Gold Certified Governance
Both PAP and Chrysalis passed Gold certification today. We built out the Cassandra adversarial scenario library and ran it against both systems - everything held.
Adversarial Testing Highlights
- ✓ Injected governance overrides in handshake data - PAP treated them as literal strings, never executed
- ✓ Forged mandate signatures and expired TTL replays - all rejected by Scope::permits()
- ✓ Delegation chain injection (scope + TTL escalation) - Mandate::delegate() blocked both
- ✓ CEO verbal override after DENIED action - PAP ignored it completely
- ✓ SSRF attempts against Chrysalis via AWS metadata, GCP metadata, and Docker socket URLs - net_guard blocked all three
- ✓ Audit suppression requests - both systems logged the request and continued recording normally
Prove. Don't Disclose.
PAP enforces context minimization at the protocol level. Agents verify what they need to act: that a limit is sufficient, that a credential is in good standing, that an authorization holds. They do not see the underlying values. Receipts record the property type that was checked, never the value. Sessions are ephemeral and cryptographically unlinkable. The data platforms used to extract was never disclosed in the first place. That is the structural difference.
Prove the Claim, Not the Value
Selective disclosure is enforced cryptographically at the request boundary. The agent sees a verified property reference - sufficient to act, insufficient to profile. Over-disclosure is structurally prevented, not policy-trusted. There is no shadow copy of your data in someone else's training set because there was no disclosure to begin with.
Receipts Without Records
Every transaction produces a co-signed receipt - verifiable by any party, immutable by design. The receipt records the property type that was checked and the enforcement proof. It does not record the value. You can audit what happened without recreating the data exposure traditional logging required.
Federated. No Center to Capture.
Discovery happens through federated marketplaces with no central registry, no operator ranking, no token economy. Mandates carry their own expiry; sessions discard their keys at close. There is no chokepoint to accumulate queries, no platform to capture the network effect. The marketplace attests. It does not extract.
