ProofGauntlet in plain English

The problem

Proof Protocol records are sealed, signed, anchored, and registered. Anyone can check that a record is the one that was made. But two perfectly valid records can mean very different things. One is a single attack, fired once at a development box a year ago, judged by the same party that launched it. The other is a campaign across many techniques, run last week in an environment built to match the customer's, watched by an independent witness, and repeated by a second, unrelated party who got the same answer.

Both are "valid". Only one of them should be trusted with a purchase, a policy, or a premium.

What ProofGauntlet does

Give it any proof listed in proofregister.com (or any registry that meets the rules in SPEC Section 4). It does two things.

1. The Gate: is it real? Nine checks: the record is registered, not revoked, unchanged, anchored to a public time beacon, signed by keys that come from somewhere other than the record itself, in the right format, committed before the attack ran, from a valid run, and Conformant. Fail one and the answer is invalid, with the reason. If a check cannot be done, the answer is unverifiable, never a guess. Either way there is no score.

2. The Strength Rating: how much can it carry? A record that passes gets a score from 0 to 100, built from six questions:

Each question gets a Level from 0 to 4, decided by facts the record already contains. Anything the record cannot show scores zero. Some conditions cap the score: no proof of efficacy caps it at 40; a failed reproduction caps it at 50; an old-format record caps it at 40.

The score lands in a band: weak (0 to 39), moderate (40 to 69), strong (70 to 89), or extremely_strong (90 to 100).

The flow

flowchart TD
  R["Any record listed in a PP-SPEC-004 registry<br/>proofregister.com first"] -->|"resolved by Locator,<br/>public API only"| G{"THE GATE<br/>G1 to G9"}
  G -->|"any check fails"| X["invalid<br/>no score, reason shown"]
  G -->|"a check cannot run"| U["unverifiable<br/>no score, reason shown"]
  G -->|"full record, all pass"| V["valid"]
  G -->|"PP-SPEC-004 fields only"| L["valid_legacy"]
  V --> S
  L --> S
  subgraph S ["STRENGTH RATING, rubric PGR-0.1.0"]
    direction LR
    D1["D1 Tier 25"]
    D2["D2 Adversarial Depth 20"]
    D3["D3 Environment Fidelity 15"]
    D4["D4 Capture Fidelity 15"]
    D5["D5 Independence 15"]
    D6["D6 Freshness 10"]
  end
  S -->|"Levels 0 to 4,<br/>unknown is zero"| K["Ceilings<br/>K1 no efficacy: 40<br/>K2 reproof diverged: 50<br/>K3 legacy: 40"]
  K --> B["0 to 100<br/>weak | moderate | strong | extremely_strong<br/>efficacy shown beside it"]
  B --> RK["RANKINGS<br/>every public record, best per DUT,<br/>the rest shown beside it"]

What makes it different

• No opinion. The rubric is a published data file. Anyone can recompute any score and get the same number.
• No hiding. Every public record is rated and ranked. No vendor can opt out, and a ranking always shows the rest of a product's records beside its best one.
• Strength is not efficacy. A strong proof can show a control failing. Efficacy and false block rates are always shown beside the strength.
• API first. Everything is an API call first. The website is just a client. The same rule applies to the registries it reads.
• Nothing is changed. ProofGauntlet never edits a record. It computes, like a calculator.

Old records

Records registered before PP-SPEC-077 Section 21 carry only a product name, a hash, and a time-beacon reference. They are not thrown out. They go through the checks they can support and are rated on what they can show, which is usually only Freshness. The rendering says exactly what would have to be registered for each score to rise.