Verification chain
Four things are pinned, and each can be checked independently of the others.
The assessment PDF. SHA-256: 4ac3c2038b41db60fdce9d4dbfb97afc30a1cdb605d7890d62a860fc3271db9e
Download the file and run shasum -a 256 over it. If the value differs, the file is not the one struck here.
The timestamp. The receipt AOS-ACD-2026-001-v1.1.pdf.ots is an OpenTimestamps proof over exactly those bytes, submitted to four calendars on 15 August 2026 and pending confirmation in the Bitcoin blockchain at the time of publication. It establishes that the file existed no later than the moment it was stamped. It establishes nothing about whether the file is correct.
Receipt SHA-256: 28198b134aa625e61fec8c4d1ac59c64e53978f442cc6f372e44c26071290c4a
The assessed source. The assessment rests on one published guidance document and its guidance page, both pinned by hash and both independently archived. Every quotation was read from the pinned copy at page-image resolution.
| Ref | Artefact | SHA-256 | Third-party copy |
|---|---|---|---|
| A-GUID-1 | Opportunities for AI in cyber defence. ASD Australian Signals Directorate, co-sealed with the Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK. PDF, 24 pages, first published 27 May 2026, last updated 12 Aug 2026 | bf1ac3624676e11df2cd9694a869c4b938a28e7d4cab371e0e07172f35470e6b | archived copy |
| A-GUID-2 | Opportunities for AI in cyber defence, cyber.gov.au guidance page, HTML as served. Carries the same body text as the PDF including both appendices | 96b45d5e2130f8962ce741d9f8c06f0b93e0db00a040261276e7d7def8f0796b | archived copy |
Both archived captures were fetched and hash identically to the copies pinned above, so a reader can check the quotations without relying on this site or on the publisher’s server.
The build. The PDF is produced deterministically from tracked source by build.sh, with SOURCE_DATE_EPOCH pinned to the assessment date. Repeat builds on one machine and one toolchain are byte-identical; independent third-party reproducibility is not established and is not claimed. Verify by SHA-256, not by rebuild.
Version history
Two versions. v1.1 corrects one sentence in v1.0. A revision does not replace its predecessor: v1.0’s bytes are unchanged, its hash still resolves, and the file remains downloadable at its own address.
| Version | Assessed | Published | SHA-256 | Status |
|---|---|---|---|---|
| v1.1 | 15 August 2026 | 15 August 2026 | 4ac3c2038b41db60fdce9d4dbfb97afc30a1cdb605d7890d62a860fc3271db9e | current · see Corrections |
| v1.0 | 15 August 2026 | 15 August 2026 | ffad1d06619d2404ee9206a2025e53f8fd81a37b21ce19805c3a764b5fa5c770 | superseded, not withdrawn · see Corrections |
Both versions were assessed and published on 15 August 2026, and the cover of each carries that date. A revision keeps its predecessor’s SOURCE_DATE_EPOCH, because a revision is not a new reading - it is the same reading, corrected, and the moment of the reading did not move. An assessment is a reading of a source at a moment, and the document’s retrieval times and viewed dates already fix that moment; the cover is not moved to the upload date, because that would put two dates on one act of reading.
Corrections
v1.1, 15 August 2026 - one sentence corrected. v1.0 cited AOS-CMP-2026-001 for a proposition that assessment does not hold.
| Where | Was | Now |
|---|---|---|
| Section 1, the paragraph on earlier work | “It is cited for one thing only: that the question is one Commonwealth assurance material has not put before.” | “It is cited for that finding and no more: for what those two instruments do not test, and not for any proposition about Commonwealth material at large.” |
Why. AOS-CMP-2026-001 finds that two named instruments - the Foreign Ownership, Control or Influence Risk Assessment Guidance and the Hosting Certification Framework, both administered by the Department of Home Affairs - do not test whether a certified provider can be lawfully compelled by a foreign government to disclose the data it holds. It makes no claim about Commonwealth material at large, and this document was not entitled to cite it for one.
No finding moves and no count moves. This assessment’s own finding rests on the material it read, not on the cited work. Nothing else in v1.0 is withdrawn or qualified, and v1.0 remains published at its own address with its own hash.
How it was found. While verifying an unrelated claim about the Information Security Manual, AOS-CMP-2026-001 was read again against the documents citing it. The defect exists independently of that work.
What no check caught. The corrected sentence does not quote AOS-CMP-2026-001. It is a citation whose scope exceeded its source, and no check in this practice reads a citing sentence against what the cited document holds.
Corrections made before publication are not listed here. They are recorded in the case’s own scope file, which is where the drafting record belongs.
Assessment PDF
SHA-256: 4ac3c2038b41db60fdce9d4dbfb97afc30a1cdb605d7890d62a860fc3271db9e