QR Trust PoC documentation¶
This documentation explains the research boundary, verifier semantics, implementation, evidence, and operating paths for the QR Trust PoC.
Important
The repository demonstrates controlled decision semantics. It does not establish a production trust authority, universal standard, field detection rate, or user-comprehension result.
Start by role¶
| Reader | Recommended path |
|---|---|
| Professor or researcher | Project overview → published paper and citation → evaluation |
| Security or protocol engineer | Trust layers → security requirements → scanner decisions |
| Application developer | Run guide → verifier profile → test vectors |
| Platform or infrastructure engineer | Network architecture → network contracts → evidence |
| Contributor or reviewer | Contributing → public checklist → release-candidate status |
Project orientation¶
- Project overview — problem statement, architecture, service catalog, resource estimates, and supported workflows.
- Published paper and citation — current SSRN paper, preferred citation, DOI, and BibTeX.
- Run guide — environment setup, Compose profiles, frontend, backend, network, and iOS commands.
- Open-source direction — public scope and contribution direction.
- Public PoC companion plan — preparation guide for a paper-companion repository surface; not a release commitment.
Trust and decision semantics¶
- Trust model — high-level managed-trust architecture.
- Trust layers — artifact, cryptographic, issuer, destination, and runtime-safety questions.
- Trust tiers — assurance categories and their limits.
- Enrollment and consent — issuer enrollment and monitoring boundaries.
- Verifier profile — current verifier contract.
- Scanner decision matrix — evidence-to- decision mapping.
- Scanner UX states — user-visible green, orange, and red behavior.
- Short-URL and redirect policy — resolver and final-destination handling.
- Security requirements — stable requirements derived from adversarial review.
- Failure modes — ecosystem, governance, privacy, and adoption pressure tests.
Implementation and architecture¶
- Network architecture — reference topology and service responsibilities.
- Network contracts — schemas, example events, cache entries, scanner decisions, and operator evidence.
- Governance artifacts — non-normative examples used by the PoC.
- iOS end-user design — native scanner boundary and UX direction.
- iOS enterprise readiness — deployment constraints for managed-device use.
Evaluation and evidence¶
- Trust-residual evaluation — controlled corpus, generated results, and claim limits.
- Test vectors — behavior-level verifier cases.
- Browser and device matrix — supported validation surfaces.
- Evidence manifest — what the tracked browser and iPhone artifacts prove.
- iPhone test plan — physical-device procedure.
- Governance fixture bundle — the deterministic demo artifacts the evaluation corpus references.
- iOS provider-profile fixtures — public-safe signed profile for the native import path.
Diagrams¶
- Trust-model graph — document dependency graph; the ASCII reference mirrors the paper's Figure 3.
- Authority flow — governance, publication, and scan-time validation; the ASCII reference mirrors the paper's Figure 2.
- Problem framing — why decoding is not trust; the ASCII reference mirrors the paper's Figure 1.
- Deployment rollout — adoption ordering; the ASCII reference mirrors the paper's Figure 4.
Policies and contribution¶
Local documentation server¶
From the repository root:
Open http://127.0.0.1:8088/. The maintainer target builds a filtered static site before serving it, so excluded paper-development and local-only material is not exposed by the documentation server.