→ The decision rule, in full

Every scored indicator resolves through one ladder, evaluated in order, first match wins. It reads exactly two inputs: scores.confidence (0 to 100) and distinct_source_count, the number of distinct sources reporting the value. One check comes first: a value on the allowlist is never sent to block, whatever its scores. The four records below are chosen so each passes or fails for a different reason.

—

Rule inputs

—

recommended_actionawaiting reveal

scores.confidence—

distinct_source_count—

Talk track & traps

Scores and verdict inputs

as emitted for this record

Severity, freshness and corroboration are computed and returned but do not participate in the verdict. They are advisory to SarraS's decision precisely so they can be decisive in the customer's own routing policy.

If asked about Admiralty

Reliability and credibility are separate axes. A record can carry a well-regarded source and still score low on credibility if the claim itself has not been independently judged. Say that plainly rather than treating the pair as one number.

How credibility is worked out (since 25 September): from the number of distinct sources. Three or more gives 2, two gives 3, one gives 6. It never assigns 1 (confirmed) automatically, because distinct sources are not yet shown to be independent.

→ The signed attribution claim

shown for record 01

Verification does not happen on this page. A signature check run inside a SarraS-authored screen proves nothing. This card exists to hand the claim over. Your engineer runs a verifier containing no SarraS code, on your own machine, and watches it pass and then fail.

The covered fields

read live from signed_fields in the response

The trap in the tamper path

Altering a character only breaks verification if that field sits inside the signed payload. Say "change any of these", never "change anything". The list above comes from the response itself, so it is self-describing rather than asserted.

Tell them the canonicalisation scheme is RFC 8785 JCS. A verifier cannot infer it.

→ What each record proved

fills in as each record is run