Every flag arrives with its receipts.

Contents

What is actually in the thing you sign.

The bundle is not a PDF of a chart. It is canonical JSON carrying the repair event and its close timestamp, the scoring window in UTC, the residual with its sample count and sigma, the resulting tier, the exact model version and pinned weight hash, and the thresholds as they were configured at the moment of scoring — followed by an HMAC-SHA256 signature over everything above it.

The thresholds field is the one people underestimate. A tier is a function of a number and a line, and a bundle that records the number but not the line is unfalsifiable a year later when the line has moved. Recording the configuration alongside the result is what makes two bundles from different quarters comparable.

Verification

Checkable by someone who does not trust us.

Verification runs against the bundle alone. It re-canonicalises the payload, recomputes the digest, confirms the model version is pinned to the weights that produced the score, walks the chain to confirm it is intact and append-only, and checks the signature. It does not call our API, it does not need credentials, and it works offline eighteen months after the fact.

The access log is part of the same posture. Every read, write, signature and export is an entry, including ours — there is no privileged internal view that leaves no trace. If someone at NADIR opened your bundle, that is a line in your log, and there is no delete path that could remove it.

Custody

How long it lives, and where it sits.

Raw telemetry is the shortest-lived artefact in the system and is dropped at thirty days. Derived residuals and tier history persist for thirteen months inside your own cloud tenancy. Evidence bundles and the access log are customer-held for seven years, because they are the artefacts most likely to be needed long after the vehicle, the contract and possibly the vendor are gone.

That ordering is deliberate and is the opposite of what a data-hungry product would choose. We keep the least of what is most sensitive and the most of what is most checkable.

Platform

The rest of the category.