What a third party can check
The statement this product makes about a change — five things checkable from your root public key alone — and the conditions under which each one holds.
This page is the statement, in one place, of what the product lets a person outside your organisation check about a single change. Every sentence is bounded by the limits of the signed record. Read the two together: the statement without the limits overstates, and the limits without the statement understate.
The statement
For a change, a third party who holds only your organisation's root public key can check, on their own machine:
- The order, in full text, was signed by the person who issued it.
- The execution status was signed by the agent seat that did the work, and that seat traces to your root.
- The review verdict and the review notes were signed by the reviewer's seat, a seat of its own.
- The human decision at a gate was signed by the person's own key — a browser passkey or a local security key — and the signed assertion is kept.
- Nothing was altered afterwards, and no signature belongs to a key that had been revoked before it was used.
"Non-repudiable" is earned only when all five check out offline with the public verification tool — and only in the sense the conditions below allow. A document, a gate or a deployment for which a condition does not hold is not covered by the word, whatever the other four show.
⚠ In this release the check cannot be run end to end from shipped commands alone. The folder the verifier reads is produced by a library call, not by a saphan command, and the verifier saphan-verify is not in the release packages — it is built from source. Verify a change yourself says what that means for you.
Which page states each item
| # | Item | Stated and bounded on |
|---|---|---|
| 1 | The order, signed by the person who issued it | Security: the record, what you can prove afterwards · limits |
| 2 | The execution status, signed by the executing seat | What the record guarantees |
| 3 | The review verdict and notes, signed by the reviewer's seat | What the record guarantees · tracing one change backward |
| 4 | The human decision at a gate, signed by the person's own key | What the record guarantees · what this does not prove |
| 5 | Nothing altered afterwards; no signature by an already-revoked key | Verify a change yourself |
The conditions, in plain words
- Orders. Every order a run receives carries a person's passkey approval, bound to the exact order text, single-use and time-limited; the door that places an order refuses one that is unapproved, expired or already spent. Whether the order's chain back to your root is also enforced is the
trust.enforcesetting, off by default — read it on the deployment, not on this page. - Gates. A person's touch signs the gates that belong to the owner. A seat signs the gates that belong to a master or a reviewer. That holds for gates decided after the owner declares the person epoch. Until the owner declares it, gate rows are signed by the workspace key, which shows that a machine of the workspace wrote the row and does not show which person decided. Item 4 therefore holds only for gates above the epoch.
- "As of a checkpoint." The answer is "verified as of checkpoint X". A revocation recorded after X is not covered by that answer; a newer checkpoint covers it.
- One signer. Each act is signed by one key. There is no quorum.
What the statement does not say
It does not say the product is certified, and it does not say your organisation is compliant; conformity remains your auditor's verdict (audit and compliance). It does not describe any one deployment's state. The next page says how to run the check yourself: verify a change yourself.