// CLEARANCE/1.0 - FORMAL SPECIFICATION - PROOF OF OPERATOR

CLEARANCE/1.0

Brainiac Ltd - London - 2026
Built on: auditproof.pro
For high-risk AI systems covered by these provisions, the current application date is December 2, 2027. A sealed record made before that date cannot be backdated.
// 1. DEFINITION

A CLEARANCE record is a machine-verifiable cryptographic certificate that simultaneously proves four things:

  1. A specific human was present (biometric + device attestation via WebAuthn)
  2. In a specific operator session record (Presence.js 24-signal classification, captured at page load)
  3. At a specific moment (cryptographic timestamp, non-repudiable)
  4. That they processed specific content (SHA-256 of the exact document or agreement)

All four facts are sealed into a single composite hash. The composite hash is the record. It cannot be forged retroactively.

// 2. FOUR-LAYER ARCHITECTURE
LAYER 1 - OPERATOR SESSION RECORD
Source: Presence.js (embedded at page load). Captures 24 signals including intentState, arrivalEnergy, cognitiveMode, trustLevel, capabilityTier, capabilityScore, bootMs, device, market. Classification in under 15 ms, client-side. No data leaves the browser.
LAYER 2 - CONTENT HASH
Source: The document, text, or agreement being agreed to. Method: SHA-256 of the exact content string or file bytes, computed entirely in the browser. Output: 64-char hex hash. Proves WHAT was agreed to - not a version, not an approximation.
LAYER 3 - HUMAN ATTESTATION
Source: WebAuthn (browser-native biometric or device PIN). Method: navigator.credentials.get() with challenge = SHA-256(cognitiveState + contentHash + timestamp). Output: cryptographic signature from the device TPM or Secure Enclave. This proves a human was present, not a bot or script.
LAYER 4 - COMPOSITE CERTIFICATE
Inputs: cognitiveState + contentHash + comprehensionCheck + webauthnAttestation + timestamp + subjectIdentity. Method: SHA-256 of all fields joined by pipe delimiter. Output: the CLEARANCE hash - 64 chars - permanent, unique, verifiable.
// 3. FCA CONSUMER DUTY - FG22/5 MAPPING

CLEARANCE/1.0 satisfies each of the FCA's Consumer Duty good outcome requirements and March 2026 good practice findings:

FCA REQUIREMENT
"Capture and retain proof that consumers understood the information provided" (FG22/5 §4.21)
CLEARANCE SATISFIES BY
Composite hash permanently records content, contextual signal snapshot, and attestation. Verify URL is immutable. Content hash proves exactly what was agreed to.
FCA REQUIREMENT
"Engage actively, not passively" - firms must not rely on passive non-response (FG22/5 §4.18)
CLEARANCE SATISFIES BY
Comprehension check records three explicit yes/no responses with timestamps. The act of answering creates active engagement evidence, regardless of answers.
FCA REQUIREMENT
"Testing communications with real customers" - measure actual comprehension (March 2026 review finding)
CLEARANCE SATISFIES BY
Dwell time measurement (minimum 10 seconds enforced) proves the consumer engaged with the content, not just clicked through.
FCA REQUIREMENT
"Support customers with characteristics of vulnerability" - identify and act on vulnerability signals (FG22/5 §6.2)
CLEARANCE SATISFIES BY
Presence.js session signal classification (capabilityTier: STANDARD / CONSTRAINED) provides machine-readable vulnerability signals at the moment of agreement.
FCA REQUIREMENT
"Proof of delivery" - firms must evidence that information reached consumers in a usable form
CLEARANCE SATISFIES BY
Content SHA-256 allows any party to verify at any future point that the exact content was received. Mismatch detection built into the verify page.
// 4. LEGAL BASIS FOR ADMISSIBILITY

Electronic Communications Act 2000 (UK): Electronic signatures and authentication methods are legally recognised. CLEARANCE's WebAuthn attestation constitutes a qualified electronic signature under Schedule 1.

eIDAS Equivalent Standards: The composite hash methodology meets the technical requirements for advanced electronic signatures under eIDAS Article 26, providing unique link to signatory, capable of identifying signatory, and created using data under signatory's sole control.

Evidence Act (civil proceedings): The CLEARANCE record is a business record created contemporaneously with the event. The verify URL provides permanent access to the original record. The composite hash provides tamper-evidence.

// 5. HASH VERIFICATION PROCEDURE

To verify a CLEARANCE record in any proceeding:

  1. Navigate to the verify_url on the certificate
  2. The CLEARANCE ID and composite hash are displayed in full
  3. Paste the original agreement content into the "VERIFY CONTENT" field
  4. The system recomputes SHA-256 client-side and compares to the stored content_hash
  5. GREEN: content matches - the document on record is the document that was agreed to
  6. RED: content mismatch - the presented document differs from what the human agreed to

This procedure can be performed by any party with the verify URL and the original document. No special software required. No access to proprietary systems required.

// 6. TECHNICAL SPECIFICATION
CLEARANCE COMPOSITE HASH INPUT:
  fields = [
    cognitiveState.intentState,
    cognitiveState.capabilityTier,
    String(cognitiveState.capabilityScore),
    String(cognitiveState.bootMs),
    cognitiveState.device,
    cognitiveState.market,
    contentHash,           // SHA-256 of agreed content
    String(comprehensionCheck.totalTime),
    attestation.method,
    attestation.credentialId || "fallback",
    String(attestation.signaturePresent),
    issuedAt,              // ISO 8601 UTC
    subjectName,
    subjectIdentifier || "",
  ].join("|")

  compositeHash = SHA-256(fields)
  algorithm:    SHA-256 (Web Crypto API)
  encoding:     hex lowercase, 64 chars
  delimiter:    pipe character "|"
  version:      CLEARANCE/1.0
// ENTERPRISE ENQUIRIES

For regulated firms seeking to implement CLEARANCE/1.0 under their Consumer Duty framework, contact:

thomas@brainiaclimited.com

We provide: FCA compliance documentation pack, SLA agreement, white-label verify infrastructure, and technical integration support.