VERITAS — Community Damage Certification Platform

VERITAS v3.0.0 — Execution-Verified Engine, Honest Pipeline, Sealed Rescue Receipts

Full Changelog: v2.5.3...v3.0.0

The largest correctness and honesty pass in the project's history. The CERTUS engine advanced two generations (v2.5 → v3.2.2) and became the first version proven to run, not merely read. The entire photo-to-score pipeline was made honest end to end, a new sealed rescue-acknowledgment capability was added, and every document was reconciled to state claims at exactly the strength the code supports.

🔴 Engine: v2.5 → v3.2.2 (execution-verified)

An independent execution-level code review found and resolved 19 findings (2 FATAL, 4 CRITICAL, 4 HIGH, 6 MEDIUM, 3 LOW):

FATAL — the shipped engine did not parse (a stray brace); the demo had been loading the pre-audit v2.5 engine. Fixed and locked by CI.
FATAL — the epistemic ceiling (0.95) was defined but never enforced. Now enforced in scoring and appeals.
CRITICAL — four documented mechanisms didn't exist in code: graduated model trust, weight self-calibration, witness extraction, cumulative appeal ceiling. All implemented.
HIGH — reputation-weight math (negative/runaway weights), a coordinate-schema mismatch silently killing corroboration, a third-party coordinate leak now made opt-in.
Cumulative across the full audit lineage: 76 findings resolved, 0 open.
The engine now passes node --check plus a 21-check runtime suite, gated in CI so a non-parsing or claim-breaking engine can never merge.
🟢 Honest photo→score pipeline

No layer can now enter a number it didn't earn. The AI module returns no judgment (NOT_EVALUABLE) when analysis is unavailable instead of a fabricated one; the frontend passes real values or honest nulls; mock scores are clearly labeled wherever a user sees them.

🆘 New: sealed rescue-acknowledgment receipt

A responder can acknowledge a rescue signal on the dashboard; the acknowledgment is STP-sealed and returns to the sender's device, showing "a responder saw your signal at T." Proves the signal was seen — never that rescue is dispatched, stated in all six languages. Closes the receipt-of-signal gap for the rescue feature.

📄 Documentation reconciled

README, CERTUS.md, and the UNDP compliance file were aligned to a three-state (✅/◐/✗) honesty standard. Offline photo AI and AI-features are now honestly marked partial; the licence is stated consistently as GPL-3.0; the engine version is consistent across all files.

Upgrade note

The v3.2.2 engine's score() is async — the frontend now correctly awaits it. If you integrate the engine directly, await CERTUS.score(...). The frontend must load certus-engine-v3.2.2.js; ship the engine and frontend together.