Verifiable compliance warranty

A compliance claim is only worth what a third party can check. A warranty here is a signed statement that specific controls held continuously over a stated window, anchored in a public transparency ledger, and verifiable by any carrier or auditor with stock tools and no account.

Compliance evidence tells you a control was in force. A warranty packages a set of those controls into one signed, time-bounded assertion you can hand to a customer, an insurer, or a carrier, who can confirm it independently rather than take your word. The issuing half needs your key. The verifying half needs nothing.

What a warranty asserts

A warranty is a small, self-describing object. It names the coverage window, the frameworks it spans, and, per control, how many observation periods were seen and how many passed. It only warrants a control that was continuously in force: a pass verdict in every period of the window.

// GET https://whisper.online/api/warranty  (X-API-Key: your partner key): a preview before you issue
{
  "object": "whisper-warranty",
  "preview": true,
  "issuable": false,
  "warranty": {
    "v": 1,
    "tenant": "tc76deaa651427ca97c760ab3302c3e9d",
    "coverage": { "from": 1784530200000, "to": 1784537400000, "periods": 24, "interval_ms": 300000 },
    "frameworks": ["iso27001", "soc2"],
    "posture": { "controls_total": 10, "controls_in_force": 0, "level": "none" },
    "controls": [
      {
        "framework": "soc2",
        "control_id": "CC6.1",
        "title": "Logical access restricted to authorized identities (DANE-pinned per-agent /128)",
        "in_force": false,
        "periods_observed": 24,
        "periods_pass": 0,
        "leaves": []
      }
    ]
  }
}

The tenant is the opaque one-way slug also published in RDAP, never a customer name. Each in-force control lists the ledger leaves that anchor its passing periods, so the warranty points straight at its own evidence.

It refuses to over-claim

Issuance is conservative by construction. Ask to issue when nothing held continuously and you get a clear, actionable error, never a warranty papered over a gap, and never an opaque 500:

// POST https://whisper.online/api/warranty?periods=1&validity_days=90  (X-API-Key)
{
  "error": "insufficient_evidence",
  "detail": "no catalogued control was continuously in force (a pass verdict in every one of the 2 covered periods), so there is nothing to warrant. Review your compliance evidence grid, then re-issue once controls hold continuously."
}

This is the point of the surface: a warranty you can issue is one you could always defend, because the evidence for it already exists in the ledger before the warranty is signed.

Carrier-verify, keyless, end to end

When a control does hold continuously and a warranty is issued, its assertion and its evidence are committed to the same public transparency ledger every Whisper identity and evidence receipt rides. Anyone can then run the full chain keyless. Run it yourself against any anchored statement in the current log (the same machinery a warranty leaf uses); fetch live values rather than trust the ones sketched here, because the tree grows and every proof is relative to a size:

# 1. the statement digest, taken from a receipt URL in the evidence
DIGEST=<statement-digest>

# 2. the signed inclusion receipt (RFC 9162 / SCITT COSE_Sign1)
curl -s -H 'accept: application/cose' https://whisper.online/entries/$DIGEST
#   HTTP 200, Content-Type: application/cose
#   issuer "whisper.online/ledger/g2", subject (leaf hash) <leaf-hash>
#   embedded proof: tree_size <N>, leaf_index <i>

# 3. the same proof as JSON
curl -s "https://whisper.online/inclusion?leaf=<i>"
#   { "leaf_hash": "<leaf-hash>", "proof": [ about log2(N) sibling hashes ], "tree_size": <N>, ... }

# 4. the signed checkpoint (C2SP tree head, co-signed by an independent witness)
curl -s https://whisper.online/checkpoint
#   origin whisper.online/ledger/g2, tree size <N>, base64 root, then a signature
#   line for the log and one for markovianprotocol.com/witness

Fold the leaf hash up the audit path with a stock RFC 6962 verifier, using no Whisper code, and the result must equal the root the log and the witness both signed:

leaf <leaf-hash>  folded up about log2(N) siblings
   -> <recomputed root, hex>
checkpoint root (base64 line, decoded to hex)
   == <recomputed root, hex>       # equal, at the size the log and witness both signed

A match proves the warranted statement is in the tree that two independent parties signed, at the size they signed. Nothing in the chain asks you to trust Whisper's word, and nothing in it maps a leaf back to an address or an owner.

Two tiers, by design

• Issue with your partner key: the control plane assembles the warranty from evidence already in the ledger and refuses to issue past a gap.
• Verify with no key at all: the carrier, insurer, or auditor confirms the signature and the inclusion proof against the public ledger and its independent witness.

Next: Compliance evidence the control grid a warranty draws from · Transparency log the append-only ledger and its witness · Verify an agent the same keyless chain for a /128 identity.