Skip to content

Readiness

We publish the ladder, and the rung we are on.

Four rungs. Each one carries a specific sentence we are allowed to say once it is fully green — and nothing broader. Selling a claim above your real rung is the one thing a security brand cannot survive, so the constraint is enforced in the build rather than left to judgement.

Check the current rung yourselfRead the security model

How it is enforced

The build rejects an over-claim.

This is the same mechanism the verifier uses to stop `simulated` rounding up to `pass`: the rule lives in code, not in an instruction someone has to remember.

Every reserved phrase is stored against the gate that would license it. A build containing one from a rung above CURRENT_GATE fails CI, and the failure names the gate — so it tells you what you would have to finish rather than only telling you off.

Raising the site's claims is therefore a deliberate one-line change, reviewed like any other, and it will not pass until the evidence for that rung actually exists.

Some phrases are reserved at every rung. No amount of progress licenses “unhackable”.

npm run verify:claims
$ node scripts/verify-claims.mjs

  FAIL  src/content/investors.ts:58
        reserved phrase: "battle-tested"
        licensed only at Gate 3; we are at Stage 0

  scanned 61 files against 31 reserved phrases
  1 claim violation(s).

  Either rewrite the copy, or — if the evidence
  genuinely exists — raise CURRENT_GATE and tick
  the items that justify it. Do not add an
  exemption to make this pass.

Currently: Stage 0

The ladder.

Counted, not estimated. Every tick is an item somebody can check.

  1. Stage 0 · Working demo

    5/9cleared

    Anyone who wants to check the cryptography themselves.

    “Here's a working demo — verify it yourself, offline.”

    What we say today.

    What is real today

    • Hash → hybrid-sign → transparency log → offline verifier

      ML-DSA-65 (FIPS 204) and Ed25519 over deterministic CBOR, appended to an RFC 6962 log.

      done

    • Tamper-evidence proven by attack, not by assertion

      The conformance run edits a byte and confirms the binding and signature domains both reject it.

      done

    • Policy engine and selective disclosure

      done

    • Audit pack export

      done

    • Verifier refuses under --require-hardware

      A receipt without a vendor-rooted quote is rejected outright, however many other domains pass.

      done

    What is not real today

    • Hardware attestation is simulated

      No TDX in the loop yet. The attestation domain reports `simulated` and can never report `pass` — that rule is in the verifier, not in the copy.

      not done

    • Public anchoring is absent

      The log is signed by our keys alone, which is not tamper-evident against us. Witnesses close this and they are not built.

      not done

    • Capture is manual (CLI), not automatic

      not done

    • Single-node. No SSO, no on-prem, no certifications.

      not done

  2. Gate 1 · Pilot-ready

    0/11in progress

    A friendly technical team can run a scoped, non-production pilot in a sandbox.

    “Run a scoped pilot in your sandbox — and verify every record yourself, offline.”

    Not yet sayable. The site's CI rejects it.

    SDK behaviour under failure

    • Fail-open proven with tests

      Capture must never block or break host inference. Dropped events are counted and written as a signed entry — loss is recorded, never silent.

      not done

    • Kill switch

      not done

    • Windows Ctrl-C exits clean

      not done

    Supply chain

    • npm audit = 0 on the SDK and verifier package

      not done

    • @anthropic-ai/sdk confirmed absent from the SDK tree

      not done

    Correctness

    • redact ↔ verify integrity proven

      Redaction must work AND the log must still verify afterward — append-only cannot be broken by a privacy operation.

      not done

    • Offline verifier identical on Windows, Linux and macOS

      not done

    • Receipt schema carries a version field

      not done

    Hardware

    • Real attestation on Phala TDX

      Deploy to a real CVM so the two simulated domains flip to pass under a genuine Intel root via dcap-qvl — while receipts still label sim vs real honestly.

      not done

    Integration

    • Automatic capture from a real app in one language

      One reference integration — a CI hook or a gateway hook — not just a manual CLI seal.

      not done

    • Install, config, verify-it-yourself docs and a draft threat model

      not done

  3. Gate 2 · Security-review-ready

    0/13not started

    Survives an enterprise security questionnaire; deployable single-tenant in the customer's own VPC or on-prem.

    “Pass your security review and deploy CooL single-tenant inside your own VPC — your data never leaves.”

    Not yet sayable. The site's CI rejects it.

    Deployment and data boundary

    • Control-plane / data-plane split real and verified

      not done

    • Helm chart, K8s manifests, VPC and on-prem installs

      not done

    • Every outbound network call enumerated and disable-able

      One audited list; each call degrades gracefully so an air-gapped install still works.

      not done

    Identity and access

    • SAML 2.0 and OIDC, RBAC, MFA, separation of duties

      not done

    • Immutable audit log of CooL's own control plane

      not done

    Crypto and log integrity

    • Signing keys HSM/TEE-sealed, never plaintext on disk

      not done

    • Known-answer tests against FIPS 203 and FIPS 204 in CI

      not done

    • Witnesses or public-chain anchoring live

      A log signed only by our own keys is not tamper-evident against us. This is the item that closes that hole, and no amount of hardware substitutes for it.

      not done

    Assurance

    • OWASP API Top-10 pass; SSRF, path traversal, TOCTOU closed

      not done

    • Third-party penetration test letter

      not done

    • Signed releases, SBOM, build provenance (Sigstore/SLSA)

      not done

    • HA, backup/restore and DR runbook where the restored log verifies

      not done

    • Load and soak tested with asserted SLOs

      not done

  4. Gate 3 · Enterprise GA

    0/8not started

    A large organisation can standardise on it org-wide, multi-tenant and certified.

    “Standardize on CooL org-wide as your system of record for AI change.”

    Not yet sayable. The site's CI rejects it.

    Certification

    • SOC 2 Type II, ISO/IEC 27001, HIPAA + BAA, India DPDP mapping

      not done

    • Compliance-clause → evidence mapping in the product

      not done

    Multi-tenancy and scale

    • Multi-tenant isolation proven

      Cross-tenant proof-forgery and cross-tenant key-use tests must pass. A cross-tenant leak in an evidence product is fatal.

      not done

    • 10^8+ log entries with proofs still O(log n)

      not done

    Operations

    • SCIM provisioning, SIEM export, observability and runbooks

      not done

    • Air-gapped bundle, Terraform modules, rolling upgrade and safe rollback

      not done

    • Continuous fuzzing and crypto-correctness gates in CI

      not done

    • Support/SLA, pricing and licensing, GA docs

      not done