# A-033

- **Artifact ID:** A-033
- **Status:** ACTIVE
- **Public record:** https://record.cybersecurityhq.com/assumptions#A-033
- **Machine-record SHA-256:** `10124f9572b96a53c317ad423443adb9792d6a26917c2d8c23723ee02582aa80`

## Complete structured record

```json
{
  "id": "A-033",
  "statement": "Software distribution channels are passive delivery mechanisms that do not exercise execution authority",
  "status": "ACTIVE",
  "category": "Under Pressure",
  "ledger_references": [
    "2026-03-25 — CHQ-P-2026-015: Under pressure on issuance. Registries, package managers, and CI/CD pipelines determine what code executes, what credentials are exposed, and what artifacts are published; they function as control planes rather than passive delivery infrastructure."
  ],
  "evidence_count": 6,
  "last_updated": "2026-03-25",
  "related_positions": [
    "CHQ-P-2026-015"
  ]
}
```