the artifact what you keep

The page you hand the auditor.

Not a dashboard nobody logs into. A dated artifact, generated from the engine's own state with no human-written section inside it — and reproducible by someone who does not trust us, from the files it came with.

“Can you prove isolation for last Tuesday?” is the question this page exists to answer. Last Tuesday is a closed window. A closed window replays.

generated, not written every claim links to an artifact replays byte-identically

0100 what is in it

Seven sections. The two that matter most are the ones most packs leave out.

01 The cover — which engine produced it: version, image digest, licence id; the scope; first byte to this window, in days. Replay must be able to name the engine that made the claim.

02 The network truth — topology, address spaces, zones, the reachability graph, and how many endpoints resolved to a role and from which source.

03 The gap ledger — every relationship in one of six states: verified and observed, verified but not observed, broken intent, exposure, active violation, correctly isolated. The six states, defined →

04 Rule and flow classification — shadowed, redundant, disabled, overly broad, unused per counters, unknown — and the conservative retirement list, with the reason on each line rather than a hit count.

05 Coverage and limits — the section that makes the rest honest — the sampling rate of every stream, including unknown; every construct the parsers could not read, listed; every device without hit counters; and the sentence “not observed is not no traffic”. Derived from the inputs, never typed.

06 Hashes and the replay command — a hash for every frozen input and for the results, and the one command that recomputes them. If the recomputed hashes match, the pack is what it says it is. If one byte of the inputs has changed, they will not.

07 The claims index — every finding in the pack is a claim pointing at a frozen file and its digest. A finding without an artifact cannot be generated; the gate that enforces that has been shown going red.

0200 a sample

What a scope looks like on paper.

the artifact

Segmentation evidence — scope: payments-prod

window 2026-08-06 → 2026-08-13 · tenant t-4417 · generated on your infrastructure
5 roles · 18 declared paths · 1 escalation · exporters sampled 1:1000, stamped

verified

Enforced policy equals declared intent Every rule in force maps to a named, approved declaration. No orphans. pass

Policy scored against traffic it never saw Held-back and adversarial sets, run before enforcement, gate red on seeded defect. pass

Rules retired conservatively 3 unused rules proposed for retirement; counters present on all three; reachability model shows removal safe. pass

Cross-tenant reachability No configured path between t-4417 and any other tenant scope. None observed in the window — stated as not observed, not as absent. pass

Sensitive flow awaiting a named human cardholder-db → reporting: proposed, not enforced. Queued for approval since 08-11. escalated

every decision carries user · time · event — approve, reject, retire
inputs sha256:9f2c…a41d · results sha256:1c77…e0b3 · replay: themis replay --scope payments-prod --window w-2026-08-13 · raw flows never left the site

Sample artifact, lab topology. Shape and fields are real; the numbers are not yours yet.

0300 what a third party does with it

Check the hashes. Replay. Identical.

An evidence pack that cannot be regenerated from the same inputs on a different day is a screenshot, not evidence. So a window is frozen when it closes — observed aggregate, declarations, configuration, results, each with its digest — and the pack is the readout of that frozen window.

Check the hashes

Every input file and the results carry a digest in the manifest. The pack's claims point at those digests.

Replay

One command recomputes the ledger and the classification from the frozen inputs, through the same code path the engine ran — not a second implementation.

Identical — or not

The recomputed hashes match, or they do not. One flipped byte in the inputs is detected. That gate has been shown going red on purpose.

The same property makes the window the unit of time. “Last Tuesday” is not a query against a database that has moved on since; it is a closed window with its own hashes, and it will replay next year the way it replays today.

0400 who reads it

Different rules by market. One artifact.

The regimes change as you cross a border. What they ask for does not: show that what is enforced is what was declared, and show it for a date. The mapping below is directional, validated per country and per entity with your own auditors.

FranceNIS2 · ANSSI ReCyF — continuous timestamped verification reports, a justification attached to each rule rather than a hit count, and human decisions recorded as they were taken.

FranceSecNumCloud · HDS — machine-checkable proof that the policy actually enforced equals the intent that was declared, produced without anything leaving your infrastructure.

EuropeDORA · NIS2 — an evidence pack per scope or per tenant, on demand, covering both the entity and the ICT providers it is required to audit; for NIS2, demonstrated segmentation and control of change across essential and important entities.

United StatesNIST SP 800-207 · SOC 2 · FedRAMP (NIST 800-53) — a Zero Trust architecture asks for continuously verified, least-privilege access; SOC 2 auditors test segmentation for design and operating effectiveness across an observation window. A continuously generated, dated pack is coverage of the whole window rather than the day someone took a screenshot.

SectorPCI DSS · NERC CIP · HIPAA · IEC 62443 · CMMC — cardholder scope, bulk electric system boundaries, clinical and patient-data isolation, OT zones and conduits, defence supplier environments: each reads the same per-scope pack against its own control families. Evidence mapped to the family, never positioned as compliance software.

WorldwideISO 27001 — the change workflow itself as the artifact: proposal, verification, named approval, event log — for every widening of reachability.

The claim is never “we make you compliant.” It is: we generate the segmentation evidence your auditors — and your customers' auditors — keep asking for, continuously, on your infrastructure.

e000 End.DT6 deliver

Bring your auditor.

30–60 minutes, read-only. The first pack comes out of the first two weeks on your own estate — and the replay command comes with it.

See it on your estate Why a pass means anything →