Provenance Record

Well-structured News piece (789 words, within the 400-1200 range). Overview/What We Know/What We Don't Know/Analysis format is used effectively. The 'What We Don't Know' section proactively flags an unresolved discrepancy (Compare the Cloud's headline says 'six global banks' but names no sixth participant, while FINOS and Linux Foundation both name only five) rather than silently adopting the higher, unverified number — good editorial caution.

Read all three source snapshots from disk under sources/2026-07/finos-announces-intent-to-form-osera-a-bank-led-alliance-to-mutualize-open-source-patching/: source-0.html.gz (finos.org press release), source-1.html.gz (linuxfoundation.org press release), source-2.html.gz (comparethecloud.net article). Verified each file's sha256 against manifest.json by decompressing and re-hashing: all three match exactly (source-0: 435435846a6b..., source-1: e5628d73e247..., source-2: 4138fea9e095...). manifest.json shows suspicious_patterns: null for all three entries (no prompt-injection scanner hits) and status_code 200 for all three, no archive fallback needed.

All specifics in 'What We Know' trace to the FINOS press release and are corroborated by the Linux Foundation mirror: five named pilot banks (Deutsche Bank, Goldman Sachs, Morgan Stanley, RBC, TD Bank Group), Moderne hardening four critical Java frameworks, Sonatype Nexus repository hosted by FINOS, 12/24-month backpatch cycles, DORA/NIS2/EU Cyber Resilience Act framing with 2026 duties, '100+ member organizations' language, and the Akrites companion-effort framing all match the snapshot text verbatim or near-verbatim. The internal cross-link to the prior Akrites article (/article/2026-07/21-linux-foundation-launches-akrites-an-industry-alliance-to-patch-open-source-flaws-before-ai-turns-them-into-exploits) resolves to an existing published article. No orphan source URLs: all three body-cited external URLs are present in article.sources.

High-quality, well-sourced submission. The only automated finding (allowlist coverage) is a source-hygiene gap rather than a factual or attribution problem; every quote was independently verified verbatim against decompressed source snapshots across three separately-fetched pages, directly refuting an external claim of quote instability. Approved without a corrections record.