<?xml version="1.0" encoding="UTF-8"?>
<?rfc toc="yes"?>
<?rfc compact="no"?>
<?rfc subcompact="no"?>
<?rfc sortrefs="yes"?>
<?rfc symrefs="yes"?>
<rfc xmlns:xi="http://www.w3.org/2001/XInclude"
     ipr="trust200902"
     docName="draft-singh-apex-psi-05-02"
     category="info"
     xml:lang="en">

<front>
  <title abbrev="PSI-05 Financial Disclosure Integrity">
    PSI-05: Financial Disclosure Integrity
  </title>
  <author initials="K." surname="Singh" fullname="Kawaljeet Singh">
    <organization>Apex Intelligence Empire</organization>
    <address>
      <postal>
        <city>Balaclava, Victoria</city>
        <country>Australia</country>
      </postal>
      <email>kawaljeet.singh3008@gmail.com</email>
      <uri>https://apex-infrastructure.com</uri>
    </address>
  </author>
  <date year="2026" month="August" day="09"/>
  <abstract>
    <t>
      PSI-05 defines a cryptographic attestation framework for financial
      disclosures, enabling third parties to recompute and verify company
      filings against their published figures.  It establishes a public
      ledger of sealed financial statements, a verification protocol using
      RFC 8785 canonicalization with Ed25519 (classical) and ML-DSA-65
      (post-quantum) signatures, and an API for querying reconciliation
      results.  The framework supports ASX, NYSE, NSE, LSE, and Euronext filings.
    </t>
  </abstract>
</front>

<middle>
  <section anchor="introduction" title="Introduction">
    <t>
      Public companies publish financial disclosures (10-K, 10-Q, 20-F,
      annual reports) that are legally binding but rarely independently
      verified.  PSI-05 establishes a cryptographic framework where:
    </t>
    <ul>
      <li>Every financial disclosure is sealed with SHA-256.</li>
      <li>The seal is signed with Ed25519 (classical) and ML-DSA-65
        (post-quantum) in a hybrid dual-signature scheme.</li>
      <li>The dual signature is recorded in a public PSI-04 ledger.</li>
      <li>Third parties can recompute the disclosed figures and verify
        against the sealed source.</li>
      <li>Variance between published and recomputed figures is flagged.</li>
    </ul>
    <t>
      This creates a trust layer for financial data that is independent
      of the filing entity and quantum-resistant by design.
    </t>
  </section>

  <section anchor="terminology" title="Terminology">
    <dl>
      <dt>Sealed Disclosure:</dt>
      <dd>
        A financial document hashed with SHA-256 and signed with
        Ed25519 + ML-DSA-65 hybrid scheme, recorded in the PSI public ledger.
      </dd>
      <dt>Recomputation:</dt>
      <dd>
        Independent calculation of disclosed figures from source data
        using the PSI reconciliation engine.
      </dd>
      <dt>Variance:</dt>
      <dd>
        Difference between published and recomputed figures, expressed
        as a percentage.
      </dd>
      <dt>Ledger Entry:</dt>
      <dd>
        A PSI-04 attestation recording the dual seal hash, timestamp,
        and source citation.
      </dd>
      <dt>Hybrid Signature:</dt>
      <dd>
        A cryptographic envelope containing both an Ed25519 signature
        (classical) and an ML-DSA-65 signature (post-quantum) over the
        same canonicalized document.
      </dd>
    </dl>
  </section>

  <section anchor="cryptographic-framework" title="Cryptographic Framework">
    <section anchor="canonicalization" title="Canonicalization">
      <t>
        All financial disclosures MUST be canonicalized using
        <xref target="RFC8785"/> (JSON Canonicalization Scheme) before hashing.
      </t>
    </section>
    <section anchor="hashing" title="Hashing">
      <t>
        The canonicalized document MUST be hashed with SHA-256.
      </t>
    </section>
    <section anchor="signing" title="Signing">
      <t>
        The hash MUST be signed using a hybrid dual-signature scheme:
      </t>
      <ol spacing="normal" type="a">
        <li>Classical signature: Ed25519 <xref target="RFC8032"/></li>
        <li>Post-quantum signature: ML-DSA-65 (NIST FIPS 204)</li>
      </ol>
      <t>
        Both signatures MUST be included in the attestation bundle.
        Verifiers MUST validate at least one signature.
        Verifiers SHOULD validate both for maximum assurance.
      </t>
      <t>
        The classical Ed25519 signature provides backwards compatibility
        with existing tooling.  The ML-DSA-65 signature provides quantum
        resistance.  The hybrid scheme ensures security against both
        classical and quantum adversaries.
      </t>
      <t>
        Implementations SHOULD transition to ML-DSA-65 as the primary
        signature by 1 January 2028.  Ed25519 alone is NOT quantum-
        resistant and SHOULD NOT be used without a post-quantum
        counterpart.
      </t>
    </section>
    <section anchor="ledger-recording" title="Ledger Recording">
      <t>
        The dual signature, hash, timestamp, and source URL MUST be
        recorded in the PSI public ledger as a PSI-04 attestation
        <xref target="PSI04"/>.
      </t>
    </section>
  </section>

  <section anchor="verification-protocol" title="Verification Protocol">
    <section anchor="recomputation-request" title="Recomputation Request">
      <t>
        A verifier requests a company's financial disclosure via the PSI API:
      </t>
      <artwork><![CDATA[
GET /api/v1/companies/{ticker}/filings/{year}/{type}
      ]]></artwork>
      <t>
        Response includes the sealed document hash, dual signatures,
        and source citation.
      </t>
    </section>
    <section anchor="independent-recomputation" title="Independent Recomputation">
      <t>
        The verifier recomputes the disclosed figures from the source
        data and compares against the published figures.
      </t>
    </section>
    <section anchor="variance-detection" title="Variance Detection">
      <t>
        If variance exceeds a threshold (default: 0.1%), the verifier
        flags the discrepancy in the PSI ledger.
      </t>
    </section>
    <section anchor="public-verification-endpoint" title="Public Verification Endpoint">
      <t>
        Any party may verify a sealed disclosure via:
      </t>
      <artwork><![CDATA[
GET /api/v1/verify/{hash}
      ]]></artwork>
      <t>Response includes:</t>
      <ul>
        <li>match: true/false</li>
        <li>sealed_at: ISO 8601 timestamp</li>
        <li>source: URL of original filing</li>
        <li>recomputed_figures: JSON object</li>
        <li>signatures: { ed25519: valid/invalid, ml_dsa_65: valid/invalid }</li>
      </ul>
    </section>
  </section>

  <section anchor="ledger-structure" title="Ledger Structure">
    <t>The PSI ledger maintains a registry of sealed disclosures:</t>
    <artwork><![CDATA[
{
  "company_id": "UBER",
  "filing_type": "10-K",
  "fiscal_year": 2025,
  "sealed_at": "2026-03-15T10:30:00Z",
  "hash": "a3f2e8...",
  "source": "https://sec.gov/Archives/edgar/data/...",
  "signatures": {
    "ed25519": "base64-encoded-ed25519-signature",
    "ml_dsa_65": "base64-encoded-ml-dsa-65-signature"
  },
  "recomputed_at": "2026-08-09T20:40:00Z",
  "variance": 0.0003,
  "status": "verified"
}
    ]]></artwork>
  </section>

  <section anchor="api-endpoints" title="API Endpoints">
    <t>Five REST API endpoints are defined for the PSI ledger:</t>
    <artwork><![CDATA[
GET  /api/v1/companies                 List all companies with sealed disclosures
GET  /api/v1/companies/{ticker}/filings  Get all sealed filings for a company
GET  /api/v1/verify/{hash}               Verify a sealed disclosure hash
GET  /api/v1/ledger/stats                Total seals, companies, daily activity
POST /api/v1/seal                        Submit a new financial disclosure for sealing
    ]]></artwork>
    <t>
      The POST /api/v1/seal endpoint accepts a JSON body with company_id,
      filing_type, fiscal_year, document, and source_url.  It returns the
      seal hash and both signatures (Ed25519 and ML-DSA-65).
    </t>
  </section>

  <section anchor="commercial-reuse" title="Commercial Reuse">
    <t>
      The PSI ledger is free to read and cite.  Commercial reuse above
      1,000 rows per year requires a royalty agreement with Rockyfilms888
      Pty Ltd (ABN 71672237795).  Royalty tiers:
    </t>
    <table>
      <thead>
        <tr><th>Tier</th><th>Annual Row Threshold</th><th>Per-Row Fee (AUD)</th></tr>
      </thead>
      <tbody>
        <tr><td>A</td><td>&lt;= 1,000</td><td>Free</td></tr>
        <tr><td>B</td><td>1,001 - 100,000</td><td>$0.001</td></tr>
        <tr><td>C</td><td>&gt; 100,000</td><td>$0.0001 (negotiable)</td></tr>
      </tbody>
    </table>
    <t>
      Exemptions: Personal research, academic citation, journalism,
      public-interest reporting, and regulatory compliance audits.
    </t>
  </section>

  <section anchor="security-considerations" title="Security Considerations">
    <ul>
      <li>Sealed disclosures are immutable once recorded in the ledger.</li>
      <li>Ed25519 signatures prevent classical tampering.</li>
      <li>ML-DSA-65 signatures prevent quantum tampering.</li>
      <li>
        The hybrid dual-signature scheme ensures security against both
        classical and quantum adversaries.
      </li>
      <li>Public ledger ensures transparency and verifiability.</li>
      <li>Recomputation is deterministic and verifiable by any party.</li>
      <li>
        Private keys MUST be stored in hardware security modules (HSM)
        or equivalent secure enclaves.
      </li>
      <li>Signatures MUST be timestamped with a trusted time source.</li>
    </ul>
  </section>

  <section anchor="iana-considerations" title="IANA Considerations">
    <t>This document has no IANA actions.</t>
  </section>
</middle>

<back>
  <references>
    <name>References</name>
    <xi:include href="https://www.rfc-editor.org/refs/bibxml/reference.RFC.2119.xml"/>
    <xi:include href="https://www.rfc-editor.org/refs/bibxml/reference.RFC.8032.xml"/>
    <xi:include href="https://www.rfc-editor.org/refs/bibxml/reference.RFC.8174.xml"/>
    <xi:include href="https://www.rfc-editor.org/refs/bibxml/reference.RFC.8554.xml"/>
    <xi:include href="https://www.rfc-editor.org/refs/bibxml/reference.RFC.8785.xml"/>
    <reference anchor="FIPS204" target="https://csrc.nist.gov/pubs/fips/204/final">
      <front>
        <title>Module-Lattice-Based Digital Signature Standard</title>
        <author><organization>NIST</organization></author>
        <date month="August" year="2024"/>
      </front>
    </reference>
    <reference anchor="PSI04" target="https://datatracker.ietf.org/doc/draft-singh-apex-psi-04/">
      <front>
        <title>PSI-04: Evidentiary Document Integrity</title>
        <author initials="K." surname="Singh" fullname="Kawaljeet Singh">
          <organization>Apex Intelligence Empire</organization>
        </author>
        <date month="July" year="2026"/>
      </front>
    </reference>
  </references>
</back>

</rfc>