Deliverable 02 Blueprint · v1.0 TARGET: 2.5 M CONCURRENT L3 SESSIONS

End-to-end system architecture

Five subsystems, one invariant: no candidate-addressable question text exists anywhere in the system until that candidate's identity, hardware and display have all been proven.

TransportWebRTC SFU for media · independent WSS for binding
Trust anchorApp Attest / Play Integrity receipt chain
GenerationTemplate-bounded LLM + solver gate + IRT calibrator
RecordAppend-only signed ledger, 7-year replay

Section 01System topology

Four planes. The candidate plane holds no secrets; the edge plane terminates media and attestation but never sees item content; the service plane holds the invariants; the data plane is append-only where it matters and short-lived where it does not.

CANDIDATE PLANE EDGE PLANE · IN-COUNTRY SERVICE PLANE DATA PLANE Exam client browser · nothing cached Companion app sealed chip signs frames Status agent state, never content Self-view all capture stays visible WebRTC SFU + TURN relay Token gateway WSS · independent path Attestation verifier vendor chain check Media processor mesh, corr, clip cut Session orchestrator authoritative session clock Identity service OCR · liveness · correlation Delivery gate A ∧ B ∧ attest → key Generation + IRT variant engine · solver · IRT Evidence engine deterministic · append-only Sealed item bank AES-256-GCM at rest Evidence ledger signed · 7 years Media vault flagged clips only · P30D Consent registry Ed25519 receipts BLUE — GATED ITEM CONTENT: THE ONLY ROUTE TO A CANDIDATE SOLID: SYNCHRONOUS · DASHED: ASYNCHRONOUS / BEST-EFFORT
FIG 1 System topology. The blue path is the only route by which question text reaches a candidate, and it is unreachable until the delivery gate derives a session key.
SubsystemResponsibilityExplicitly does not
Session orchestratorOwns the session state machine and the authoritative clock; every transition is an event.Never evaluates candidate behaviour.
Identity serviceDocument match, liveness scoring, dual-angle correlation, enrolment templates.Never stores a raw ID number or ships a face image off-region.
Delivery gateThe single conjunction point: identity ∧ binding ∧ attestation → derive session key.Never caches a derived key; never opens on a partial condition.
Generation + IRTVariant synthesis inside declared ranges, solver verification, parameter calibration.Never emits an unsolved or uncalibrated variant.
Evidence engineDeterministic event emission, signing, verdict routing.Never computes an aggregate, score or probability.

Section 02WebRTC streaming engine

Two independent publishers per Level 3 session — the laptop's webcam and the phone's rear camera — joined at a selective forwarding unit rather than peered to each other. The SFU never mixes: each track is forwarded, recorded conditionally, and processed on a separate worker so that a failure in mesh extraction cannot stall media.

  • Codecs. VP9 with simulcast at three spatial layers; the processor subscribes to the layer it needs, so a poor uplink degrades resolution rather than dropping the stream.
  • Bitrate floor. 350 kbps per publisher at the lowest rung; below that the client falls to 5 fps stills plus audio and the session continues under the E12 protocol.
  • Recording is conditional. The processor holds a rolling 60-second encrypted buffer. Only when a rule fires is a ±30 s clip cut, sealed and written to the media vault. Everything else is overwritten in place.
  • Clip integrity. Each clip is content-addressed, and its hash is written into the event that caused it — so a clip cannot later be swapped for a different one without breaking the record.
  • Failure isolation. Mesh extraction, correlation and clip-cutting run as separate consumers of the same track. Any of them can crash and restart without touching delivery.

Why not peer-to-peer? A direct peer connection between the candidate's two devices would let the pair agree on a story the server cannot check. Both devices publish independently to the SFU and neither can see the other's stream, so temporal correlation is computed on evidence neither device controls.

Section 03Sealed-chip attestation verification

The companion app holds a key generated inside the device's secure element. Every media payload is signed with it, and the signature is only meaningful because the vendor's attestation service will vouch that the key lives in real, unmodified hardware.

COMPANION APP ORCHESTRATOR ATTESTATION VERIFIER VENDOR SERVICE 01 · session join, device id 02 · server nonce (single use, 60 s) Secure element signs nonce ‖ frame hash 03 · assertion + attestation receipt 04 · forward for verification 05 · receipt chain check 06 · genuine hardware · not emulated · app unmodified attestation.held = true bound to this session id only FAIL PATH · session refused before any exam material is addressed · E20 fallback to Level 2
FIG 2 Attestation is checked before the delivery gate is even evaluated, so a spoofed device never reaches the point where item content exists.
// Every media payload from the companion app carries this envelope. { "session": "S-77401", "seq": 8841, "captured": "2026-07-30T11:42:06.114+05:30", // advisory only "frame": "sha256:9c1f…a07f", "attest": { "platform": "ios.app_attest", // or android.play_integrity "nonce": "srv:3f9a…d201", // server-issued, single use "assertion": "MIIB…", "receipt": "MIIG…" }, "sig": "ed25519:7c40…91ba" } // Verification is a conjunction. Any false short-circuits the session. verified = chainValid(receipt) && nonceMatches(assertion, issuedNonce) && frameHashSigned(assertion, frame) && !emulator && !rooted && !virtualCamera && boundToSession(assertion, sessionId)

Section 04Screen-binding timing

The binding loop is a latency argument. A token that appears on screen and returns from a different device inside two seconds could only have been seen. A decoy display, a photograph or a relayed screen adds either capture delay or a sequence mismatch, and both are visible against the server's own clock.

0 ms 500 1000 2000 3000 VALIDITY WINDOW · 2000 ms · MEASURED ON THE SERVER CLOCK TOKEN TTL · 3000 ms · NEXT TOKEN ISSUED AT 3000 Issueserver Render+90 ms Capture+310 ms Decode+400 ms Server receives · 412 ms · WITHIN_WINDOW Decoy display · 2412 ms · LAPSE_LOGGED
FIG 3 A single binding cycle. Three consecutive in-window cycles are required before the delivery gate evaluates; a lapse is an event routed to human review, never an automatic consequence.

Section 05The delivery gate

The gate is the architectural heart of the product. It is deliberately small, boring and conjunctive: five predicates, no weights, no thresholds to tune, no partial credit.

// Delivery gate — the whole security argument in one function. // There is no configuration that turns any clause off. function evaluateGate(session) { const ok = session.identity.level === 'L3' // FR-A-01…05 && session.identity.correlation >= 0.94 // rolling 8 s window && session.attestation.held === true // FR-A-06 && session.binding.consecutive >= 3 // FR-B-04 && session.consent.complete === true; // FR-E-01 if (!ok) return { open: false }; // no reason codes leak to the client // Key exists only for the lifetime of this session, in memory, on one node. const key = hkdf(masterKey, session.id + session.identity.templateHash); return { open: true, key }; }
  • No partial opening. There is no state in which some items are released and others are not because a condition was "mostly" met.
  • Re-evaluated continuously. The gate is not a one-time check at T−0; losing a condition mid-exam pauses delivery of subsequent items while the timer halts.
  • Key never persisted. The derived key lives in the orchestrator's memory for the session and is destroyed at seal. A database dump contains no readable paper, past or future.

Section 06Generation and IRT pipeline

Generation is bounded rewriting, not authorship. The model may only move values the item author declared movable, and every variant must survive two independent gates — a symbolic solver and the IRT calibrator — before it can be addressed to a candidate.

Item template typed params + ranges answer-preserving ops Sampler per-candidate seed no repeats in cohort Surface rewrite names · place · phrasing option order Solver gate symbolic re-solve must equal closed form IRT calibrator Δb ≤ .05 · Δa ≤ .01 Δt ≤ 4 s Seal encrypt to session key REJECT · answer mismatch · variant discarded, never delivered REJECT · outside parity tolerance · logged with parameters Pre-calibrated fallback pool used when the generation service degrades — delivery never blocks on a model (E21) Median added latency of both gates: 4.8 s at p50 · 11.2 s at p95
FIG 4 Generation pipeline. Two hard gates and a fallback pool. A rejected variant costs milliseconds; a delivered bad variant costs the exam's validity.

The calibration mathematics — how the b-parameter is estimated for a variant that has never been sat by anyone, and why the tolerance is ±0.05 logits — is set out in the Psychometric Equivalence Specification.

Section 07Evidence ledger

The ledger is append-only, content-addressed and signed at write time. Its most important property is not immutability but determinism: the same session inputs, replayed through the same engine and rule-set versions, produce byte-identical events. That is what makes the record evidence rather than a rendering.

PropertyMechanismWhy it matters
Append-onlyHash-chained segments, per-shift Merkle root published to the agencyNothing can be quietly edited after a result is contested
DeterministicPure rule evaluation; no wall-clock reads, no randomness, no model calls in the evidence pathAn auditor in 2033 gets the same trail as the reviewer did in 2026
VersionedEngine version and rule-set version stamped on every sessionRules can improve without rewriting history
BoundedClosed event vocabulary; unknown types rejected at writePrevents behavioural telemetry creeping in through a generic event
Candidate-readableSame records rendered in plain language in the candidate reportA candidate can contest facts, not vibes

No model in the evidence path. Machine-learning components (mesh extraction, correlation, OCR) run upstream and emit measurements. The rules that turn measurements into events are ordinary deterministic code, so an event can always be traced to a threshold a human chose and can defend.

Section 08Threat model

AttackCapability assumedStructural defenceResidual
Advance paper leakInsider access to the item bankNo candidate-addressable paper exists before T−0; bank is encrypted and item-level access is loggedItem-bank exposure reveals a bank, not a paper — and banks are large, versioned and rotated
Proxy sitterA confederate physically presentDual-angle temporal correlation + continuous enrolment matchingExtremely close relative under identical lighting — mitigated by enrolment templates, not population models
Deepfake on primary cameraReal-time face synthesis, virtual cameraSecond physical camera at an arbitrary angle, hardware attestation, virtual-camera refusalRequires simultaneously compromising a sealed chip — no known practical path
Decoy display / relayed screenSecond monitor, screen share, remote desktopScreen-binding token loop + status agent display topologySub-2 s relay chain across two devices remains theoretically possible; the latency budget is the defence and it is measured, not assumed
Emulated companion deviceRooted phone or emulatorAttestation receipt chain verified vendor-sideVendor compromise; mitigated by E20 fallback and agency notification
Replay of a valid sessionCaptured media and tokensSingle-use server nonces, session-bound assertions, server-clock validityNone material
Coercion in the roomFamily or agent pressuring the candidateEnvironmental events, ambient audio, discreet duress signal, civic-node alternativeUnsolved by technology. Stated plainly rather than papered over.
Malicious insider at TrustXDProduction accessPer-session keys never persisted, four-eyes on rule changes, published Merkle rootsDetection rather than prevention; the ledger makes tampering visible after the fact

Section 09Scale and failure domains

DimensionDesign pointNotes
Peak concurrency2,500,000 L3 sessionsSharded by session id; no cross-shard read on the delivery path
Media egress~1.1 TbpsTwo publishers × 350–900 kbps, regional SFU pools, no cross-region media
Binding messages~833 k/sOne token read per session per 3 s; tiny payloads on a dedicated WSS tier
Generation throughput~30 k variants/s at openAbsorbed by pre-warm; fallback pool covers the first two minutes of a shift
Ledger writes~120 k events/sBatched into hash-chained segments; Merkle root published per shift
Failure domainOne region = one shift's worth of sessionsA region loss triggers the E25 protocol: administrative Not-assessable and automatic re-sit

What degrades first, by design

  1. Video resolution, then frame rate, then video entirely — audio and binding are the last things to go.
  2. Generation falls back to the pre-calibrated pool before delivery is ever blocked.
  3. Attestation falls back to cached receipts, then to a declared Level 2 with the agency notified and the level printed on the result.
  4. Nothing degrades the evidence path. If events cannot be written, the session pauses — a record with holes is worse than a paused exam.