Vallum Trust & Evidence Center

Scoped Authorization Receipt

In the target architecture, a protected operation would begin with a scoped authorization decision that records the tenant, request, evaluated policies, and outcome. Build 01 implements the underlying tenant-bound request and policy-decision contracts locally; Titan Handshake is not a released service.

Fail-Closed Trust Decision

The Build 01 policy engine denies by default when required context is missing, tenant boundaries conflict, roles are insufficient, or data rules block the action. A future hosted adapter would need durable decision evidence and production reliability controls before this target behavior could be claimed operationally.

Evidence Package

A proposed portable bundle of decision records, manifests, metadata, and integrity references. Build 01 provides a local deterministic hash-chain reference package, not an issued evidence package or independent verification service.

Cryptographic Provenance

The target design calls for tamper-evident provenance and explicit chain verification. Build 01 demonstrates deterministic hashing, redaction, and tamper detection locally; signing infrastructure, key custody, external timestamps, and third-party verification are not implemented.

Tenant-Scoped Evidence Boundary

Build 01 contracts and policy checks are explicitly tenant-scoped, and cross-tenant requests are denied in tests. A future evidence service would also need durable tenant isolation and a separately reviewed minimal public-status boundary; neither endpoint is operating in Build 01.

Certificate Lifecycle

The target design includes a non-legal technical-status lifecycle for future review. Build 01 issues no certificates, VERIFIED or CERTIFIED status, audit opinions, or independently verifiable lifecycle evidence.

Public Verification Boundary

A future minimal-status endpoint would need to disclose only deliberately public fields and prevent access to private evidence or tenant data. No Vallum public-verification endpoint is deployed in Build 01.

A future adapter could evaluate tenant context, operation type, and applicable policy before a protected operation. Build 01 exposes local TypeScript contracts and policy functions, not this API.

// Illustrative architecture example — not a currently released API.
// Refer to Titan Forge documentation for current SDK usage.

// Step 1: Request scoped authorization
const receipt = await titanHandshake.authorize({
  tenant: tenantId,
  operation: 'deployment.approve',
  context: { environment: 'production', artifact: releaseId },
});

// Step 2: Proceed only if authorized (fail-closed)
if (!receipt.authorized) {
  // Denial is receipted with reason
  log.warn('Operation denied', receipt.denialReason);
  return;
}

// Step 3: Execute the protected operation
await deployArtifact(releaseId);

Proposed pseudocode only. Build 01 releases no public SDK or hosted service for this operation.

A future evidence adapter could assemble decision records and integrity references into a portable package. Build 01 does not issue or independently verify such packages.

// Illustrative architecture example — not a currently released API.

// Proposed pseudocode only; no Titan Verify SDK is released.
const evidencePackage = await proposedEvidenceAdapter.assemble({
  lifecycleRecordId: 'SYNTHETIC-001',
  includeReceipts: true,
  includeManifest: true,
});

// Production use would still require signing, key custody,
// access controls, external validation, and independent review.
console.log(evidencePackage.plannedPublicStatusUrl);

Proposed pseudocode only. Build 01 releases no public SDK or hosted service for this operation.

A future signing component could seal approved evidence outputs. Build 01 has deterministic hashing and tamper detection only; it has no production signing keys, custody service, or audit-output issuer.

// Illustrative architecture example — not a currently released API.

// Proposed pseudocode only; no Titan Sign service is released.
const sealingProposal = await proposedSigningAdapter.prepare({
  packageId: evidencePackage.id,
  provenance: 'synthetic-deployment-review',
});

// A future implementation would need protected keys, custody,
// external timestamps, revocation, and independent validation.
console.log(sealingProposal.plannedIntegrityReference);

Proposed pseudocode only. Build 01 releases no public SDK or hosted service for this operation.