OPEN METHOD / EXPLICIT BOUNDARIES

Inspect the method. Understand the deliverable.

A separate educational component demonstrates verification. Review samples explain what a client receives. No internal research-programme implementation is included.

A black electronic unit with cables and indicators on a laboratory bench — VISUAL CONTEXTLocal computing

01 / DA-MODEL-002

A receipt ≠ an external effect.

DA-MODEL-002 is an invented lamp bench. The software accepted a command; whether the lamp switched on is a separate question for an external observer.

01
Command
A request to switch on the indicator.
02
Software receipt
The software accepted the request. The indicator state is not established.
03
External observation
A fresh report from a trusted observer, bound to this command.

Confirmation requires the current command and a fresh trusted observation. Misbound, stale and forged messages are rejected; replay cannot renew freshness.

Executed result for the finite example

reachable states: 106
transitions checked: 1378
sequences of 100 events: 1000
broken variants detected: 4

PASS · Python 3.12.14 · 2026-10-13T04:58:49.960638+00:00

Counterexamples to deliberate faults

receipt_is_effect

request_1 → receipt

wrong_ticket

request_1 → wrong_ticket

stale

request_1 → stale

forged

request_1 → forged

Example and verifier · ZIP ↓Recorded JSON report ↗

Reproduce locally

Python 3.10+ · no external dependencies

python verify.py --report verification.local.json

SHA-256 / ZIP

1ba4989109c73bfb1f16bc0787153e13d4e222a055917b2131b5fc612bae2bff

02 / Review samples

What a client receives.

Two aligned documents for the same invented bench. Identifiers link a trust boundary, a gap, required evidence and a closure criterion.

Trust-boundary map

Boundary	What crosses it	Trust basis / limitation
TB-01 · Client → receiver	A command and its identifier.	A receipt establishes acceptance; it is not evidence of indicator state.
TB-02 · Receiver → environment	An intention to change external state.	Execution and observation are separate; an effect can occur without confirmation.
TB-03 · Observer → assessment	An observation bound to the command.	Source authenticity and measurement accuracy are assumed here. A real system needs separate evidence.
TB-04 · Assessment → interface	A status and observation time.	Display “observed”, time and scope; do not turn a past observation into a current-state guarantee.

Download editable sample · Markdown ↓

Gap register

Gap	Impact and required evidence	Closure criterion
G-01 / TB-03 · High	Observer authenticity is assumed. A trust model, key rules and negative checks are required.	The source is identified; foreign, revoked and forged reports are rejected.
G-02 / TB-03 · High	Abstract freshness is not measured time. Delay bounds, clock uncertainty and expiry behaviour are required.	Expired reports and excessive clock uncertainty cannot produce fresh confirmation.
G-03 / TB-02 · Medium	Recovery and identifier reuse are not modelled. Restart and persistence scenarios are required.	After restart, an old observation cannot be bound to a new command.
G-04 / TB-04 · Medium	A user might read an observation as current truth. An interface sample and status-comprehension review are required.	The interface distinguishes accepted, observed, expired and unknown.

Download editable sample · CSV ↓

All gaps remain open when moving from the model to a real bench. This demonstrates a deliverable format; it is not a client-system review.

03 / Access levels

Agree the scope. Then grant access.

The public page does not unlock confidential material. Each release requires an agreed objective, recipient and conditions.

01 / Public

Purpose, conclusion limits, the invented example and review samples. Research-programme source code is not published.

02 / NDA review

After agreement: recorded verification output, a version identifier and selected redacted materials. A personalized copy carries a unique release marker; no complete source code.

03 / Controlled viewing

An agreed material list, named read-only access, an access expiry and a release log. Confirm the channel and recipient before granting access.

Describe the assessment objective and required outcome.
Agree the NDA, material version and permitted scope.
Confirm the recipient, expiry and viewing channel.
Issue a marked copy and record its hash, scope and expiry in the release log.

A release marker distinguishes copies; it cannot prevent screenshots or transcription. An NDA alone is not technical access control. This site does not provide an automatic confidential-programme repository.

Request a technical review ↗

Contact the researcher directly

1westwestwest@gmail.com

04 / Integrity and provenance

Integrity and provenance

Verifiable hashes and signatures for the available public materials. A signature establishes possession of its key; independent identity verification and independent timestamping are not claimed.

SHA-256 and signature index ↗Index signature ↓Public key ↓

minisign -Vm public-evidence-index.json -p release-key.pub

Download public-evidence-index.json.minisig to the same directory. Retain the public-key fingerprint separately: files and a key from the same site do not create independent trust by themselves.

SHA-256 / public key

df5ad41bb5583bfe18ce84336e5122a5f24fd8c667868e99b7702c393882fa84

Signatures cover the public example, review samples and historical form package. No hashes of private specifications or source for the six programmes are claimed without explicitly selected snapshots. Signature time is the issuer’s clock, not an independent timestamp.