XPScerpto Portal-3
Security
Sovereign cryptographic platform portal
XPScerpto presents a sovereignty-oriented cryptographic platform portal with explicit authority boundaries, evidence-first status reporting, and a separate editorial control plane.
Evidence-first UI
Security
This portal distinguishes the real Python backend from the native C++ runtime. Claims remain gated by evidence and runtime truth checks.
Truth contract
No unproven production claim
production_ready is computed from native runtime attachment plus qualifying evidence; it is not an editorial toggle.
Security sectionsControls
Security & Assurance
Security controls and claims
Public controls stay visible when blocked, stale or unconfigured; verified claims remain fail-closed.
SEC-ADV-001
StaleIndependent advisory publication
Only approved immutable advisory revisions can become public.
- Last verified
- 2026-09-10T18:23:04Z
- Version
xps.security.center.r01.2026-08-06
SEC-AUDIT-001
StaleTransactional audit receipts
Security mutations and their audit records commit or roll back together.
- Last verified
- 2026-09-10T18:23:04Z
- Version
xps.security.center.r01.2026-08-06
SEC-AUTH-001
StaleCapability-gated security operations
HTTP and domain service layers independently enforce report, evidence and governance authority.
- Last verified
- 2026-09-10T18:23:04Z
- Version
xps.security.center.r01.2026-08-06
SEC-COMMS-001
StaleManaged PGP channel
The PGP route is public only when a managed key and fingerprint are configured.
- Last verified
- 2026-10-02T19:44:26Z
- Version
xps.security.center.r01.2026-08-06
SEC-DISC-001
Stalesecurity.txt publication
The well-known security contact record has a future expiry, canonical URL and canonical disclosure policy.
- Last verified
- 2026-10-02T19:44:26Z
- Version
xps.security.center.r01.2026-08-06
SEC-DOC-001
StaleCanonical security documentation
Security documentation is generated from the canonical documentation source and carries publication identity.
- Last verified
- 2026-09-10T18:23:04Z
- Version
xps.security.center.r01.2026-08-06
SEC-EVID-002
StaleCanonical evidence binding
Public security claims bind to normalized evidence registry entries without exposing restricted report evidence.
- Last verified
- 2026-09-10T18:23:04Z
- Version
xps.security.center.r01.2026-08-06
SEC-EVID-001
StaleProtected evidence channel
File evidence is admitted only when scanning, quarantine, AES-GCM and restricted storage are all available.
- Last verified
- 2026-10-02T19:44:26Z
- Version
xps.security.center.r01.2026-08-06
SEC-INTAKE-001
StaleAnonymous text reporting
A report can be submitted without an account and receives an immutable receipt.
- Last verified
- 2026-09-10T18:23:04Z
- Version
xps.security.center.r01.2026-08-06
SEC-POL-001
StaleRuntime disclosure policy
The public disclosure policy is projected from the running security domain.
- Last verified
- 2026-09-10T18:23:04Z
- Version
xps.security.center.r01.2026-08-06
SEC-LIFE-001
StaleIdempotent report commands
Intake and state-changing commands reject payload conflicts and safe retries do not duplicate work.
- Last verified
- 2026-09-10T18:23:04Z
- Version
xps.security.center.r01.2026-08-06
SEC-FOLLOW-001
StaleBound follow-up session
A report reference and secret are exchanged for a short-lived HttpOnly session with CSRF binding.
- Last verified
- 2026-09-10T18:23:04Z
- Version
xps.security.center.r01.2026-08-06
Verified public claims
Security administration is capability-gated at HTTP and domain boundaries.
Draft and unapproved advisories are not public.
Security reports can be submitted without an account.
A failed audit write prevents the associated security mutation.
Reporter follow-up uses a short-lived server session rather than browser storage or URL secrets.
Public evidence projections expose receipts and freshness, never raw restricted report evidence.
Security documentation is generated from one canonical multilingual revision set.
security.txt points to the canonical disclosure policy and has a future expiry.