Where governance claims become inspectable proof

The certification badge is visual shorthand. The product is the set of auditable objects an Arena engagement produces — the things you forward to an auditor, board, regulator, or procurement team.

Arena Light is the entry tier for buyers who arrived through the AEGIS funnel. You already have scan results. Your ISMS documents are ingested via MindMeld. Arena Light maps that material to framework controls and tells you, control by control, where the proof actually is.

The output is a gap report consumable by an auditor, board, or regulator — not a passing grade. Arena Light does not run full Cassandra L3–L5 adversarial testing; that is the full certification engagement. Light is the moment a buyer sees the difference between knowing the gap and closing it with proof.

Stage 3 in the buyer funnel is the same thing as Pattern 3 in the architectural interlock between AEGIS, Arena, and Raknor — one concept, two angles. The rest of this site calls it continuous certification.

Arena’s highest-value mode is not a one-time engagement. AEGIS pipes signed evidence on every deploy. Arena validates continuously. Your Raknor certification stays live as long as evidence stays green. When a build breaks a criterion, the certification degrades with a gap report — you do not have to wait for a re-test to find out.

This is the opposite of the annual audit. It is recurring posture, with a recurring credential, backed by recurring evidence. Treat it as infrastructure, not a badge purchase.

When you register an agent, the Arena computes a testing lane across four dimensions. Two agents in different domains with different consequence levels get different scenarios—but the same 26 governance criteria.

Each certification run blends general governance scenarios, domain-specific tests, and Cassandra adversarial attacks. The mix is weighted by your agent's lane.

Cassandra escalates through five difficulty levels. Most agent testing today operates at L1 at best. Certification requires full coverage at L3 or above.

Governance behavior is half the picture. The other half is whether your agent’s codebase, dependencies, and infrastructure have exploitable vulnerabilities that undermine everything the governance layer protects.

Lane 2 evaluates cybersecurity posture using evidence from AEGIS code scans — vulnerability findings, compliance coverage, supply chain integrity, and cryptographic provenance. The result is a separate RCS credential (Raknor Cybersecurity) with its own score, grade, and expiration.

Each lane is independently evaluated. Cross-lane results are linked via related_cert_id but certified separately. A buyer can pursue one lane or both.

Both credentials are publicly verifiable in the Certification Registry.

Arena is deliberately arms-length from the agent platforms it tests. The test lab must be independent from the vendors it certifies — otherwise the certificate is marketing.

Equilateral AI’s own agents are treated as just another submission. No special paths. No insider knowledge. No easier tests. If Equilateral’s agents fail a Cassandra scenario, they fail publicly, in the same registry, against the same scoring engine, on the same day.

This is credibility through process separation, not institutional authority. Raknor does not need to be older or larger than the vendors it tests — it needs to be structurally incapable of giving them a pass they did not earn.

Lane 2 scoring consumes AEGIS evidence bundles and evaluates 7 cybersecurity domains. Domain weights reflect where risk concentrates. Controls marked not applicable are scoped out with documented justification — remaining weights redistribute proportionally.

Lane 2 certifications are framework-specific. A system certified against FedRAMP High faces stricter thresholds than one certified against NIST CSF 2.0. Each framework defines its own minimum coverage, maximum tolerable findings, and evidence validity period.

The twelve: FedRAMP High, FedRAMP Moderate, SOC 2 Type II, PCI-DSS v4.0, HIPAA, DORA, ISO 27001, CMMC Level 2, NIST CSF 2.0, EU AI Act (Articles 9–15), Treasury FS AI RMF, and FedRAMP ConMon. FedRAMP High and Moderate are counted separately because they are assessed against different control baselines and validity windows. The nine rows below show the threshold-bearing frameworks; EU AI Act and Treasury FS AI RMF are governance-method frameworks evaluated under Lane 1, and FedRAMP ConMon is the continuous-monitoring overlay that runs through Stage 3.

Certification validity reflects the framework’s assessment cadence. FedRAMP’s 30-day window aligns with continuous monitoring requirements. HIPAA’s 180-day window aligns with annual risk assessment cycles. When a credential expires, re-certification requires a fresh AEGIS scan and Arena evaluation — not a rubber stamp.

In addition to the 5 governance MFCs, Lane 2 adds two cybersecurity-specific mandatory failure conditions. If either triggers, the certification is denied regardless of overall score.

Lane 2 does not scan your code directly. It consumes evidence bundles produced by AEGIS — 35+ signed report formats across 12 compliance frameworks, from a single scan. SARIF, OSCAL (SSP/AR/POA&M), DORA Pillar I–V, VEX, SBOM, ISO 27001, NIST CSF, FedRAMP ConMon, and more. The scoring engine evaluates the evidence. The certification authority issues the decision.

This separation matters. AEGIS is the evidence producer. Arena is the decision maker. One scan, multiple frameworks — the same AEGIS evidence bundle can support FedRAMP, SOC 2, PCI-DSS, and DORA certifications simultaneously, without re-scanning.

Vendors who use their own SAST/DAST tools can submit findings in SARIF format. AEGIS is the default evidence engine, not a requirement.

Arena’s value is structured evaluation and certification artifacts — not raw evidence and not regulatory authorization. It produces the documentation and decision narrative that compliance regimes need as input.

Platinum, Gold, Silver, and Bronze are visual shorthand — a glance for procurement, an embedded QR for verification. The grade exists so buyers can ask the next question. The answer is the audit objects above. Anyone can scan the QR to confirm the certification is current and pull the underlying evidence.