{"schemaVersion":"1.0.0","recordId":"qeravio-supply-chain:qeravio-ai-companion:2.1.0","name":"qeravio-ai-companion","version":"2.1.0","generatedAt":"2026-08-20T00:00:00.000Z","status":"hash_verified_unsigned","publisher":{"claimedIdentity":"M.S.I NAOR LTD","contact":"support@qeravio.com","website":"https://qeravio.com","identitySources":["Codex manifest","Claude manifest","LICENSE.md"],"publisherAccountVerification":"not_available","publisherSignature":"not_available","checksumAuthenticatesPublisher":false},"subjects":[{"kind":"plugin-archive","url":"https://qeravio.com/downloads/qeravio-ai-companion-2.1.0.zip","bytes":25644,"sha256":"e9c889c8a31d5b16f24d4237d2cfaee1ceb77e0184c3f085d7d3cc30c68ccf22"},{"kind":"marketplace-bundle","url":"https://qeravio.com/downloads/qeravio-marketplace-2.1.0.zip","bytes":26825,"sha256":"6a0280bb4a53846a12434f39801fe3be057b59733db3e1809313a326b030042d"}],"archiveInventory":[{"kind":"plugin-archive","fileCount":23,"sourceFileCount":22,"generatedFileCount":1},{"kind":"marketplace-bundle","fileCount":25,"sourceFileCount":24,"generatedFileCount":1}],"source":{"treeSha256":"e6f44ee7d2c02beb57e85a4a858effa7b574bbd98c405aa11a15d7dec1260653","revisionStatus":"not_recorded","revisionVerified":false,"packageContentsSha256":"c88528af46bc7773bcebe91c56a7c4e49e0c9ef8fadef1c20fa3f56469e358e0","buildScript":"research/build_plugin_release.py","buildScriptSha256":"46bbc5d8c9778f434536fbc9952a4aa20bb7c281f71cd201d04921a997e64c1c","buildMethod":"deterministic ZIP with fixed timestamp, sorted paths, fixed permissions and DEFLATE level 9","independentCleanRoomRebuild":"not_run"},"sbom":{"format":"CycloneDX","specVersion":"1.6","url":"https://qeravio.com/downloads/qeravio-ai-companion-2.1.0.sbom.cdx.json","bytes":50818,"sha256":"090eda22e0f890514d9a50841f0a75e89779453f262cbb6d52e42bcc25c49b46","componentCount":48},"provenance":{"format":"in-toto Statement v1 with SLSA provenance v1 predicate","url":"https://qeravio.com/downloads/qeravio-ai-companion-2.1.0.provenance.json","bytes":2700,"sha256":"151d34256b68961fa6381bd1102d5929eb95b08029d76627d4a8ffa146457db1","signed":false},"dependencyInventory":{"bundledThirdPartyRuntimeDependencies":0,"remoteServiceDependencies":[{"name":"Qeravio public MCP service","version":"2.1.0","endpoint":"https://qeravio.com/mcp","bundled":false,"authority":"public-read-only"}],"repositoryProductionLockfile":"pnpm-lock.yaml","repositoryProductionLockfileSha256":"52e274ebde1ef72a84b6fc60976297afd6eeb69fd7db8f320026b88395db0abe"},"licenseInventory":{"packageLicense":"Proprietary","licenseReference":"LicenseRef-Qeravio-Proprietary-2026","licenseDocument":"qeravio-ai-companion/LICENSE.md","everyBundledFileAssigned":true,"thirdPartyRuntimeComponentsBundled":0},"vulnerabilityReview":{"scope":"repository production dependencies represented by the recorded pnpm lockfile","checkedOn":"2026-08-19","command":"pnpm audit --prod --audit-level high","result":"no_known_vulnerabilities","pointInTimeOnly":true},"releaseRecord":"https://qeravio.com/downloads/qeravio-ai-companion-release.json","openGates":["Protect a publisher signing key and publish a signature verification path.","Verify the publisher account through an approved host marketplace.","Run an independent clean-environment rebuild and compare both archive digests.","Repeat the vulnerability review for every release and after material lockfile changes."],"truthBoundary":{"checksum":"SHA-256 detects changed bytes when compared with this independently retrieved record. It does not authenticate the publisher.","sbom":"The SBOM inventories the two archives. It does not prove that every component is secure or suitable.","provenance":"The provenance binds the deterministic builder inputs and outputs. It is not a signed attestation and no source commit is claimed.","host":"This record does not prove installation or invocation inside a real Codex or Claude Code host.","remoteService":"Package rollback does not roll back the shared remote MCP service."}}