How the Dossier checks the four reports.

Each report the Dossier reads passes the same five controls. Present means a readable report from a named tool. Sealed means the content hash written in the report matches a hash recomputed from its content. Signed means the public test set the report cites carries the tool's signature. Fresh means the report was measured within the declared validity period. Past that, it is marked due, and past two validity periods it is marked stale. Consistent means the report names one dataset and one content hash. If the tool version is unknown, the Dossier writes unknown. It does not guess a version.

The Dossier builds its list of controls from the code that declares them, so a missing control is computed. No hand-written list is recited.

Each answer carries its reason in words. A report that cannot state its measurement day is not called stale. The Dossier marks it unjudgeable and prints that, which is a different and worse fact.

To build its own public test set, the Dossier runs on the other tools' public test sets. It prints coverage, content hashes, signatures and freshness as it finds them on the day of the measure. A Dossier that flattered its own suite would be of no use to a reviewer. On day one that meant three questions of four covered, with the fourth named missing, and two content hashes recomputed. It also meant zero verifiable signatures, printed in the file and recorded as a failed control.

Freshness only means something against a validity period, and you declare it. It is ninety days by default, written in the public test set as a declaration. You change it with a flag, and an auditor can see that flag because the file stores the settings it was measured under. So two Dossiers can be compared knowing whether the rule moved between them.