Skip to content

launch-evidence.md

Latest commit

 

History

History
47 lines (36 loc) · 3.22 KB

launch-evidence.md

File metadata and controls

47 lines (36 loc) · 3.22 KB
Raw

Launch evidence

This is an evidence inventory, not a security score. Counts describe versioned repository artifacts and reproduced local behavior; they do not claim universal scanner coverage.

Reproducible inventory

Surface Reproduced evidence Source
Detection contract 11 stable narrow detection families; 0 planned detection capabilities Generated matrix
Supporting contract 10 evidence/reporting, 1 lifecycle/distribution and 6 agent-guided capabilities; none are counted as detection coverage Generated matrix
Stable source/deployment rule corpus 25 built-in risk; 3 built-in evidence-integrity; 16 external adapter risk; 44 total Labelled corpus
Local before/after demo OS command injection lead (CWE-78); SUSPECTED HIGH -> security fixed; functional passed; side effect recorded Generated demo evidence
Ordinary project review 43 findings across 5 fixed commits -> 11 useful leads; 27 expected benign; 1 unknown; 4 confirmed facts v0.5.0 review
Source methodology studies 5 fixed-commit studies, kept separate from CLI precision claims Study method
Release v0.8.1 signed tag, reproducible archive, SPDX SBOM, checksums, manifest and provenance v0.8.1 release

Ordinary project journeys

  • Linkwarden at 62f1b81ff7f66001b0f5f613202f87771f3186ee: 0 confirmed, 6 suspected, 0 unknown in the v3 report; reviewed as 0 useful leads, 6 expected benign, 0 unknown and 0 confirmed facts.
  • Healthchecks at 49653c350cddc47fc00a471bd1b08b5771a7967c: 0 confirmed, 5 suspected, 0 unknown in the v3 report; reviewed as 4 useful leads, 1 expected benign, 0 unknown and 0 confirmed facts.
  • Open WebUI at 01f4282f1ffe0d6212f58d3afbeae21fffd0c4be: 0 confirmed, 6 suspected, 1 unknown in the v3 report; reviewed as 3 useful leads, 3 expected benign, 1 unknown and 0 confirmed facts.
  • Uptime Kuma at 6b5ea0155793e666666745fb8d6fef1e829543a2: 4 confirmed, 21 suspected, 0 unknown in the v3 report; reviewed as 4 useful leads, 17 expected benign, 0 unknown and 4 confirmed facts.
  • Mealie at 2fc22cea43f2978533f3a89a1ddeb1e6a18b245f: 0 confirmed, 0 suspected, 0 unknown in the v3 report; reviewed as 0 useful leads, 0 expected benign, 0 unknown and 0 confirmed facts.

Source methodology studies

Verification

node scripts/generate-launch-evidence.mjs --check
npm run demo -- --out ./demo-output
node scripts/check-case-journeys.mjs
node scripts/check-v050-ordinary-review.mjs
node scripts/check-p7-surfaces.mjs

A source pattern remains suspected until reproduced. Unavailable evidence remains unknown. Checksums and attestations prove artifact identity and origin, not every security conclusion.