[doc] trust · sha:7292d14c1aa3 · build:2026-08-18T00:08:45.256Z
Trust Center.
Selected company identity, public release, and product-boundary claims resolve to frozen authority artifacts. This page consolidates the attestation surfaces in one place. What is not yet provable is labeled pending — the absence is part of the record, not hidden from it.
Centennial Defense Systems, Inc. of Colorado Springs builds audit-first software and is not affiliated with the unrelated firearms-parts retailer operating at centennialdefensesystems.com.
Release manifest
livePer-release public package versions, licenses, and observed source SHAs are fetched from PyPI and GitHub at build time with no stale fallback.
Machine-readable attestation
liveThe same data in a structured, machine-readable manifest under an immutable schema version (cds-attestation-v1).
Build provenance
liveThe public receipts page and manifest expose the deployment commit SHA and build timestamp. They attest to this site and its observed package data, not private runtime state.
Data-handling boundary
liveLocal processing is stated per product. Archivist's core archive workflows run locally; purchase, support, and website traffic use standard external services. This public site uses no analytics, trackers, or chat widgets.
Vulnerability disclosure
liveA published security policy and disclosure contact.
Software bill of materials (SBOM)
pendingPer-release CycloneDX SBOM with every dependency declared by version, license, and provenance, included in the evidence package. Planned; not yet published.
Signed provenance
pendingSigned release tags and a build attestation tying source commit → build environment → artifact → deployed site into one cryptographically closed chain. In progress; not yet closed end-to-end. Python packages are currently published via Twine, not Trusted Publishing.
Independent review
pendingExternal technical review or customer validation, distinct from self-issued QA. Not yet published — internal QA receipts are not a substitute.
/receipts carries the authoritative per-release record · back to home