{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:GK3WMUTKYOSND35H4DAA3H6DWK","short_pith_number":"pith:GK3WMUTK","canonical_record":{"source":{"id":"2606.26866","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-25T10:52:48Z","cross_cats_sorted":["cs.AI","cs.CY"],"title_canon_sha256":"0080e0b863b5add3643cd386edb23358adbc0ff6c58919ba8d282d65a16f9347","abstract_canon_sha256":"2c4df640c72906587e5aa883e99b0b93c1668e91ce5e797f4340e7d2dd4e8e52"},"schema_version":"1.0"},"canonical_sha256":"32b766526ac3a4d1efa7e0c00d9fc3b2941851e86de1574e2ae43e3e4a49e4f1","source":{"kind":"arxiv","id":"2606.26866","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.26866","created_at":"2026-06-26T01:16:02Z"},{"alias_kind":"arxiv_version","alias_value":"2606.26866v1","created_at":"2026-06-26T01:16:02Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.26866","created_at":"2026-06-26T01:16:02Z"},{"alias_kind":"pith_short_12","alias_value":"GK3WMUTKYOSN","created_at":"2026-06-26T01:16:02Z"},{"alias_kind":"pith_short_16","alias_value":"GK3WMUTKYOSND35H","created_at":"2026-06-26T01:16:02Z"},{"alias_kind":"pith_short_8","alias_value":"GK3WMUTK","created_at":"2026-06-26T01:16:02Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:GK3WMUTKYOSND35H4DAA3H6DWK","target":"record","payload":{"canonical_record":{"source":{"id":"2606.26866","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-25T10:52:48Z","cross_cats_sorted":["cs.AI","cs.CY"],"title_canon_sha256":"0080e0b863b5add3643cd386edb23358adbc0ff6c58919ba8d282d65a16f9347","abstract_canon_sha256":"2c4df640c72906587e5aa883e99b0b93c1668e91ce5e797f4340e7d2dd4e8e52"},"schema_version":"1.0"},"canonical_sha256":"32b766526ac3a4d1efa7e0c00d9fc3b2941851e86de1574e2ae43e3e4a49e4f1","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-26T01:16:02.287724Z","signature_b64":"0jxIpNs/ZJNq0jv5AgLySATXV/GFoms3zinxQ6AXeb/fcFsr8t53sAZNs3plF4RTXyDjL+jga/Cvf49zS/YWCw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"32b766526ac3a4d1efa7e0c00d9fc3b2941851e86de1574e2ae43e3e4a49e4f1","last_reissued_at":"2026-06-26T01:16:02.287328Z","signature_status":"signed_v1","first_computed_at":"2026-06-26T01:16:02.287328Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2606.26866","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-26T01:16:02Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Xsuao/vPvsAeKl/QdzaaHUf2ZprW3su4QodR3EPB1IiqdJ30P7D4J0BAS9cV4YfeH3jXTZc0fyHPMoLwx2NuDw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-28T11:07:10.459257Z"},"content_sha256":"51593a0968f0d0eb77064d3f13c12dfa70a80e22c4d0c6b3ad4980bc37ac8491","schema_version":"1.0","event_id":"sha256:51593a0968f0d0eb77064d3f13c12dfa70a80e22c4d0c6b3ad4980bc37ac8491"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:GK3WMUTKYOSND35H4DAA3H6DWK","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Fortress and Gatekeeper: Theorizing Transitive Trust in Third-Party Cybersecurity Risk Governance","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI","cs.CY"],"primary_cat":"cs.CR","authors_text":"Misita Anwar, Yijun Chen","submitted_at":"2026-06-25T10:52:48Z","abstract_excerpt":"Third-party vendors, such as analytics platforms, cloud services, identity providers, and software suppliers, are increasingly embedded in digital service delivery. While these arrangements enable scale and specialization, they also move customer data and security-relevant practices into environments that customers rarely see, select, or evaluate. This paper examines this problem through a document analysis of the November 2025 OpenAI-Mixpanel security incident. The incident serves as an illustrative case for showing how a security event in a vendor environment can become a governance and acco"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.26866","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2606.26866/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-26T01:16:02Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"3A8uL4wSoA4uwbe3RWIwsnNiYCl4e60ac+ScPX61ZOKxEtsauGDaQ7Dyj0V+DXwUp8B1dy+PmPzWCtXmD7zTBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-28T11:07:10.459643Z"},"content_sha256":"8c1871f7573b09b2cd94645d2ef3aaab428d85a96b6be0363ad5bf3bcf8ca304","schema_version":"1.0","event_id":"sha256:8c1871f7573b09b2cd94645d2ef3aaab428d85a96b6be0363ad5bf3bcf8ca304"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/GK3WMUTKYOSND35H4DAA3H6DWK/bundle.json","state_url":"https://pith.science/pith/GK3WMUTKYOSND35H4DAA3H6DWK/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/GK3WMUTKYOSND35H4DAA3H6DWK/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-28T11:07:10Z","links":{"resolver":"https://pith.science/pith/GK3WMUTKYOSND35H4DAA3H6DWK","bundle":"https://pith.science/pith/GK3WMUTKYOSND35H4DAA3H6DWK/bundle.json","state":"https://pith.science/pith/GK3WMUTKYOSND35H4DAA3H6DWK/state.json","well_known_bundle":"https://pith.science/.well-known/pith/GK3WMUTKYOSND35H4DAA3H6DWK/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:GK3WMUTKYOSND35H4DAA3H6DWK","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"2c4df640c72906587e5aa883e99b0b93c1668e91ce5e797f4340e7d2dd4e8e52","cross_cats_sorted":["cs.AI","cs.CY"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-25T10:52:48Z","title_canon_sha256":"0080e0b863b5add3643cd386edb23358adbc0ff6c58919ba8d282d65a16f9347"},"schema_version":"1.0","source":{"id":"2606.26866","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.26866","created_at":"2026-06-26T01:16:02Z"},{"alias_kind":"arxiv_version","alias_value":"2606.26866v1","created_at":"2026-06-26T01:16:02Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.26866","created_at":"2026-06-26T01:16:02Z"},{"alias_kind":"pith_short_12","alias_value":"GK3WMUTKYOSN","created_at":"2026-06-26T01:16:02Z"},{"alias_kind":"pith_short_16","alias_value":"GK3WMUTKYOSND35H","created_at":"2026-06-26T01:16:02Z"},{"alias_kind":"pith_short_8","alias_value":"GK3WMUTK","created_at":"2026-06-26T01:16:02Z"}],"graph_snapshots":[{"event_id":"sha256:8c1871f7573b09b2cd94645d2ef3aaab428d85a96b6be0363ad5bf3bcf8ca304","target":"graph","created_at":"2026-06-26T01:16:02Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2606.26866/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Third-party vendors, such as analytics platforms, cloud services, identity providers, and software suppliers, are increasingly embedded in digital service delivery. While these arrangements enable scale and specialization, they also move customer data and security-relevant practices into environments that customers rarely see, select, or evaluate. This paper examines this problem through a document analysis of the November 2025 OpenAI-Mixpanel security incident. The incident serves as an illustrative case for showing how a security event in a vendor environment can become a governance and acco","authors_text":"Misita Anwar, Yijun Chen","cross_cats":["cs.AI","cs.CY"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-25T10:52:48Z","title":"Fortress and Gatekeeper: Theorizing Transitive Trust in Third-Party Cybersecurity Risk Governance"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.26866","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:51593a0968f0d0eb77064d3f13c12dfa70a80e22c4d0c6b3ad4980bc37ac8491","target":"record","created_at":"2026-06-26T01:16:02Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"2c4df640c72906587e5aa883e99b0b93c1668e91ce5e797f4340e7d2dd4e8e52","cross_cats_sorted":["cs.AI","cs.CY"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-25T10:52:48Z","title_canon_sha256":"0080e0b863b5add3643cd386edb23358adbc0ff6c58919ba8d282d65a16f9347"},"schema_version":"1.0","source":{"id":"2606.26866","kind":"arxiv","version":1}},"canonical_sha256":"32b766526ac3a4d1efa7e0c00d9fc3b2941851e86de1574e2ae43e3e4a49e4f1","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"32b766526ac3a4d1efa7e0c00d9fc3b2941851e86de1574e2ae43e3e4a49e4f1","first_computed_at":"2026-06-26T01:16:02.287328Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-26T01:16:02.287328Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"0jxIpNs/ZJNq0jv5AgLySATXV/GFoms3zinxQ6AXeb/fcFsr8t53sAZNs3plF4RTXyDjL+jga/Cvf49zS/YWCw==","signature_status":"signed_v1","signed_at":"2026-06-26T01:16:02.287724Z","signed_message":"canonical_sha256_bytes"},"source_id":"2606.26866","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:51593a0968f0d0eb77064d3f13c12dfa70a80e22c4d0c6b3ad4980bc37ac8491","sha256:8c1871f7573b09b2cd94645d2ef3aaab428d85a96b6be0363ad5bf3bcf8ca304"],"state_sha256":"3ca95c83801b8bfeea377b96ef463cb1973b0eb4e25d782c9c19aa6b5dad19b5"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"JDOXD1B4PR9n8alyytCppLbHgAG/O9+WkQyQuwdPHnS/VJnL1ZTQk9Yv73xhpmGHiv7xwfNJbke6UmJ/KxcWCA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-28T11:07:10.462068Z","bundle_sha256":"e1e3df2daee5a209a9080c6d4ad82b1a58e7f535c14029afff3ba5359028e29b"}}