{
  "id": "EVI-RCSR-230-0166",
  "slug": "evi-clsa-c-0257-0166",
  "title": "Source research for EVI-CLSA-C-0257",
  "dependencyId": "EVI-CDEP-229-0166",
  "claimId": "EVI-CLSA-C-0257",
  "reportId": "REP-EVULGARE-CYBER-DEFENSE-001",
  "claimClass": "PRESENT_CAPABILITY_CLAIM",
  "previousDisposition": "REJECTED",
  "researchDisposition": "REJECTED",
  "sourceKey": "IETF_RFC9711",
  "sourceUrl": "https://www.rfc-editor.org/info/rfc9711",
  "publisher": "Internet Engineering Task Force / RFC Editor",
  "sourceTitle": "RFC 9711: The Entity Attestation Token (EAT)",
  "publicationOrUpdateDate": "2025-04",
  "accessDate": "2026-08-09",
  "jurisdiction": "Internet standardization",
  "claimSupported": "Bounded proposition only",
  "limitations": "An EAT carries attestation-oriented claims; relying-party policy determines how to use them, and attestation does not itself establish legal authority or citizenship.",
  "currentness": "CURRENT",
  "exactBeforePassage": "- Useful defensive concepts include short-lived workload identity, hardware and software attestation, supply-chain provenance, evidence correlation, append-only integrity, bounded containment, key epochs, reconciliation, attested recovery, and explicit abstention. - Defensive responses should be reversible, least-privilege, non-destructive, evidence-preserving, and incapable of becoming counterattack or arbitrary punishment. - A procedural click is not a merits review; restoration and authority changes require bounded roles, evidence, conflict disclosure, and independent review appropriate to the actual deployment. - Synthetic fault injection can test parser and state-machine behavior without touching production systems, customer networks, physical devices, or public infrastructure.",
  "beforeSha256": "c9d4eb85ea5c5b64a4a53700ce1abfcbb91a396e2c8aa3b50e100ef3bf621928",
  "proposedAfterPassage": "The current official source is RFC 9711: The Entity Attestation Token (EAT) (Internet Engineering Task Force / RFC Editor). It supports only the bounded technical or legal proposition identified in the source record and does not establish Eviulon production deployment, external recognition, or legal effect beyond its stated jurisdiction and scope.",
  "afterSha256": "4d8ad2490491a1fe4280c185b5e4c4021d5014b83834fe7340281cb636d7a4f8",
  "correctionNoticePublished": false,
  "correctionAppliedToSource": false,
  "correctionAppliedToActiveSynthesis": false,
  "submittedSourceMutated": false,
  "activeSynthesisMutated": false,
  "publicExplanation": "No current official external source proves a present Eviulon production capability; local package evidence cannot be promoted into a production claim.",
  "automaticApplicationProhibited": true,
  "reviewedExactlyOnce": true,
  "repositoryRuntimeNetworkCalls": 0,
  "canonicalRoute": "/reference/report-memory/source-research/v2-30/records/evi-rcsr-230-0166/",
  "machineReadableUrl": "/api/report-claim-source-research/records/evi-rcsr-230-0166.json",
  "truthBoundary": "Claim-level source-research record. A citation supports only the bounded proposition identified here. Submitted source bytes and active synthesis remain unchanged; correction notices append history and do not silently rewrite reports.",
  "recordSha256": "3ae67f60419f9ca00ffdd4b3ae260117a5653cb24dd5f67d56abf241df352aa5"
}