{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T13:36:43.315Z",
  "record_id": "VXI-EXT-PROCUREMENT-SLSA-EXPECTATIONS-01-v1",
  "record_kind": "external_reference",
  "title": "SLSA provenance: Trusted builder and expected inputs",
  "system": "SLSA",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does possessing SLSA provenance prove the package came from the expected build?",
  "near_questions": [
    "Who is the trusted builder?",
    "Was the provenance signature checked?",
    "Which build type was expected?",
    "Were external parameters compared?",
    "What happens to unrecognized parameters?",
    "Who defined the acceptance expectations?",
    "Is an attached provenance file already verified?",
    "Does the verifier bind the actual artifact?",
    "Are dependencies checked recursively or excluded?",
    "Which SLSA version is being applied?",
    "Does provenance establish application correctness?",
    "Can I retain the build-expectation review?"
  ],
  "supported_claims": [
    {
      "claim": "The reviewed SLSA v1.2 guidance requires verification against expectations: trusted builder identity, provenance signature, build type and external parameters. Unrecognized external parameters should fail verification. Merely retaining a provenance document does not perform those checks or establish the buyer-specific expected build.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "The reviewed SLSA v1.2 guidance requires verification against expectations: trusted builder identity, provenance signature, build type and external parameters. Unrecognized external parameters should fail verification. Merely retaining a provenance document does not perform those checks or establish the buyer-specific expected build.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "SLSA verifying artifacts",
    "source_url": "https://slsa.dev/spec/v1.2/verifying-artifacts",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-SLSA-EXPECTATIONS-01-v1",
    "candidate_record_sha256": "a9e402296dc670746f8acb42d72c8aa7b1b01105f2e8a27387c1b5dce244d49f",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "The reviewed SLSA v1.2 guidance requires verification against expectations: trusted builder identity, provenance signature, build type and external parameters. Unrecognized external parameters should fail verification. Merely retaining a provenance document does not perform those checks or establish the buyer-specific expected build.",
    "required_buyer_context": "SLSA v1.2 guidance, artifact, builder trust, build type and external parameters. Effective configuration and dated operational evidence have not been inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "claim_to_check": "A provenance attachment alone proves the expected supplier build was used.",
    "documented_statement": {
      "status": "documented",
      "statement": "The reviewed SLSA v1.2 guidance requires verification against expectations: trusted builder identity, provenance signature, build type and external parameters. Unrecognized external parameters should fail verification. Merely retaining a provenance document does not perform those checks or establish the buyer-specific expected build.",
      "source_ids": [
        "slsa"
      ]
    },
    "buyer_evidence_required": [
      "Trusted builder mapping and expected source/build criteria.",
      "Signed provenance and artifact identity.",
      "Parameter comparison and verifier outcome."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Form and check expectations before relying on provenance as acceptance evidence."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "slsa",
        "url": "https://slsa.dev/spec/v1.2/verifying-artifacts",
        "final_url": "https://slsa.dev/spec/v1.2/verifying-artifacts",
        "title": "SLSA verifying artifacts",
        "checked_on": "2026-10-16",
        "sha256": "3922b210da9ea002d2c267edf89864382bf4e582d3da9bbc8164ef8fe977a8b1",
        "bytes": 35578
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Preserve explicit build-acceptance questions alongside the reviewed provenance guidance.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "SLSA v1.2 guidance, artifact, builder trust, build type and external parameters."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#slsa-provenance-expected-build-parameters",
  "machine_readable_record": "/varexis-index/records/slsa-provenance-expected-build-parameters.json"
}