# ONE Market E18 — External Assurance Statement of Work

## Objective

Execute an independent qualification campaign against the exact artifact identified by the signed E18 challenge. The contractor shall not substitute a rebuilt, instrumented, or semantically different artifact without issuing a separately signed deviation record.

## Required work packages

1. Physical-region adversarial WAN campaign across three independently administered providers and failure domains.
2. Timing and cache leakage assessment with raw traces and calibrated negative controls.
3. Power and electromagnetic assessment where the target hardware permits meaningful measurement.
4. Fault-injection assessment covering process, storage, clock, network, and cryptographic boundaries.
5. Cryptographic-module validation evidence bound to the deployed module and public key.
6. Independent review of the threshold-signature provider and distributed protocol implementation.

## Mandatory evidence

Every work package shall provide raw datasets, a canonical dataset manifest, calibration records, chain-of-custody events, source/build/artifact/toolchain digests, signed findings, limitations, deviations, and at least two independent witnesses where the policy requires them.

## Independence and prohibition

The requester may supply artifacts and technical clarification but may not sign its own production evidence. Internal fixtures, self-attestations, unsigned summaries, screenshots without raw data, and reports outside the accredited scope are non-admissible.

## Acceptance

Acceptance is performed exclusively by the executable E18 admission policy. A commercially successful engagement does not imply technical admission, and a technically valid report does not by itself authorize production launch when another required evidence class remains absent.
