RESEARCH
Notes from inside the catalog layer.
Long-form on supply chain integrity, attestation, and the structural difference between scan-after-install and prove-before-install. We're starting with one essay — the wedge.
FIRST ESSAY
WEDGE
Draft in progress
Prove-before-install: why provenance belongs at ingest
The structural argument for moving the verification boundary one hop earlier — attaching signed provenance to every Windows artifact at ingest, before it reaches an endpoint. Why that is a different control from scanning after install, not the same control with better timing.
Notify me when it's publishedSUBSCRIBE
Get the wedge in your inbox.
We'll email you when it's published. No marketing.