Artefact Tier Cross-Reference

1. Tier 1 — BFT council (11 artefacts AT-01..AT-11)

2. Tier 2 — Buyer due-diligence (10 artefacts AT-12..AT-21)

3. Tier 3 — Compliance & procurement (17 artefacts AT-22..AT-38)

4. Curl-verifiable byte-exact proof

# Run on a fresh buyer VM (~52s for 38 tests)
BASE=https://www.csoai.org
for url in \
  $BASE/defoneos-bft-council-public-minutes.html \
  $BASE/defoneos-council-vote-tally-by-ring.html \
  $BASE/defoneos-council-vote-tally-by-quorum-threshold.html \
  $BASE/defoneos-council-vote-tally-probe.html \
  $BASE/defoneos-witness-list-live-snapshot.html \
  $BASE/defoneos-witness-list-rotation-policy.html \
  $BASE/defoneos-bft-voter-participation-cohort.html \
  $BASE/defoneos-bft-voter-cosine-similarity-cluster.html \
  $BASE/defoneos-redline-motions-history.html \
  $BASE/defoneos-bft-redline-invariant-checklist.html \
  $BASE/defoneos-per-ring-vote-tally-deep-dive.html \
  $BASE/defoneos-buyer-due-diligence-pack.html \
  $BASE/defoneos-buyer-acceptance-test-plan.html \
  $BASE/defoneos-buyer-evidence-acceptance-test-drilldown.html \
  $BASE/defoneos-buyer-evidence-bundle-freshness-probe.html \
  $BASE/defoneos-pilot-cost-benefit-model.html \
  $BASE/defoneos-buyer-faq.html \
  $BASE/defoneos-changelog.html \
  $BASE/defoneos-operator-troubleshooting-knowledge-base.html \
  $BASE/defoneos-buyer-operator-handbook.html \
  $BASE/defoneos-recovery-playbook.html \
  $BASE/defoneos-sbom-index.html \
  $BASE/defoneos-sbom-type-breakdown.html \
  $BASE/defoneos-sbom-quarterly-trend.html \
  $BASE/defoneos-mcp-seal-eligibility-tracker.html \
  $BASE/defoneos-mcp-category-lifecycle-seal-drift-audit.html \
  $BASE/defoneos-mcp-drift-event-timeline.html \
  $BASE/defoneos-pen-test-summary.html \
  $BASE/defoneos-pen-test-per-mcp-result-detail.html \
  $BASE/sovereign-disclosure-policy.html \
  $BASE/defoneos-system-card.html \
  $BASE/sovereign-air-gap-deployment-guide.html \
  $BASE/sovereign-identity-attestation.html \
  $BASE/sovereign-secrets-keystore-federation.html \
  $BASE/sovereign-federation-discovery.html \
  $BASE/defoneos-artefact-byte-exact-ledger.html \
  $BASE/defoneos-artefact-tier-cross-reference.html \
  $BASE/defoneos-witness-rotation-calendar.html ; do
  status=$(curl -sI "$url" -o /dev/null -w "%{http_code}")
  size=$(curl -sI "$url" | grep -i content-length | awk '{print $2}' | tr -d '\r')
  printf "%s %s %s\n" "$status" "$size" "$url"
done | tee buyer-evidence-acceptance-suite.log

5. Compliance cross-walk

• EU AI Act Art. 12 / 13 / 14 — Tier 1 (AT-01..AT-11) supplies logs, technical documentation, human-oversight evidence
• GDPR Art. 30 / 32 / 35 — Tier 2 (AT-12..AT-21) supplies DPIA + due-diligence + acceptance tests
• NCSC CAF / ISO 27001 / ISO 42001 — Tier 3 (AT-22..AT-38) supplies SBOM + SEAL + pen-test + secrets/keys
• JSP 936 / JSP 440 — Tier 3 covers air-gap deployment + identity attestation + key rotation