The EU Cyber Resilience Act's Article 14 reporting obligations begin to apply on September 11, 2026. The deadline is concrete. So is the question behind it: what changed, what authority moved, and what can the producer prove?
Article 14 covers actively exploited vulnerabilities and severe security incidents for products in scope. Its early-warning deadline is no later than 24 hours after awareness; the next notification is due no later than 72 hours after awareness. The final-report timetable differs between vulnerabilities and incidents. Full application of the Regulation follows on December 11, 2027.
That is a reporting duty, not a language feature. It does sharpen a question software teams already face: when code changes faster than a person can reread it, what can the organization prove about the authority that changed?
Garnet treats authority as reviewable program data. garnet check verifies declared capability budgets across the registered surface. garnet diff-caps reduces a large source change to its declared-capability delta. Neither command makes a product compliant; they make the acceptance record smaller and harder for the author to fake.
The proposed garnet build --evidence path is under construction. No such build flag exists in the shipping CLI. Today's runnable pieces are garnet caps, garnet diff-caps, and garnet seal; the seal records the declared surface, but it does not rerun the checker.
@caps and @max_depth have deterministic traps on the interpreter and VM, with cross-OS trap parity recorded.garnet CLI runtime-gates the bounded host-authority set named in the capability scope table.garnet build --evidence remains under construction under W-SHIP.Evidence only matters if its author cannot grade it into acceptance. Garnet's repository keeps implementation, independent review, the structured record, carrier approval, re-evaluation, and merge as separate acts. A content change voids the earlier verdict; sanctioned record-only succession does not extend what was reviewed; a missing record stays red. Those separations matter more than the format of an evidence bundle. A generated PDF does not prove acceptance. A useful chain ties each claim to a trap and each acceptance to its decision-maker.
That position follows the existing register and ceremony rail ([U-32](https://github.com/Island-Dev-Crew/garnet/blob/main/ops/lane1/review/04-request.md), [U-33](https://github.com/Island-Dev-Crew/garnet/blob/main/ops/lane1/review/04-request-addendum-u33.md)). It does not upgrade either finding or claim that the open work has shipped.