TrustBench: tests that prove themselves by failing first.

Each security test in our source has a deliberate break on record that it must catch; more than 1,900 on 6 November 2026, and a share is planted again regularly to check its test still fails.

Since 6 November 2026 some of the code that decides on what arrives from outside is also checked by a model checker, which tries every case rather than the cases someone wrote down: a device's release floor and its store's counter over every possible value, and the grammar of rights in a credential and the radio's frame decoders over every short text and every frame size. Each proof has a deliberate break on record that it must catch, like the tests.

Since 7 November 2026 the channel between a client and its relay is also written as a formal model and checked by a protocol verifier against an attacker who controls the network, in both of its versions. In the one phones use, inside Tor, what a client sends stays secret from a recording while either half of its post-quantum key exchange holds. In the one for clients that cannot use Tor, built and not yet deployed, the client is also shown to have reached the relay whose address it dialled, and what it sent stays secret after that relay's keys are seized. Pairing is modelled the same way: an invitation stays whole while either half of its post-quantum signature holds, for whoever compares the safety number. So is retiring a recovery phrase: a contact moves to a new identity only as its owner signed it, and the model is how one of its checks was found to cover only half of the new identity, now covering all of it. And moving an account to a new phone: the code shown on one screen and typed into the other is what keeps a stranger on the same network out, which is why it is long. And the signed list of relays every client agrees on: one seized signer key is not enough to change it. Each model carries cases that must fail, and deliberate breaks on record that it must catch.

The same tool runs a maker's deliberate breaks over the maker's own code: an example in C, a check on command frames with three of the mistakes such code makes, is planted regularly with a real compiler.

Forty-eight clients per condition for an hour against our own relays, scored by the attacks a recording of their links allows; our traffic-analysis measurements were made in it, the defences that failed included.

Since 6 November 2026 the same laboratory can be given one network's shape: how many devices, the links they sit on with their delay, their loss and their outages, how often they write, and which of our settings run. It then says, for that network, how well a listener who sees every link can tell who talks to whom, and what that protection costs in delay.

Since 5 November 2026 a TrustBench run writes what it ran, on which source and when, and which deliberate breaks its tests caught; the laboratory signs the report with its own identity, and anyone checks the signature with our command-line tool, no account needed.