Trust
Seal · Identity · Policy
These are implemented as separate layers in code. Marketing that collapses them into one green badge is wrong.
Seal
Tampered?
SHA-256 of archive members + Ed25519 over the canonical manifest. Envelope header integrity. Works offline.
epi verify · private browser check
Identity
Who sealed?
Embedded public key proves the seal. Trust (LOCAL / UNKNOWN / pinned / DID:web) is whether you accept that key. First-run LOCAL is normal.
epi keys trust · STRICT policy
Policy
Rules broken?
Optional epi_policy.json + 9-pass deterministic fault analyzer. Policy FAULT can sit next to a valid seal — the record is intact; a rule matched. Unpinned identity is still not claim-ready.
epi analyze · not moral judgment
Optional transparency layers
- Local SCITT — offline transparency service under
~/.epi/local-scitt. Free. Not a public independent log. - Remote SCITT — hosted registration; requires Hosted plan or higher on the portal.
- RFC 3161 / OpenTimestamps — best-effort notarization at seal time (needs network; can fail open).
- Human review ledger — signed, append-only reviews bound to the sealed artifact.
Honesty notes
- Hosted PDF API is not implemented (CLI Annex PDF is free).
- Annex IV helpers are scaffolding + multi-sign — not a conformity certificate.
- EU notification helpers generate local signed payloads — not a live EU database client.
- See KNOWN_LIMITATIONS.md.