Menu

Substrate-Independent Trust Continuity · SITC

What survives when the original system disappears?

SITC is CertiLink’s research program on whether a protected record can stay persistent, under legitimate custody, authentic, independently verifiable and recoverable after the systems and custodians that created it fail.

The problem

Trust can fail while the data remains.

A record may be copied across several services and still depend on one identity provider to authorize retrieval, one proprietary decoder to read the archive, or one decryption key that never left a defunct provider.

The reverse also happens. A complete local backup may be recoverable as bytes but lack trustworthy signing-key history, chain-of-custody evidence, proof that it is the current version, or the authorization needed to disclose it.

The scientific problem is not the durability of bytes. It is whether enough information and evidence survive to perform a specific trust-dependent operation.

Central hypothesis

H-SITC

For bounded classes of failures, a typed, externally interpretable resource-dependency model carried with an authenticated artifact can improve the accuracy of continuity assessment and the auditability of recovery or migration compared with matched baselines, while preserving application-specific authorization and independent verification.
  • Survival requires resources that are informative enough and actually available.
  • A committed description of a resource is not evidence that it is reachable today.
  • Cryptography cannot decide a legal entitlement without external facts and authority.
  • Any long-horizon assurance depends on explicit failure models, maintenance, cryptographic strength and future interpreters.

Four research constructs

One cell, one contract, two evaluators.

  1. PTC

    Portable Trust Cell

    A passive, authenticated, versioned object that binds an asset to its evidence, protected representations, constraints and interpretation contract. It carries facts and rules; it never runs code.

    Explore its anatomy

  2. RSC

    Recursive State Contract

    A declarative contract inside the cell mapping each pillar to typed claims, dependencies, failure observations and termination bounds. One external deterministic interpreter evaluates it, with no AI agent in the loop.

  3. TSQ

    Trust Survivability Quorum

    Asks whether at least one valid, compatible, policy-permitted pathway survives specified failures. A count of shares, copies or votes alone is not sufficient.

  4. QPST

    Quorum-Preserving State Transition

    An authenticated protocol for repair, custody handover, key changes and migration that establishes proved continuity, an explicit degraded interval, or a failed transition.

Five governing properties

Each pillar is a separate claim, with a stated limit.

The pillars are not five equal votes and are not assumed to hold together. Every evaluation keeps each outcome separate, with its own evidence.

Persistence
Enough authentic representations of the content and its evidence stay obtainable and readable within a declared failure model and time horizon.
Limit A successful retrieval today is not proof of availability forever.
Self-Custody
The legitimate owner or authorized succession structure keeps a permitted recovery path without depending on the original provider as sole custodian.
Limit Controlling a key does not prove authority to disclose a legal, medical or estate record.
Authenticity
Cryptographic and evidentiary material supports scoped claims about origin, integrity, issuer, history and custody.
Limit A signature binds an issuer to an assertion. It does not certify that the assertion is true.
Verifiability
At least one independent implementation can reproduce claim-scoped outcomes from portable evidence and versioned rules, without a secret online service.
Limit Two interpreters agreeing does not prove a claim if their shared specification is flawed.
Recoverability
The exact protected bytes can be reconstructed from compatible resources without the original services, by an authorized actor where that is required.
Limit Technically recoverable is not the same as authorized for release.

Six sufficiency dimensions

What a specific operation actually needs.

These describe the requirements of one operation, not six votes. Checking a public signature needs no key or disclosure authority; releasing a protected will needs both.

  • D

    Data

    Enough authentic data exists.

  • K

    Key

    Appropriately bound key access exists.

  • E

    Evidence

    Integrity and provenance evidence suffices.

  • I

    Interpretation

    A suitable interpreter is independently available.

  • A

    Authorization

    A valid authorization pathway, when needed. Always a separate claim.

  • C

    Compatibility

    Identifiers, generations, algorithms, policies and epochs line up.

Worked example · as shown in the film

A count of copies is not a quorum.

An archive uses 3-of-5 ciphertext fragments and a separate 3-of-5 key-share set. Five providers appear in the manifest, so a simple count looks comfortably redundant.

Watch chapter 7

Data fragments · need 3

Shared identity tenant F1F2F3F4
F5

1 of 3 · Data fails

Key shares · need 3

K1K2K3K4K5

5 of 3 · Key holds

Four fragment holders draw their access from the same identity tenant. When that tenant goes down, four fragments go with it. The keys survive, but the recover-and-verify operation fails on the D dimension: no sufficient path.

Custody through time

Every handover gets an honest verdict.

Storage disappears, formats age, custodians change. A transition is committed only if its preconditions hold, it is authorized, and the successor verifies. Otherwise the previous generation stays addressable and the failure is recorded.

  • QPST-STRICT

    The required pathway stayed supported throughout the handover and the successor passed verification.

  • QPST-DEGRADED

    An identifiable interruption or unverified interval. It does not retroactively create uninterrupted continuity.

  • QPST-FAILED

    Unauthorized, contradictory, incomplete or unverified. No continuity claim for that change.

Verification spectrum · research vocabulary

Precise answers, not a “trusted” badge.

Results are scoped to a specific claim and carry their reasons. An independent verifier must never silently turn signed into true, or recoverable into legally releasable.

  • VERIFIED

    All mandatory evidence for this specific claim was examined and satisfied.

  • INVALID

    A contradiction, signature failure, hash mismatch or prohibited transition was found. It is never hidden behind an earlier missing input.

  • INSUFFICIENT_EVIDENCE

    Evidence needed for the claim was not presented or could not be validated.

  • NOT_APPLICABLE

    The profile excludes the claim. Never a disguised success.

  • UNSUPPORTED

    The algorithm, profile or version isn’t recognized by this interpreter.

  • REQUIRES_EXTERNAL_AUTHORITY

    A legal or current-status question that offline evidence cannot decide.

This six-outcome vocabulary is a research proposal alongside Certi-Lock’s existing claim states. The exact mapping between them is unfinished work.

Where the work stands

Tier-0: simulated logic, measured honestly.

A Bun/Hono Tier-0 research sandbox runs the recursive and failure-state logic against synthetic cases.

Latest logged run · LOG-031, 18 Oct 2026
209 passing · 1 TODO · 0 failing
Synthetic fixtures
25

22 named research vectors

Implemented at Tier-0 scope Not built: OFF-01, independent offline recovery (Tier 2)

Baseline comparison · 11 synthetic cases that should not be recoverable

  • Naive replica count9 of 11 wrongly called recoverable
  • Naive multi-cloud8 of 11
  • TSQ solver0 of 11
The TSQ solver also missed 1 of 14 recoverable cases: it fails closed when path enumeration is incomplete. Expected answers were written by hand from each fixture’s design intent before the engine ran (LOG-024). This is a structural Tier-0 result on synthetic labels, not a measurement of real-world recoverability and not validation of hypothesis H6.
  1. T0 Simulated recursive and failure-state logic Current
  2. T1 Real cryptographic integration Unproven
  3. T2 Independent offline exact-byte recovery Unproven

These results show simulated logic. They are not cryptographic SITC correctness, full survivability proofs, or independent exact-byte recovery.

Hypotheses and falsification

Six claims Phase I will try to break.

Each is tested against matched baselines with the same resources and comparable cost: encrypted multi-provider backup, threshold-share recovery, a documented offline archive and an erasure-coded design. No weak single-copy straw man.

  1. H1

    Correctness

    The TSQ solver matches an exhaustive oracle on bounded graphs and real recovery attempts.

  2. H2

    Portability

    Two independently produced interpreters reproduce the same commitments, outcomes and exact bytes, offline.

  3. H3

    Temporal continuity

    QPST blocks unauthorized promotion and separates strict, degraded and failed transitions.

  4. H4

    Security trade-off

    Better survivability does not unacceptably raise unauthorized reconstruction or false acceptance.

  5. H5

    Cross-vertical invariance

    Estate and veteran-service profiles pass the same core vectors without changing core meaning.

  6. H6

    Practical value

    At comparable cost, the evaluator finds hidden failure dependencies or yields more correctly recoverable outcomes.

The proposition is weakened or falsified if TSQ systematically misclassifies recoverability, independent interpreters disagree, QPST misses partial or unauthorized transitions, security exposure rises unacceptably, or simpler baselines do as well at lower cost.

Proposed Phase I · twelve months

Five work packages, each with an exit artifact.

  1. Months 1–2

    Formal threat and evidence model

    Failure ontology, claim states, hypotheses, matched baselines.

    Exit Reviewable model, versioned vectors, test registration

  2. Months 3–4

    TSQ solver and independence

    Typed pathways, cut and compromise sets, exhaustive small-graph oracle.

    Exit Solver correctness report and counterexamples

  3. Months 5–6

    Portable cell, contract, interpreters

    Canonical PTC/RSC draft, bounded recursion, a second implementation, offline package.

    Exit Cross-implementation vector corpus

  4. Months 7–8

    QPST and evolution

    Fragment repair, share succession, media and format changes, handover proofs.

    Exit Transition-certificate corpus incl. negative cases

  5. Months 9–12

    Vertical trials and decision

    eStateSafe and VetNetUnited synthetic cases, failure injection, comparator trials, independent review.

    Exit Feasibility report and go/no-go for Phase II

Research integrity

What we don’t claim.

SITC does not claim to have invented distributed backups, secret-sharing access structures, erasure or regenerating codes, archival information packages, evidence-record renewal, canonical encodings or model checking. Each has substantial prior art.

The candidate differentiator is the combination: one claim-typed, portable model spanning data, keys, interpretation, provenance, external authority and compatibility, used for failure-aware sufficiency evaluation and independently checkable transitions. Whether that combination is novel, better or commercially valuable is an open question for controlled comparison and qualified review.

CertiLink has submitted an NSF SBIR Phase I Project Pitch. A submitted pitch is not an NSF award, endorsement or evidence that these hypotheses have been proven.

For researchers and technical reviewers

Help us find where it breaks.

We welcome review from people in formal methods, cryptography, digital preservation and security testing.

Start a conversation Watch the film