How Candor works

Candor is split so that no single service can connect a person to a report. Each box is a separate trust domain with its own keys and storage, and the arrows carry only what is written on them.

• Domain: Reporter’s browser

  Holds

  Originals, the name map, K_r and K_a until upload, codename-derived inbox keys

  Never holds

  Anything on a server in plain text

• Domain: Identity service

  Holds

  Per-campaign RSA issuer keys, HMAC nullifier tags, 15-minute sessions

  Never holds

  Reports, evidence, payments, raw proofs, passport data

• Domain: Report API

  Holds

  Ciphertext, sealed key shares, the job queue, the log, the payments ledger

  Never holds

  Plaintext evidence, or any key that can open it

• Domain: Analysis worker

  Holds

  The enclave X25519 key; the redacted analysis view, in memory

  Never holds

  Originals, the name map, identity data

• Domain: Reviewers’ browsers

  Holds

  X25519 and Ed25519 private keys; one Shamir share each

  Never holds

  The reporter’s identity

Three databases, no joins

identity.db, reports.db with audit.db, and payments.db share no keys and no foreign keys. Payments reach jobs only through HMAC-SHA256(link key, job_id).

One fact for identity

The identity service learns that a verified person asked for tokens for one campaign, and nothing else.

Ciphertext at rest

The API stores envelopes it cannot open: originals under the report key, the analysis view sealed to the worker, findings sealed to reviewers.

Every access logged

Openings, file fetches, access requests, approvals and grants are appended to a signed Merkle log.

A reporter proves once per campaign that they are a real adult with a genuine passport, and leaves with three tokens that cannot be traced back to that proof.

Scoped nullifiers

The Self scope is per campaign, so the same passport yields different nullifiers for different organisations. Reports to two organisations cannot be linked through identity.

Rate limit

Three tokens per person per campaign per 30 days. A fourth request in the same epoch is refused with quota_exhausted.

Issuer keys

RSA-2048, e = 65537, one per campaign, generated with @cloudflare/blindrsa-ts and encrypted at rest with AES-256-GCM under an HKDF-derived key.

Redemption

Standard RSASSA-PSS verification (SHA-384, MGF1-SHA-384, 48-byte salt). The spent registry key is hex(sha256(prepared)); a second use returns 409 token_spent.

Everything here runs in the reporter’s browser before a single byte is uploaded. The server never sees the before.

Three symmetric keys, each wrapped only for the parties that need it. The API stores every envelope and can open none of them.

{
  "v": 1,
  "alg": "xc20p-padme",
  "n": "<b64u 24-byte nonce>",
  "c": "<b64u ciphertext>"
}

AD = "candor/v1/" + purpose + "/" + report_id
purpose ∈ manifest | file/<i> | analysis | findings

F = u32be(len(P)) ‖ P        L = len(F)
E = ⌊log2 L⌋   S = ⌊log2 E⌋ + 1   z = E − S
padded = ⌈L / 2^z⌉ · 2^z

The email in the hero:
P = 278 B → L = 282
E = 8, S = 4, z = 4
padded = 288 B, sealed = 304 B (+16 tag)

A directed acyclic graph of twelve stages, five of them plain code. Independent stages run concurrently; a failed non-critical stage degrades the result instead of failing the job, and invalid model output never reaches the result.

score = σ(−1.6 + 2.2·agreement + 1.8·v + 0.45·min(sources, 3)
           − 1.2·contradicted − 1.5·injected)

v: supported 1 · partly 0.6 · unverifiable 0 · not supported −0.6 · contradicted −1.2
labels: high ≥ 0.80 · moderate ≥ 0.60 · low ≥ 0.35 · otherwise very low

Structured output

JSON Schema comes from the Pydantic stage models. Output is parsed strictly, then validated for types and meaning: every passage and claim it cites must exist, and dates must parse. Up to two repair prompts carry the validation errors back; whatever still fails is dropped, never invented.

Providers

One interface, complete_json. The demo and the evaluation run on Muse Spark Open, Meta’s open-weights model (meta-models/muse-spark-open-1026 on Baseten). Baseten does not enforce JSON schemas for it, so the schema travels in the prompt and the validator and repair loop do the enforcing; its reasoning stays in a separate field and never reaches the result. Open weights matter here: an organisation can run the same model inside its own boundary, so redacted evidence need not leave it. The same interface reaches Muse Spark on the Meta Model API (muse-spark-1.3), Fireworks, Claude Haiku 5.5, a local Codex CLI and a record-and-replay cassette provider that makes CI deterministic.

Routing

candor-evals bench measures quality, p50 and p95 latency and cost per stage and provider, and writes router.json choosing, per stage, the cheapest provider within two points of the best quality.

Evidence is data, never instructions. Candor assumes some documents were written to manipulate the analysis, and treats the attempt as a finding in its own right.

1. 1Spotlighting. Every passage sits inside delimiters carrying a random per-run nonce, so a document cannot forge a closing tag. The system prompt states that evidence is untrusted and that instructions inside it are findings, not commands.
2. 2Heuristics. Regex families for instruction overrides, role switching, system-prompt references, output manipulation, tool or URL exfiltration and hidden-text markers produce signals and a risk score per passage.
3. 3Classifier. One batched model call refines the risk of passages with any heuristic signal or imperative, second-person wording.
4. 4Quarantine. At a risk of 0.7 or more a passage is quarantined: still shown to reviewers, marked for the model, and unable to support a claim alone. A claim resting only on quarantined text is flagged cites_injected_passage, classed unsupported, and loses 1.5 in the calibration logit.

Every submission, analysis, opening, fetch, approval and message is appended to a public, append-only Merkle log. Anyone can check that an entry is in it and that the log has only grown.

leaf_hash(d)    = SHA-256(0x00 ‖ d)
node_hash(l, r) = SHA-256(0x01 ‖ l ‖ r)

{ "tree_size": 42, "root_hash": "<hex>",
  "timestamp": "2026-10-26T10:00:00Z",
  "key_id": "<hex>", "signature": "<b64u>" }

signed: "candor/v1/sth\n" + size + "\n"
        + root_hash + "\n" + timestamp

Signing

A new Ed25519-signed tree head after every append. Inclusion and consistency proofs are served under /v1/log/proofs, and verifyInclusion and verifyConsistency in @candor/crypto check them in any browser.

Anchoring

Every 16 entries, and on demand, the root is published as calldata in a zero-value self-transaction on Base Sepolia. Demo mode records a deterministic mock reference instead.

What it does not stop

An operator could show different logs to different people. Signed tree heads make that provable once two views are compared, and anchors give a shared reference, but nothing yet gossips tree heads between independent monitors.

Running the model costs money, so someone has to pay for each analysis. It is never the reporter.

Analysis runs as an asynchronous job: leased, retried, dead-lettered when it keeps failing, and streamed to the reviewer stage by stage.

Workers on Modal

With MODAL_ENABLED, enqueueing spawns run_analysis, which runs candor-worker --once with two Modal-level retries (backoff coefficient 2) and a 30-minute timeout. Without Modal, a local worker polls every 1.5 seconds.

Plaintext stays in memory

The worker unseals the analysis key, runs the graph, seals findings to every reviewer and posts only counts, timings and model names as the job summary. Nothing it decrypts is logged.

Live progress

Stage events stream to the console over Server-Sent Events at /v1/jobs/{id}/events, resumable with Last-Event-ID. The token travels as a query parameter because EventSource cannot set headers.

Deployment

One Modal app runs the API (SQLite on a Modal volume), the identity service on Node 22, the analysis function and scheduled evaluations. The web app deploys to Vercel and falls back to recorded showcase data when no backend is configured.

Six seeded synthetic scenarios, each with planted canaries, contradictions and injected instructions, run through the real on-device scrubber and the real pipeline.

• Measure: Identifier leakage

  How it is computed

  Each canary, and each of its tokens of four or more characters, is searched for case-insensitively in the analysis payload, every outbound prompt captured by the tap provider, the stripped file metadata and the final result. Leak rate is scenarios with any leak over all scenarios.

  Pass condition

  0

• Measure: Source traceability

  How it is computed

  Ground-truth names map to placeholders through the name map; predicted claims match ground-truth events by Hungarian assignment on statement similarity and actor overlap, at 0.55. Event recall, claim precision, quote grounding, citation precision and the unsupported-claim rate.

  Pass condition

  Reported, no fixed bar

• Measure: Timeline accuracy

  How it is computed

  Kendall τ-b between true dates and predicted interval midpoints, mean absolute error in days, interval coverage, and recall of planted temporal contradictions.

  Pass condition

  Reported, no fixed bar

• Measure: Invalid output

  How it is computed

  The run is repeated with the chaos provider corrupting 30% of responses. Schema-valid final results, repair success, degraded stages, and invalid items that reach the result.

  Pass condition

  1.0 valid · 0 invalid items

• Measure: Injection robustness

  How it is computed

  Planted instructions flagged, attack success judged by keyword rules from each scenario’s stated target (with an optional model judge), and true events lost when an injection is present.

  Pass condition

  Reported, no fixed bar

• Measure: Contradictions and gaps

  How it is computed

  Recall of planted contradictions, and how many expected gap types the follow-up questions cover.

  Pass condition

  Reported, no fixed bar

What Candor defends against, and what it does not. Residual risks are stated plainly; some of them only the reporter can reduce.

• Network observer

  Capability

  Sees which services a device talks to, when, and how much data moves.

  Mitigation

  TLS; Padmé-padded uploads; 2–20 s submission jitter; same-size chaff; tokens valid for 30 days so verifying and submitting can be days apart.

  Residual risk

  Traffic analysis. That a device contacted Candor, and roughly when, stays visible. Use Tor or a network your employer does not run.

• Report API operator

  Capability

  Reads every database and blob, and serves the web app.

  Mitigation

  Ciphertext only; keys sealed to reviewers and the enclave; unlinkable tokens; a separate payments database.

  Residual risk

  Sees padded sizes, hour buckets and connecting addresses; can withhold or delete data (visible in the log, not prevented). A malicious build of the web app could read evidence before encryption.

• Identity service operator

  Capability

  Knows that a verified person requested tokens for a campaign, and when.

  Mitigation

  Blind signatures; HMAC nullifier tags; no proofs or passport data stored.

  Residual risk

  Timing correlation if a reporter verifies and submits back to back. Jitter and the 30-day epoch reduce it; reporters can widen the gap.

• One reviewer

  Capability

  Holds one key share and reads the redacted findings.

  Mitigation

  2-of-3 threshold; shares combined only in browsers; every opening and approval logged.

  Residual risk

  Context in the redacted text, such as a role or a shift pattern, can still point to someone.

• A colluding quorum

  Capability

  Two reviewers who agree to open a report.

  Mitigation

  Access requests carry a reason; approvals are Ed25519-signed; request, approval and grant are all public log entries.

  Residual risk

  Full access to originals and real names. The log makes it visible afterwards; it cannot stop it.

• The organisation being reported

  Capability

  Chooses the reviewers, owns the campaign, and knows its own staff.

  Mitigation

  Identity never reaches the organisation; self terms are redacted on the device; leakage warnings before submission.

  Residual risk

  It controls the quorum, so it can open anything the reporter uploads in original form. Content and writing style (stylometry) can identify a reporter; Candor flags quasi-identifiers but does not rewrite anyone’s prose.

• Model provider

  Capability

  Receives every prompt the worker sends.

  Mitigation

  Only the redacted, pseudonymised view; no metadata; every outbound prompt is captured and checked for canaries in evaluation.

  Residual risk

  The provider’s retention policy applies to redacted text, and quasi-identifiers can survive redaction.

• Author of a planted document

  Capability

  Writes text the model will read.

  Mitigation

  Nonce-tagged spotlighting; heuristic and classifier quarantine at 0.7; a separate verifier; verbatim grounding.

  Residual risk

  An injection below the threshold can still shape wording. Measured in evaluation, not ruled out.

• Someone flooding a campaign

  Capability

  Submits many reports to bury or discredit real ones.

  Mitigation

  Passport proof with a scoped nullifier; three tokens per 30-day epoch.

  Residual risk

  A person holding several genuine passports can obtain more tokens.

• Log operator rewriting history

  Capability

  Controls the log server.

  Mitigation

  Signed tree heads; consistency proofs; on-chain anchors every 16 entries.

  Residual risk

  Split views are provable only when someone compares tree heads, and no independent monitor gossips them yet. Anchoring is mocked in demo mode.