The validation chamber. "Secure" is earned here, artifact by artifact, on evidence you can re-run yourself — never asserted by a page. Don't trust the seal: press the part yourself.
The build-admission decider: may this build be admitted to the factory queue? Six boolean facts in, one verdict out. The judgement is a proven SPARK conjunction (Build_Admission_Pkg.May_Build) with no other path to admission; this front is its forged argv shell. Every admission the portal ever makes crosses this exact binary.
Binary: wired (named by BUILD_ADMISSION_DECIDER)
Theorems carried by the proven core:
The credit-grant decider: may this grant be made? Each grant kind carries exactly one form of evidence — a purchase grants on a validated receipt, a discretionary grant on an authorised operator, an achievement on a server-side attestation — and evidence that has ever granted, on any membership, never grants again. The judgement is the proven Credit_Grant_Pkg.May_Grant; this front is its forged argv shell, and it is the only door credit enters any account by.
Binary: wired (named by CREDIT_GRANT_DECIDER)
Theorems carried by the proven core:
The credit-spend decider: may this spend proceed? Never in arrears, never beyond the balance, and never beyond the remaining refund-window velocity allowance — so the worst-case fraud loss inside the window is a known number by construction, not a convention. The judgement is the proven Credit_Grant_Pkg.May_Spend; this front is its forged argv shell. Nothing in the portal consumes it yet — that gap is stated on its note, not papered over.
Binary: wired (named by CREDIT_SPEND_DECIDER)
Theorems carried by the proven core:
Examination proves the door held (your admission facts, each with its source named — see your account page for the link). Testing proves the behaviour holds (the truth table, live, re-runnable). Fitting proves it still holds in YOUR environment — that bench ships last, and until then says so rather than pretending.