Skip to content
Downloads

# Downloads.

Public‑safe artifacts for procurement + security review. Designed to be verifiable offline and safe to mirror.

Proof Playground (/verify)Research & DOIs Why now Contact security

## Files

Public‑safe artifacts hosted on this site. For integrity verification, see SHA256SUMS.txt and README. Legal policies are published under /legal/.

ZIP APEX

### HALTSEAL Pilot‑in‑a‑Box (Self‑serve)

~30‑minute buyer‑run pilot: fail‑closed gateway + deterministic PASS/FAIL/HOLD vectors + receipts + DSSE signing request (no host Python required; hardened docker‑compose defaults). Generates a Conformance Pack for /verify.

Download ZIP Open SHA256SUMS
SHA256SUMS includes hash Redirect from v1.0.0
Air‑gapped
Offline‑complete No uploads No network

### Air‑gapped verifier kit (Public) v1.0.0

Run the MVG verifiers in an isolated environment: `/verify‑assurance`, `/verify‑diligence`, and `/verify‑trust`. Includes printer‑friendly audit summaries with QR re‑verification and ticket binding.

Download kit ZIP Verify kit signature Overview Commitments
Attachable approvals Threshold policy JIRA/ServiceNow binding
Assurance
Offline‑verifiable DSSE (Ed25519)Keyring + transparency

### Assurance Pack (Public) v1.0.0

Procurement‑grade evidence bundle for offline review: signed keyring snapshot + key transparency log + executive summary. Built for skeptical security teams (no uploads, no third‑party scripts).

Download ZIP Verify offline Overview Countersign spec Hardware attestation spec Org keyring spec Ticket binding spec Sample keyring
Signed keyring Hash‑chained log Org threshold policy Ticket binding
Licensing
Offline‑verifiable DSSE (Ed25519)Blinded commitments

### Licensing Diligence Teaser (Public) v1.0.0

Public-safe demonstration of the MVG licensing diligence format: pack ZIP + private receipt DSSE + optional blinded commitment log. Designed to let Big Tech security/procurement verify evidence offline.

Download ZIP Verify offline Commitments Sample receipt Two‑layer spec
Two‑layer commitment Append‑only log head No pack hash leakage
ZIP

### MVG Trust Pack v31

Public-safe trust artifacts bundle for offline review.

DSSE

### Trust Pack Signature (DSSE)

Signed digest binding for MVG Trust Pack v31.

DSSE

### Trust Anchor Snapshot v31

Pinned public keys + witness threshold for verification.

ZIP CLI

### Org Signer CLI (v21)

No‑dependency Node CLI to sign DSSE requests and reproduce anchored PASS end‑to‑end.

Download Open
MD Spec

### Org Signing Service Spec (v21)

Request/response format for KMS/HSM‑backed signing services (DSSEv1 PAE).

Download Open
ZIP Mock HTTP

### Org Signer Mock Server (v23)

Local no‑deps signing service for PoC: bootstrap key + trust‑anchor snapshot + DSSE(PAE) report signing.

Download Open
YAML OpenAPI

### Org Signer OpenAPI (v23)

Endpoint schema for a KMS/HSM‑backed org signing service (DSSEv1 + PAE).

Download Open
MD curl

### Org Signer curl examples (v23)

Copy/paste commands: signing request → HTTP signer → anchored PASS in-browser.

Download Open
MD Spec

### Org Signing Service Spec (v23)

Minimal PoC spec linking OpenAPI + mock server + curl for anchored report verification.

Download Open

### Org Signer CLI (v23)

No-dependency Node.js CLI to sign /verify requests (PoC).

ZIP Strict HTTP

### Org Signer Mock Server (v23.5 strict)

Intake template: idempotency, replay protection, audit fields, and key‑alias policy (DSSEv1 PAE).

Download Open
OpenAPI Strict

### Org Signer OpenAPI (v23.5 strict)

Strict schema + Idempotency‑Key header + policy endpoints.

MD Strict

### Org Signer curl examples (v23.5 strict)

Copy/paste flow: signing request → sign → extract DSSE → upload to /verify.

Spec Strict

### Org Signer Integration Spec (v23.5 strict)

Idempotency, nonce replay protection, audit fields, and KMS key alias policy.

ZIP

### HALTSEAL Sample Conformance Pack (public‑safe)

Use with /verify for 30‑second offline proof.

Download Verify
ZIP FAIL

### HALTSEAL Test Vector (FAIL — tampered)

For security review: deterministic FAIL due to SHA256SUM mismatch.

Download Verify
DSSE Release

### Release signature (v31)

Signed binding for this site’s artifacts manifest.

Download Open
JSON Signed

### Artifacts manifest (SHA‑256)

Hash inventory + DSSE signatures (browser-verifiable).

Download Open
JSON SBOM

### Proof Playground SBOM

CycloneDX SBOM for verifier assets.

Download Open
JSON Keys

### Verifier trust anchors

Publishes the verifier signing key used for signed exports.

Download Open
PDF

### Kingdom Conformance RFC v1.3.6

Standards‑track draft (PDF).

Download Open
PDF

### CTC AAS Constitution v1.0

Admissible Automation Standard (PDF).

Download Open
PDF

### HALTSEAL — Outreach Brief

1‑pager for Security review.

Download Open
PDF

### HALTSEAL — Outreach Deck

Deck (PDF).

Download Open
PDF

### Trust — Security posture

Printable trust brief (PDF).

Download Open
For business/technical discussion only. Not a compliance certification. Not legal advice.