CHANGEGATE RELEASEPROOF

Release review

Project 42 · Pipeline 77
Reviewed commit aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa · Review time 2026-10-14T20:00:00Z

Human release approval is pending. This report supplies evidence for review. It performs no deployment and grants no release authority.

QC verdictFAILED_WITH_FINDINGS

Evidence consistencyPASSED

Artifact provenanceINCOMPLETE_NATIVE_ARTIFACT_PROVENANCE

Human releasePENDING

Required jobs

Job	ID	Native status
application-validation	101	success
semgrep-sast	102	success
secret_detection	103	success
npm-dependency-audit	104	success
qc-assessment	105	failed

Execution, coverage and findings

Check	Execution	Coverage	Findings count	Target findings	Affected dependency records	Advisory / finding IDs	Dependency severities	Dependency command exit
sast	SUCCEEDED	COMPLETE	0	Not supplied	Not applicable	None reported	Not applicable	Not applicable
secrets	SUCCEEDED	COMPLETE	0	Not supplied	Not applicable	None reported	Not applicable	Not applicable
dependencies_full	SUCCEEDED	COMPLETE	5	Not supplied	`synthetic-package-1` `synthetic-package-2` `synthetic-package-3` `synthetic-package-4` `synthetic-package-5`	`GHSA-example-synthetic`	Info: 0; Low: 0; Moderate: 0; High: 5; Critical: 0; Total: 5	1
dependencies_production	SUCCEEDED	COMPLETE	0	Not supplied	None reported	None reported	Info: 0; Low: 0; Moderate: 0; High: 0; Critical: 0; Total: 0	0

Audit comparability

SUBSET_CONFIRMED

Production findings are a subset under the declared comparable snapshots.

Collector-supplied lockfile and advisory snapshot identities; not independently authenticated by this report.

dependencies_full

Lockfile SHA-256: dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd
Advisory snapshot SHA-256: eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee

dependencies_production

Lockfile SHA-256: dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd
Advisory snapshot SHA-256: eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee

Risk disposition

NOT_SUPPLIED

Acceptance applies only to the displayed bounds. A recorded risk acceptance does not change the QC verdict or grant release approval.

Historical unknowns

diagnostic_artifact_capture_time
lifecycle_approval_configuration_comparison

Historical model interpretation

Session 9 · 2026-10-13T20:00:00Z · Interpretation only

Historical model input commit: bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb

Historical interpretation: findings remain visible; human review is required.

Receipt and byte-integrity details

Byte integrity and packet consistency only; this report does not authenticate the provider or the collecting actor.

{
  "artifacts": [
    {
      "byte_count": 1770,
      "job": "105",
      "path": "qc-summary.json",
      "sha256": "465f454b82c2dbaf896cc6014943579948558cc75128f91d0df39f26314cc7d8",
      "source_kind": "synthetic-fixture"
    },
    {
      "byte_count": 57,
      "job": "101",
      "path": "qc-validation/exits.json",
      "sha256": "a7e4533a541ccad8dd76926794ee1ae956dba5badf83f5c28f07a8650085d07d",
      "source_kind": "synthetic-fixture"
    }
  ],
  "deployment": {
    "action": "NONE",
    "authorized": false
  },
  "human_release": {
    "approved": false,
    "authority": "SEPARATE_HUMAN_DECISION_REQUIRED",
    "status": "PENDING"
  }
}