# Project-reported audit status

Updated: 13 October 2026. Status: **In progress**. No completed audit report has been published.

According to the project team:

- The MIT CSAIL Computer Systems Security (CSS) Group is conducting a cryptographic audit using HACL*.
- The MIT CSAIL Programming Languages and Verification (PLV) Group is reviewing the overall mechanism using high-assurance software verification methods based on the Coq proof assistant.

This is an audit-progress statement supplied by the project team, not a completed audit result or institutional endorsement. Scope details and reports will be linked when published.

## Meaning of `independentAuditComplete`

The boolean `independentAuditComplete: false` in existing signed protocol releases means that an independent audit was not recorded as complete when those releases were published. Those fields form part of the fixed release identity and must not be replaced with text or rewritten retrospectively. Changing them would invalidate release verification.

The separate [audit-status.json](audit-status.json) records the current project-reported progress. It does not alter signed release history, verification keys, balances or transaction rules. A transaction marked **protocol verified** has passed protocol checks; this label is not an independent security-audit certificate.