EVULGARE

Institutional evidence record

EVI-INST-0012

Restrictive response-header logic exists in source

The packaged application defines security-header behavior, but reverse proxies and host configuration can alter the final public response.

Source and verification

Full bounded record

Return to the ledger
Claim ID
EVI-INST-0012
Claim class
REPOSITORY VERIFIABLE
Status
SUPPORTED WITHIN SCOPE
Institutional page
Security
Source type
REPOSITORY SOURCE
Source release
2.0.0-rc.57-WIP
Source path or public URL
app/security.py
Source digest
ab2f62c3f3bcc9fb3c1fecb8af080a960fb2437d76f4baf1cd747b4f4287bc7d
Observation environment
RC57 source tree
Observation time
2026-08-13T00:47:38Z
Verification method
Security middleware inspection
Verification result
Header construction and response hook present
Scope
Application-generated responses in the packaged source
Change event
EV-CHG-0056-008
Public record URL
https://evulgare.com/institutional/evidence/EVI-INST-0012/

Scope control

Limitations

  • Final actual-host headers were unavailable in the build environment.

Review triggers

Known defeaters

  • Proxy rewriting, stale release, route fallback, configuration drift, or middleware registration failure.

Append-oriented lineage

Change history

Material claim changes are added as events. A correction, qualification, withdrawal, supersession, restoration, or stale marker should not silently erase the earlier state.

  1. QUALIFY

    EV-CHG-0056-008

    Application middleware evidence does not substitute for final response evidence.

    Reason
    Describe security-header logic without claiming final proxy output.
    Previous state
    Header behavior described generally
    New state
    Source and actual-host boundaries separated
    Review boundary
    Final public headers require host observation
    Source record
    app/security.py

Machine-readable record

Inspect the bounded JSON representation

The JSON endpoint contains the same public fields and change events. It does not add evidentiary weight or expand the record beyond this declared scope.

Open record JSON

MISSION-FIRST · EVIDENCE-LOCKED · MACHINE-SPEED

DETECT → VERIFY → DENY → CONTAIN → RECOVER → PROVE

Command integrity. Decision superiority. Compartment security. Attested reconstitution.