Independent clean-lab software assurance

Evidence should say exactly what was proven.

If it was not proven, it does not pass.

WindAnvil takes an exact source or release, applies explicit policy outside the subject, preserves the receipts, and returns one honest outcome.

PASS FAIL BLOCKED

If the proof is missing, the result is BLOCKED. It never quietly becomes PASS.

immutable object→explicit policy→independent evidence→portable record
The problem

Most assurance failures begin by blurring different claims together.

A green build is not provenance. An SBOM is not proof of which build graph produced it. A skipped check is not a passing check.

WindAnvil keeps identity, policy, execution, observation, and decision separate so the final claim can be narrower and stronger.

The model

Bind the object first. Then prove only what the evidence supports.

01

Admit

Fix the exact source, release, or artifact identity before work begins.

02

Plan

Apply the external minimum policy and any additive local requirements.

03

Execute

Run authorized work without substituting source, architecture, or capability.

04

Observe

Collect results, hashes, provenance, and capability evidence as distinct facts.

05

Decide

Return PASS, FAIL, or BLOCKED. Never a stronger claim than the proof allows.

The output

The Assurance Record is the durable product.

It binds the admitted object to the policy, execution plan, observations, artifact digests, and terminal verdict without inventing a second layer of interpretation.

subject.shaimmutable
policy.digestbound
plan.digestbound
observationscanonical
artifactssha256
verdictPASS | FAIL | BLOCKED
Fieldwork

Build the evidence primitive where the software already lives.

Small upstream changes expose the authority boundaries WindAnvil cares about: release identity, dependency state, artifact binding, inherited policy, and build-graph semantics.

Apache IcebergRelease identityWhich release binary is this? Apache CelixDependency stateWhich dependency graph does the evidence describe? Apache Camel KArtifact bindingWhat immutable artifact is the evidence about? Apache MavenInherited policyWhere should producer-side evidence behavior live? CycloneDX MavenBuild graphWhich reactor lifecycle defines the component?

Merged upstream

Accepted changes only. Open proposals stay in the broader fieldwork layer until upstream merges them.

Apache Maven #13039 · mergedSeal resolver statePrevent callers from mutating nested path lists exposed through a read-only resolver result. FireCrab #190 · mergedMake release evidence enforceableShip SBOMs, license evidence, exact corresponding source, and fail-closed publication checks with release artifacts. Sandia Atlas UI #886 · mergedPreserve structured tool outputExtract real MCP prompt text in message order without promoting non-text structured content into invented text.

Narrower claims.

Stronger evidence.

No invisible gaps.