Follow these links for each risk’s controls, verification and residual assumptions. Each chapter owns its guidance; this index adds no requirements.

Find the relevant explanation§

Executed code crosses into publication authority

Execution boundaries, Action wrappers and effective settings.

Storage or an upgrade substitutes executable bytes

Artifact admission, provisioning, tool selection and upgrades.

Tested source or assets differ from the delivered release

Release evidence, example archives and native-input publication.

Source roles or native targets are confused

Source boundaries and native targets.

Partial, stale or unrelated results appear successful

Compatibility verdicts and adoption.

A test hangs, hides diagnostics or substitutes smoke for deeper testing

Test evidence and campaign separation.

Utility copies, companions or interfaces drift

Utility contracts and policy evidence.

Composition records omit components or bind the wrong artifact

Component evidence.

Documentation or an assessment overstates the checks

Documentation claims, retrievable formats, diagram rendering and maintaining explanations.