Skip to main content

​
The Compliance Problem

Your customer needs to hand a session record to their auditor. The session shows what was reviewed, who approved it, what gates fired, what overrides were recorded, and on what justification. Standard options:
  • Send a PDF. Not machine-verifiable. Tampering is undetectable at the field level.
  • Give the auditor a read-only login. Massive blast radius. The auditor has access to everything, not just the one session.
  • Provide a JWT and a verifier endpoint. The auditor must reach your endpoint. If you go offline or block them, audits stall. Their security team will block the cross-origin call anyway.
None of these are good. All of them put the issuer (your customer) on the hook for the verifier’s access.

​
The Pattern

Sign the session record with Ed25519 over canonical JSON. Embed the public key in the token itself. Any third party with the token can verify it using a standard library — no network calls, no JWKS endpoint, no STRATT access. 
{
  "payload":   {...},                    // the session ledger
  "sig":       "base64url(64 bytes)",    // Ed25519 over canonicalJson(payload)
  "publicKey": "base64url(32 bytes)",    // verifier extracts this — no lookup
  "exp":       "2026-04-24T..."          // TTL clamped at mint
}
base64url-encode the whole envelope, drop it into a URL path segment, share it.

​
Why It Stands Up

PropertyHow
Tamper-evident at the field levelAny payload change → signature fails
Issuer-independent verificationPublic key embedded; no lookup
Time-boundedTTL at mint replaces revocation lists
Standards-alignedEd25519 is FIPS, IETF, and every modern crypto library
Privacy-respectingInternal actor IDs can be redacted by default; opt-in unmask requires a second signature

​
What It Enables

  • Customer to auditor: handoff is a URL.
  • Customer to opposing counsel: cryptographic proof without discovery.
  • Customer to regulator: filing-grade artefact that survives the issuer going offline.
  • Customer to customer: supply-chain provenance with no shared infrastructure.

​
The Engineering Cost

@stratt/signature is ~80 lines on top of @noble/ed25519. Tests cover round-trip, tamper, expiry. Reuses @stratt/fingerprint for the canonical-JSON layer that makes signatures reproducible across implementations. The whole audit bridge — sign endpoint + public viewer page + middleware exemption — landed in one taskset.

​
The Positioning Move

Most enterprise platforms quietly require their auditors to log in. STRATT customers hand their auditors a URL. That difference removes a procurement objection and ships a compliance story most competitors cannot match without rebuilding their auth model.