Direction

Master Doctrine

Codebase-level direction for anyone touching SSX360 or Matrix Scroll. If a decision is not covered here, derive it from the doctrine.

Back to docs llms.txt →

The one thesis

AI agents now write code and move money at machine speed. Nobody can prove who authorized what. We own the proof layer: signed at the moment of action, verified before merge, exported as evidence an assessor can read without us in the room.

Everything in this codebase either strengthens that sentence or does not belong in it.

Doctrine — the five rules every commit answers to

1. We are the trust layer, never the platform.

We do not build version control. We do not build a forge. We do not build payment rails. We are the provenance layer that rides on all of them — git, GitHub, GitLab, Forgejo, Gitea, any Actions-syntax CI, any payment protocol that emits signed mandates. Forge-agnostic and rail-agnostic is the moat.

2. The assessor is the user.

The buyer is a security or platform team, but the user who decides if we win is the auditor who receives the Evidence Pack. Every schema, export, log line, and doc is written for a person who will read it cold, without a founder on the call.

3. Every claim must be falsifiable — in marketing, in code, in README.

The Honest Limits section is the brand. Emulated signing is called emulated. Hardware in firmware validation is not “hardware-backed signing.” “Aligned to SSDF / EU AI Act,” never “certified” until a third party says so.

4. Dogfood the provenance or do not ship it.

Our own releases carry signed provenance, pinned versions, checksums, and attestations — the pipeline is the demo. A provenance company with a sloppy supply chain is a contradiction the market will not forgive.

5. Meet buyers at the migration, sell them the evidence.

Distribution is the open protocol; revenue is the control plane. The spear stays sharp and free; the handle is what we sell.

Double down

  • Evidence Pack as the flagship artifact.
  • Verification everywhere git goes.
  • Forge-agnostic integrations as first-class citizens.
  • Hardware as device-bound identity — preview until firmware validation passes.
  • Crawlability and machine-readability of everything public.

Hold — maintained, not grown

  • Agent-commerce (AP2/mandates): narrative only until a payments buyer pulls it forward.
  • Digital Rain / studio: live demo of agent builds with provenance, not a second product line.

Killed — do not resurrect without a scored memo

Building a DVCS. Building or hosting a forge. Competing on scanning/analysis (partner narrative only). Payment-rail infrastructure. Silicon beyond the validated path until revenue demands it.

The test

Before merging, shipping, or publishing, ask in order:

  1. Does this make the proof stronger, the verify faster, or the evidence more legible?
  2. Would it survive an adversarial reader with zero explanation from us?
  3. Does it work on every forge and rail, or does it marry us to one?
  4. Are we running the same provenance on ourselves that we sell?
  5. Is every word of it falsifiable?

Five yeses: ship. Any no: it is not done.