Verification chain
Four things are pinned, and each can be checked independently of the others.
The assessment PDF. SHA-256: bd300182f031b6e4f7ec34de0f2623b3ef3dcd9dbed0c46a4dd15e70a60889c3
Download the file and run shasum -a 256 over it. If the value differs, the file is not the one struck here.
The timestamp. The receipt AOS-CSO-2026-001-v1.0.pdf.ots is an OpenTimestamps proof over exactly those bytes, submitted to four calendars on 27 August 2026 and pending confirmation in the Bitcoin blockchain at publication. It has since been anchored: the receipt served here carries two Bitcoin attestations. It establishes that the file existed no later than the moment it was stamped. It establishes nothing about whether the file is correct.
The assessed source. The assessment rests on 27 pinned artefacts: 9 retrieved and pinned by this case, and 18 inherited under convention 7 from other cases in this corpus, each re-verified against its recorded hash before this record was written. All 27 are pinned by hash and 18 of the 27 are themselves Internet Archive captures. Quotations were checked against page images, not against a text layer alone; vocabulary counts state the artefact they were taken from and the control word run on the same extraction.
What the register holds beyond what the assessment cites. The register is this case’s own, and its SHA-256 is published here so the whole chain is checkable: 93e84e7ad8852fda3cc81e78008d0694d1bb6307c76b04afc2dd7fd6cc9b7fae over 27 rows. Seven are held for the case scope and are cited by no claim in the assessment — S-AWS-1, S-AWS-2, S-GOO-1 and S-GOO-2, the four pins read for Records one and two, and S-CDX-GOO-1, S-CDX-AWS-1 and S-CDX-AWS-2, the Internet Archive CDX indexes queried for their addresses on 27 August 2026. All 27 are pinned, hashed and re-verified, which is what “the assessment rests on 27 pinned artefacts” above states: the phrase counts what is pinned, not what is cited.
Re-fetch, measured 2026-09-06. Every own raw-body row of this register, 25 rows, was fetched twice that day and the two hashes compared. 2 returned different bytes on each fetch, S-GOO-1, S-GOO-2, and are marked in the table: their hashes stand only against the copies this practice holds and cannot be confirmed by fetching. 10 could not be measured because a fetch failed: SP-IA-CDX, O-IA-20250623183308, O-IA-20250916163147, O-IA-20251114112212, SP-IA-20220523031342, SP-IA-20220704220619, SP-IA-20221018055051, SP-IA-20230304175649, SP-IA-20231020042123, SP-IA-20250916172222. The rest returned the same bytes twice on that day, which holds until the publisher changes the page. The measurement is in STABILITY-2026-09-06.tsv beside the register; the register itself is unchanged and pinned, does not point to that file, and a reader of the register alone does not see this (convention 50).
| Ref | Artefact | SHA-256 | Third-party copy |
|---|---|---|---|
| S-HCF-1 | Hosting Certification Framework, March 2021 v2, 30 pages - the only framework document linked from hostingcertification.gov.au; publisher's own PDF | 7b654f6e435bb90560701bf5e4905538f2da0cae73157ab4d58e710045855070 | - |
| S-HCF-2 | hostingcertification.gov.au Certified Service Providers page as served, 17 August 2026 | 4db055fdb011b3a223b3a6509bf9c29a1e705d7d664e25fcab60d30a3db44ca3 | - |
| S-AWS-1 | AWS ARNs and namespaces reference as served | 82913024d2ddbf01429c14eaf42fec26274379a4f9d083ec4b3a800818ba30c2 | - |
| S-AWS-2 | AWS IAM User Guide, Manage AWS STS in an AWS Region, as served | bfcbe75fe6caed7fbd99497576c1647ff7faf040349ed19cfd3135388842de0a | - |
| S-GOO-1 | Google Cloud, Geography and regions, as served Re-fetch: the served body hashes differently on each fetch, measured 2026-09-06; this hash stands only against the copy this practice holds and cannot be confirmed by fetching the address. | e7053835bbfccb3328b90c0bca0f8e34b91509a35510361004b48950cde5b9ac | - |
| S-GOO-2 | Google Cloud locations page as served Re-fetch: the served body hashes differently on each fetch, measured 2026-09-06; this hash stands only against the copy this practice holds and cannot be confirmed by fetching the address. | 7bf2514913d93a12564825553115e2a58128305ffff81e6f9da01199848599df | - |
| S-CDX-GOO-1 | Internet Archive CDX index for S-GOO-1's address, queried 27 August 2026 | 9274fd482a57355511643faf063417a5b880e3ae069f1aa5ba6fb94cbc495401 | Internet Archive replay |
| S-CDX-AWS-1 | Internet Archive CDX index for S-AWS-1's address, queried 27 August 2026 | a3e2ae113a98d78e9fd00b14ec64a5ad28105ac15d2802cb4365eda90b3b2690 | Internet Archive replay |
| S-CDX-AWS-2 | Internet Archive CDX index for S-AWS-2's address, queried 27 August 2026 | f9ac0965715689104c5d4458c9f0c89ba1a82e46fa64bf4dc5f7688bc7bdde1b | Internet Archive replay |
| A-DEED-1 | HCF Deed of Certification, published standard form, 20 pages. Cited for the definitions of Service and Service Provider Type at clause 1.1, the grant of certification at clauses 4.2 to 4.5, and the clauses bearing on Agency Data | 3b7f03819a27aae5550b8ce5a434bea2e29b36806d44729d4cd25e79dd101a2f | - |
| AT-HCF-3 | HCF For Service Providers page as served. Cited for the eligibility criteria that define an enclave, and for the two provider types the framework states it applies to | becb270af231925cea25fdb1dde404a7c8b7a79100356a6fbd99f196b3a6940b | - |
| F-IA-20211126005423 | Framework document, earliest Internet Archive capture, raw replay. Cited for the document's byte identity with the pinned copy and for the date from which the landlord passage is established | 7b654f6e435bb90560701bf5e4905538f2da0cae73157ab4d58e710045855070 | Internet Archive replay |
| F-IA-CDX | Internet Archive CDX index for the framework document's own address. Cited for the twenty-three capture rows and the two digests | e280383aa4782e9fe28e4cf3b387cb82004ca8ebbcb43093c45299e661e811fe | Internet Archive replay |
| H-HCF-1 | HCF certified-provider register as served. Cited for the three Certified Strategic certification-object headings | 8ea432069b2f83781fc869e93c53c05e7e0a44c84209d943429e1e8e91709c4d | - |
| O-IA-20220117005227 | HCF certified-provider register, Internet Archive capture, raw replay. Cited for the heading signature | 1f5f679b73b5ba9b6a330b64ee734ee6e813b3b31f402701ba7a8c64e8784571 | Internet Archive replay |
| O-IA-20241214160934 | HCF certified-provider register, Internet Archive capture, raw replay. Cited for the heading signature | 9c0f279e4c81ad54b1ab980316dad2878c3c48f31900bb542f937c3caf5fee4e | Internet Archive replay |
| O-IA-20250216115257 | HCF certified-provider register, Internet Archive capture, raw replay. Cited for the heading signature | be62cdbbc4dd011fad31f630d54516047dcfcb9400d15d79ebdcf6002c970596 | Internet Archive replay |
| O-IA-20250623183308 | HCF certified-provider register, Internet Archive capture, raw replay. Cited for the heading signature and as the lower bound on the storage sentence | 08ab7d9e70d9a4cd9b88d060db005707cd28b43c6f7e4ecd72c551134aba76be | Internet Archive replay |
| O-IA-20250916163147 | HCF certified-provider register, Internet Archive capture, raw replay. Cited for the heading signature and as the upper bound on the storage sentence | 35f4dfe1228ac90a1f0b0223bf7116d0b9ff6daaced29554222f9c323e7bdde1 | Internet Archive replay |
| O-IA-20251114112212 | HCF certified-provider register, Internet Archive capture, raw replay. Cited for the heading signature | cb0378c32a4595ce72f6da4300e45752cb6e34ffe65e75b7300727c841370c31 | Internet Archive replay |
| SP-IA-20220523031342 | HCF For Service Providers page, Internet Archive capture, raw replay. Cited as the lower bound on the removal of the Software-as-a-Service category | 33d1d11cbd2b8c1941c2453d0b9782d97a36ebe20a447621343e681e509a43bd | Internet Archive replay |
| SP-IA-20220704220619 | HCF For Service Providers page, Internet Archive capture, raw replay. Cited as the upper bound on the removal of the Software-as-a-Service category | 635a5640a9e577dd42617358e1a412082d82b1753f993c3ab1dafbbb530e0145 | Internet Archive replay |
| SP-IA-20221018055051 | HCF For Service Providers page, Internet Archive capture, raw replay. Cited as the lower bound on the change from an enumeration to a limit | 4c1758a89d34c27d9a59e86d26670758de68f58c213dec76daf11591bb2c9e23 | Internet Archive replay |
| SP-IA-20230304175649 | HCF For Service Providers page, Internet Archive capture, raw replay. Cited as the upper bound on that change and as the lower bound on the enclave definition | a9b27db71fd795144a77999555d15f31110734d08a191e729abebf235fe95d56 | Internet Archive replay |
| SP-IA-20231020042123 | HCF For Service Providers page, Internet Archive capture, raw replay. Cited as the upper bound on the enclave definition and as the first capture carrying the eligibility block | ec7b819d9c01891697a46e9bc8ed9d277aaa3dac54eafefeef9c426d0914b479 | Internet Archive replay |
| SP-IA-20250916172222 | HCF For Service Providers page, Internet Archive capture, raw replay. Cited for the page's state on 16 September 2025 | 22e9ea726e4c81c868bdaa94e684f95a161dc6e594cf4ee3a212bc548e4d8635 | Internet Archive replay |
| SP-IA-CDX | Internet Archive CDX index for the For Service Providers page. Cited for the capture population the eighteen pinned captures are drawn from | d36ab3e0b251def55958d35b4f2efd6fc336b6e4ebde64f8d9007ee71a68dc60 | Internet Archive replay |
Of the 27 pinned artefacts, 18 are themselves third-party archive captures - S-CDX-GOO-1, S-CDX-AWS-1, S-CDX-AWS-2, F-IA-20211126005423, F-IA-CDX, O-IA-20220117005227, O-IA-20241214160934, O-IA-20250216115257, O-IA-20250623183308, O-IA-20250916163147, O-IA-20251114112212, SP-IA-20220523031342, SP-IA-20220704220619, SP-IA-20221018055051, SP-IA-20230304175649, SP-IA-20231020042123, SP-IA-20250916172222, SP-IA-CDX - retrieved from the Internet Archive rather than from a publisher, and a reader can re-fetch each of those from that archive at the address the register records. The other 9 were retrieved from the publisher, and no independent capture of them is pinned here; for those 9 a reader must rely on this site or on the publisher’s server.
The build. The PDF is produced deterministically from tracked source by build.sh, with SOURCE_DATE_EPOCH pinned to midnight UTC of 27 August 2026, the publication day, which does not move at any revision. Repeat builds on one machine and one toolchain are byte-identical; independent third-party reproducibility is not established and is not claimed. Verify by SHA-256, not by rebuild.
Version history
One version. The assessment date and the publication date are both recorded, and here they are the same day.
| Version | Assessed | Published | SHA-256 | Status |
|---|---|---|---|---|
| v1.0 | 27 August 2026 | 27 August 2026 | bd300182f031b6e4f7ec34de0f2623b3ef3dcd9dbed0c46a4dd15e70a60889c3 | current · download |
The cover carries 27 August 2026, the date the assessment was made, and publication followed the same day. An assessment is a reading of a source at a moment, and the document’s retrieval times and viewed dates already fix that moment; the cover is not moved to the upload date, because that would put two dates on one act of reading.
Corrections
None. This is the first edition and it has not been corrected since publication. Any correction to this assessment will be recorded here and in the practice’s corrections register, and the published bytes of this version will not move.
Corrections made before publication are not listed here. They are recorded in the case’s own pre-insertion audit and pre-publication audit, which are tracked with the source.
Assessment PDF
SHA-256: bd300182f031b6e4f7ec34de0f2623b3ef3dcd9dbed0c46a4dd15e70a60889c3