{"schema":"quox.evidence.item/1","id":"claim:registry_claims.quoxproof_provenance","kind":"claim","claim_id":"quox.quoxproof.provenance.v1","statement":"quoxproof is published on PyPI with build provenance an outside party can trace to its source repository and commit.","not_claimed":null,"status":"OWNER-APPROVED","status_note":"Owner-approved wording for publication. This is owner-curated, not a computed VERIFIED status.","computed_status":null,"status_history":[],"independent":{"kind":"external","note":"Primary record is issued or hosted by PyPI, outside Quox."},"issuer":"PyPI","dates":{"first":"2026-09-28","latest":"2026-09-28","as_of":"2026-09-28"},"freshness":{"staleness_days":90,"stale":false,"expires":"2026-12-27","as_of":"2026-10-23"},"evidence":[{"type":"pypi","url":"https://pypi.org/project/quoxproof/","label":"Inspect the PEP 740 provenance attestation PyPI generated via Trusted Publishing (https://pypi.org/integrity/quoxproof/0.2.0/ , per-file provenance returns HTTP 200). PyPI, not Quox, binds the published artifact to the GitHub repository and commit it was built from."}],"limitations":"PyPI provenance attests where the artifact was built from (repository and commit); it is not an independent audit of what the code does.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. PyPI attests where the artifact was built from; it is not an audit of what the code does.","open_findings":[],"withheld_findings":0,"capabilities":["quoxproof_provenance"],"verify":{"method":"pypi-provenance","artifact_url":"https://pypi.org/project/quoxproof/","receipt_url":null,"public_key":null,"public_key_source":null,"locator":null,"verifier_cmd":null,"reproduction":"Inspect the PEP 740 provenance attestation PyPI generated via Trusted Publishing (https://pypi.org/integrity/quoxproof/0.2.0/ , per-file provenance returns HTTP 200). PyPI, not Quox, binds the published artifact to the GitHub repository and commit it was built from.","browser_verifiable":false},"citations":[{"url":"https://pypi.org/project/quoxproof/","label":"PyPI"}],"detail":{"path":"registry_claims.quoxproof_provenance"},"human_url":"/evidence/explore#claim:registry_claims.quoxproof_provenance","machine_url":"/evidence/items/claim:registry_claims.quoxproof_provenance.json","api_url":"/api/evidence/claim:registry_claims.quoxproof_provenance","contract":{"authentic_is_not_correct":"A valid signature or a recomputed hash proves a record is authentic and unmodified. It does not prove the system behaved correctly or that a finding list is complete.","independence":"self = issued by Quox and recomputable by anyone, not audited by a third party. visitor-recomputable = the reader recomputes it offline from published material. external = an outside party issued or hosts the primary record. Quox-verified is never independently verified.","curated_status":"status OWNER-APPROVED means the owner approved the wording for publication. It is not a computed VERIFIED status. computed_status, where present, is computed from proof-engine runs and is reported separately.","verify_caveat":"authentic != correct. A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly."}}