// CLEARANCE/1.0 - FORMAL SPECIFICATION - PROOF OF OPERATOR

CLEARANCE/1.0

Brainiac Ltd - London - 2026

Built on: auditproof.pro

EU AI Act obligations are already in force for covered systems. A sealed record cannot be backdated.

// 1. DEFINITION

A CLEARANCE record is a machine-verifiable cryptographic certificate that simultaneously proves four things:

A specific human was present (biometric + device attestation via WebAuthn)
In a specific operator session record (Presence.js 24-signal classification, captured at page load)
At a specific moment (cryptographic timestamp, non-repudiable)
That they processed specific content (SHA-256 of the exact document or agreement)

All four facts are sealed into a single composite hash. The composite hash is the record. It cannot be forged retroactively.

// 2. FOUR-LAYER ARCHITECTURE

LAYER 1 - OPERATOR SESSION RECORD

Source: Presence.js (embedded at page load). Captures 24 signals including intentState, arrivalEnergy, cognitiveMode, trustLevel, capabilityTier, capabilityScore, bootMs, device, market. Classification in under 15 ms, client-side. No data leaves the browser.

LAYER 2 - CONTENT HASH

Source: The document, text, or agreement being agreed to. Method: SHA-256 of the exact content string or file bytes, computed entirely in the browser. Output: 64-char hex hash. Proves WHAT was agreed to - not a version, not an approximation.

LAYER 3 - HUMAN ATTESTATION

Source: WebAuthn (browser-native biometric or device PIN). Method: navigator.credentials.get() with challenge = SHA-256(operator session signals + contentHash + timestamp). Output: cryptographic signature from the device TPM or Secure Enclave. This proves a human was present, not a bot or script.

LAYER 4 - COMPOSITE CERTIFICATE

Inputs: operator session signals + contentHash + comprehensionCheck + webauthnAttestation + timestamp + subjectIdentity. Method: SHA-256 of all fields joined by pipe delimiter. Output: the CLEARANCE hash - 64 chars - permanent, unique, verifiable.

// 3. LEGAL BASIS

CLEARANCE/1.0 is an evidence format, not a legal opinion. It records what was agreed, when, and by whom. Admissibility is for your counsel to determine.

// 4. HASH VERIFICATION PROCEDURE

To verify a CLEARANCE record in any proceeding:

Navigate to the verify_url on the certificate
The CLEARANCE ID and composite hash are displayed in full
Paste the original agreement content into the "VERIFY CONTENT" field
The system recomputes SHA-256 client-side and compares to the stored content_hash
GREEN: content matches - the document on record is the document that was agreed to
RED: content mismatch - the presented document differs from what the human agreed to

This procedure can be performed by any party with the verify URL and the original document. No special software required. No access to proprietary systems required.

// 5. TECHNICAL SPECIFICATION

CLEARANCE COMPOSITE HASH INPUT:
  fields = [
    cognitiveState.intentState,
    cognitiveState.capabilityTier,
    String(cognitiveState.capabilityScore),
    String(cognitiveState.bootMs),
    cognitiveState.device,
    cognitiveState.market,
    contentHash,           // SHA-256 of agreed content
    String(comprehensionCheck.totalTime),
    attestation.method,
    attestation.credentialId || "fallback",
    String(attestation.signaturePresent),
    issuedAt,              // ISO 8601 UTC
    subjectName,
    subjectIdentifier || "",
  ].join("|")

  compositeHash = SHA-256(fields)
  algorithm:    SHA-256 (Web Crypto API)
  encoding:     hex lowercase, 64 chars
  delimiter:    pipe character "|"
  version:      CLEARANCE/1.0

// ENTERPRISE ENQUIRIES

For regulated firms seeking to implement CLEARANCE/1.0, contact:

thomas@brainiaclimited.com

We provide: SLA agreement, white-label verify infrastructure, and technical integration support.