What a passport proves, and what it does not

The passport is the page a run hands to the people who decide: a model risk validator, a vendor risk reviewer, a buyer. It is one self contained HTML file, with no scripts and no network, that prints to PDF from any browser. It is written from a sealed record and changes nothing in it.

What is inside

1. Identity: the system, its version and model ids, the code and data digests, the run, the commitment and its nonce, the seed, the engine and its digest.
2. Verdict board: one row per check, its status as a word and an icon, never colour alone, the bound, the committed limit, and for a row that is not a pass, why, and how far it is from changing.
3. What was tested: the families and their sizes, the logins asked as, and the access oracle with its digest.
4. Findings: each FAIL and INCONCLUSIVE in plain words, with its smallest example and what to do.
5. Coverage and limits: what each family can and cannot see.
6. Regulatory crosswalk: withheld until its headings are checked word for word against the regulator's own text.
7. Verification: the seal, the signature, the record digest, the replay command, and a statistics appendix with every exact bound, its counts and the formula.
8. History: every earlier run given, its verdict and commitment, and the checks that changed since, so failed and abandoned runs show too.

What a reader can check

Verify a passport in Studio, or offline from the file. Each row answers one question:

• The seal: no byte of the record changed since it was signed, including questions, outcomes, bounds and verdict. A changed record draws a different seal.
• The signature: the issuer's key signed it, checked only against a key the reader pinned. A key you did not pin cannot pass, even if it is real.
• The record digest: the record hashes to the digest the seal states.
• Replay: everything needed to recompute the verdict offline is in the file. Replaying recomputes the grading; it does not ask the system again.

What it does not prove

• It says nothing about who holds the file now.
• It does not show replies a hosted run never kept: those are kept only as keyed digests.
• A PASS covers the questions in the plan, on the version that was tested, at that time. A new version, or a model that changed behind an unchanged identifier, needs a new run.
• A seal made with a shared secret is not a signature, and the passport says so.
• A preview passport is not sealed. It carries a watermark, and the reader has no seal to verify.
• It is not a new grade and not an approval. The verdict and bounds are copied from the record, and no one but the reader decides what the evidence is enough for.

What this does not show

• This article describes the format. It does not show that any particular system is safe.
• Offline replay checks the grading of the recorded replies. It cannot check that the recorded replies are what the system said, beyond what the seal and the witnessed log establish.