Section 01System topology
Four planes. The candidate plane holds no secrets; the edge plane terminates media and attestation but never sees item content; the service plane holds the invariants; the data plane is append-only where it matters and short-lived where it does not.
| Subsystem | Responsibility | Explicitly does not |
|---|---|---|
| Session orchestrator | Owns the session state machine and the authoritative clock; every transition is an event. | Never evaluates candidate behaviour. |
| Identity service | Document match, liveness scoring, dual-angle correlation, enrolment templates. | Never stores a raw ID number or ships a face image off-region. |
| Delivery gate | The single conjunction point: identity ∧ binding ∧ attestation → derive session key. | Never caches a derived key; never opens on a partial condition. |
| Generation + IRT | Variant synthesis inside declared ranges, solver verification, parameter calibration. | Never emits an unsolved or uncalibrated variant. |
| Evidence engine | Deterministic event emission, signing, verdict routing. | Never computes an aggregate, score or probability. |
Section 02WebRTC streaming engine
Two independent publishers per Level 3 session — the laptop's webcam and the phone's rear camera — joined at a selective forwarding unit rather than peered to each other. The SFU never mixes: each track is forwarded, recorded conditionally, and processed on a separate worker so that a failure in mesh extraction cannot stall media.
- Codecs. VP9 with simulcast at three spatial layers; the processor subscribes to the layer it needs, so a poor uplink degrades resolution rather than dropping the stream.
- Bitrate floor. 350 kbps per publisher at the lowest rung; below that the client falls to 5 fps stills plus audio and the session continues under the E12 protocol.
- Recording is conditional. The processor holds a rolling 60-second encrypted buffer. Only when a rule fires is a ±30 s clip cut, sealed and written to the media vault. Everything else is overwritten in place.
- Clip integrity. Each clip is content-addressed, and its hash is written into the event that caused it — so a clip cannot later be swapped for a different one without breaking the record.
- Failure isolation. Mesh extraction, correlation and clip-cutting run as separate consumers of the same track. Any of them can crash and restart without touching delivery.
Why not peer-to-peer? A direct peer connection between the candidate's two devices would let the pair agree on a story the server cannot check. Both devices publish independently to the SFU and neither can see the other's stream, so temporal correlation is computed on evidence neither device controls.
Section 03Sealed-chip attestation verification
The companion app holds a key generated inside the device's secure element. Every media payload is signed with it, and the signature is only meaningful because the vendor's attestation service will vouch that the key lives in real, unmodified hardware.
Section 04Screen-binding timing
The binding loop is a latency argument. A token that appears on screen and returns from a different device inside two seconds could only have been seen. A decoy display, a photograph or a relayed screen adds either capture delay or a sequence mismatch, and both are visible against the server's own clock.
Section 05The delivery gate
The gate is the architectural heart of the product. It is deliberately small, boring and conjunctive: five predicates, no weights, no thresholds to tune, no partial credit.
- No partial opening. There is no state in which some items are released and others are not because a condition was "mostly" met.
- Re-evaluated continuously. The gate is not a one-time check at T−0; losing a condition mid-exam pauses delivery of subsequent items while the timer halts.
- Key never persisted. The derived key lives in the orchestrator's memory for the session and is destroyed at seal. A database dump contains no readable paper, past or future.
Section 06Generation and IRT pipeline
Generation is bounded rewriting, not authorship. The model may only move values the item author declared movable, and every variant must survive two independent gates — a symbolic solver and the IRT calibrator — before it can be addressed to a candidate.
The calibration mathematics — how the b-parameter is estimated for a variant that has never been sat by anyone, and why the tolerance is ±0.05 logits — is set out in the Psychometric Equivalence Specification.
Section 07Evidence ledger
The ledger is append-only, content-addressed and signed at write time. Its most important property is not immutability but determinism: the same session inputs, replayed through the same engine and rule-set versions, produce byte-identical events. That is what makes the record evidence rather than a rendering.
| Property | Mechanism | Why it matters |
|---|---|---|
| Append-only | Hash-chained segments, per-shift Merkle root published to the agency | Nothing can be quietly edited after a result is contested |
| Deterministic | Pure rule evaluation; no wall-clock reads, no randomness, no model calls in the evidence path | An auditor in 2033 gets the same trail as the reviewer did in 2026 |
| Versioned | Engine version and rule-set version stamped on every session | Rules can improve without rewriting history |
| Bounded | Closed event vocabulary; unknown types rejected at write | Prevents behavioural telemetry creeping in through a generic event |
| Candidate-readable | Same records rendered in plain language in the candidate report | A candidate can contest facts, not vibes |
No model in the evidence path. Machine-learning components (mesh extraction, correlation, OCR) run upstream and emit measurements. The rules that turn measurements into events are ordinary deterministic code, so an event can always be traced to a threshold a human chose and can defend.
Section 08Threat model
| Attack | Capability assumed | Structural defence | Residual |
|---|---|---|---|
| Advance paper leak | Insider access to the item bank | No candidate-addressable paper exists before T−0; bank is encrypted and item-level access is logged | Item-bank exposure reveals a bank, not a paper — and banks are large, versioned and rotated |
| Proxy sitter | A confederate physically present | Dual-angle temporal correlation + continuous enrolment matching | Extremely close relative under identical lighting — mitigated by enrolment templates, not population models |
| Deepfake on primary camera | Real-time face synthesis, virtual camera | Second physical camera at an arbitrary angle, hardware attestation, virtual-camera refusal | Requires simultaneously compromising a sealed chip — no known practical path |
| Decoy display / relayed screen | Second monitor, screen share, remote desktop | Screen-binding token loop + status agent display topology | Sub-2 s relay chain across two devices remains theoretically possible; the latency budget is the defence and it is measured, not assumed |
| Emulated companion device | Rooted phone or emulator | Attestation receipt chain verified vendor-side | Vendor compromise; mitigated by E20 fallback and agency notification |
| Replay of a valid session | Captured media and tokens | Single-use server nonces, session-bound assertions, server-clock validity | None material |
| Coercion in the room | Family or agent pressuring the candidate | Environmental events, ambient audio, discreet duress signal, civic-node alternative | Unsolved by technology. Stated plainly rather than papered over. |
| Malicious insider at TrustXD | Production access | Per-session keys never persisted, four-eyes on rule changes, published Merkle roots | Detection rather than prevention; the ledger makes tampering visible after the fact |
Section 09Scale and failure domains
| Dimension | Design point | Notes |
|---|---|---|
| Peak concurrency | 2,500,000 L3 sessions | Sharded by session id; no cross-shard read on the delivery path |
| Media egress | ~1.1 Tbps | Two publishers × 350–900 kbps, regional SFU pools, no cross-region media |
| Binding messages | ~833 k/s | One token read per session per 3 s; tiny payloads on a dedicated WSS tier |
| Generation throughput | ~30 k variants/s at open | Absorbed by pre-warm; fallback pool covers the first two minutes of a shift |
| Ledger writes | ~120 k events/s | Batched into hash-chained segments; Merkle root published per shift |
| Failure domain | One region = one shift's worth of sessions | A region loss triggers the E25 protocol: administrative Not-assessable and automatic re-sit |
What degrades first, by design
- Video resolution, then frame rate, then video entirely — audio and binding are the last things to go.
- Generation falls back to the pre-calibrated pool before delivery is ever blocked.
- Attestation falls back to cached receipts, then to a declared Level 2 with the agency notified and the level printed on the result.
- Nothing degrades the evidence path. If events cannot be written, the session pauses — a record with holes is worse than a paused exam.