Verifiable security

Verify, instead of asking for trust. Whoever receives an evidence package can check its integrity, signature and context with a verifier that runs in their own browser. The verifier itself is distributed by the R-TITAN website: this is why its expected fingerprint and the remaining trust are declared.

On test packages, the verifier checks signature, fingerprints, key trust and coverage in the browser, as separate outcomes. The check runs in a Worker, an isolated browser context. During local verification, the selected package is not uploaded to a server.

Evidence: Qualified on Linux with a receipt. Tested in the Edge browser, Chromium engine, in the development preview, 24 September 2026: 11 cases out of 11.

An authentic package can still be the wrong one. The test protocol binds the package to the organisation, mission and run context, and rejects the mismatches exercised by the test bench: a different archive, a superseded key snapshot, a context expired even during verification, a clock moving backwards.

Evidence: Qualified on Linux with a receipt, 24 September 2026. Tested in the Edge browser in the development preview, 25 September 2026: 33 cases out of 33, together with signed evidence.

In the qualified path, the downloaded bytes of the verifier are checked against the expected fingerprint before execution, and the browser runs those same bytes. Every resource opened during verification is closed.

Evidence: Qualified on Linux with a receipt, 25 September 2026. Tested in the Edge browser in the development preview: 42 cases out of 42, with complete release of resources. Byte-by-byte comparison with the files served in production performed on 27 September 2026; verification in the browser in production has not yet been performed.

Minimised, versioned audit export; review decisions recorded together with the trail that documents them; a single allow-list of domains for external sources. In production since 27 September 2026.

Evidence: Database update applied and privilege inspection passed on 27 September 2026; the review decision has not yet been exercised in production.

The console presents the result of a mission and produces a PDF copy, not certified, after checking the mission outputs against the result inventory. The copy is not proof of signature nor of the correctness of the content.

Evidence: In production since 27 September 2026: authenticated reading of a real mission and of its PDF copy verified against the original outputs.

Changes to the controls are accompanied by automated tests and, in documented cases, by mutation counter-tests: defects are deliberately reintroduced to make sure the tests detect them. The verification components are qualified on Linux with receipts and tested in a real browser.

Evidence: Candidate v34: 311 tests out of 311, typecheck and build successful locally, 26 September 2026. Browser tested: Edge, Chromium engine; Firefox and Safari not yet.

The producer is qualified offline; runtime I2 has been deployed with the KMS key configuration. The first signed issuance for a real mission and its authenticated verification on the website remain to be verified. The verification tests described on this page concern test packages and test keys.