Disclosure Boundary
These docs define the interoperability contract for Arbiter (and optional Stratum sealing). They answer how do I interoperate? They do not answer how does the system reach its judgment?
Link this page from every major section. Forward it to security and legal reviewers without edits.
Purpose
Partners, agents, and assessors need stable vocabulary: lifecycle states, record shapes, actor boundaries, and what a fingerprint or seal proves. Judgment logic stays private at every access tier.
Published
- Lifecycle state names and meanings for risks, controls, and related records
- Record shapes and field names that appear on REST / Partner Read / MCP
- Actor boundaries (who can read or act under RBAC)
- What
evidence_hash/ verification receipts / optional Stratum seals prove - Public error categories
- Synthetic examples only
- Integration surface maturity matrix
Never published
- Gate criteria, thresholds, or scoring models
- Prompts, orchestration, or internal procedure logic
- Internal review reasoning or proprietary risk-engine details
- How fingerprints are constructed beyond the public hash algorithm name
- Raw backend schemas that are not part of the public contract
- Real client data, workpapers, or private evidence
Three-line test
Before shipping any page:
- Describes the interface an actor interacts with, not how conclusions are reached.
- Names states and signals, not the rules for admission or blocking.
- Explains verification of releases or seals, not production judgment processes.
Pages that fail this test are not shipped.
Claim boundary (three layers)
Public claims must stay aligned with Verification:
| Layer | Approved public claim | Do not claim |
|---|---|---|
| Operational | Arbiter stores and exposes register records under RBAC | That Arbiter “certified” your posture |
| Hash-chained | SHA-256 fingerprints are tamper-evident | That a hash equals a ledger seal |
| On-chain | When entitled: Seal → badge Verified on-chain | “Cryptographically sealed” without Stratum configured |
Unless Stratum sealing is configured for a tenant, public integrity claims stop at SHA-256 fingerprints. NPI never rides the on-chain path.
Verification semantics
| Signal | What it gives you |
|---|---|
evidence_hash | Independent check that envelope or artifact bytes match a published digest |
verified_no_npi | Partner envelope asserts metadata-only / NPI boundary for that response |
payload_hash / body_hash | Integrity of webhook payload or policy body reference without embedding content |
| Optional Stratum seal | Metadata-only ledger anchor of a published digest — verify without trusting Arbiter alone |
Stratum sealing is available by arrangement; the seal proves anchoring of the published digest, not that Arbiter’s internal review was correct. Full vocabulary: Verification.