# QuantumSentinel integration
The integration adapter accepts the existing scanner's scanRepository function. It reads a fixed Git commit and extracts that commit into an isolated temporary directory. It does not scan the mutable working tree. It rejects repository symlinks for this scan handoff. It runs static cryptographic inventory only. It does not execute repository code.

The adapter removes the private local scan path from the public demonstration report. It preserves scanner name, version, scan time, findings, limitations, and the exact scanner source hash. It creates a QuantumPassportCBOMV1 inventory from observed algorithm references. This inventory is not a claim of CycloneDX compliance. Report decimals become decimal strings under the restricted canonical format.

The evidence bundle includes the repository manifest, full commit ID, repository fingerprint, CBOM, CBOM hash, assessment, assessment hash, and scanner source hash. publishAssessment creates a passport, records ASSESSMENT_COMPLETED, and issues a signed ASSESSMENT_COMPLETED attestation. It binds the repository, CBOM, and report hashes in the signed claim. The designated QuantumSentinel test issuer key identifies this demonstration only. It does not grant certification authority.

A third party downloads the repository bundle and proof package, checks out the recorded commit, recomputes the RepositoryV1 fingerprint, hashes the canonical CBOM and report, checks the metadata and claim hashes, verifies the signatures, and retrieves the testnet receipts and blocks. The SoftwareArtifactV1 demonstration uses the same fixed repository blobs as a software artifact manifest. Its metadata also carries the RepositoryV1 fingerprint.

verifyEvidence checks the repository, CBOM, and assessment binding. The public demonstration includes canonical manifests for browser verification. Private customer evidence must remain in protected storage; publish only approved hashes and public metadata.