Vault web audit evidence. The SBOM covers the shared workspace production dependency lock graph, including packages outside Vault; it is not a native OS binary inventory. Manifest scope excludes downloads, generated build-evidence and signing material. Local output is unsigned. GitHub provenance exists only after the configured protected workflow has actually run. Native publisher signatures and a third-party audit are separate requirements.
