VAREXIS-INDEX · Free decision guide
Software Artifact Acceptance Evidence
An image has attached signatures or provenance, yet an incomplete inventory, an unverified digest or a relaxed trust policy can leave its acceptance unsupported.
For: Software consumers and release reviewers assessing artifact identity, attachment coverage and effective trust policy.
Your decision: Decide whether the collected artifact identity, evidence attachments and effective verification policy support the intended acceptance statement, or which missing checks must remain explicit.
Evidence to bring
Registry and fully qualified repository; expected digest and retrieved bytes; complete referrer responses; attachment types; verifier version, effective trust policy, accepted signer and individual validation results. Do not provide signing keys or private build data to public MCP.
- Bind artifact evidence to the intended repository and verified content digest.
- Resolve referrer pagination and fallback before asserting evidence completeness.
- Inspect the selected trust policy, overrides and individual signature outcomes.
- Keep technical acceptance distinct from safety claims; optionally reconcile the declared audit chain locally.
What this evidence supports
The selected specifications separate content integrity from publisher trust, attachment discovery from endorsement, and policy acceptance from every validation passing. Pinned Notary specification snapshots describe requirements, not tested behavior of your installed verifier.
What remains unestablished
This guide does not verify signatures, certify software, test deployment compatibility or approve a release. A digest identifies bytes; associations and policy labels do not independently establish safety, authority or complete verification.
Read the source evidence
These 8 existing records are free. Review the source version and limitations before applying a finding to your decision.
Does a valid OCI descriptor establish trustworthy downloaded content
Verify byte size and digest before consuming untrusted content.
Original source · Reviewed 2026-10-29. Full provenance and limitations are retained in the evidence record JSON.
Exact agent access and integrity
- Connector
https://varexis.tech/mcp/catalogue- Tool
get_publication_record- Arguments
{"record_id":"VXI-EXT-ICE07-OCI-DESCRIPTOR-SIZE-DIGEST-BEFORE-CONSUMPTION-01-v1"}- Record identifier
VXI-EXT-ICE07-OCI-DESCRIPTOR-SIZE-DIGEST-BEFORE-CONSUMPTION-01-v1- SHA-256
4e7ce2dca5d312a7835f024e4bab6f229015d53c75f3d4e6a2c0bc067cd9a88c
Does the first OCI referrers response contain every evidence attachment
Resolve all continuation pages for the evidence inventory.
Original source · Reviewed 2026-10-29. Full provenance and limitations are retained in the evidence record JSON.
Exact agent access and integrity
- Connector
https://varexis.tech/mcp/catalogue- Tool
get_publication_record- Arguments
{"record_id":"VXI-EXT-ICE07-OCI-REFERRERS-PAGINATION-COMPLETENESS-01-v1"}- Record identifier
VXI-EXT-ICE07-OCI-REFERRERS-PAGINATION-COMPLETENESS-01-v1- SHA-256
c68fd85af15b922d2be4d0536c72828613cd738d6351ccbb7ca8bea1b2d97bce
Does a referrers API 404 prove no OCI evidence exists
Distinguish unsupported API discovery from absent attachments.
Original source · Reviewed 2026-10-29. Full provenance and limitations are retained in the evidence record JSON.
Exact agent access and integrity
- Connector
https://varexis.tech/mcp/catalogue- Tool
get_publication_record- Arguments
{"record_id":"VXI-EXT-ICE07-OCI-REFERRERS-404-FALLBACK-BOUNDARY-01-v1"}- Record identifier
VXI-EXT-ICE07-OCI-REFERRERS-404-FALLBACK-BOUNDARY-01-v1- SHA-256
3065eeced1ecff2f19f01b72f8e70b44907d4ce892aa4de3cad8edc45c89b9c7
Does an OCI subject field approve the referenced artifact
Treat subject linkage as association, not approval.
Original source · Reviewed 2026-10-29. Full provenance and limitations are retained in the evidence record JSON.
Exact agent access and integrity
- Connector
https://varexis.tech/mcp/catalogue- Tool
get_publication_record- Arguments
{"record_id":"VXI-EXT-ICE07-OCI-SUBJECT-WEAK-ASSOCIATION-NOT-ENDORSEMENT-01-v1"}- Record identifier
VXI-EXT-ICE07-OCI-SUBJECT-WEAK-ASSOCIATION-NOT-ENDORSEMENT-01-v1- SHA-256
35c91ca1985607da9dd2599d84fde7f5d430164d429116da1370f8175772ccd1
Does a Notary policy pass mean every signature check passed
Record which checks were enforced or only logged.
Original source · Reviewed 2026-10-29. Full provenance and limitations are retained in the evidence record JSON.
Exact agent access and integrity
- Connector
https://varexis.tech/mcp/catalogue- Tool
get_publication_record- Arguments
{"record_id":"VXI-EXT-ICE07-NOTARY-VERIFICATION-LEVEL-ENFORCEMENT-01-v1"}- Record identifier
VXI-EXT-ICE07-NOTARY-VERIFICATION-LEVEL-ENFORCEMENT-01-v1- SHA-256
95d90604f35f180bc08e4b2c0e3a7f8889865d7702a6f004cdda47c651def1bc
Does the Notary strict label establish the effective verification policy
Inspect overrides rather than trusting the level name.
Original source · Reviewed 2026-10-29. Full provenance and limitations are retained in the evidence record JSON.
Exact agent access and integrity
- Connector
https://varexis.tech/mcp/catalogue- Tool
get_publication_record- Arguments
{"record_id":"VXI-EXT-ICE07-NOTARY-CUSTOM-OVERRIDES-CHANGE-ASSURANCE-01-v1"}- Record identifier
VXI-EXT-ICE07-NOTARY-CUSTOM-OVERRIDES-CHANGE-ASSURANCE-01-v1- SHA-256
877123276ee6ac3fe4c601f3781ec638cd0ac624a616630da057ad54b5cfbfc5
Does a global Notary policy govern every artifact repository
Resolve the exact repository policy before a global fallback.
Original source · Reviewed 2026-10-29. Full provenance and limitations are retained in the evidence record JSON.
Exact agent access and integrity
- Connector
https://varexis.tech/mcp/catalogue- Tool
get_publication_record- Arguments
{"record_id":"VXI-EXT-ICE07-NOTARY-EXACT-REPOSITORY-POLICY-PRECEDENCE-01-v1"}- Record identifier
VXI-EXT-ICE07-NOTARY-EXACT-REPOSITORY-POLICY-PRECEDENCE-01-v1- SHA-256
c6213e5328dcafa29a45f45c11afb614c7e13a2473644cc5ddff45498c77f665
Does Notary artifact success validate every attached signature
Identify the accepted signature without claiming every signature passed.
Original source · Reviewed 2026-10-29. Full provenance and limitations are retained in the evidence record JSON.
Exact agent access and integrity
- Connector
https://varexis.tech/mcp/catalogue- Tool
get_publication_record- Arguments
{"record_id":"VXI-EXT-ICE07-NOTARY-ONE-VALID-SIGNATURE-NOT-ALL-01-v1"}- Record identifier
VXI-EXT-ICE07-NOTARY-ONE-VALID-SIGNATURE-NOT-ALL-01-v1- SHA-256
0e5e7d99c599488a3d8f639a61b6dea546ba9790abad252fa40a862b2cd25004
Connect an evidence client
Configure the two existing MCP connectors, then use the endpoint and arguments shown for each record. The original /mcp provides its frozen search and previews; /mcp/catalogue provides bounded browsing and exact access to additional published records. They are separate tool contracts, not interchangeable connections.
Canonical decision-guide JSON: records, provenance, hashes and checker selection. Enhanced natural-language search remains on HOLD. Keep credentials and private declarations local; public MCP supplies evidence and does not run licensed analysis.
When a local checker helps
Perform cryptographic and registry checks with the appropriate trusted tooling. Audit Coverage is optional only for supported declarations describing the resulting evidence chain; it is not a Notation, Cosign or OCI verifier and this guide adds no such capability.
The free records explain documented boundaries and the evidence to collect. The optional existing Audit Coverage licence adds repeatable local analysis of supported supplied event declarations, chain gaps and completeness findings. It does not inspect a provider account or establish that a reported event really occurred.
Agent Audit & Evidence Coverage
£79 + VAT · One-time internal-use licence. Separate from saved evidence and subscriptions. VAT is confirmed at checkout.
Supplied inputs: JSON declarations of identity, authorisation, action and outcome events, invocation references, and capture, retention, export and recovery coverage for supported source profiles.
Local results: Structured event-chain gaps, conflicting references and review requirements, with source and content hashes.
Synthetic demonstration: An outcome cannot be connected to its declared parent event. Resolve the missing reference before relying on the chain.
Assesses supplied declarations only; no independent live-system testing, runtime enforcement, certification, verified deletion or settlement.
Read the free demonstration and licence terms · Review purchase — £79 + VAT · Existing product details
A free record supplies documented evidence. A licensed checker performs reusable local analysis of supported customer-supplied declarations. Full operational schemas, runnable examples and executable archives accompany the existing licensed package. These examples are concise synthetic excerpts, not complete operational inputs or analyses. No runtime enforcement, live-system verification or certification is supplied. Compare existing prices · Checkout and recovery terms.
Original evidence-pack section · Choose another decision guide
