# security.txt — RFC 9116
# AgenticRail (TUARA KURI LIMITED), Hokianga, Aotearoa New Zealand
#
# This is an enforcement and evidence product. If you have found a way to make
# the gate permit a step it should refuse, to produce a receipt that verifies
# but is untrue, or to alter a sealed sequence without the chain breaking, that
# is the finding we most want to hear about. Say so plainly and we will not
# argue about scope.

Contact: mailto:hello@agenticrail.nz
Expires: 2027-08-11T00:00:00.000Z
Preferred-Languages: en
Canonical: https://agenticrail.nz/.well-known/security.txt

# What is in scope
#   agenticrail.nz, api.agenticrail.nz, report.agenticrail.nz,
#   mcp.agenticrail.nz, dashboard.agenticrail.nz, assets.agenticrail.nz
#
# Testing against the public demo key (DEMO-AGENTICRAIL-PUBLIC-2026) is welcome
# and expected — it is public and burnable, rate-limited to 300 req/min, and
# every sequence it creates is world-readable by design. Please do not run
# volumetric or denial-of-service testing; it proves nothing about enforcement
# and it is the one thing that degrades the service for everyone else.
#
# How to check our claims before reporting: run a sequence at
# https://agenticrail.nz/demo/ and verify it at
# https://report.agenticrail.nz/report — the report carries each receipt's raw
# signature, the byte-exact preimage that was signed, and the public keys
# inline, so Ed25519 verification runs entirely in your own code.
#
# Known and documented, so not a finding:
#   - AgenticRail holds the receipt signing keys. A key holder could construct a
#     consistent but false chain; an independently held archive copy is what
#     catches that. Stated at https://agenticrail.nz/faq/
#   - ts_ms is signed but self-asserted. It is a record of when, not proof of
#     when. Stated on /eu-ai-act/ and in every report's verification block.
#   - The attestation field is published verbatim in reports, and a demo-
#     sequence report needs no key. That is by design; it is documented.