{"project_id":"87476475","commit_sha":"1e386861925fae282682b22113f9a18b798ed2d9","pipeline_id":"2943433979","pipeline_status":"failed","application_validation_status":"success","current_qc_status":"FINDINGS","configured_scan_coverage_complete":true,"sast_finding_count":0,"secret_finding_count":0,"full_audit_record_count":5,"full_audit_high_record_count":5,"distinct_advisory_count":1,"production_audit_record_count":0,"historical_unknowns":["diagnostic_artifact_capture_time","lifecycle_approval_configuration_comparison"],"audit_waiver":false,"overall_validation":"UNVERIFIED","G0":"OPEN / NOT APPROVED","G1":"CLOSED","source_acquisition":"human_read_connector","autonomous_private_access_proven":false,"release_authorized":false,"deployment_authorized":false,"explanation":"This interprets only the embedded saved QC evidence; no live retrieval or new testing was done. Current QC status is FINDINGS and the pipeline status is failed. Configured scan coverage is complete, and SAST and secrets scans succeeded with 0 findings, and application-validation succeeded. However, the full dependency audit command exited 1 and the QC assessment failed. The audit-capture job executed successfully, but that does not turn the audit failure into a pass. The full audit has 5 affected package records, all high severity, which map to 1 distinct advisory (GHSA-vfj7-8cjw-p6xm). The production audit has 0 records. No audit waiver exists, and two historical unknowns remain (diagnostic_artifact_capture_time, lifecycle_approval_configuration_comparison). Complete scan coverage and successful scanner execution do not establish release approval or security, so overall validation stays UNVERIFIED. G0 stays OPEN / NOT APPROVED and G1 stays CLOSED. The evidence was human-transferred, autonomous private access is not proven, and release and deployment are not authorized. This is not a new frozen-verifier v0.4 result; v0.4 is unchanged and was not run on this report."}