The rubric we hold assurance layers to — and the threat research behind it. For payments engineers, protocol maintainers, and risk teams; public prior art and public tracker positions only.
The evaluation framework behind every post in this series: seven assurance domains, a maturity model, and a standards cross-walk to FIDO AP2, OWASP, CSA ATSF, and PCI DSS. CC-BY-4.0 — copy, adapt, cite.
Post 1Cryptographic validity answers was this artifact issued by who it claims? — nothing about whether the payment should happen. Three gaps sit between "signature verifies" and "safe to settle."
Post 2Proof of delegation and proof of non-reuse are independent properties — each fails differently. A closed mandate can be perfectly signed and spent twice.
Post 3An evidence bundle that proves internal consistency proves exactly that. Closing the temporal gap requires anchoring the chain tip to a store neither party controls.
Post 4cnf binds a mandate to a key — proof of which
key, not whose current intent. Why behavioral baselines are
the missing signal.