roadmap(assurance): establish public-sector deployment readiness

[ubugeeei]

Objective

Make Vize suitable for serious public-sector procurement and deployment without claiming certification or accreditation that has not been independently granted.

This work is part of #3131. It treats assurance as verifiable behavior and retained evidence, not as branding or a configuration flag.

Principles

• Fail closed at every protected trust boundary.
• Require explicit identity, authorization, transport evidence, and audit ownership.
• Keep the portable contract language-neutral across JavaScript, Rust, Go, and JVM hosts.
• Preserve exact diagnostics and conformance fixtures across implementations.
• Keep browser-facing code independent from server assurance code.
• Record residual risk and deployment responsibilities next to every built-in control.
• Never describe a deployment as certified without an external assessment and buyer approval.
• Name packages and directories for one concrete responsibility; do not add generic umbrella areas.

Delivery sequence

Each item should be a small conventional PR and may auto-merge only after all required checks are green.

• Reject unknown, malformed, prototype-bearing, and weakened policy input at runtime.
• Add non-weakenable high-assurance access-policy defaults to the shared schema.
• Require explicit identity and bounded allow-or-deny decisions before protected handler work.
• Require per-request evidence from the trusted listener rather than inferring network trust.
• Provide equivalent host-side admission semantics and stable denial codes for every supported backend family.
• Produce a machine-readable control-to-implementation-to-test traceability index.
• Add negative conformance fixtures for anonymous, malformed, denied, failed, late, and cross-scope decisions.
• Add deployment evidence packaging with artifact digest, resolved policy, approvals, test results, and rollback reference.
• Add privacy-impact and threat-model templates with data-flow and retention inventories.
• Add accessible-service evidence covering keyboard, screen reader, zoom, contrast, motion, language, error recovery, and user testing.
• Add operational evidence for service objectives, capacity, monitoring, incident exercises, backup restoration, recovery time, and recovery point measurements.
• Add vulnerability intake, remediation targets, exception ownership, expiry, and supported-version evidence.
• Add independent penetration-test and accessibility-assessment release gates for a designated deployment candidate.
• Publish a procurement-facing support, compatibility, migration, deprecation, and evidence-retention policy.
• Bind protected key custody, purpose, rotation, revocation, destruction, and compromise exercises to release admission.
• Bind reviewed source, isolated builds, exact artifacts, component inventories, signatures, and reproducibility to release admission.
• Authenticate contiguous audit ranges, exact exports, independent retention, clock evidence, and checkpoint replay state.
• Replace the generic test-result reference with release-bound, independently observed test-run evidence.
• Make release decisions and all accepted anti-replay state one durable atomic transition.

Required control families

• configuration and change admission;
• identity lifecycle and phishing-resistant authentication integration;
• least-privilege authorization and separation of duties;
• transport and network boundary validation;
• data classification, minimization, retention, deletion, and disclosure control;
• secret and key lifecycle management;
• tamper-evident audit, independent checkpoints, monitoring, and investigation;
• input validation, resource exhaustion, abuse prevention, and availability;
• signed update and rollback protection for native and desktop targets;
• reproducible release evidence, dependency inventory, source provenance, and deployment admission;
• release-bound test execution, failure, retry, coverage, and environment evidence;
• accessibility and inclusive-service verification;
• incident response, continuity, restoration, and disaster recovery;
• supplier support, vulnerability remediation, and end-of-life management.

Exit criteria

A public-sector readiness claim is allowed only for a named version and deployment profile when:

1. every applicable control has an owner, implementation reference, passing verification reference, and stated residual risk;
2. all required CI, conformance, package, browser, native, desktop, and backend-host gates pass on the release commit;
3. release artifacts and retained evidence resolve to the same reviewed source and digest;
4. independent security and accessibility assessments have no unresolved critical findings;
5. restore and incident exercises meet the approved measured objectives;
6. the adopting organization has completed its own risk, privacy, identity, hosting, and accreditation decisions;
7. documentation clearly distinguishes built-in controls, deployment obligations, evaluated scope, and unsupported claims.

Non-goals

• A framework flag that claims automatic compliance.
• Shipping a preferred identity provider or policy engine.
• Trusting client-side authorization.
• Treating a hash chain as immutable storage.
• Treating path existence or a green unit test as sufficient audit evidence.

[ubugeeei]

Implementation checkpoint (not yet merged):

• Added a versioned deployment evidence contract with strict JSON Schema and bounded collections.
• Added matching TypeScript and Rust validation, canonical serialization, SHA-256 fingerprints, and fail-closed admission.
• Bound artifact, source, application-contract, and resolved-policy fingerprints to independently observed promotion inputs.
• Required distinct human approval, build/approval separation, retained checks, artifact integrity, and tested rollback evidence for high assurance.
• Added consolidated CLI validate, canonical, fingerprint, schema, and admit commands with bounded input.
• Added shared positive, negative, unknown-field, canonical, and fingerprint fixtures plus hostile-input tests.
• Added operator documentation and machine-readable control traceability.
• Full universal verification passed locally, including package checks, builds, export and compressed-size gates, browser tests, TypeScript tests, Rust tests, formatting, and strict lints.

The roadmap checkbox remains open until the work is isolated into a small reviewed change and merged with required checks green.

[ubugeeei]

Assurance hardening checkpoint (not yet merged):

• Added a distinct, versioned deployment observation contract for facts assembled by the trusted promotion boundary.
• Admission now compares application, environment, source, contract, builder, build time, artifact verification, complete approval records, complete check records, rollback facts, and the independently resolved policy fingerprint.
• Evidence can no longer serve as its own observation: the formats and strict schemas are intentionally distinct.
• High assurance requires an authenticated service or system observer with an assurance statement.
• Added TypeScript and Rust validation, canonical serialization, SHA-256 fingerprints, schema parity checks, hostile inputs, unknown-field rejection, and cross-language fixtures.
• Replaced positional digest arguments with a bounded observation document in the consolidated CLI.
• Updated operator guidance to prohibit deriving observations from submitted evidence and to require substitution-resistant retention.
• Full universal verification is green, including browser tests, package builds, compressed-size gates, TypeScript tests, Rust tests, formatting, and strict lints.

The roadmap checkbox remains open until this work is isolated, reviewed, and merged with required checks green.

[ubugeeei]

Progress update — portable assurance assessment and promotion binding

Completed in this working milestone:

• Removed the standalone umbrella area and moved ownership to responsibility-named framework and Rust modules. Public framework boundaries are now policy, server enforcement, deployment admission, and assurance assessment. Machine evidence and operational guidance live under assurance.
• Added a strict versioned assurance-assessment contract covering application scope, environments, trust zones, information assets, retention and verified disposition, data flows, privacy impact, threats, residual-risk treatment, review deadlines, and accountable approvals.
• Added hostile-input shape validation, bounded collections and text, unknown-property rejection, stable source-addressable diagnostics, and full cross-reference validation.
• Added non-weakenable high-assurance invariants: annual reassessment, complete asset and flow threat coverage, protected cross-boundary enforcement, restricted-log protection, privacy-impact evidence, distinct accountable human roles, and time-bounded risk acceptance.
• Implemented matching TypeScript and Rust models, validators, canonical serialization, and SHA-256 fingerprints. Shared fixtures prove identical canonical bytes, fingerprints, invalid diagnostic code/path pairs, and ordering independence.
• Extended the consolidated Rust CLI with assurance schema, validate, canonical, and fingerprint commands. The trusted caller selects high validation; serialized input cannot select a weaker profile for itself.
• Bound high-assurance deployment admission to a required assurance-assessment check. Its evidence must be assurance-assessment:, and the independently produced promotion observation must contain the identical check record. Mutable references are rejected in both TypeScript and Rust.
• Added the assessment operations guide, deployment lifecycle guidance, evidence-index traceability, and complete CI path coverage for assessment, deployment, documentation, and evidence changes.

Verification is green:

• the complete universal repository gate, including checks, builds, unit tests, browser interaction tests, SFC policy checks, export validation, documentation-comment defaults, compressed-size budgets, shared-contract conformance, Rust formatting, tests, doctests, and strict lint;
• production documentation build with 144 generated outputs;
• framework deployment entry remains inside its blocking gzip budget at 8,667 / 8,704 bytes.

Important trust boundary retained in the documentation: admission binds an exact assessment fingerprint, but promotion infrastructure must retrieve that assessment from controlled storage, validate it with a trusted clock and the high profile, verify application/environment/contract scope against the candidate, authenticate approvals, and protect both the assessment and observation from substitution. No certification or accreditation claim is made.

Next small slices:

• add a promotion-boundary assessment resolver that performs retrieval and candidate-scope comparison before emitting the observed check;
• add an authenticated attestation envelope and key-rotation model for retained assessment and observation records;
• add assessment authoring and migration diagnostics to the project doctor without weakening the language-neutral contract;
• add change-impact rules that require reassessment when contract, data classification, residency, trust-zone, or material flow facts change.

[ubugeeei]

Follow-up: the first next slice from the preceding update is now implemented and verified.

• TypeScript promotion resolution retrieves the retained assessment by the requested fingerprint through a caller-owned controlled resolver. Retrieval is cancellable, fail-closed, and bounded to 10 seconds by default with a documented 60-second maximum.
• Resolution always applies the high-assurance profile, recomputes the canonical fingerprint, and compares application, environment, and application-contract scope before emitting a passed assurance-assessment check. Resolver failures, cancellation, timeout, substitution, malformed candidates, stale assessments, and scope mismatch cannot produce a passed check.
• Rust exposes the matching promotion admission primitive after controlled retrieval and returns the exact evidence value that the trusted observation must retain.
• Documentation and the machine-readable assurance evidence index now describe the resolver boundary and remaining operator responsibility.
• The complete universal gate is green after the change. The assurance entry is 6,841 / 10,240 gzip bytes, while the deployment entry remains 8,667 / 8,704 bytes.

[ubugeeei]

Implementation update — authenticated evidence admission

Completed locally:

• Added strict, versioned attestation and trust-store contracts for reviewed assessments and independent deployment observations.
• Bound document digest, application, environment, application-contract fingerprint, purpose, audience, issuer, key, validity window, and monotonic sequence into domain-separated canonical signing bytes.
• Added two canonical signature profiles with fixed key/signature encodings, canonical-signature enforcement, and matching TypeScript/Rust verification.
• Added active, retired, and revoked key lifecycle enforcement; purpose-limited keys; bounded validity; explicit rotation chains; cycle rejection; trust-generation rollback detection; and sequence replay detection.
• Added atomic high-level admission APIs so assessment or deployment allow results are emitted only after document validation, exact release binding, trust, signed scope, freshness, and replay checks.
• Added a consolidated Rust CLI for attestation/trust schemas, validation, canonicalization, fingerprints, and verification.
• Split lightweight verification from integrated admission. Measured gzip sizes are 5,598 bytes for @vizejs/framework/attestation and 6,266 bytes for @vizejs/framework/attestation/admission; the browser core remains unchanged at 12,842 bytes.
• Added shared cross-language fixtures, strict schemas, hostile-input and unknown-field rejection, tampering, substitution, replay, trust rollback, retirement, revocation, rotation-cycle, and canonical-signature negative tests.
• Added operator documentation covering trust bootstrap, private-key custody, rotation/revocation, durable generation and sequence state, atomic promotion state, retention, and remaining accreditation responsibilities.

Verification completed:

• The universal gate passed across workspace lint, builds, tests, compressed-size budgets, browser tests, TypeScript/Rust conformance, documentation references, and public-option default documentation.
• Documentation production build completed with 146 outputs.

The trust store remains an out-of-band operator-controlled input, and private signing keys remain outside Vize. Deployment-specific key custody, cryptographic-module, independent assessment, and accreditation requirements remain explicit operator and buyer responsibilities.

[ubugeeei]

Change-impact admission milestone

Implemented and verified in the current working tree:

• Vize native cross-file analysis now exposes deterministic dependency edges on demand.
• Doctor computes transitive source impact, application-contract compatibility, reassessment invalidation, required evidence, and fail-closed decisions for incomplete graph coverage.
• The TypeScript and Rust boundaries share strict versioned report and review contracts, canonical JSON, SHA-256 fingerprints, schemas, and conformance fixtures.
• Doctor CLI accepts repeated changed files plus paired previous/current application contracts, with project-root confinement and bounded input handling.
• Review resolution requires exactly one retained result and SHA-256 digest for every evidence class.
• High-assurance deployment admission now requires a fingerprint-bound change-impact check.
• The implementation is split by responsibility: policy, assurance, attestation, and admission. No standalone platform, backends, protocol, or security directory remains in the audited repository structure.
• Documentation, navigation, evidence registration, residual limitations, and operational examples are included.

Verification completed:

• Universal workspace gate: passed across framework, native, desktop, terminal UI, UI, compose, and the dogfood application.
• Framework tests: 77 passed.
• Doctor CLI tests: 9 passed.
• Rust unit, conformance, CLI, runtime, and documentation tests: passed.
• Browser accessibility interaction tests: 5 passed.
• Public-option default documentation and assurance-evidence checks: passed.
• Documentation build: 147 output files generated.
• Size gates: passed; change-impact is 13,444 gzip bytes under 14 KiB, and deployment is 8,697 gzip bytes under 8.5 KiB.

No pull request was opened from this tree because it contains mixed pre-existing work that cannot be isolated safely without risking unrelated changes. The implementation should be split into small conventional pull requests before enabling auto-merge.

[ubugeeei]

Service-continuity milestone completed locally.

• Added a strict language-neutral assessment for recovery-time, recovery-point, restored-capacity, data-integrity, exercise-coverage, validity, and distinct accountable approvals.
• Added matching TypeScript and Rust validation, canonical serialization, SHA-256 fingerprints, strict JSON Schema, shared fixtures, hostile-input coverage, and consolidated CLI commands.
• Bound high-assurance deployment to the exact service-continuity-assessment:<sha256> reference. Mutable labels, stale records, scope substitution, incomplete exercise coverage, and contradictory measurements fail closed.
• Reissued the signed deployment-observation fixture after the continuity binding changed its canonical digest, then verified the signature and trust lifecycle in both implementations.
• Added operational documentation, evidence-index traceability, workflow paths, public exports, lazy-loading boundaries, and compressed-size budgets.
• Kept responsibilities under concrete ownership boundaries; no standalone security, platform, backends, or protocol package/directory was added.

Verification:

• Universal workspace gate: passed.
• Framework: 82 tests passed; format, lint, build, export, and size gates passed.
• Rust application contracts: all unit, conformance, CLI, and documentation tests passed; formatting and Clippy passed.
• Browser interaction suite: 5 tests passed.
• Documentation: 149 outputs generated. Existing local Mermaid image-generation attempts timed out, but the documentation build completed successfully.
• Compressed entry sizes: service continuity 5,215 bytes; deployment admission 8,708 bytes.

No commit or pull request was created because the shared worktree contains broad pre-existing and concurrent changes that cannot be isolated safely.

[ubugeeei]

Vulnerability-response admission milestone

Implemented a strict, language-neutral vulnerability-response assessment for one exact release candidate.

Delivered

• Matching TypeScript and Rust validation, canonical serialization, and SHA-256 fingerprints.
• A strict JSON Schema plus shared canonical fixtures.
• Non-weakenable acknowledgement, triage, and remediation targets for every severity.
• Complete dependency, source, and exact-artifact evidence with bounded freshness.
• A measured private-intake exercise using the critical response target.
• Derived finding deadlines, explicit dispositions, independently approved and bounded exceptions, and rejection of critical risk acceptance.
• Supported-release enforcement, distinct response and release approvals, and bounded assessment validity.
• Bounded, cancellable promotion resolution that binds application, environment, contract, source revision, release, and canonical assessment fingerprint.
• Exact high-assurance deployment evidence using vulnerability-response-assessment:<sha256>.
• Consolidated CLI commands for schema, validation, canonical output, and fingerprints.
• Operator documentation and machine-readable assurance traceability.

Verification

• Framework tests: 87 passed.
• Rust package: all unit, conformance, CLI, and documentation tests passed.
• Browser accessibility tests: 5 passed.
• Formatting, lint, type checks, export checks, option-default documentation, evidence references, Rust formatting, and warning-free Rust linting passed.
• Full universal repository gate passed.
• Documentation production build passed.
• Compressed production sizes:
  • vulnerability-response entry: 7,203 bytes / 16,384-byte budget
  • deployment entry with exact admission bindings: 8,746 bytes / 9,216-byte budget

No pull request was opened from the current shared worktree because it contains broad pre-existing work that cannot be isolated safely into a small reviewable change.

[ubugeeei]

Milestone evidence: independent penetration-test and accessibility-assessment release gates

Implemented two separate, release-bound assurance contracts without adding an umbrella package or directory:

• strict language-neutral schemas for independent penetration tests and accessibility assessments;
• exact application, environment, contract, source revision, artifact digest, and target bindings;
• deterministic canonical JSON and matching SHA-256 fingerprints in TypeScript and Rust;
• fail-closed validation for authorization, evaluator independence, method completeness, representative scope, interoperability, user evaluation, findings, retests, exceptions, validity, and distinct approvals;
• bounded and cancellable controlled-storage resolvers;
• public package subpaths and consolidated Rust CLI schema, validate, canonical, and fingerprint commands;
• mandatory high-assurance penetration-test checks and exact fingerprint references for both assessment types at deployment admission;
• independently observed deployment parity and refreshed signed observation fixtures;
• operator documentation, evidence-index controls, and workflow path coverage.

Verification completed:

• node tools/check-universal.mjs;
• 97 framework tests;
• 5 browser accessibility-interaction tests;
• all application-contract Rust unit, integration, CLI, conformance, and documentation tests;
• Rust formatting and Clippy with warnings denied;
• package checks, builds, exports, SFC lint, and compressed-size gates across web, native, desktop, terminal, UI, and composable packages;
• compressed entry sizes: penetration test 7,111 / 16,384 bytes; accessibility assessment 7,322 / 16,384 bytes; deployment admission 8,787 / 9,216 bytes.

The contracts retain external assessment results; they do not claim certification, replace qualified independent evaluators, or prove that an undeclared deployment surface has been assessed.

[ubugeeei]

Product-lifecycle procurement milestone implemented and verified:

• Added a strict language-neutral policy for exact release support windows, public-surface decisions, support routes, response targets, compatibility evidence, migration and deprecation windows, emergency exceptions, complete record retention, and distinct accountable approvals.
• Added matching TypeScript and Rust validation, deterministic canonical serialization, SHA-256 fingerprinting, hostile-input rejection, and exact release-candidate admission.
• Exposed the optional @vizejs/framework/product-lifecycle entry and consolidated vize-application lifecycle commands.
• Made product-lifecycle a mandatory high-assurance deployment check with exact product-lifecycle-policy:<sha256> evidence binding.
• Reconciled the procurement-facing support policy, vulnerability reporting policy, stability guidance, deployment operations, documentation navigation, and machine-readable assurance evidence index.
• Shared lifecycle fixture fingerprint: f83fb74da3d3dd4979249a37c2395717c55088d327fee545913c471389ca83b9.
• Updated resolved policy fingerprint: a1b10fd199fba11ea99c20b51f4afc98b86dbcbe798cf5b80507310818435521.
• Updated deployment evidence fingerprint: 42da4c57332d04f47579446d86885753b59ac21cd26d728d5cc031961496d3d5.
• Updated independent observation fingerprint: 16ad47429f1edb637490b09931bb63812ed124cb7f57f56ee61ff9de7b405b39.
• Reissued the observation attestation with an ephemeral signing key and retained only its public verification material.
• The complete universal gate passed, including formatting, linting, TypeScript tests, Rust tests and doctests, strict static analysis, builds, public-entry checks, SFC policy checks, browser tests, evidence-index checks, and gzip budgets.

No pull request was opened because the shared worktree contains broad pre-existing and overlapping changes that cannot be isolated safely into a small reviewable change.

[ubugeeei]

Milestone complete: release-bound key lifecycle admission

Implemented the next high-assurance roadmap slice without introducing a generic umbrella package or directory.

• Added a strict vize.key-lifecycle.assessment contract, shared JSON Schema, canonical fixtures, and SHA-256 fingerprinting.
• Added TypeScript and Rust validation with matching canonical output and promotion admission.
• Enforced purpose-limited key inventory, protected private/secret material, owner/custodian separation, bounded cryptoperiods, acyclic replacement, exact lifecycle state, and retained evidence fingerprints.
• Required passed inventory, generation, storage, access, usage, rotation, revocation, recovery, destruction, and monitoring controls.
• Required a current measured compromise exercise with bounded revocation, replacement, and completion targets.
• Required distinct key-owner, independent-reviewer, and release-owner approvals.
• Added the optional @vizejs/framework/key-lifecycle entry and the consolidated vize-application key-lifecycle commands.
• Added the high-assurance key-lifecycle deployment check with exact key-lifecycle-assessment:<sha256> binding and independent observation parity.
• Reissued the observation attestation against the new canonical deployment observation using an ephemeral signing key; no private key was persisted.
• Added operator guidance, evidence traceability, navigation, and workflow path coverage.

Verification:

• TypeScript: 107 tests passed.
• Rust focused conformance, CLI, deployment, policy, and attestation suites passed.
• Full universal gate passed across framework, native, desktop, terminal UI, UI packages, testing packages, browser tests, CLI, Rust formatting/tests/lints, public-option documentation, exports, and compressed-size budgets.
• Optional key-lifecycle entry: 6,701 gzip bytes.
• Core framework entry: 13,301 / 13,312 gzip bytes.

Current fingerprints:

• Key-lifecycle assessment: 86e76f34e10513496f9b75c7e0e6b7564c443cc80e4efc20e83f458f004848fd
• Resolved high-assurance policy: baa6b48d150155dc07a6882df6297745fe26d2d753709efac7cc4e666d18d1eb
• Deployment evidence: 95c81ac10f3c694c8de64d93aa543a4dc7d01780f7647304a2cfdebb14cf66ca
• Independent observation: 7a1e3e5b3fb2bbd61bee45ac741f820fb45d3c323bd76bdeee409e58c568cdf7
• Observation attestation: 8e19383d2cae7d6c99dc2b01be10a9f7870acf5b9c453a9a0d825ccd49b2a407
• Trust store: 466d1f821d61ca7548e228824e8db95d3f889f174f659798a3e232ebba929259

Residual responsibility remains explicit: operators must independently approve algorithm profiles, verify real protection boundaries and module requirements, authenticate custodians and evidence stores, operate revocation/destruction, monitor production use, and repeat assessment after material changes. This evidence is not certification or accreditation.

[ubugeeei]

Milestone: release-bound build provenance

Implemented a fail-closed release-provenance contract and connected it to high-assurance promotion.

• Binds the reviewed source tree and dependency lock to an authenticated, isolated, ephemeral build invocation.
• Binds every delivered artifact to its digest, size, media type, passed signature result, exact provenance, and complete component inventory.
• Requires all source, build, artifact, inventory, and reproducibility controls to pass.
• Requires a byte-identical rebuild by a distinct builder and three distinct accountable approvals.
• Rejects unknown fields, mutable references, expired assessments, scope substitution, artifact substitution, and builder substitution.
• Provides matching TypeScript and Rust validation, canonical serialization, fingerprints, promotion admission, strict schema, shared fixtures, and CLI commands.
• Exposes an optional @vizejs/framework/release-provenance subpath; measured production entry size is 5,820 gzip bytes and it remains absent from the core entry.
• High-assurance deployment now requires release-provenance-assessment:<sha256> and independently observes the exact check.
• Refreshed the signed deployment observation and trust fixture after adding the new required check.
• Updated the assurance guide, operating procedure, deployment guide, navigation, workflow coverage, and machine-readable evidence index.

Canonical assessment fingerprint:
460be8cb0195c0d73e30ddc5ca9de625a9a6ed9080bb1ebf08c084b28d9e0864

Verification completed locally:

• 112 framework tests
• 27 focused Rust conformance and attestation tests
• strict formatting, linting, type checks, schema checks, CLI checks, export isolation, and compressed-size budgets

The evidence index now marks release-provenance admission as implemented while retaining explicit operational and buyer-specific residual risks. This is traceable engineering evidence, not certification or accreditation.

[ubugeeei]

Universal verification is green for the release-provenance milestone. The gate passed workspace formatting, linting, type checks, builds, unit and browser tests, SFC policy checks, compressed-size budgets, CLI checks, cross-language schemas and fingerprints, Rust tests, documentation tests, and signed-observation admission. No pull request was opened because the shared worktree contains broad pre-existing and concurrent changes that cannot be isolated safely.

[ubugeeei]

Audit checkpoint milestone

Implemented the authenticated audit-checkpoint boundary without introducing a generic security package or directory. The responsibility is exposed directly as audit-checkpoint.

Delivered:

• strict language-neutral checkpoint schema with hostile-input and unknown-field rejection;
• exact contiguous event-range verification, prior checkpoint and event linkage, canonical export bytes, SHA-256 fingerprint, and byte-count binding;
• append-only primary retention plus a distinct independently administered archive;
• authoritative-clock evidence, eight mandatory control results, and independent verifier separation;
• purpose-limited signed checkpoint envelopes with trust-generation rollback protection and monotonic sequence replay protection;
• exact audit-checkpoint:<sha256> high-assurance deployment binding and independently observed release evidence;
• TypeScript and Rust parity, embedded schema, consolidated CLI validation/canonical/fingerprint/export verification, shared fixtures, and negative conformance tests;
• lazy @vizejs/framework/audit-checkpoint export with a 20 KiB gzip budget (17,698 bytes measured);
• operator guidance, threat-boundary documentation, machine-readable evidence inventory, and CI path coverage.

Canonical checkpoint fingerprint: 8fca8ae9c66927b72dd0cd1a56ec370586516e9a4a4f372f900ed49c3b5b2fcb

Signed checkpoint attestation fingerprint: df7e3954ae731c21d0d0cd3e07c10e85e346b71071c5f9d76eed49d1beecf184

Updated deployment evidence fingerprint: 775d9d5626f684429616988f3d42a785cafdc6a8fc28534ba7951f63b5c8b96e

Updated independent observation fingerprint: 3f2698f23beac066e41a141f04382d9564758dbdce2b520c2fce595c09191ecb

Updated trust-store fingerprint: ab5aa64da4953a9606dacb28471a3935a872058515fcd016ee2b3d46cdbc39e9

Verification: the complete universal gate passed, including all package checks/builds/exports/tests/size budgets, browser interaction tests, SFC policy checks, CLI tests, TypeScript/Rust conformance, Rust formatting, and clippy with warnings denied.

Residual boundary: operators still own complete event collection before the chain writer, independent archive operation, clock and signer protection, durable atomic sequence state, out-of-band reconciliation, and deployment-specific authorization or accreditation.