# HXP-003 — Open Verification and Trust Roots

Status: Candidate Standard 0.1

## Independent signals

The verifier reports credential integrity, issuer authority, evidence-root integrity, intrinsic-object correspondence, token-envelope integrity, optical-PUF correspondence, attachment continuity, offline freshness, custody proof, and registry state separately. It must not replace these with a generic `authentic` boolean.

`verified-under-profile` is permitted only when every signal required by the named profile passes. `rejected` is returned for an invalid signature, wrong evidence root, optical no-match, broken required continuity, revoked registry record, or policy mismatch. Missing, low-quality, stale, or out-of-envelope observations return `indeterminate`.

## Offline operation

Package and token signatures, evidence-root recomputation, inventory validation, and commissioning-state checks can run offline. Root trust requires a root pinned outside the presented object. Fresh revocation, recovery, and custody require an online observation and are never implied by an old checkpoint.

## Open surface

The schemas, signing domains, deterministic encoding, trust behavior, observation inputs, thresholds, result vocabulary, reference verifier, and conformance vectors are public. Issuance infrastructure, optical inverse design, exposure recipes, calibration secrets, vendor controls, and manufacturing economics are outside the open surface.