The assertion path does not take a model's word for it.

The control plane schedules work and records evidence. Repository code runs in the data plane. A broker is the only path between them, so a plan cannot directly reach a credential, host service, or verdict.

Model output is compiled into declarative verification IR and statically validated. A model proposes how to test; an oracle over recorded evidence determines the result.

BASE and HEAD run in separate, disposable sandboxes. Egress is denied unless policy grants a declared destination. The two sides execute the same validated plan so the comparison does not depend on different test logic.

Credentials are resolved and leased at the broker boundary. Server-held tenant secrets do not enter browser bundles, model prompts, logs, or evidence artifacts, and sandbox code receives only the value required for an authorized operation.

Tenant identity is carried through run, claim, evidence, and artifact-reference records. Reads authorize the tenant against the owning run before returning tenant-scoped data; an unknown and a foreign identifier have the same public result.

Evidence and plans are content-addressed, and final manifests bind the digests used to reach a verdict. Replay verifies stored content against those references rather than trusting a later summary.

Missing evidence cannot become a pass. Certus preserves the distinction between a proved failure, an inconclusive run, and a run blocked before it could prove anything.

Send a private report to security@certus.dev. Include the affected surface, impact, and reproducible steps. Do not send live credentials, customer repository content, or exploit data that belongs to another tenant.

We will use the same address for follow-up and coordinated disclosure. Please avoid public issue trackers until the report has been assessed.