ArtifactMark keeps release evidence tied to the exact bytes

Field notes

ArtifactMark separates the identity of released bytes from the decision record describing their assessment. Its evidence model names an artifact digest, an assessment ID, and a coverage state for passed, failed, skipped, or unavailable checks. The homepage’s example compares an assessed release, 4f2a1c9, with 7d8e12b, where a new package.json postinstall script means the later version needs assessment. Maintainer participation is described as opt-in, with invitation-based accounts and processes for requests, disputes, and withdrawal.