What QubiTrust does and does not do

Purpose

Know, before the first meeting, what the product will stand behind and what it will refuse to claim. Everything below is enforced in the codebase, not a promise in a slide.

The five invariants

1. Only the deterministic engine scores. Scores come from the frontier, FAIR and capital modules — seeded, no clock reads, byte-identical on the same inputs. No screen, no import and no human writes a score directly; saving an assessment writes your inputs and the engine recomputes from them.
2. No AI or LLM touches customer data. There is none in the product path. If someone asks whether an assistant drafted a figure: no, and there is nothing in the repository that could.
3. Connectors are read-only. Every adapter is GET-only, SSRF-guarded, scoped to hosts under the listed domains and hard-timed-out, and degrades to zero rows rather than throwing into a scan. The TLS probe completes handshakes and sends no request; the SSH probe reads the pre-auth key-exchange offer and never authenticates; the mail probe says only EHLO, STARTTLS and QUIT — it never sends mail or logs in.
4. Tenant isolation is forced at the database. The application connects as a de-privileged role, so row-level security fails closed outside an organisation scope. The activity log is append-only and hash-chained, and you can re-verify the chain from the screen.
5. Every displayed figure carries value, formula and provenance. Mock, benchmark and typed figures are always labelled. See the badge vocabulary on the method index.

What it does not do

• No agents, no credentials on endpoints. Nothing is installed in the customer estate.
• No probing beyond what a browser or a mail server does. Outside-in evidence is Certificate Transparency records plus TLS handshakes, DNS and the certificate the host presents, on a fixed list of ports (:443, :22, and the four mail ports on mail hosts under the listed domains). No port sweeps, no vulnerability scanning, no authentication attempts. Open ports and outdated software appear only when Shodan or Censys — configured with keys — reported them.
• No guessing. A host the scan did not see this cycle is reported as not observed, never as decommissioned. A certificate whose algorithm the parser could not read is unknown, never a default. A business process that is not in the tenant's sector pack is left unattached rather than inferred from a host name.
• No conversion of benchmark money. Seeded magnitudes stay in the pack's currency until an analyst calibrates them, and say so on the row.

Who does what

The Analyst Console and the Assessment workspace share one gate, so a role that reaches one reaches the other. Two panels write more than the console's evidence verbs and render read-only for an assessor instead of offering a control that can only fail.

Common failures

• Someone expects a vulnerability report. Say what the evidence is: certificates, algorithms, key exchange, expiry, issuer concentration. It is a cryptographic inventory and an exposure model, not a pen test.
• Someone asks for a number the estate cannot support. The honest answer is the empty badge and the next step that would fill it — not an estimate.

Next: Day 0 stand-up

All steps: Analyst method