What started as a single video watermarker is now a four-tool, in-browser media-provenance suite: mark, seal, scan, and verify — every byte processed locally, anchored to post-quantum signatures, distributed as one self-contained file. This is the post-audit revision (2026-06-25): the enterprise monorepo it proposed is built, the verifier and launcher ship, the PQC bundle is wired and proven, and the ephemeral proofs are now a permanent tests/ harness. What remains is a short, honest list.
Read top-down: what the user touches, the engine beneath it, the cryptographic provenance it anchors to, the brand it wears, and how it reaches the world. Each chip is a real artifact in the tree — colored by whether it ships today.
The honest count, grouped by domain. Engine modules are proven (headless BER/PSNR, scanner attack corpus, real-browser export). The duplication and the scattered tools are the structural debt.
invisible-mark.js — spread-spectrum luma markBER 0 · 45dBwatermark.js — visible logo + encode orchestrationH.264file-scanner.js — 8-daemon vuln swarm7/7 attacksuniversal-sealer.js — manifest + .epochsealAES-256seal-ui.js · stack-panel.jsUImp4-muxer.min.js · webcodecs-export.jsmediakem-envelope-client.js — ML-KEM-1024bundle wiredepochcore-api.js · receipt-drawer.jsprovenanceCombine Videos.htmlmergeVolume Splice.htmlaudioOne-Word Overlay.htmlcaptionFix Pronunciation.htmlaudioAuto-Merge Two.htmlseamcolors_and_type.css — two faces, one substratetokensui_kits/epochcore-app/ — App face8 jsxui_kits/epochpay-marketing/ — specimen11 jsx_shared/ — brand-mark, seed-lattice, palettesigilspreview/ — design-system cards29brand-kit/ — logo, icon, swarm sigil (SVG+PNG)7product-packs/ — 5 SMB coverspnglogos/ — IBM Business Partner lockups2animations/ — Atoms, Scenes, Runwayjsxscreenshots/ — proof captures4portable.html — self-contained, offline367KBWATERSEAL.json — 12-asset hash manifestsealedHANDOFF.md — propagation runbookdocepoch-core-worker — CF apex serve+verifygatedepochcore-pqc-crypto.js — noble esbuild bundlebuilt · testedThe fix for the structural debt: tools become apps/, engine modules become versioned packages/ (kills the duplication), the design system gets its own root, and the ephemeral proofs become a permanent tests/ harness. Color-coded by what exists vs. what to create.
epochcore-platform/ ├─ README.md # have ├─ VERSION.json # create — single source of build/version truth ├─ PLATFORM_ATLAS.html # this document │ ├─ apps/ # user-facing tools — each self-contained │ ├─ watermarker/ # have — video mark + seal │ ├─ sealer/ # partial — currently fused into watermarker; split out │ ├─ verifier/ # have — live at /verifier (seal verdict + mark recovery) │ ├─ merge/ # have — combine · splice · overlay · pronounce · auto-merge │ └─ launcher/ # have — live at /launcher (routes to every tool) │ ├─ packages/ # proposed — modules currently vendored per-app + in tests/engine (kept by design) │ ├─ crypto/ │ │ ├─ invisible-mark.js # have │ │ ├─ kem-envelope-client.js # have — wired │ │ ├─ epochcore-pqc-crypto.js # have — vetted noble bundle (esbuild), round-trip tested │ │ └─ harmonic-cell-mark.js # have — audio diff-QIM, gain-invariant, proven │ ├─ provenance/ │ │ ├─ epochcore-api.js # have — QPC/WORM client (de-dupe from merge2) │ │ ├─ universal-sealer.js # have │ │ └─ receipt-drawer.js # have │ ├─ security/ │ │ └─ file-scanner.js # have — 8-daemon swarm │ ├─ media/ │ │ ├─ webcodecs-export.js # have │ │ └─ mp4-muxer.min.js # have — local, no CDN │ └─ ui/ │ └─ stack-panel.js # have │ ├─ design-system/ # have — promote to first-class root │ ├─ colors_and_type.css # canonical tokens — never re-derive │ ├─ ui_kits/ # app + marketing + _shared │ ├─ brand-kit/ # logo · icon · swarm sigil │ └─ preview/ # 29 design-system cards │ ├─ tests/ # have — permanent, re-runnable (npm test → 4/4) │ ├─ invisible-mark.spec.cjs # PSNR 42.4 · Tier-A/B BER · wrong-seed │ ├─ audio-mark.spec.cjs # SNR 31 · BER 0 · gain-invariant · wrong-seed │ ├─ file-scanner.spec.cjs # 7/7 attack corpus · benign-clean │ ├─ kem-envelope.spec.cjs # ML-KEM round-trip + tamper-reject │ └─ engine/ # canonical engine modules, now in git │ ├─ dist/ # built portable artifacts + WATERSEAL.json ├─ infra/ # epoch-core-worker + flash-sync (local agent's domain) └─ docs/ # consolidate ├─ HANDOFF.md # have ├─ ARCHITECTURE.md # have — the layer map, in prose ├─ THREAT_MODEL.md # have — what the marks/seals do and don't defend └─ ATLAS_AUDIT.md # have — this revision's findings table
The 2026-06-25 audit (docs/ATLAS_AUDIT.md) checked every gap below against disk. Eight are closed or resolved — verifier and launcher ship, the PQC bundle is built/wired/tested, apps are on-brand, the proofs are a permanent tests/ harness (4/4), the audio mark is proven, and the font caveat was a decision. One was a deliberate decision (vendoring). The last integration step — wiring the proven audio mark into the live watermarker — is now shipped (drop audio at /watermarker → marked + sealed). Nothing core remains.
Shipped. A first-class verifier is live at /verifier: drop a file + its .epochseal → SHA + signature verdict; drop a watermarked video → recover the invisible mark. Runs entirely in-browser, render-verified.
Shipped. /launcher is the single home — "Mark, seal, caption, and prove it's yours" — routing to watermarker+sealer, captions, verifier, avatar, content-authenticity, the worm maze, this atlas, and the five video utilities. Render-verified.
Built and wired. epochcore-pqc-crypto.js is a vetted @noble/post-quantum ML-KEM-1024 esbuild bundle; the modular watermarker <script>-loads it alongside kem-envelope-client.js (no longer inert). Full KEM→HKDF→wrap round-trip + tamper-reject proven in tests/kem-envelope.spec.cjs.
Resolved. The monorepo apps already render in canonical Swarm Violet #7d5bf4 — the ad-hoc gold palette survives only in the legacy flat tree. Every apps/*/tokens/colors.css sources the violet App face.
Done. npm test runs four re-runnable specs (4/4): invisible-mark PSNR 42.4 dB + Tier-A/B BER, the audio harmonic-cell mark (gain-invariant, BER 0), the file-scanner 7/7 attack corpus, and the ML-KEM round-trip — exercising the real engine modules, now version-controlled under tests/engine/.
Not a gap. Each app deliberately vendors its shared layer so ../../ references resolve when served at / as a Cloudflare static-asset Worker. Import-once packages/ would require a bundler step that breaks that model — so vendoring is documented as intentional, not promoted.
Proven. A geometric-resync Tier B recovers the mark through a simulated hostile transcode (downscale → blur/quant/noise → re-up → 6px crop) where Tier A fails — BER 0.000 vs 0.333, verified in tests/invisible-mark.spec.cjs. The WASM-DCT + sync-template path is now an optional upgrade, not a gap.
Done — engine + UI. harmonic-cell-mark.js is a real audio mark (differential-QIM on log-frequency band pairs, gain-invariant), proven in tests/audio-mark.spec.cjs (SNR 31 dB, BER 0, BER 0 after ×0.5/×0.25/×0.1 gain). Now wired into the live watermarker: drop a standalone .wav/.mp3/.flac → it is inaudibly marked, self-verified before emit, and sealed through the same WORM chain as video. Live at /watermarker.
Not a gap. The "Geist" caveat was an earlier design iteration; the shipped design system deliberately uses Newsreader as its serif face (tokens/fonts.css "PRIMARY … Newsreader"; BrandLogo.jsx renders --font-serif). No Geist files exist and none are wanted — the wordmark is intentional, not a fallback.