L0Registered
A product exists in the system and nothing has been verified about it yet.
It is a starting position rather than a result, and it is what a product stays at until something completes.
The Standard
Stronger claims need stronger access
The ladder is sequential and it is derived rather than claimed. At the end of a run the engine works out which rung the product has reached from facts it can check, and a rung nobody earned is a rung nobody gets.
What each rung is really recording is how much access the validation had. That is why they cannot be skipped: you cannot establish runtime behaviour without running the thing, and no amount of confidence substitutes for that.
L1Externally verified
A verified production domain and a completed URL scan. A product with no public endpoint at all, which is the ordinary pre-launch case, reaches it with a completed deep run instead.
A product that does claim a public endpoint has to verify it. Skipping that would let a live product claim external verification it never earned, which is the exact thing the word external is doing in the name.
L2Code verified
L1 plus a completed source-mode run: a connected repository, the local agent, an upload, or an enterprise runner.
Source evidence establishes what is implemented. It does not establish that the implementation holds when the system runs, which is the next rung and a different claim.
L3Runtime verified
L2 plus a completed runtime run whose application actually booted in the sandbox.
A runtime run that completed without the application booting earns nothing. It recorded an honest finding, and a finding that the system would not start is not evidence that the system behaves correctly.
L4Production validated
L3 plus the run scoring Production Validated. It is a scoring status rather than another scan, so the rung advances the moment the score earns it.
It is not a certification. It describes one product on one date against one control pack, and it can be lost on the next run.
L5Continuously validated
L4 plus re-validation that is still happening: weekly re-validation switched on, an automatic run within the last 30 days, and no more than 7 days between new commits and a re-validation.
It is the one rung that lapses on its own. Every other rung is earned by a run and stays earned, because the run happened. This one describes a state rather than an event, so an hourly sweep takes it away when the state stops being true. Losing it leaves L4, which the runs did earn.
Why the pre-launch case is handled separately
Externally verified means a public endpoint was checked from outside. Plenty of products have a repository and no live domain yet, and gating the first rung on a verified domain used to strand them at the bottom of the ladder however deeply their code had been examined.
So a product with no public endpoint at all reaches the first rung on a completed deep run instead. A product that does claim an endpoint still has to verify it, because otherwise a live product would be claiming external verification it never earned, and the word external would stop meaning anything.
The rung that expires
Every rung up to production validated is earned by a run and stays earned, because the run happened. A product that was code verified in March is still code verified in June: that is a fact about the past and the past does not change.
Continuously validated is not a fact about the past. It says re-validation is still happening, which is a claim about now, so it has to be able to fall away when it stops being true. An hourly sweep is what notices, because nobody re-validates a product they have abandoned and a rule that only ran during a validation could grant this rung and never take it back.
Losing it leaves production validated, which the runs did earn. The alternative, a badge reading continuously validated six months after the last automatic run, would undermine every other claim on the page it sits on.
What the ladder is not
It is not a maturity model and it does not rank companies. A product at the second rung with a clean result may be in better shape than one at the fourth with known failures: the rung says how much was examined, and the score says what was found. Reading one as the other is the most common mistake made with it.
It is also not a certification, and no rung is awarded by anybody. A rung is a consequence of runs that completed, which means it can go down as well as up, and a Passport shows the date so a reader can decide whether that date is recent enough to care about.