Trust · Prototype baseline
Trust starts with present-tense facts
This page separates controls demonstrated in the prototype from production configuration, organizational assurance, and future work.
Inspectable claims. Declared scope. Human accountability.
Product data boundary
The public website is designed as a separate application and deployment boundary. It must not share product customer sessions, product credentials, or customer data access. First-contact forms must not receive controlled documents.
Systems of record
QMS · DMS · GRC · ALM · requirements · workflow
Controlled content and approvals remain here.EvidView
Scoped versions → governed findings
No implemented connector is implied.Specific controls in the locally qualified prototype
The M1–M4 workflows use named actors, expiring revocable server-side sessions, centralized role checks, CSRF protection for cookie mutations, tenant-scoped API authorization, and append-only decision history.
- This is not a statement that the product is secure, certified, compliant, penetration-tested, or production-ready.
- Provider and deployment controls require separate production verification.
Evidence and auditability
Material change and positive impact records can retain exact evidence, versions, relationship basis, and reconstructable paths in the locally qualified scope. Frozen M3–M4 provenance supports replay of recorded deterministic and model-free projections against pinned inputs.
Every material conclusion keeps an inspectable basis
Follow one bounded impact finding back through its relationship, semantic record, exact excerpts, source locator, and frozen evaluation basis.
Inspect the basis for WI-08
- Impact findingWI-08 · potentially affected
The work instruction repeats both changed fields.
- Dependency edgereferences and restates
exact reference plus structural match · deterministic reference rule v1 · confirmed
- Semantic DeltaSD-SYN-001
OPTIONAL → MANDATORY; WITHIN 30 CALENDAR DAYS → WITHIN 15 CALENDAR DAYS
- Exact version evidencev4.1 → v4.2
The Quality Investigator may initiate the investigation within 30 calendar days of intake.
The Quality Investigator must initiate the investigation within 15 calendar days of intake.
- Source identityQMS-SOP-014 · Nonconformance Investigation
Section 6.2, paragraph 2
- Frozen evaluation basisCMP-SYN-2026-09-15-01
GRAPH-SYN-2026-09-15-01 · maximum depth 3; maximum 25 retained paths
- 1Source
- 2Evidence
- 3Claim
- 4Verification
- 5Human approval
- 6Closure
Uncertainty and evaluated scope
Known ambiguity, stale inputs, unsupported evidence, failures, and exhausted budgets remain visible. Unaffected language applies only to successfully processed objects inside a declared frozen graph and evaluation boundary.
Inspect the path, not just the outcome
Select a target to inspect its node, relationship basis, evidence, lifecycle state, version, and bounded impact reason.
Choose a target
Target node · WI-08
Investigation Work Instruction
- Source evidenceQMS-SOP-014 v4.2
- Semantic DeltaSD-SYN-001
- Relationshipreferences and restates
- TargetWI-08
- Object
- WI-08 · Investigation Work Instruction
- Type
- Controlled work instruction
- State
- confirmed
- Reason
- The work instruction repeats both changed fields.
- Source
- QMS-SOP-014, Section 6.2, paragraph 2
- Evidence
- Section 2 cites QMS-SOP-014; section 4.1 repeats the 30-day initiation window.
- Relationship
- references and restates
- Origin
- exact reference plus structural match
- Method
- deterministic reference rule v1
- Lifecycle state
- confirmed
- Graph version
- GRAPH-SYN-2026-09-15-01
- Comparison
- CMP-SYN-2026-09-15-01
Target node · CL-04
Investigation Intake Checklist
- Source evidenceQMS-SOP-014 v4.2
- Semantic DeltaSD-SYN-001
- Relationshipimplements
- TargetCL-04
- Object
- CL-04 · Investigation Intake Checklist
- Type
- Controlled checklist
- State
- confirmed
- Reason
- The acceptance criterion contains the previous deadline.
- Source
- QMS-SOP-014, Section 6.2, paragraph 2
- Evidence
- Checklist item 7 asks whether initiation occurred within 30 calendar days.
- Relationship
- implements
- Origin
- field-to-claim match
- Method
- policy rule v3
- Lifecycle state
- confirmed
- Graph version
- GRAPH-SYN-2026-09-15-01
- Comparison
- CMP-SYN-2026-09-15-01
Target node · TR-22
Investigator Refresher Training
- Source evidenceQMS-SOP-014 v4.2
- Semantic DeltaSD-SYN-001
- Relationshiptrains
- TargetTR-22
- Object
- TR-22 · Investigator Refresher Training
- Type
- Training module
- State
- inferred — review required
- Reason
- The content is semantically related, but the relationship is not yet confirmed.
- Source
- QMS-SOP-014, Section 6.2, paragraph 2
- Evidence
- Module 3 teaches investigation initiation timing but does not cite the SOP identifier.
- Relationship
- trains
- Origin
- semantic candidate
- Method
- bounded candidate classifier v2
- Lifecycle state
- inferred — review required
- Graph version
- GRAPH-SYN-2026-09-15-01
- Comparison
- CMP-SYN-2026-09-15-01
Declared boundary: A result applies only to this declared synthetic portfolio, frozen graph, applicability policy, and evaluation budget.
Public-site providers and form handling
The public site uses Cloudflare for delivery and security, Turnstile, short-lived EU-jurisdiction D1 form storage, and disabled-by-default non-essential measurement; Beget hosts project mail and delivers opaque receipt notifications; GitHub supports source review and delivery automation.
- Active form retention: 30 days.
- Approved deletion requests target active rows within 7 business days after verification.
- The current D1 plan may retain recoverable history for up to seven additional days; restoration must reapply the deletion ledger.
- Form content must not appear in application, security, CI, or email notification logs.
- Non-essential analytics remains off until explicit opt-in under the approved design.
AI limitations
- Model output is not verification by itself.
- A dependency inferred by a model is not a confirmed dependency.
- A score is not probability of truth.
- The system does not establish unrestricted language truth, source correctness, legal or regulatory correctness, or external-world completeness.
- Human policy and contextual judgment remain required.
Current status matrix
- Implementation: M0–M4 exists in the repository.
- Verification: locally qualified with synthetic fixtures and named records.
- Availability: Prototype; no production availability.
- Evidence: thesis, synthetic cases, and one internal one-path development benchmark; no customer, partner, pilot, or commercial evidence.
Operating boundary
The public inquiry form is an initial-contact channel, not a product account or document-upload surface. Optional analytics remains disabled. EvidView will reassess its legal, provider, security, and retention controls before trading, contracts, sensitive data, locally targeted activity, analytics, profiling, or material growth.
Next step