We don't ask you to trust a number on a slide. Every R-Series reference test below was re-run from a clean checkout of the frozen tag audit-tob-v1.1.0 on 27 Jul 2026 (Node v22.22.3). Here are the results, the exact commands, and — deliberately — what each one does not prove.
Ground-demonstrated, not externally audited. The post-quantum leg uses real ML-DSA-65; key custody is a software signer, not a FIPS-certified HSM. Nothing here is flight-qualified. Every figure below traces to a run we executed with the command shown. The reference-core runs are executed from a private repository, so they are reproducible by us and auditable by you, but not currently re-runnable by you; the R+2 / R+3 artefacts in the public repositories are.
H-1 adversarial fuzz — corrected 28 August 2026. The suite runs 404,000 adversarial cases (signature malleability · downgrade · Merkle forgery). The original oracle could not detect the relabel-to-legacy downgrade attack it enumerated: it counted a slip only when the receipt was not flagged as downgraded, while that attack sets the flag. Re-run with the corrected oracle against the frozenaudit-tob-v1.1.0code, the suite reports 309 slips out of 404,000, not 0. The underlying signature-suite binding defect is repaired in the current implementation (commits85e3d09andc66e25d, 28 August 2026), where the corrected suite reports 0 slips. The repair is not present in the publishedaudit-tob-v1.1.0tag. Evidence for the repaired state will be republished against a new frozen baseline.
Mandatory non-claim (stated up front): Post-quantum signature: the current R-Series hybrid profile signs the post-quantum leg with real ML-DSA-65. Key custody: a software signer — hardware-backed HSM/KMS custody is a separate deployment control, is not deployed here, and no FIPS 140-3 / FIPS 204 / FIPS 205 validated module is claimed. Anchoring: the Base rail is live; the Bitcoin/OpenTimestamps rail is a deterministic stand-in and runs DARK by default — an anchoring rail, not the post-quantum signature leg. Not flight-qualified. Not independently audited by external third parties.
git checkout audit-tob-v1.1.0 # frozen tag · commit 697f339 npm install # test deps only — 0 production deps node test/run-all.mjs # → ALL REFERENCE SUITES GREEN
Erratum against all five report PDFs — 30 August 2026. Every PDF linked on this page carries a post-quantum sentence that describes the signature algorithm as a “size-conformant ground stand-in”. That is wrong: the PQ leg uses real ML-DSA-65. What is a stand-in is key custody — a software signer, not a FIPS-certified HSM. Report 1’s PDF additionally predates the H-1 erratum above. The PDFs are preserved unmodified and are pending a coordinated re-issue of all five together. Read the full erratum, report by report →
What it proves. The R2 v1.1 reference suite passes in full, from a clean checkout. Every number below is printed with the population it counts, because two of them count different things over different populations on different dates:
391159c8…, dated 18 Aug 2026 (Gate A closed by internal verification — not an external audit; no R-Series component has been externally audited).test_H2a_property.mjs's 8 property-assertions, reported as "ok") is the 27 Jul 2026 run, retained here as dated historical evidence. It is not a smaller version of the figures above; it is an earlier population on an earlier date.$ node test/run-all.mjs ✓ test.mjs 18 · keyreg 6 · interop 13 · groupA 24 · groupB 18 · groupC 18 ✓ groupD 18 · groupE 20 · groupF 20 · groupG 16 · H2a ok · H2b 15 · H3a 9 ALL REFERENCE SUITES GREEN
What it proves. A root anchored to both rails verifies on each independently; when one chain is down the other still proves the root; when both are down the system reports UNANCHORED honestly rather than faking permanence. DARK by default — a live rail is refused unless its *_LIVE=1 flag is set.
$ node --test test/dual_anchor.test.mjs # tests 15 · pass 15 · fail 0
What it proves. The verifier's accept/reject behaviour matches Google's public Wycheproof Ed25519 test vectors on all 150 edge cases — the adversarial suite the industry uses to catch signature-verification bugs.
$ node test/test_wycheproof_ed25519.mjs Wycheproof Ed25519: 150 passed, 0 failed of 150 RESULT: PASS — verifier matches Wycheproof accept/reject on all edge cases
What it proves. For the ML-DSA-65 modes the receipt layer actually uses, the verifier matches NIST's official ACVP accept/reject vectors, 16/16. The 44 skipped modes are ML-DSA parameter sets outside receipt-layer usage — out of scope, not failures.
$ node test/test_nist_acvp_mldsa65.mjs NIST ACVP ML-DSA-65 sigVer: 16 passed, 0 failed, 44 skipped (modes outside receipt-layer usage) RESULT: PASS — PQ leg matches official FIPS 204 accept/reject vectors
What it proves. Software supply-chain, model lineage, AIBOM, compute, and content-disclosure roots bind into one MMR-anchored passport that a client verifies offline (7/7), with coverage computed and honestly enforced (absent domains commit a signed em-dash sentinel; over-claims are rejected two ways).
$ node test/fabric.test.mjs R+12 FABRIC: 33 passed, 0 failed [buyer/regulator verifies OFFLINE] PASSPORT VALID ✓ (7/7)
Each figure on this page came from a command we ran against the frozen tag, not copied from an earlier document. Three dates are involved and this page keeps them apart: the tag was created 14 Jul 2026, the 13-suite run was executed 27 Jul 2026, and the CORE-AUDIT-C2.9 baseline is dated 18 Aug 2026. The repo is zero-production-dependency; the suites run with node --test, deterministic and clock-free. It is a private repository, so "reproduced" here means reproduced by us from a clean checkout and published as evidence — it does not mean you can run it today. If a number here doesn't check out, tell us — we'll fix it or remove it. That's the deal.
R+2 and R+3 artefacts in the public repositories are reproducible by anyone from a clean clone. The reference-core evidence records are produced from a private repository at tag audit-tob-v1.1.0; they are published as evidence, not as runs you can currently reproduce.