CONTROL AREA
Validation Status
Current construction, machine-validation, production-promotion and external-authority gate state from the controlled ledger.
TRUST CENTER
Read the implementation status before relying on the statement.
METRAXIOM treats public claims as governed records with status, permitted wording, evidence, owner, review date and limitation. The Trust Center is an evidence index—not a marketing shortcut around accreditation, validation, security assessment or customer authority.
BOUNDED PUBLIC DISCLOSURE · EVIDENCE AS OF 2026-10-06
This Trust Center describes current public implementation and architecture. It is not an accreditation, certification, independent security assessment, regulator approval, warranty, legal opinion, insurance determination, or representation that every control applies to every deployment.
ONE TRUST MODEL
Security, data, AI, assurance, accessibility, reliability, and standards live under one index.
Deep URLs remain directly accessible, but a buyer or reviewer should not need to understand several overlapping “centers” before locating the current control and its limitation.
Open Validation Status →
CONTROL AREA
Document & Build Integrity
Exact document and artifact identities, SHA-256 evidence, hierarchy, lineage and build-identity boundaries.
CONTROL AREA
Security
Authentication, MFA, tenant isolation, server authorization, CSP, secrets, dependencies, incidents, and recovery.
CONTROL AREA
Assurance
Public evidence index, controlled artifacts, procurement boundaries, limitations, and request process.
CONTROL AREA
Data Governance
Classification, storage, retention, deletion, legal hold, export, analytics, and tenant responsibility.
CONTROL AREA
AI & Data Use
Model/provider roles, routing, prompt and model governance, prohibited authority, and audit boundaries.
CONTROL AREA
Governance
Policy, authority, feature gates, validation, review, audit, and fail-closed release discipline.
CONTROL AREA
Accessibility
WCAG target, critical interaction requirements, tested routes, known limitations, and feedback.
CONTROL AREA
Reliability / Status
Current feature gates, availability, incidents, release posture, backup/restore, and deployment state.
CONTROL AREA
Subprocessors
Provider, purpose, data category, region, effective date, and notice posture.
CONTROL AREA
Standards map
How product controls support metrology, quality, security, accessibility, and provenance frameworks without certification by association.
PUBLIC CAPABILITY REGISTER
Claims are controlled records—not adjectives copied across pages.
Each statement has a status, permitted wording, evidence source, owner, review date, page scope, and material limitation. Architecture adoption does not automatically change a claim to Implemented or Validated.
VALIDATED
1 governed claim
CLM-CALCULATION-ENGINE-001 · Calculation engine verified against published and adversarial deterministic test vectors within the stated profile.
ValidatedEvidence: src/lib/calibration-calculation-engine.ts · src/lib/calculation-engine-published-vectors.ts · src/lib/calculation-engine-verifier.ts · src/lib/calculation-engine-verification-profile.ts · tests/calibration-calculation-engine-verification.test.ts · src/app/(public)/trust/calculation-engine/page.tsx · docs/CALCULATION_ENGINE_VERIFICATION_EVIDENCE_2026-09-03.md
Limitation: Verification applies to software numerical logic within the published profile only. It does not establish calibration accuracy, laboratory uncertainty, metrological traceability, unit-conversion accuracy, accreditation, method validity, or conformity of user-entered data.
Owner: metrology · Reviewed: 2026-10-06
IMPLEMENTED
15 governed claims
CLM-PRODUCT-001 · Measurement-decision infrastructure connecting the instrument, source, uncertainty, rule, calculation, evidence, and human authority behind each result.
ImplementedEvidence: src/app/(public)/page.tsx · src/app/(public)/product/page.tsx · src/server/engine · docs/CALIBRATION_WORK_PACKAGE_AND_REPORTING_CONTROL.md
Limitation: A complete customer calibration result still depends on the organization’s methods, competence, standards, quality system, and separately enabled release controls.
Owner: product · Reviewed: 2026-10-06
CLM-STUDIO-001 · Open Calibration Studio without an account. Public Builder state is uncontrolled and cannot become controlled customer evidence merely because it was calculated or shared.
ImplementedEvidence: src/app/(public)/calibration-studio/page.tsx · src/app/(public)/calibration-studio/builder/page.tsx · src/components/calibration-studio-mode-nav.tsx · src/components/guest-calibration-builder-institutional.tsx
Limitation: Optional bounded share state, when enabled, remains uncontrolled and cannot create retrospective laboratory authority, an issued certificate, accreditation, or release authority.
Owner: product · Reviewed: 2026-10-06
CLM-PROOF-001 · Run the bounded Decision Engine sample and inspect P1 reproduction fingerprint, BW Decision Boundary Witness, P2 scope-bound envelope digest, conditional P3 Ed25519 signature, and the explicitly unearned P4 independent trust-anchor state.
ImplementedEvidence: src/components/public-verifier.tsx · src/components/public-proof-ladder.tsx · src/app/api/verify/route.ts · src/lib/public-proof-envelope.ts · src/lib/proof-receipt.ts · src/lib/public-proof-boundary-witness.ts · src/server/engine/boundary-witness.ts · tests/public-proof-envelope.test.ts · tests/public-proof-boundary-witness.test.ts · tests/public-proof-signature.test.ts · tests/public-proof-local-verification.test.ts · tests/public-proof-p3-browser-harness.test.ts · tests/public-proof-ed25519-fallback-supply-chain.test.ts · e2e/public-proof-signed-fixture.spec.ts · scripts/run-public-proof-p3-browser-acceptance.mjs
Limitation: Proof Mode targets the separate server-side Decision Engine sample only. It does not authenticate customer-entered measurements, prove the public Calibration Builder calculation engine, Consequence Lens, Decision Situation Capsule or historical AFTERSHOCK. Ephemeral signed-browser acceptance confirms local P3 verification across Chromium, Firefox and WebKit, with a strict RFC8032 fallback used only where native Ed25519 verification is unavailable; this does not establish a released/deployed signing identity. P4 remains unearned until signing-key identity is independently anchored.
Owner: metrology · Reviewed: 2026-10-06
CLM-XRAY-001 · Stress the PT-1042 sample by removing procedure/source, DUT identity, reference binding, uncertainty, rule topology, time/context boundary, reconstruction evidence, or review authority while the +0.074 psi observation remains fixed.
ImplementedEvidence: src/lib/public-sample-record.ts · src/lib/decision-xray-reconstruction.ts · src/components/decision-integrity-lab.tsx · src/components/sample-reconstruction-passport.tsx · src/app/(public)/calibration-studio/decision-xray/page.tsx · src/app/(public)/calibration-studio/sample-record/page.tsx · tests/decision-xray-reconstruction.test.ts · tests/public-sample-record.test.ts
Limitation: Educational public reconstruction only. A reconstructable public fixture is not controlled evidence, trusted capture time, a Flight Recorder record, historical AFTERSHOCK input, traceability, accreditation, review acceptance, signed release, certificate authority, or customer disposition.
Owner: metrology · Reviewed: 2026-10-06
CLM-AFTERSHOCK-001 · Run a bounded synthetic foundation incident through deterministic dependency and consequence analysis, including explicit refusal when retained replay evidence is insufficient.
ImplementedEvidence: src/lib/aftershock-consequence.ts · src/components/aftershock-consequence-lab.tsx · src/app/(public)/calibration-studio/aftershock/page.tsx · tests/aftershock-consequence-engine.test.ts · docs/AFTERSHOCK_CONSEQUENCE_ENGINE.md
Limitation: The public dataset is synthetic. AFTERSHOCK classifies technical consequence within declared incident and replay bounds; it does not declare aircraft safety, batch disposition, recall, accreditation validity, regulator action, or customer disposition.
Owner: metrology · Reviewed: 2026-10-06
CLM-CONSEQUENCE-LENS-001 · Analyze the current browser-local worksheet to see the minimum error-space distance to the nearest decision-class boundary and identify the most sensitive evaluated point.
ImplementedEvidence: src/lib/calibration-consequence-lens.ts · src/components/guest-calibration-consequence-lens.tsx · tests/calibration-consequence-lens.test.ts · tests/calibration-consequence-lens-source.test.ts
Limitation: The consequence lens describes deterministic distance in the frozen current error/decision space only. It does not predict a future incident, probability, reference correction, historical AFTERSHOCK verdict, product disposition, recall action, uncertainty contribution, safety state, or measurement authority.
Owner: metrology · Reviewed: 2026-10-06
CLM-FLIGHT-RECORDER-001 · Flight Recorder is the historical replay foundation inside AFTERSHOCK: retained state is used for reconstruction rather than silently substituting today’s procedure, rule, reference, or software state.
ImplementedEvidence: src/lib/aftershock-consequence.ts · src/components/aftershock-consequence-lab.tsx · docs/AFTERSHOCK_CONSEQUENCE_ENGINE.md
Limitation: A replay match establishes reproduction of the recorded computation within the retained capsule boundary. It does not independently establish physical correctness, authenticity of external evidence, accreditation, or metrological truth.
Owner: metrology · Reviewed: 2026-10-06
CLM-CONTEXT-TWIN-001 · Inspect rate-limited NOAA/NWS and NOAA/SWPC context with provider, time, freshness, missingness, and context-only authority kept explicit.
ImplementedEvidence: src/app/(public)/context-twin/page.tsx · src/app/(public)/status/page.tsx · src/components/environment-context-twin-v2.tsx · src/app/api/external-context/nws/route.ts · src/app/api/external-context/space-weather/route.ts · src/server/universal-calibration/space-metrology-context.ts · src/lib/environment-context-twin.ts · docs/architecture/V6_1_ENVIRONMENT_CONTEXT_TWIN_2026-09-04.md
Limitation: The bounded public-use profile enables only the implemented NOAA/NWS U.S. station-observation and NOAA/SWPC space-weather paths. Candidate geocoding, global weather-model, commercial-provider, controlled-environment, correction, and historical-evidence paths remain OFF. Enabled context cannot silently satisfy a controlled environmental measurement gate, become a calibration correction or conformity input, or masquerade as retained historical evidence.
Owner: metrology · Reviewed: 2026-10-06
CLM-WORKSPACE-PREVIEW-001 · Inspect and manipulate temporary synthetic workspace state while retaining the explicit boundary: no production writes, controlled observation, method/reference/evaluator authority, review, release, certificate, accreditation, or traceability authority is created.
ImplementedEvidence: src/app/(public)/calibration-studio/workspace-preview/page.tsx · src/components/universal-calibration-workspace-preview.tsx · src/components/universal-calibration-governance-preview.tsx · e2e/calibration-studio.spec.ts
Limitation: Interactive preview state is transient and non-authoritative. It is not proof that the private production workspace, controlled writes, certificate issuance, or release authority has been promoted.
Owner: product · Reviewed: 2026-10-06
CLM-PROCEDURE-001 · Procedure authority is resolved before retained acquisition and rechecked when the worksheet session is created.
ImplementedEvidence: supabase/migrations/0089_procedure_authority_expectation_lock.sql · src/app/api/calibration-worksheets/route.ts · scripts/check-universal-procedure-plane.mjs
Limitation: Database migration and target-environment verification remain deployment-specific release evidence.
Owner: metrology · Reviewed: 2026-10-06
CLM-EVIDENCE-001 · As-found and as-left remain separate retained states; corrections and interventions preserve lineage.
ImplementedEvidence: supabase/migrations/0066_pressure_worksheet_session_lineage.sql · supabase/migrations/0069_pressure_work_package_candidate_manifest.sql · supabase/migrations/0070_pressure_work_package_manifest_hardening.sql · scripts/check-pressure-session-lineage.mjs
Limitation: This verified retained execution path is currently pressure-centered; additional controlled discipline lanes remain gated until their domain tests pass.
Owner: metrology · Reviewed: 2026-10-06
CLM-TENANCY-001 · Organization data is protected by tenant-scoped server authorization and database row-level security controls.
ImplementedEvidence: src/lib/workspace.ts · src/lib/supabase · supabase/migrations · tests
Limitation: No SOC 2, penetration-test, government authorization, or universal deployment assurance is implied.
Owner: security · Reviewed: 2026-10-06
CLM-AI-001 · AI can retrieve, explain, and challenge within its allowed scope; it cannot invent measurement facts or authorize release.
ImplementedEvidence: docs/AI_INTELLIGENCE_RIGOR_CONTRACT_2026-08-29.md · scripts/check-ai-governance.mjs · src/app/(public)/ai-data-use/page.tsx
Owner: product · Reviewed: 2026-10-06
CLM-GUEST-BUILDER-001 · Use the free public Universal Calibration Builder to configure governed scalar work, enter browser-local observations, inspect supported deterministic calculations, and review an explicitly uncontrolled concise PDF or exact-revision work package.
ImplementedEvidence: src/app/(public)/calibration-studio/builder/page.tsx · src/components/calibration-studio/universal-worksheet-job-manager.tsx · src/components/calibration-studio/universal-worksheet-shell.tsx · src/components/calibration-studio/universal-worksheet-output-client.tsx · src/lib/universal-worksheet/public-universal-catalog.server.ts · e2e/calibration-studio.spec.ts · docs/architecture/REV4_ENGINEERING_IMPLEMENTATION_STATUS.md
Limitation: Guest work remains browser-local and uncontrolled. The current public Universal Builder is the guest surface. Non-scalar channel topology and waveform capture are unavailable, and public work cannot become controlled evidence, an issued certificate, accreditation, an authorized release, validated GxP evidence, or retrospective traceability.
Owner: product · Reviewed: 2026-10-06
CLM-PUBLIC-PDF-001 · Download an explicitly uncontrolled concise calibration PDF projected from the selected exact browser-local worksheet revision.
ImplementedEvidence: src/components/calibration-studio/universal-calibration-pdf-download.tsx · src/app/api/public/universal-calibration-pdf/route.ts · src/server/universal-calibration-pdf.ts · tests/universal-calibration-pdf-route.test.ts · tests/universal-calibration-pdf.test.ts · e2e/calibration-studio.spec.ts
Limitation: The PDF is not an issued Certificate of Calibration, controlled evidence, accreditation, traceability, or authorized release. Its revision identity and fingerprint support reproducibility and input-integrity inspection only.
Owner: metrology · Reviewed: 2026-10-06
GATED
4 governed claims
CLM-RELEASE-001 · Authoritative release remains separately validation-gated.
GatedEvidence: src/app/app/layout.tsx · src/app/api/calculations/[id]/release/route.ts · docs/AUTHORITY_RELEASE_MODEL.md
Limitation: The authoritative-output flag remains disabled until the exact deployment passes metrology, authority, security, accessibility, backup/restore, migration, and post-deployment verification gates.
Owner: metrology · Reviewed: 2026-10-06
CLM-DUEPROOF-001 · DUEPROOF is the governed assurance architecture beneath METRAXIOM; enabled capabilities are identified separately from planned or gated controls.
GatedEvidence: docs/architecture/ADR-0001-adopt-v5-world-class-construction-control.md · src/lib/public-proof-verification.ts · src/lib/material-reliance-graph.ts · src/lib/contest-correction.ts · src/lib/recall-action-projection.ts · src/lib/aftershock-impact-package.ts · src/app/(public)/resources/architecture/page.tsx · src/components/aftershock-consequence-lab.tsx · src/app/app/quality/impact/page.tsx · tests/public-proof-local-verification.test.ts · tests/material-reliance-graph.test.ts · tests/contest-correction.test.ts · tests/recall-action-projection.test.ts · tests/aftershock-impact-package.test.ts · public/verifiers/aftershock-impact-package-v1.mjs · public/verifiers/aftershock-impact-package-v1-integrity-vector.json · tests/aftershock-standalone-verifier.test.ts · e2e/recall-action-projection.spec.ts · e2e/aftershock-impact-package.spec.ts · e2e/aftershock-standalone-verifier.spec.ts · supabase/migrations/0156_dueproof_contest_correction_ledger.sql · src/server/dueproof/contest-correction-ledger.ts · src/app/api/assurance/contest-correction/route.ts · scripts/check-dueproof-contest-correction-ledger.mjs · tests/dueproof-contest-correction-ledger.test.ts
Limitation: Selected public/synthetic proof, reliance, contest/correction, deterministic recall-action projection, and a manifest-driven portable impact package with local deterministic reconstruction are implemented. A public zero-application-import verifier reference separately checks canonicalization, ordered manifest/component digests, package digest, and fixed no-authority declarations without the authoring UI or application runtime. Both verification paths remain unanchored and do not establish issuer identity, independent trust, external verifier acceptance, notifications, recall, product/batch disposition, certificate lifecycle action, regulator action, or release. A tenant-scoped append-only contest/correction persistence substrate and private API are now source-controlled in migration 0156, but 0156 remains unexecuted on the qualification target and therefore earns no hosted-runtime or operational authority. Production reliance capture, recall execution authority, independently anchored signing identity, externally independent verifier acceptance, local-first release, and authoritative calibration release remain unearned.
Owner: product · Reviewed: 2026-10-06
CLM-INDEXING-001 · Public discoverability remains a controlled production launch decision.
GatedEvidence: src/lib/site-metadata.ts · src/app/sitemap.ts · scripts/check-public-metadata.mjs
Limitation: The current public-production evaluation profile remains noindex. Search indexing requires a separate controlled decision after legal/operator identity, canonical routing, claim review, structured data, accessibility, performance, security, monitoring, and production URL checks pass for the exact candidate build.
Owner: operations · Reviewed: 2026-10-06
CLM-UNIVERSAL-CALIBRATION-001 · Universal calibration is the adopted construction architecture; enabled discipline lanes and retained execution paths are identified separately and remain release-gated.
GatedEvidence: docs/architecture/ADR-0002-adopt-v6-1-universal-calibration-construction-control.md · src/server/universal-calibration/schema.ts · config/v6-1-calibration-conformance.json
Limitation: Architecture adoption and schema construction do not establish that every discipline, universal write path, certificate workflow, or production deployment is complete or validated.
Owner: metrology · Reviewed: 2026-10-06
NOT CLAIMED
5 governed claims
CLM-CONTEXT-PROVIDER-001 · External context providers are adapter- and gate-specific. U.S. and other provider coverage must be described by the exact enabled provider and observed availability.
Not claimedEvidence: src/server/universal-calibration/external-environment-context.ts · docs/architecture/V6_1_METROLOGY_CONTEXT_FABRIC_2026-09-04.md · config/v6-1-promotion-readiness.json
Limitation: No universal global provider coverage, controlled environmental authority, SLA, or non-U.S. completeness claim is made by the existence of the Context Twin interface.
Owner: operations · Reviewed: 2026-10-06
CLM-LOCAL-001 · The current release is a hosted public-production evaluation profile. The private hosted workspace, Local Professional, and Air-Gapped editions remain held or planned until separately implemented, qualified, and promoted.
Not claimedEvidence: docs/architecture/ADR-0001-adopt-v5-world-class-construction-control.md
Limitation: No production installer, local identity profile, key-custody model, backup/update channel, offline licensing, support runbook, or independently validated air-gapped release exists yet.
Owner: product · Reviewed: 2026-10-06
CLM-CERTIFICATE-ISSUANCE-001 · Customer-issued certificate architecture is defined, but certificate artifact generation and issuance remain separately gated until frozen-package, renderer, issuer, review/release, immutable-byte, numbering, amendment and verification controls pass.
Not claimedEvidence: docs/architecture/ADR-0002-adopt-v6-1-universal-calibration-construction-control.md · config/v6-1-calibration-conformance.json
Limitation: No current public or private screen, PDF, subscription state, integrity mark, or calculation may be represented as an issued Certificate of Calibration merely because the architecture is adopted.
Owner: legal · Reviewed: 2026-10-06
CLM-DCC-001 · PTB DCC v3.3.0 is the planned initial mapping baseline; no DCC validation claim is made until the named profile passes mapping, schema validation, unit/vocabulary, known-fixture and round-trip semantic tests.
Not claimedEvidence: docs/architecture/ADR-0002-adopt-v6-1-universal-calibration-construction-control.md · config/v6-1-calibration-conformance.json
Limitation: The DCC export feature gate is default-off and no generic DCC-conformance claim is permitted.
Owner: metrology · Reviewed: 2026-10-06
CLM-ACCREDITATION-001 · Designed to support ISO/IEC 17025-aligned technical-record controls; not an accreditation, certification, or declaration of conformity.
Not claimedEvidence: docs/CALIBRATION_WORK_PACKAGE_AND_REPORTING_CONTROL.md · src/app/(public)/trust/page.tsx
Limitation: Software cannot create laboratory competence, accredited scope, authorized signatories, method validity, or metrological traceability; those remain organization- and measurement-result-specific.
Owner: legal · Reviewed: 2026-10-06
DUEPROOF CONTROL DISCIPLINE
Trust is preserved through explicit limits, not optimistic language.
DUEPROOF supplies the cross-cutting assurance rules beneath METRAXIOM. These principles control the website, application, AI, evidence model, correction flow, recall behavior, proof packages, and release gates.
Canonical truth is not LLM-owned
AI output remains a typed suggestion, extraction, inference, or explanation until deterministic controls or an authorized human action bind it.
No silent overwrite
Material correction creates a new version or event and preserves the superseded state.
Authority is separate
Correct arithmetic, successful configuration, paid entitlement, and visual status are insufficient to authorize reliance.
Recall follows dependencies
Changed methods, specifications, standards, calculations, approvals, or evidence traverse declared material reliance paths.
Proof is independently checkable
A proof package must include enough manifest and integrity information to validate it without trusting the authoring interface.
CURRENT ASSURANCE BOUNDARY
Software controls support an organization’s quality system. They do not create it.
METRAXIOM cannot establish customer competence, method validity, metrological traceability, accredited scope, authorized signatories, regulatory suitability, cybersecurity authorization, insurance coverage, or the authority to issue a calibration result.
Those facts remain organization-, deployment-, method-, contract-, and evidence-specific. Where a third-party artifact exists, it may be disclosed only for the correct entity, service, scope, version, evidence date, and authorized audience.
Need a scoped review?
Identify the proposed service, deployment, intended data classes, applicable framework, required artifact, reliance purpose, and due date. Do not send restricted evidence through a public form or ordinary email.
Start a sanitized request →