Current release status
Public document hashing and exact integer aggregation are live with signed results. Native consensus, mining, issuance, COMPUTE payments and rewards are inactive. Independent operation is not yet demonstrated.
No independent audit claim
Recorded internal/adversarial software tests are not a genuine external security audit or production economic-security proof. No SOC/ISO/GDPR certification is claimed.
Available evidence
The frozen compound source has 70 scoped Linux cases and five internal TLS phases on one administration, with separate evidence scopes and limitations. Do not add overlapping earlier test totals or infer real independent operators.
Qualification still required
Actual independent resources/WAN/costs, ratification and target-specific migration/recovery/financial activation are outstanding. Passing tests cannot supply an honest-resource majority or consent.
Trust boundaries and practical checks
Security comes from specific controls and explicit assumptions. No website badge, AI review or internal test count is an independent security audit.
| Boundary | Implementation / evidence | Meaning |
|---|---|---|
| Browser boundary | Same-origin HTTPS / fixed upstream routes | No caller-selected upstream or server-side wallet signing |
| Evidence boundary | Pinned policy / canonical commitments / Ed25519 | Reject altered, duplicate, unknown or mismatched attestations |
| Execution boundary | Fixed source, bounded input/runtime, non-root isolation | No arbitrary uploaded program or privileged host command |
| Economic boundary | Production activation remains gated | A receipt cannot authorize issuance, payments or governance |
Practical procedure
- 1Verify software/policy provenance through an independently trusted channel.
- 2Keep private identities local with restricted permissions.
- 3Retain authentic evidence and classify the scope of each successful check.
- 4Stop on source/state/runtime mismatches; never replace a failed check with a simulated success.
Read-only source and pinned artifacts ├─ HTTPS public API / bounded inputs ├─ qualified fixed-source runtime ├─ known-policy receipt verification └─ separate financial/consensus activation gate
Limits and failure cases
- Signatures do not prove independent administration or arbitrary computation correctness.
- Internal tests are scoped evidence; they are not an external audit or economic-security guarantee.
- No certified SOC/ISO/GDPR service or paid bounty commitment is claimed.