{
  "schema": "varexis-index-publication-manifest/1",
  "version": "pub-2-tranche-52-v1",
  "baseline_commit": "5406a5cced32b6c06d3187e51f8f32a0d6e04086",
  "tranches": [
    "public-safe-tranche-52"
  ],
  "record_count": 29,
  "route_count": 29,
  "complete": true,
  "next_page": null,
  "lookup": "Enumerate this complete manifest; compare record_id or route_id for exact equality and fetch its listed HTTPS JSON URL. Never infer a URL or fall back to related evidence for an unknown ID.",
  "boundary": "Catalogue additions are available free through the exact HTTP JSON links below. Enhanced natural-language discovery is not yet qualified for these records. They are outside MCP search, MCP preview and paid saved retrieval. No search qualification, executable capability or entitlement is added.",
  "records": [
    {
      "record_id": "VXI-EXT-PROCUREMENT-SPIFFE-JWT-JTI-REPLAY-BOUNDARY-01-v1",
      "route_id": "agentic_reviewed_spiffe_jwt_jti_replay_boundary",
      "title": "SPIFFE token replay and uniqueness",
      "question": "Does a JWT-SVID jti claim make a SPIFFE workload token single-use?",
      "record_url": "/varexis-index/records/spiffe-jwt-jti-replay-boundary.json",
      "record_sha256": "bd7fe3bfccc067fe3c689152002770a4f461f1777921ad47ec7aae6d646bf004",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_spiffe_jwt_jti_replay_boundary.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-SPIFFE-JWT-JTI-REPLAY-BOUNDARY-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/spiffe/spiffe/49a9cbbc018c39ec6643ad3301632f9f4549258b/standards/JWT-SVID.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-SPIFFE-X509-MULTIPLE-URI-REJECTION-01-v1",
      "route_id": "agentic_reviewed_spiffe_x509_multiple_uri_rejection",
      "title": "SPIFFE identity ambiguity in certificates",
      "question": "Can an X509-SVID with two URI SAN identities be accepted if its certificate chain verifies?",
      "record_url": "/varexis-index/records/spiffe-x509-multiple-uri-rejection.json",
      "record_sha256": "175f0d11949594c9fe26ad381189c92067757fbbb8a5a45fbd2df30bacc574d6",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_spiffe_x509_multiple_uri_rejection.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-SPIFFE-X509-MULTIPLE-URI-REJECTION-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/spiffe/spiffe/49a9cbbc018c39ec6643ad3301632f9f4549258b/standards/X509-SVID.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-SPIFFE-SIGNING-CERTIFICATE-NOT-WORKLOAD-01-v1",
      "route_id": "agentic_reviewed_spiffe_signing_certificate_not_workload",
      "title": "SPIFFE signing authority versus caller identity",
      "question": "Can a SPIFFE CA signing certificate authenticate as the workload it issues credentials for?",
      "record_url": "/varexis-index/records/spiffe-signing-certificate-not-workload.json",
      "record_sha256": "3c761098f88c8e9b9d134c40642cd3d69d6d98753d5a22be8b82549787758ab3",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_spiffe_signing_certificate_not_workload.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-SPIFFE-SIGNING-CERTIFICATE-NOT-WORKLOAD-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/spiffe/spiffe/49a9cbbc018c39ec6643ad3301632f9f4549258b/standards/X509-SVID.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-SPIFFE-STREAM-REDACTION-REPLACES-CACHE-01-v1",
      "route_id": "agentic_reviewed_spiffe_stream_redaction_replaces_cache",
      "title": "SPIFFE streamed identity withdrawal",
      "question": "Should a workload keep an old SPIFFE bundle when a later API response omits it?",
      "record_url": "/varexis-index/records/spiffe-stream-redaction-replaces-cache.json",
      "record_sha256": "75a12d9d27f51c65e8b73b1aa96ddc2451c1cbd79bb560d001c6384b83ecf2a8",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_spiffe_stream_redaction_replaces_cache.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-SPIFFE-STREAM-REDACTION-REPLACES-CACHE-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/spiffe/spiffe/49a9cbbc018c39ec6643ad3301632f9f4549258b/standards/SPIFFE_Workload_API.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-SPIFFE-FEDERATION-DOMAIN-BUNDLE-BINDING-01-v1",
      "route_id": "agentic_reviewed_spiffe_federation_domain_bundle_binding",
      "title": "SPIFFE federation endpoint binding",
      "question": "Does a downloaded SPIFFE trust bundle identify which trust domain it is authorized to represent?",
      "record_url": "/varexis-index/records/spiffe-federation-domain-bundle-binding.json",
      "record_sha256": "ca84e2a7c75037b69da8b7087fe4584868d5f8a72f69bd599f1ff529490784cf",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_spiffe_federation_domain_bundle_binding.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-SPIFFE-FEDERATION-DOMAIN-BUNDLE-BINDING-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/spiffe/spiffe/49a9cbbc018c39ec6643ad3301632f9f4549258b/standards/SPIFFE_Federation.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-SPIFFE-FEDERATION-KEY-ROTATION-ORDER-01-v1",
      "route_id": "agentic_reviewed_spiffe_federation_key_rotation_order",
      "title": "SPIFFE federation key rollout",
      "question": "Can a new SPIFFE signing key be used before foreign verifiers can fetch its bundle?",
      "record_url": "/varexis-index/records/spiffe-federation-key-rotation-order.json",
      "record_sha256": "cdf4b1521306b35aef193e53f7e2c3dd5a32450600f571af75011381b666e69d",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_spiffe_federation_key_rotation_order.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-SPIFFE-FEDERATION-KEY-ROTATION-ORDER-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/spiffe/spiffe/49a9cbbc018c39ec6643ad3301632f9f4549258b/standards/SPIFFE_Federation.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-SPIFFE-FILESYSTEM-SINGLE-READ-ROTATION-01-v1",
      "route_id": "agentic_reviewed_spiffe_filesystem_single_read_rotation",
      "title": "SPIFFE filesystem key and certificate consistency",
      "question": "Can separate file reads load a mismatched SPIFFE private key and certificate despite atomic rotation?",
      "record_url": "/varexis-index/records/spiffe-filesystem-single-read-rotation.json",
      "record_sha256": "ddebb07a6e87d759ecb412679fb37f594fd13b6ec3bb502302bc36b2461aad62",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_spiffe_filesystem_single_read_rotation.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-SPIFFE-FILESYSTEM-SINGLE-READ-ROTATION-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/spiffe/spiffe/49a9cbbc018c39ec6643ad3301632f9f4549258b/standards/SPIFFE_Filesystem_Delivery.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-SPIFFE-FILESYSTEM-EMPTY-REDACTION-01-v1",
      "route_id": "agentic_reviewed_spiffe_filesystem_empty_redaction",
      "title": "SPIFFE filesystem withdrawal signals",
      "question": "Does an empty SPIFFE credential file mean the client should keep its last cached identity?",
      "record_url": "/varexis-index/records/spiffe-filesystem-empty-redaction.json",
      "record_sha256": "131564b5290036706cd8a70bbeed71bc4d760d014342c5d6d4d0196f7cd67f18",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_spiffe_filesystem_empty_redaction.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-SPIFFE-FILESYSTEM-EMPTY-REDACTION-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/spiffe/spiffe/49a9cbbc018c39ec6643ad3301632f9f4549258b/standards/SPIFFE_Filesystem_Delivery.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-OPENFGA-MODEL-ID-PINNING-01-v1",
      "route_id": "agentic_reviewed_openfga_model_id_pinning",
      "title": "OpenFGA authorization model selection",
      "question": "Can an OpenFGA authorization check change when the request omits authorization_model_id?",
      "record_url": "/varexis-index/records/openfga-model-id-pinning.json",
      "record_sha256": "617aa5da2fcce7a2d8be75d421b030b4b41009a52477c7cc0e990fc8e10ff064",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_openfga_model_id_pinning.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-OPENFGA-MODEL-ID-PINNING-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/openfga/openfga.dev/fb5359796e1e1027985675cfdd2413e6dcbfdf5d/docs/content/getting-started/immutable-models.mdx",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-OPENFGA-RELATION-RENAME-MIGRATION-01-v1",
      "route_id": "agentic_reviewed_openfga_relation_rename_migration",
      "title": "OpenFGA model and tuple migration",
      "question": "Does publishing a renamed relation in OpenFGA migrate existing relationship tuples automatically?",
      "record_url": "/varexis-index/records/openfga-relation-rename-migration.json",
      "record_sha256": "53f41e5e05ad077f73703efe986f6b59926304b2ec6db5a56b1110b66ef3aa2e",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_openfga_relation_rename_migration.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-OPENFGA-RELATION-RENAME-MIGRATION-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/openfga/openfga.dev/fb5359796e1e1027985675cfdd2413e6dcbfdf5d/docs/content/getting-started/immutable-models.mdx",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-OPENFGA-CACHED-CHECK-AFTER-TUPLE-CHANGE-01-v1",
      "route_id": "agentic_reviewed_openfga_cached_check_after_tuple_change",
      "title": "OpenFGA authorization cache freshness",
      "question": "Can a successful OpenFGA tuple update be followed by a stale Check response?",
      "record_url": "/varexis-index/records/openfga-cached-check-after-tuple-change.json",
      "record_sha256": "17593d7db048d3fab5756f20c0821e7eb88330b848b60299aca5bd66b069c2fb",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_openfga_cached_check_after_tuple_change.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-OPENFGA-CACHED-CHECK-AFTER-TUPLE-CHANGE-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/openfga/openfga.dev/fb5359796e1e1027985675cfdd2413e6dcbfdf5d/docs/content/interacting/consistency.mdx",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-OPENFGA-CONTEXTUAL-TUPLE-PRECEDENCE-01-v1",
      "route_id": "agentic_reviewed_openfga_contextual_tuple_precedence",
      "title": "OpenFGA request-local relationship overrides",
      "question": "Can a contextual tuple override the same stored relationship in an OpenFGA request?",
      "record_url": "/varexis-index/records/openfga-contextual-tuple-precedence.json",
      "record_sha256": "5aef526ec01a797f6de44b31f3b69dafc92fda9cefad1cc09a052f328cd914b0",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_openfga_contextual_tuple_precedence.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-OPENFGA-CONTEXTUAL-TUPLE-PRECEDENCE-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/openfga/openfga.dev/fb5359796e1e1027985675cfdd2413e6dcbfdf5d/docs/content/interacting/contextual-tuples.mdx",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-OPENFGA-TOKEN-CLAIMS-RESIDUAL-ACCESS-01-v1",
      "route_id": "agentic_reviewed_openfga_token_claims_residual_access",
      "title": "OpenFGA token-derived residual membership",
      "question": "Does removing a directory group immediately remove OpenFGA access based on an unexpired token claim?",
      "record_url": "/varexis-index/records/openfga-token-claims-residual-access.json",
      "record_sha256": "4da67a2db4f803b549f4be5f38365f64dde0a20ec43586dbceafdc2e81065f57",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_openfga_token_claims_residual_access.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-OPENFGA-TOKEN-CLAIMS-RESIDUAL-ACCESS-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/openfga/openfga.dev/fb5359796e1e1027985675cfdd2413e6dcbfdf5d/docs/content/modeling/token-claims-contextual-tuples.mdx",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-OPENFGA-CHANGE-LOG-CONTEXT-OMISSION-01-v1",
      "route_id": "agentic_reviewed_openfga_change_log_context_omission",
      "title": "OpenFGA change log and decision reconstruction",
      "question": "Can OpenFGA Read Changes alone reconstruct decisions that used contextual tuples?",
      "record_url": "/varexis-index/records/openfga-change-log-context-omission.json",
      "record_sha256": "b09f4a31e5e57f82a35a4896bbd60f3460fa44719baaf749017312514133f1a4",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_openfga_change_log_context_omission.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-OPENFGA-CHANGE-LOG-CONTEXT-OMISSION-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/openfga/openfga.dev/fb5359796e1e1027985675cfdd2413e6dcbfdf5d/docs/content/interacting/contextual-tuples.mdx",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-OPENFGA-CONDITION-TIME-INPUT-BOUNDARY-01-v1",
      "route_id": "agentic_reviewed_openfga_condition_time_input_boundary",
      "title": "OpenFGA temporal condition inputs",
      "question": "Does an OpenFGA temporal grant independently establish the current time used for authorization?",
      "record_url": "/varexis-index/records/openfga-condition-time-input-boundary.json",
      "record_sha256": "8101bfe2199c2d26c488998033a98507344a81331689d8760a8418bf60dc2c5d",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_openfga_condition_time_input_boundary.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-OPENFGA-CONDITION-TIME-INPUT-BOUNDARY-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/openfga/openfga.dev/fb5359796e1e1027985675cfdd2413e6dcbfdf5d/docs/content/modeling/conditions.mdx",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-OPENFGA-PERSISTED-CONDITION-CONTEXT-PRECEDENCE-01-v1",
      "route_id": "agentic_reviewed_openfga_persisted_condition_context_precedence",
      "title": "OpenFGA condition context merge",
      "question": "Can request context replace a condition parameter already stored in an OpenFGA relationship tuple?",
      "record_url": "/varexis-index/records/openfga-persisted-condition-context-precedence.json",
      "record_sha256": "69e1e4b0db65ccb3568899633c188dc01caba8b954ed38ba4838e720c9b3de61",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_openfga_persisted_condition_context_precedence.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-OPENFGA-PERSISTED-CONDITION-CONTEXT-PRECEDENCE-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/openfga/openfga.dev/fb5359796e1e1027985675cfdd2413e6dcbfdf5d/docs/content/modeling/conditions.mdx",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-OPENFGA-READ-CHANGES-CURSOR-SCOPE-01-v1",
      "route_id": "agentic_reviewed_openfga_read_changes_cursor_scope",
      "title": "OpenFGA change-stream resumption",
      "question": "Does reaching the current end of OpenFGA Read Changes make its continuation token disposable?",
      "record_url": "/varexis-index/records/openfga-read-changes-cursor-scope.json",
      "record_sha256": "d329d2752aef61b88a6898e509d569230ceb379be7e0dd6fa1bab50bf5fe66a4",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_openfga_read_changes_cursor_scope.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-OPENFGA-READ-CHANGES-CURSOR-SCOPE-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/openfga/openfga.dev/fb5359796e1e1027985675cfdd2413e6dcbfdf5d/docs/content/interacting/read-tuple-changes.mdx",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-OPENFGA-EXPAND-CONTEXT-DOCUMENTATION-CONFLICT-01-v1",
      "route_id": "agentic_reviewed_openfga_expand_context_documentation_conflict",
      "title": "OpenFGA contextual Expand documentation conflict",
      "question": "Do the pinned OpenFGA guides agree that Expand accepts contextual tuples?",
      "record_url": "/varexis-index/records/openfga-expand-context-documentation-conflict.json",
      "record_sha256": "e108d5cb7996cdca8d2af3a2d7245c8bb07d5d6dac28bcd3eb4e77b3b2799f2b",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_openfga_expand_context_documentation_conflict.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-OPENFGA-EXPAND-CONTEXT-DOCUMENTATION-CONFLICT-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/openfga/openfga.dev/fb5359796e1e1027985675cfdd2413e6dcbfdf5d/docs/content/interacting/contextual-tuples.mdx",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-TUF-INITIAL-ROOT-TRUST-BOOTSTRAP-01-v1",
      "route_id": "agentic_reviewed_tuf_initial_root_trust_bootstrap",
      "title": "TUF initial trust bootstrap",
      "question": "Can an agent trust a new tool repository by downloading its own TUF root metadata from that repository?",
      "record_url": "/varexis-index/records/tuf-initial-root-trust-bootstrap.json",
      "record_sha256": "f18ed72560629d59101596d435cde435cea316506b54facc10343863affa56ab",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_tuf_initial_root_trust_bootstrap.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-TUF-INITIAL-ROOT-TRUST-BOOTSTRAP-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false,
      "source_rights_notice": {
        "id": "tuf-specification-1.0.37",
        "url": "/varexis-index/publications/pub-2-tranche-52-v1/source-rights.json",
        "record_ids": [
          "VXI-EXT-PROCUREMENT-TUF-INITIAL-ROOT-TRUST-BOOTSTRAP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-ROTATION-DUAL-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-UNIQUE-SIGNATURE-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-INTERMEDIATE-VERSION-CHAIN-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-INTERMEDIATE-ROOT-EXPIRY-BOUNDARY-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TIMESTAMP-SIGNATURE-FRESHNESS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SAME-TIMESTAMP-NORMAL-STOP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SNAPSHOT-CROSS-METADATA-BINDING-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATION-ALL-ANCESTOR-PATHS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TERMINATING-DELEGATION-NO-FALLBACK-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATOR-RETAINS-PUBLISHING-AUTHORITY-01-v1"
        ],
        "attribution": "Based on The Update Framework Specification, version 1.0.37 (2026-10-08), by The Update Framework Working Group, retrieved from https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md. Source material is licensed under the Community Specification License 1.0: https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/LICENSE.md. VAREXIS-INDEX supplies an original bounded documentation review; it does not verify a buyer deployment or certify an implementation.",
        "disclaimer": "THESE MATERIALS ARE PROVIDED “AS IS.” The Contributors and Licensees expressly disclaim any warranties (express, implied, or otherwise), including implied warranties of merchantability, non-infringement, fitness for a particular purpose, or title, related to the materials.  The entire risk as to implementing or otherwise using the materials is assumed by the implementer and user. IN NO EVENT WILL THE CONTRIBUTORS OR LICENSEES BE LIABLE TO ANY OTHER PARTY FOR LOST PROFITS OR ANY FORM OF INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER FROM ANY CAUSES OF ACTION OF ANY KIND WITH RESPECT TO THIS DELIVERABLE OR ITS GOVERNING AGREEMENT, WHETHER BASED ON BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND WHETHER OR NOT THE OTHER MEMBER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.",
        "notice_text_origin": "Distribution disclaimer reproduced verbatim from captured Community Specification License 1.0 §8.2. The licence text is copyright 2020 Joint Development Foundation, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), as the captured licence states at line97.",
        "source_bindings": [
          {
            "source_id": "tuf-spec",
            "sha256": "87c7136231b8cb3355736d8e7cfe88380d030cb2994ea283a19e78e03fb171ff",
            "lines": [
              1,
              20
            ],
            "supports": "Title, date 2026-10-08 and VERSION 1.0.37"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              5,
              9
            ],
            "supports": "Copyright grant and §1.2 Working Group/material name/version/source attribution requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              61,
              63
            ],
            "supports": "§8.2 materially similar distribution disclaimer requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              97,
              99
            ],
            "supports": "Licence-text attribution and CC BY 4.0"
          }
        ],
        "immutable_record_boundary": "Original standalone record bytes are preserved. This companion notice accompanies the publication package and exact preview; retain it when redistributing the reviewed material."
      }
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-TUF-ROOT-ROTATION-DUAL-THRESHOLD-01-v1",
      "route_id": "agentic_reviewed_tuf_root_rotation_dual_threshold",
      "title": "TUF root-rotation continuity",
      "question": "Is a new TUF root trusted when only the new root keys signed it?",
      "record_url": "/varexis-index/records/tuf-root-rotation-dual-threshold.json",
      "record_sha256": "2d17c5fc7a96bf0c0769a3e5120d5a2db15909273e7b4dbcf65004977ee747b3",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_tuf_root_rotation_dual_threshold.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-TUF-ROOT-ROTATION-DUAL-THRESHOLD-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false,
      "source_rights_notice": {
        "id": "tuf-specification-1.0.37",
        "url": "/varexis-index/publications/pub-2-tranche-52-v1/source-rights.json",
        "record_ids": [
          "VXI-EXT-PROCUREMENT-TUF-INITIAL-ROOT-TRUST-BOOTSTRAP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-ROTATION-DUAL-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-UNIQUE-SIGNATURE-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-INTERMEDIATE-VERSION-CHAIN-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-INTERMEDIATE-ROOT-EXPIRY-BOUNDARY-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TIMESTAMP-SIGNATURE-FRESHNESS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SAME-TIMESTAMP-NORMAL-STOP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SNAPSHOT-CROSS-METADATA-BINDING-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATION-ALL-ANCESTOR-PATHS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TERMINATING-DELEGATION-NO-FALLBACK-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATOR-RETAINS-PUBLISHING-AUTHORITY-01-v1"
        ],
        "attribution": "Based on The Update Framework Specification, version 1.0.37 (2026-10-08), by The Update Framework Working Group, retrieved from https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md. Source material is licensed under the Community Specification License 1.0: https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/LICENSE.md. VAREXIS-INDEX supplies an original bounded documentation review; it does not verify a buyer deployment or certify an implementation.",
        "disclaimer": "THESE MATERIALS ARE PROVIDED “AS IS.” The Contributors and Licensees expressly disclaim any warranties (express, implied, or otherwise), including implied warranties of merchantability, non-infringement, fitness for a particular purpose, or title, related to the materials.  The entire risk as to implementing or otherwise using the materials is assumed by the implementer and user. IN NO EVENT WILL THE CONTRIBUTORS OR LICENSEES BE LIABLE TO ANY OTHER PARTY FOR LOST PROFITS OR ANY FORM OF INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER FROM ANY CAUSES OF ACTION OF ANY KIND WITH RESPECT TO THIS DELIVERABLE OR ITS GOVERNING AGREEMENT, WHETHER BASED ON BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND WHETHER OR NOT THE OTHER MEMBER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.",
        "notice_text_origin": "Distribution disclaimer reproduced verbatim from captured Community Specification License 1.0 §8.2. The licence text is copyright 2020 Joint Development Foundation, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), as the captured licence states at line97.",
        "source_bindings": [
          {
            "source_id": "tuf-spec",
            "sha256": "87c7136231b8cb3355736d8e7cfe88380d030cb2994ea283a19e78e03fb171ff",
            "lines": [
              1,
              20
            ],
            "supports": "Title, date 2026-10-08 and VERSION 1.0.37"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              5,
              9
            ],
            "supports": "Copyright grant and §1.2 Working Group/material name/version/source attribution requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              61,
              63
            ],
            "supports": "§8.2 materially similar distribution disclaimer requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              97,
              99
            ],
            "supports": "Licence-text attribution and CC BY 4.0"
          }
        ],
        "immutable_record_boundary": "Original standalone record bytes are preserved. This companion notice accompanies the publication package and exact preview; retain it when redistributing the reviewed material."
      }
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-TUF-UNIQUE-SIGNATURE-THRESHOLD-01-v1",
      "route_id": "agentic_reviewed_tuf_unique_signature_threshold",
      "title": "TUF signature threshold identity",
      "question": "Can repeated signatures from one TUF key satisfy a multi-key approval threshold?",
      "record_url": "/varexis-index/records/tuf-unique-signature-threshold.json",
      "record_sha256": "17a4a349fe0c5f3f38003a03902ea63ec57f091a0c5ded8f8f3bb1723522131a",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_tuf_unique_signature_threshold.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-TUF-UNIQUE-SIGNATURE-THRESHOLD-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false,
      "source_rights_notice": {
        "id": "tuf-specification-1.0.37",
        "url": "/varexis-index/publications/pub-2-tranche-52-v1/source-rights.json",
        "record_ids": [
          "VXI-EXT-PROCUREMENT-TUF-INITIAL-ROOT-TRUST-BOOTSTRAP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-ROTATION-DUAL-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-UNIQUE-SIGNATURE-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-INTERMEDIATE-VERSION-CHAIN-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-INTERMEDIATE-ROOT-EXPIRY-BOUNDARY-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TIMESTAMP-SIGNATURE-FRESHNESS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SAME-TIMESTAMP-NORMAL-STOP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SNAPSHOT-CROSS-METADATA-BINDING-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATION-ALL-ANCESTOR-PATHS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TERMINATING-DELEGATION-NO-FALLBACK-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATOR-RETAINS-PUBLISHING-AUTHORITY-01-v1"
        ],
        "attribution": "Based on The Update Framework Specification, version 1.0.37 (2026-10-08), by The Update Framework Working Group, retrieved from https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md. Source material is licensed under the Community Specification License 1.0: https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/LICENSE.md. VAREXIS-INDEX supplies an original bounded documentation review; it does not verify a buyer deployment or certify an implementation.",
        "disclaimer": "THESE MATERIALS ARE PROVIDED “AS IS.” The Contributors and Licensees expressly disclaim any warranties (express, implied, or otherwise), including implied warranties of merchantability, non-infringement, fitness for a particular purpose, or title, related to the materials.  The entire risk as to implementing or otherwise using the materials is assumed by the implementer and user. IN NO EVENT WILL THE CONTRIBUTORS OR LICENSEES BE LIABLE TO ANY OTHER PARTY FOR LOST PROFITS OR ANY FORM OF INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER FROM ANY CAUSES OF ACTION OF ANY KIND WITH RESPECT TO THIS DELIVERABLE OR ITS GOVERNING AGREEMENT, WHETHER BASED ON BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND WHETHER OR NOT THE OTHER MEMBER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.",
        "notice_text_origin": "Distribution disclaimer reproduced verbatim from captured Community Specification License 1.0 §8.2. The licence text is copyright 2020 Joint Development Foundation, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), as the captured licence states at line97.",
        "source_bindings": [
          {
            "source_id": "tuf-spec",
            "sha256": "87c7136231b8cb3355736d8e7cfe88380d030cb2994ea283a19e78e03fb171ff",
            "lines": [
              1,
              20
            ],
            "supports": "Title, date 2026-10-08 and VERSION 1.0.37"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              5,
              9
            ],
            "supports": "Copyright grant and §1.2 Working Group/material name/version/source attribution requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              61,
              63
            ],
            "supports": "§8.2 materially similar distribution disclaimer requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              97,
              99
            ],
            "supports": "Licence-text attribution and CC BY 4.0"
          }
        ],
        "immutable_record_boundary": "Original standalone record bytes are preserved. This companion notice accompanies the publication package and exact preview; retain it when redistributing the reviewed material."
      }
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-TUF-ROOT-INTERMEDIATE-VERSION-CHAIN-01-v1",
      "route_id": "agentic_reviewed_tuf_root_intermediate_version_chain",
      "title": "TUF skipped root versions",
      "question": "Can a TUF client skip unavailable intermediate root versions and trust the latest signed root?",
      "record_url": "/varexis-index/records/tuf-root-intermediate-version-chain.json",
      "record_sha256": "dcde1c82d343b66bbe039b529aade2ea163bbb5de5c86945d42edb02839f514b",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_tuf_root_intermediate_version_chain.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-TUF-ROOT-INTERMEDIATE-VERSION-CHAIN-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false,
      "source_rights_notice": {
        "id": "tuf-specification-1.0.37",
        "url": "/varexis-index/publications/pub-2-tranche-52-v1/source-rights.json",
        "record_ids": [
          "VXI-EXT-PROCUREMENT-TUF-INITIAL-ROOT-TRUST-BOOTSTRAP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-ROTATION-DUAL-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-UNIQUE-SIGNATURE-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-INTERMEDIATE-VERSION-CHAIN-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-INTERMEDIATE-ROOT-EXPIRY-BOUNDARY-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TIMESTAMP-SIGNATURE-FRESHNESS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SAME-TIMESTAMP-NORMAL-STOP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SNAPSHOT-CROSS-METADATA-BINDING-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATION-ALL-ANCESTOR-PATHS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TERMINATING-DELEGATION-NO-FALLBACK-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATOR-RETAINS-PUBLISHING-AUTHORITY-01-v1"
        ],
        "attribution": "Based on The Update Framework Specification, version 1.0.37 (2026-10-08), by The Update Framework Working Group, retrieved from https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md. Source material is licensed under the Community Specification License 1.0: https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/LICENSE.md. VAREXIS-INDEX supplies an original bounded documentation review; it does not verify a buyer deployment or certify an implementation.",
        "disclaimer": "THESE MATERIALS ARE PROVIDED “AS IS.” The Contributors and Licensees expressly disclaim any warranties (express, implied, or otherwise), including implied warranties of merchantability, non-infringement, fitness for a particular purpose, or title, related to the materials.  The entire risk as to implementing or otherwise using the materials is assumed by the implementer and user. IN NO EVENT WILL THE CONTRIBUTORS OR LICENSEES BE LIABLE TO ANY OTHER PARTY FOR LOST PROFITS OR ANY FORM OF INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER FROM ANY CAUSES OF ACTION OF ANY KIND WITH RESPECT TO THIS DELIVERABLE OR ITS GOVERNING AGREEMENT, WHETHER BASED ON BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND WHETHER OR NOT THE OTHER MEMBER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.",
        "notice_text_origin": "Distribution disclaimer reproduced verbatim from captured Community Specification License 1.0 §8.2. The licence text is copyright 2020 Joint Development Foundation, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), as the captured licence states at line97.",
        "source_bindings": [
          {
            "source_id": "tuf-spec",
            "sha256": "87c7136231b8cb3355736d8e7cfe88380d030cb2994ea283a19e78e03fb171ff",
            "lines": [
              1,
              20
            ],
            "supports": "Title, date 2026-10-08 and VERSION 1.0.37"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              5,
              9
            ],
            "supports": "Copyright grant and §1.2 Working Group/material name/version/source attribution requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              61,
              63
            ],
            "supports": "§8.2 materially similar distribution disclaimer requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              97,
              99
            ],
            "supports": "Licence-text attribution and CC BY 4.0"
          }
        ],
        "immutable_record_boundary": "Original standalone record bytes are preserved. This companion notice accompanies the publication package and exact preview; retain it when redistributing the reviewed material."
      }
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-TUF-INTERMEDIATE-ROOT-EXPIRY-BOUNDARY-01-v1",
      "route_id": "agentic_reviewed_tuf_intermediate_root_expiry_boundary",
      "title": "TUF root expiry during recovery",
      "question": "Does an expired intermediate TUF root necessarily prevent reaching a valid current root?",
      "record_url": "/varexis-index/records/tuf-intermediate-root-expiry-boundary.json",
      "record_sha256": "1d79afb110dc994a19b63607984f6d5d7a6a860ff37f0e47725af96bd0fcba31",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_tuf_intermediate_root_expiry_boundary.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-TUF-INTERMEDIATE-ROOT-EXPIRY-BOUNDARY-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false,
      "source_rights_notice": {
        "id": "tuf-specification-1.0.37",
        "url": "/varexis-index/publications/pub-2-tranche-52-v1/source-rights.json",
        "record_ids": [
          "VXI-EXT-PROCUREMENT-TUF-INITIAL-ROOT-TRUST-BOOTSTRAP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-ROTATION-DUAL-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-UNIQUE-SIGNATURE-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-INTERMEDIATE-VERSION-CHAIN-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-INTERMEDIATE-ROOT-EXPIRY-BOUNDARY-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TIMESTAMP-SIGNATURE-FRESHNESS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SAME-TIMESTAMP-NORMAL-STOP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SNAPSHOT-CROSS-METADATA-BINDING-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATION-ALL-ANCESTOR-PATHS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TERMINATING-DELEGATION-NO-FALLBACK-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATOR-RETAINS-PUBLISHING-AUTHORITY-01-v1"
        ],
        "attribution": "Based on The Update Framework Specification, version 1.0.37 (2026-10-08), by The Update Framework Working Group, retrieved from https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md. Source material is licensed under the Community Specification License 1.0: https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/LICENSE.md. VAREXIS-INDEX supplies an original bounded documentation review; it does not verify a buyer deployment or certify an implementation.",
        "disclaimer": "THESE MATERIALS ARE PROVIDED “AS IS.” The Contributors and Licensees expressly disclaim any warranties (express, implied, or otherwise), including implied warranties of merchantability, non-infringement, fitness for a particular purpose, or title, related to the materials.  The entire risk as to implementing or otherwise using the materials is assumed by the implementer and user. IN NO EVENT WILL THE CONTRIBUTORS OR LICENSEES BE LIABLE TO ANY OTHER PARTY FOR LOST PROFITS OR ANY FORM OF INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER FROM ANY CAUSES OF ACTION OF ANY KIND WITH RESPECT TO THIS DELIVERABLE OR ITS GOVERNING AGREEMENT, WHETHER BASED ON BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND WHETHER OR NOT THE OTHER MEMBER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.",
        "notice_text_origin": "Distribution disclaimer reproduced verbatim from captured Community Specification License 1.0 §8.2. The licence text is copyright 2020 Joint Development Foundation, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), as the captured licence states at line97.",
        "source_bindings": [
          {
            "source_id": "tuf-spec",
            "sha256": "87c7136231b8cb3355736d8e7cfe88380d030cb2994ea283a19e78e03fb171ff",
            "lines": [
              1,
              20
            ],
            "supports": "Title, date 2026-10-08 and VERSION 1.0.37"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              5,
              9
            ],
            "supports": "Copyright grant and §1.2 Working Group/material name/version/source attribution requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              61,
              63
            ],
            "supports": "§8.2 materially similar distribution disclaimer requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              97,
              99
            ],
            "supports": "Licence-text attribution and CC BY 4.0"
          }
        ],
        "immutable_record_boundary": "Original standalone record bytes are preserved. This companion notice accompanies the publication package and exact preview; retain it when redistributing the reviewed material."
      }
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-TUF-TIMESTAMP-SIGNATURE-FRESHNESS-01-v1",
      "route_id": "agentic_reviewed_tuf_timestamp_signature_freshness",
      "title": "TUF signed metadata freshness",
      "question": "Does a valid TUF timestamp signature prove that the update metadata is fresh enough to use?",
      "record_url": "/varexis-index/records/tuf-timestamp-signature-freshness.json",
      "record_sha256": "3adf178b459878eaaebd68da34f6ba9414fb4a9adef3c337c45841dafdf3dcea",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_tuf_timestamp_signature_freshness.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-TUF-TIMESTAMP-SIGNATURE-FRESHNESS-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false,
      "source_rights_notice": {
        "id": "tuf-specification-1.0.37",
        "url": "/varexis-index/publications/pub-2-tranche-52-v1/source-rights.json",
        "record_ids": [
          "VXI-EXT-PROCUREMENT-TUF-INITIAL-ROOT-TRUST-BOOTSTRAP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-ROTATION-DUAL-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-UNIQUE-SIGNATURE-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-INTERMEDIATE-VERSION-CHAIN-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-INTERMEDIATE-ROOT-EXPIRY-BOUNDARY-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TIMESTAMP-SIGNATURE-FRESHNESS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SAME-TIMESTAMP-NORMAL-STOP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SNAPSHOT-CROSS-METADATA-BINDING-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATION-ALL-ANCESTOR-PATHS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TERMINATING-DELEGATION-NO-FALLBACK-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATOR-RETAINS-PUBLISHING-AUTHORITY-01-v1"
        ],
        "attribution": "Based on The Update Framework Specification, version 1.0.37 (2026-10-08), by The Update Framework Working Group, retrieved from https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md. Source material is licensed under the Community Specification License 1.0: https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/LICENSE.md. VAREXIS-INDEX supplies an original bounded documentation review; it does not verify a buyer deployment or certify an implementation.",
        "disclaimer": "THESE MATERIALS ARE PROVIDED “AS IS.” The Contributors and Licensees expressly disclaim any warranties (express, implied, or otherwise), including implied warranties of merchantability, non-infringement, fitness for a particular purpose, or title, related to the materials.  The entire risk as to implementing or otherwise using the materials is assumed by the implementer and user. IN NO EVENT WILL THE CONTRIBUTORS OR LICENSEES BE LIABLE TO ANY OTHER PARTY FOR LOST PROFITS OR ANY FORM OF INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER FROM ANY CAUSES OF ACTION OF ANY KIND WITH RESPECT TO THIS DELIVERABLE OR ITS GOVERNING AGREEMENT, WHETHER BASED ON BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND WHETHER OR NOT THE OTHER MEMBER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.",
        "notice_text_origin": "Distribution disclaimer reproduced verbatim from captured Community Specification License 1.0 §8.2. The licence text is copyright 2020 Joint Development Foundation, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), as the captured licence states at line97.",
        "source_bindings": [
          {
            "source_id": "tuf-spec",
            "sha256": "87c7136231b8cb3355736d8e7cfe88380d030cb2994ea283a19e78e03fb171ff",
            "lines": [
              1,
              20
            ],
            "supports": "Title, date 2026-10-08 and VERSION 1.0.37"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              5,
              9
            ],
            "supports": "Copyright grant and §1.2 Working Group/material name/version/source attribution requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              61,
              63
            ],
            "supports": "§8.2 materially similar distribution disclaimer requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              97,
              99
            ],
            "supports": "Licence-text attribution and CC BY 4.0"
          }
        ],
        "immutable_record_boundary": "Original standalone record bytes are preserved. This companion notice accompanies the publication package and exact preview; retain it when redistributing the reviewed material."
      }
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-TUF-SAME-TIMESTAMP-NORMAL-STOP-01-v1",
      "route_id": "agentic_reviewed_tuf_same_timestamp_normal_stop",
      "title": "TUF unchanged timestamp handling",
      "question": "Does a repeated TUF timestamp version mean a tool update failed or an attack was proven?",
      "record_url": "/varexis-index/records/tuf-same-timestamp-normal-stop.json",
      "record_sha256": "0522a5bb301739043bc9386a25ee85ccf7a2f4d65ee854d072f20de1125ecbb9",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_tuf_same_timestamp_normal_stop.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-TUF-SAME-TIMESTAMP-NORMAL-STOP-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false,
      "source_rights_notice": {
        "id": "tuf-specification-1.0.37",
        "url": "/varexis-index/publications/pub-2-tranche-52-v1/source-rights.json",
        "record_ids": [
          "VXI-EXT-PROCUREMENT-TUF-INITIAL-ROOT-TRUST-BOOTSTRAP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-ROTATION-DUAL-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-UNIQUE-SIGNATURE-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-INTERMEDIATE-VERSION-CHAIN-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-INTERMEDIATE-ROOT-EXPIRY-BOUNDARY-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TIMESTAMP-SIGNATURE-FRESHNESS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SAME-TIMESTAMP-NORMAL-STOP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SNAPSHOT-CROSS-METADATA-BINDING-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATION-ALL-ANCESTOR-PATHS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TERMINATING-DELEGATION-NO-FALLBACK-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATOR-RETAINS-PUBLISHING-AUTHORITY-01-v1"
        ],
        "attribution": "Based on The Update Framework Specification, version 1.0.37 (2026-10-08), by The Update Framework Working Group, retrieved from https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md. Source material is licensed under the Community Specification License 1.0: https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/LICENSE.md. VAREXIS-INDEX supplies an original bounded documentation review; it does not verify a buyer deployment or certify an implementation.",
        "disclaimer": "THESE MATERIALS ARE PROVIDED “AS IS.” The Contributors and Licensees expressly disclaim any warranties (express, implied, or otherwise), including implied warranties of merchantability, non-infringement, fitness for a particular purpose, or title, related to the materials.  The entire risk as to implementing or otherwise using the materials is assumed by the implementer and user. IN NO EVENT WILL THE CONTRIBUTORS OR LICENSEES BE LIABLE TO ANY OTHER PARTY FOR LOST PROFITS OR ANY FORM OF INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER FROM ANY CAUSES OF ACTION OF ANY KIND WITH RESPECT TO THIS DELIVERABLE OR ITS GOVERNING AGREEMENT, WHETHER BASED ON BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND WHETHER OR NOT THE OTHER MEMBER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.",
        "notice_text_origin": "Distribution disclaimer reproduced verbatim from captured Community Specification License 1.0 §8.2. The licence text is copyright 2020 Joint Development Foundation, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), as the captured licence states at line97.",
        "source_bindings": [
          {
            "source_id": "tuf-spec",
            "sha256": "87c7136231b8cb3355736d8e7cfe88380d030cb2994ea283a19e78e03fb171ff",
            "lines": [
              1,
              20
            ],
            "supports": "Title, date 2026-10-08 and VERSION 1.0.37"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              5,
              9
            ],
            "supports": "Copyright grant and §1.2 Working Group/material name/version/source attribution requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              61,
              63
            ],
            "supports": "§8.2 materially similar distribution disclaimer requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              97,
              99
            ],
            "supports": "Licence-text attribution and CC BY 4.0"
          }
        ],
        "immutable_record_boundary": "Original standalone record bytes are preserved. This companion notice accompanies the publication package and exact preview; retain it when redistributing the reviewed material."
      }
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-TUF-SNAPSHOT-CROSS-METADATA-BINDING-01-v1",
      "route_id": "agentic_reviewed_tuf_snapshot_cross_metadata_binding",
      "title": "TUF cross-file metadata consistency",
      "question": "Can separately valid TUF signatures establish that timestamp, snapshot and targets metadata belong together?",
      "record_url": "/varexis-index/records/tuf-snapshot-cross-metadata-binding.json",
      "record_sha256": "fd46bd45141a15965952ba7008e5bf7772cb48d3cfd9a7cb83ccc0317050f5e8",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_tuf_snapshot_cross_metadata_binding.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-TUF-SNAPSHOT-CROSS-METADATA-BINDING-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false,
      "source_rights_notice": {
        "id": "tuf-specification-1.0.37",
        "url": "/varexis-index/publications/pub-2-tranche-52-v1/source-rights.json",
        "record_ids": [
          "VXI-EXT-PROCUREMENT-TUF-INITIAL-ROOT-TRUST-BOOTSTRAP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-ROTATION-DUAL-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-UNIQUE-SIGNATURE-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-INTERMEDIATE-VERSION-CHAIN-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-INTERMEDIATE-ROOT-EXPIRY-BOUNDARY-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TIMESTAMP-SIGNATURE-FRESHNESS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SAME-TIMESTAMP-NORMAL-STOP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SNAPSHOT-CROSS-METADATA-BINDING-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATION-ALL-ANCESTOR-PATHS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TERMINATING-DELEGATION-NO-FALLBACK-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATOR-RETAINS-PUBLISHING-AUTHORITY-01-v1"
        ],
        "attribution": "Based on The Update Framework Specification, version 1.0.37 (2026-10-08), by The Update Framework Working Group, retrieved from https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md. Source material is licensed under the Community Specification License 1.0: https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/LICENSE.md. VAREXIS-INDEX supplies an original bounded documentation review; it does not verify a buyer deployment or certify an implementation.",
        "disclaimer": "THESE MATERIALS ARE PROVIDED “AS IS.” The Contributors and Licensees expressly disclaim any warranties (express, implied, or otherwise), including implied warranties of merchantability, non-infringement, fitness for a particular purpose, or title, related to the materials.  The entire risk as to implementing or otherwise using the materials is assumed by the implementer and user. IN NO EVENT WILL THE CONTRIBUTORS OR LICENSEES BE LIABLE TO ANY OTHER PARTY FOR LOST PROFITS OR ANY FORM OF INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER FROM ANY CAUSES OF ACTION OF ANY KIND WITH RESPECT TO THIS DELIVERABLE OR ITS GOVERNING AGREEMENT, WHETHER BASED ON BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND WHETHER OR NOT THE OTHER MEMBER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.",
        "notice_text_origin": "Distribution disclaimer reproduced verbatim from captured Community Specification License 1.0 §8.2. The licence text is copyright 2020 Joint Development Foundation, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), as the captured licence states at line97.",
        "source_bindings": [
          {
            "source_id": "tuf-spec",
            "sha256": "87c7136231b8cb3355736d8e7cfe88380d030cb2994ea283a19e78e03fb171ff",
            "lines": [
              1,
              20
            ],
            "supports": "Title, date 2026-10-08 and VERSION 1.0.37"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              5,
              9
            ],
            "supports": "Copyright grant and §1.2 Working Group/material name/version/source attribution requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              61,
              63
            ],
            "supports": "§8.2 materially similar distribution disclaimer requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              97,
              99
            ],
            "supports": "Licence-text attribution and CC BY 4.0"
          }
        ],
        "immutable_record_boundary": "Original standalone record bytes are preserved. This companion notice accompanies the publication package and exact preview; retain it when redistributing the reviewed material."
      }
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-TUF-DELEGATION-ALL-ANCESTOR-PATHS-01-v1",
      "route_id": "agentic_reviewed_tuf_delegation_all_ancestor_paths",
      "title": "TUF delegated target authority",
      "question": "Can a delegated TUF signer authorize a tool path allowed by its own metadata but excluded by an ancestor?",
      "record_url": "/varexis-index/records/tuf-delegation-all-ancestor-paths.json",
      "record_sha256": "395f77869b24867f4201b257227bc57a1daf768cf57a8580aca91818592be145",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_tuf_delegation_all_ancestor_paths.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-TUF-DELEGATION-ALL-ANCESTOR-PATHS-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false,
      "source_rights_notice": {
        "id": "tuf-specification-1.0.37",
        "url": "/varexis-index/publications/pub-2-tranche-52-v1/source-rights.json",
        "record_ids": [
          "VXI-EXT-PROCUREMENT-TUF-INITIAL-ROOT-TRUST-BOOTSTRAP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-ROTATION-DUAL-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-UNIQUE-SIGNATURE-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-INTERMEDIATE-VERSION-CHAIN-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-INTERMEDIATE-ROOT-EXPIRY-BOUNDARY-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TIMESTAMP-SIGNATURE-FRESHNESS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SAME-TIMESTAMP-NORMAL-STOP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SNAPSHOT-CROSS-METADATA-BINDING-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATION-ALL-ANCESTOR-PATHS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TERMINATING-DELEGATION-NO-FALLBACK-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATOR-RETAINS-PUBLISHING-AUTHORITY-01-v1"
        ],
        "attribution": "Based on The Update Framework Specification, version 1.0.37 (2026-10-08), by The Update Framework Working Group, retrieved from https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md. Source material is licensed under the Community Specification License 1.0: https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/LICENSE.md. VAREXIS-INDEX supplies an original bounded documentation review; it does not verify a buyer deployment or certify an implementation.",
        "disclaimer": "THESE MATERIALS ARE PROVIDED “AS IS.” The Contributors and Licensees expressly disclaim any warranties (express, implied, or otherwise), including implied warranties of merchantability, non-infringement, fitness for a particular purpose, or title, related to the materials.  The entire risk as to implementing or otherwise using the materials is assumed by the implementer and user. IN NO EVENT WILL THE CONTRIBUTORS OR LICENSEES BE LIABLE TO ANY OTHER PARTY FOR LOST PROFITS OR ANY FORM OF INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER FROM ANY CAUSES OF ACTION OF ANY KIND WITH RESPECT TO THIS DELIVERABLE OR ITS GOVERNING AGREEMENT, WHETHER BASED ON BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND WHETHER OR NOT THE OTHER MEMBER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.",
        "notice_text_origin": "Distribution disclaimer reproduced verbatim from captured Community Specification License 1.0 §8.2. The licence text is copyright 2020 Joint Development Foundation, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), as the captured licence states at line97.",
        "source_bindings": [
          {
            "source_id": "tuf-spec",
            "sha256": "87c7136231b8cb3355736d8e7cfe88380d030cb2994ea283a19e78e03fb171ff",
            "lines": [
              1,
              20
            ],
            "supports": "Title, date 2026-10-08 and VERSION 1.0.37"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              5,
              9
            ],
            "supports": "Copyright grant and §1.2 Working Group/material name/version/source attribution requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              61,
              63
            ],
            "supports": "§8.2 materially similar distribution disclaimer requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              97,
              99
            ],
            "supports": "Licence-text attribution and CC BY 4.0"
          }
        ],
        "immutable_record_boundary": "Original standalone record bytes are preserved. This companion notice accompanies the publication package and exact preview; retain it when redistributing the reviewed material."
      }
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-TUF-TERMINATING-DELEGATION-NO-FALLBACK-01-v1",
      "route_id": "agentic_reviewed_tuf_terminating_delegation_no_fallback",
      "title": "TUF terminating delegation boundary",
      "question": "Can a TUF updater fall back to another signer after a terminating delegation has no matching tool target?",
      "record_url": "/varexis-index/records/tuf-terminating-delegation-no-fallback.json",
      "record_sha256": "fe3ed50228a453f27565a07f64b4c9c0462bbd7fe736f42ed9609d7516156eb5",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_tuf_terminating_delegation_no_fallback.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-TUF-TERMINATING-DELEGATION-NO-FALLBACK-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false,
      "source_rights_notice": {
        "id": "tuf-specification-1.0.37",
        "url": "/varexis-index/publications/pub-2-tranche-52-v1/source-rights.json",
        "record_ids": [
          "VXI-EXT-PROCUREMENT-TUF-INITIAL-ROOT-TRUST-BOOTSTRAP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-ROTATION-DUAL-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-UNIQUE-SIGNATURE-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-INTERMEDIATE-VERSION-CHAIN-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-INTERMEDIATE-ROOT-EXPIRY-BOUNDARY-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TIMESTAMP-SIGNATURE-FRESHNESS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SAME-TIMESTAMP-NORMAL-STOP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SNAPSHOT-CROSS-METADATA-BINDING-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATION-ALL-ANCESTOR-PATHS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TERMINATING-DELEGATION-NO-FALLBACK-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATOR-RETAINS-PUBLISHING-AUTHORITY-01-v1"
        ],
        "attribution": "Based on The Update Framework Specification, version 1.0.37 (2026-10-08), by The Update Framework Working Group, retrieved from https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md. Source material is licensed under the Community Specification License 1.0: https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/LICENSE.md. VAREXIS-INDEX supplies an original bounded documentation review; it does not verify a buyer deployment or certify an implementation.",
        "disclaimer": "THESE MATERIALS ARE PROVIDED “AS IS.” The Contributors and Licensees expressly disclaim any warranties (express, implied, or otherwise), including implied warranties of merchantability, non-infringement, fitness for a particular purpose, or title, related to the materials.  The entire risk as to implementing or otherwise using the materials is assumed by the implementer and user. IN NO EVENT WILL THE CONTRIBUTORS OR LICENSEES BE LIABLE TO ANY OTHER PARTY FOR LOST PROFITS OR ANY FORM OF INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER FROM ANY CAUSES OF ACTION OF ANY KIND WITH RESPECT TO THIS DELIVERABLE OR ITS GOVERNING AGREEMENT, WHETHER BASED ON BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND WHETHER OR NOT THE OTHER MEMBER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.",
        "notice_text_origin": "Distribution disclaimer reproduced verbatim from captured Community Specification License 1.0 §8.2. The licence text is copyright 2020 Joint Development Foundation, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), as the captured licence states at line97.",
        "source_bindings": [
          {
            "source_id": "tuf-spec",
            "sha256": "87c7136231b8cb3355736d8e7cfe88380d030cb2994ea283a19e78e03fb171ff",
            "lines": [
              1,
              20
            ],
            "supports": "Title, date 2026-10-08 and VERSION 1.0.37"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              5,
              9
            ],
            "supports": "Copyright grant and §1.2 Working Group/material name/version/source attribution requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              61,
              63
            ],
            "supports": "§8.2 materially similar distribution disclaimer requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              97,
              99
            ],
            "supports": "Licence-text attribution and CC BY 4.0"
          }
        ],
        "immutable_record_boundary": "Original standalone record bytes are preserved. This companion notice accompanies the publication package and exact preview; retain it when redistributing the reviewed material."
      }
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-TUF-DELEGATOR-RETAINS-PUBLISHING-AUTHORITY-01-v1",
      "route_id": "agentic_reviewed_tuf_delegator_retains_publishing_authority",
      "title": "TUF delegation without relinquishment",
      "question": "Does delegating a TUF target role remove the parent publisher’s authority over those targets?",
      "record_url": "/varexis-index/records/tuf-delegator-retains-publishing-authority.json",
      "record_sha256": "cb75e111bccf943f1d001a43d425d35383586b08ac7fa9a85d091196ab18dabc",
      "preview_url": "/varexis-index/publications/pub-2-tranche-52-v1/routes/agentic_reviewed_tuf_delegator_retains_publishing_authority.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-TUF-DELEGATOR-RETAINS-PUBLISHING-AUTHORITY-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false,
      "source_rights_notice": {
        "id": "tuf-specification-1.0.37",
        "url": "/varexis-index/publications/pub-2-tranche-52-v1/source-rights.json",
        "record_ids": [
          "VXI-EXT-PROCUREMENT-TUF-INITIAL-ROOT-TRUST-BOOTSTRAP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-ROTATION-DUAL-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-UNIQUE-SIGNATURE-THRESHOLD-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-ROOT-INTERMEDIATE-VERSION-CHAIN-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-INTERMEDIATE-ROOT-EXPIRY-BOUNDARY-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TIMESTAMP-SIGNATURE-FRESHNESS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SAME-TIMESTAMP-NORMAL-STOP-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-SNAPSHOT-CROSS-METADATA-BINDING-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATION-ALL-ANCESTOR-PATHS-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-TERMINATING-DELEGATION-NO-FALLBACK-01-v1",
          "VXI-EXT-PROCUREMENT-TUF-DELEGATOR-RETAINS-PUBLISHING-AUTHORITY-01-v1"
        ],
        "attribution": "Based on The Update Framework Specification, version 1.0.37 (2026-10-08), by The Update Framework Working Group, retrieved from https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/tuf-spec.md. Source material is licensed under the Community Specification License 1.0: https://raw.githubusercontent.com/theupdateframework/specification/e2bc7d83d0740aaae8dd7133dd4f237ce3d86b16/LICENSE.md. VAREXIS-INDEX supplies an original bounded documentation review; it does not verify a buyer deployment or certify an implementation.",
        "disclaimer": "THESE MATERIALS ARE PROVIDED “AS IS.” The Contributors and Licensees expressly disclaim any warranties (express, implied, or otherwise), including implied warranties of merchantability, non-infringement, fitness for a particular purpose, or title, related to the materials.  The entire risk as to implementing or otherwise using the materials is assumed by the implementer and user. IN NO EVENT WILL THE CONTRIBUTORS OR LICENSEES BE LIABLE TO ANY OTHER PARTY FOR LOST PROFITS OR ANY FORM OF INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER FROM ANY CAUSES OF ACTION OF ANY KIND WITH RESPECT TO THIS DELIVERABLE OR ITS GOVERNING AGREEMENT, WHETHER BASED ON BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND WHETHER OR NOT THE OTHER MEMBER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.",
        "notice_text_origin": "Distribution disclaimer reproduced verbatim from captured Community Specification License 1.0 §8.2. The licence text is copyright 2020 Joint Development Foundation, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), as the captured licence states at line97.",
        "source_bindings": [
          {
            "source_id": "tuf-spec",
            "sha256": "87c7136231b8cb3355736d8e7cfe88380d030cb2994ea283a19e78e03fb171ff",
            "lines": [
              1,
              20
            ],
            "supports": "Title, date 2026-10-08 and VERSION 1.0.37"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              5,
              9
            ],
            "supports": "Copyright grant and §1.2 Working Group/material name/version/source attribution requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              61,
              63
            ],
            "supports": "§8.2 materially similar distribution disclaimer requirement"
          },
          {
            "source_id": "tuf-license",
            "sha256": "f40b1d00369c21b963293189b4617b5de439a11858541c07c620984634fb63b7",
            "lines": [
              97,
              99
            ],
            "supports": "Licence-text attribution and CC BY 4.0"
          }
        ],
        "immutable_record_boundary": "Original standalone record bytes are preserved. This companion notice accompanies the publication package and exact preview; retain it when redistributing the reviewed material."
      }
    }
  ]
}