The Compellability Gap in Commonwealth Cloud Assurance

Verification status

The assessment is structured in layered attestation. The counts below show what is in the document; the CLAIM verdicts below show the engine result for the verified layer.

CLAIMs are facts tested by the AustraliaOS verification engine against primary sources. ANALYSIS blocks are labelled AUTHOR REASONED: each is the director's reasoning over CLAIMs and names the step at which a reasonable reader could disagree. This assessment carries no RECOMMENDATION blocks: it ends at its Bounds section and proposes no actions.

CLAIM verdicts

SUPPORTED indicates the CLAIM is confirmed by at least one primary source. PARTIALLY SUPPORTED would indicate the source pool confirms the substance of the CLAIM but a specific element in the evidence assembly diverges or could not be fully verified against the available source text. NOT SUPPORTED would indicate the source contradicts the CLAIM. UNVERIFIED would indicate the source was inaccessible to verification at the time of publication. The 14 SUPPORTED, 0 PARTIALLY SUPPORTED, 0 NOT SUPPORTED, 0 UNVERIFIED census confirms every CLAIM in the assessment against a primary source the reader can open.

Primary sources

Verification draws on three categories of primary source. Each category is named below with the instruments, registers and filings it attests. Every source is publicly accessible and was viewed on 6 July 2026.

How to trust this record

The integrity of this verification record rests on public-source reviewability. Every factual claim in the assessment is tied to a named primary source, listed above, that is publicly accessible. Any reader, official, or independent reviewer can fetch the same source, locate the same passage, and confirm or contest the verdict for themselves. The verification does not ask the reader to trust an internal record; it asks the reader to check the public source directly.

AustraliaOS operates under a publicly disclosed interim audit-chain state pending migration to Australian-hosted infrastructure. The audit log entries written by the verification engine for this assessment are unsigned, via the JSONL fallback path, and are not yet cryptographically chained under a HMAC key. This is the same interim state disclosed for production on the AustraliaOS landing page. It is named explicitly here rather than left implicit, in keeping with the doctrine of disclosed accuracy the assessment itself argues for. The integrity guarantee on which this record stands is reviewability of public sources by the reader, not the internal audit chain; the chain is documentary, the public sources are evidentiary.

How this record is verified

Verification chain: citation. This assessment predates the practice’s hash-pinning convention. Its register records, for every source, a reference, a name, a URL and the date it was viewed - not a SHA-256 and not an archived copy. A reader can open every source and check every claim against it. A reader cannot confirm that what the source serves today is byte-identical to what the assessment read, and this practice cannot produce that copy. The document’s own claims are framed accordingly and assert no archival chain.

What this page is not

This verification record confirms that the factual claims in the assessment match what the named primary sources state at the time of publication. The assessment examines the design of two Commonwealth instruments and one program; it does not assess the conduct of any provider or any government entity, and it alleges no wrongdoing by either. It makes no allegation against Amazon Web Services, Google, or any provider named: that a provider holds Strategic certification, and that a United States company is reachable under United States law, are ordinary and lawful facts.

It makes no claim that any particular Australian Government dataset or system is held with any particular provider, at any tier, or in any location. It does not allege that the CLOUD Act has been invoked, or that any Australian Government data has been compelled, disclosed, or accessed. The subject is legal reachability, a standing property of jurisdiction, not any event. The assessment itself, not this verification page, is the decision-support artefact.

Every version, with hash

Every document this page has ever struck now has an address. That convention was adopted 12 August 2026 and applies corpus-wide.

A row marked see Corrections is affected by the correction recorded in the next section.

v1.1's service is established by a third-party capture (Internet Archive, 8 August 2026), not by this practice's own record.

v1.0 was struck by this page on 6 July 2026 and superseded four hours and five minutes later. No capture sampled that window, and the site publishes from a working tree rather than a branch, so the repository cannot answer whether any reader was served it. It is published at its own address for the first time at v1.2.

What changed, and why

v1.2, 12 August 2026 - an addition, not a correction. Section 6 gains a subsection recording section 30AB(4) of the Security of Critical Infrastructure Act 2018 and the critical infrastructure risk management regime; Section 7 gains its limits. Nothing in the earlier versions is withdrawn, corrected or qualified, and no finding moves.

A correction to this page's own version history. A revision published at 13:29 AEST on 12 August 2026 was mislabelled v1.1; it is v1.2. In that window this page carried a row stating "v1.0 · fd31859858a2ad1e…", which was false - those are v1.1's bytes. The false state was captured by the Internet Archive at 03:31:54 UTC on 12 August 2026 and remains retrievable there; this practice cannot withdraw that capture. The full account is in the Corrections section of the v1.2 document.

Assessment PDF

The full assessment, authored and signed by the director, is available below. The verification status set out on this page is reflected in the document footer.