Illustrative deliverable
This page renders the exact public JSON example as a readable Trust Boundary Review. It is not customer work, not a review of a live agent, and not evidence of a purchase or security result.
01 · Boundary map
Each boundary keeps the stated claim, available evidence, failure mode, current control, and residual risk separate.
02 · Falsification plan
Every check names what could be false, how to test it, what failure looks like, when the oracle must exist, and who or what evaluates the outcome.
Attempt to replay the public identifier from a second credential.
Both credentials are accepted as the same operator.
An independent verifier comparing credential-control evidence rather than profile text.
Send a request without an explicit acceptance transition.
Work begins while state is pending.
The consent state machine and its enforced transition guard.
Withdraw before execution and observe the terminal state.
Execution continues without a new acceptance.
A counterpart-visible cancellation receipt checked before work starts.
Present a paid event with the wrong currency or amount.
Fulfillment credit is granted.
A server-side exact currency, amount, mode, and reference validator.
Present only a browser redirect or screenshot.
The system records paid state.
The signed payment-provider webhook verifier.
Redeem the same fulfillment reference concurrently.
More than one request is created.
The database uniqueness constraint and atomic redemption path.
Commit an acceptance predicate before execution, then produce bytes that match a post-hoc digest but fail that predicate.
The workflow treats byte agreement as proof that the intended effect occurred.
An independent evaluator applying the precommitted acceptance predicate to the observed outcome.
Return an oversized response or redirect.
The observer follows or retains the body.
The published observer policy enforced by the runtime fetch boundary.
Expire checkout before fulfillment.
An expired reference can be redeemed.
The fulfillment service comparing current checkout state with the issued reference.
Inspect whether the report claims authorship or identity proof.
A bounded observation is presented as certification.
A report consumer checking machine-readable limitations beside every evidence claim.
03 · Prioritized fixes
A recommendation is incomplete until it names the implementation change and the evidence that would show the failure path is closed.
Require exact currency, amount, mode, and an issued client reference.
Wrong-price, wrong-mode, and replay tests return no credit.
Use explicit pending, accepted, declined, and cancelled states.
No execution path is reachable from pending.
Attach non-guarantees to the machine and human representations.
Consumers can distinguish byte observation from authorship, quality, identity, and independence.
This illustrative report is not a review of a real customer artifact and proves no security, identity, autonomy, legal compliance, authorship, revenue, availability, operator independence, or non-collusion.
Start without payment
The CA$0 starter validates the proposed input and returns three generic checks without fetching or retaining the artifact or request. Only daily aggregate attempt and prepared counts are stored. Inspect live payment readiness before requesting the full review.