Open governance, readable by outsiders
++ IF.TTT is a receipt‑first governance layer. It binds a source artifact to an output with a + trace page, stable no‑login links, and optional offline bundles anyone can verify. +
+ ++ We don’t claim “compliance”. We support audits by producing verifiable receipts that third parties can check without your + credentials. +
++ This is the sequence third‑party reviewers actually care about. Every step either produces a receipt, or it doesn’t ship. +
+ +source_sha256.output_sha256 (what the reader sees).trace_id and publish a trace receipt that links hashes, time, and versioning.shareId (trace, dossier, pack, source).This is the “procurement/audit” checklist, stated plainly.
+ +Use the same path your auditors and external reviewers will use.
+ +
+ Every published output gets a stable share surface keyed by a single shareId.
+
https://infrafabric.io/static/trace/<shareId>
+https://infrafabric.io/static/dossier/<shareId>
+https://infrafabric.io/static/dossier/<shareId>/download
+https://infrafabric.io/static/pack/<shareId>.md
+https://infrafabric.io/static/review/<shareId>.md
+https://infrafabric.io/static/marketing/<shareId>.md
+https://infrafabric.io/static/source/<source_sha256>.pdf
+ HTML views exist for sandboxes that load text/html but reject downloads:
+ /static/pack/<shareId>, /static/review/<shareId>, /static/marketing/<shareId>.
+
+ Note: some constrained “web fetchers” reject downloadable binaries (e.g., .tar.gz) while still loading HTML. That’s why
+ HTML views exist for packs and indexes.
+
Download a bundle from the selector, then:
+curl -fsSL -o iftrace.py 'https://infrafabric.io/static/hosted/iftrace.py'
+python3 iftrace.py verify trace_bundle_<id>_standard.tar.gz --expected-sha256 <sha256>+ VERIFIED means the hashes match what the receipt declares. QUANTUM READY may be shown when a + post‑quantum signature receipt exists (PQ verification is additive; hash verification still stands). +
+Same mechanism, different third‑party pressure.
+ +Third party
+Auditors + enterprise procurement
+They want
+Evidence that controls existed at the right time, in the right scope, with receipts.
+IF.TTT helps by
+Publishing no‑login receipts and offline bundles for disputes and audits.
+Third party
+Regulators + model risk + internal audit
+They want
+Non‑repudiation, dispute workflows, and “show your work” provenance.
+IF.TTT helps by
+Binding outputs to sources and creating a defensible, replayable receipt trail.
+Third party
+Compliance + vendors + incident reviewers
+They want
+Clear boundaries: what’s verified, what’s inferred, and what must be reviewed by humans.
+IF.TTT helps by
+Making evidence legible to outsiders while preserving strict, machine‑verifiable receipts.
+Third party
+Assessors + customers + supply‑chain review
+They want
+Offline‑verifiable bundles and unambiguous chain‑of‑custody.
+IF.TTT helps by
+Providing triage bundles that can be verified without trusted network access.
+Third party
+Enterprise buyers + incident responders
+They want
+Provable provenance for outputs (“why did it say that?”) without internal access.
+IF.TTT helps by
+Making trace receipts shareable, replayable, and dispute‑friendly.
+Third party
+Executives + auditors after an incident
+They want
+To verify AI summaries against raw evidence and keep chain‑of‑custody intact.
+IF.TTT helps by
+Binding “what the system said” to “what the system saw” via receipts and bundles.
+Third party
+Customers + auditors + insurers
+They want
+Proof of change control and traceability that survives contractor handoffs.
+IF.TTT helps by
+Standardizing receipts so handoffs remain verifiable across organizational boundaries.
++ “VERIFIED” means the hashes on the trace page match the output/source that can be downloaded and hashed independently. It is an + integrity receipt: the bytes match what the trace declares. +
++ “QUANTUM READY” is shown when a post‑quantum signature receipt exists for the trace. It means PQ receipts are present now (for future + audit requirements). PQ verification is additive; the hash receipt remains valid either way. +
++ No. IF.TTT produces verifiable artifacts that can support audits and disputes. Compliance is a broader program: scope, policy, human + review, and governance decisions are still required. +
+
+ shareId is the public handle used in URLs. trace_id is the chain‑of‑custody UUID recorded in receipts and
+ bundles.
+