R3-04 Differentiation sheet

Supports slide 20.

Five differences, because each answers a different buyer’s question. Each one carries the evidence behind it.

Difference	The buyer’s need	Evidence
Provenance on every mapping	Defend a mapping in an audit	5 Aug: I found AC-1 showing 781 SCF mappings when the truth is 3. Michael fixed it in 16 minutes. The publisher’s three now headline; our four-hop compositions sit in a disclosure labelled “derived by us, not asserted by any source.”
Proof of absence	Know the gap before the assessor does	The August outside review named absence as our “number one hole.” By 26 Aug the MCP server shipped the uncovered residue as an output (live query). Pages still lead with presence.
API and MCP for agents	Compliance inside the tools people already run	MCP beta released 19 Sep 2026 to existing API users. “I am connected, and it works great!” (Kevin Houston, 22 Sep). API and MCP bundled in the price from 24 Sep.
Traced vs derived, labelled	Trust the number, not the brand	Outside read, 21 Aug: “asserted-versus-derived on every hop... Yours structurally prevents the one failure mode that would get a customer failed at an audit.” SecRed’s evaluation (21 Sep) praised the instruction to treat STIG text as content, never as commands.
Air-gapped path	Use it where the work actually is	DTA and I met on 24 Sep on billing, tracking and content versioning for their air-gapped deployment. Documenting the path is on the roadmap for Q1 2027 (R3-05).

Not yet evidenced: a documented air-gapped deployment path. Today it’s a partner conversation and a roadmap item.

Sources:

• AC-1 defect and fix: Weekly Check-In 12 Aug 2026
• Outside system review (absence, asserted/derived): Weekly Check-In 12 Aug 2026
• MCP live query: Weekly Check-In 26 Aug 2026; outside read 21 Aug: same check-in
• MCP beta and Kevin Houston: Weekly Check-In 23 Sep 2026; bundling: Weekly Check-In 30 Sep 2026
• SecRed evaluation: Weekly Check-In 23 Sep 2026
• DTA air-gapped meeting: Weekly Check-In 30 Sep 2026