Atlas, built on R-Series, is a private evidence explorer in development. It is designed to check signed R-Series receipts, keep each tenant’s records apart, lay them out on a timeline and export an offline bundle that checks without Atlas.
Atlas does not create evidence. R-Series signs the receipts; Atlas is designed to keep them, check them and show what they establish, in five views.
Every route that reads evidence asks for your tenant’s token, and another tenant’s record looks absent.
In development
Request, approval, action, provider response, receipt and incident, rebuilt from indexed receipts only. Nothing is re-run, and a gap is shown as missing.
In development
Related receipts and records become one case. The policy digest signed into each receipt shows which policy applied, version by version.
In development
Original receipt bytes, trust material, key history and the steps to check them, in one package that a separate verifier checks without Atlas or a DCS account.
In development
Scan findings, the approved change and the re-scan, side by side, from the receipts of each scan run.
In development
Atlas is a capability of R-Series, not a separate product. Like every capability, it has no cryptography of its own.
Atlas issues no receipts. Its checks run only through the R-Series SDK, against a trust bundle and pins set by the operator.
| R-Series part | What Atlas takes from it |
|---|---|
| Receipts | Atlas keeps the original receipt text, checks that text and is designed to export that text, never a re-serialised copy. |
| The evidence contract | Atlas obtains and judges R-Series evidence only through the evidence contract. |
| Verification | Verification takes its policy only by hash and its trust only from operator pins. Atlas passes in no key of its own. |
| R+14 Key lifecycle | Keys resolve only in the registry snapshot that the receipt’s signed body names. The offline bundle is designed to carry that registry snapshot and the key history. |
| Connector OS | Connector OS produces facts. R-Series turns facts into evidence. Atlas reads that evidence and re-runs nothing. |
Six stations, one rule at each. Receipts enter, are checked and are kept per tenant; the timeline, the case and the export follow.
Atlas keeps the original text byte for byte, under the sha256 of those bytes. A re-serialised copy is never stored as the original.
Each receipt is checked only through the R-Series SDK, with keys from a trust bundle and pins in the operator’s configuration. A key carried inside a receipt is never used, and a receipt with one signature is never valid.
Atlas takes the tenant from the authenticated token, never from the request, and compares it with the tenant signed into the receipt. A header that claims an identity is refused, and another tenant’s receipt is invalid in your workspace.
Index fields come only from the signed body of a receipt that checked valid, each marked observed or asserted. The timeline is designed to be rebuilt from them, never by re-running anything, with gaps shown as missing.
Each receipt carries the digest of the policy it was signed under. The investigation view is designed to group related receipts into a case and show policy versions and their differences; a later interpretation stays a separate record.
A case is designed to export as one offline bundle. A separate verifier opens it with pins it holds itself and checks it without Atlas and without a DCS account.
Standard profile: Ed25519 + ML-DSA-65, both signatures required. A higher profile with ML-DSA-87 is in development.
Atlas adds no rule of its own: the verdict is the R-Series engine’s, reported field by field.
| Case | Designed response |
|---|---|
| A receipt with one signature missing or empty | INVALID · MISSING_LEG, and evidence presence INSUFFICIENT |
| A key carried inside the receipt, even the correct one | INVALID · MALFORMED; the carried key is never used |
| Signed bytes edited after signing | INVALID · BAD_SIGNATURE; the carried hash is recomputed, never trusted |
| No pinned trust configured | INVALID for every receipt, never a pass |
| A receipt the old Atlas issued | Kept and labelled; never VALID |
The timeline view is designed to rebuild one run from its receipts: what was asked, who approved it, what ran and what came back. Each step says how it is known.
A bundle carries the receipt exactly as issued, the trust material needed to check it and the steps to follow. The person checking holds the pins separately: pins are never bundle content.
In development
No bundle is demonstrated on this page. A demonstration follows only once the bundle work and its checks are accepted, and the bundle format has had its independent cryptographic review.
When a referenced approval, policy or receipt is absent, Atlas is designed to report it as missing or unknown.
In development
Receipts the old Atlas issued keep their original bytes and carry the label “classical-only, issued before the move, issuer unverified”. They are never shown as valid.
Atlas reports the evidence contract’s status fields on every read, recomputed from the original bytes. Nothing combines them into a single verdict.
| Field | Values |
|---|---|
| Verification outcome | VALID or INVALID |
| Reason codes | None when valid; one or more when invalid |
| Lifecycle | CURRENT, HISTORICAL or RETIRED-SUITE |
| Completeness and time | COMPLETE, INCOMPLETE, INDETERMINATE or PROVISIONAL |
| Execution outcome | PLANNED, EXECUTED, DENIED, FAILED or UNKNOWN |
| Custody | HSM_BACKED, DRY_RUN or SOFTWARE_OBSERVATION |
| Evidence presence | PRESENT, UNSIGNED, MISSING, UNKNOWN or INSUFFICIENT |
Atlas used to be a separate product with its own signing key, trust scores and public routes. That authority is retired, not hidden behind a setting.
Atlas generates no key and signs nothing; receipts come from R-Series.
This is not a certification. Verification checks that the signed bytes match a key. Trusting the issuer also needs an authenticated key binding and policy checks; a valid signature does not by itself prove that the action happened or was authorised.
The bounded change pilot is a separate offer from the assessment: one approved change through Connector OS, with its receipts and an Atlas before/after bundle.
A person approves one bounded change, tied to the plan, the assets and an expiry.
Connector OS runs the change; denial, failure and rollback are evidenced as well.
R-Series signs receipts for the intent, the approval, the outcome and any rollback.
Atlas shows the state before and after the change, side by side.
An offline bundle is checked by a second process with only the public verifier.
Status as of 31 October 2026: In development. Atlas is built on the R-Series engine and is in independent review; ingestion is in development. Receipt V2 revision 7 was issued on 30 October 2026. Evidence Contract v1 was signed with conditions by the programme’s cryptography lead on 30 October 2026. Every statement on this page is drawn from the claim register of that date.
Own cryptography removed, checks through the R-Series SDK, private by default, legacy evidence labelled. In development.
Durable, private intake: tenant from authentication, restart recovery, missing evidence shown, an index rebuilt from the originals.
Timeline, policy history, the offline bundle and the assessment view. The gate: a customer checks the bundle without Atlas.
The bundle format goes through an independent cryptographic review.
The Atlas work as a whole is independently reviewed.
A customer accepts the before/after bundle of a change pilot.
In development No date is set for any gate: the plan fixes the order, not a calendar.
No. Atlas is a capability of R-Series: Atlas, built on R-Series. Its status is in development.
No. By design, every evidence route needs your token, the tenant comes from that token, and another tenant’s record looks absent.
No. It means the receipt is authentic, unchanged, and from an issuer the verifier trusts. Whether the action was authorised is answered by the intent and governance receipts it links to.
Not yet: Atlas is in development. You can sign and check a sample receipt in your browser on Verify a receipt, and we brief teams on Atlas in a private technical briefing.
Atlas is in development on R-Series. Bring us the evidence your systems produce today, and we will walk through what a private workspace and an offline bundle would need to show.