The name refers to conservation scientist Andrew Oddy. In 1973 he published the test developed at the British Museum for evaluating materials used near museum objects. Silver, copper and lead coupons reveal potentially corrosive emissions before a material is admitted to long-term display or storage. Read the British Museum history.
Nothing reaches the edge until it is proven inert
Oddessy applies the same preventive discipline to software. A model, release or connector that asks for edge reach is evaluated as a candidate against the specific device profile it wants to reach. The result is a target-specific admission decision, not a general safety score.
The three software coupons
| Coupon | Question | Evidence |
|---|---|---|
| 01 · Identity | Is this the exact candidate that was reviewed? | Publisher, version, approved manifest and actual SHA-256 digest agree. A signed manifest is required for permanent admission. |
| 02 · Fit | Can it run inside this device envelope? | Runtime, format, accelerator, measured memory and approved hardware profiles fit the named target. |
| 03 · Reach | Can it ask for more authority than its role permits? | No undeclared field output, shell execution, arbitrary write path, PLC mutation or approval bypass is exposed. |
Example admission record
qwen2.5-vl-3b · gguf q4_k_m was evaluated for QCS6490 · line 3. Identity, Fit and Reach passed. Recorded 2026-07-24 09:41 UTC · eu-west-1; verdict retained for 365 days.
Permanent means eligible for a persistent versioned slot on that target. It is still revocable and must be re-evaluated when the candidate digest, manifest, requested reach, runtime or target profile changes. An unsigned or unmanifested build cannot receive permanent admission.
Workflow
- Declare. The candidate arrives with publisher, version, digest, intended role, requested reach and target device profile.
- Test. Identity, Fit and Reach run against that exact candidate-target pair. Missing evidence is a failure, not an inferred pass.
- Admit. A pass may activate a versioned slot. A failure remains in the control plane and does not receive edge credentials or an installation directive.
- Keep. Record the evidence, coupon verdicts, reviewer or policy version, target, region, time, retention and any later revocation.
Current enforcement and boundary
The live controls behind the gate include approved private release metadata, local SHA-256 verification, safe archive extraction, model hardware-profile and memory scoping, versioned Linux slots, health verification and rollback, plus hard-denied PLC-write and shell paths in the current agent surfaces.
The unified coupon record is the governing workflow. A candidate type cannot receive a permanent verdict until all three coupons have executable enforcement and retained evidence for that path.
The Oddy test decides whether a named software candidate is allowed onto a named device. It is not a compliance attestation, model safety rating, machine certification or functional-safety claim. Safety PLCs, relays, interlocks, commissioned procedures and accountable operators remain authoritative.