{
  "schema": "varexis-index-publication-manifest/1",
  "version": "pub-5-tranche-55-v1",
  "baseline_commit": "5406a5cced32b6c06d3187e51f8f32a0d6e04086",
  "tranches": [
    "public-safe-tranche-55"
  ],
  "record_count": 32,
  "route_count": 32,
  "complete": true,
  "next_page": null,
  "lookup": "Enumerate this complete manifest; compare record_id or route_id for exact equality and fetch its listed HTTPS JSON URL. Never infer a URL or fall back to related evidence for an unknown ID.",
  "boundary": "Catalogue additions are available free through the exact HTTP JSON links below. Enhanced natural-language discovery is not yet qualified for these records. They are outside MCP search, MCP preview and paid saved retrieval. No search qualification, executable capability or entitlement is added.",
  "records": [
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDEVENTS-SOURCE-ID-OCCURRENCE-COUNT-01-v1",
      "route_id": "agentic_reviewed_cloudevents_source_id_occurrence_count",
      "title": "CloudEvents deduplication and occurrence counts",
      "question": "Can CloudEvents id alone identify duplicate business actions across several sources?",
      "record_url": "/varexis-index/records/cloudevents-source-id-occurrence-count.json",
      "record_sha256": "fdc3e5e117b0cdded78f8e30ce22e8becc1dcb59c87f22c86ff5b60990925711",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_cloudevents_source_id_occurrence_count.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-CLOUDEVENTS-SOURCE-ID-OCCURRENCE-COUNT-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/cloudevents/spec/fc1f6f31f5f011a72183f1bcea20c987cb683ade/cloudevents/spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDEVENTS-SOURCE-PRODUCER-IDENTITY-01-v1",
      "route_id": "agentic_reviewed_cloudevents_source_producer_identity",
      "title": "CloudEvents source context and producer identity",
      "question": "Does a CloudEvents source URI identify exactly one authenticated emitting process?",
      "record_url": "/varexis-index/records/cloudevents-source-producer-identity.json",
      "record_sha256": "1e90e6a84fc46a48f61e700c35a56bf6e2cd487b7e52d95ff0f06e72c81a3035",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_cloudevents_source_producer_identity.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-CLOUDEVENTS-SOURCE-PRODUCER-IDENTITY-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/cloudevents/spec/fc1f6f31f5f011a72183f1bcea20c987cb683ade/cloudevents/spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDEVENTS-TIME-FALLBACK-POLICY-01-v1",
      "route_id": "agentic_reviewed_cloudevents_time_fallback_policy",
      "title": "CloudEvents occurrence-time interpretation",
      "question": "Does CloudEvents time always represent the actual time the underlying action happened?",
      "record_url": "/varexis-index/records/cloudevents-time-fallback-policy.json",
      "record_sha256": "1b1260c9d459bdb222f57d0e574bd473859c2b30bbe78b7b51304fd51ce390a0",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_cloudevents_time_fallback_policy.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-CLOUDEVENTS-TIME-FALLBACK-POLICY-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/cloudevents/spec/fc1f6f31f5f011a72183f1bcea20c987cb683ade/cloudevents/spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDEVENTS-SPECVERSION-PAYLOAD-SCHEMA-01-v1",
      "route_id": "agentic_reviewed_cloudevents_specversion_payload_schema",
      "title": "CloudEvents envelope version versus data schema",
      "question": "Does CloudEvents specversion 1.0 identify the exact payload schema or specification patch version?",
      "record_url": "/varexis-index/records/cloudevents-specversion-payload-schema.json",
      "record_sha256": "09ac21b7a474c857c21ebfd12b16a373c688ffe49e46ef48bc2df08484984925",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_cloudevents_specversion_payload_schema.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-CLOUDEVENTS-SPECVERSION-PAYLOAD-SCHEMA-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/cloudevents/spec/fc1f6f31f5f011a72183f1bcea20c987cb683ade/cloudevents/spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDEVENTS-NULL-VERSUS-ABSENT-PAYLOAD-01-v1",
      "route_id": "agentic_reviewed_cloudevents_null_versus_absent_payload",
      "title": "CloudEvents absent and explicit-null data",
      "question": "Does a CloudEvents envelope with missing data mean the same as an explicit null payload?",
      "record_url": "/varexis-index/records/cloudevents-null-versus-absent-payload.json",
      "record_sha256": "f1faaebb3d9ea0c5a610a93be0f7b6ac00d942dfe29040c3590858c8e16bdc50",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_cloudevents_null_versus_absent_payload.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-CLOUDEVENTS-NULL-VERSUS-ABSENT-PAYLOAD-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/cloudevents/spec/fc1f6f31f5f011a72183f1bcea20c987cb683ade/cloudevents/spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDEVENTS-JSON-PAYLOAD-DECODING-01-v1",
      "route_id": "agentic_reviewed_cloudevents_json_payload_decoding",
      "title": "CloudEvents JSON decoding and original data",
      "question": "Should a CloudEvents JSON consumer parse a string-valued JSON data field again as a JSON document?",
      "record_url": "/varexis-index/records/cloudevents-json-payload-decoding.json",
      "record_sha256": "03d0a0278e8657e1168ab637685e9975b8228365968f90264215715442bb300e",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_cloudevents_json_payload_decoding.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-CLOUDEVENTS-JSON-PAYLOAD-DECODING-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/cloudevents/spec/fc1f6f31f5f011a72183f1bcea20c987cb683ade/cloudevents/formats/json-format.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDEVENTS-HTTP-MODE-CONTENT-TYPE-01-v1",
      "route_id": "agentic_reviewed_cloudevents_http_mode_content_type",
      "title": "CloudEvents HTTP envelope versus payload media type",
      "question": "Does an HTTP Content-Type header always describe only the CloudEvents event payload?",
      "record_url": "/varexis-index/records/cloudevents-http-mode-content-type.json",
      "record_sha256": "74c615882b2d54af5b678602986b18d0911be01875b7ba3c19619262afd2e78f",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_cloudevents_http_mode_content_type.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-CLOUDEVENTS-HTTP-MODE-CONTENT-TYPE-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/cloudevents/spec/fc1f6f31f5f011a72183f1bcea20c987cb683ade/cloudevents/bindings/http-protocol-binding.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDEVENTS-HTTP-BATCH-NEGOTIATION-01-v1",
      "route_id": "agentic_reviewed_cloudevents_http_batch_negotiation",
      "title": "CloudEvents negotiated batch scope",
      "question": "Can a sender use CloudEvents HTTP batched mode without receiver solicitation and mix specification versions?",
      "record_url": "/varexis-index/records/cloudevents-http-batch-negotiation.json",
      "record_sha256": "28bddde71c9a4b28d490a8a6a2e2e454599c19d3c5551df15de04544ae0b2631",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_cloudevents_http_batch_negotiation.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-CLOUDEVENTS-HTTP-BATCH-NEGOTIATION-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/cloudevents/spec/fc1f6f31f5f011a72183f1bcea20c987cb683ade/cloudevents/bindings/http-protocol-binding.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDEVENTS-WEBHOOK-ACCEPTED-NOT-PROCESSED-01-v1",
      "route_id": "agentic_reviewed_cloudevents_webhook_accepted_not_processed",
      "title": "CloudEvents webhook processing acknowledgements",
      "question": "Does a CloudEvents HTTP webhook response of 202 establish that its event was processed?",
      "record_url": "/varexis-index/records/cloudevents-webhook-accepted-not-processed.json",
      "record_sha256": "56dd4a3d99558eee62092664b223a0ac3cd0812acbebee7a6d2b6a49b25b4035",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_cloudevents_webhook_accepted_not_processed.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-CLOUDEVENTS-WEBHOOK-ACCEPTED-NOT-PROCESSED-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/cloudevents/spec/fc1f6f31f5f011a72183f1bcea20c987cb683ade/cloudevents/http-webhook.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDEVENTS-WEBHOOK-HANDSHAKE-NOT-AUTHENTICATION-01-v1",
      "route_id": "agentic_reviewed_cloudevents_webhook_handshake_not_authentication",
      "title": "CloudEvents subscription consent and authentication",
      "question": "Does the CloudEvents webhook OPTIONS handshake authenticate the sender or authorise its business action?",
      "record_url": "/varexis-index/records/cloudevents-webhook-handshake-not-authentication.json",
      "record_sha256": "4d88f91b50fef69631face85b8c094f06ebf49d9a2fda16b57349b78e74568d5",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_cloudevents_webhook_handshake_not_authentication.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-CLOUDEVENTS-WEBHOOK-HANDSHAKE-NOT-AUTHENTICATION-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/cloudevents/spec/fc1f6f31f5f011a72183f1bcea20c987cb683ade/cloudevents/http-webhook.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDEVENTS-TRACE-EXTENSION-ORIGINAL-CONTEXT-01-v1",
      "route_id": "agentic_reviewed_cloudevents_trace_extension_original_context",
      "title": "CloudEvents original trace versus transport hops",
      "question": "Should ce-traceparent be replaced by each intermediary HTTP hop traceparent when forwarding a CloudEvent?",
      "record_url": "/varexis-index/records/cloudevents-trace-extension-original-context.json",
      "record_sha256": "0623c9119eee5e5daccf4471dd1ffe8f381e4f2ced07ddb92b8c294e49d42e98",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_cloudevents_trace_extension_original_context.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-CLOUDEVENTS-TRACE-EXTENSION-ORIGINAL-CONTEXT-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/cloudevents/spec/fc1f6f31f5f011a72183f1bcea20c987cb683ade/cloudevents/extensions/distributed-tracing.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDEVENTS-SEQUENCE-TYPE-WRAP-BOUNDARY-01-v1",
      "route_id": "agentic_reviewed_cloudevents_sequence_type_wrap_boundary",
      "title": "CloudEvents sequence interpretation and wraparound",
      "question": "Can a CloudEvents sequence value be sorted as an unbounded global event counter?",
      "record_url": "/varexis-index/records/cloudevents-sequence-type-wrap-boundary.json",
      "record_sha256": "def76d13faf754b089b0490b63a258402207348214b7c0e30cdf3e4c2239b661",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_cloudevents_sequence_type_wrap_boundary.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-CLOUDEVENTS-SEQUENCE-TYPE-WRAP-BOUNDARY-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/cloudevents/spec/fc1f6f31f5f011a72183f1bcea20c987cb683ade/cloudevents/extensions/sequence.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDEVENTS-DATAREF-RETENTION-EVIDENCE-01-v1",
      "route_id": "agentic_reviewed_cloudevents_dataref_retention_evidence",
      "title": "CloudEvents referenced payload lifetime",
      "question": "Does retaining a CloudEvent with dataref preserve its payload for a later audit?",
      "record_url": "/varexis-index/records/cloudevents-dataref-retention-evidence.json",
      "record_sha256": "694f2365ef62d72a839ecee1932802537627f0e3c86ebe8ef8f39516e8d2a1a4",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_cloudevents_dataref_retention_evidence.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-CLOUDEVENTS-DATAREF-RETENTION-EVIDENCE-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/cloudevents/spec/fc1f6f31f5f011a72183f1bcea20c987cb683ade/cloudevents/extensions/dataref.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDEVENTS-PARTITION-KEY-HOP-CHANGES-01-v1",
      "route_id": "agentic_reviewed_cloudevents_partition_key_hop_changes",
      "title": "CloudEvents partition keys across intermediaries",
      "question": "Does an unchanged CloudEvents source guarantee that partitionkey remains stable through every hop?",
      "record_url": "/varexis-index/records/cloudevents-partition-key-hop-changes.json",
      "record_sha256": "0fa0aa77410e5c4f66105e3e07aa254bc107ddd8e8f74e1c82ef496721e4dcc8",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_cloudevents_partition_key_hop_changes.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-CLOUDEVENTS-PARTITION-KEY-HOP-CHANGES-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/cloudevents/spec/fc1f6f31f5f011a72183f1bcea20c987cb683ade/cloudevents/extensions/partitioning.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-INTOTO-EXPECTED-COMMAND-WARNING-01-v1",
      "route_id": "agentic_reviewed_intoto_expected_command_warning",
      "title": "in-toto command alignment warnings",
      "question": "Does successful in-toto verification establish that every reported command exactly matched expected_command?",
      "record_url": "/varexis-index/records/intoto-expected-command-warning.json",
      "record_sha256": "94c2bbfaccf7700d32bf132dee074d0c8a73ded7a6b55b7ddf5c05240bcde595",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_intoto_expected_command_warning.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-INTOTO-EXPECTED-COMMAND-WARNING-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/in-toto/specification/6459afd8e94a332e423ba05c2862b534acbe741d/in-toto-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-INTOTO-STEP-BYPRODUCTS-NOT-VERIFIED-01-v1",
      "route_id": "agentic_reviewed_intoto_step_byproducts_not_verified",
      "title": "in-toto step outputs and exit results",
      "question": "Does in-toto default verification check a step return-value and its stdout or stderr?",
      "record_url": "/varexis-index/records/intoto-step-byproducts-not-verified.json",
      "record_sha256": "c40b0fd46b43f04da57caf4afed3b5f724613f274cc239e331d4e861cbe43cb4",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_intoto_step_byproducts_not_verified.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-INTOTO-STEP-BYPRODUCTS-NOT-VERIFIED-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/in-toto/specification/6459afd8e94a332e423ba05c2862b534acbe741d/in-toto-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-INTOTO-VERIFICATION-INSPECTION-PROCESSES-01-v1",
      "route_id": "agentic_reviewed_intoto_verification_inspection_processes",
      "title": "in-toto verification can execute inspections",
      "question": "Is in-toto layout verification always a read-only signature check?",
      "record_url": "/varexis-index/records/intoto-verification-inspection-processes.json",
      "record_sha256": "22771f7567cb34ce6b6efd614d82293af31140249b60e4fa0177c06c7de41d6e",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_intoto_verification_inspection_processes.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-INTOTO-VERIFICATION-INSPECTION-PROCESSES-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/in-toto/specification/6459afd8e94a332e423ba05c2862b534acbe741d/in-toto-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-INTOTO-IMPLICIT-ALLOW-UNMATCHED-ARTIFACTS-01-v1",
      "route_id": "agentic_reviewed_intoto_implicit_allow_unmatched_artifacts",
      "title": "in-toto unmatched artifact acceptance",
      "question": "Does an in-toto artifact rule list reject every artifact that its explicit rules did not match?",
      "record_url": "/varexis-index/records/intoto-implicit-allow-unmatched-artifacts.json",
      "record_sha256": "045b0f03b1191eeb7bf5313e0e1959e936ae711f98879d6b702e6defa6e95b72",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_intoto_implicit_allow_unmatched_artifacts.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-INTOTO-IMPLICIT-ALLOW-UNMATCHED-ARTIFACTS-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/in-toto/specification/6459afd8e94a332e423ba05c2862b534acbe741d/in-toto-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-INTOTO-RULE-CONSUMPTION-ORDER-01-v1",
      "route_id": "agentic_reviewed_intoto_rule_consumption_order",
      "title": "in-toto ordered artifact consumption",
      "question": "Can a later in-toto DISALLOW rule reject an artifact already consumed by an earlier ALLOW rule?",
      "record_url": "/varexis-index/records/intoto-rule-consumption-order.json",
      "record_sha256": "22e6ba6d0eb656b01dd9fcbcc465dca2b2243dc707e1725b89815e2d2a5ee9b7",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_intoto_rule_consumption_order.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-INTOTO-RULE-CONSUMPTION-ORDER-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/in-toto/specification/6459afd8e94a332e423ba05c2862b534acbe741d/in-toto-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-INTOTO-MATCH-NONMATCH-CONSUMPTION-01-v1",
      "route_id": "agentic_reviewed_intoto_match_nonmatch_consumption",
      "title": "in-toto MATCH and explicit rejection",
      "question": "Does an in-toto MATCH rule by itself fail verification when artifact hashes differ?",
      "record_url": "/varexis-index/records/intoto-match-nonmatch-consumption.json",
      "record_sha256": "1094543b5e6c48d65d8892d892304eba3ccfdbf6be6e0935dd9edd7f26d5b79e",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_intoto_match_nonmatch_consumption.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-INTOTO-MATCH-NONMATCH-CONSUMPTION-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/in-toto/specification/6459afd8e94a332e423ba05c2862b534acbe741d/in-toto-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-INTOTO-MODIFY-HASH-NOT-SEMANTIC-CHANGE-01-v1",
      "route_id": "agentic_reviewed_intoto_modify_hash_not_semantic_change",
      "title": "in-toto MODIFY and intended changes",
      "question": "Does an in-toto MODIFY rule prove that a required business or security fix was implemented?",
      "record_url": "/varexis-index/records/intoto-modify-hash-not-semantic-change.json",
      "record_sha256": "21a68d13031c503e8b6d618bf03a0e62fe7933e16a27784e53897f195827df7e",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_intoto_modify_hash_not_semantic_change.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-INTOTO-MODIFY-HASH-NOT-SEMANTIC-CHANGE-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/in-toto/specification/6459afd8e94a332e423ba05c2862b534acbe741d/in-toto-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-INTOTO-LAYOUT-EXPIRY-CLOCK-BOUNDARY-01-v1",
      "route_id": "agentic_reviewed_intoto_layout_expiry_clock_boundary",
      "title": "in-toto layout expiry and verifier time",
      "question": "Can a correctly signed in-toto layout remain trusted after its expiry date?",
      "record_url": "/varexis-index/records/intoto-layout-expiry-clock-boundary.json",
      "record_sha256": "07c2ae28711794825f9d45d6352bc253c688bb19f264ebb922c677e456fdbe94",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_intoto_layout_expiry_clock_boundary.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-INTOTO-LAYOUT-EXPIRY-CLOCK-BOUNDARY-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/in-toto/specification/6459afd8e94a332e423ba05c2862b534acbe741d/in-toto-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-INTOTO-LINK-REUSE-LAYOUT-BINDING-01-v1",
      "route_id": "agentic_reviewed_intoto_link_reuse_layout_binding",
      "title": "in-toto link reuse across layouts",
      "question": "Does a signed in-toto link prove that a step ran freshly for one particular layout verification?",
      "record_url": "/varexis-index/records/intoto-link-reuse-layout-binding.json",
      "record_sha256": "d15f5199632d4c4a40701d7623af4b4afabae84156be42cad1f80848c4301d2a",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_intoto_link_reuse_layout_binding.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-INTOTO-LINK-REUSE-LAYOUT-BINDING-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/in-toto/specification/6459afd8e94a332e423ba05c2862b534acbe741d/in-toto-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-INTOTO-SUBLAYOUT-BOUNDARY-ARTIFACTS-01-v1",
      "route_id": "agentic_reviewed_intoto_sublayout_boundary_artifacts",
      "title": "in-toto delegated sublayout boundaries",
      "question": "Does a parent in-toto layout directly receive every intermediate artifact from a verified sublayout?",
      "record_url": "/varexis-index/records/intoto-sublayout-boundary-artifacts.json",
      "record_sha256": "2a5527c258d6bd30fff6c26e38130dad6eb979de1b30862cb39b157c3187f328",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_intoto_sublayout_boundary_artifacts.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-INTOTO-SUBLAYOUT-BOUNDARY-ARTIFACTS-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/in-toto/specification/6459afd8e94a332e423ba05c2862b534acbe741d/in-toto-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-DSSE-KEYID-UNTRUSTED-SELECTION-HINT-01-v1",
      "route_id": "agentic_reviewed_dsse_keyid_untrusted_selection_hint",
      "title": "DSSE key identifiers and trusted signers",
      "question": "Can a DSSE keyid be used as authenticated evidence of the signer or signature algorithm?",
      "record_url": "/varexis-index/records/dsse-keyid-untrusted-selection-hint.json",
      "record_sha256": "c7df30ca8243c4aa1438c60fbcb272dadbb5a4bdba3f9a3f9a3e6a24ddb67081",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_dsse_keyid_untrusted_selection_hint.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-DSSE-KEYID-UNTRUSTED-SELECTION-HINT-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/secure-systems-lab/dsse/b531b787bb3e5f0c3e1c19cee84da1c5d569b061/protocol.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-DSSE-PAYLOAD-TYPE-SCHEMA-BINDING-01-v1",
      "route_id": "agentic_reviewed_dsse_payload_type_schema_binding",
      "title": "DSSE authenticated payload interpretation",
      "question": "Does a valid DSSE signature permit an application to interpret its payload under any JSON schema?",
      "record_url": "/varexis-index/records/dsse-payload-type-schema-binding.json",
      "record_sha256": "77ac0dcf1eeb95b7f52b5065dca89082235134f40d847918519d1468dcbcabb6",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_dsse_payload_type_schema_binding.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-DSSE-PAYLOAD-TYPE-SCHEMA-BINDING-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/secure-systems-lab/dsse/b531b787bb3e5f0c3e1c19cee84da1c5d569b061/protocol.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-DSSE-VERIFIED-BYTES-APPLICATION-HANDOFF-01-v1",
      "route_id": "agentic_reviewed_dsse_verified_bytes_application_handoff",
      "title": "DSSE verified bytes and application use",
      "question": "Can a DSSE verifier reparse the original envelope after verification to obtain the application payload?",
      "record_url": "/varexis-index/records/dsse-verified-bytes-application-handoff.json",
      "record_sha256": "ae4d2807bba51cc6693b373e4b79392e2eed3f36c99b98845a65e4dc732e8da2",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_dsse_verified_bytes_application_handoff.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-DSSE-VERIFIED-BYTES-APPLICATION-HANDOFF-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/secure-systems-lab/dsse/b531b787bb3e5f0c3e1c19cee84da1c5d569b061/protocol.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDEVENTS-WEBHOOK-REDIRECT-PROHIBITION-01-v1",
      "route_id": "agentic_reviewed_cloudevents_webhook_redirect_prohibition",
      "title": "CloudEvents webhook redirects and destination control",
      "question": "Can a CloudEvents HTTP receiver follow a redirect without changing the authorised destination?",
      "record_url": "/varexis-index/records/cloudevents-webhook-redirect-prohibition.json",
      "record_sha256": "aa7a19a6cfca561f8f223978f35ed7527c06abd01d7371d5feca84e6a00114d5",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_cloudevents_webhook_redirect_prohibition.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-CLOUDEVENTS-WEBHOOK-REDIRECT-PROHIBITION-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/cloudevents/spec/fc1f6f31f5f011a72183f1bcea20c987cb683ade/cloudevents/http-webhook.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDEVENTS-WEBHOOK-RETIRED-DESTINATION-01-v1",
      "route_id": "agentic_reviewed_cloudevents_webhook_retired_destination",
      "title": "CloudEvents retired webhook destinations",
      "question": "When must a CloudEvents sender stop delivery after a 410 Gone response?",
      "record_url": "/varexis-index/records/cloudevents-webhook-retired-destination.json",
      "record_sha256": "eb3c477354c13cc5f3685afc6f29c58ad23b5e792a1df641d27a0dff0f445e71",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_cloudevents_webhook_retired_destination.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-CLOUDEVENTS-WEBHOOK-RETIRED-DESTINATION-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/cloudevents/spec/fc1f6f31f5f011a72183f1bcea20c987cb683ade/cloudevents/http-webhook.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDEVENTS-WEBHOOK-RATE-LIMIT-BACKOFF-01-v1",
      "route_id": "agentic_reviewed_cloudevents_webhook_rate_limit_backoff",
      "title": "CloudEvents rate-limit retry timing",
      "question": "Can a CloudEvents sender ignore Retry-After on a 429 response without violating its delivery contract?",
      "record_url": "/varexis-index/records/cloudevents-webhook-rate-limit-backoff.json",
      "record_sha256": "bb8dd6e08e766847bbe8375ff3b3019534662f4eeddbcfb4fd0a247439c12606",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_cloudevents_webhook_rate_limit_backoff.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-CLOUDEVENTS-WEBHOOK-RATE-LIMIT-BACKOFF-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/cloudevents/spec/fc1f6f31f5f011a72183f1bcea20c987cb683ade/cloudevents/http-webhook.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-INTOTO-SUBLAYOUT-CACHED-INSPECTION-01-v1",
      "route_id": "agentic_reviewed_intoto_sublayout_cached_inspection",
      "title": "in-toto signed inspection reuse",
      "question": "Can a signed in-toto sublayout inspection result be reused without rerunning its inspection command?",
      "record_url": "/varexis-index/records/intoto-sublayout-cached-inspection.json",
      "record_sha256": "3e10786b88985ca5b6d89bd4b37de85258d78878211e93dbb6312f00b043e2cd",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_intoto_sublayout_cached_inspection.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-INTOTO-SUBLAYOUT-CACHED-INSPECTION-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/in-toto/specification/6459afd8e94a332e423ba05c2862b534acbe741d/in-toto-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    },
    {
      "record_id": "VXI-EXT-PROCUREMENT-INTOTO-SUBLAYOUT-LINK-NAMESPACE-01-v1",
      "route_id": "agentic_reviewed_intoto_sublayout_link_namespace",
      "title": "in-toto delegated link namespaces",
      "question": "Does in-toto disambiguate links from sublayouts that reuse the same step name?",
      "record_url": "/varexis-index/records/intoto-sublayout-link-namespace.json",
      "record_sha256": "d74aa85f339e034060ec483ac2689080ebcf0d0868d9c34beecfe4fcb38180e3",
      "preview_url": "/varexis-index/publications/pub-5-tranche-55-v1/routes/agentic_reviewed_intoto_sublayout_link_namespace.json",
      "review_url": "/varexis-index/vendor-evidence.html#VXI-EXT-PROCUREMENT-INTOTO-SUBLAYOUT-LINK-NAMESPACE-01-v1",
      "reviewed_on": "2026-10-24",
      "source_url": "https://raw.githubusercontent.com/in-toto/specification/6459afd8e94a332e423ba05c2862b534acbe741d/in-toto-spec.md",
      "payment_required": false,
      "purchase_url": null,
      "access": "exact_http_only",
      "mcp_available": false,
      "natural_language_search_qualified": false
    }
  ]
}