Help
How to read the trust surface
Publicus is a public trust substrate, not a generic security dashboard. The registry status is curated truth. Live enrichments and source observations are additive context that help a reviewer move faster without hiding where the evidence came from.
Start with status
AllowedNo current evidence blocks routine use in the intended component category.
Allowed with constraintsUse may be possible, but only with version floors, deployment conditions, or compensating controls.
Under reviewThe evidence base is moving or incomplete. Treat this as a hold state, not a soft approval.
BlockedThere is an active reason not to ship or deploy the component in the current context.
Curated truth versus live enrichment
Curated truthComponent status, allowed package ranges, advisory rows, ATLAS mappings, and registry-native provenance expectations come from the signed registry corpus.
Checked enrichmentEPSS, Scorecard, Rekor, deps.dev, PyPI JSON metadata, and source observations help explain urgency, maintenance posture, release health, and corroboration, but they do not overwrite the curated registry decision.
Dependency scanThe scan route checks a single package or accepts package manifests, lockfiles, and supported SBOMs, then shows what to fix first while keeping registry verdicts, fresh upstream evidence, and package-health signals separate.
Evidence packEach scan can export JSON and Markdown release-readiness evidence. The pack contains package findings, source freshness, review proposals, and Canada-readiness checks; it does not contain uploaded file contents.
Ask PublicusAsk Publicus uses bounded synthesis over existing Publicus evidence. It is not the registry of record and should be challenged through the cited sources and tool activity it surfaces.
Synthesis in Publicus
What Publicus usesPublicus uses structured output, session continuity, internal evidence calls over signed registry/context data, citation allowlists, and explicit local-evidence fallback. Extra tool capability remains profile-gated rather than silently assumed.
Display enrichmentRegistry and exploited-risk detail panels can run an on-demand "Explain evidence" or "Deep inspect" action. These actions are cache-first and provider-neutral in the public UI; they summarize visible evidence and cite the same public source URLs.
Cost boundaryAsk Publicus remains limited by default. Richer web, code, indexed-evidence, and approved-tool checks are reserved for explicit evidence-card actions or configured operator flows.
What stays out of scopePublicus does not treat generated text as the truth source, does not let open web context rewrite a registry decision, and does not hide fallback behind a fake "AI succeeded" answer.
How to verify itRead the citations, inspect the registry rows, compare freshness lanes, and treat the answer as a recommendation layer rather than a source of record.
How to interpret the key signals
EPSSExploit-likelihood context from FIRST for CVE-backed advisories. Use it to understand pressure, not to replace the advisory itself.
ScorecardUpstream repository-health context from OpenSSF. Useful for maintenance risk and release hygiene, but not a substitute for package-specific advisory review.
RekorPublic transparency-log corroboration. Publicus distinguishes between "expected," "published," and "not yet recorded" rather than collapsing everything into one provenance badge.
Package healthdeps.dev and PyPI JSON metadata can show dependency counts, published advisories, license signals, release counts, yanked files, package-level vulnerability records, and published provenance/attestation counts for package-specific scans.
Source familiesCanada-context, vulnerability, exploit pressure, project-health, provenance, and standards mapping are intentionally separated so reviewers can see what each source actually contributes.
Package evidence eventsManifest scans can create fresh evidence events and ReviewProposal objects. Treat these as review pressure, not as a hidden registry status change.
Primary-source linksRecent-change and evidence cards open the original source URL when one is available. Advisory movement falls back to NVD or GHSA primary-source pages.
Recent changesThe drift and weekly-brief surfaces do not invent movement. If the system has little recent delta, they say so directly.
Where to drill down next
Source contractInspect publisher, cadence, provenance URL, live observation, and why a source belongs in the trust surface.
Why Publicus is differentRead how Publicus complements cyber-capable models, scanners, and SBOM tools instead of competing as another black box.
Canada release readinessRead how package evidence maps into Canadian review context without claiming certification.
Weekly briefSee current movement, connected source coverage, and standards artifacts summarized in one page.
Canada mappingSee how registry status language translates into Canadian procurement, policy, and deployment-review context.
Reference plan snapshotRead the historical repo execution reference, then use the current-state, decision-log, and lineage docs for active operating truth.
Dependency scanCheck one package or upload package files and supported SBOMs to see blockers, unknowns, fresh advisory evidence, and fix-first recommendations.
RegistryUse the full component browser for advisories, provenance, versions, and curated package truth.
Exploited risksUse the exploited-risk browser for CISA known-exploited intersections, urgency review, and patch targeting.
Ask PublicusUse the explicit Ask workspace after scan or evidence inspection when you want a scoped recommendation rather than another browsing surface.