TrustXD ExamOS binds a candidate's identity to their hardware, their hardware to their screen, and their screen to a question paper that did not exist until the moment they authenticated.
TRUST CHAIN · SELECT A LINK
Four states of one session. Each link is independently provable, and the paper only unlocks when the three before it hold.
Exam names denote format compatibility only. No affiliation with, or endorsement by, any testing agency, board or university is implied.
A printed paper is a valuable secret held by presses, couriers, strongrooms and centre staff for weeks. A leak is not an anomaly in that design — it is the design working exactly as built.
We fix it Nothing to steal. Papers are assembled per candidate at T−0 inside a sealed pipeline, and the ciphertext is useless until identity clears.
A photograph, a signature, a tired invigilator at 9 a.m. Proxy substitution survives because verification is treated as a moment rather than a continuously held state.
We fix it Two cameras, one subject, cross-matched frame by frame — and a sealed chip proving the frames came from real hardware.
Remote proctoring returns a probability — "87% suspicious" — and a career turns on it. A candidate cannot cross-examine a number, and a court cannot audit one.
We fix it No risk scores. Timestamped, deterministic event records; three permitted verdicts; a named human on every flag.
Each lock is independently verifiable and independently auditable. Breaking one does not weaken the others — it stops the session.
Government ID parsed on-device, active liveness, and a second camera at 60°–120° whose head-motion vector must correlate with the first in real time.
The server paints a 3-second token on the exam screen. The phone reads it and reports back over an independent channel. Arrive late, or point at a decoy, and the lapse is recorded.
Encrypted item bank, opened only after locks one and two hold. The generator then re-parameterises every item for that candidate — while the IRT calibrator holds difficulty constant.
A deepfake can hold a front-facing camera. It cannot hold two cameras, at an arbitrary angle to each other, and keep both stories straight while a person is asked to turn their head and show the back of their ear.
Aadhaar, passport or driving licence OCR runs client-side; only the extracted field hashes and a match decision leave the machine.
Randomised prompts — rotate to 45°, show the left ear, follow the dot — scored against a 468-point facial mesh and depth symmetry.
The phone app signs every media payload with Apple App Attest or Android Play Integrity. Emulators, rooted devices and virtual cameras fail the chain, not the model.
The rig must sit between 60° and 120° of the primary axis. Outside that window the session cannot start — geometry is a precondition, not a score.
Knowing who is in the room is only half the problem. The other half is proving that the screen the phone can see is the screen the exam is running on.
The read-back travels over the phone's own WebSocket, not the laptop's. A compromised exam machine cannot forge its own confirmation.
Validity is measured against the server's own NTP-disciplined clock, so client clock drift or replay buys an attacker nothing.
A wall, a photograph or a second monitor produces a stale token or none at all. Either way the mismatch is written to the record within one cycle.
A lapse is an event, not a verdict. It routes the session to a human reviewer with the exact clip and timestamps attached.
The paper is assembled after the candidate is proven, not before. Every candidate receives a different surface — and, by construction, the same test.
A cyclist of combined mass 60 kg is moving at 8 m s⁻¹. Brakes bring the cycle uniformly to rest over 4 m. Find the magnitude of the average retarding force.
Names, places, numeric parameters, option order and phrasing all move. The difficulty, the cognitive operation and the expected solve time do not.
Papers stay encrypted server-side. The decryption key is derived only after Level 3 identity and screen-binding both hold, and is never persisted on the client.
A candidate who starts twenty minutes late gets a freshly generated paper, not a leftover one. There is no window in which an earlier paper helps a later candidate.
The model rewrites within a template's declared parameter ranges and answer-preserving transforms. It does not invent physics, and every variant is machine-solved before release.
Variants outside the ±0.05 logit band are rejected by the calibrator and never reach a candidate. See the curves ↓
No integrity scores. No automated rejections. A machine may only observe and record; a trained human decides, and the candidate can read the same record the reviewer read.
The candidate receives this same trail, plus a log of every reviewer who opened it.
Clear, Review required, Not assessable. There is no fourth outcome, and "Not assessable" always carries a remedy — a free re-sit, never a penalty.
Reviewers are not employed by the institution whose exam they are reviewing, are randomly assigned, and see the evidence before they see the candidate's name.
Given the same inputs the engine emits byte-identical events. A tribunal can replay a session and get the same trail three years later.
A candidate can open a dispute from inside their own report. The clock on evidence retention pauses for the duration of the appeal.
A surveillance system that a candidate cannot see, understand or contest is not a trust system. Everything captured is visible to the person it was captured from.
The candidate sees their own secondary stream at full size for the whole session, so what is captured is never a surprise.
Consent, prompts and the final report ship in English and Hindi, with the language pack extensible to any scheduled language.
Every access to a candidate's evidence — reviewer, auditor, agency — appears in the candidate's own transparency log.
Unflagged media is discarded when the session closes. Flagged clips expire at 30 days unless an appeal holds them, and the purge itself is logged.
An institution declares the level; the candidate sees the level before they consent; the certificate records the level it was earned under.
Formative assessment, practice tests, internal coursework.
University entrance tests, hiring assessments, structured interviews.
NEET, JEE, UPSC, banking recruitment and state common entrance tests.
The status agent reports state, not content. It has no keylogger, reads no files, and inspects no other application's memory — it answers a fixed set of questions about displays, capture devices and remote sessions, and it uninstalls itself when the exam ends.
T−45:00
Device readiness
Every step is reversible up to T−0. After the paper releases, the session may pause but never restarts.
Bandwidth, camera resolution, battery headroom and phone-mount geometry are checked. Failures here are cheap; failures at T−2 are not.
Each capture right is granted separately, in the candidate's chosen language, and a signed receipt is issued to the candidate before anything is recorded.
ID is parsed on device and matched against a live 3D facial mesh under randomised movement prompts. The ID number never leaves the machine in clear text.
The phone stream joins. Head-motion vectors from both cameras are correlated over a rolling window; the session cannot proceed below the correlation floor.
App Attest / Play Integrity receipts are verified against the vendor chain. Emulators, virtual cameras and rooted devices are refused before any exam data moves.
The token loop starts and must hold three consecutive cycles inside the latency window before the delivery gate will even evaluate.
Only now does a paper exist for this candidate. It is generated, IRT-checked, encrypted to this session's key and streamed item by item.
Identity correlation, screen binding and attestation all remain live for the full duration. Interruptions pause the timer and are credited back, second for second.
Responses are hashed, countersigned by server and client, and written to an append-only ledger. The candidate receives the hash before they close the tab.
Unflagged media is destroyed immediately. Flagged sessions enter the human queue with a 30-day clock, and the candidate is told, in their own report, exactly which is which.
Every one of these has a defined, candidate-favourable protocol. None of them ends a career by accident.
E01 The internet drops mid-paper
Answers are already sealed locally. The timer halts within 400 ms, the client retries for 15 minutes, and on reconnect the lost seconds are credited back in full. The gap is an event on the record, never a verdict.
E02 The phone rings
The exam app holds the camera session through an incoming call and the timer pauses. A call answered is logged as a stream interruption and routed to human review — not scored, not failed.
E03 The phone battery dies
Charging is mandatory at Level 3 and warned at 30%. On loss, the candidate has 10 minutes to restore the secondary angle; beyond that the session becomes Not assessable with an automatic free re-sit.
E04 The mount slips or the phone falls
Geometry loss is detected within two frames. The candidate is prompted to re-seat the device, and the reposition window is timed out of the exam, not out of the candidate.
E05 Mains power fails
The client runs from battery and degrades to audio-plus-low-frame-rate video at 15% charge. Region-wide outages are detected across sessions and escalate to an agency-level reschedule.
E06 Someone walks into the room
A second face is recorded as an environmental event with the clip attached. A family member crossing the frame and a second person seated at the desk are different facts, and a human decides which happened.
E07 A candidate needs a comfort break
Scheduled and medical breaks are declared in advance and honoured. Re-entry requires a fresh liveness check; break time is excluded from the exam clock by policy.
E08 The candidate uses assistive technology
Screen readers, magnification and scribes are first-class configurations, declared at registration. The status agent allowlists them; extra time is applied to the generated paper's timing model.
E09 The candidate has one device, not two
Level 3 requires two. Where a second device is unavailable, the agency assigns a supervised civic node — a library or panchayat centre with loan hardware — so the level is never a wealth test.
Full protocols, owners and timing tables for all twenty-six defined edge cases are in the Product Requirements Document →
Item Response Theory turns that from a promise into a measurement. Every generated variant carries the same three parameters as its parent — discrimination, difficulty and guessing — inside a tolerance the calibrator enforces before release.
3PL model: P(θ) = c + (1 − c) / (1 + e−1.7a(θ − b)). The shaded envelope is the ±0.05 logit parity band; a variant that leaves it is rejected before delivery.
Twelve variants of PHY-1104 as delivered on 30 July. Every b-parameter sits inside the tolerance band.
Pre-calibration on a live cohort, continuous re-estimation during delivery, and a post-hoc DIF sweep across language, region and gender. Read the equivalence specification →
Delivery health, queue depth and disposition — live. Every number here is a count of recorded events, never an estimate of anyone's honesty.
Candidates in session now
214,806
across 28 states · peak concurrency 231,412
Sessions started per minute
1,284
last 24 min · +18% vs. opening window
Delivery gate — median time to paper
41.2 s
from Level 3 clear to first item rendered
Session disposition · today
Illustrative operating figures for a Level 3 delivery day, shown to demonstrate the interface. Not results from a live administration.
Event stream · human review queue
MEDIAN TIME TO REVIEWER 6 MINMedia is captured only for declared exam-integrity purposes, only for consented items, and only between session start and submission.
Unflagged video and audio are destroyed the moment the session seals. What survives is the event record — timestamps and outcomes, not footage.
Flagged clips only, encrypted at rest with per-session keys, accessible to assigned reviewers and to the candidate. Every access is logged to both.
Deletion runs on schedule, emits its own signed record, and pauses only for an open appeal. The candidate is notified when their file is gone.
All candidate data processed and stored in-country, on infrastructure the agency can inspect.
Access, correction, portability and grievance redressal wired into the candidate's own report view.
Append-only ledger of every verdict, access and purge, exportable for statutory audit.
Reviewer pool contracted separately from the delivery institution, with rotation and blind assignment.
Placeholder copy — replace with attributed quotes before launch
"The part that changed the conversation internally was 'the paper does not exist yet'. Everything we spend on strongroom logistics is protecting an asset this design simply does not create."
"We have refused every proctoring pilot on one ground: none of them could tell a tribunal why a candidate was flagged. A deterministic trail with three verdicts is something our legal cell can actually defend."
"My question was always psychometric, not technical. Show me that variant 47 is the same difficulty as variant 3 and I will sign. The parity band answered it in one chart."
"Students in my district travel eleven hours to a centre. If the integrity story holds, the equity story is bigger than the integrity story."
"The self-view mattered more than we expected in user testing. Candidates stopped asking what was being recorded once they could simply see it, at full size, the whole time."
User stories for candidate, invigilator, reviewer and agency; functional requirements; twenty-six edge-case protocols.
Read 02 · BlueprintEnd-to-end data flow: WebRTC engine, attestation verification, generation pipeline, IRT service, evidence ledger.
Read 03 · SpecificationHow IRT keeps AI-generated variants mathematically fair: calibration, tolerance, linking, DIF and the rejection rule.
Read 04 · DeckTen slides for testing agencies, education ministries and university boards. Keyboard-navigable, presentation-ready.
PresentA pilot is a single exam, one cohort, both systems side by side — your existing delivery and TrustXD ExamOS — with the evidence ledger open to your auditors from day one.