---

name: certisyn-independent-verification description: >- Independent, third-party verification of what a counterparty claims about itself, established BEFORE an agent commits funds, signs, delegates authority, or admits that counterparty to a deal. Declared coverage today is verification by physical law - vehicle telemetry and orbital node claims - where a finding is arithmetic that can be re-derived rather than an opinion that must be weighed. Use for any reliance on a counterparty assertion, when drafting the verification clause of an agreement, and when assembling or assessing a dispute filing. Returns one of four outcomes, always names what it could not determine, and states the conditions under which its own evidence should be ruled out. license: LicenseRef-Certisyn-Skill-1.0 homepage: https://certisyn.com contact: partners@certisyn.com

Certisyn - independent verification for agent commerce

Most verifiers are built to return a value. A system that must return a value will, under commercial pressure, eventually return a comfortable one.

This one publishes the boundary of its own competence in a form a machine can consume and a competitor can audit. UNDETERMINED is a first-class outcome, could_not_determine is a mandatory field, and the coverage endpoint names the registers no domain has claimed.

Quickstart

# 1. Coverage and declared gaps. No key, no account, no signup.
curl -s https://certisyn.com/api/v1/verification/capability

# 2. Resolve a determination the counterparty handed you.
curl -s https://certisyn.com/api/v1/public/scorecard/{vro_code}

Then decide with the four outcomes below. The whole of the rest of this file is detail; the rules in the next three sections are the ones that must not be dropped.

The four outcomes

Never collapse them into a score.

| Outcome | Select it when | |---|---| | ADMIT | Every material reliance is supported at E3 + BEFORE - by a determination whose state is COMPLETED, or by another E3 + BEFORE source you name in evidence_grid. | | ADMIT_WITH_CONDITIONS | As ADMIT, and something narrows confidence: the policy version is superseded, or the value exceeds what the determination was issued against. Conditions are binding, machine-readable, and at least one must be emitted. | | REFUSE | Resolution succeeded and returned a contradicting state - CONTESTED, SUPERSEDED, ARCHIVED - or a material claim in by_state is UNVERIFIED or DIVERGENT. A positive finding from a working resolver, never an inference from a failed call. | | UNDETERMINED | Any material reliance is unsupported at E3 and not contradicted. Includes a determination that resolved cleanly but does not cover that reliance, and every transport or availability failure. |

Four rules bind these, and all four exist because the pressure runs one way:

• Never upgrade UNDETERMINED to ADMIT.
• Never downgrade UNDETERMINED to ADMIT_WITH_CONDITIONS. Conditions narrow a verified reliance. They do not substitute for one.
• Never infer an adverse finding from a failed call. A code that does not resolve is UNDETERMINED. Only a successful resolution returning a contradicting state is REFUSE.
• Timing floor: a pre-commitment reliance requires BEFORE. E3 + DURING or E3 + AFTER does not satisfy a reliance you are about to act on.

Decision procedure

1. Name the reliance. Write down literally what you are about to rely on. "This node was in the orbit its telemetry claims." "This aircraft flew the track in the log." If you cannot state it in one sentence you do not know what you are exposed to: if a human is present, ask; if you are headless, emit the record with relied_on: ["reliance could not be stated"], name that in could_not_determine, return UNDETERMINED and halt.

2. Classify the best available evidence for each reliance on both axes of the grid below.

3. Apply the floor. A material reliance is any one of: it would change the decision if false; the exposure exceeds what the user has said they will accept losing; or a regulator, counterparty or auditor will later ask who checked. Anything below E3 is unverified. Use the word unverified to the user. Do not launder it into "verified", "trusted", "confirmed", or a numeric score.

4. Resolve or obtain a determination.

• The counterparty already holds one - resolve its code. No credentials, no cost.
• You need the act of checking independently evidenced and billable - pay for anchor verification inline over x402. This does not produce a determination. Nothing does, self-serve.
• The subject needs verifying from scratch - route to intake. Human-supervised, measured in days. Tell the user that.

5. Decide using the four outcomes. 6. Record the reliance in the shape below.

The evidence grid

Apply this to every piece of evidence in any layer, including Certisyn's.

| Level | Source | |---|---| | E0 | Self-asserted. The counterparty's own manifest, well-known file, or signed statement about itself | | E1 | Platform-asserted. The registry, marketplace or chain the counterparty operates on vouching for its own participant | | E2 | Interested third party. A reviewer exposed to which way the answer comes out - paid per favourable outcome, holding equity, or where the subject can vary the policy or suppress the finding | | E3 | Independent. Not exposed to which way the answer comes out - fee fixed in advance and not contingent on outcome, working to a published standard the subject cannot vary, adverse findings issued and not withdrawable by the subject, producing a record another party can replay |

| Timing | Meaning | |---|---| | BEFORE | Established prior to commitment. Can prevent the loss. | | DURING | Produced by execution - runtime attestation, signed receipts, escrow state. Proves what happened. | | AFTER | Produced once a dispute exists - adjudication, arbitration, litigation. Allocates the loss. |

A cryptographic signature is not independence. It proves who said something, not whether it was true; an E0 claim signed perfectly is still E0. A high reputation score is not independence either - open reputation registries can be manipulated at scale, so treat them as E1 signal.

A primary-source public register operated by the authority that grants the thing claimed is E3 + BEFORE - a licensing regulator, a companies registry, a court docket. It is E3 only for the thing it is the register of, and only read from the authority's own endpoint. An aggregator of that register is E2.

Where Certisyn sits, and who pays

Subjects pay Certisyn to be verified. Stating that plainly matters, because payment by the subject is the commonest reason to doubt a verifier and a document that hid it would deserve the doubt.

Payment is not what makes a reviewer E2. Exposure to which way the answer comes out is. The test any relying party should apply to Certisyn, and to every other verifier:

• Is the fee fixed in advance, or contingent on the finding?
• Does the verifier hold equity or a revenue share in the subject?
• Can the subject vary the policy version its determination is judged under?
• Can the subject suppress or withdraw an adverse finding once issued?
• Is the rate at which adverse findings are issued published?

Certisyn's answers to the first four: fees are published at verify.certisyn.com and are not outcome-contingent; no equity or revenue share is held in subjects; the policy version is Certisyn's and the subject cannot vary it; an issued adverse finding cannot be withdrawn by the subject.

The fifth deserves more than an answer, because a verifier publishing an adverse rate it computed about itself is making an E0 claim about an E3 property - the exact error this file exists to prevent. A number like that is also gameable in both directions: take easy engagements and the pass rate flatters, issue trivial adverse findings and the adverse rate flatters, and the denominator belongs to the party being measured.

So the answer is a measurement someone else can check, built so that the party being measured does not choose the denominator. That is the whole difficulty. A verifier grading itself picks which cases, which fault, and how large, and the textbook remedy - an external seeder, a second organisation injecting cases through normal intake - is not available to a company that does not have one. Certisyn removed the choice instead of outsourcing it.

• The decision rule is registered before any case is judged - the acceptance criterion, the ladders, the scoring method, not merely that an engagement exists. Registration of the identifier alone is known not to work; registration carrying the analysis plan is.
• The catalogue is exhaustive. Every point in the registered difficulty space is built and judged before any beacon publishes: four fault families, twelve magnitude rungs each, plus a clean variant, across 60 cases from a Copernicus precise orbit. 2,940 evaluations, every one logged with its verdict. Exhaustiveness is the independence proof - a catalogue containing every point has no free parameter left to tune - and a verifier recomputes the expected point set from the registration alone, before reading a single verdict, and requires an exact match.
• Two independent public beacons pick the headline. drand quicknet and the NIST Randomness Beacon, each committed to a value that had not published at registration. A single beacon operator would be a single point of trust; steering the selection here takes both at once.
• Cases carry independent ground truth from public data. A Copernicus precise orbit at sub-metre accuracy, open, no account. Ground truth means a designated reference record fixed before the case was minted, not the true physical state.
• Registrations, catalogue and scores go into an append-only log, so a published figure cannot be restated later without a third party being able to detect it.
• The floor test. A ladder whose lowest rung is still detected was chosen to flatter. Every ladder must therefore contain rungs the register fails, and the verifier fails the document if any ladder does not. It is the check that costs something to pass.

The transfers are mature prior art in fields that solved this shape long ago: limit of detection from metrology, where a laboratory publishes the level at which its method detects rather than a count of spikes recovered; the method of constant stimuli from psychophysics, where every intensity in a fixed range is presented and the output is a curve; and allocation concealment from clinical trials, where concealment by commitment substitutes for an independent randomisation centre, and where inadequate concealment is measured to exaggerate effect estimates by 30 to 40 percent.

What the register resolves, measured 17 September 2026. Detection rate by fault magnitude, 60 cases per rung:

position_step (m)     1  3  10 30 100 300 | 1k  3k  10k 30k 100k 300k
                      0  0  0  0  0   0   | 28% 77% 92% 98% 100% 100%
                      floor 30 km     highest level still missed 10 km

position_drift (m)    0  0  0  0  0   0   | 20% 67% 85% 98% 100% 100%
                      floor 30 km     highest level still missed 10 km

velocity_step (m/s)   .001 ... 0.3        | 1   3   10  30  100  300
                      all 0                 22% 83% 82% 97% 100% 100%
                      floor 30 m/s    highest level still missed 10 m/s

time_skew (s)         .001 ... 5          | 10   30   60   120  300
                      all 0                 100% 100% 100% 100% 100%
                      floor 10 s      highest level still missed 5 s

clean variants 60, false flags 0, specificity 1.0000 [0.9398, 1.0000]
FLOOR TEST PASS - 4 of 4 families contain rungs the register misses

**Read that as a sp