{
  "report": "R+12 Cross-Domain Provenance Fabric",
  "id": "r12-fabric",
  "component": "Five domain roots -> one verifiable passport",
  "suite_file": "test/fabric.test.mjs (package: r12-fabric)",
  "suite_file_sha256": null,
  "result": {
    "passed": 33,
    "failed": 0,
    "skipped": 0,
    "unit": "tests",
    "suites": 1,
    "status": "PASS"
  },
  "detail": "33 tests; offline passport verify 7/7",
  "note": "Binds software supply-chain, model lineage, AIBOM, compute, and content-disclosure roots into one MMR-anchored passport. Reproduced live 27 Jul from R12_FABRIC_2026-07-23.zip; original evidence captured 2026-07-23. Test-file sha256 not in the CW4 reference-core manifest (separate package).",
  "what_it_proves": "Five domain roots bind into one passport a client verifies offline (7/7), with coverage computed and honestly enforced (absent domains commit a signed em-dash sentinel; over-claims rejected two ways).",
  "what_it_does_not_prove": "The domain roots are live production roots — the suite uses the pick-package test vectors.",
  "raw_excerpt": "$ node test/fabric.test.mjs\nR+12 FABRIC: 33 passed, 0 failed\n[buyer/regulator verifies OFFLINE] PASSPORT VALID ✓ (7/7)",
  "frozen_tag": "audit-tob-v1.1.0",
  "commit": "697f339",
  "reproduced_utc": "2026-07-27",
  "node": "v22.22.3",
  "repo": "github.com/DCS-LabsAI/dcs-rseries-core",
  "prod_dependencies": 0,
  "reproduced_by": "DCS Labs — live reproduction from clean checkout",
  "posture": "ground-demonstrated; not externally audited",
  "non_claim": "Post-quantum signature: the current R-Series hybrid profile signs the post-quantum leg with real ML-DSA-65. Key custody: a software signer — hardware-backed HSM/KMS custody is a separate deployment control, is not deployed here, and no FIPS-validated module is claimed. Not independently audited by external third parties."
}