02 · Architecture brief · classified-lightThe boundary is the architecture.
Four stages. Four contracts. Each stage publishes the guarantees the next stage can rely on — and the input it refuses to accept. This page walks the platform end-to-end at the contract level, then drops into the operational details: key ceremonies, attestation logs, throughput windows, and the spec tables a security review will actually ask for.
A◆Stages & contracts
Four contracts, in order.
Each stage exists to honor one contract and pass a verified signal to the next. If a contract fails at any stage, the signal does not advance — it is logged, attested, and surfaced to operators with a reason code.
STAGE 01 · ORIGIN
Raw data stays.
Origin systems publish bounded, signed events. They never surrender source records. The boundary is enforced before the gateway, not after.
NO-INGESTInputs acceptedEdge frames · acoustic envelopes · badge claims · partner feeds. Each signed at the device.DEVICE
Inputs refusedRaw media · transcripts · biometric vectors · PII · identifiable telemetry.REFUSED
Signing schemeEd25519 with per-device anchored keys. Optional FROST 2-of-3 threshold for partner-issued claims.ED25519
Window enforcementEach contribution carries a TTL and a revocation channel. Default TTL: 14400s.TTL
Failure modeUnsignable or out-of-window contributions are dropped at the origin. Nothing exits the boundary.DROP
STAGE 02 · GATEWAY
Anonymize, verify.
The signal gateway verifies every signature, strips identifiers, applies privacy budget, and binds the contribution to the simulation window. Output is a sealed, scoped envelope.
VERIFY · ANON · BOUNDVerificationEd25519 signature check + OCSP staple + replay nonce window 0042 ↔ 0048.CONSTANT-TIME
PII suppressionFace vectors discarded · voiceprints committed-only · badges HMAC-truncated · routes bucketed.FPT · HMAC
Privacy budgetRényi differential privacy with ε spent per scenario. Default ε = 0.72, δ = 1e-6.RÉNYI-DP
Selective disclosureBBS+ credentials reveal only the attributes the model requires for the current scenario.BBS+
ReceiptsEach accepted signal produces a Sigstore-style bundle recorded in the transparency log.REKOR
STAGE 03 · FABRIC
Merge, simulate, propagate.
Inside a TEE-attested enclave, anonymized signals from many origins are merged into a single dependency graph. Counterfactuals propagate along that graph at 72-hour horizons.
RIPPLE-V4 · ENCLAVEMerge boundaryCross-org merge happens inside the enclave. No party — including SimSumNexus operators — sees another's raw signals.TEE
ModelRipple-v4. Graph-based propagation with counterfactual delays and confidence decay along edge weights.RIPPLE-V4
Horizon72 hours by default, configurable to 168. Scenarios beyond horizon do not commit.72H
AttestationEvery simulation run includes an enclave attestation hash so operators can verify the code that ran.ATTESTED
Failure modeContradictory signals widen the confidence interval and surface as a flag, not a silent override.FLAGGED
STAGE 04 · OUTCOME
Summary, not source.
The output is an operator-grade brief: recommended action, risk window, confidence, scenario deltas. The underlying records remain on the far side of the boundary.
SEALED EXPORTOutput typeSealed briefing bundle: a recommendation, three KPIs, and a scenario delta set. No source records.SEALED
Export channelsSigned JSON, sealed PDF, or push-only to an operator console with audit log.SIGNED
RetentionOutcomes retained per customer policy. Backing signals expire on their TTL regardless of outcome retention.TTL-IND
AuditEach brief links to the attestation hash of the simulation run that produced it.LINKED
Failure modeIf confidence falls below a customer-set floor, the brief includes the floor breach, not a confident recommendation.FLOOR
B◆Operational log
Live attestation & ceremony log.
A different view of the same boundary: the attestation log a security reviewer would actually read. Key ceremony stages, signed credentials, replay challenges, and policy decisions are all written here — and only here. The capture JSON is on the home page; this log lives in operations.
attestation log · key ceremony · live
sigstore · rekor · epoch 0042