Standards
Open by construction. The formats our verdicts ride on are published open specifications anyone can read, implement, or object to — so the proof you rely on is never locked inside one vendor.
Each is a versioned RFC-style document with a public comment window, a GitHub repository for proposals and objections, and a commitment to transfer editorial control to a neutral body once external adoption and standards-track recognition justify it. None is a paid product.
Architecture background for the specs on this page: the PEP/PDP/PIP model, the four obligations a PIP owes a PDP (facts with provenance, coverage honesty, a freshness contract, verification without trust), and how the published surfaces implement that contract.
What a PIP owes a PDP: per-source facts each labeled with a coverage tri-state (observed_clean / never_observed / degraded — an observation, an honest blind spot, or a failure, never a guess), a freshness contract (valid_until, stale_if_error), and an Ed25519 signature binding via key_id. Facts, not verdicts — the trust decision stays in your policy engine. Live on every POST /v1/verify response; includes an OPA/Rego consumption example and a streaming (NDJSON) form with a published conformance vector.
The reconciliation layer above all roots of trust. One verdict, keyed on an Ed25519 key, that reconciles what the key can prove about itself (its attestation tier across roots — a bare self-attestation or a RATS/EAT hardware token) against what the network has seen its subject do (Scry × Sigil × GhostRoute × Tracker). Surfaces over-claim contradictions no single root can. Ships as a self-verifying receipt with an RFC 6962 inclusion proof and witness cosignatures — verifiable offline, no call back to TunnelMind.
Open identifier standard for entities that observe, profile, or act against users, devices, and networks. Free resolution, permanent canonical identifiers, signed observations. CVE-style editorial model.
The wire shape every TunnelMind sensor speaks when submitting a first-party observation to the corpus. Compact-JSON canonicalization, Ed25519 signature over the record, producer-agnostic (Familiar today; commodity sensors, contribute-and-earn third parties, and future microkernel devices in future). Single canonical schema URL pins forward compatibility.
A per-customer, append-only, hash-chained ledger of an agent’s verdict receipts, with Ed25519 signed checkpoints and regime-mapped signed exports (EU AI Act Art.12, DORA, NYDFS Part 500, HIPAA, PCI DSS, SOC 2) in signed_json / CSV / EAT / STIX. You pick the regime, retention, and format; an auditor verifies the chain independently against the published receipt key.