Your compliance blocks. Can it testify?

Three questions the stack cannot answer today

1. What ran? Which policy version executed on this transfer, against which data? Today: log files someone promises are complete — and an auditor who samples.
2. At what privacy cost? Persistent on-chain identity registries and decade-long workpapers that hold sampled client files are disclosure channels.
3. What survives? Ten-year retention obligations; evidence trapped inside vendor systems that turn over in a few years.

We do not replace the compliance gate. It stays. We make it provable, privacy-preserving, and vendor-independent — beside the part that works.

Three claims

Durable. The verifier is published, escrowed, and self-hostable: evidence stays checkable for the retention period with every vendor gone — including us.

Policy as a program

A compliance policy is not a PDF, not an allowlist, not a vendor black box. It is a TypeScript program whose execution produces a proof. Engineers own it in their repo. Compiled, each checked transfer emits a certificate: a zero-knowledge proof that this exact policy ran over attested inputs. Verifiable by anyone. Revealing no one.

Data declares where it is allowed to live: public on the ledger; private encrypted for authorized parties; secret never leaving its lawful holder’s machine; witness material consumed only inside the prover. A junior engineer cannot leak a residency into a public field — the compiler rejects it:

this.denial.reason = `blocked: sender residency ${this.sender.residency}`;

  error LMA201: '@lma.secret' data cannot reach '@lma.public' field 'reason'
    sender.residency is @lma.secret — custody: its holder's machine, forever

What a certificate is — and is not

How we enter the market

1. Harness. Differential-test existing token-compliance modules against published formal specs of the ERC-3643-class standards they already run — in CI, without cryptography knowledge required.
2. Pilot. Specs calibrated to the buyer’s own rulebook and modules; findings report written for their auditor.
3. Shadow mode. Continuous second judge beside production, certificates accumulating into standings institutions can rely on across organizational boundaries.

Oracle boundary: coverage and standing rest on signed attestations consumed in-circuit — never proven underlying assets or KYC truth beyond contractual liability of attesters. A certificate is evidence, never discharge of statutory duty.