Reference — Verified Available now
The compliance-assertion library
com.codevidence.assertions.ComplianceAssertions is a small
library of static assertion methods for use inside
@VerifiesControl tests. A test calls one of these instead of
a bare assertTrue — the specific method is what tells
Codevidence which claim the test checked.
| Method | Passes when | Pairs with |
|---|---|---|
assertConsentRecorded(String userId, String lawfulBasis) |
A non-blank userId, and a lawfulBasis that is one of the six GDPR Art. 6 bases: consent, contract, legal_obligation, vital_interests, public_task, legitimate_interests. |
Consent-capture controls |
assertEncrypted(byte[] data, String algorithm) |
Non-empty data, and an algorithm that is one of AES-256-GCM, AES-128-GCM, ChaCha20-Poly1305. |
Encryption-at-rest controls |
assertRetentionEnforced(String recordId, Duration retentionPeriod) |
A non-blank recordId, and a positive retentionPeriod no longer than 10 years (a sanity ceiling). |
Data-deletion / retention controls |
assertAccessLogged(String actorId, String resourceId) |
A non-blank actorId and a non-blank resourceId. |
Access-logging controls |
Each method throws AssertionError when its check fails —
same as any assertion library, so a bad check fails the test the normal
way. What the check considers “valid evidence” for each
control type is this library's own scoped judgment, not something read
off a spec.
Every outcome becomes evidence
Every call made inside an active @VerifiesControl test is
recorded as one raw finding — pass or fail. A failing
assertion still produces a Verified evidence record (with
status: "failed"), because an auditor needs to see a broken
control just as clearly as a working one. Calls made outside a
@VerifiesControl test log a warning and record nothing.
Where it lives
Verified evidence records are written as JSON under
target/codevidence/verified/ (Maven) or
build/codevidence/verified/ (Gradle) — one file per
assertion. Like Declared records, they can optionally be POSTed to an
ingestion endpoint you configure; see
build plugin configuration.
Related
- @VerifiesControl — the annotation and setup.
- Supported control types — how these four map onto control categories.
- Verified evidence record schema.