identity: sha256:29bc384dfc0cd3d8cbb83db16c761549d12035d458b1bab541b6ace571eb31cc
verified: 4 members, each matching the manifest's sha256 and size
limit: unsigned: verification detects a changed member; it does not authenticate the sender
limit: no replay: this bundle shows an investigation; it does not reproduce or fix it