Public Methodology

The published methodology — versioned, content-addressed, no auth.

A litigation bundle pins methodology_sha256 so a verifier can tell whether the report they hold was produced under the method they are reading. Served from the API rather than as a static page for two reasons: bundled JavaScript cannot be hashed meaningfully, and a static file under frontend/public needs its own nginx exact-match rule — the signing-key registry is a live 404 for exactly that reason, and publishing a second dead URL into signed reports would repeat it.