# The certified app — audited by machines, not by opening the source

> **Status: DESIGN / direction.** An answer to *"how do I know an app is good?"* for apps that are **not open-sourced**,
> by making the app model small enough that an automated, attested audit is sound. It defines what *good* **means** and
> who decides it — complementing [the power-user stack](./the-power-user-stack.md) (which verifies you *received* the good
> build) and [the pinned bundle](./the-pinned-bundle.md) (which pins the client bytes). See also
> [the attested client](./the-attested-client.md), [the attested tier](./the-attested-tier.md),
> [verify it yourself](./verify.md), [trust model](./trust-model.md).

## The question

Open source + plural human review is the gold standard for "no hidden backdoor" — but it demands publishing the source,
which most builders won't do, and it doesn't scale to every app. Can you get a **verifiable** "this app is good" *without*
open-sourcing it?

## The move: make the app auditable by construction

Not "out-analyse an adversary's arbitrary code" — **remove arbitrary code from the problem.**

- **A Witbitz app is almost entirely a manifest + UI** — a declarative capability request (what data, which tools, where
  it may send) plus a constrained interface. It is closer to a *policy* than a program, and policy is checkable.
- **Complexity disqualifies.** An app too complex to audit cleanly is **auto-rejected**, not waved through. That one rule
  kills the main evasion vector for free: obfuscation, time bombs, hidden data-dependent paths are all *complexity* — and
  you cannot hide a backdoor in convolution if convolution itself fails the gate.

This converts *"determine what an arbitrary program does"* (undecidable, evadable) into *"check a small declarative
artifact against a policy"* (tractable — and much of it deterministic, not even an LLM question). It does **not** need
superhuman models; the small surface is what makes it work now.

## The mechanism

1. **A fixed, confining runtime — proven once, for all apps.** The security rests here, not on each app. The runtime
   confines every app to its **declared capabilities**, keeps the egress-lock, sandboxes the UI, and forbids arbitrary
   code. It is **one small shared artifact** → open it, reproduce it, attest it **once**, and it covers every app. The
   per-app surface stays a checkable manifest; the risky surface collapses into a single thing everyone can review.
2. **Plural attested checkers.** Many independent checker images — from **different entities**, with genuinely different
   methods/models — each receive the **source inside an attested enclave** (fed to the machines, **not** the public) and
   verify the app matches its **privacy certificate**. **N-of-M must agree.** Each checker is itself a reproducible,
   attested image, so its verdict is reproducible and its independence is checkable.
3. **Deterministic where possible, LLM where necessary.** The crisp claims — declared egress and capabilities — are
   checked *deterministically* (no model needed). The fuzzy part — does the UI/intent match the stated purpose — is where
   the LLMs work, scoped and plural.
4. **A public verdict log — cheap, no source.** On approval, the **build hash + the privacy certificate + the set of
   checkers + their verdicts** go to the public transparency log. So *"N independent attested checkers approved this
   build"* is **accountable and challengeable**, not asserted — without publishing the source.
5. **The enclave answers "is this build good?"** from that logged, plural-audited record — backed by many independent
   attested audits rather than one operator's say-so.

## What it buys

A **verifiable** "good app" for **closed-source** apps, automated, at scale — the property open source gives, minus the
requirement to publish. The chain: *the runtime confines it → N independent attested checkers approved it → the log makes
that public → your verifier confirms you received that exact build* ([power-user stack](./the-power-user-stack.md)).

## Where the security actually lives now

Honestly located — and a strictly better place than per-app code review:

| Piece | Why it's the real work |
|---|---|
| **The runtime** | "simple ⇒ safe" only holds if a simple manifest *cannot* do harm — the runtime must enforce that. It is small, shared, and **openable/attestable once**. |
| **The complexity gate** | must be objective enough that a manifest can't stay under the bar yet misuse its declared capabilities. |
| **Checker diversity** | plurality only helps if it's *uncorrelated* — different entities *and* methods, so no single trick fools them all. |

The trust moved from "audit each app's arbitrary code" to "a small fixed runtime + an objective gate + plural attested
checkers" — smaller, mostly deterministic, and mostly openable.

## Honest scope — hold the claim tight

The defensible guarantee is **"a simple, capability-confined app, approved by N independent attested checkers against its
declared certificate."** Not *"any app is safe."* The LLM verdicts on the fuzzy parts are **strong heuristic assurance —
backed by plurality + attestation + reproducible checker images** — not a proof of the impossible. The hard, deterministic
guarantees (capability confinement by the runtime, egress-lock, reproducible builds, the public log) are the floor; the
automated audit rides on top and is what makes **closed-source better than today**, approaching open-source assurance for
apps small enough to qualify.

## Trust roots

All checkable, none of them "Witbitz's word": the **runtime's reproducible/attested build**; the **plural checker images**
(independent entities, attested, reproducible); the **hardware root**; the **public verdict log** (accountable,
challengeable); and math. No single authority — not even an attested one — decides "good" alone.

## Status

DESIGN / direction. Prerequisites that make it sound: the **capability-confining runtime** (the app model must actually be
manifest-shaped and confined, not arbitrary code), an objective **complexity gate**, a **checker-diversity** programme, and
the **verdict log**. When those exist, "good app, without open source" becomes something you *check*, not something you take.