One person built this. The record does not depend on him.
The evidence format is published. Your auditor builds the verifier from source and runs it on a machine you control, so records you hold verify with NOMARK absent from the room. The company behind them is pre-revenue, with no customers to name. Below are the design-partner terms, in the words of the signed brief.
01, docs/design-partner-kit/brief.md
How far along this actually is.
NOMARK is pre-revenue. There are no customers to name, no case studies, no certifications held, and no logos anywhere on this site. No price is published either, because none has been set.
The company is looking for three design partners. What that means in practice is below, in the terms of the signed brief.
02, standards/policy-packs/packs/apra-cps/sources/cps-230.txt, para 35(c), retrieved 2026-08-03
The background, and the part left blank.
NOMARK is Reece Frazier, working alone. The background is fund administration in regulated financial services, which is the operation CPS 230 names as critical for an RSE licensee.
No years, no firms and no titles are published here. They are not settled facts in this repository.
One person is survivable here for one reason.
You would be relying on a record format and a verifier you already hold, not on a company. Nothing in the record depends on NOMARK still existing.
The licence and the verifier that make that true are set out in full. The verification exercise is how you check it on your own machine.
04, docs/design-partner-kit/brief.md
What a design partner gets.
- The open protocol and the independent verifier
- Verification needs stream files and a public keyring, not a NOMARK service. The verifier is a separate implementation you build from source.
- The reference workload
- A deterministic agent reads a declared fixture pack and proposes a recommendation. Then it attempts an unauthorised production approval. A declared deny rule stops it before the protected tool is called. It receives a scoped draft-only grant instead, and creates one draft.
- A countersigned evidence bundle
- The collector verifies emitter signatures and sequence continuity, appends the stream, and adds a distinct countersignature over the emitter hash.
- Negative evidence
- The same campaign ships streams the independent verifier must refuse: tampered, sequence-gap and forged-attestation variants. A negative stream that verifies is a failed run.
- The policy-pack and assessment material
- Every unknown stays visible, and draft regulatory provenance is never presented as verified.
05, docs/design-partner-kit/brief.md
What NOMARK asks for.
- A named sponsor and a named assurance contact
- One executive sponsor, and the auditor or assurance lead who would run the check.
- Access to the control library, or the subset in scope
- So that success is expressed in your controls rather than in our vocabulary. There is no worldview to adopt.
- One agent workload, and an explicit instrumentation boundary
- Named in advance, so what is observed and what is not are both on the record.
- A written continue-or-stop verdict at the end of week four
- Stopping with reasons is a result. It is more useful to us than a soft continuation.
- Permission, granted or withheld, before you are named
- Nothing about your operation reaches a website, a repository or a pitch without it. Withholding it costs you nothing here.
NOMARK asks for no production credentials and assumes no data egress. Any telemetry leaving your environment would need a separate, scoped, written grant.
06, docs/design-partner-kit/brief.md
Four weeks, and a verdict.
| Week | Focus | Ends with |
|---|---|---|
| 1 | Map success criteria to your control library | Gap register read and accepted |
| 2 | Demonstrate live enforcement and denial as evidence | Protected action blocked before tool execution |
| 3 | Independent verification run by your own auditor | Valid stream passes, negative streams fail |
| 4 | Self-service conformance and written verdict | Continue as a paid pilot, or stop with reasons |
Week three is the one that matters. If your own auditor cannot verify the stream without us in the room, the other three weeks were a demonstration.
07, docs/design-partner-kit/brief.md
What the reference campaign does not prove.
The campaign proves specific things about a deterministic reference workload. It proves none of the following, and the kit says so in its own bytes.
- recommendation accuracy
- regulatory compliance
- production safety
- production authority
- external validity
- complete observation outside the instrumented boundary
Every question we cannot answer yet is written down on the assessment register, beside the item that would clear it.
Map the gap before an assessor does.
You leave with a gap map you own, in your own terms, covering the operations you name. It is not a proposal. You keep it whether or not you go further.
45 minutes with your risk or investment operations lead. We walk your CPS 230 critical operations, mark where agents act, and name what evidence exists today.
Email is faster than a calendar link. A short note describing the operation tells us more than a meeting request.