Solutions
Regulated ops & change control
KCS provides procurement‑grade, offline‑verifiable conformance artifacts for release, policy, and evidence bundles — with pinned trust anchors and signed checksums.
Procurement‑gradePinned fingerprintsSigned checksums
Expected outputs: PASS (verifiable), FAIL (mismatch), HOLD (missing evidence/signatures; fail‑closed).
What can go wrong
- Release integrity cannot be verified (or depends on vendor dashboards).
- Supply chain drift: dependencies or artifacts change between approval and deployment.
- Silent key rotation or unpinned trust anchors break diligence and audit trails.
- Artifacts exist but are not discoverable (reviewers miss the authoritative pointers).
- Audit cannot reproduce PASS/FAIL/HOLD outcomes offline.
What reviewers attach
- 1 URL (DSSE) —
/.well-known/mvg-procurement-ticket-pack.dsse.json. - 1 ZIP — Ticket Pack (offline verifier kit + receipts).
- Site release receipts — signed site release pointers (verifier UI integrity).
- Identity receipts — Company (KYB) + Governance.
- Transparency — append‑only log + inclusion proof pointers.
Where MVG gates
Verify release artifacts
Signed manifests + pinned fingerprints; mismatches escalate immediately (FAIL/HOLD).
Change approval as a receipt
Approvals are expressed as portable receipts (not screenshots), and can be replayed.
Fail‑closed promotion
If signatures/pointers are missing, promotion must HOLD until evidence is complete.
Standards & papers
Canonical pointers live on the standards surface; immutable deposits on Zenodo.