the *observations and the rubric*, not over the derived letters
— because the derivation is deterministic and published, anyone holding the
sheet can recompute the letters and check them.

---

## 8. Normative vectors

Reproduced by `refimpl/test_grading.py`. Regenerate with
`refimpl/make_grade_vectors.py` — do not hand-edit.

All vectors share a reference unit: a three-year-old fleet laptop, 57,000 mWh
design battery at 52,000 mWh, 9,800 power-on hours, clean SMART, TPM 2.0,
purge-verified. Each vector changes as little as possible from it.

| ID | Case | Grade | Tier | Battery | Load | Grade token (first 16) |
|---|---|---|---|---|---|---|
| GV-1 | Reference fleet laptop | `F6/C6/S4` | A | 91% | 2 | `03dee6aeb0bc0186…` |
| GV-2 | Vendor support ended | `F6/C6/S3` | B | 91% | 2 | `00c518c904f6413f…` |
| GV-3 | TPM 1.2 only | `F6/C6/S2` | C | 91% | 2 | `85ccb6a49e7ffcfd…` |
| GV-4 | Dented but sound | `F6/C3/S4` | A | 91% | 45 | `410e708fff382124…` |
| GV-4b | The rubber foot problem | `F3/C3/S4` | D | 91% | 50 | `fa96149ac59af28c…` |
| GV-5 | Pristine but unsanitized | `F6/C6/S0` | R | 91% | 0 | `de472828a7a39cda…` |
| GV-6 | Drive beginning to fail | `F3/C6/S4` | D | 91% | 2 | `31ed513744afcbe9…` |
| GV-7 | Legacy BIOS machine | `F6/C6/S1` | L | 91% | 2 | `ab6111e9c6d02d3c…` |
| GV-8 | Tired battery | `F5/C6/S4` | A | 61% | 2 | `a4d7974dc0a7a7ff…` |
| GV-9 | Cracked housing | `F6/C1/S4` | R | 91% | 11 | `8aee96aabc677fd5…` |
| GV-10 | Cascade unit for a homework desk | `F3/C4/S3` | D | 72% | 16 | `620b54b5d722afb2…` |

Read the pairs. They carry the argument:

- **GV-1 → GV-2.** Nothing physical changes. The vendor stops issuing firmware
  fixes and the unit loses Tier A. Support lifetime, not condition, is what
  ends a machine's working life at the top tier.
- **GV-1 → GV-4.** Seven dents, fourteen long scratches, worn key legends, tag
  residue. Drops three cosmetic bands and **stays at Tier A**. Appearance does
  not decide placement.
- **GV-4 → GV-4b.** One missing rubber foot. Drops two functional bands and
  three tiers. See section 9, open item 4 — this is inherited from R2v3 F4 and
  it is wrong, and it is published rather than quietly patched.
- **GV-1 → GV-5.** Immaculate, current, fully functional, unsanitized.
  Recovery. The gate that overrides everything.
- **GV-9.** Passes every functional test, holds the top sovereign grade,
  cracked housing. Recovery. This one was a genuine bug found by running the
  vectors: tier derivation originally ignored the cosmetic axis entirely and
  placed a cracked-chassis laptop at Tier A.

### 8.1 Reconciliation vectors

| ID | Case | Status | Pivotal fields |
|---|---|---|---|
| RV-1 | Immaterial divergence | **immaterial** | — |
| RV-2 | Material divergence, single pivotal field | **material** | `dents_ge_6mm` |
| RV-3 | Machine-read conflict | **void** | — |
| RV-4 | Several independently pivotal fields | **material** | `dents_ge_2mm`, `discolored_zones_ge_10mm`, `scratches_ge_25mm` |

### 8.2 Reference commitment

`GV-1` observation sheet, `rubric_hash` as above:

```
rubric_hash = 91ffd02632bdaa504bd33fad2e77466dd649f2fad44f066e02a480634a336f79
grade       = F6/C6/S4
tier        = A (Business and agency)
grade_token = 03dee6aeb0bc0186cd9225875674ff227247d3d2b657390e6b6d4019cf827e05
```

---

## 9. Open items

Stated as unresolved rather than papered over.

1. **The thresholds are not calibrated.** 2mm, 10mm, 25mm, 90% battery, C3 as
   the placement floor — every one is a defensible starting point and none is
   an empirical finding. They need paired inspection data: many units, two
   independent inspectors, measure how often the derived grades agree. Until
   that exists, the honest claim is "deterministic", not "accurate".

2. **Inter-rater reliability is unmeasured.** The entire value proposition is
   that two inspectors converge. That is a testable claim and it has not been
   tested. It should be reported as a proper agreement statistic, per field,
   and the fields that disagree most should have their thresholds redrawn or be
   moved to Class M.

3. **Tolerances are guesses.** ±1 dent, ±2 scratches. These should fall out of
   the calibration data in item 1, not out of a judgement call.

4. **The rubber foot problem.** R2v3 F4 requires "no missing or damaged
   components or parts" and draws no distinction between a rubber foot and a
   memory module. GV-4b drops three tiers over a piece of rubber. The rubric
   inherits this faithfully because diverging from the standard silently is
   worse than inheriting a known defect visibly. The fix is a
   `missing_parts_cosmetic` / `missing_parts_functional` split, which breaks
   verbatim R2v3 compatibility, so it is a v1.1 decision and not a v1.0 one.

5. **Sovereign thresholds encode a point in time.** "Vendor support active" and
   "firmware current" are true until they are not, and a unit's S grade decays
   without anyone touching it. The rubric has no re-grading cadence. It needs
   one, and a placed unit that silently falls out of its tier is a real
   operational risk.

6. **No adversarial testing.** The pivotal-field algorithm has not been
   examined for whether a sophisticated party could construct a sheet that
   passes the materiality test while being materially wrong — for instance by
   diverging on many fields that are individually immaterial but jointly
   misleading about the unit.

7. **Photographic evidence is unspecified.** Counts should be checkable against
   images. Nothing here says what must be photographed, at what resolution,
   with what scale reference, or how those images bind into the commitment.

8. **S1 placement is a policy question, not a technical one.** v1.0 refuses to
   place S1 units with households or children. That is the conservative call
   and it may be the wrong one — it may simply mean usable machines are
   destroyed. It deserves an explicit decision by someone accountable, not a
   default buried in a derivation function.

---

## 10. Legal note

Nothing in this document is an appraisal. A derived grade is a structured
description of observations, not a valuation, and the word "appraisal" carries
licensing consequences in several states that this program has not addressed.

The grade feeds a price attestation; it does not set a price. Coverage terms
attached to a placed unit must not be described as insurance until counsel has
reviewed the structure. See SPEC.md section 12.

---

## 11. Sources

- R2v3 R2 Equipment Categorization, cosmetic and functional category
  definitions — [CDR Global grading scale aligned to R2v3 REC](https://cdrglobal.com/wp-content/uploads/2022/11/CDR-Grading-Scale-alignment-with-R2v3-REC-Effective-042022-1.pdf)
- R2v3 second-draft analysis, including the undefined-cosmetic-terms problem —
  [MCDCG on R2 Equipment Categorization](https://mcdcg.com/blog/r2/the-r2v3-second-draft-standard-analysis-part-17-r2-equipment-categorization/)
- Media sanitization, Clear and Purge —
  [NIST SP 800-88 Rev. 2](https://csrc.nist.gov/pubs/sp/800/88/r2/final)
- SMART attributes that predict drive failure —
  [Backblaze, Analyzing hard drive SMART stats](https://www.backblaze.com/blog/hard-drive-smart-stats/)
- TPM 2.0 as a hard floor, TPM 1.2 insufficient —
  [Microsoft on enabling TPM 2.0](https://support.microsoft.com/en-us/windows/security/devicesecurity/enable-tpm-2-0-on-your-pc),
  [CRN on the 2.0 requirement](https://www.crn.com/news/applications-os/microsoft-now-says-windows-11-tpm-requirement-is-for-version-2-0)
- Canonical serialization — [RFC 8785 JCS](https://www.rfc-editor.org/info/rfc8785/)
- Hash function — [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final)

---

*Sovereign Circuit · Born Between 2 Generals · Rubric SCGR1/1.0 draft ·
29 August 2026*