Studio · portable evidence qualification path
Portable Release Records keep evidence reviewable and bounded.
The supported workflow is `verglos record create`, `record sign`, `record verify`, and `record pack`. It collects verified findings, provenance notes, and report metadata into a portable Release Record. Signing is explicit and approval-bound; hosted signing, verification, recipient acceptance, and public handoff remain qualification-gated and separate from npm or in-toto provenance.
Who it is for
- /Agencies packaging security evidence at client handoff.
- /Startups answering procurement and diligence questions.
- /Teams preparing security evidence for SOC 2 readiness workflows.
Current status
The public contract documents the portable record fields and trust boundaries. `verglos attest` remains a compatibility shell; it is not a claim that hosted or public signing is shipped. Hosted signing, verification, white-label reports, recipient acceptance, and final release evidence remain qualification-gated Studio capabilities.
Trust chain diagram
This diagram describes the public trust boundary. A hosted verify URL and final Studio acceptance require the corresponding private qualification evidence.