{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-24T21:56:24.175Z",
  "record_id": "VXI-EXT-PROCUREMENT-SPIFFE-FEDERATION-DOMAIN-BUNDLE-BINDING-01-v1",
  "record_kind": "external_reference",
  "title": "SPIFFE federation endpoint binding",
  "system": "SPIFFE",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does a downloaded SPIFFE trust bundle identify which trust domain it is authorized to represent?",
  "near_questions": [
    "Where does the trust-domain name for a SPIFFE bundle come from?",
    "May foreign SPIFFE bundles be merged into one CA list?",
    "Does TLS on a federation endpoint prove its configured namespace?",
    "What binds a fetched SPIFFE bundle to its trust domain?"
  ],
  "supported_claims": [
    {
      "claim": "The pinned federation specification says a bundle does not contain its trust-domain name. Clients must configure the endpoint URL, profile and associated trust domain before retrieval. Bundles from different domains must remain separate; merging them allows one domain to forge identities in another under the combined trust store. HTTPS success alone does not supply the missing domain binding.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "The buyer federation mapping and endpoint control are unknown.",
    "Authentication or a policy result does not establish business approval, safe tool behaviour or completed execution.",
    "Buyer deployment testing, live runtime enforcement, certification or permission to act",
    "Expanded capabilities or licences for existing INDEX executables"
  ],
  "public_summary": "The pinned federation specification says a bundle does not contain its trust-domain name. Clients must configure the endpoint URL, profile and associated trust domain before retrieval. Bundles from different domains must remain separate; merging them allows one domain to forge identities in another under the combined trust store. HTTPS success alone does not supply the missing domain binding.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "SPIFFE Federation",
    "source_url": "https://raw.githubusercontent.com/spiffe/spiffe/49a9cbbc018c39ec6643ad3301632f9f4549258b/standards/SPIFFE_Federation.md",
    "checked_on": "2026-10-24",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-SPIFFE-FEDERATION-DOMAIN-BUNDLE-BINDING-01-v1",
    "candidate_record_sha256": "60272c56c3a4cb79d8713990071b17a9f99babbd74fe98fe025febd6fb517c95",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "The pinned federation specification says a bundle does not contain its trust-domain name. Clients must configure the endpoint URL, profile and associated trust domain before retrieval. Bundles from different domains must remain separate; merging them allows one domain to forge identities in another under the combined trust store. HTTPS success alone does not supply the missing domain binding.",
    "required_buyer_context": "Approved endpoint/profile/domain mapping; Separate stored trust bundles; Independent approval for the endpoint-to-domain association. Buyer deployment not inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-24",
    "claim_to_check": "Does a downloaded SPIFFE trust bundle identify which trust domain it is authorized to represent?",
    "documented_statement": {
      "status": "documented",
      "statement": "The pinned federation specification says a bundle does not contain its trust-domain name. Clients must configure the endpoint URL, profile and associated trust domain before retrieval. Bundles from different domains must remain separate; merging them allows one domain to forge identities in another under the combined trust store. HTTPS success alone does not supply the missing domain binding.",
      "source_ids": [
        "spiffe-federation"
      ]
    },
    "review_inference": {
      "status": "review_inference",
      "statement": "Validate the configured issuer namespace before accepting a foreign workload. This is a source-based review decision, not an observed deployment result.",
      "source_ids": [
        "spiffe-federation"
      ]
    },
    "buyer_evidence_required": [
      "Approved endpoint/profile/domain mapping",
      "Separate stored trust bundles",
      "Independent approval for the endpoint-to-domain association"
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Do not infer domain authority from an arbitrary HTTPS bundle or merge trust domains."
    },
    "unknowns": "The buyer federation mapping and endpoint control are unknown.",
    "unknown_finding": {
      "status": "unknown",
      "statement": "The buyer federation mapping and endpoint control are unknown."
    },
    "evidence_sources": [
      {
        "source_id": "spiffe-federation",
        "url": "https://raw.githubusercontent.com/spiffe/spiffe/49a9cbbc018c39ec6643ad3301632f9f4549258b/standards/SPIFFE_Federation.md",
        "final_url": "https://raw.githubusercontent.com/spiffe/spiffe/49a9cbbc018c39ec6643ad3301632f9f4549258b/standards/SPIFFE_Federation.md",
        "status": 200,
        "captured_at_utc": "2026-10-24T21:45:00.756Z",
        "sha256": "fb287faffdf75fd1fe65bd192a319eea8fd4c8c02313cf47d21a937b3ebd4ee1",
        "bytes": 44045,
        "title": "SPIFFE Federation",
        "hash_basis": "Decoded HTTP response body bytes",
        "rights_review": "Original factual paraphrase and source metadata only; Apache-2.0 repository captures retained privately and not redistributed.",
        "checked_on": "2026-10-24",
        "capture_status": 200,
        "claim_review_completed": true,
        "reviewed_sections": [
          "4.2. Managing Fetched Bundles",
          "5.1. Endpoint Parameters",
          "4.1. Adding and Removing Keys"
        ],
        "version_context": "Pinned spiffe/spiffe revision 49a9cbbc018c39ec6643ad3301632f9f4549258b captured 2026-10-24. Documentation review, not evidence that a buyer implementation conforms."
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Documentation review only; the buyer must establish applicability and actual outcomes. INDEX does not inspect or control the deployment.",
    "paid_value": {
      "decision_context": "Validate the configured issuer namespace before accepting a foreign workload.",
      "free": "Complete review, sources, practical questions and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Recheck the pinned source, actual implementation version, policy inputs and retained decision evidence before relying on a current outcome."
    },
    "buyer_relevance": "Validate the configured issuer namespace before accepting a foreign workload.",
    "refusal_conditions": [
      "Do not infer domain authority from an arbitrary HTTPS bundle or merge trust domains."
    ]
  },
  "niche": {
    "niche_id": "agent-authority-action-evidence",
    "label": "Agent Authority & Action Evidence",
    "classification_id": "identity",
    "classification_label": "Agent Identity, Credentials & Delegation",
    "topic_id": "identity",
    "buyer_intent": "Validate the configured issuer namespace before accepting a foreign workload.",
    "comparison_role": "supplementary_discovery"
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#spiffe-federation-domain-bundle-binding",
  "machine_readable_record": "/varexis-index/records/spiffe-federation-domain-bundle-binding.json"
}