{
  "artifacts": [
    {
      "byte_count": 1770,
      "job": "105",
      "path": "qc-summary.json",
      "sha256": "465f454b82c2dbaf896cc6014943579948558cc75128f91d0df39f26314cc7d8",
      "source_kind": "synthetic-fixture"
    },
    {
      "byte_count": 57,
      "job": "101",
      "path": "qc-validation/exits.json",
      "sha256": "a7e4533a541ccad8dd76926794ee1ae956dba5badf83f5c28f07a8650085d07d",
      "source_kind": "synthetic-fixture"
    }
  ],
  "audit_comparison": {
    "basis": "Collector-supplied lockfile and advisory snapshot identities; not independently authenticated by this report.",
    "snapshot": {
      "advisory_snapshot_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
      "lockfile_sha256": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
    },
    "status": "SUBSET_CONFIRMED"
  },
  "command_execution": {
    "application_exits": {
      "assessor": 0,
      "build": 0,
      "lint": 0,
      "tests": 0,
      "typecheck": 0
    },
    "status": "SUCCEEDED"
  },
  "consistency": "PASSED",
  "contract": "releaseproof-review/v1",
  "deployment": {
    "action": "NONE",
    "authorized": false
  },
  "expected": {
    "pipeline": "77",
    "project": "42",
    "reviewed_at": "2026-10-14T20:00:00Z",
    "sha": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  },
  "findings": [
    {
      "coverage": "COMPLETE",
      "execution": "SUCCEEDED",
      "findings_count": 0,
      "name": "sast",
      "records": []
    },
    {
      "coverage": "COMPLETE",
      "execution": "SUCCEEDED",
      "findings_count": 0,
      "name": "secrets",
      "records": []
    },
    {
      "advisory_ids": [
        "GHSA-example-synthetic"
      ],
      "command_exit": 1,
      "coverage": "COMPLETE",
      "execution": "SUCCEEDED",
      "findings_count": 5,
      "name": "dependencies_full",
      "records": [
        "synthetic-package-1",
        "synthetic-package-2",
        "synthetic-package-3",
        "synthetic-package-4",
        "synthetic-package-5"
      ],
      "severity_counts": {
        "critical": 0,
        "high": 5,
        "info": 0,
        "low": 0,
        "moderate": 0,
        "total": 5
      }
    },
    {
      "advisory_ids": [],
      "command_exit": 0,
      "coverage": "COMPLETE",
      "execution": "SUCCEEDED",
      "findings_count": 0,
      "name": "dependencies_production",
      "records": [],
      "severity_counts": {
        "critical": 0,
        "high": 0,
        "info": 0,
        "low": 0,
        "moderate": 0,
        "total": 0
      }
    }
  ],
  "historical_unknowns": [
    "diagnostic_artifact_capture_time",
    "lifecycle_approval_configuration_comparison"
  ],
  "human_release": {
    "approved": false,
    "authority": "SEPARATE_HUMAN_DECISION_REQUIRED",
    "status": "PENDING"
  },
  "jobs": [
    {
      "id": "101",
      "name": "application-validation",
      "status": "success"
    },
    {
      "id": "102",
      "name": "semgrep-sast",
      "status": "success"
    },
    {
      "id": "103",
      "name": "secret_detection",
      "status": "success"
    },
    {
      "id": "104",
      "name": "npm-dependency-audit",
      "status": "success"
    },
    {
      "id": "105",
      "name": "qc-assessment",
      "status": "failed"
    }
  ],
  "model_note": {
    "authority": "INTERPRETATION_ONLY",
    "source": {
      "captured_at": "2026-10-13T20:00:00Z",
      "id": "9",
      "input_sha": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
      "kind": "historical-interpretation"
    },
    "text": "Historical interpretation: findings remain visible; human review is required."
  },
  "native_pipeline_status": "failed",
  "owner_risk_disposition": {
    "grants_release": false,
    "status": "NOT_SUPPLIED"
  },
  "provenance_limit": "Byte integrity and packet consistency only; this report does not authenticate the provider or the collecting actor.",
  "provenance_status": "INCOMPLETE_NATIVE_ARTIFACT_PROVENANCE",
  "qc_verdict": "FAILED_WITH_FINDINGS",
  "scan_coverage": "COMPLETE"
}