Evidence artifact

What is evidence artifact?

An evidence artifact is a portable record of discovery results, such as a CycloneDX cryptographic bill of materials, that can be validated and reused outside the product interface.

A dashboard assertion is not the same as durable evidence. Schema validation, hashes, signatures and public verification procedures determine whether another party can prove the artifact is complete and unaltered.

Questions to ask a vendor

1. Can the complete artifact be downloaded?
2. Does it validate against a named schema?
3. Can an unaffiliated third party verify integrity without contacting the vendor?

What this edition actually supports

Weight 3 of 19. Can a reviewer carry the finding away and verify its structure and custody?

A CBOM or equivalent export is useful when it identifies the product/build, records findings, states its source and can be checked against a public format. The QScout 9 in the frozen edition includes a signed sample from its own API; that sample is not a customer-estate Gold scan. A separately published owned one-file lab packet shows what its local, unreleased export repair produced, including an incomplete after inventory.

How to investigate this criterion

Inspect the actual artifact, schema, signature scope, verifier and the difference between sample, lab and production output.

Primary and original inputs: api.qtonicquantum.com · cyclonedx.org · pqc-index.org. Review all dated cell source checks and the 1 October per-cell limits.

The 2026.7 cells below are public-evidence scores. A vendor page documents a claim; an artifact check tests only its stated scope. Missing product execution and inaccessible sources remain explicit unknowns. The score snapshot has not been recomputed from later pages.