{"schemaVersion":"1.0.0","recordId":"qeravio-supply-chain:qeravio-ai-companion:3.1.0","name":"qeravio-ai-companion","version":"3.1.0","generatedAt":"2026-09-08T15:00:00.000Z","status":"hash_verified_unsigned","publisher":{"claimedIdentity":"M.S.I NAOR LTD","contact":"support@qeravio.com","website":"https://qeravio.com","identitySources":["Codex manifest","Claude manifest","LICENSE.md"],"publisherAccountVerification":"not_available","publisherSignature":"not_available","checksumAuthenticatesPublisher":false},"subjects":[{"kind":"plugin-archive","url":"https://qeravio.com/downloads/qeravio-ai-companion-3.1.0.zip","bytes":34513,"sha256":"fd1b3b9f3a08bd148e82e2a79b2004c0cc5de9310b9498259e69086190ff18bc"},{"kind":"marketplace-bundle","url":"https://qeravio.com/downloads/qeravio-marketplace-3.1.0.zip","bytes":35778,"sha256":"c5b8a8f93d66247f0e5ec4920545ebe3cfda419ad0664a1eaa1d7a995713e487"}],"archiveInventory":[{"kind":"plugin-archive","fileCount":29,"sourceFileCount":28,"generatedFileCount":1},{"kind":"marketplace-bundle","fileCount":31,"sourceFileCount":30,"generatedFileCount":1}],"source":{"treeSha256":"1526b0e4a02a4c46d26554221609046effea354ba5c4cfe3b6eebe5f096b8e4e","revisionStatus":"not_recorded","revisionVerified":false,"packageContentsSha256":"e44d9a1e536298d56fd4afd1f6cf0dfc2841603b984ef8b963d458e65b2bbc7f","buildScript":"research/build_plugin_release.py","buildScriptSha256":"cdc10ce074fa2642bc48f58dbec35fb3563390ea96a829e4ac7abdd77e32e99a","buildMethod":"deterministic ZIP with fixed timestamp, sorted paths, fixed permissions and DEFLATE level 9","independentCleanRoomRebuild":"not_run"},"sbom":{"format":"CycloneDX","specVersion":"1.6","url":"https://qeravio.com/downloads/qeravio-ai-companion-3.1.0.sbom.cdx.json","bytes":63652,"sha256":"3e8bd3d527367ddc14ccffe020cb882f552463f45cf8d6ba1ffac7863e2a65c2","componentCount":60},"provenance":{"format":"in-toto Statement v1 with SLSA provenance v1 predicate","url":"https://qeravio.com/downloads/qeravio-ai-companion-3.1.0.provenance.json","bytes":2700,"sha256":"ecfc0de8d1f38f20d4ba0697a141516746233ab2d91fdf07b0154648a0ad64de","signed":false},"dependencyInventory":{"bundledThirdPartyRuntimeDependencies":0,"remoteServiceDependencies":[{"name":"Qeravio public MCP service","version":"3.1.0","endpoint":"https://qeravio.com/mcp","bundled":false,"authority":"public-read-only"}],"repositoryProductionLockfile":"pnpm-lock.yaml","repositoryProductionLockfileSha256":"e841d24c6a391a355761df6d514fa380945685dabd5495eca16caf4bdbfa5542"},"licenseInventory":{"packageLicense":"Proprietary","licenseReference":"LicenseRef-Qeravio-Proprietary-2026","licenseDocument":"qeravio-ai-companion/LICENSE.md","everyBundledFileAssigned":true,"thirdPartyRuntimeComponentsBundled":0},"vulnerabilityReview":{"scope":"repository production dependencies represented by the recorded pnpm lockfile","checkedOn":"2026-08-19","command":"pnpm audit --prod --audit-level high","result":"no_known_vulnerabilities","pointInTimeOnly":true},"releaseRecord":"https://qeravio.com/downloads/qeravio-ai-companion-release.json","openGates":["Protect a publisher signing key and publish a signature verification path.","Verify the publisher account through an approved host marketplace.","Run an independent clean-environment rebuild and compare both archive digests.","Repeat the vulnerability review for every release and after material lockfile changes."],"truthBoundary":{"checksum":"SHA-256 detects changed bytes when compared with this independently retrieved record. It does not authenticate the publisher.","sbom":"The SBOM inventories the two archives. It does not prove that every component is secure or suitable.","provenance":"The provenance binds the deterministic builder inputs and outputs. It is not a signed attestation and no source commit is claimed.","host":"This record does not prove installation or invocation inside a real Codex or Claude Code host.","remoteService":"Package rollback does not roll back the shared remote MCP service."}}