SOURCE
Immutable identity
- Repository, branch and full commit SHA
- Language, package and binary versions
- Licence and third-party provenance
Buyer-run verification · claim boundaries · known limitations
Technical Due Diligence.
Evaluate each component at an immutable commit, run its own verification path and preserve the exact output. Qualification is scoped to the repository, platform and boundary stated by that evidence.
DON'T TRUST THE DEMO. VERIFY THE SYSTEM.Control Substrate
INTERCEPT → DECIDE → AUTHORIZE → COMMIT → EFFECT → RECONCILE → PROVE → REPLAY
Domain desks integrate beside incumbent systems through authenticated notifications, authoritative rereads, exact source bytes and cryptographic commitments. A webhook is a trigger; it is not automatically authoritative evidence or a synchronous prevention hook.
Evidence expected per component
VERIFY
Buyer-run command
- Native and container commands where implemented
- Unit, integration and hostile tests kept distinct
- Toolchain, OS boundary and retained output
SECURITY
Failure behaviour
- Authentication and tenant isolation
- Fail-closed versus alert-only modes
- Tamper, omission, duplication and crash cases
EFFECT
Consequence semantics
- Exact operation and authority binding
- Pre-execution receipt only where a true gate exists
- Ambiguous outcomes held for reconciliation
Qualification vocabulary
| Term | Meaning | Does not mean |
|---|---|---|
| IMPLEMENTED | Code and tests exist in the named tree. | Production operation. |
| QUALIFIED | A named matrix passed at a specific commit and environment. | Certification or universal correctness. |
| PARTIAL | An internal path exists but a named dependency remains. | End-to-end qualification. |
| PROVEN | A specific proof object verifies under its protocol. | Truth of facts the protocol never observed. |
| DIVERGED | Observed evidence differs from the committed record. | Automatic attribution of fault. |
| UNRESOLVED | Evidence cannot determine the effect. | Permission to retry a possibly started effect. |
Current honesty boundary
Independent pre-revenue software R&D. Working source and local or CI qualification are not claims of ARR, customer adoption, public production traffic, SOC 2, Home Office or OfDIA approval, payment-institution status, live betting profitability, or fitness for a buyer's regulated use.
Live credentials, customer consent, public HTTPS, production key custody, source licences, external-provider contracts, deployment topology, backup/restore, load and buyer acceptance remain separate diligence items unless proved explicitly.
Review path
- Select the smallest relevant component or desk.
- Pin the commit and run its stated verification.
- Inspect exclusions and failures, not only pass counts.
- Exercise mutation, interruption and reconciliation.
- Agree external dependencies before commercial evaluation.