Trust / Governance

Governance

Controls, evidence checks, signature verification, and release attestation.

3 exact recordsSource + SHA-256Failure + recovery

Dated repository-local capture

Authority & Evidence

CAPTURED PASS2026-08-02T07:30:52Z

Dated repository-local command-output evidence captured from the named commit and tree. Reported hashes vary by execution; they are exact fields from this captured payload, not reproducible canonical constants.

Source commit: 5cec88069a5646c188079fab2c701c79b4941f34
Source tree: 7f9808af367d630265b2bb115a9f90d041e661e4
Captured payload bytes: receiz-docs/evidence/slice-6/trust-command-output.v1.json90f04e0d6aa4e29813f0ef54022b8fafdc21b8b1076429def82ae8cff13b44f3
Capture runtime: Node.js v24.15.0; pnpm 10; macOS arm64; repository-local commands

PASS

Governance controls

15 documents · 15 active families

8bba1dc326518c4de85a34de007219c04498457e150729245b4f959e5f6d4037b920acc795893361c66512017b29cc2f95ca66935ea5b2a97798dcfb57fdfef8receiz.governance.ed25519.2a7c4651102d1498

PASS

Governance evidence

4 controls

d08b41fe380fa07035f85d05520ca260d38e64043e90596d58501e79a8423354

PASS

Artifact signatures

7 artifacts · public/governance/artifact-manifest.v1.json

defeb9426855b8552b930bf1b1c790b15bb6479d2ac820ea2945b51fc347fb96receiz.governance.ed25519.2a7c4651102d1498

VERIFIED

Dated release attestation

artifacts/release-attestations/2026-06-30T18-43-21-460Z-617c943ad70e.json

Commit: 617c943ad70eae1c72ab6dda587636aa0dd32a03
Tree: f4df91467bb73f67bbb3767d45a70ceb7a238b9b
Build: Fy4kSk7jLG1YOIVrQP0BJ1ae616db02577495a4167cf383a54854d13d9b39d293d470263aa82bfa731785
Economy revision: 322edae1b449a2c0dfb3da34e0f72488df459ed852fdc972dafb8009799c9c7e
Verification revision: 4e230c6f125637a76c70dbef160e4eaa5defacc8cee114bc8bbbfcc2e2caec4b
Market revision: 15175c2566ca5e860d5538a2657c9ebe5818aff87f3982962ada3c35b670ba4c
Payload hash: c3c37fa46d27eec432a5ce8b4cf7c4d78d849e0002685f280aa2c85d61f7d5e8
Signing key: receiz.governance.ed25519.2a7c4651102d1498
Signature: sz1VpQXA_unmO6mS9Tmv-ZUwxlDJEVD5NUA4Yps31XE4kBxFLbj8qNdcjVD62APAYKJlrFBGR8rYwZP_JTbCAQ

governance-control

Governance control check

Required governance documents and control structure are checked as release evidence.

Exact source: scripts/check_governance_controls.tsSHA-2568fa9d6429e8775c2fbea9b731078aab4a7d978f649bd6323d01b1199e8c7c4a8
Implemented primitive: governance
Source of truth: Normative governance documents and registered controls.
Guarantee: Required control records exist and satisfy the script's exact structural checks.
Executable check: pnpm governance:check
Evidence output: A passing governance control report or exact failing control.
Failure meaning: Required governance structure is absent, inconsistent, or invalid.
Recovery / escalation: Correct the named control source and rerun the check before release.
Offline behavior: Repository governance controls are checked locally.
External boundary: The check does not establish live organizational practice beyond recorded evidence.
What this record does not prove: This record does not prove every control operated in production during an unobserved period.

signed-evidence-verifier

Governance artifact signature verification

Signed governance artifacts are verified against the registered public key.

Exact source: scripts/check_governance_artifact_signature.tsSHA-256a7ba1e04bc27e2106d286f532d4ece159a20974c00df1b41994917531eac7eaf
Implemented primitive: signed governance evidence
Source of truth: Exact artifact bytes, detached signature, and registered verification key.
Guarantee: A passing result establishes signature validity for the supplied bytes and key.
Executable check: pnpm governance:verify-artifact-signature
Evidence output: Verified signature result or exact unknown-key, missing-signature, or mismatch failure.
Failure meaning: Signature absent; unknown or invalid signatures retain failure status.
Recovery / escalation: Restore the original signed bytes and known key, or issue a new signed artifact through authorized custody.
Offline behavior: Signature verification executes locally with committed key material.
External boundary: Signature validity does not prove the truth of every claim inside the signed artifact.
What this record does not prove: This record does not prove an unsigned, unknown-key, or modified artifact is authentic.

release-evidence-emitter

Release attestation emission

Attestation emission follows release gates and records exact build evidence.

Exact source: scripts/create_release_attestation.tsSHA-256918a5c328799194fe44095100ba30c54eede44b956b7dcfe0d03ba5347a397db
Implemented primitive: release attestation
Source of truth: Exact release commit, tree, build, gate outputs, and signing material.
Guarantee: The command emits a dated attestation only from its observed inputs.
Executable check: pnpm release:attest
Evidence output: A dated signed attestation artifact and latest convenience pointer.
Failure meaning: No verified attestation exists for the attempted release evidence.
Recovery / escalation: Pass release gates, preserve exact outputs, then emit and independently verify the dated artifact.
Offline behavior: Local artifact creation is possible with authorized local key custody; it does not publish deployment state.
External boundary: Attestation creation may mutate release evidence and is not run by Academy validation.
What this record does not prove: This record does not prove deployment or production smoke unless those exact evidence dimensions are present and verified.