Scanner UX States¶

Date: 2026-04-12

Purpose: - define what a scanner should tell the user - avoid overloading all non-green outcomes into one generic warning

Design Goal¶

Users need to distinguish between: - no trust signal - trusted issuer but current problem - actively blocked destination

Meaning: - no trusted issuer enrollment - no recognized trust signal

Suggested UX: - neutral or caution state - show normalized destination - do not imply malware unless there is evidence

Meaning: - signature present and valid - issuer not accepted by the active trust policy

Note: - this state was previously named signed, unknown issuer; the wire label signed_unknown_issuer is retained for compatibility

Suggested UX: - caution state - explain that the QR was signed but not by a recognized issuer

Meaning: - issuer enrolled - signature valid - destination bound correctly - no current runtime safety issue

Suggested UX: - positive trust badge - issuer tier label - destination summary

Meaning: - issuer is trusted - current destination does not match issuer-approved state

Suggested UX: - strong warning - explain that this QR no longer points where the issuer approved

Meaning: - issuer and destination binding are valid - runtime safety engine has current risk concerns

Suggested UX: - caution or block depending on severity - explain that the issuer is known, but the site appears risky now

Meaning: - revoked issuer - malformed signed state - replay/policy failure in a controlled environment - known malicious destination

Suggested UX: - red block state - strong instruction not to proceed

Do not tell users that all unsigned QR codes are malicious.

Tell them: - whether trust is present - whether trust is absent - whether an active failure was detected

That is much more usable.