GHALVERA

SECURITY RESEARCH AND ENGINEERING MADRID / INDEPENDENT

We test what digital evidence can actually prove.

Ghalvera runs controlled security experiments to measure what records establish, what they leave open, and where a conclusion goes further than the evidence.

Working object
Evidentiary sufficiency
Method
Controlled experiments
Public state
Working hypothesis

The record can be true. The conclusion can still be false.

01 / MISSION

Clear questions.
Built evidence.

01

Research

Test the limits of security evidence.

02

Engineering

Build the systems and instruments those tests require.

03

Publish

Release findings with their evidence and limitations attached.

02 / RESEARCH AREAS

Where does the
evidence stop?

Each programme names the conclusion under pressure before an experiment begins.

  1. 01

    Authorization

    When does identity stop proving intent?

  2. 02

    Attribution

    When does a name stop identifying an actor?

  3. 03

    Completeness

    When does healthy logging stop meaning complete evidence?

  4. 04

    Consequence

    When does containment stop proving reversal?

03 / FEATURED RESEARCH

R-002RETROSPECTIVE MOTIVATING SPECIMENACCEPTED / 17 AUG 2026

AUDIT RETRIEVAL

Retrieval failure
is not absence.

The canonical query returned no matches and exited successfully. Reading the configured log explicitly recovered the records.

Read the finding

S-001 / OPEN PROTOCOL

Security Decision Invariance

When the transient process-to-action link disappears, does attribution remain defensible—or should the method refuse to answer?

NO_VERDICT ↗

04 / METHOD

A record is the
start of the test.

The loop produces evidence for a narrow judgment. It does not make the judgment by itself.

01

See

Did the event enter an evidence system?

02

Attribute

Which actor or authority does the record identify?

03

Retrieve

Can the evidence be checked independently?

05 / ENGINEERING

Some questions require
new instruments.

Software exists to make an experiment possible. Its limits remain part of the instrument.

01 / INSTRUMENT

ledger

Hash-chains appended research records.

Cannot detect end truncation or wholesale rewrite without an external anchor.
02 / INSTRUMENT

range

Runs controlled scenarios in owned guest systems.

Not a host sandbox; teardown failure leaves state unknown.
03 / INSTRUMENT

provenance

Extracts and checks npm provenance inputs.

Does not rebuild a package, prove authorization, or recover expired logs.
04 / PUBLIC PRODUCT

trace-npm ↗

Reports lifecycle-script files, processes and endpoints.

Not a sandbox, intent proof or package verdict.

06 / SELECTED PUBLIC RECORD

Research stays attached
to its limits.

A selection from the public record. Accepted work keeps its original treatment; open protocols do not become findings by appearing here.

View all research ↗
R-002

Audit retrieval

A successful empty query did not establish an empty record.

ACCEPTEDS-001

Security Decision Invariance

Prospective attribution protocol; no empirical finding.

NO_VERDICT
R-005

Provenance integrity and retrieval

Engineering precursor across the tested package sample.

ACCEPTED
R-006 / S0

Rebuild safety contract

Safety infrastructure only; no guest or rebuild result.

ACCEPTED

07 / THE LAB

Independent security research
and engineering in Madrid.

Ghalvera builds controlled experiments to understand what digital evidence can establish. Every target is owned or explicitly authorized, ground truth is preserved independently, and findings are published with their limitations.

Scope
Security evidence and the conclusions attached to it
Boundary
Owned or explicitly authorized environments only
Maturity
Working hypothesis; Foundation threshold not yet earned