Security and Trust

• Capability-based security

  Capability-based security is the access-control model PointSav uses at the hardware and operating-system layers, where each software component must hold a mathematically verified cryptographic token to communicate with any other component.

• Cryptographic ledgers

  Cryptographic ledgers are the immutable-state storage pattern used in the PointSav platform, enforcing mathematical immutability so that any alteration to a recorded fact breaks a verifiable cryptographic hash chain rather than requiring trust in administrative access controls.

• Cryptographic payload attestation

  Mechanism by which PointSav edge nodes prove published text integrity to any viewer via client-side SHA-256 hashing, independently verifiable by any auditor.

• Data sovereignty and zero-state telemetry

  The platform collects only anonymized, IP-masked geospatial telemetry with no personally identifiable information retained, appending mandatory regulatory disclosure to public-facing interfaces.

• Diode standard

  Foundational security topology of the PointSav OS family — unidirectional command flow from authority to subject that removes lateral-movement attacks by design.

• Five-stage sovereign supply chain

  Code path from contributor environment to production in five stages, with a double-blind air-gap keeping production credentials and data out of contributors' reach.

• Genesis protocol

  The Genesis Protocol is the fleet-bootstrapping sequence run by every os-infrastructure node at first boot, allowing nodes to reach a secure claimable state without any prior configuration or control plane dependency.

• Identity ledger schema design

  The identity ledger defines three record types — Person, Anchor, and Claim — that together represent who is known to the system, how that identity was observed, and what attributes have been recorded, all persisted through WORM discipline with no AI involvement at any stage.

• Machine-based authorization

  Machine-based authorization replaces username and password structures with the cryptographic pairing of physical hardware — the pair is the permission, and an entire class of remote credential theft is eliminated by structure.

• Personnel and permissions

  Contributor identity and permissions expressed through cryptographic pairings rather than database roles — reachability requires a paired os-console.

• Pre-commit defense in depth — secret scan, size guard, helper-only gate

  Three-check pre-commit gate — helper-only commits, a 17-pattern secret scan, and a 2 MiB size guard — closing the incident classes behind leaked and mis-attributed commits.

• seL4 Capability Topology

  In an seL4 system, security is determined by the shape of the capability graph — the topology. If component A has no capability path to component B, A cannot reach B by any means, a property proved by machine-checked formal verification.

• Verification surveyor

  The Verification Surveyor is the human-in-the-loop component of service-people that presents extracted identity fragments to an operator for manual verification before they are permanently committed to the verified ledger.