engagement-deliverable-audit
Copyright 2026 The Arbiter Project Authors

Licensed under the Apache License, Version 2.0 (the "License"); you may not use
this file except in compliance with the License. You may obtain a copy of the
License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed
under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
CONDITIONS OF ANY KIND, either express or implied.

This project audits an engagement: of the deliverables a statement of work says
should exist, which are moving, which are tracked and stalled, and which are
absent. The first two are different answers and a tracker that reports only
"open" cannot tell them apart.

THIRD-PARTY CONTENT: A REAL PUBLIC SOURCE, PSEUDONYMOUS PEOPLE

Both sentences that stood here were false, and they were published. They read
*nothing in this repository was copied from anywhere else* and *no consultant
named anywhere here is real*. `evidence/astropy-cycle5-*` is derived from the
Astropy project's public Cycle 5 funding requests and the issues tracking them,
and it named four real maintainers by their GitHub handles, against deliverables
this package reports as stalled.

The invented examples are still invented -- `examples/` is a fictional
engagement and says so on its face. What is NOT invented is the astropy
evidence, and it is now pseudonymous: deliverables carry stable `D-NN`
identifiers, the people who own them carry `C-NN`, and no person is named in
any field or any title.

THAT IS PSEUDONYMITY AND NOT ANONYMITY, and it is not offered as any. The source
is named openly, one commit deep, because an audit whose provenance you cannot
check is worth nothing -- and anybody who opens it can map the pseudonyms back.
The deliverable TEXT is quoted verbatim from a public document, so it is a join
key in the way a filing's figures are. The pseudonyms buy one thing and it is
worth having: this repository does not itself publish a named individual beside
an adverse finding about their work.

DEPENDENCIES, SEPARATELY LICENSED

The optional vertical registration depends on `presence-audit`, and Stage 2
depends on `arbiter-engine`. Both are separately licensed under the same terms.
This is a consumer of them and not a part of either.

Stage 1 depends on nothing at all.
