Tessera
served-script evidence · synthetic specimen · scale 1:1
- Sheet
- DEMO-6.4.3
- Rev
- C
- Process
- Diazo / NH₃
- Scale
- 1:1
- Origin
- shop.example / synthetic
PCI DSS 4.0.1 · REQUIREMENT 6.4.3
Prove what your payment page is running.
- NOTE 1
A free static inventory of served scripts, resolved hosts, observed integrity, and your authorization decisions. No account. No card details.
Submit only a page you own or are authorized to inspect. The next view runs the bounded check without putting your target in the address bar. Behind a cart or login? The full reader also accepts deliberately pasted served source.
- Masking strip. Withdraws right as the sheet develops. The value beneath it was printed first — the strip only ever hid it.
- Revision cloud. Marks a line changed since the last examination.
- Chain link. Draws when an examination is sealed and added to the ledger.
| Rev | Description | Date |
|---|---|---|
| A | Synthetic sheet issued. Six example references drawn. | EXAMPLE |
| B | Example authorized-host list supplied; column 5 populated. | EXAMPLE |
| C | Example line 03 clouded in B‑3 — host absent from the synthetic list. | EXAMPLE |
Illustrative seal.
Not customer evidence.
- EXAMPLE 01 Synthetic sheet issued. Six references drawn. demo-a1
- EXAMPLE 02 Synthetic authorized-host list supplied. demo-b2
- EXAMPLE 03 Example line 03 clouded and sealed. demo-c3 · tip
Schedule A — synthetic served scripts
Illustrative data · static read · no execution
| No. | Served referenceas written in the served document | Resolved hostfrom the served reference | Observed integritySRI attribute | Authorizationmerchant decision |
|---|---|---|---|---|
| 01 | /assets/checkout.js | shop.example | NOT OBSERVED | AUTHORIZED |
| 02 | https://js.stripe.com/v3/ | js.stripe.com | NOT OBSERVED | AUTHORIZED |
| 03 | https://cdn.hotjar.com/hotjar-3.min.js | cdn.hotjar.com | NOT OBSERVED | UNAUTHORIZED |
| 04 | https://www.googletagmanager.com/gtm.js | googletagmanager.com | NOT OBSERVED | AUTHORIZED |
| 05 | inline script block | — | NOT ASSESSED | NOT ASSESSED |
| 06 | /assets/analytics.js | shop.example | OBSERVED | AUTHORIZED |
- †
- Example line 03, zone B‑3. In this synthetic specimen, cdn.hotjar.com is present and absent from the supplied example authorization list. Your result is drawn only from the authorized page or source you submit.
6 references inventoried 1 unauthorized 1 not assessed 1 integrity attribute observed
General notes
- 2.
- Integrity is reported as observed or not observed, never as pass or fail. A missing attribute is a fact about the page, not a verdict about the merchant.
- 3.
- Line 05 is not assessed. An inline block has no host to resolve and no integrity attribute to read, so the sheet says so rather than inventing a row that reads clean.
- 4.
- Authorization is your decision, recorded here. Tessera resolves the host and asks. It does not rank vendors or score your site.
- 5.
- The free check does not store its result. The paid 11.6.1 ledger separately re-evaluates every 72 hours and retains successful observations as a hash-chained record.
- Drawing title
- Served-script inventory & authorization schedule
- Drawn by
- Tessera static reader
PCI DSS v4.0.1 - Examined by
- Sign at assessment
- Chain tip
- DEMO-C3
synthetic - Sheet / rev
- DEMO-6.4.3 / C
1 of 1
SCHEDULE C
This sheet, read by the reader that drew it
0 script elements on this sheet — 0 inline, 0 served from a resolved host, 0 with an integrity attribute observed. Content-Security-Policy meta element observed.
Tessera sells proof of which scripts a page serves, so this page is built to survive its own audit. The development sequence above is CSS keyframes, the stamp is drawn geometry, and the rosette is computed from a hypotrochoid rather than traced — none of which needs a script element. Run the free check against this URL and the numbers on the line above are what you will get back.
Schedule D — after the free observation
Exact public prices · checkout opens only when delivery is ready
| Evidence rail | Price | Delivery | Inspect first |
|---|---|---|---|
| PCI DSS 6.4.3 remediation pack | $299 once | Written remediation pack after checkout | Synthetic pack |
| PCI DSS 5.4.1 email pack | $99 once | Written SPF, DKIM, and DMARC pack after checkout | Synthetic pack |
| PCI DSS 11.6.1 evidence ledger | $99 / month | Re-evaluation every 72 hours; hash-chained ledger | Synthetic ledger |
Toledo Technologies LLC operates Tessera. Polar handles payments and receipts as merchant of record. Eligible paid orders automatically refund if no complete initial delivery arrives within 48 hours; a ledger subscription’s renewal is also stopped. A checkout link appears after an applicable result only when billing, delivery, refunds, retention, and required scheduled jobs are ready. Read the enforced refund policy or contact qi@toledotechnologies.com.
Schedule B — ink & stock
Contrast measured against the surface each ink sits on
Sepia is spent on revisions and the stamp, and on nothing else — not a link, not a hover, not a price — so that when a real finding arrives the colour still means something. Measured in the release frame, it is 9.6 % of the drawn ink; a release gate fails the build above 20 %, because a restraint nobody counts is not a restraint. Two line weights are drawn, 1px and 2px. Set in Archivo (SIL OFL 1.1) at width 84–92 for drawn lettering, IBM Plex Mono (SIL OFL 1.1) for every recorded value, and Libre Franklin (SIL OFL 1.1) for notes — all three embedded in the document with metric-matched local fallbacks and no remote font request. Stock fibre is an embedded grayscale texture multiplied over the sheet colour; the stamp’s dry ink and the guilloche are generated, not drawn by hand. Nothing on this sheet loops, and it reaches a complete still state after its finite opening sequence.