The Hardening

Why this page exists

We sell assurance you can check. The white paper describes the architecture as it stood when it was published. This page describes what happened next: the company turned its own examination on itself, a full hardening study of the backbone, every part of it, run in October 2026. What the examination found is printed here at the same size as what passed. The work it set is still running. Publishing the account before the second examination, rather than after it, is deliberate: the state going in is part of the record.

How the examination ran

Every team in the company filed three assignments against the backbone: break it, use it, harden it. An outside red team ran the same three assignments against the same evidence. The assembled claims were then graded by people who did not make them, and every claim was capped at what its evidence carries. One rule governed the whole run, and it governs this page: a standard is claimed only when an outside body grants it, and a capability is stated at the level its measurements support, never above it.

Five first-contact tests closed the run. Their verdicts, in the examination's own register:

1. Hostile concurrency, many writers striking the audit chain at once. STATE: SURVIVES WITH FINDINGS.
2. A cold outside review, a reviewer meeting the work with no goodwill and no guide. STATE: DOES NOT SURVIVE AT FULL SCOPE, on content substance. The provenance of every number survived; some of the content behind the numbers had not yet reached the standard its provenance set, and the examination said so.
3. Unreliable infrastructure, the ground failing under the work. STATE: SURVIVES WITH FINDINGS. Transport survives; knowing the state of things, mechanically, is the owed work.
4. A motivated adversary, a skilled attacker with the public record and time. STATE: SURVIVES WITH FINDINGS. The gating survives that adversary; the confidentiality of key material against the same adversary is the named work, and until it closes the company's posture is stated exactly this way: gated, short-lived, honestly disclosed.
5. A customer's security review, a regulated buyer grading the company the way buyers do. STATE: SURVIVES WITH FINDINGS, with conditions that now stand as the gate any pilot must clear.

What it found

The findings ranked foundation first: the layers everything else stands on outrank any product built on them. They also sorted on one line that matters. Half of them are missing measurements of controls that exist, not missing controls. A missing measurement is the cheaper fix, and it is still a finding until the number exists.

The audit chain under concurrent writes. A repair was executed and independently corroborated. What is still owed is the standing monitor that catches the next break by machine, and the measured time it would take. STATE: PARTIAL. DETECTION TIME: NOT YET MEASURED.

Key material and the written record. The rule is metadata only: keys are never printed, pasted, or carried in the open. Today that rule is kept by discipline. The technical layer that intercepts key-shaped material before it can be written down is the owed gate. STATE: PROCEDURAL TODAY.

The path things publish by. Confirmations stood open longer than they should have, because a person, not the path, was watching. Confirmation inside the path itself is owed. STATE: NOT YET BUILT.

Revocation. Authority can be revoked, and the path is practiced. The measured interval from revoke to dead does not exist yet, so today revocation is a practice, not a provable time. STATE: NOT YET MEASURED.

One operator. The hands that build, verify, and attest are today one operator's. The fix is a countersign rule: no number publishes on a single attestation where a second signature can be had, with outside attestation sequenced behind it. STATE: RULE NAMED, MECHANISM OWED.

Independent assurance. No outside body has tested anything. STATE: NONE.

The honest number, labeled as what it is

Alongside the examination, the company re-verified its own legacy audit chain against three independent sources, record by record: 15 events examined, 14 corroborated in full, 1 in part, 0 contradicted, a corroboration of 93%, with the full result disclosed wherever the figure is used, including the part that did not corroborate. In the same season the system caught one of its own headline figures inflated and retracted it to the defensible number, in public. That is the discipline this page is written under: the number that survives checking is the only number that prints.

The standards we build to, stated plainly

This page claims no certification, and the company holds none. The architecture is designed to meet, and built to exceed, the governing standards of the domains it enters, receipts first: SOC 2: NOT HELD (Type I is the next engagement; Type II follows on its evidence window) · ISO/IEC 27001: NOT HELD · ISO/IEC 42001: NOT HELD · HIPAA: NOT CLAIMED (Security Rule safeguards in the design; BAA readiness by design) · Section 508: NOT STARTED (conformance to be stated by a current Accessibility Conformance Report against WCAG 2.1 AA). One sequencing fact, printed because it is the kind of fact that gets rounded: the evidence window for a SOC 2 Type II attestation opens when the instrumentation that produces the evidence is verified in place, and not before. An attestation over a window the system could not evidence would be a claim without a receipt.

The backbone the design is built against is NIST SP 800-53 Rev. 5 and the NIST Cybersecurity Framework 2.0, with CMS ARC-AMPE for Medicaid and the NIST AI Risk Management Framework mapped for the agents themselves. In the design register, named as design register and not as coverage: DISA STIGs, OWASP, FIPS 140-3, the GLBA Safeguards Rule, and FFIEC guidance. On the roadmap, named as roadmap: GovRAMP, HITRUST, CMMC 2.0, and FedRAMP. A standard is claimed only when an outside body grants it.

The pace

The company's records are built to live for decades, and material captured today can be read by the machines of a later decade. So the pace of the cryptography work is set by the data's lifetime, not by any predicted arrival date. The design target, stated as a target: the long-lived layers migrate to the standardized post-quantum families on a derived schedule, and every algorithm in the backbone is swappable without a redesign, so a migration is a rotation, never a rebuild. No migration is claimed on this page. The target is printed so the work can be checked against it.

What happens next

The order from here is the order this page was published in. First, the account stands in public, before the second examination rather than after it. Then the remaining work is finished and checked, item by item, against the measurements named above. Then the company examines itself again, and the second examination's results succeed this page in the open, whatever they say. Nothing on this page is the end of anything. It is the state going in, on the record.