Identity custody
The Identity Record carries signing custody. The application uses usable signing material on the device and retains protected local records. Protect the original Record, its required phrase and the unlocked device. Encryption at rest does not make an unlocked, compromised runtime trustworthy.
Verify the source
Check original bytes, signatures, schema, participants, value and predecessor relationships. Presentation metadata supports discovery but cannot override a failed original. An unknown proof format must not receive a universal verified label.
Replay and rollback
Once-only connected consumption and qualified offline protected state address different environments. A copied file, local clock or synced passkey cannot establish irreversible consumption alone. Continuous offline custody needs the actual protected operation and admissible evidence, not a weaker substitution.
Recovery without invention
Lost replies leave uncertain outcomes. Retain the exact attempt and recover its existing result. Never infer success from a spinner ending or failure from a timeout. Keep unknown financial state intact until its supported recovery determines the outcome.
Assessment scope
Reference checks establish the properties they actually exercise. They do not prove production configuration, device security or every external claim. Publish the exact version and assessed capability. Treat unassessed behavior as unassessed rather than implying certification.
Method, sources and assessment
This explanation describes the supported implementation. Exact protocol requirements come from the pinned Receiz contracts and original sources. A reference result does not qualify a production deployment or a physical device.