VSO reports ten merged cloud-evidence and maintenance updates
VeritasChain Standards Organization (VSO) summarizes ten pull requests merged on 7–8 November across six repositories. The research, release preparation, maintenance and incident-source updates have different scopes; their test counts are not combined into one product claim.
Unadopted research; release preparation and publication are separate
The experimental extensions remain unadopted. Independent third-party reproduction has not been established. PR #61 records release preparation: interop demo v0.2.0 was still a draft and unpublished at the initial review on 8 November. A later GitHub publication at 12:09 JST is recorded separately below as an experimental prerelease. First-party CI and merging do not establish adoption, full conformance, certification or production suitability.
Cloud evidence, collection and portable snapshots — VAP #60
A bounded synthetic Azure-shaped evidence checker verifies supplied records and trust bindings. The research adds a local filesystem/SQLite collector, signed receipts, crash-recovery checks and portable snapshots that recipients can verify using a public key and expected store identifier, without the producing database or private signing seed. Records report 61 named evidence tests and 71 collector/portable-snapshot tests (42 + 29), plus 10 evidence acceptance groups, seven collector demo scenarios and five portable demo scenarios. These are different test categories, not an additive total.
Interop demo — release preparation only, VAP #61
The merged change fixes a reproduction baseline, dependency constraints and release instructions. The recorded checks cover 32 existing tests, 11 fixture/manifest files and eight vectors per verifier (two expected PASS and six expected FAIL). At the initial review the release was still a draft, not a published distribution. At 12:09 JST on 8 November, GitHub published the experimental prerelease from cbd4502; publication does not establish adoption or independent reproduction. Existing checker, generator, test, schema, trust and fixed-data files remain unchanged; no independent external execution is established.
Explorer dependency maintenance — GUI #24
follow-redirects is updated from 1.16.1 to 1.16.2 in the lockfile. The recorded validation passed 52 existing tests, lint and build. All four generated default-profile distribution files were byte-identical. This is dependency maintenance, not a new GUI feature or evidence that a public GUI leak occurred. Separate development-tool findings remain outside this change.
Six local-settings guards — VAP #62, site #206, SDK #14, API #28, GUI #25, Evidect #40
Each repository now ignores local agent settings and checks the current Git index for tracked .claude/settings.local.json paths, including nested paths. The same 12 integration tests cover ordinary and optimized execution; repetition across repositories is not 72 unique tests. This detects tracked paths in CI after a push; it is not a secret-content or history scanner, nor a guarantee against disclosure before CI.
Incident-source records — site #205
The merged update adds Microsoft/Todyl cloud-credential evidence and WorkOS source attribution. At that revision the catalog grew from 38 to 40 records; this is a historical count, not a claim about the live catalog total. An Apiiro item without a retrieved primary source stays on HOLD outside that count. Reported events, attribution and unknowns remain separated; the update does not establish that VAP would have prevented an incident.
First-party CI, with source revisions retained
The checked post-merge heads across six repositories had 23 completed successful workflow runs. VAP cloud research is tied to 8ca7b6f; interop preparation was checked at cbd4502. The site CSP run at 7706013 failed on its first attempt and succeeded on attempt 2 with the same source and criteria. The earlier failure remains recorded; this announcement does not claim that its underlying cause was conclusively fixed. These are repository CI records, not newly rerun research tests for this announcement.
- Cloud evidence
- Collector and portable snapshots
- Interop preparation revision
- Site CSP: successful attempt 2; failed attempt 1 retained
All cloud experiments are synthetic and operated by the same party; no live cloud calls were made. They do not prove Azure origin, complete observation, independent custody, latestness, third-party timestamps, power-loss durability or production readiness. A valid older snapshot can remain valid without a separately retained contradictory checkpoint. Verification of custody does not grant permission to publish evidence. First-party CI is not independent reproduction.
The ten merged pull requests
- vap-spec #60 — Cloud evidence, collector and portable snapshots
- vap-spec #61 — Interop demo release preparation
- vcp-explorer-gui #24 — follow-redirects dependency update
- vap-spec #62 — Local agent settings guard
- vcp-site #206 — Local agent settings guard
- vcp-sdk #14 — Local agent settings guard
- vcp-explorer-api #28 — Local agent settings guard
- vcp-explorer-gui #25 — Local agent settings guard
- evidect-site #40 — Local agent settings guard
- vcp-site #205 — Cloud credential and WorkOS incident records
2026-11-08 12:09 JST · Experimental prerelease v0.2.0
Past records remain tied to their original versions
The 7 November payment-research notice, earlier site CI results, the Explorer record at 159 tests and fixed reproduction distributions are retained. This announcement changes website explanations only; current normative requirements, implementations, signed data, fixed distributions and K3 are not changed.