What the Instruments Require

Verification chain

Four things are pinned, and each can be checked independently of the others.

The assessment PDF. SHA-256: dde03b0aee8eeec90d8e919dc7346a9a6f323d1df17e4fff92305aed2a9a9fc2

Download the file and run shasum -a 256 over it. If the value differs, the file is not the one struck here.

The timestamp. The receipt AOS-ASR-2026-001-v1.6.pdf.ots is an OpenTimestamps proof over exactly those bytes, submitted to four calendars on 12 October 2026 and pending confirmation in the Bitcoin blockchain at publication. The receipt served here carries no Bitcoin attestation and is pending still. It establishes that the file existed no later than the moment it was stamped. It establishes nothing about whether the file is correct.

Receipt SHA-256: 6e9e1d8910c2700b2ad6576b22b2c4a710d45ccae0212b8fa334d62703c85e35

The assessed source. The assessment rests on 25 pinned artefacts: 16 retrieved and pinned by this case, and 9 inherited under convention 7 from other cases in this corpus, each re-verified against its recorded hash before this record was written. All 25 are pinned by hash and 22 of 25 independently archived. Quotations were checked against page images, not against a text layer alone; vocabulary counts state the artefact they were taken from and the control word run on the same extraction.

What the register holds, and what the assessment cites. The register is this case’s own, and its SHA-256 is published here so the whole chain is checkable: bd3d3e1099b20b9c8299cbb256158378f84edc517461160fd657d63dc469b6d1 over 24 rows. Sixteen are cited by ref in the assessment. Eight are not, and they are not of one kind. G-ASD-5 to G-ASD-11 are the seven further publications listed on the ASD cloud computing page; they were read on 19 August 2026, and Section 1’s negative — that none of the seven specifies a method for assessing foreign legal reach, and that the word extrajudicial appears in none of them — rests on that reading. G-ASD-2 is the Cloud assessment and authorisation landing page, held because the referral resolves to it. All 24 are pinned, hashed and re-verified, which is what “the assessment rests on 24 pinned artefacts” above states: the phrase counts what is pinned, not what is cited.

Re-fetch, measured 2026-09-06. Every own raw-body row of this register, 15 rows, was fetched twice that day and the two hashes compared. 3 returned different bytes on each fetch, G-CSA-1, G-NIST-2, G-NIST-3, and are marked in the table: their hashes stand only against the copies this practice holds and cannot be confirmed by fetching. The rest returned the same bytes twice on that day, which holds until the publisher changes the page. The measurement is in STABILITY-2026-09-06.tsv beside the register; the register itself is unchanged and pinned, does not point to that file, and a reader of the register alone does not see this (convention 50).

21 of 25 pinned sources have a third-party capture, each fetched back and confirmed to be the artefact. 14 of those 21 archived bodies hash identically to the copy pinned above. The other 7 are dynamically served web pages whose bytes differ from the pinned capture. For 6 of those 7 the extracted text is identical to the pinned copy, character for character; for those, the archived copy establishes that the page existed and what it said, not that the bytes are the same bytes. G-CSA-1’s archived text also differs, by a rotating promotional banner in the page furniture; the Cloud Controls Matrix content itself is identical. I-ISM-2 is captured, and its memento is recorded on the AOS-ISM-2026-001 verification record. 3 pinned sources have no third-party capture - A-DEED-1, A-DEED-2, G-HA-1 - and for those a reader must rely on this site or on the publisher’s server.

The build. The PDF is produced deterministically from tracked source by build.sh, with SOURCE_DATE_EPOCH pinned to midnight UTC of 19 August 2026, the publication day, which does not move at any revision. Repeat builds on one machine and one toolchain are byte-identical; independent third-party reproducibility is not established and is not claimed. Verify by SHA-256, not by rebuild.

Version history

7 versions. Each version carries its own assessment date below. v1.0 and v1.1 were published on 19 August 2026, v1.2 on 20 August 2026, v1.3 and v1.4 on 24 August 2026, v1.5 on 23 September 2026, and v1.6 on 12 October 2026. What each revision changed is in the document’s own version note and, where a revision corrected anything, under Corrections below. A revision does not replace its predecessor: each superseded version’s bytes are unchanged, its hash still resolves, and its file remains downloadable at its own address - all are listed below with their hashes. Every revision keeps v1.0’s SOURCE_DATE_EPOCH, because a revision is not a new reading - it is the same reading, corrected or extended.

The cover carries 12 October 2026, the date the assessment was made, and publication followed the same day. An assessment is a reading of a source at a moment, and the document’s retrieval times and viewed dates already fix that moment; the cover is not moved to the upload date, because that would put two dates on one act of reading.

Corrections

What changed in v1.6, and why

Version 1.6 corrects a count that v1.0 to v1.5 carried, and adds a referral disclosure under a rule this practice decided on 6 October 2026. The assessment said that four of the eight instruments name foreign legal reach in terms. Three do, in their own words: the ISM procurement chapter, PSPF Release 2025 and ASD’s Cloud assessment and authorisation. The fourth, PSPF Direction 001-2024, names foreign ownership, control or influence as an application of foreign interference and requires a process to identify and manage it; its two pages do not name a foreign government’s access to, or compulsion of, a provider’s data. Sections 2 and 8 now say so, and the v1.5 version note, which called the earlier universal false for one of the eight, carries a dated correction: it was false for the Commonwealth Procurement Rules and unsupported for four more on the words quoted. The finding does not move: none of the eight specifies a method for assessing foreign legal reach, and at least one, the Commonwealth Procurement Rules, does not name it at all. Apart from that count, no figure moves, and no quotation of any instrument is changed. Separately, under the rule of 6 October 2026 that a negative about an instrument speaks of its own text, that a method reached by referral does not make it false, and that where the practice knows of one the document says so, v1.6 names PSPF Release 2025 §6.1.3 as read at this revision, records its two referrals in Section 6, and discloses the test the public one states, with one source row added, G-HA-1. Version 1.5 and each earlier version stay published at their own addresses with their own hashes, and their bytes do not move.

Correction, 12 October 2026, corrected at v1.6. The assessment stated at Sections 2 and 8 that four of the eight instruments name foreign legal reach in terms, and its v1.5 version note said the earlier universal was false as written for one of the eight. On the words the assessment itself quotes, three name it in their own words, PSPF Direction 001-2024 does not, and the universal was unsupported for four of the eight besides the Procurement Rules. The count was wrong when v1.0 was published on 19 August 2026 and was carried to v1.5. The detail is recorded in the practice’s corrections register, and the corrected version, v1.6, was published on 12 October 2026.

What changed in v1.5, and why

Version 1.5 corrects the first half of the finding, which was false as written for one of the eight instruments from v1.0. The assessment stated that each of the eight names or asserts foreign legal reach. Its own text says that one of them, the Commonwealth Procurement Rules, does not name it. The finding now reads that none of the eight specifies a method for assessing foreign legal reach, and that at least one, the Commonwealth Procurement Rules, does not name it at all. The second half, that none specifies a method, does not change, and no other finding, figure or quotation of any instrument moves. The assessment’s own breakdown of how the eight relate to foreign legal reach is kept as its classification. The version note at the head of the document sets out the change. Version 1.4 and each earlier version stay published at their own addresses with their own hashes, and their bytes do not move.

Correction, 23 September 2026, now corrected in v1.5. The assessment states that each of the eight instruments it read names or asserts foreign legal reach. Its own text says that one of them, the Commonwealth Procurement Rules, does not name it, so that half of the finding was wrong when the assessment was made. The other half, that none of the eight specifies a method for assessing foreign legal reach, is unchanged. The detail is recorded in the practice’s corrections register, and the corrected version, v1.5, was published on 23 September 2026, ahead of the 16 October 2026 date rostered when the correction was ruled.

What changed in v1.2, and why

v1.2, 20 August 2026 - three defects, none touching a finding. All three sat in the apparatus that lets a reader check the findings. A quotation was truncated mid-sentence: the PSPF referral was introduced as “the sentence that follows” and stopped at “Circular 149” with no ellipsis, omitting the circular’s subtitle - Physical security certification of outsourced information and communications technology facilities - and its “(on GovTEAMS)”. The subtitle names a subject that bears on the assessment’s own reliance on that referral, so its omission engaged the corpus rule against eliding a qualification. The full sentence is restored. A statement about what was retrieved had nothing behind it: v1.0 and v1.1 said landing pages “were retrieved” for two NIST catalogues and the Cloud Security Alliance matrix, and no register row, hash, path or retrieval time evidenced it. The three are retrieved and pinned at this revision, and the sentences now say what is pinned. Retrieving them today does not make the earlier sentence true - whether a retrieval happened in early August is not established and is not now establishable - so the earlier assertion is recorded as unevidenced rather than repeated. And a classification had no artefact behind it: NIST SP 800-145 was marked Public in the referral table with no reference, while both not obtainable rows carried their method. Tested on 20 August 2026: HTTP 200, 85,781 bytes, 7 pages. The classification holds, the row now carries a reference, and the count of six referrals - three public, two to one unobtainable document, one not followed - does not move. No finding moves and no claim moves. One quotation is lengthened to the source’s own full stop.

What changed in v1.1, and why

One figure, corrected at v1.1. v1.0 stated that ten further cloud publications listed on the ASD cloud computing page were not read. That page lists eight publications, one of which is examined in the assessment and seven of which were read at this revision. The count was taken from reading the page rather than from counting over it, and was carried into the register row for that page and from there into the assessment. None of the seven specifies a method for assessing foreign legal reach, and the finding is unchanged. The full account and its reach determination are in the practice’s corrections register.

Corrections to this page

The timestamp sentence named a receipt that did not exist, from publication until 23 August 2026. The page said the receipt AOS-ASR-2026-001-v1.2.pdf.ots was “submitted to four calendars on 20 August 2026” and linked it. No receipt had been created for this version, on that date or any other, and the link returned HTTP 404 to every reader who followed it. The sentence was generated from the page’s publication date and rendered whether or not a receipt existed, so it asserted a stamping it never checked.

What was done. The receipt was created on 23 August 2026 over exactly the bytes struck above, and is served at its own address. The sentence now carries the true stamping date, which is later than the date the page gave. That gap is stated rather than closed: nothing was stamped on 20 August 2026. The document did not change and does not reissue - its hash is the one it has always had. The generator now renders the timestamp only where a receipt exists and refuses to build unless that receipt covers this document.

This page’s version history was corrected on 19 August 2026. As first served at v1.1 the lead sentence read “Two versions… v1.0’s bytes are unchanged, its hash still resolves, and the file remains downloadable at its own address” above a table carrying one row. v1.0’s hash appeared nowhere on the page, and neither did a link to it. A reader was told the earlier version could be checked and given nothing to check it with. The table and the count now derive from a single version list, so they cannot disagree. The assessment PDF was not affected and does not reissue; v1.0 remains at its own address with its own hash, both now listed above.

The verification page was separately corrected on 19 August 2026 before this revision: as first published it carried another case’s descriptive text and listed four sources where this assessment relies on eleven. The assessment PDF was not affected by that correction.

Corrections to the assessment itself are set out above and in its version note. Corrections made before publication are not listed here; they are recorded in the case’s own working files, which are not published.

Corrections made before publication are not listed here. They are recorded in the case’s own scope file, which is where the drafting record belongs. This section exists to hold what changes after a reader could have relied on it, and it will say so plainly if that ever happens.

Assessment PDF

AOS-ASR-2026-001-v1.6.pdf · 176,985 bytes · 20 pages

SHA-256: dde03b0aee8eeec90d8e919dc7346a9a6f323d1df17e4fff92305aed2a9a9fc2

OpenTimestamps receipt