{
  "schema": "wuci-site-claim-evidence-v1",
  "project": "wuci-ji",
  "surface": "Wuci-Ji v2.2 — Aperture Bastion website",
  "canonical_url": "https://nosuchmachine.net/",
  "last_updated": "2026-07-10",
  "purpose": "Map public website claims to the local evidence files and commands that can check them.",
  "claim_boundary": "Every listed claim is repository-local or hosted-site evidence only. Production cryptography is not claimed; runtime containment is not claimed; external certification, host-cleanliness proof, and independent audit completion are not claimed.",
  "primary_validation": [
    "make site-validate",
    "make daylight-v19-aperture-bastion-ci",
    "make daylight-public-artifact-firewall",
    "make site-live-check",
    "make live-integrity-check"
  ],
  "claims": [
    {
      "id": "official-emblem",
      "public_claim": "The website publishes the official No Such Machine / Wuci-Ji emblem asset.",
      "status": "local-static-artifact",
      "evidence_paths": [
        "site/assets/wuci-ji-official-emblem.jpg",
        "site/assets/no-such-machine-official-emblem.svg",
        "site/assets/no-such-machine-official-emblem.jpg",
        "site/assets/no-such-machine-official-banner.jpg",
        "site/humans.txt",
        "site/llms.txt"
      ],
      "evidence_values": {
        "emblem_sha256": "890d4c6ccc6af97a4d4f3de4b53fe4c6384b03456053bbe66a7a3b06f739b6c4",
        "emblem_svg_sha256": "0790f9fae750460099c38e217800deee0d97043a591918a2e478b594a18b4c8f",
        "banner_sha256": "ecdd6006344afd0ec6aacc9c46765deb9210360359601ace9dec13e02e47ecb3"
      },
      "validation_commands": [
        "make site-validate"
      ],
      "does_not_prove": [
        "brand trademark registration",
        "external certification"
      ]
    },
    {
      "id": "noether-forge-source-only-review",
      "public_claim": "The website publishes WuciOS 2.4.0 Noether Forge as a source-only external review candidate and does not offer its ISO or upstream binary payloads.",
      "status": "source-review-merged; distribution-mode-source-only; binary-publication-not-authorized",
      "evidence_paths": [
        "site/index.html",
        "site/wucios.html",
        "site/noether-forge-status.json",
        "site/llms.txt",
        "site/humans.txt",
        "tools/site_live_check.py"
      ],
      "evidence_values": {
        "release_id": "noether-forge-v2.4.0",
        "reviewed_commit": "4783ebc530bc8c28cdeed2f06e79c233cee13b08",
        "merge_commit": "bc8ac166055a935ee10872eee371ef2f8972df68",
        "distribution_mode": "source-only",
        "official_release": false,
        "public_release_authorized": false,
        "binary_assets_published": false,
        "substrate": "Alpine Linux 3.24.1 x86_64",
        "locked_apk_payload_count": 52,
        "repeat_build_scope": "one clean checkout and host toolchain",
        "virtual_boot_lanes": [
          "QEMU SeaBIOS",
          "QEMU OVMF/UEFI"
        ]
      },
      "validation_commands": [
        "make site-validate",
        "make site-live-check"
      ],
      "does_not_prove": [
        "binary redistribution clearance or authorization",
        "cross-host reproducibility",
        "reference physical-hardware validation",
        "external certification or independent audit",
        "general runtime sandboxing",
        "OS containment",
        "legal advice or an export classification"
      ]
    },
    {
      "id": "daylight-bottle-public-preview",
      "public_claim": "The website links to the Daylight Bottle preview, describes its reviewed browser-local encryption boundary, and discloses that recipient activation was pending at the recorded live keyring observation.",
      "status": "implementation-reviewed; live-recipient-activation-pending",
      "evidence_paths": [
        "site/index.html",
        "site/daylight-bottle-status.json",
        "site/daylight-bottle-keyring-observation.json",
        "apps/bottle/public/keyring.json",
        "tools/live_integrity_check.py",
        "tests/live_integrity_check.py",
        "apps/bottle/src/tests/product-surface.test.ts",
        "apps/bottle/src/tests/lifecycle.test.ts",
        "apps/bottle/worker/index.test.ts"
      ],
      "evidence_values": {
        "origin": "https://bottle.nosuchmachine.net",
        "observed_at": "2026-07-10T04:21:51Z",
        "keyring_sha256": "sha256:d3c6c2e035d44f731bbc538f861e2886ba6165c31fd128977060de8b3a009ce1",
        "active_recipient_count": 0,
        "recipient_activation": "pending"
      },
      "validation_commands": [
        "make site-validate",
        "make live-integrity-test",
        "make live-integrity-check",
        "cd apps/bottle && npm run check"
      ],
      "does_not_prove": [
        "continuous service availability or future keyring state",
        "uncompromised JavaScript delivery, browser integrity, or device integrity",
        "that the server never observed plaintext outside the implemented request path",
        "production authority"
      ]
    },
    {
      "id": "aperture-review-capsule",
      "public_claim": "Aperture Bastion binds a public review capsule to subject bytes, public manifest data, and claim boundaries.",
      "status": "release-evidence-bound",
      "evidence_paths": [
        "site/aperture-status.json",
        "docs/WUCI_JI_V2_APERTURE_BASTION.md",
        "docs/archive/aperture-bastion/APERTURE_BASTION_PASS_REPORT.md"
      ],
      "evidence_values": {
        "release_tag": "v2.2.0-aperture-bastion",
        "capsule_digest": "9109e7d9364f305a0618e6f5d810f3dd665d995e5c56f9d0ccc8d01875b9eec0",
        "firewall_profile_id": "aperture-bastion-public-v1"
      },
      "validation_commands": [
        "make daylight-v19-aperture-bastion-ci"
      ],
      "does_not_prove": [
        "production cryptography",
        "runtime containment",
        "external certification"
      ]
    },
    {
      "id": "public-artifact-firewall",
      "public_claim": "The public artifact profile rejects private-material patterns and unexpected public files before release publication.",
      "status": "release-evidence-bound",
      "evidence_paths": [
        "site/aperture-status.json",
        "docs/APERTURE_BASTION_SECURITY_BOUNDARY.md",
        "docs/archive/aperture-bastion/APERTURE_BASTION_PASS_REPORT.md"
      ],
      "evidence_values": {
        "firewall_profile_id": "aperture-bastion-public-v1",
        "firewall_profile_digest": "d191c651b963806015e1c779fcf72ab7d84cac9c0090f5beeb38a108e3329878"
      },
      "validation_commands": [
        "make daylight-public-artifact-firewall",
        "make daylight-v19-aperture-bastion-firewall"
      ],
      "does_not_prove": [
        "that an unknown secret matching no rule cannot pass",
        "host cleanliness"
      ]
    },
    {
      "id": "daylight-score-binding",
      "public_claim": "The displayed Daylight AM+ value is bound to committed v17 scorecard evidence and is not a declared perfect score.",
      "status": "local-evidence-bound",
      "evidence_paths": [
        "site/daylight-status.json",
        "daylight/v17-singularity/examples/current-scorecard.v17.json"
      ],
      "evidence_values": {
        "score_AM_plus": 999999687,
        "unit": "AM+",
        "scorecard_digest": "6debccd2631146bead454d475789060d3aad50ef2d7b18b60d7960ce67bddd3d",
        "declared": false
      },
      "validation_commands": [
        "make site-daylight-status-check",
        "make site-validate"
      ],
      "does_not_prove": [
        "a perfect score",
        "external validation",
        "government validation"
      ]
    },
    {
      "id": "daylight-v20-aperture-singularity-score-surface",
      "public_claim": "The Daylight v20 Gate repo-owned ceiling score surface is bound to the committed v20 Aperture Singularity capsule and remains a non-declaration.",
      "status": "local-evidence-bound; declaration-refused",
      "evidence_paths": [
        "site/daylight-v20-aperture-singularity-status.json",
        "site/assets/daylight-v20-gate-repo-owned-ceiling-score-surface-999801305.webp",
        "site/assets/daylight-v20-gate-repo-owned-ceiling-score-surface-999801305.png",
        "daylight/v20-aperture-singularity/examples/aperture-singularity-capsule.fixture.v20.json"
      ],
      "evidence_values": {
        "score_AM_plus": 999801305,
        "unit": "AM+",
        "capsule_digest": "dd69f30f3ed099032fe3c16e1d55b2c269f8dc5e1c056537ee9d9a8c8cdf62e5",
        "declared": false,
        "fixture": true,
        "claim_usable": false,
        "repo_owned_code_gap_count": 0,
        "repo_owned_ceiling_reached": true,
        "singularity_possible_without_external_validation": false,
        "highest_truthful_no_external_score_AM_plus": 999801305
      },
      "validation_commands": [
        "make daylight-v20-aperture-singularity-ci",
        "make site-validate"
      ],
      "does_not_prove": [
        "Singularity declaration",
        "external validation",
        "independent audit",
        "production cryptography",
        "runtime containment"
      ]
    },
    {
      "id": "daylight-v20-public-challenge",
      "public_claim": "The website publishes a bounded Daylight v20 public technical review challenge: review the evidence, reproduce the lane, and challenge the claim surface without implying endorsement.",
      "status": "local-evidence-bound; public-review-request",
      "evidence_paths": [
        "site/index.html",
        "site/llms.txt",
        "site/sitemap.xml",
        "site/assets/daylight-v20-public-challenge-780thc.jpg",
        "site/daylight-v20-aperture-singularity-status.json",
        "docs/DAYLIGHT_V20_REVIEWER_PACKET.md",
        "docs/DAYLIGHT_V20_EXTERNAL_EVIDENCE_PROTOCOL.md"
      ],
      "evidence_values": {
        "poster_sha256": "f866cec5314a142d77074b786bd920b0c9d991b9dc5ca73de4a914683401b172",
        "score_AM_plus": 999801305,
        "repo_owned_code_gap_count": 0,
        "repo_owned_ceiling_reached": true,
        "singularity_possible_without_external_validation": false,
        "declaration_allowed": false
      },
      "validation_commands": [
        "make daylight-v20-aperture-singularity-ci",
        "make site-validate"
      ],
      "does_not_prove": [
        "endorsement",
        "Singularity declaration",
        "external validation",
        "government validation",
        "independent audit"
      ]
    },
    {
      "id": "defense-assurance-roadmap-exists",
      "public_claim": "The repository and website publish a public defense-assurance roadmap for the path from research-proof artifact to high-assurance defense-system candidacy.",
      "status": "roadmap-only; non-certifying",
      "evidence_paths": [
        "docs/DEFENSE_ASSURANCE_ROADMAP.md",
        "docs/DEFENSE_ASSURANCE_CONTINGENCIES.md",
        "docs/DEFENSE_ASSURANCE_CONTROL_MAP.md",
        "site/defense-assurance.html",
        "site/defense-assurance-status.json",
        "docs/defense-assurance-roadmap.v1.json"
      ],
      "evidence_values": {
        "status": "roadmap_only",
        "warning_level": "BLUE",
        "external_evidence_required": true
      },
      "validation_commands": [
        "make site-validate",
        "make daylight-npt-ci"
      ],
      "does_not_prove": [
        "Department of War approval",
        "production authority",
        "external certification"
      ]
    },
    {
      "id": "defense-assurance-roadmap-non-certifying",
      "public_claim": "The defense-assurance roadmap is explicitly non-certifying. It is not Department of War approved. It is not cATO authorized. It is not RMF authorized. It is not FIPS validated. Production authority is not claimed. External certification is not claimed.",
      "status": "non-claim-boundary",
      "evidence_paths": [
        "docs/DEFENSE_ASSURANCE_ROADMAP.md",
        "docs/DEFENSE_ASSURANCE_CONTINGENCIES.md",
        "docs/DEFENSE_ASSURANCE_CONTROL_MAP.md",
        "site/defense-assurance.html",
        "site/defense-assurance-status.json",
        "docs/defense-assurance-roadmap.v1.json"
      ],
      "evidence_values": {
        "roadmap_only": true,
        "forbidden_authority_claims": [
          "DoW approval claim",
          "cATO authorized",
          "RMF authorized",
          "FIPS validated",
          "production authority",
          "government endorsed"
        ]
      },
      "validation_commands": [
        "make site-validate",
        "make daylight-npt-ci"
      ],
      "does_not_prove": [
        "government endorsement",
        "formal authorization",
        "independent audit completion"
      ]
    },
    {
      "id": "defense-assurance-required-external-contingencies",
      "public_claim": "The defense-assurance roadmap records required external contingencies before any stronger defense-system claim can be considered.",
      "status": "open-contingencies",
      "evidence_paths": [
        "docs/DEFENSE_ASSURANCE_ROADMAP.md",
        "docs/DEFENSE_ASSURANCE_CONTINGENCIES.md",
        "docs/DEFENSE_ASSURANCE_CONTROL_MAP.md",
        "site/defense-assurance.html",
        "site/defense-assurance-status.json",
        "docs/defense-assurance-roadmap.v1.json"
      ],
      "evidence_values": {
        "required_external_contingencies": [
          "independent_rebuild",
          "external_verifier_quorum",
          "external_security_audit",
          "red_team_or_falsification_review",
          "cryptographic_review",
          "installation_use_testing",
          "sbom_and_provenance",
          "continuous_monitoring_model",
          "rmf_control_mapping",
          "claim_surface_review"
        ]
      },
      "validation_commands": [
        "make site-validate",
        "make daylight-npt-ci"
      ],
      "does_not_prove": [
        "that the contingencies are closed",
        "external validation",
        "operational deployment readiness"
      ]
    },
    {
      "id": "defense-assurance-scope-bound-perfect-contingency",
      "public_claim": "The possible 100.0/100.0 defense-assurance contingency is scope-bound to a defined evidence rubric and validated audit scope.",
      "status": "conditional; scope-bound; not current score credit",
      "evidence_paths": [
        "docs/DEFENSE_ASSURANCE_ROADMAP.md",
        "docs/DEFENSE_ASSURANCE_CONTINGENCIES.md",
        "docs/DEFENSE_ASSURANCE_CONTROL_MAP.md",
        "site/defense-assurance.html",
        "site/defense-assurance-status.json",
        "docs/defense-assurance-roadmap.v1.json"
      ],
      "evidence_values": {
        "possible_score": "100.0/100.0",
        "scope": "defined evidence rubric and validated audit scope only",
        "score_rule": "Roadmap documentation creates obligations, not score credit. Credit requires evidence-derived closure."
      },
      "validation_commands": [
        "make site-validate",
        "make daylight-npt-ci"
      ],
      "does_not_prove": [
        "perfection",
        "invulnerability",
        "government approval",
        "production authority",
        "validity outside the tested scope"
      ]
    },
    {
      "id": "defense-assurance-no-government-approval",
      "public_claim": "The defense-assurance roadmap and website are not government approved. They are not Department of War approved. Production authority is not claimed. They are not cATO authorized. They are not RMF authorized. They are not FIPS validated. External certification is not claimed.",
      "status": "non-claim-boundary",
      "evidence_paths": [
        "docs/DEFENSE_ASSURANCE_ROADMAP.md",
        "docs/DEFENSE_ASSURANCE_CONTINGENCIES.md",
        "docs/DEFENSE_ASSURANCE_CONTROL_MAP.md",
        "site/defense-assurance.html",
        "site/defense-assurance-status.json",
        "docs/defense-assurance-roadmap.v1.json"
      ],
      "evidence_values": {
        "status": "roadmap_only",
        "warning_level": "BLUE",
        "no_government_approval_claimed": true
      },
      "validation_commands": [
        "make site-validate",
        "make daylight-npt-ci"
      ],
      "does_not_prove": [
        "approval",
        "authorization",
        "certification",
        "endorsement"
      ]
    },
    {
      "id": "ai-scoring-integrity-audit",
      "public_claim": "The website and repository publish a bounded AI scoring-integrity audit separating model-confidence assessments from evidence-derived Daylight runtime scores.",
      "status": "public-ledger; non-claim-bounded",
      "evidence_paths": [
        "site/ai-scoring-integrity.html",
        "docs/archive/site/daylight-grok-audit.html",
        "docs/archive/scores/GROK_SCORE_INFLATION_AUDIT.md",
        "docs/DAYLIGHT_AI_SCORING_ASSURANCE_LEDGER.md",
        "docs/DAYLIGHT_AI_ASSURANCE_STANDARD.md",
        "docs/archive/scores/DAYLIGHT_GROK_AUDIT_EXHIBITS.md",
        "data/daylight/grok-scoring-audit/ledger.json",
        "data/daylight/grok-scoring-audit/exhibits.json"
      ],
      "evidence_values": {
        "rules": [
          "NoEvidence(x) → NoScore(x)",
          "NoProvenance(x) → NoAuthority(x)",
          "NoExecution(x) → NoRuntimeScore(x)"
        ],
        "classification": "scoring-integrity concern"
      },
      "validation_commands": [
        "make site-validate",
        "git diff --check"
      ],
      "does_not_prove": [
        "criminal conclusion",
        "intent",
        "federal agency endorsement",
        "Daylight production readiness",
        "that all Grok outputs are invalid",
        "that the prior public score trail is authenticated raw Grok transcript"
      ]
    },
    {
      "id": "hosted-tls-requirements",
      "public_claim": "The hosted site is expected to serve the canonical HTTPS apex, redirect HTTP to HTTPS, redirect www to apex, and send HSTS.",
      "status": "requirement-declared; hosted gate must pass after deployment",
      "evidence_paths": [
        "site/hosting-requirements.json",
        "tools/site_live_check.py",
        "tools/live_integrity_check.py",
        "docs/WEBSITE_DEPLOY.md"
      ],
      "evidence_values": {
        "canonical_url": "https://nosuchmachine.net/",
        "required_header": "strict-transport-security",
        "required_redirect_source_scheme": "http",
        "required_redirect_source_host": "nosuchmachine.net",
        "required_redirect_target_prefix": "https://nosuchmachine.net/"
      },
      "validation_commands": [
        "make site-live-check",
        "make live-integrity-check"
      ],
      "does_not_prove": [
        "current hosted compliance until the live gate passes",
        "server compromise resistance",
        "independent hosting audit"
      ]
    },
    {
      "id": "research-discovery-metadata",
      "public_claim": "The site publishes machine-readable research software metadata for crawlers, archival tools, and research agents.",
      "status": "local-static-artifact",
      "evidence_paths": [
        "CITATION.cff",
        "site/citation.cff",
        "site/codemeta.json",
        "site/llms.txt",
        "site/sitemap.xml"
      ],
      "evidence_values": {
        "codemeta_context": "https://w3id.org/codemeta/3.0",
        "citation": "https://nosuchmachine.net/citation.cff",
        "license": "https://spdx.org/licenses/Apache-2.0"
      },
      "validation_commands": [
        "make site-validate"
      ],
      "does_not_prove": [
        "third-party indexing",
        "external endorsement"
      ]
    },
    {
      "id": "daylight-equation-standard-exists",
      "public_claim": "The Daylight Equation Standard exists as a standard candidate with documentation, schemas, examples, and conformance tooling.",
      "status": "standard-candidate; evidence-bound",
      "evidence_paths": [
        "docs/DAYLIGHT_EQUATION_STANDARD.md",
        "specs/daylight-equation/v1/README.md",
        "specs/daylight-equation/v1/daylight-equation.v1.schema.json",
        "specs/daylight-equation/v1/daylight-claim.v1.schema.json",
        "specs/daylight-equation/v1/daylight-evidence.v1.schema.json",
        "specs/daylight-equation/v1/daylight-scorecard.v1.schema.json",
        "examples/daylight-standard/minimal-claim.json",
        "tools/daylight_standard_validate.py",
        "tools/daylight_conformance.py"
      ],
      "evidence_values": {
        "equation": "Claim + Evidence + Provenance + Reproducibility + Boundary + Monitoring + Falsification = Authority",
        "status": "standard_candidate"
      },
      "validation_commands": [
        "make daylight-standard-schema-test",
        "make daylight-standard-examples-test",
        "make daylight-conformance-test"
      ],
      "does_not_prove": [
        "certification",
        "production authority",
        "government approval"
      ]
    },
    {
      "id": "wuci-evidence-bound-control-plane-path",
      "public_claim": "Wuci-Ji is developing into an evidence-bound security control plane for claim verification, release gates, control maps, and audit-boundary discipline.",
      "status": "roadmap-and-standard-candidate",
      "evidence_paths": [
        "docs/WUCI_PRODUCT_STANDARD.md",
        "docs/WUCI_CONTROL_PLANE_ARCHITECTURE.md",
        "site/security-product-roadmap.html",
        "site/wuci-product-standard-status.json"
      ],
      "evidence_values": {
        "product_category": "Evidence-Bound Security Control Plane",
        "current_status": "product_standard_candidate"
      },
      "validation_commands": [
        "make site-validate",
        "make daylight-standard-ci"
      ],
      "does_not_prove": [
        "production security replacement",
        "runtime containment",
        "security operations replacement"
      ]
    },
    {
      "id": "wuci-not-production-security-replacement",
      "public_claim": "Wuci-Ji / Daylight is not currently a production security replacement.",
      "status": "controlling-non-claim",
      "evidence_paths": [
        "docs/WUCI_SECURITY_PRODUCT_BOUNDARY.md",
        "docs/PRODUCTION_READINESS.md",
        "docs/SECURITY_BOUNDARY.md",
        "site/product-boundary.html"
      ],
      "evidence_values": {
        "replacement_claim_allowed": false,
        "runtime_sandbox_claim_allowed": false,
        "production_crypto_claim_allowed": false
      },
      "validation_commands": [
        "make daylight-npt-ci",
        "make site-validate"
      ],
      "does_not_prove": [
        "endpoint protection",
        "SIEM replacement",
        "IAM replacement",
        "incident response replacement"
      ]
    },
    {
      "id": "wuci-no-external-validation-value",
      "public_claim": "Wuci-Ji remains useful without external validation for claim discipline, evidence discipline, reproducibility discipline, release gates, control mapping, and internal audit packets.",
      "status": "bounded-internal-value",
      "evidence_paths": [
        "docs/WUCI_NO_EXTERNAL_VALIDATION_VALUE.md",
        "site/no-external-validation-value.html",
        "examples/daylight-standard/no-external-validation-example.json"
      ],
      "evidence_values": {
        "external_validation_required_for_d9": true,
        "internal_value_without_external_validation": true
      },
      "validation_commands": [
        "make daylight-standard-examples-test",
        "make site-validate"
      ],
      "does_not_prove": [
        "independent audit",
        "external certification",
        "D9 formal authority"
      ]
    },
    {
      "id": "wuci-external-validation-uplift",
      "public_claim": "External validation can increase authority for the reviewed scope, but does not create unlimited security, certification, or government-approval claims.",
      "status": "uplift-boundary",
      "evidence_paths": [
        "docs/WUCI_EXTERNAL_VALIDATION_UPLIFT.md",
        "site/external-validation-uplift.html",
        "specs/daylight-equation/v1/daylight-attestation.v1.schema.json"
      ],
      "evidence_values": {
        "d9_self_issued": false,
        "external_validation_is_unlimited_claim": false
      },
      "validation_commands": [
        "make daylight-standard-schema-test",
        "make site-validate"
      ],
      "does_not_prove": [
        "universal security",
        "permanent safety",
        "certification outside the issuing scheme"
      ]
    },
    {
      "id": "wuci-default-standard-exit-criteria",
      "public_claim": "Default-standard status requires adoption, conformance tooling, evidence schemas, integrations, and governance; formal authority cannot be self-issued.",
      "status": "roadmap-exit-criteria",
      "evidence_paths": [
        "docs/WUCI_DEFAULT_STANDARD_EXIT_CRITERIA.md",
        "docs/WUCI_STANDARD_GOVERNANCE.md",
        "site/default-standard.html"
      ],
      "evidence_values": {
        "default_standard_self_declared": false,
        "formal_authority_self_issued": false
      },
      "validation_commands": [
        "make site-validate",
        "make daylight-standard-ci"
      ],
      "does_not_prove": [
        "ecosystem adoption",
        "formal authority",
        "certification"
      ]
    },
    {
      "id": "wuci-product-readiness-separate-from-security-score",
      "public_claim": "The product readiness score is separate from the Daylight security score and measures standard/product maturity rather than security perfection.",
      "status": "generated-product-maturity-metric",
      "evidence_paths": [
        "docs/WUCI_PRODUCT_REQUIREMENTS.md",
        "tools/daylight_product_score.py",
        "site/wuci-product-standard-status.json"
      ],
      "evidence_values": {
        "score_type": "product_standard_readiness",
        "security_score": false
      },
      "validation_commands": [
        "make daylight-product-score",
        "make daylight-standard-ci"
      ],
      "does_not_prove": [
        "security perfection",
        "production authority",
        "certification"
      ]
    }
  ],
  "non_claims": [
    "not production cryptography",
    "not runtime sandboxing",
    "not host-cleanliness proof",
    "not whole-system post-quantum safety",
    "not FIPS validation",
    "not government validation",
    "not external certification",
    "not independent audit completion",
    "not a perfect score claim from repository-owned evidence"
  ]
}