Conformance Checks

Oasis CLI ships a catalogue of 45 conformance checks that assess a machine, a device or an endpoint and report what is actually true about it. Checks need no model, no network and no inference budget. They run from a shell, from CI, or from the agent mid-conversation.

This is what separates Oasis CLI from a general coding agent: the agent that wrote the configuration is the one that reads the machine back and checks it.

The catalogue

Module	Checks	Assesses
preempt-rt	33	Real-time readiness: kernel, scheduling, isolation, IRQs, power, measured jitter
opc-ua	5	Reachability, node map conformance, security policy, certificate validity, anonymous access
ethercat	4	Segment reachability, SubDevice count, dark ports, all-in-OP state
modbus	2	Reachability against a latency budget, and map conformance
iec-61131	1	Structured Text toolchain availability
Total	45

List what your build actually has. The set depends on which packs were compiled in, plus any of your own descriptors:

oasis-agent check --list-modules

Verdicts

Four verdicts. A non-answer is never a pass.

Verdict	Meaning
pass	The property was measured and holds
fail	The property was measured and does not hold
not_applicable	The check does not apply to this subject, with a reason
error	The check could not run, with a reason: a missing tool, a probe that produced no number, or a command that would not start

A missing tool is not a passed check. not_applicable and error are reported separately and are never folded into a total a reader could mistake for a score.

Confidence classes

Every descriptor declares how strongly its criteria support the claim in its title. Confidence is enforced when the catalogue loads: a descriptor whose criteria are only a proxy for the property in its title cannot claim proven. It fails to load.

Class	Count	Meaning
proven	40	The criteria measure the property in the title directly
indicative	5	The criteria are an inference, not a direct measurement

The five indicative checks include the two control-loop checks in the preempt-rt module, which infer loop behaviour without telemetry from the loop itself. They are labelled that way on purpose. See Limitations.

Severity and gates

Severity	Checks
critical	11
high	25
medium	6
low	3

Checks are grouped into two gates: L2 (11 checks) and L3 (34 checks), reflecting how deep an assessment goes.

Framework mappings

Every descriptor carries mappings to published control frameworks, so a finding can be traced to the control it evidences.

Framework	Mapped controls
NIST SP 800-53	37
IEC 62443-3-3	24
IEC 61508-2	13
IEC 61508-3	5
IEC 62443-4-2	4

Every descriptor also carries written remediation, so a failure arrives with what to do about it rather than just a red line.

Running checks

# Everything applicable to this machine
oasis-agent check

# One module
oasis-agent check --module preempt-rt

# One check by id
oasis-agent check --check l3.rt.preempt-rt-active

Subjects and targets

A check declares which subjects it understands and is refused against the rest.

Subject	What --target means	Default target
device (default)	A hostname or address	This machine
repo	A directory path	The working directory
artefact	A file path	—
endpoint	An address, e.g. opc.tcp://10.0.0.5:4840	—

# Assess a remote OPC UA endpoint
oasis-agent check --module opc-ua --subject endpoint --target opc.tcp://10.0.0.5:4840

# Assess a repository
oasis-agent check --module iec-61131 --subject repo --target ./plc-project

Exit codes

The exit code is the contract for CI.

Code	Meaning
0	Nothing failed. Includes checks that could not be measured.
2	Something failed.

A check that could not be measured leaves the code at 0 deliberately. A missing tool is not a failed assessment, and a pipeline that goes red for one teaches its owners to stop reading it.

Output format

oasis-agent check --format json

JSON is the only supported format.

Using checks from a conversation

The Check tool exposes the same catalogue to the agent, so a conversation can measure the machine and act on the result in the same turn:

"Check whether this box is real-time capable, and if isolcpus isn't effective, tell me what to change."

Check is a safe-tier tool and never prompts.

Site-specific checks

Layer your own descriptor TOML over the built-in catalogue by check id. Your descriptor replaces the built-in one with the same id, and a new id adds a check.

oasis-agent check --catalogue /etc/oasis/checks

Or set it once so every run and every Check tool call picks it up:

{
  "checks_catalogue": "/etc/oasis/checks"
}

Your descriptors are subject to the same confidence enforcement as the built-in ones.

Guidance skills

Four skills ship alongside the catalogue and are available to the agent through the Skill tool. They turn a report into a decision.

Skill	Use when
check-triage	After running Check or Audit, before reporting results. What each verdict and confidence class licenses you to claim
rt-provisioning	A machine needs to become real-time capable. Choosing between a distro RT kernel, mainline PREEMPT_RT, and runtime preemption switching
rt-tuning	A machine fails its PREEMPT_RT checks. Turning a report into the right fix in the right order
rt-control-loop	Writing or reviewing a control program that has to hold a cycle time

Producing the document

check answers a question. To produce the artefact a customer is given, use audit.