Meridian Verity Group — /downloads

This directory is intentionally kept small (<= 100 items) for Git webapp constraints.

Purpose
- "Core evidence" and public-safe artifacts that are okay to mirror under a single stable path.

Not here (by design)
- Legal policy PDFs live under /legal/ (canonical).
- Procurement-friendly DOCX convenience copies live alongside the controlling PDFs under /legal/*/.

Integrity
- See SHA256SUMS.txt to verify file hashes.

Notes
- The controlling versions of policies are the PDF files linked from /legal/.
- Website documents are informational unless incorporated into a signed agreement (see /legal/).
New in v35
- MVG_HALTSEAL_Pilot_in_a_Box_v1.0.2_PUBLIC_SAFE.zip — self‑serve 30‑minute pilot kit (fail‑closed gateway + deterministic PASS/FAIL/HOLD vectors + receipts + DSSE signing request). Runs even if host Python is not installed; includes hardened docker‑compose defaults and third‑party notices.


New in v38
- MVG_Assurance_Pack_PUBLIC_v1.0.0.zip — public-safe sample Assurance Pack (offline-verifiable integrity + signature + contents inventory).
- MVG_Assurance_Keyring_PUBLIC_v1.0.0.dsse.json — signed, versioned keyring snapshot (rotation-ready).
- MVG_Assurance_KeyTransparency_Log_PUBLIC_v1.0.0.dsse.json — key transparency log (append-only, hash-chained; public-safe demo).

New in v38.4
- MVG_Org_Approval_Keyring_SAMPLE_v1.0.0.json — sample org approval keyring format (public keys + threshold policy).
- MVG_Org_Approval_Keyring_Spec_v1.0.0.md — spec for org approval keyring (threshold countersign evaluation).
- MVG_Receipt_Ticket_Binding_Spec_v1.0.0.md — spec for binding approvals to JIRA/ServiceNow ticket IDs (signed payload; offline verifier).

New in v38.5
- MVG_Hardware_Attested_Countersign_Spec_v1.0.0.md — optional WebAuthn evidence (platform TPM/Secure Enclave / security keys) bound to receipt countersigns; offline verifier parsing + structural checks.
