Mirror
Who it’s for
Banks and trade-finance headsThe five-minute brief: what it does, what it refuses, what it costs, where it stands.Supervisors and FIUsThe macro ledger: corridor divergence, measured from signed verdicts.Examiners and auditorsOne signed record, and the checks you run with the network unplugged.EngineersThe operator API, the SDKs and the conformance vectors.Every documentThe protocol, procurement and operations library, in reading order.
ConsoleStart a pilot
For examiners & internal audit

One signed record. Three checks you run with the network unplugged.

What a supervisor or an internal auditor receives from Mirror is not a dashboard login and not a risk score. It is a single ES256-signed verdict you verify offline — and a record built to refuse a filing decision or a risk score even when it is validly signed. This page runs the real verification kernel in your browser; nothing here calls a server.

The verdict, as receivedbuilding a real signed record…
…
Run the checks yourself
·
Ready
Press “Verify offline” to check the signature in your own browser.

What the operator never saw

  • ×the price — only a salted hash of the band
  • ×the quantity or amount
  • ×the buyer or seller name
  • ×the invoice or LC number — only an opaque locator
  • ×the corridor price table as anything but a commitment

The record above carries a corridor commitment and the disclaiming boundary in its own words, never a value. There is no plaintext to seize under subpoena, and no operator route that escrows or recovers a shared secret. This is a fact about the bytes, checkable here.

The moat, in one interaction

A valid signature is necessary. It is not sufficient.

CHECK 1

It verifies

ES256 over the record as canonical JSON, checked against the published key by kid. No database, no network — the whole point of an offline record.

CHECK 2

Tampering breaks it

Flip the verdict from divergent to reconciled — the most consequential forgery — and the signature stops verifying. A single altered character is enough.

CHECK 3

A forbidden field is refused

Plant a risk_score and re-sign it with a real key. The signature is genuine — and a conformant verifier refuses it anyway. Mirror cannot hold a risk score or a filing decision, and the examiner checks that, not the operator’s word.

Every claim on this rail is a test you can run.
The full conformance suite runs with one command — node kernel/test.js — and the sha256 of every test file it executes is published at /conformance-suite.json, so you can confirm you ran the whole suite, not a subset chosen to pass. Read the enforced refusals on the cannot list.
Open the offline examiner pack Read the boundary register Read the protocol spec The typology map The supervisor pack