Follow the evidence.

This is a bounded technical demonstration, not a compliance verdict. AI cannot alter the assessment. Downloaded hashes detect changes relative to the manifest; they do not establish issuer authenticity. Read the limitations