System Maturity Disclosure
Three open scaffold categories, plus hardware on hosted runs, named explicitly in every audit bundle.
Every Verdifax audit bundle names its open scaffold categories in the orchestrator code, surfaces them in every audit PDF, and prints them via the independent verifier under verdifax-verify --show-evidence-summary. Three remain open on every run today, and a fourth, hardware attestation, is cleared only on runs sealed with the SEV-SNP attestation agent, so records from the hosted API carry four flags. The three:
- Timing declarations (
leakage_bundle.scaffold), flagged 2026-10-15: the constant-time booleans are design declarations of the deterministic scheduler, not per-run measurements. Real per-stage wall-clock timing IS now measured and bundle-sealed on every run; the flag clears when the declarations themselves are replaced by measurement. - ZK transcript (
transcript.scaffold), activates when the winterfell AIR adapter ships and validates determinism across three Rust toolchains. - ZK proof binding (
zksp_binding.scaffold), activates when the winterfell prover replaces the transitional R1CS hash facade with real STARK proof bytes.
Hardware attestation graduated from scaffold to real on its first platform. Runs sealed with an AMD SEV-SNP attestation agent carry a verified hardware quote bound inside the execution record (hardware_attestation.attestation_mode = "sev_snp") with the scaffold flag cleared; the quote, endorsement certificate, and AMD chain are embedded for offline re-verification. Runs sealed without the attestation service still disclose the scaffold honestly: the flag reports what each individual run actually carried.
Formal verification is no longer a scaffold category. Every new audit bundle carries a formal_verification record naming the pinned Lean 4 proof development: repository, commit, toolchain, the kernel-checked theorem list (including manifest binding and pipeline determinism over the model), and the audited axiom footprint. The record is sealed by its section hash inside the bundle. On successful runs sealed from run 238 on, the complete-record anchor binds it to the public log; on earlier records only the run's formal-verification status is anchored, as one of the 33 pre-anchor values on leaf v5 records. The independent verifier recomputes its hash and checks it, and its scope statement says plainly that the theorems are about a model of the pipeline, with byte-format fidelity tracked on the specialist roadmap.
Full per-declaration detail, with the precise activation condition for each, is published at docs.verdifax.com/concepts/scaffold-gaps.
There is no silent fallback anywhere in the stack. Until orchestrator 1461f3a (October 19, 2026 UTC) there was one: when the live AI review's call to the Claude API failed, the review approved the text on a one-step trace of the text itself and the record still named the live adapter; the server now stops such a run at the review stage and seals no record. The verifier's --strict mode exits non-zero whenever any scaffold flag is set, so a strict pass means no value in the bundle carries a scaffold flag.
