Deployment gate

Three things had to be true before there was a decision at all, and they were checked in this order. First the evidence: verifyPassport() canonicalised the document you dropped and checked its Ed25519 signature against the key published in the governance table — the same check, in the same order, with the same exit codes as plan_d/src/verify_passport.py. Second the policy: its rules were read to find every inference.* path it actually asks about, and the controls in region 3 were built from those paths and from the lists inside your passport. Third the decision: rules are tried in file order and the first match wins, which is why the trace above marks a rule that also matched as shadowed rather than hiding it.

A document that does not verify stops all of that. Where the loaded policy has a rule reading runtime.signature_valid, runtime.passport_present or passport.expiry_utc, that rule fires and the policy is what refuses. Where it has not, this page refuses and says so, because a gate that reasons about an unverified document is a gate that can be lied to.

The record below is built by chainEntry(), the browser port of the hash-chained ledger in plan_d/src/heldout/ledger.py: each entry hashes its own contents and names the hash of the entry before it. Editing a recorded decision therefore breaks that entry and every entry after it, which is a claim you can test on this page rather than take on trust. Nothing is persisted and nothing is sent anywhere — the chain lives for the life of this tab.

The signature is checked over the whole document, because that is what was signed. Policy paths are then resolved against a projection of it — identity, expiry, issuer, the cross-site block without its full matrix, the scalar metrics of each evaluation, and the acquisition envelope when the certificate carries one — which is the identical projection the Trust Runtime page evaluates against, imported from one module so the two cannot drift. Fields are copied or dropped, never re-derived.

Every example policy offered here is marked example and none is loaded for you. In deployment the policy is authored by the operating institution, with its thresholds, reviewed under its clinical governance.

Trust Runtime