{ "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-16T14:13:51.913Z", "route_id": "agentic_pack_github_release_acceptance_v1", "question": "GitHub release acceptance evidence?", "answer": "Review whether approval and execution evidence is bound to the artifact being accepted. Five dated documentation reviews connect GitHub code-owner enforcement, skipped checks, reusable-workflow OIDC identity and artifact replacement with Cosign signer and digest verification. They preserve the buyer evidence still required for the exact revision and artifact. They do not approve a release, verify your configuration or certify software safety.", "records": [ { "record_id": "VXI-EXT-PROCUREMENT-CODEOWNERS-ENFORCEMENT-01-v1", "url": "/varexis-index/records/github-codeowners-matching-not-required-approval.json", "content_sha256": "442eb25bac190ab56283dfc32a33c86b6119f6ec1b9caa68633aa1627cf6c5aa", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-16T13:36:43.315Z", "record_id": "VXI-EXT-PROCUREMENT-CODEOWNERS-ENFORCEMENT-01-v1", "record_kind": "external_reference", "title": "GitHub CODEOWNERS: Matching and enforcement", "system": "GitHub", "evidence_family": "vendor_evidence_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Does a CODEOWNERS file prove the right owner must approve every change?", "near_questions": [ "Is code-owner review actually required?", "Which branch supplies CODEOWNERS?", "Are any lines invalid and skipped?", "Which matching pattern wins?", "Do named owners have repository access?", "Can an unknown team leave a file unowned?", "Does a file alone enforce review?", "Are sensitive paths matched correctly?", "Is the file below the documented size limit?", "Can the ownership file itself be changed?", "What evidence shows the required owner approved?", "Can I retain this ownership-control review?" ], "supported_claims": [ { "claim": "Code-owner review must be required through the applicable branch controls. Invalid lines are skipped, later matching patterns take precedence, and owners need suitable repository access. A file in the repository therefore does not prove complete matching or enforced review of the target branch.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent execution, completeness or security testing", "Vendor certification, legal compliance or guaranteed suitability" ], "public_summary": "Code-owner review must be required through the applicable branch controls. Invalid lines are skipped, later matching patterns take precedence, and owners need suitable repository access. A file in the repository therefore does not prove complete matching or enforced review of the target branch.", "related_record_ids": [], "source_review": { "source_type": "official_external_documentation", "source_title": "GitHub code owners", "source_url": "https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners", "checked_on": "2026-10-16", "candidate_record_id": "VXI-EXT-PROCUREMENT-CODEOWNERS-ENFORCEMENT-01-v1", "candidate_record_sha256": "6ddd478ecadbc6f163fc359c386aac9d0ce3163294e7fe631e809ef50e39247d", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "Code-owner review must be required through the applicable branch controls. Invalid lines are skipped, later matching patterns take precedence, and owners need suitable repository access. A file in the repository therefore does not prove complete matching or enforced review of the target branch.", "required_buyer_context": "Target branch, ownership file, matched paths, team access and review settings. Effective configuration and dated operational evidence have not been inspected.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "decision_profile": { "schema": "varexis-vendor-evidence-review/1", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "The presence of CODEOWNERS guarantees all changes receive mandatory owner approval.", "documented_statement": { "status": "documented", "statement": "Code-owner review must be required through the applicable branch controls. Invalid lines are skipped, later matching patterns take precedence, and owners need suitable repository access. A file in the repository therefore does not prove complete matching or enforced review of the target branch.", "source_ids": [ "codeowners" ] }, "buyer_evidence_required": [ "Target-branch CODEOWNERS version and syntax errors.", "Matched file patterns and owner access.", "Applicable required-review configuration." ], "review_condition": { "status": "varexis_review_policy", "statement": "Confirm matching and enforcement separately before asserting owner approval coverage." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.", "evidence_sources": [ { "source_id": "codeowners", "url": "https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners", "final_url": "https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners", "title": "GitHub code owners", "checked_on": "2026-10-16", "sha256": "f8d5a942d5e46368c818d3c3bd3098ac40fb6777e14b01fa7ac84ee752a9be3c", "bytes": 239490 } ], "observed_deployment": false, "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.", "paid_value": { "decision_context": "Save the versioned ownership and enforcement questions for release procurement.", "free": "Complete review, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "A saved purchase does not recheck the source or buyer configuration.", "specific_watch": "Target branch, ownership file, matched paths, team access and review settings." } }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#github-codeowners-matching-not-required-approval", "machine_readable_record": "/varexis-index/records/github-codeowners-matching-not-required-approval.json" } }, { "record_id": "VXI-EXT-PROCUREMENT-GITHUB-SKIPPED-CHECK-01-v1", "url": "/varexis-index/records/github-required-check-skipped-versus-executed.json", "content_sha256": "a7fab987ab8d14869ca99a7e9983c95c87f09888cb6943b1be60070e6af583fb", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-16T14:13:51.913Z", "record_id": "VXI-EXT-PROCUREMENT-GITHUB-SKIPPED-CHECK-01-v1", "record_kind": "external_reference", "title": "GitHub checks: Successful status and skipped execution", "system": "GitHub Actions", "evidence_family": "vendor_evidence_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Does a passing required GitHub check prove its test job actually ran?", "near_questions": [ "Was the job executed or skipped?", "What condition controlled execution?", "Can neutral satisfy this required check?", "Did path filtering skip the workflow?", "Why is a skipped workflow pending?", "Which commit was checked?", "Does the merge badge identify test output?", "Was a dependent job skipped after failure?", "What proves the required test ran?", "Are required checks named unambiguously?", "Does the evidence match the release revision?", "Can I save the execution review?" ], "supported_claims": [ { "claim": "Required checks accept success, skipped and neutral conclusions. A job skipped by a condition can report success, while a whole workflow skipped by path or branch filtering can remain pending. Review job execution and the applicable commit, not just the merge badge, before claiming a release passed a specific test.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent execution, completeness or security testing", "Vendor certification, legal compliance or guaranteed suitability" ], "public_summary": "Required checks accept success, skipped and neutral conclusions. A job skipped by a condition can report success, while a whole workflow skipped by path or branch filtering can remain pending. Review job execution and the applicable commit, not just the merge badge, before claiming a release passed a specific test.", "related_record_ids": [], "source_review": { "source_type": "official_external_documentation", "source_title": "GitHub: Troubleshooting required status checks", "source_url": "https://docs.github.com/en/pull-requests/how-tos/merge-and-close-pull-requests/troubleshooting-required-status-checks", "checked_on": "2026-10-16", "candidate_record_id": "VXI-EXT-PROCUREMENT-GITHUB-SKIPPED-CHECK-01-v1", "candidate_record_sha256": "5d6bbda466cfde11e8fd2ab77c42e9822a1928e0eabd7979201479cedcfd30a0", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "Required checks accept success, skipped and neutral conclusions. A job skipped by a condition can report success, while a whole workflow skipped by path or branch filtering can remain pending. Review job execution and the applicable commit, not just the merge badge, before claiming a release passed a specific test.", "required_buyer_context": "Branch rules, workflow version, check identity, conditions and commit-bound test output. Effective configuration and dated operational evidence have not been inspected.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "decision_profile": { "schema": "varexis-vendor-evidence-review/1", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "A green required-check badge proves test execution.", "documented_statement": { "status": "documented", "statement": "Required checks accept success, skipped and neutral conclusions. A job skipped by a condition can report success, while a whole workflow skipped by path or branch filtering can remain pending. Review job execution and the applicable commit, not just the merge badge, before claiming a release passed a specific test.", "source_ids": [ "github-checks" ] }, "buyer_evidence_required": [ "Required check identity and applicable commit.", "Job conditions, execution steps and conclusion.", "Test output bound to the accepted revision." ], "review_condition": { "status": "varexis_review_policy", "statement": "Require actual execution evidence before describing a skipped or neutral check as a passed test." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.", "evidence_sources": [ { "source_id": "github-checks", "url": "https://docs.github.com/en/pull-requests/how-tos/merge-and-close-pull-requests/troubleshooting-required-status-checks", "final_url": "https://docs.github.com/en/pull-requests/how-tos/merge-and-close-pull-requests/troubleshooting-required-status-checks", "title": "GitHub: Troubleshooting required status checks", "checked_on": "2026-10-16", "sha256": "c7956aa97a4a4ba6a3e625a3090d0c19655cfb29fe55d3c1953f7f58ce750d70", "bytes": 181140 } ], "observed_deployment": false, "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.", "paid_value": { "decision_context": "Preserve the difference between merge eligibility and demonstrated test execution.", "free": "Complete review, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "A saved purchase does not recheck the source or buyer configuration.", "specific_watch": "Branch rules, workflow version, check identity, conditions and commit-bound test output." } }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#github-required-check-skipped-versus-executed", "machine_readable_record": "/varexis-index/records/github-required-check-skipped-versus-executed.json" } }, { "record_id": "VXI-EXT-PROCUREMENT-GITHUB-OIDC-CALLER-01-v1", "url": "/varexis-index/records/github-oidc-reusable-workflow-caller-and-callee-identity.json", "content_sha256": "a328d34bfa53339c81c1938731f444eb6643633d5082efb5e6c17e6ee37ec475", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-16T14:13:51.913Z", "record_id": "VXI-EXT-PROCUREMENT-GITHUB-OIDC-CALLER-01-v1", "record_kind": "external_reference", "title": "OIDC workflows: Caller and reusable-job identity", "system": "GitHub Actions OIDC", "evidence_family": "vendor_evidence_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Does a valid GitHub OIDC token prove an approved reusable deployment workflow ran?", "near_questions": [ "Which claims describe the caller?", "What does job_workflow_ref identify?", "Does the provider support that claim?", "Is the expected workflow reference constrained?", "Is the audience checked?", "Does the subject include the intended boundary?", "Is the workflow pinned to a revision?", "Can another caller meet the policy?", "What proves the active cloud trust rule?", "Does token validity prove policy correctness?", "Were sensitive token values excluded from the review?", "Can I save the workflow-identity basis?" ], "supported_claims": [ { "claim": "For reusable workflows, ordinary workflow and ref claims describe the caller, while job_workflow_ref identifies the called workflow. Cloud trust policies must use the supported claim or subject conditions for the intended restriction. Token validity alone does not establish that the buyer configured an approved-workflow boundary.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent execution, completeness or security testing", "Vendor certification, legal compliance or guaranteed suitability" ], "public_summary": "For reusable workflows, ordinary workflow and ref claims describe the caller, while job_workflow_ref identifies the called workflow. Cloud trust policies must use the supported claim or subject conditions for the intended restriction. Token validity alone does not establish that the buyer configured an approved-workflow boundary.", "related_record_ids": [], "source_review": { "source_type": "official_external_documentation", "source_title": "GitHub: OIDC with reusable workflows", "source_url": "https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-with-reusable-workflows", "checked_on": "2026-10-16", "candidate_record_id": "VXI-EXT-PROCUREMENT-GITHUB-OIDC-CALLER-01-v1", "candidate_record_sha256": "a28ca699226897787db68c952227643a3aee6747b907a2debd51a6627a5354c2", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "For reusable workflows, ordinary workflow and ref claims describe the caller, while job_workflow_ref identifies the called workflow. Cloud trust policies must use the supported claim or subject conditions for the intended restriction. Token validity alone does not establish that the buyer configured an approved-workflow boundary.", "required_buyer_context": "Caller, reusable workflow revision, provider-supported claims and effective trust conditions. Effective configuration and dated operational evidence have not been inspected.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "decision_profile": { "schema": "varexis-vendor-evidence-review/1", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "A valid token proves the expected reusable workflow was authorized.", "documented_statement": { "status": "documented", "statement": "For reusable workflows, ordinary workflow and ref claims describe the caller, while job_workflow_ref identifies the called workflow. Cloud trust policies must use the supported claim or subject conditions for the intended restriction. Token validity alone does not establish that the buyer configured an approved-workflow boundary.", "source_ids": [ "github-oidc" ] }, "buyer_evidence_required": [ "Caller identity and called-workflow reference.", "Cloud-provider claim support and actual trust policy.", "Dated token-claim evidence with sensitive token material removed." ], "review_condition": { "status": "varexis_review_policy", "statement": "Check caller and callee restrictions separately before accepting workflow-specific cloud access." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.", "evidence_sources": [ { "source_id": "github-oidc", "url": "https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-with-reusable-workflows", "final_url": "https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-with-reusable-workflows", "title": "GitHub: OIDC with reusable workflows", "checked_on": "2026-10-16", "sha256": "fa44d8b0de334dfbfbeed91c71c8089bbbdfcafb52e17015a60d05c519df124f", "bytes": 323975 } ], "observed_deployment": false, "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.", "paid_value": { "decision_context": "Save the identity binding behind a deployment-credential decision.", "free": "Complete review, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "A saved purchase does not recheck the source or buyer configuration.", "specific_watch": "Caller, reusable workflow revision, provider-supported claims and effective trust conditions." } }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#github-oidc-reusable-workflow-caller-and-callee-identity", "machine_readable_record": "/varexis-index/records/github-oidc-reusable-workflow-caller-and-callee-identity.json" } }, { "record_id": "VXI-EXT-PROCUREMENT-GITHUB-ARTIFACT-IDENTITY-01-v1", "url": "/varexis-index/records/github-upload-artifact-overwrite-new-object-identity.json", "content_sha256": "06da1660b403cb8c98bc8e8f6925369eab1eb79cb6a79e029bafba9101f7474b", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-16T14:13:51.913Z", "record_id": "VXI-EXT-PROCUREMENT-GITHUB-ARTIFACT-IDENTITY-01-v1", "record_kind": "external_reference", "title": "Build artifacts: Names, replacement and object identity", "system": "GitHub Actions artifacts", "evidence_family": "vendor_evidence_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Does reusing an artifact name mean a later download contains the same approved build?", "near_questions": [ "Which artifact ID was approved?", "Was overwrite enabled?", "Did replacement create a new ID?", "Does the downloaded digest match?", "Which run produced the object?", "Which source revision was built?", "Can a name be reused?", "Is the approved object still retained?", "Does retention prove immutability?", "Was the action version recorded?", "What binds deployment to the approved object?", "Can I save the artifact-identity review?" ], "supported_claims": [ { "claim": "The upload-artifact documentation describes immutable artifacts and an overwrite option that deletes and replaces the named artifact with a new ID. A name alone is therefore not a durable identity. Bind acceptance to the artifact ID, digest and producing run, and distinguish retention availability from content identity.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent execution, completeness or security testing", "Vendor certification, legal compliance or guaranteed suitability" ], "public_summary": "The upload-artifact documentation describes immutable artifacts and an overwrite option that deletes and replaces the named artifact with a new ID. A name alone is therefore not a durable identity. Bind acceptance to the artifact ID, digest and producing run, and distinguish retention availability from content identity.", "related_record_ids": [], "source_review": { "source_type": "official_external_documentation", "source_title": "GitHub Actions: Upload artifact identity and replacement", "source_url": "https://raw.githubusercontent.com/actions/upload-artifact/main/README.md", "checked_on": "2026-10-16", "candidate_record_id": "VXI-EXT-PROCUREMENT-GITHUB-ARTIFACT-IDENTITY-01-v1", "candidate_record_sha256": "1747bbef6161aa4c8eec35812d2f74115f9ec4ab37130b4ced2d87f26f633d0d", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "The upload-artifact documentation describes immutable artifacts and an overwrite option that deletes and replaces the named artifact with a new ID. A name alone is therefore not a durable identity. Bind acceptance to the artifact ID, digest and producing run, and distinguish retention availability from content identity.", "required_buyer_context": "Action version, artifact ID, digest, producing run, revision and retention policy. Effective configuration and dated operational evidence have not been inspected.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "decision_profile": { "schema": "varexis-vendor-evidence-review/1", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "An unchanged artifact name proves unchanged build content.", "documented_statement": { "status": "documented", "statement": "The upload-artifact documentation describes immutable artifacts and an overwrite option that deletes and replaces the named artifact with a new ID. A name alone is therefore not a durable identity. Bind acceptance to the artifact ID, digest and producing run, and distinguish retention availability from content identity.", "source_ids": [ "github-artifact" ] }, "buyer_evidence_required": [ "Artifact ID and digest at approval.", "Producing run and source revision.", "Replacement history, retention and retrieved digest." ], "review_condition": { "status": "varexis_review_policy", "statement": "Do not accept name-only matching as proof that the downloaded artifact was approved." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.", "evidence_sources": [ { "source_id": "github-artifact", "url": "https://raw.githubusercontent.com/actions/upload-artifact/main/README.md", "final_url": "https://raw.githubusercontent.com/actions/upload-artifact/main/README.md", "title": "GitHub Actions: Upload artifact identity and replacement", "checked_on": "2026-10-16", "sha256": "82e3d7226dabea938b107b93e015aa816150d6894fff631064aa2884c26771f7", "bytes": 18601 } ], "observed_deployment": false, "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.", "paid_value": { "decision_context": "Preserve the artifact identity needed to compare approval with later retrieval.", "free": "Complete review, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "A saved purchase does not recheck the source or buyer configuration.", "specific_watch": "Action version, artifact ID, digest, producing run, revision and retention policy." } }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#github-upload-artifact-overwrite-new-object-identity", "machine_readable_record": "/varexis-index/records/github-upload-artifact-overwrite-new-object-identity.json" } }, { "record_id": "VXI-EXT-PROCUREMENT-COSIGN-EXPECTED-IDENTITY-01-v1", "url": "/varexis-index/records/cosign-verification-expected-signer-digest.json", "content_sha256": "19988069853d77d2a19cb8cc92277f3771faad10645e9921a3bdac0c7f00f949", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-16T13:36:43.315Z", "record_id": "VXI-EXT-PROCUREMENT-COSIGN-EXPECTED-IDENTITY-01-v1", "record_kind": "external_reference", "title": "Cosign verification: Expected signer and artifact", "system": "Sigstore Cosign", "evidence_family": "vendor_evidence_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Does any valid Cosign signature establish the supplier artifact we intended to accept?", "near_questions": [ "Which signer identity is expected?", "Which OIDC issuer is trusted?", "Does the signature bind the requested image digest?", "Were claim checks disabled?", "Does a valid key prove the intended supplier identity?", "Is this an image or a separate blob?", "Which bundle or signature was verified?", "Are identity patterns overly broad?", "Was the exact downloaded artifact checked?", "Does the signature assess software safety?", "What verification result should be retained?", "Can I save the artifact-acceptance boundary?" ], "supported_claims": [ { "claim": "Identity-based verification checks the expected certificate identity and OIDC issuer. Container verification normally checks the signed image digest; disabling claim checks changes what is established. A cryptographically valid signature without the intended identity and artifact binding is insufficient for the buyer acceptance decision.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent execution, completeness or security testing", "Vendor certification, legal compliance or guaranteed suitability" ], "public_summary": "Identity-based verification checks the expected certificate identity and OIDC issuer. Container verification normally checks the signed image digest; disabling claim checks changes what is established. A cryptographically valid signature without the intended identity and artifact binding is insufficient for the buyer acceptance decision.", "related_record_ids": [], "source_review": { "source_type": "official_external_documentation", "source_title": "Cosign verifying signatures", "source_url": "https://docs.sigstore.dev/cosign/verifying/verify/", "checked_on": "2026-10-16", "candidate_record_id": "VXI-EXT-PROCUREMENT-COSIGN-EXPECTED-IDENTITY-01-v1", "candidate_record_sha256": "eb763083d1aaf4bf754faefb1b65a0a6c2c7fd6d522750490779afc6a489a11b", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "Identity-based verification checks the expected certificate identity and OIDC issuer. Container verification normally checks the signed image digest; disabling claim checks changes what is established. A cryptographically valid signature without the intended identity and artifact binding is insufficient for the buyer acceptance decision.", "required_buyer_context": "Artifact identity, expected signer, issuer, bundle and verification options. Effective configuration and dated operational evidence have not been inspected.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "decision_profile": { "schema": "varexis-vendor-evidence-review/1", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "Any valid signature is enough to accept an artifact as the intended supplier release.", "documented_statement": { "status": "documented", "statement": "Identity-based verification checks the expected certificate identity and OIDC issuer. Container verification normally checks the signed image digest; disabling claim checks changes what is established. A cryptographically valid signature without the intended identity and artifact binding is insufficient for the buyer acceptance decision.", "source_ids": [ "sigstore" ] }, "buyer_evidence_required": [ "Expected signer identity and issuer.", "Artifact digest and signed payload.", "Verification flags and policy result." ], "review_condition": { "status": "varexis_review_policy", "statement": "Require the intended signer and artifact binding; do not treat signature validity as a safety assessment." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.", "evidence_sources": [ { "source_id": "sigstore", "url": "https://docs.sigstore.dev/cosign/verifying/verify/", "final_url": "https://docs.sigstore.dev/cosign/verifying/verify/", "title": "Cosign verifying signatures", "checked_on": "2026-10-16", "sha256": "cddc158241a16c414589b05f77674d24902660e61c722f9630414c16a753e298", "bytes": 73554 } ], "observed_deployment": false, "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.", "paid_value": { "decision_context": "Save the acceptance criteria and source version behind an artifact-origin review.", "free": "Complete review, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "A saved purchase does not recheck the source or buyer configuration.", "specific_watch": "Artifact identity, expected signer, issuer, bundle and verification options." } }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#cosign-verification-expected-signer-digest", "machine_readable_record": "/varexis-index/records/cosign-verification-expected-signer-digest.json" } } ], "basis": "A frozen compilation of existing public documentation reviews and their source bindings. No new source review, tool execution, independent experiment or buyer assessment was performed for this package.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material. The saved pack is not continually refreshed. Hashes bind its contents; the optional delivery receipt is unsigned.", "pack": { "schema": "varexis-index-evidence-pack/1", "pack_id": "github-release-acceptance", "version": "1.0.0", "title": "GitHub Release Acceptance — Approval, Execution & Artifact Identity", "prepared_at_utc": "2026-10-16T14:43:10.379Z", "review_status": "documentation_review_only", "source_checked_on": [ "2026-10-16" ], "source_capture_date": null, "source_capture_boundary": "Existing dated review and upstream hash metadata are preserved. No new source bytes were acquired for this compilation; separate capture timestamps and independently tested runtime versions are not established.", "summary_markdown": "# GitHub Release Acceptance — Approval, Execution & Artifact Identity\n\nUse this pack to prepare a GitHub supplier-release evidence review. Follow the chain from required review and actual job execution through workflow identity to the retrieved artifact and intended signer. A valid token, green badge, reused artifact name or valid signature answers only part of that question. No release is authorised by retrieving this pack.\n\n## GitHub CODEOWNERS: Matching and enforcement\nCode-owner review must be required through the applicable branch controls. Invalid lines are skipped, later matching patterns take precedence, and owners need suitable repository access. A file in the repository therefore does not prove complete matching or enforced review of the target branch.\n\nReviewed: 2026-10-16. Documentation review only.\n\nEvidence still needed: Target-branch CODEOWNERS version and syntax errors. Matched file patterns and owner access. Applicable required-review configuration.\n\n## GitHub checks: Successful status and skipped execution\nRequired checks accept success, skipped and neutral conclusions. A job skipped by a condition can report success, while a whole workflow skipped by path or branch filtering can remain pending. Review job execution and the applicable commit, not just the merge badge, before claiming a release passed a specific test.\n\nReviewed: 2026-10-16. Documentation review only.\n\nEvidence still needed: Required check identity and applicable commit. Job conditions, execution steps and conclusion. Test output bound to the accepted revision.\n\n## OIDC workflows: Caller and reusable-job identity\nFor reusable workflows, ordinary workflow and ref claims describe the caller, while job_workflow_ref identifies the called workflow. Cloud trust policies must use the supported claim or subject conditions for the intended restriction. Token validity alone does not establish that the buyer configured an approved-workflow boundary.\n\nReviewed: 2026-10-16. Documentation review only.\n\nEvidence still needed: Caller identity and called-workflow reference. Cloud-provider claim support and actual trust policy. Dated token-claim evidence with sensitive token material removed.\n\n## Build artifacts: Names, replacement and object identity\nThe upload-artifact documentation describes immutable artifacts and an overwrite option that deletes and replaces the named artifact with a new ID. A name alone is therefore not a durable identity. Bind acceptance to the artifact ID, digest and producing run, and distinguish retention availability from content identity.\n\nReviewed: 2026-10-16. Documentation review only.\n\nEvidence still needed: Artifact ID and digest at approval. Producing run and source revision. Replacement history, retention and retrieved digest.\n\n## Cosign verification: Expected signer and artifact\nIdentity-based verification checks the expected certificate identity and OIDC issuer. Container verification normally checks the signed image digest; disabling claim checks changes what is established. A cryptographically valid signature without the intended identity and artifact binding is insufficient for the buyer acceptance decision.\n\nReviewed: 2026-10-16. Documentation review only.\n\nEvidence still needed: Expected signer identity and issuer. Artifact digest and signed payload. Verification flags and policy result.\n\n## What payment adds\nThe entire pack is free to inspect or save locally. Single Request (GBP 5 plus applicable VAT) saves this complete version-bound JSON as one retrievable result. Evidence Receipt (GBP 19 plus applicable VAT) adds an unsigned delivery receipt. Eligible subscriptions use one query for the whole pack, not one per member. Keep the original access key and query reference for recovery; do not purchase again after uncertain payment.\n\n## Scope\nSource dates, documented claims, review considerations and unknowns remain distinct. No fresh investigation, buyer configuration test, certification, legal conclusion, continual refresh or permanent-retention commitment is included. Hashes bind content, not truth or independent assurance.\n", "comparison": [ { "record_id": "VXI-EXT-PROCUREMENT-CODEOWNERS-ENFORCEMENT-01-v1", "subject": "GitHub", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "The presence of CODEOWNERS guarantees all changes receive mandatory owner approval.", "documented_statement": { "status": "documented", "statement": "Code-owner review must be required through the applicable branch controls. Invalid lines are skipped, later matching patterns take precedence, and owners need suitable repository access. A file in the repository therefore does not prove complete matching or enforced review of the target branch.", "source_ids": [ "codeowners" ] }, "buyer_evidence_required": [ "Target-branch CODEOWNERS version and syntax errors.", "Matched file patterns and owner access.", "Applicable required-review configuration." ], "review_condition": { "status": "varexis_review_policy", "statement": "Confirm matching and enforcement separately before asserting owner approval coverage." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature." }, { "record_id": "VXI-EXT-PROCUREMENT-GITHUB-SKIPPED-CHECK-01-v1", "subject": "GitHub Actions", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "A green required-check badge proves test execution.", "documented_statement": { "status": "documented", "statement": "Required checks accept success, skipped and neutral conclusions. A job skipped by a condition can report success, while a whole workflow skipped by path or branch filtering can remain pending. Review job execution and the applicable commit, not just the merge badge, before claiming a release passed a specific test.", "source_ids": [ "github-checks" ] }, "buyer_evidence_required": [ "Required check identity and applicable commit.", "Job conditions, execution steps and conclusion.", "Test output bound to the accepted revision." ], "review_condition": { "status": "varexis_review_policy", "statement": "Require actual execution evidence before describing a skipped or neutral check as a passed test." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature." }, { "record_id": "VXI-EXT-PROCUREMENT-GITHUB-OIDC-CALLER-01-v1", "subject": "GitHub Actions OIDC", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "A valid token proves the expected reusable workflow was authorized.", "documented_statement": { "status": "documented", "statement": "For reusable workflows, ordinary workflow and ref claims describe the caller, while job_workflow_ref identifies the called workflow. Cloud trust policies must use the supported claim or subject conditions for the intended restriction. Token validity alone does not establish that the buyer configured an approved-workflow boundary.", "source_ids": [ "github-oidc" ] }, "buyer_evidence_required": [ "Caller identity and called-workflow reference.", "Cloud-provider claim support and actual trust policy.", "Dated token-claim evidence with sensitive token material removed." ], "review_condition": { "status": "varexis_review_policy", "statement": "Check caller and callee restrictions separately before accepting workflow-specific cloud access." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature." }, { "record_id": "VXI-EXT-PROCUREMENT-GITHUB-ARTIFACT-IDENTITY-01-v1", "subject": "GitHub Actions artifacts", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "An unchanged artifact name proves unchanged build content.", "documented_statement": { "status": "documented", "statement": "The upload-artifact documentation describes immutable artifacts and an overwrite option that deletes and replaces the named artifact with a new ID. A name alone is therefore not a durable identity. Bind acceptance to the artifact ID, digest and producing run, and distinguish retention availability from content identity.", "source_ids": [ "github-artifact" ] }, "buyer_evidence_required": [ "Artifact ID and digest at approval.", "Producing run and source revision.", "Replacement history, retention and retrieved digest." ], "review_condition": { "status": "varexis_review_policy", "statement": "Do not accept name-only matching as proof that the downloaded artifact was approved." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature." }, { "record_id": "VXI-EXT-PROCUREMENT-COSIGN-EXPECTED-IDENTITY-01-v1", "subject": "Sigstore Cosign", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "Any valid signature is enough to accept an artifact as the intended supplier release.", "documented_statement": { "status": "documented", "statement": "Identity-based verification checks the expected certificate identity and OIDC issuer. Container verification normally checks the signed image digest; disabling claim checks changes what is established. A cryptographically valid signature without the intended identity and artifact binding is insufficient for the buyer acceptance decision.", "source_ids": [ "sigstore" ] }, "buyer_evidence_required": [ "Expected signer identity and issuer.", "Artifact digest and signed payload.", "Verification flags and policy result." ], "review_condition": { "status": "varexis_review_policy", "statement": "Require the intended signer and artifact binding; do not treat signature validity as a safety assessment." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature." } ], "members": [ { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-16T14:13:51.913Z", "route_id": "agentic_reviewed_github_codeowners_matching_not_required_approval", "question": "Does a CODEOWNERS file prove the right owner must approve every change?", "answer": "Code-owner review must be required through the applicable branch controls. Invalid lines are skipped, later matching patterns take precedence, and owners need suitable repository access. A file in the repository therefore does not prove complete matching or enforced review of the target branch.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "3a2a98270db95985c1bef9ed96afe169839e821c44d6d6f9e9cc97352f2567fb", "record_ids": [ "VXI-EXT-PROCUREMENT-CODEOWNERS-ENFORCEMENT-01-v1" ] }, { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-16T14:13:51.913Z", "route_id": "agentic_reviewed_github_required_check_skipped_versus_executed", "question": "Does a passing required GitHub check prove its test job actually ran?", "answer": "Required checks accept success, skipped and neutral conclusions. A job skipped by a condition can report success, while a whole workflow skipped by path or branch filtering can remain pending. Review job execution and the applicable commit, not just the merge badge, before claiming a release passed a specific test.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "18d3bf9908821a3e1bb433ada3e6af76e71cf026398b53a9a0207fa8ba57be3a", "record_ids": [ "VXI-EXT-PROCUREMENT-GITHUB-SKIPPED-CHECK-01-v1" ] }, { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-16T14:13:51.913Z", "route_id": "agentic_reviewed_github_oidc_reusable_workflow_caller_and_callee_identity", "question": "Does a valid GitHub OIDC token prove an approved reusable deployment workflow ran?", "answer": "For reusable workflows, ordinary workflow and ref claims describe the caller, while job_workflow_ref identifies the called workflow. Cloud trust policies must use the supported claim or subject conditions for the intended restriction. Token validity alone does not establish that the buyer configured an approved-workflow boundary.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "fdd74f3fc760faccdbdd78e9a0191a02e6e3cb99f1f669549d6bf0ed8d5fdf97", "record_ids": [ "VXI-EXT-PROCUREMENT-GITHUB-OIDC-CALLER-01-v1" ] }, { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-16T14:13:51.913Z", "route_id": "agentic_reviewed_github_upload_artifact_overwrite_new_object_identity", "question": "Does reusing an artifact name mean a later download contains the same approved build?", "answer": "The upload-artifact documentation describes immutable artifacts and an overwrite option that deletes and replaces the named artifact with a new ID. A name alone is therefore not a durable identity. Bind acceptance to the artifact ID, digest and producing run, and distinguish retention availability from content identity.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "cf063b5209a5b628d3221e8344228885df0c78211f361ea1cf3f2fc83e0c3f37", "record_ids": [ "VXI-EXT-PROCUREMENT-GITHUB-ARTIFACT-IDENTITY-01-v1" ] }, { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-16T14:13:51.913Z", "route_id": "agentic_reviewed_cosign_verification_expected_signer_digest", "question": "Does any valid Cosign signature establish the supplier artifact we intended to accept?", "answer": "Identity-based verification checks the expected certificate identity and OIDC issuer. Container verification normally checks the signed image digest; disabling claim checks changes what is established. A cryptographically valid signature without the intended identity and artifact binding is insufficient for the buyer acceptance decision.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "4e0524e9333b4f719278b80ac5ff7259be3364ddfc284a1c35f3fd474748ff36", "record_ids": [ "VXI-EXT-PROCUREMENT-COSIGN-EXPECTED-IDENTITY-01-v1" ] } ], "rights_review": { "reviewed_on": "2026-10-16", "scope": "This exact public compilation of VAREXIS-authored review prose, factual identifiers, source links, dates and hashes.", "included": "Existing public VAREXIS review records and their limitations; an attributed comparison using the same documented findings.", "excluded": "Upstream documentation bodies, source code, screenshots, logos, private operator templates and protected evidence.", "redistribution_boundary": "Source links and hashes identify upstream material; they do not grant rights to redistribute that material. This package includes no upstream document bodies or code. Existing VAREXIS service terms apply to the supplied compilation.", "terms_url": "https://varexis.tech/checkout-terms", "independent_testing": false }, "delivery_unit": { "kind": "one_published_route", "member_count": 5, "developer_query_units": 1, "research_query_units": 1, "extra_member_purchases": false, "automatic_refresh": false } }, "snapshot_sha256": "8b86a5f6ae7575763b014b9c7d3e8543611dc8264de63e2a4e056e4131b89a0d" }