Proof of Recovery Artefacts

The full pack is delivered as a sealed, numbered Proof of Recovery certificate. It is examinable, linked to the exact release tested, and refreshed when the vendor ships a new version.

Build Report

A complete log of the build process: compiler, dependencies, build tools, errors encountered and resolved, and final binary outputs. It is evidence that the code compiles from the deposit alone rather than from undocumented knowledge held only by the vendor.

Deployment Runbook

A step-by-step operational guide for deploying the application in your environment if a trigger event occurs. It is written so your team can execute it without the vendor present, including environment setup, configuration, health checks, and rollback instructions.

Replication Report

Evidence that the declared production architecture — database, network topology, service configuration, and environment variables — has been replicated and validated. This proves recovery extends beyond compilation to an operable system.

SBOM

A complete inventory of every dependency, library, runtime, and component included in the verified release, formatted to SPDX and CycloneDX standards. The SBOM creates an auditable software-supply-chain record for the exact release tested.

Confidence Score

A numeric score from 0–100 representing verified recoverability confidence for the release. It reflects build completeness, dependency resolution, deployment success, replication fidelity, and the remaining exceptions that require action.

Engineer’s Seal

A numbered, dated signature from a named Castler verification engineer. It is not a probabilistic output: it is an auditable artefact with an accountable professional behind the claim and a public verification reference.

What is in the signed evidence pack

One signed pack. Per vendor. Per release