{
  "schemaVersion": "eviulon-software-supply-chain-registry-1.0",
  "version": "2.26.0",
  "generated": "2026-08-09",
  "status": "PASS",
  "recordCount": 2,
  "records": [
    {
      "id": "EVI-SCR-226-001",
      "softwareId": "urn:eviulon:software:public-portal",
      "version": "2.26.0",
      "lifecycleStates": {
        "sourcePublished": "SOURCE_PACKAGE_PRESENT",
        "buildable": "LOCAL_BUILD_RECIPE_PRESENT",
        "signed": "NO_PRODUCTION_SIGNATURE",
        "reproducible": "LOCAL_DETERMINISTIC_REPLAY_REQUIRED_IN_EXTERNAL_AUDIT",
        "deployed": "NOT_OBSERVED",
        "active": "NOT_OBSERVED",
        "superseded": false,
        "revoked": false
      },
      "sourceCommit": null,
      "sourceCommitState": "SOURCE_COMMIT_UNAVAILABLE",
      "buildInstructions": "/README.md#build-and-release",
      "dependencyManifests": [
        "/requirements-dev.txt",
        "/THIRD-PARTY-NOTICES.md"
      ],
      "sbom": null,
      "sbomState": "NOT_GENERATED",
      "artifactDigest": null,
      "artifactDigestState": "BOUND_EXTERNALLY_AFTER_ARCHIVE_CREATION",
      "primaryBuilderAttestation": "LOCAL_REPOSITORY_BUILD_ONLY",
      "independentRebuilderCount": 0,
      "independentRebuildState": "UNVERIFIED",
      "currentPackageAudit": "/docs/proof/v226-package-audit.json",
      "truthBoundary": "The in-package record cannot self-bind the final ZIP without circularity. Final archive hash, extraction replay, CRC, and deterministic rebuild are recorded in the external package audit.",
      "recordSha256": "b5798c99bbc08810125da387d5f8929a7c8f55d7502f160575726d0f1939be6f"
    },
    {
      "id": "EVI-SCR-226-002",
      "softwareId": "urn:eviulon:software:public-portal",
      "version": "2.25.0",
      "lifecycleStates": {
        "sourcePublished": "PRESERVED",
        "buildable": "PRESERVED",
        "signed": "NO_PRODUCTION_SIGNATURE",
        "reproducible": "PRIOR_LOCAL_EVIDENCE",
        "deployed": "NOT_OBSERVED",
        "active": "NOT_OBSERVED",
        "superseded": true,
        "revoked": false
      },
      "supersededBy": "2.26.0",
      "truthBoundary": "Superseded release history does not prove prior or current deployment.",
      "recordSha256": "599ccb067df9f2920d1a645c52f75a322b318b28d024376ff581776c6659ed41"
    }
  ],
  "truthBoundary": "Source, buildability, signature, reproducibility, packaging, deployment, operation, supersession, and revocation are separate states."
}