Core System Architecture Part 126 — Anonymous Network Release Evidence Repository, Certification Records, Artifact Qualification Lineage, Compliance Trace Packages & Privacy-Preserving Assurance Archive Architecture
SIAR — Secure, Local-First, Multi-Transport Communication Platform
Series: Core System Architecture
Part: 126
Status: Architecture specification
Primary language: Rust
Builds on: Core System Architecture Parts 73, 94–100, 108, 120–125
Primary purpose: define SIAR's long-lived assurance archive for release evidence, qualification records, certification history, artifact lineage, compliance trace packages, evidence retention, archive integrity, revocation/supersession, reproducibility metadata, redaction, scoped exports, and privacy-preserving historical assurance.
1. Purpose
A release decision should remain explainable long after:
the CI job expired
the repository moved
the test environment changed
the team reorganized
the release was superseded
A mature platform must answer:
What exactly qualified release X?
Which artifact digest was tested?
Which requirement baseline applied?
Which evidence was accepted?
Which exceptions were active?
Which certification was later revoked?
Can we reconstruct the release decision years later?
Can we export proof without exposing private data?
The governing principle is:
SIAR assurance history should be immutable, content-addressed, provenance-rich, release-specific, auditable, and exportable while preserving strict privacy, access control, retention, and anti-surveillance boundaries.
2. Architectural Position
RELEASE CANDIDATE
│
▼
QUALIFICATION PACKAGE
│
┌───────────┼───────────┐
│ │ │
TESTS FORMAL EXERCISES
│ │ │
└───────────┼───────────┘
▼
CERTIFICATION RECORD
│
▼
ASSURANCE REPOSITORY
│
┌───────────┼───────────┐
│ │ │
EXPORT AUDIT REPLAY
3. Core Separation
Keep distinct:
artifact
evidence
qualification package
certification record
release decision
archive record
trace package
revocation
supersession
4. Non-Goals
Part 126 does not create:
a generic document dump
a CI log warehouse
a user activity archive
developer performance records
one giant compliance export containing everything
5. Assurance Artifact Identity
#![allow(unused)] fn main() { pub struct AssuranceArtifactId(pub Digest); }
Content-addressed.
6. Release Artifact Identity
#![allow(unused)] fn main() { pub struct ReleaseArtifact { pub release: ReleaseId, pub artifact_digest: Digest, pub artifact_type: ReleaseArtifactType, } }
7. Release Artifact Type
#![allow(unused)] fn main() { pub enum ReleaseArtifactType { LinuxBinary, WindowsBinary, MacOsBinary, AndroidApk, AndroidAab, ContainerImage, FirmwareBundle, OfflineBundle, ProtocolSchemaBundle, } }
8. Hard Rule
Artifact identity is digest-based, not filename-based.
9. Qualification Package
Part 125.
#![allow(unused)] fn main() { pub struct ArchivedQualificationPackage { pub package_id: QualificationPackageId, pub release: ReleaseId, pub artifact_digest: Digest, pub requirement_baseline: RequirementBaselineId, pub architecture_baseline: ArchitectureBaselineVersion, pub verification_matrix: VerificationMatrixVersion, } }
10. Immutable Once Certified
Hard rule.
11. Qualification Package Contents
artifact digest
source revision
build provenance
SBOM
requirement baseline
architecture baseline
verification matrix version
evidence references
open accepted risks
active exceptions
rollback qualification
12. Hard rule.
13. Certification Record
#![allow(unused)] fn main() { pub struct ReleaseCertificationRecord { pub certification_id: CertificationId, pub release: ReleaseId, pub qualification_package: QualificationPackageId, pub state: CertificationState, pub issued_at: Timestamp, } }
14. Certification State
#![allow(unused)] fn main() { pub enum CertificationState { Draft, Qualified, ConditionallyQualified, Certified, Suspended, Revoked, Superseded, } }
15. No Revoked→Certified Direct
Hard rule.
16. Certification Authority
Scoped.
#![allow(unused)] fn main() { pub enum CertificationAuthority { ReleaseEngineering, SecurityAssurance, PrivacyAssurance, ReliabilityAssurance, PlatformGovernance, } }
17. No Universal Certification Superuser
Hard rule.
18. Multi-Authority Certification
Critical release may require several attestations.
19. Certification Attestation
#![allow(unused)] fn main() { pub struct CertificationAttestation { pub authority: CertificationAuthority, pub decision: CertificationDecision, pub evidence_digest: Digest, pub signed_at: Timestamp, } }
20. Certification Decision
#![allow(unused)] fn main() { pub enum CertificationDecision { Approve, ApproveWithConditions, Reject, } }
21. Conditions Must Be Explicit
Hard rule.
22. Certification Is Not Merely "CI Green"
Hard rule.
23. Evidence Record
#![allow(unused)] fn main() { pub struct AssuranceEvidenceRecord { pub evidence_id: VerificationEvidenceId, pub kind: AssuranceEvidenceKind, pub digest: Digest, pub provenance: EvidenceProvenance, pub classification: EvidenceClassification, } }
24. Evidence Kind
#![allow(unused)] fn main() { pub enum AssuranceEvidenceKind { TestResult, FuzzResult, PropertyTestResult, FormalVerificationResult, BenchmarkResult, SimulationResult, ChaosResult, OperationalExerciseReceipt, ArchitectureComplianceReport, RiskAcceptanceRecord, ChangeReceipt, ReleaseReceipt, Attestation, Sbom, BuildProvenance, } }
25. Evidence Classification
#![allow(unused)] fn main() { pub enum EvidenceClassification { Public, Internal, Restricted, SecuritySensitive, } }
26. Hard rule.
27. Evidence Provenance
Every evidence record should include:
source revision
artifact digest
runner/toolchain
environment
execution time
producer authority
28. Hard rule.
29. Evidence Digest Chain
#![allow(unused)] fn main() { pub struct EvidenceChainLink { pub current: Digest, pub previous: Option<Digest>, } }
30. Append-Only Integrity
Hard rule.
31. Archive Manifest
#![allow(unused)] fn main() { pub struct AssuranceArchiveManifest { pub archive_id: AssuranceArchiveId, pub release: ReleaseId, pub certification: CertificationId, pub package_digest: Digest, pub evidence_digests: BTreeSet<Digest>, } }
32. Signed
Hard rule.
33. Archive Object Model
Store:
manifest
certification
qualification package
evidence metadata
content-addressed evidence objects
trace metadata
revocation/supersession records
34. Hard rule.
35. Archive Store
Preferred architecture:
PostgreSQL metadata
+
content-addressed object store
36. Hard rule.
37. Metadata vs Evidence Blobs
Metadata contains:
IDs
digests
classification
lineage
state
Blobs contain detailed evidence.
38. Hard rule.
39. Content Addressing
Evidence blobs keyed by digest.
40. Hard rule.
41. Immutable Evidence
Certified evidence object is immutable.
42. Corrections create new object/version.
43. Hard rule.
44. Evidence Supersession
#![allow(unused)] fn main() { pub struct EvidenceSupersession { pub old_evidence: VerificationEvidenceId, pub new_evidence: VerificationEvidenceId, pub reason: SupersessionReason, } }
45. Historical Evidence Preserved
Hard rule.
46. Certification Supersession
New certification may supersede old release/certification.
47. Old certification remains queryable.
48. Hard rule.
49. Certification Revocation
Reasons:
#![allow(unused)] fn main() { pub enum CertificationRevocationReason { ArtifactCompromised, EvidenceInvalidated, VulnerabilityDiscovered, SigningKeyCompromise, QualificationError, PolicyViolation, } }
50. Revocation Record
#![allow(unused)] fn main() { pub struct CertificationRevocation { pub certification: CertificationId, pub reason: CertificationRevocationReason, pub revoked_at: Timestamp, pub evidence: Vec<EvidenceRef>, } }
51. Hard rule.
52. Revocation Does Not Delete History
Hard rule.
53. Revocation Propagation
Notify:
release channels
deployment control
update system
compliance trace state
54. Hard rule.
55. Archive Integrity
Need:
digest verification
manifest signature
tamper-evident append log
periodic integrity scan
56. Hard rule.
57. Integrity State
#![allow(unused)] fn main() { pub enum ArchiveIntegrityState { Verified, Degraded, Corrupted, Unknown, } }
58. Unknown ≠ Verified
Hard rule.
59. Integrity Scan
#![allow(unused)] fn main() { pub struct ArchiveIntegrityScan { pub archive: AssuranceArchiveId, pub checked_objects: u64, pub failures: Vec<Digest>, } }
60. Hard rule.
61. Long-Term Signature Validation
Signing algorithms/certs may age.
62. Preserve:
signature
certificate chain
timestamp evidence
algorithm metadata
63. Hard rule.
64. Crypto Agility
Part 66.
Archive records can be re-attested under newer algorithms without mutating old evidence.
65. Hard rule.
66. Re-Attestation Record
#![allow(unused)] fn main() { pub struct ArchiveReAttestation { pub archive: AssuranceArchiveId, pub prior_manifest_digest: Digest, pub new_signature_suite: CryptoSuiteId, pub re_attested_at: Timestamp, } }
67. Historical Signature Remains
Hard rule.
68. Reproducibility Manifest
#![allow(unused)] fn main() { pub struct ReproducibilityManifest { pub source_revision: RevisionId, pub toolchain_digest: Digest, pub dependency_lock_digest: Digest, pub build_config_digest: Digest, pub expected_artifact_digest: Digest, } }
69. Hard rule.
70. Rebuild Verification
Optional periodic replay.
71. Rebuild Result
#![allow(unused)] fn main() { pub enum RebuildVerificationState { Reproducible, NonReproducible, Inconclusive, } }
72. NonReproducible ≠ Compromised Automatically
Hard rule.
73. But Requires Investigation
Hard rule.
74. Artifact Qualification Lineage
Trace:
source revision
→ build provenance
→ artifact digest
→ verification evidence
→ qualification package
→ certification
→ deployment
75. Core requirement.
76. Lineage Record
#![allow(unused)] fn main() { pub struct ArtifactQualificationLineage { pub source_revision: RevisionId, pub artifact: Digest, pub evidence: BTreeSet<VerificationEvidenceId>, pub qualification: QualificationPackageId, pub certification: CertificationId, } }
77. Hard rule.
78. Rollback Artifact Lineage
Rollback artifact has independent qualification lineage.
79. Hard rule.
80. Delta Update Lineage
Delta package must trace to both:
base artifact
target artifact
81. Hard rule.
82. Firmware Lineage
Firmware bundle archive records:
vendor signature
source/provenance
firmware baseline
hardware compatibility
qualification
83. Hard rule.
84. Protocol Schema Lineage
Protocol bundle qualification includes:
schema version
compatibility tests
fuzz results
negotiation tests
85. Hard rule.
86. Compliance Trace Package
Purpose-specific export.
87. Trace Package
#![allow(unused)] fn main() { pub struct ComplianceTracePackage { pub package_id: ComplianceTracePackageId, pub scope: ComplianceTraceScope, pub generated_at: Timestamp, pub manifest_digest: Digest, } }
88. Compliance Trace Scope
#![allow(unused)] fn main() { pub enum ComplianceTraceScope { Control(ControlId), Release(ReleaseId), Service(ServiceId), RequirementSet(RequirementSetId), } }
89. Hard rule.
90. Trace Package Contents
Can include:
control/requirement
standard
ADR
implementation reference
test evidence
qualification result
certification
91. Hard rule.
92. Minimal Export
Export only required evidence.
93. Hard rule.
94. No Full Archive Export By Default
Hard rule.
95. Export Redaction
#![allow(unused)] fn main() { pub enum ExportRedactionPolicy { PublicSafe, Internal, AuditorRestricted, SecurityRestricted, } }
96. Hard rule.
97. Redacted Trace Package
Can substitute:
digest
metadata
verification statement
for sensitive raw evidence.
98. Hard rule.
99. Auditor Verification
Auditor can verify package manifest/signatures without seeing unrelated evidence.
100. Hard rule.
101. Evidence Disclosure Boundary
No automatic disclosure of:
private user content
secrets
internal topology beyond scope
developer personal data
102. Hard rule.
103. Legal Hold Boundary
Archive may support hold policy.
104. But legal hold applies only scoped evidence.
105. Hard rule.
106. Retention Policy
#![allow(unused)] fn main() { pub struct AssuranceRetentionPolicy { pub evidence_class: AssuranceEvidenceKind, pub retention: Duration, pub legal_hold_supported: bool, } }
107. Hard rule.
108. Retention Tiers
Example:
certification metadata → long-term
critical verification evidence → long-term
high-volume CI logs → short-term
derived summaries → rebuildable
109. Hard rule.
110. No "Keep Everything Forever"
Hard rule.
111. Evidence Expiration
Metadata may remain after raw blob expires if policy permits.
112. Hard rule.
113. Expiration Record
#![allow(unused)] fn main() { pub struct EvidenceExpirationRecord { pub evidence: VerificationEvidenceId, pub expired_at: Timestamp, pub preserved_digest: Digest, } }
114. Good.
115. Deletion / Crypto Erasure
Part 67.
Sensitive evidence can be cryptographically erased after retention.
116. Hard rule.
117. Archive Backup
Archive itself requires backup.
118. Backup copy integrity included in manifest.
119. Hard rule.
120. Geographic Residency
Part 103.
Assurance evidence may have residency constraints.
121. Hard rule.
122. Security-Sensitive Evidence
Examples:
exploit traces
internal topology
key-management verification
facility security details
123. Regional storage policy may be stricter.
124. Hard rule.
125. Archive Access Control
Use Part 81 authorization.
126. Access Scope
#![allow(unused)] fn main() { pub enum AssuranceArchiveAccessPurpose { ReleaseReview, Audit, IncidentResponse, ComplianceEvidence, Forensics, EngineeringReview, } }
127. Purpose-Bound
Hard rule.
128. Least Privilege
Hard rule.
129. No "All Engineers Can Read All Evidence"
Hard rule.
130. Archive Access Audit
Audit sensitive evidence access.
131. Avoid logging every benign metadata query unnecessarily.
132. Hard rule.
133. Break-Glass Archive Access
Temporary.
134. Cannot bypass classification/redaction silently.
135. Hard rule.
136. Evidence Packaging
Exports use deterministic manifest.
137. Package Manifest
#![allow(unused)] fn main() { pub struct TracePackageManifest { pub package_id: ComplianceTracePackageId, pub entries: Vec<TracePackageEntry>, pub generated_from_archive: AssuranceArchiveId, } }
138. Entry
#![allow(unused)] fn main() { pub struct TracePackageEntry { pub kind: AssuranceEvidenceKind, pub digest: Digest, pub redacted: bool, } }
139. Hard rule.
140. Package Signature
Sign with dedicated assurance-export key.
141. Not same as release signing key.
142. Hard rule.
143. Export Reproducibility
Same archive + same scope + same policy should produce same logical package manifest.
144. Hard rule.
145. Package Expiry
Some exported trace packages can have expiry.
146. Hard rule.
147. Package Revocation
If source certification revoked, trace package indicates stale/revoked status.
148. Hard rule.
149. Certification Record Query
#![allow(unused)] fn main() { pub trait CertificationRepository { fn certification( &self, id: CertificationId, ) -> Result<ReleaseCertificationRecord, AssuranceArchiveError>; fn for_release( &self, release: ReleaseId, ) -> Result<Vec<ReleaseCertificationRecord>, AssuranceArchiveError>; } }
150. Hard rule.
151. Artifact Lineage Query
#![allow(unused)] fn main() { pub trait ArtifactQualificationRepository { fn lineage( &self, artifact: Digest, ) -> Result<ArtifactQualificationLineage, AssuranceArchiveError>; } }
152. Trace Package Service
#![allow(unused)] fn main() { pub trait ComplianceTracePackageService { fn generate( &self, scope: ComplianceTraceScope, policy: ExportRedactionPolicy, ) -> Result<ComplianceTracePackage, AssuranceArchiveError>; } }
153. Archive Integrity Service
#![allow(unused)] fn main() { pub trait AssuranceArchiveIntegrityService { fn verify( &self, archive: AssuranceArchiveId, ) -> Result<ArchiveIntegrityState, AssuranceArchiveError>; } }
154. Replay Service
#![allow(unused)] fn main() { pub trait AssuranceReplayService { fn qualification_context( &self, release: ReleaseId, ) -> Result<HistoricalQualificationContext, AssuranceArchiveError>; } }
155. No User-Analytics API
Hard rule.
156. Historical Qualification Context
Includes:
requirements
architecture baseline
verification matrix
artifact
evidence
exceptions
accepted risks
certification
157. Hard rule.
158. Certification Conditions
Conditional certification records outstanding conditions.
159. Condition Record
#![allow(unused)] fn main() { pub struct CertificationCondition { pub condition_id: CertificationConditionId, pub description: String, pub expires_at: Option<Timestamp>, pub verification_required: bool, } }
160. Hard rule.
161. Condition Closure
Requires evidence.
162. Hard rule.
163. Expired Condition
May suspend certification depending policy.
164. Hard rule.
165. Certification Suspension
Temporary state.
166. Causes:
evidence under review
new vulnerability
qualification uncertainty
167. Hard rule.
168. Suspension ≠ Revocation
Hard rule.
169. Certification Recovery
Suspended certification may return to Certified only with fresh evidence/review.
170. Hard rule.
171. Release Channel Integration
Part 99/108.
Certification state controls promotion eligibility.
172. Hard rule.
173. Deployment Integration
Deployments should reference certification ID.
174. Hard rule.
175. Deployment Evidence
#![allow(unused)] fn main() { pub struct DeploymentCertificationBinding { pub deployment: DeploymentId, pub certification: CertificationId, pub artifact: Digest, } }
176. Artifact must match certification.
177. Hard rule.
178. Drift Detection
Deployment artifact differs from certified digest.
179. Critical finding.
180. Hard rule.
181. Revoked Artifact In Production
Trigger:
incident
update/replacement workflow
risk escalation
182. Hard rule.
183. Compliance Mapping
Part 95.
control
→ requirement
→ standard
→ implementation
→ test
→ evidence
→ certification
184. Hard rule.
185. Security Assurance Package
Can include:
threat-model controls
security requirements
fuzz/static/formal evidence
certification
186. Hard rule.
187. Privacy Assurance Package
Can include:
data-flow constraints
retention/deletion tests
privacy controls
certification
188. Hard rule.
189. Reliability Assurance Package
Can include:
SLO
resilience model
chaos/simulation evidence
DR drill
certification
190. Hard rule.
191. Supply-Chain Assurance Package
Can include:
SBOM
provenance
dependency policy
reproducibility
signature chain
192. Hard rule.
193. Facility/Hardware Assurance Package
Can include:
attestation
firmware baseline
facility controls
maintenance evidence
194. Hard rule.
195. Archive Replication
Replicate across compliant regions.
196. No replica outside residency policy.
197. Hard rule.
198. Archive Disaster Recovery
Part 100.
Need restore test.
199. Hard rule.
200. Archive Restore
Restored archive must pass integrity verification.
201. Hard rule.
202. No Blind Restore To Trusted State
Hard rule.
203. Archive Migration
Storage backend can change.
204. Migration must preserve:
digests
signatures
IDs
lineage
timestamps
205. Hard rule.
206. Archive Format Version
#![allow(unused)] fn main() { pub struct AssuranceArchiveFormatVersion(pub u32); }
207. Migration Explicit
Hard rule.
208. Interoperability Export
Use stable external schema.
209. JSON only if necessary for external consumer.
210. Internal archive metadata remains typed/Postcard-compatible.
211. Hard rule.
212. Human-Readable Archive Manifest
RON/Markdown summary.
213. Hard rule.
214. External Auditor Interface
Read-only scoped export/API.
215. No mutation authority.
216. Hard rule.
217. Archive Search
Search metadata:
release
artifact digest
certification
requirement
control
evidence kind
218. No full-text private-content search baseline.
219. Hard rule.
220. Search Result Access Control
Applied before disclosure.
221. Hard rule.
222. Archive Indexes
Recommended:
release_id
artifact_digest
certification_id
requirement_id
control_id
evidence_kind
223. Hard rule.
224. No User ID Index
Hard rule.
225. Certification Timeline
#![allow(unused)] fn main() { pub struct CertificationTimelineEntry { pub certification: CertificationId, pub state: CertificationState, pub at: Timestamp, pub evidence_digest: Option<Digest>, } }
226. Hard rule.
227. Immutable Timeline
Hard rule.
228. Archive Snapshot
Periodic signed snapshot.
229. Snapshot Root Digest
#![allow(unused)] fn main() { pub struct AssuranceArchiveSnapshot { pub snapshot_id: AssuranceArchiveSnapshotId, pub root_digest: Digest, pub generated_at: Timestamp, } }
230. Hard rule.
231. Merkle Structure
Optional for efficient integrity verification.
232. No custom crypto.
233. Hard rule.
234. Transparency Log
Possible append-only internal log.
235. Does not expose sensitive evidence publicly.
236. Hard rule.
237. Evidence Deduplication
Safe for identical encrypted/archive objects within same trust scope.
238. Do not infer user/content equality.
239. Hard rule.
240. Compression
Allowed for archive blobs.
241. Preserve digest semantics clearly.
242. Hard rule.
243. Encryption At Rest
Evidence classification may require encryption.
244. Key management Part 72/80.
245. Hard rule.
246. Archive Key Rotation
Re-encrypt/re-wrap without changing evidence identity semantics.
247. Hard rule.
248. Crypto Erasure
Destroy keys for expired sensitive evidence.
249. Hard rule.
250. Evidence Access Expiry
Temporary access tokens.
251. Hard rule.
252. Archive Roles
#![allow(unused)] fn main() { pub enum AssuranceArchiveRole { Reader, Certifier, Auditor, Exporter, ArchiveOperator, SecurityReviewer, } }
253. Scoped capabilities.
254. Hard rule.
255. No Role Implies Shell Access
Hard rule.
256. Separation Of Duties
Prefer:
evidence producer != certifier
certifier != archive operator
archive operator != export approver
for critical assurance.
257. Hard rule.
258. Evidence Producer Identity
Record service/runner identity first.
259. Human identity only where required.
260. Hard rule.
261. Workforce Privacy
Do not build:
who failed most tests
who approved most releases
who caused revocations
262. Hard rule.
263. User Privacy
No user behavior or private message content should be needed for ordinary release certification.
264. Hard rule.
265. Archive Observability
Safe metrics:
archives by integrity state
certifications by state
evidence freshness
revocations
trace package generation
266. Forbidden:
certification activity per employee
test failure per developer
user identifiers
267. Hard rule.
268. Archive SLOs
Examples:
100% certification records integrity-verified
critical archive restore test within cadence
revocation propagation within target
trace package generation within target
269. Security SLO
0 unsigned certification record accepted
0 revoked certification used for new deployment
0 restricted evidence exposed outside policy
270. Privacy SLO
0 user-behavior archive
0 workforce-performance analytics derived from assurance archive
271. Failure Modes
missing evidence blob
manifest mismatch
signature algorithm obsolete
revocation not propagated
over-retention
272. Missing Evidence Blob
Integrity state becomes Degraded/Corrupted.
273. Hard rule.
274. Manifest Mismatch
Reject archive verification.
275. Hard rule.
276. Obsolete Signature Algorithm
Re-attest archive under newer suite while preserving old signature.
277. Hard rule.
278. Revocation Propagation Failure
Escalate as release-control incident.
279. Hard rule.
280. Over-Retention
Retention reconciliation triggers deletion/crypto erasure.
281. Hard rule.
282. Testing
Need assurance-archive testkit.
283. Test Scenarios
certify normal release
conditional certification
revoke artifact
export compliance trace
restore archive backup
284. Immutability Test
Certified qualification package cannot mutate.
285. Artifact Binding Test
Evidence for digest A cannot qualify digest B.
286. Revocation Test
Revoked certification cannot authorize new deployment.
287. Supersession Test
Old certification remains queryable.
288. Archive Integrity Test
Tampered evidence blob detected.
289. Re-Attestation Test
New signature does not rewrite old signature history.
290. Rebuild Test
Reproducibility mismatch yields NonReproducible, not automatic compromise verdict.
291. Trace Package Test
Export contains only requested scope.
292. Redaction Test
Restricted evidence replaced with safe metadata/digest where policy says.
293. Residency Test
Archive replica outside allowed region rejected.
294. Restore Test
Restored archive must re-verify before Trusted.
295. Privacy Test
No employee/user analytics dimension exists.
296. Retention Test
Expired sensitive blob deleted/crypto-erased while metadata digest retained if policy permits.
297. Fuzzing
Fuzz:
archive manifests
certification state transitions
trace package manifests
revocation records
retention policies
298. Property Tests
Properties:
revoked certification can never authorize new deployment
evidence bound to artifact A can never certify artifact B
certified archive history can never be mutated in place
redacted export can never include evidence above requested sensitivity level
299. Formal Verification Targets
Strong candidates:
certification lifecycle
revocation propagation
archive immutability
artifact-evidence binding
300. Kani Candidate
state/artifact-binding/retention invariants.
301. TLA+ Candidate
qualify → certify → deploy → suspend/revoke → replace.
302. Loom Candidate
concurrent certification query + revocation + deployment admission.
303. Performance
Archive path is not on hot request path.
304. Deployment gate queries metadata cache.
305. Hard rule.
306. Storage
Canonical stores:
certifications
qualification_packages
evidence_metadata
artifact_lineage
revocations
archive_manifests
trace_packages
retention_records
307. Blob store:
test evidence
reports
SBOMs
provenance
formal results
drill receipts
308. Hard rule.
309. Partitioning
By:
release
artifact digest
certification
evidence class
control
service
310. No user/person partition.
311. Hard rule.
312. Crate Layout
Recommended:
crates/
├── siar-assurance-archive-core/
├── siar-certification-records/
├── siar-artifact-lineage/
├── siar-evidence-repository/
├── siar-archive-integrity/
├── siar-assurance-retention/
├── siar-trace-package/
├── siar-assurance-export/
├── siar-assurance-archive-observability/
└── siar-assurance-archive-testkit/
313. siar-assurance-archive-core
Owns:
AssuranceArchiveId
CertificationId
CertificationState
AssuranceArchiveError
314. siar-certification-records
Certification lifecycle/authority/attestations.
315. siar-artifact-lineage
Source→artifact→evidence→qualification→certification.
316. siar-evidence-repository
Immutable evidence metadata/blobs.
317. siar-archive-integrity
Digest/signature/snapshot verification.
318. siar-assurance-retention
Retention/legal hold/crypto erasure.
319. siar-trace-package
Compliance/security/privacy/reliability trace packages.
320. siar-assurance-export
Scoped redacted external packages.
321. siar-assurance-archive-observability
Aggregate archive health only.
322. siar-assurance-archive-testkit
immutability/revocation/export/privacy tests.
323. Security, Privacy & Correctness Invariants
Mandatory:
1. Certified release assurance is bound to exact artifact digests, source revisions, requirement baselines, architecture baselines, verification-policy versions, and immutable evidence; filenames or ticket states cannot establish release trust.
2. Qualification packages, certification records, archive manifests, revocation history, and historical snapshots are append-only/immutable once issued; corrections occur through supersession, suspension, or revocation rather than mutation.
3. Revoked or suspended certification state propagates to release/deployment/update control and can never continue authorizing new deployment merely because the artifact previously passed qualification.
4. Evidence provenance includes artifact, environment, toolchain/runner, timestamp, and producer authority so future reviewers can reconstruct how the evidence was created.
5. Compliance/assurance trace packages are purpose-scoped and minimally disclose only required evidence; a request for one control or release never implies export of the full assurance archive.
6. Sensitive evidence, topology, vulnerability detail, facility/security information, secrets, and private user data remain classification-controlled and redacted or represented by digests/attestations when raw disclosure is unnecessary.
7. Assurance archives preserve historical validity through signature metadata, crypto-agility re-attestation, reproducibility manifests, and integrity scans without rewriting old signatures or evidence.
8. Retention is evidence-class specific; high-value certification metadata may be long-lived while raw logs/high-volume CI artifacts expire, and "keep everything forever" is prohibited by default.
9. Archive replication, backup, restore, migration, and export preserve residency, encryption, integrity, lineage, IDs, timestamps, and access-control guarantees.
10. Assurance archive roles are scoped and separated; evidence production, certification, archive operation, export approval, and sensitive review do not collapse into a universal superuser.
11. Archive metrics, search, audit, and reporting remain release/artifact/evidence/control-centric and cannot become developer productivity scoring, approver leaderboards, employee surveillance, or user-behavior analysis.
12. The assurance archive integrates with release qualification, requirements, architecture governance, knowledge traceability, risk/PIR, audit, compliance, supply-chain provenance, deployment control, updates, incident response, DR, and geographic governance without becoming an alternate release-authority or surveillance system.
324. Initial Production Scope
Implement first:
typed AssuranceArchiveId/CertificationId
certification lifecycle
multi-authority certification attestations
immutable qualification packages
artifact qualification lineage
content-addressed evidence repository
evidence classification/provenance
signed archive manifests
revocation/supersession records
archive integrity scan
reproducibility manifests
release/deployment certification binding
trace package generation
redaction policies
scoped auditor/export access
retention/crypto-erasure policy
residency-aware archive replication
backup/restore verification
privacy-safe archive dashboards
assurance-archive testkit
Then add:
Merkle-backed snapshot verification
long-term signature timestamping
automatic crypto-suite re-attestation
selective auditor proofs
cross-organization assurance exchange
formal revocation/deployment verification
portable signed assurance bundles
325. Definition of Done
Part 126 is complete when:
- release certifications are typed and immutable;
- qualification packages bind exact artifacts;
- evidence provenance is complete;
- artifact lineage is queryable end-to-end;
- revocation/suspension propagates to deployment control;
- archive integrity can be verified;
- historical snapshots remain immutable;
- compliance trace packages are scoped/minimized/redacted;
- retention/crypto-erasure policies exist;
- archive replication respects residency;
- restore requires re-verification;
- no developer/user surveillance metrics are created;
- immutability/revocation/export/privacy/fuzz/formal tests are specified.
326. Final Architecture
SOURCE REVISION
│
▼
BUILD PROVENANCE
│
▼
ARTIFACT DIGEST
│
▼
VERIFICATION EVIDENCE
│
▼
QUALIFICATION PACKAGE
│
▼
CERTIFICATION RECORD
│
▼
ASSURANCE ARCHIVE
│
┌───────────┼───────────┐
│ │ │
AUDIT EXPORT REPLAY
Assurance-archive safety model:
exact artifact binding
+
immutable qualification
+
evidence provenance
+
certification lineage
+
revocation/supersession
+
integrity verification
+
scoped redacted exports
+
privacy-aware retention
not:
keep random CI logs, call them compliance evidence, certify by filename, delete revoked history, and dump the entire archive whenever someone asks for proof
327. Final Principle
Release assurance should remain verifiable long after the original build and test systems are gone.
The correct model is:
bind evidence to exact artifacts
+
preserve provenance
+
certify explicitly
+
archive immutably
+
retain only what policy requires
+
revoke without rewriting history
+
export minimally
+
reconstruct past qualification exactly
+
never turn assurance archives into workforce or user surveillance
This architecture gives SIAR a privacy-preserving assurance archive foundation for qualification evidence, certification history, artifact lineage, long-term release verification, compliance trace packages, revocation, retention, export, and historical reconstruction while preserving the anonymity, local-first, least-authority, requirements-engineering, engineering-assurance, and anti-surveillance guarantees established across Parts 34–125.