🧪 PRE-RELEASE RESEARCH PROTOTYPE • FOR PEER REVIEW & DISCUSSION ONLY
BinWatch is an experimental research harness under active development (v0.0.1-rc0). All outputs, metrics, and advisory strings are published strictly for educational peer review and discussion. This tool is not a certified security monitor and must not be used as the sole basis for production custody or infrastructure decisions.

🛡️ BinWatch Integrity Auditor

Sovereign, stateless Bitcoin binary integrity verification. Deterministic Merkle hex seals anchored to Bitcoin block headers.

Active Merkle Seal: #...

Latest Audit Matrix (5 Sovereign Core Targets)

Loading...
Project Tag Pipeline Status Vector [DTHS-MKEX-HRPA] Artifacts Verification Engine Status
Loading audit matrix...
💡 Click on any project row to expand its cryptographic Chain-of-Custody (Trust Anchor, Manifest URL, and Hosted Signing Key). Hover over elements for technical tooltips.

Nostr Kind 1 Digest Note

Loading digest...

📖 12-Stage Pipeline Status Vector Legend & Operator Guide

Every audited release is assigned a deterministic 12-stage status vector ([DTHS-MKEX-BRPA]). Each letter position represents a distinct isolation boundary in the supply-chain verification pipeline. Green badges (✓) indicate passed stages, yellow badges (!) indicate governance warnings, and red badges (0) indicate hard failures.

🌐 Group 1: Transport & Network Layer

  • D — DNSSEC & IP Pinning: Asserts transport IP route stability and DNSSEC integrity. (Operator: Check DNS/SOCKS5 proxy).
  • T — TLS Handshake: Validates TLS 1.3 certificate chain against strict Root CA whitelist. (Operator: Verify TLS cert/CA).
  • H — HTTP Transport: Validates HTTP 200 OK & byte-range determinism. (Operator: Check edge cache/CDN).
  • S — Schema Syntax: Parses canonical manifest ordering (SHA256SUMS.asc). (Operator: Inspect manifest formatting).

🔑 Group 2: Key & Governance Layer

  • M — Manifest Signature: Validates OpenPGP or BIP-340 Schnorr signature math. (Operator: Hard BADSIG if failed).
  • K — Declared Key Match: Verifies fingerprint matches in-tree Trust Anchor URL. (Operator: Check Readme.md#pgp key ID).
  • E — Key Expiration: Audits primary/subkey validity timestamps. (Operator: Flags yellow ! if maintainer key expired).
  • X — Key Revocation: Checks CRL / inline 0x20/0x30 revocation certificates. (Operator: Rejects revoked keys).

📦 Group 3: Payload & Blockchain Anchor

  • B — Build & Hash Determinism: Asserts SHA-256 hash match AND ingests WalletScrutiny source-to-binary build attestation (BW-WS-INGEST-v1). (Operator: Hard HASH_DRIFT / build mismatch if failed).
  • R — Freshness TTL: Asserts manifest age ≤ 180 days. (Operator: Flags yellow ! if release mirror stale).
  • P — Peer Mirror Fetch: Multi-vantage secondary fetch. (Operator: Rejects dynamic geofence swaps).
  • A — Bitcoin Chain Anchor: OpenTimestamps Merkle proof anchored to BTC block height. (Operator: Verifies state seal).
📜 Merkle Seal Mutation & Lineage Changelog (Historical Audit Trail)

This audit log records explicit architectural mutations, schema updates, upstream release discoveries, and key status changes that required recalculation of the canonical Merkle root seal (#HEXSEAL) across historical evaluation epochs.

Merkle Seal #75B5FE (2026-09-16T14:44:22Z | BTC Block #967292) [ACTIVE]
• Cause: 5 Sovereign Core Target Matrix Scope Lock & Telemetry Refactor.
• Mutations: Streamlined audit matrix strictly to 5 sovereign core targets (bitcoin_core, sparrow, coldcard, blockstream_jade, seedsigner). Disabled automatic public Nostr broadcasting without explicit CLI flags. Added multi-artifact (multi) indicators and primary hash badges.
Merkle Seal #222E65 (2026-09-15T17:57:53Z | BTC Block #967173)
• Cause: Upstream GPG Key Expiration Sentinel Alert (bitcoin_keeper v2.5.13 broadcast).
• Mutations: Broadcast Nostr Kind 1 supply-chain mutation alert for expired upstream GPG key on bitcoin_keeper. Transitioned artifact sig_status from OK to EXPIRED.
Merkle Seal #15EC8A (2026-09-13T20:57:12Z | BTC Block #966893)
• Cause: WalletScrutiny Build Attestation & Status Vector Integration.
• Mutations: Integrated WalletScrutiny reproducible build status vectors and parsed Nostr build attestations. Updated walletscrutiny.rs module and matrix bindings.

⚖️ Passive Conduit Safe Harbor & Limitation of Liability

BinWatch operates strictly as an automated, stateless cryptographic verification engine. BinWatch does not conduct software penetration testing, dynamic application analysis, source code vulnerability audits, or security certifications.

All advisory references, CVE identifiers, and version thresholds displayed herein are mirrored verbatim and unverified from third-party public databases (including OSV.dev, GitHub Security Advisories, and NVD). BinWatch asserts nothing regarding the security, merchantability, or exploit status of any binary. The absence of an upstream query match indicates solely that no record was returned by the external API at query time; it does not indicate that software is secure, defect-free, or unexploitable.

Provided strictly "AS-IS" and "AS-AVAILABLE" under the MIT License without warranties of any kind. Authors and contributors disclaim all liability for node compromises, loss of digital assets, or damages arising from reliance upon these experimental research outputs.

Autonomous Verification Rig by bootlace-dev • MIT License