scriptrequisition
Proof that the work happened.
Requisition is the authority of record for consequential actions, whoever or whatever takes them: a cryptographically bound, non-repudiable record of who held the authority to sanction the action, re-verified at execution, verifiable by anyone, offline. The record names the rule in force and the witnesses, and a stranger checks it against a published key without asking the institution that produced it.
Requisition is known internally as HolyTrinity.
against the published key
The record is a byproduct of doing the work.
Where the paperwork costs more than the task, the paperwork gets skipped or falsified, and the record becomes the least reliable thing in the building. Requisition makes the proof a product of the act itself. Every approving act is a witness carrying attributes someone can vouch for: identity, qualification, billet, presence at the equipment, time. Each deployment declares an independence predicate per class of action. The gate asks one question: does this witness set satisfy the predicate in force? The receipt records the predicate, the witnesses and the evaluation trace, so a stranger can re-run the decision and reach the same verdict.
This is not a new rule to adopt. Naval aviation already requires an ordered chain: the worker fixes it, a Collateral Duty Inspector checks it, a Quality Assurance Representative checks that, and no one may inspect their own work. Tag-out already requires a second-person check and an authorizing officer. Submarine safety already holds that if there is no objective quality evidence, the work did not happen. Requisition encodes the rules that exist and makes them produce their own proof.
the problem
One failure, in every institution that keeps its own records.
The party who benefits from the record being wrong is the party who controls the record. A sailor signs his own maintenance check. A guard logs his own rounds. An agency decides what its own release contains. An agent reports what it did. The rules requiring a second person already exist and are written down. They are attested by the institution being reviewed, in a form nobody outside can verify.
The Navy has a word for the result. Gundecking: signing off checks that were never performed. It is not laziness. It is what happens when the workload exceeds the time available and the record is the cheapest thing to fake.
where it runs
Four deployments. One rule registry.
These are not four products. They are four configurations of the same mechanism, and the shared failure is the one above: the party who benefits from the record being wrong controls the record.
Shipboard and unit maintenanceNavy 3-M, NAMP, Coast Guard SFLC
the receipt provesWho performed, who inspected, in what order, with what qualification, and that each was at the equipment. The repair is declared before it starts and compared against the equipment's observed state afterward. A check that never opens on schedule is flagged, not merely absent.
does not fixWhether the repair chosen was the right one. It proves the declared outcome was reached; it does not supply engineering judgment about what should have been declared.
ordered([work_complete, cdi_inspect, qar_inspect]) ∧ count_distinct(identity) ≥ 3 ∧ presence(inspector, asset) ≥ L2
Custody of released recordsFOIA, congressional production, court-ordered disclosure
the receipt provesCompleteness and integrity of a set without disclosing its contents. Each withholding emits its own signed record: item, exemption, deciding authority, date. The count of withheld items is checkable even when the items are not.
does not fixWhether the withholding was justified, or whether the right material was collected in the first place. It makes a decision attributable, not correct.
A signed refusal is a first-class record; the system emits receipts for what it declines, not only for what it does.
Detention and custodial careuse of force, medication, welfare checks, grievances
the receipt provesThat a record was not altered after the fact, that the person who signed held the qualification and was where the record says, and that the rounds due on the schedule were walked. Verification does not run through the facility.
does not fixWhether force was justified or care was adequate. It establishes what happened and who is answerable, for people who now have a record they can trust.
Verification is offline, against a published key registry; anyone holding a receipt can check it without the institution's cooperation.
Payment authorizationwhere the primitive is already regulated and proven
the receipt provesApproval bound to the exact bytes and re-verified at execution. An approval that merely describes a transaction can be satisfied while the executed payload differs from the one approved; a bound one cannot.
does not fixFraud where every party is genuine and the transaction is intended. Binding proves what was approved, not that approving it was wise.
The fingerprint is computed at proposal and re-checked at execution; a changed payload fails the binding, not the description.
evidence
Measured, not declared.
HolyTrinity-Benchmark v1.2 (released 3 August 2026, CC BY 4.0) measures one thing: the gap between an agent proposing a policy-violating action and that action producing an unauthorized external effect. Across 73 trials, 61 attacks and 12 controls, the violating action was driven 57 times and produced 0 unauthorized external effects. The 95% confidence interval is [0.0%, 5.9%]. Median governed-action latency was about 19 ms.
The system under test is Requisition, measured at a private commit under its working name; it is not the open-source Trinity agent. v1 is frozen. The numbers describe a superseded build, corrections append and are dated, and a known oracle limitation is disclosed in the repository rather than corrected in place.
Requisition Bench compares Requisition with the Dogwood policy engine across 28 pre-registered scenarios, and every result matched its pre-registered prediction: 14 agree, in 8 Dogwood allows what Requisition refuses, and in 6 Dogwood denies what Requisition allows. The centre of the report is what happens when the world changes between approval and execution: when an approver's standing is revoked or a plane-wide hold engages, Requisition re-checks at execution and refuses, while a trace-replay engine judges only the events it was given. Counts only, on a small set, under a policy pack Script Kitty wrote. Since v0.2.0 every row carries a signed receipt chain a reader verifies offline with the published verifier.
Verify a receipt yourself.
Two standalone verifiers are published, one in Elixir and one in dependency-free Python, and they must never disagree. Both read the receipt, the signed bytes and the published key registry, and exit with a defined code. Receipts from the production instance verify with the published verifier.
| Code | Meaning |
|---|---|
0 | verified |
1 | invalid |
2 | usage error |
5 | trust not established |
6 | compromised key |
From receipt-verification/verifier/README.md at tag receipt-verification-r4:
elixir verify_receipt.exs --receipt RECEIPT.json --registry REGISTRY.json
python3 verify_receipt.py --receipt RECEIPT.json --registry REGISTRY.jsonSupply a registry obtained independently of the receipt. To check a real receipt, the registry is keys/registry.json; verifier/corpus/registry.json is a test fixture. Given no registry, the verifier refuses and exits 5.
deployment posture
The questions a program office asks second, answered first.
- Device
- Government-furnished, managed, with derived credentials on the device. No personal devices, no unmanaged storage. Media stays in the managed store; the record holds only its hash, so anything later determined to be controlled can be purged without breaking the chain.
- Signatures
- Two signatures, two jobs. The witness's identity signature answers who, and chains to department PKI. The chain signature answers whether anything was altered, and verifies offline against a published registry. The algorithm is a recorded field, so a national security system runs a suite-approved cipher without a redesign.
- Disconnected
- Every device keeps its own signed chain and never rewrites it. Chains merge on reconnection with inclusion and consistency proofs. Ordering is logical rather than clock-based, so a ship under emission control produces a record that reconciles without a server and verifies without trusting one.
- Borders
- A verdict can cross a jurisdiction while the data stays home. Relay receipts carry the result and its depth, never the payload.
- Configuration
- A unit configures its own rules without writing code. A proposed rule is checked before it takes effect: satisfiable, sourced, reachable given the actual roster, and no looser than the rule it replaces. Emergency authority is a declared path with a signed record of who invoked it and a required reconstitution afterward.
- Accreditation
- Containerized for a software factory with continuous authority to operate, targeting the impact level that controlled unclassified maintenance data requires. Simulation establishes what the plane does on a class of action; hosting, registries and attestation are stated per environment.
What it does not do.
It does not make judgments correct. Discretion, whether an emergency waiver, a departure from specification, or "as the commanding officer sees fit", is recorded as a decision by someone with the authority to make it, bound to the bytes, with a reason. The system never evaluates the judgment.
Two signatures do not stop rubber-stamping. The clinical literature is blunt that an independent double check is a weak safeguard when it is the only one. What deters falsification is comparing the claimed outcome against the observed state afterward.
Presence is graded, not absolute. A static code on a piece of equipment can be photographed and replayed. That is evidence, not proof, and the receipt says which level it holds. An action requiring more than an asset can attest is refused with the gap named.
Private tier. The papers, the benchmarks and the receipt verifiers are public; Requisition itself is licensed. A private tier carries the full specification, written for defense, healthcare and other high-sensitivity environments and configured downward by a declared posture. It, and the fielded scope and accreditation status for a given environment, are described to qualified program offices in a briefing.
Licensing.
Requisition is licensed from Script Kitty OS & Labs. Patent pending. Sudo Apt Holdings owns the intellectual property.