What Mirror is#
- The problem. In trade-based money laundering, one bank sees the invoice and another sees the payment or the customs entry, and neither sees the other's.
- What Mirror does. Each bank bands its own figure into a price band inside its own walls and sends only a salted commitment. An operator compares the commitments and signs one of three verdicts:
- reconciled, which needs an independent witness, such as a terminal's weight or an assayer's grade;
- divergent;
- undetermined, with the reason.
- What never reaches the operator: no value, no band, no customer, and no filing decision.
What it cannot do: the contract#
/cannot (signed at GET /cannot) lists 39 refusals. Each names the code that enforces it and the test that pins it. None can be removed or weakened within a major version without the build failing. The ones a supervisor asks about first:
- no filing decision, anywhere (
filing_decision,filing_in_record); - no score, rating or percentile (
risk_score,member_ranking); - no clear on the stakeholders' word alone (
stakeholder_only_clear); - no custody and no settlement (
custody,settlement_instruction).
How to check it yourself, offline#
- Take any signed verdict a bank shows you, and the operator's keys from
/jwks. - Verify the ES256 signature over the record's canonical JSON (SPEC §8.2), with the published verifier or your own code.
- Check that the verdict is in the operator's append-only log:
/anchor/headand/anchor/consistency. Members compare the heads they were shown (/anchor/gossip), so a split view becomes a provable fork. - Reproduce the arithmetic: the conformance vectors and the verdict certificate, in which every configuration of the verdict rule is checked.
The supervisor seat#
/supervisor/feed gives read access to what a regulator watches, across the corridors of the banks it supervises. /supervise and /supervise/crosscheck let a supervisor test the rail with its own inputs. /dossier is the model-validation dossier.
Known limits, stated#
- The boundary register: each limit and its upgrade path.
- The typology map: what is caught and what is not.
- The stability policy: what is frozen and what is experimental.
- A missing proof. No zero-knowledge proof yet links a label to its value at verdict time. It is commissioned; today the link is proven when a record is opened.
- No certifications. No external audit, penetration test or certification is held or claimed.
Who operates it#
A single maintainer operates the demonstration operator. No pilot bank, customs administration, terminal or data partner is connected today. That is stated on the site and in this pack, and it will be updated only when it changes.