DARM Core: A Machine-Checked Calculus for Boundary-Indexed Assurance Transfer

Assurance arguments are frequently established in one context and then relied upon in another. A verified component may be integrated into a larger system; authority may expand; an enforcement point may change; evidence may be replaced; independently assured components may be composed; or a guarantee may cross a new representation. In each case, the target claim may depend on conditions absent from the original assurance argument.

This paper presents DARM Core, a machine-checked calculus for making such assurance transfer explicit. DARM separates assurance generation from assurance transfer. A source assurance may originate from theorem proving, contracts, testing, certification, assurance cases, or another backend. Transfer to a target domain is justified only when the assurance-relevant change is represented as structural dependency, the guarantee-relative dependency surface is covered at the claimed boundary and enforcement locus, and the required property is discharged for the represented dependencies.

The work continues the earlier DARM formalization of deterministic authorization boundaries. The conceptual progression is from authority preservation to assurance preservation: the earlier work asks whether an arbitrary action selector can manufacture authority; this work asks whether a target assurance claim can acquire warrant merely because a source claim was established. DARM does not claim a new universal semantic safety logic. Its proposed contribution is a first-class, backend-independent, boundary-indexed representation of assurance transfer, together with machine-checked positive, negative, localization, and correspondence results.