Plain statements about data, behavior under failure, and measurement. Every claim here traces to a committed document in the repository.
What we store
The evidence bundle that produced each verdict: redacted signal view, verification findings, graph hashes, stage timings, and cost. Hash-chained and immutable.
Keyed HMAC hashes of phone numbers, VPAs, and transaction references for the cross-household threat graph. Raw identifiers never leave the case sandbox.
Guardian decisions and every action as append-only audit entries with chain hashes.
Retention: evidence bundles and audit records 400 days, then gone.
What we never store
Raw forwarded message text beyond the redacted view the bundle needs.
Reversible identifiers anywhere in the graph: hashes are keyed, never reversible without the KMS-held salt.
Personal data in logs: every log line passes a scrubber, and CI plants canary strings to prove it.
Any payment credential, ever. The system recommends; it never moves money and never sends messages as a human.
How it behaves when things break
Every dependency failure produces a named degraded mode that is disclosed on the case, never a silent pass.
Lost verification forces needs-human rather than a quiet safe verdict.
A hardcoded canary appearing anywhere outbound is a critical injection alarm.
Spend is metered per call with hard breaker caps: overrun becomes an explicit reduced mode, not a surprise bill.
How we measure ourselves
Precision, recall, and false-gate rate published with Wilson confidence intervals on a fixed dev split.
A sealed 120-case hold-out opens exactly once before release; its numbers go in the README beside limitations.
Failure taxonomy written from real misses, including the uncomfortable ones.
Weekly soak reports from real households while the pilot runs.