VSO updates saved-report checks and Explorer dependencies

A read-only check of saved reports

RTA PR #19 adds a maintainer aid that reads 17 fixed report files and checks them against the pinned reference: manifests, declared revisions, 29 declared input hashes, the exact 809 regression and 15 historical cases, execution and environment records, and the stable historical replay results. It does not run submitted code, rerun tests, extract archives or contact the network.

REPORTS_MATCH_REFERENCE means saved-report consistency only. Copied first-party reports or coherently fabricated reports can also match. The output keeps tests_rerun: false, independence: NOT_ASSESSED, publication_permission: NOT_ASSESSED and conformance_claim: false. Execution identity, assistance, independence and permission to publish still require separate review.

The PR’s first-party recipe CI passed in Python 3.11.17 and 3.13.5. Its 50 new synthetic reader tests and 13 existing launcher tests form 63 helper tests, separate from the fixed 809 + 15 cases. The fixed target remains cc695fe and the guide remains a839d7a. This announcement checks the published record; it is not another verifier run.

Explorer dependency updates: repository results, not a deployment claim

The API updated body-parser to 1.20.9 and its TypeScript ESLint tooling to 8.72.0. The final review recorded eight HTTP regression cases passing and zero findings in both full and production-only dependency audits at that time. The later tooling update preserved all 84 non-development lockfile entries. Audit results are time-specific and do not guarantee security.

The GUI updated react-router and react-router-dom from 6.30.6 to 7.18.4. Its recorded comparison passed the existing three byte-handling tests and 16 browser checks for each of the baseline and candidate. Production-only audit findings fell to zero; the full audit still had five findings (one high and four moderate), including remaining build-tool work. The narrow mobile visibility checks do not establish full mobile usability.

Separate GUI text corrections identify mock data and avoid presenting it as cryptographically verified or externally anchored. The API and GUI dependency PRs passed their recorded CI. Merged repository changes do not, by themselves, confirm deployment to the public Explorer. This announcement does not claim such a deployment.

Legacy examples and SDK guidance: clearer limits

Sidecar examples are legacy v1.0 illustrations, not a production-ready or certified integration. Their Python serialization is not RFC 8785 JCS; the MQL5 placeholder hash is not SHA-256. Those examples do not implement signatures, Merkle construction or external anchoring. Documentation corrections do not repair the algorithms.

VCP documentation now distinguishes anchoring a root from authenticating batch metadata, and marks the retained duplicate-last Merkle example as historical and non-RFC. SDK guidance distinguishes the v1.0 Release Candidate specification from an informative v1.1 guide. The CAP refusal demo describes recording a refusal, not preventing content or capturing every action; its evidence remains NOT_ANCHORED.

Scope preserved

Normative specifications, signed evidence, fixed distributions and K3 are not changed by this website update. The VAP OS-isolated mock-gate kit remains a separate experiment. Experimental extensions remain unadopted, and independent reproduction remains unestablished. Successful first-party CI, report receipt and publication permission are separate states.