CSR demonstration product · Read-only evidence record · Not a public software release
Version-bound imported claims, separate from the preserved CV10 snapshot below. The 30-day reassessment interval is project policy, not an insurer requirement.
No AA1 run imported. Historical evidence below does not imply a current automated scan.
CSR / APP Audit
A source-bound evidence snapshot, not a blanket approval.
Automation, maintainer acceptance and unrun independent review remain distinct. No scan can establish complete security.
Every row is bound to the recorded product commit and tree. “Verified by human review” means maintainer acceptance unless an independent reviewer is explicitly identified.
NONE finding
EXPIRED
Previous state: VERIFIED BY AUTOMATION
Exact main commit/tree and 327 source-file hashes match the preserved evidence manifests. Separate clean repository; approved origin.
Scope: Local Git and SHA-256 checks. Private visibility separately checked in the signed-in repository UI.
Evidence: CV10 local inspection
NONE finding
EXPIRED
Previous state: VERIFIED BY AUTOMATION
181 CV9 and 139 CV8 checks passed in retained logs; source, tests and toolchain configuration bindings match. No simulation campaign repeated.
Scope: Evidence rebinding, not a new platform execution. Physical iPhone checks remain NOT RUN.
Evidence: CV9 preparation and retained test manifests
ADVISORY finding
MAINTAINER-REPORTED
Android debug APK exists with its recorded digest. No public Windows artifact or iPhone build is approved.
Scope: Historical build; no build performed for CV10.
Evidence: CV8 acceptance record and package inspection
NONE finding
EXPIRED
Previous state: VERIFIED BY HUMAN REVIEW
Maintainer accepted CV0 through CV6 native play. This is not independent security or accessibility review.
Scope: Recorded manual acceptance; no new Windows play session for CV10.
Evidence: Committed milestone acceptance records and user authorization
ADVISORY finding
MAINTAINER-REPORTED
Emulator review accepted. Default 30 FPS cap measured about 29.88 FPS, p95 33.333 ms, maximum 146.037 ms; stable 60 FPS not demonstrated.
Scope: Emulator-only historical evidence; not physical-device performance.
Evidence: CV8 acceptance record
BLOCKING finding
BLOCKED
CV9 prepared but not technically qualified. Mac/Xcode export, compile, simulator, device, signing and TestFlight have not run.
Scope: Repository preparation only.
Evidence: CV9 preparation checkpoint
ADVISORY finding
EXPIRED
Previous state: VERIFIED BY AUTOMATION
32 pinned Python dependency entries reconciled with the recorded version/license inventory. Godot 4.7.2 recorded as MIT with bundled notices.
Scope: Inventory consistency only; Python supports the historical backend/tooling. Native SDK and engine transitive license clearance remains open.
Evidence: Committed dependency and toolchain inventories
BLOCKING finding
NOT RUN
No current upstream-version or advisory database comparison was performed.
Scope: Pinned versions do not establish freshness.
Evidence: CV10 local inspection
BLOCKING finding
NOT RUN
No current advisory database was queried; no zero-vulnerability result is claimed.
Scope: Source was not uploaded to an external scanner.
Evidence: CV10 local inspection
NONE finding
EXPIRED
Previous state: VERIFIED BY AUTOMATION
No matches for private-key headers, AWS access-key shapes, GitHub token shapes or credential-bearing HTTP URLs in tracked UTF-8 text.
Scope: Bounded pattern scan only; not proof that every secret is absent.
Evidence: CV10 local inspection
ADVISORY finding
EXPIRED
Previous state: VERIFIED BY AUTOMATION
90 Python files parsed without syntax errors. No product code executed.
Scope: Python syntax only. No new GDScript semantic/security analysis or platform compilation.
Evidence: CV10 local inspection
NONE finding
EXPIRED
Previous state: VERIFIED BY AUTOMATION
All 327 tracked paths appear in the product provenance register; reviewed manifest bytes match.
Scope: Coverage and integrity, not ownership adjudication.
Evidence: CV10 local inspection
NONE finding
EXPIRED
Previous state: VERIFIED BY AUTOMATION
Frozen M1, M2, M3 proposal and CV8 APK sizes and SHA-256 hashes match. All remain ignored and untracked.
Scope: No artifact regeneration, public download or maintained rating release.
Evidence: CV10 local inspection
NONE finding
MAINTAINER-REPORTED
Recorded APK inspection: no requested permissions or services; backup disabled; stock profile receiver guarded by system DUMP permission.
Scope: Inspection record applies to the unchanged APK. No fresh device permission test.
Evidence: CV8 package inspection and bound APK
ADVISORY finding
MAINTAINER-REPORTED
Local in-memory fictional gameplay; no application-level personal information retained. Delivery platforms may process operational information.
Scope: Application boundary; no legal compliance finding.
Evidence: Bound source and maintainer declarations
BLOCKING finding
NOT RUN
Independent accessibility, TalkBack, VoiceOver and physical mobile-device acceptance remain open.
Scope: Headless layout checks and emulator review are not substitutes.
Evidence: CV10 local inspection
ADVISORY finding
MAINTAINER-REPORTED
Windows maintainer controller feedback recorded. Physical mobile controller testing has not run.
Scope: Platform-specific acceptance, not universal controller support.
Evidence: Maintainer acceptance history
BLOCKING finding
BLOCKED
Software/content license unselected and nonoperative. Public source and contribution acceptance require rights and dependency review.
Scope: No license applied or legal clearance claimed.
Evidence: CV10 local inspection
BLOCKING finding
BLOCKED
Club Volleyball remains a provisional working title; name/trademark review unresolved.
Scope: No third-party endorsement.
Evidence: CV10 local inspection
BLOCKING finding
NOT RUN
Reviewer position VACANT; maintainer acceptance cannot fill it.
Scope: No independent review evidence.
Evidence: CV10 local inspection
BLOCKING finding
NOT RUN
Reviewer position VACANT.
Scope: No certification or independent accessibility approval.
Evidence: CV10 local inspection
BLOCKING finding
BLOCKED
Public download not yet released. Debug APK is excluded; no store readiness.
Scope: Platform, rights and release gates must pass separately.
Evidence: CV10 local inspection
NONE finding
NOT APPLICABLE
No game cloud service, database or public deployment is part of this demonstration.
Scope: CSR operational security remains a separate responsibility.
Evidence: CV10 local inspection
Python dependencies belong to the historical backend and development tools, not a claim that every package ships inside the native game. Versions and upstream license labels are reconciled with the bound source inventory; license clearance and current vulnerability/freshness checks remain open.
runtime · Recorded upstream license: MIT
runtime · Recorded upstream license: MIT
runtime · Recorded upstream license: MIT
runtime · Recorded upstream license: MIT
runtime · Recorded upstream license: BSD-3-Clause
development · Recorded upstream license: BSD-3-Clause
runtime · Recorded upstream license: MIT
runtime · Recorded upstream license: MIT AND PSF-2.0
runtime · Recorded upstream license: MIT
development · Recorded upstream license: BSD-3-Clause
development · Recorded upstream license: BSD-3-Clause
runtime · Recorded upstream license: BSD-3-Clause
development · Recorded upstream license: MIT
runtime · Recorded upstream license: BSD-3-Clause
runtime · Recorded upstream license: MIT
runtime · Recorded upstream license: BSD-3-Clause
development · Recorded upstream license: Apache-2.0 OR BSD-2-Clause
development · Recorded upstream license: MIT
runtime · Recorded upstream license: LGPL-3.0-only
runtime · Recorded upstream license: LGPL-3.0-only
runtime · Recorded upstream license: MIT
runtime · Recorded upstream license: MIT
development · Recorded upstream license: BSD-2-Clause
development · Recorded upstream license: MIT
development · Recorded upstream license: MIT
runtime · Recorded upstream license: MIT
runtime · Recorded upstream license: BSD-3-Clause
development · Recorded upstream license: MIT
runtime · Recorded upstream license: MIT
runtime · Recorded upstream license: PSF-2.0
runtime · Recorded upstream license: Apache-2.0
runtime · Recorded upstream license: BSD-3-Clause
Native toolchain inventory: Godot 4.7.2 (MIT plus bundled notices); Temurin JDK 17.0.20.1+1 (GPLv2 with Classpath Exception); Android build tools 36.0.0 and target SDK 36 (SDK terms and notices). iOS tooling is not qualified. No new dependency is installed by CV10.