security - the model

wrong records
get caught.

we don’t ask you to trust the record. we hand you the inputs to check it.

The commitments
SIGNED
everything is an event

every rotation, revocation and attestation is a signed, dated event on a public record. there is no quiet path.

HELD
keys stay with the owner

hosted ceremonies are tooling around the keys. the keys themselves are never the product and never the hostage.

PUBLIC
checking needs no permission

no account, no api key, no ask. a stranger can replay any record, any time.

INCLUDED
us too

our own records replay like everyone else’s. the rule that catches a liar catches us.

The threat table

attack it.

THE MOVE
WHAT HAPPENS
forge a record
the replay fails - math doesn’t care about confidence
hide a revocation
the day’s record stops recomputing - the gap shows
rewrite history
the signed chain breaks - every line is dated and signed
we lie
you catch us - the inputs are public, including ours
Honest limits
LIMIT 1
a young record is a young record

214 days is evidence; 14 days is a start. continuity is earned in public, at one day per day.

LIMIT 2
who, not what

this layer answers who the agent is. what the agent did is a different question, on a different layer.

LIMIT 3
a grade is a state, not a promise

KNOWN holds until the record says otherwise. the moment it stops being true, the replay stops saying it.