◇ COMPLIANCE SURFACE
Audit Center
Current verification posture, stated without embellishment. Rows marked PENDING are genuinely incomplete; rows marked DECLARED are intentions we have written down but do not yet enforce in code.
STATUS · Independent Security Audit: Pending. No certification is claimed.
BUILD IDENTITY
What exactly is running, and can it be bound to a commit.
- VERIFIEDRepository versionv1.3.0Console release tag shown in the command bar.
- PENDINGGit commitunrecordedSet VITE_GIT_COMMIT at build time to bind the running bundle to a commit.
- PENDINGBuild timestampunrecordedSet VITE_BUILD_TIME at build time. Unrecorded is stated, never guessed.
- VERIFIEDDeploymentuniversaltruth.life · hosted build + IPFS-pinnable bundleThe hosted build is a convenience, not a trust root. Pin and compare the CID.
AUDIT STATUS
External review posture and reproducible evidence.
- PENDINGIndependent security auditNot commissionedNo certification is claimed. Scope is defined in docs/AuditScope.md.
- VERIFIEDContract audit bundleSHA-256 8f21bb6e…09a30 · Bitcoin block 959472Frozen and anchored. Reproduce with sha256sum and `ots verify` against docs/.
- VERIFIEDPreflight invariants8/8 PASS (contracts/scripts/preflight.js)Re-run locally: cd contracts && npm run preflight — must exit 0.
- VERIFIEDAnchor coverage12 recorded Bitcoin anchorsEach entry is reproducible by re-running `ots verify` on the original bytes.
CONTRACT & GOVERNANCE
On-chain surface, ownership model, and the mainnet gate.
- VERIFIEDTruth Coin — testnetSoulbound ERC-20 on Base Sepolia. Read live on the Truth Coin view.
- BLOCKEDTruth Coin — mainnetgatedSafe multisig on Base not created / not recorded · Independent third-party audit not commissioned / not recorded · Admin time-lock declared (48h) but not enforced by deployed code
- PENDINGOwnership — Safe multisigNot createdTarget is a 2-of-3 Safe on Base. Two-step ownership transfer prevents orphaning.
- DECLAREDAdmin time-lock48h · declared, not enforcedEnforcement requires a deployed Safe module. A declared delay is an intention, not a protection.
VERIFICATION
The controls that decide whether anything renders green.
- VERIFIEDVerifiersrc/lib/signed-envelope.ts — ARCHANGEL/v0, fail-closedSingle trust decision point. Signature checked over raw bytes before parsing.
- VERIFIEDFreshness boundsTTL ≤120s · future skew ≤30s · counter monotonicity server-sideBounds replay of genuinely signed payloads.
- VERIFIEDScheduled re-verificationpg_cron `reprobe-mesh-15m` → /api/public/hooks/reprobeServer repeats the identical check every 15 minutes. Rows are derived data only.
- VERIFIEDTelemetryOFF by default (LOCAL / POSTHOG opt-in)Only POSTHOG mode emits packets, and it is opt-in per operator.
DOCUMENTATION
Written answers to the questions a reviewer asks first.
- VERIFIEDArchitecturedocs/Architecture.mdLayers, modules, and the end-to-end verification flow.
- VERIFIEDSecurity modelSECURITY.md · docs/SecurityModel.mdDisclosure policy, threat model, key and secret handling, residual risks.
- VERIFIEDAudit scopedocs/AuditScope.md · docs/AUDIT-TRANSMITTAL.mdIn-scope and out-of-scope surfaces, plus bundle reproduction steps.
- VERIFIEDGovernancedocs/Governance.md · POLICY-OF-INTENT.mdWho can change what, and how a third party checks the rules were followed.