Records you hold verify without us.
Not because of a promise about the company. The wire protocol is published, the conformance vectors ship with it, and the verifier is a separate implementation in Go that you build from source. Test it before you sign anything.
01, packages/protocol/vectors, 30 conformance vectors, 21 valid and 9 invalid
What you would still hold if NOMARK stopped tomorrow.
The wire protocol is published at version nep/1.1. Its conformance vectors publish with it, 21 valid and 9 invalid. The verifier is a separate implementation in Go, and you build it from source on a machine you control. Verification needs stream files and a public keyring. It does not need a NOMARK service.
Records you hold today verify offline on your own machines whether or not NOMARK is reachable, funded, or in business. Nothing in the record depends on NOMARK still existing.
That is not a continuity commitment, and it is deliberately not written as one. It is what the licence and the architecture already make true. The verification exercise is how you check it.
02, packages/protocol/LICENSE
What is open, and why it stays open.
The protocol package publishes under Apache License 2.0. Not generosity, and not a growth tactic: a verifier a customer cannot build from source verifies nothing.
The open layer is not a trial. It does not expire. It is what makes the assurance claim testable, so closing it later would destroy the only property worth buying. The protocol is here, with its vector corpus and the categories an invalid record can fall into.
What you pay for.
You buy certification: an audit against the standard, and a signed attestation that a given instrumentation conforms.
The verifier can prove a record is intact. It cannot issue an attestation and it cannot be accountable for one. That difference is why the open layer can stay open.
04, standards/attestations/listings.json
Today it is a person and a signature.
Certification today is a manual audit and a signed attestation. There is no automated issuance and no self-service path to one.
The registry that would list an attestation is specified and not built. It lists nothing, and it lists nothing because none has been issued, not because results are being withheld.
The register names the fields a listing would carry.
05, docs/vendor-assessment/security-addendum.md:25-25
You are still buying from one person.
NOMARK is one person, pre-revenue, with no customers to name and no certifications held. Each of those is answered on the assessment register.
What that changes is who can sign an attestation. It does not change whether a record holds. The verifier runs from source on your machine, against a corpus you can read, with no call back to us.
Neither the vendor's TypeScript implementation nor the Go verifier is the reference for the other; both are validated against shared, versioned conformance vectors including nine categories of deliberately invalid streams
Map the gap before an assessor does.
You leave with a gap map you own, in your own terms, covering the operations you name. It is not a proposal. You keep it whether or not you go further.
45 minutes with your risk or investment operations lead. We walk your CPS 230 critical operations, mark where agents act, and name what evidence exists today.
Email is faster than a calendar link. A short note describing the operation tells us more than a meeting request.