SHA-256 rolling hash bound to each evidence artifact with actor attribution.
Scan the product manifest — ontology types, functions, actions, policies, and dataset shells.