{"schema":"quox.evidence.item/1","claim_id":null,"computed_status":null,"status_history":[],"issuer":"Quox","open_findings":[],"withheld_findings":0,"citations":[],"id":"artifact:security-audit-log","kind":"artifact","statement":"The signed log of Quox's published security audit cycles and findings (schema quox.security-audit-log.v1).","not_claimed":"Not a complete list of every issue that exists, and not a third-party audit.","status":"published","status_note":"14 cycle(s), 101 finding(s); one Ed25519 signature covers the whole canonicalized log.","independent":{"kind":"self","note":"Signed by the Quox publisher key; anyone can verify it offline, no third party has audited it."},"dates":{"first":"2026-09-19T15:11:18.624Z","latest":"2026-10-02T12:57:23.224Z","as_of":"2026-10-02T12:57:23.224Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"securityAudits.json"},{"type":"artifact","url":"/evidence/quoxtrust-verify.mjs","label":"Dependency-free offline verifier"}],"limitations":"Authenticity of the publisher key rests on the committed public key; the log lists allowlisted fields only.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the log is complete or that the findings are correctly graded.","capabilities":["security-audit","artifact"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"$"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"detail":{"cycles":14,"findings":101,"schema":"quox.security-audit-log.v1"},"human_url":"/evidence/explore#artifact:security-audit-log","machine_url":"/evidence/items/artifact:security-audit-log.json","api_url":"/api/evidence/artifact:security-audit-log","contract":{"authentic_is_not_correct":"A valid signature or a recomputed hash proves a record is authentic and unmodified. It does not prove the system behaved correctly or that a finding list is complete.","independence":"self = issued by Quox and recomputable by anyone, not audited by a third party. visitor-recomputable = the reader recomputes it offline from published material. external = an outside party issued or hosts the primary record. Quox-verified is never independently verified.","curated_status":"status OWNER-APPROVED means the owner approved the wording for publication. It is not a computed VERIFIED status. computed_status, where present, is computed from proof-engine runs and is reported separately.","verify_caveat":"authentic != correct. A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly."}}