Usage
# One-time setup
vg evidence init --coordinator NCSC-NL --responsible "Jordan Alvarez" --filing-authority
# Register a product and freeze a shipped release
vg evidence product add "Acme Edge Gateway" --markets DE,FR,NL --in-scope --until 2031-01-01
vg evidence release acme-edge-gateway 4.2.0 --from .vibgrate/scan_result.json
# The flagship question, and a readiness gap report
vg evidence exposure CVE-2026-48282 --offline --advisory advisory.json
vg evidence readiness
What It Does
Vibgrate Evidence produces signed, reproducible evidence for products with digital elements — not a compliance verdict. You register your products, freeze each shipped release into an immutable component manifest, and then answer the question a regulator asks after a vulnerability lands: which shipped products contain it, at which versions, in which markets, still in support?
The answer is matched against manifests frozen at ship time — what you actually shipped, not what is in main today — and it is deterministic: identical inputs give a byte-identical result. It never guesses; a bound product with no frozen manifest returns undetermined with a reason, never a false "not affected".
Jurisdiction-neutral regimes
Reporting duties are modelled as regimes. The EU Cyber Resilience Act (--regime cra) is the first; DORA incident reporting (--regime dora-incident) ships too. A new jurisdiction is a regime profile, not a new command. Run vg evidence regimes to list them.
Exit Codes
vg evidence exposure is CI-usable: 0 no exposure, 2 exposure found (fail the build), 3 undetermined (manual review), 1 operational error.
Signed, Offline-Verifiable Bundles
Add --bundle <dir> to emit a signed evidence bundle (DSSE / in-toto / Ed25519). vg evidence verify <bundle> checks it offline — no account, no network — with honest verified / unverified / failed states. No language model touches any figure, and there is no telemetry in the evidence path.
Evidence, Not Compliance
Vibgrate Evidence produces evidence to support your obligations under a reporting regime. It does not determine compliance, is not a certification, and is not legal advice. The scope determination, the "actively exploited" determination, and the filing decision are yours.