vg evidence — Signed regulatory evidence (Vibgrate Evidence)

Usage

# One-time setup
vg evidence init --coordinator NCSC-NL --responsible "Jordan Alvarez" --filing-authority

# Register a product and freeze a shipped release
vg evidence product add "Acme Edge Gateway" --markets DE,FR,NL --in-scope --until 2031-01-01
vg evidence release acme-edge-gateway 4.2.0 --from .vibgrate/scan_result.json

# The flagship question, and a readiness gap report
vg evidence exposure CVE-2026-48282 --offline --advisory advisory.json
vg evidence readiness

What It Does

Vibgrate Evidence produces signed, reproducible evidence for products with digital elements — not a compliance verdict. You register your products, freeze each shipped release into an immutable component manifest, and then answer the question a regulator asks after a vulnerability lands: which shipped products contain it, at which versions, in which markets, still in support?

The answer is matched against manifests frozen at ship time — what you actually shipped, not what is in main today — and it is deterministic: identical inputs give a byte-identical result. It never guesses; a bound product with no frozen manifest returns undetermined with a reason, never a false "not affected".

Jurisdiction-neutral regimes

Reporting duties are modelled as regimes. The EU Cyber Resilience Act (--regime cra) is the first; DORA incident reporting (--regime dora-incident) ships too. A new jurisdiction is a regime profile, not a new command. Run vg evidence regimes to list them.

Exit Codes

vg evidence exposure is CI-usable: 0 no exposure, 2 exposure found (fail the build), 3 undetermined (manual review), 1 operational error.

Signed, Offline-Verifiable Bundles

Add --bundle <dir> to emit a signed evidence bundle (DSSE / in-toto / Ed25519). vg evidence verify <bundle> checks it offline — no account, no network — with honest verified / unverified / failed states. No language model touches any figure, and there is no telemetry in the evidence path.

Evidence, Not Compliance

Vibgrate Evidence produces evidence to support your obligations under a reporting regime. It does not determine compliance, is not a certification, and is not legal advice. The scope determination, the "actively exploited" determination, and the filing decision are yours.

Field guides (VS Code and CLI)

If you are filling in the Evidence panel for the first time, these short guides match the form fields:

• Get started
• Reporting frameworks (regimes)
• Organization fields
• Products, markets, classification, and scope
• Freeze a release and support
• Check exposure
• CISA KEV watch
• Response drills
• Verify a signed bundle