RESEARCH RECORD

Toolchain Evidence Lock

Evidence systems · Evidence

Mobile view is optimised for record-by-record inspection. Use the section menu below; desktop keeps the full route context visible.

Record sections

SUMMARY

Record summary

Record ID: fenrua-research:toolchain-evidence-lock
Category: Evidence systems
Date: 2026-07-22
Source revision: 390f7aeef778ce93db12e16028bc3a788b643c2d
Evidence revision: ee82a0446079437b8244618db9aaa55bd620811198d1c978fd7412e1209e8286
Primitive: Evidence
Maturity: Frozen point-in-time evidence
Severity: Public-trust boundary

CLAIM

Toolchain versions are published as detected and remain locked to the inspected evidence environment.

NON-CLAIM

The registry does not claim the newest possible version of every tool.

Public page exposes only sanitized, source-linked evidence. Private endpoints, secrets, and raw witness material remain out of scope.

THREAT / INVARIANT

Threat: Post-evidence dependency drift can make public claims unreproducible.

Invariant: A public claim must refer to a tool version and evidence bundle that were captured together.

Trigger: Toolchain registry test prevents Semgrep and SnarkJS drift.

Root cause: Public claims can drift when evidence, tooling, or telemetry are not adjacent to limitations.

TOOLING

Reference implementation: data/toolchain-registry.json and docs/FENRUA_TOOLCHAIN_LOCK.md.

Tools used: Version commands, package inventory, Docker image inventory, registry validation.

Tool versions: See /data/toolchain-registry.json; Semgrep 1.169.0; SnarkJS [email protected].

COMMANDS

node scripts/test-toolchain-registry.mjs
npm run validate

EVIDENCE

Results: Registry SHA-256 ee82a0446079437b8244618db9aaa55bd620811198d1c978fd7412e1209e8286

Evidence confirmation: Review confidence is represented only where linked public evidence exists.

Evidence hash: ee82a0446079437b8244618db9aaa55bd620811198d1c978fd7412e1209e8286

Fix revision: Current website route generation.

REGRESSION

Toolchain registry test prevents Semgrep and SnarkJS drift.

Kernel impact: Evidence primitive boundary clarified.

Utility impact: Public interface remains maturity-labelled and limitation-adjacent.

LIMITATIONS

Version capture does not prove security findings.

Supersession: Active; future updates require a new frozen evidence bundle.

REPRODUCTION

node scripts/test-toolchain-registry.mjs
npm run validate