{
  "advisory": {
    "passed": 12,
    "total": 16
  },
  "change_scope": {
    "availability": "available",
    "metrics": {
      "added_lines": 1,
      "binary_files": 0,
      "changed_lines": 2,
      "excluded_added_lines": 0,
      "excluded_binary_files": 0,
      "excluded_changed_lines": 0,
      "excluded_files": 0,
      "files": 1,
      "max_added_lines_per_file": 1,
      "total_added_lines": 1,
      "total_changed_lines": 2,
      "total_files": 1
    },
    "mode": "advisory",
    "status": "passed",
    "thresholds": {
      "max_added_lines": 300,
      "max_added_lines_per_file": 150,
      "max_changed_lines": 500,
      "max_files": 12
    }
  },
  "controls": [
    {
      "activation": "reported",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-31T21:49:51Z",
        "conclusion": "success",
        "duration_seconds": 7,
        "started_at": "2026-10-31T21:49:44Z"
      },
      "group": "Build & quality",
      "id": "repository-validation",
      "measurements": {
        "availability": "available",
        "contracts": {
          "failed": 0,
          "not_run": 0,
          "passed": 4,
          "total": 4
        },
        "source": "pull-request-workflow"
      },
      "mode": "advisory",
      "name": "Repository Validation",
      "provider": "Repository Validators",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328701/job/124667450816",
      "purpose": "Validate repository-owned contracts and configuration",
      "relevant_stage": "Pull-request development",
      "selection_group": "selected",
      "separate_subject": null,
      "status": "passed",
      "verification_scope": null
    },
    {
      "activation": "reported",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-31T21:49:33Z",
        "conclusion": "success",
        "duration_seconds": 8,
        "started_at": "2026-10-31T21:49:25Z"
      },
      "group": "Build & quality",
      "id": "documentation-validation",
      "measurements": {
        "availability": "available",
        "documentation": {
          "broken_links": 0,
          "links_checked": 136,
          "mapping_failures": 0,
          "markdown_files": 56
        },
        "source": "pull-request-workflow"
      },
      "mode": "advisory",
      "name": "Documentation Validation",
      "provider": "Repository Validators",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328701/job/124667450752",
      "purpose": "Validate documentation structure, links, and declared targets",
      "relevant_stage": "Pull-request development",
      "selection_group": "selected",
      "separate_subject": null,
      "status": "passed",
      "verification_scope": null
    },
    {
      "activation": "reported",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-31T21:49:46Z",
        "conclusion": "success",
        "duration_seconds": 12,
        "started_at": "2026-10-31T21:49:34Z"
      },
      "group": "Build & quality",
      "id": "repository-ground-truth",
      "measurements": {
        "availability": "available",
        "documents": {
          "declared": 1,
          "found": 1,
          "missing": 0
        },
        "source": "pull-request-workflow"
      },
      "mode": "advisory",
      "name": "Repository Ground Truth",
      "provider": "Repository Validators",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328701/job/124667450742",
      "purpose": "Validate declared repository architecture and engineering documents",
      "relevant_stage": "Pull-request development",
      "selection_group": "selected",
      "separate_subject": null,
      "status": "passed",
      "verification_scope": null
    },
    {
      "activation": "reported",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-31T21:49:20Z",
        "conclusion": "success",
        "duration_seconds": 0,
        "started_at": "2026-10-31T21:49:20Z"
      },
      "group": "Build & quality",
      "id": "change-scope",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "PR Size",
      "provider": "PR Size / Files & LOC",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/runs/124667541822",
      "purpose": "Detect oversized or unexpectedly broad changes",
      "relevant_stage": "Pull-request development",
      "selection_group": "selected",
      "separate_subject": null,
      "status": "passed",
      "verification_scope": null
    },
    {
      "activation": "reported",
      "detail": {
        "availability": "available",
        "missing_sections": 0,
        "required_sections": 0,
        "title_matches": true
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "unavailable"
      },
      "group": "Build & quality",
      "id": "pr-metadata",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "PR Metadata",
      "provider": "Repository PR Metadata",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328105/attempts/1",
      "purpose": "Validate pull-request title and body requirements against mutable PR state",
      "relevant_stage": "Pull-request development",
      "selection_group": "selected",
      "separate_subject": null,
      "status": "passed",
      "verification_scope": null
    },
    {
      "activation": "reported",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-31T21:49:58Z",
        "conclusion": "success",
        "duration_seconds": 40,
        "started_at": "2026-10-31T21:49:18Z"
      },
      "group": "Build & quality",
      "id": "format-and-lint",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "Format and Lint",
      "provider": "Repository Format and Lint Command",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328697/job/124667450515",
      "purpose": "Verify repository formatting and lint rules with the repository-owned command",
      "relevant_stage": "Pull-request development",
      "selection_group": "selected",
      "separate_subject": null,
      "status": "passed",
      "verification_scope": null
    },
    {
      "activation": "reported",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-31T21:50:12Z",
        "conclusion": "success",
        "duration_seconds": 48,
        "started_at": "2026-10-31T21:49:24Z"
      },
      "group": "Build & quality",
      "id": "migration-validation",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "Migration Validation",
      "provider": "Repository Migration Validation Command",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328599/job/124667450442",
      "purpose": "Validate repository-specific database and data migration safety",
      "relevant_stage": "Pull-request development",
      "selection_group": "selected",
      "separate_subject": null,
      "status": "passed",
      "verification_scope": null
    },
    {
      "activation": "reported",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-31T21:50:04Z",
        "conclusion": "success",
        "duration_seconds": 41,
        "started_at": "2026-10-31T21:49:23Z"
      },
      "group": "Build & quality",
      "id": "build",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "Build",
      "provider": "Repository Build Command",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328705/job/124667450625",
      "purpose": "Detect compilation, packaging, and build-time regressions",
      "relevant_stage": "Pull-request development",
      "selection_group": "selected",
      "separate_subject": null,
      "status": "passed",
      "verification_scope": null
    },
    {
      "activation": "reported",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-31T21:49:31Z",
        "conclusion": "success",
        "duration_seconds": 29,
        "started_at": "2026-10-31T21:49:02Z"
      },
      "group": "Build & quality",
      "id": "unit-tests",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "Unit Tests",
      "provider": "Repository Unit Test Command",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328703/job/124667450455",
      "purpose": "Detect functional regressions in changed behavior",
      "relevant_stage": "Pull-request development",
      "selection_group": "selected",
      "separate_subject": null,
      "status": "passed",
      "verification_scope": null
    },
    {
      "activation": "not_activated",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "unavailable"
      },
      "group": "AI & QA",
      "id": "functional-qa",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Functional QA",
      "provider": "QA Bootstrap Workflow",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Exercise the running application as a user to detect functional regressions in changed behavior",
      "relevant_stage": "Pull-request development",
      "selection_group": "available-to-adopt",
      "separate_subject": null,
      "status": "not_activated",
      "verification_scope": null
    },
    {
      "activation": "unverified",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "unavailable"
      },
      "group": "Build & quality",
      "id": "changed-code-coverage",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "Changed Code Coverage",
      "provider": "Repository Changed Code Coverage Command",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328638/job/124667487401",
      "purpose": "Measure test coverage for changed code",
      "relevant_stage": "Pull-request development",
      "selection_group": "selected",
      "separate_subject": null,
      "status": "no_result",
      "verification_scope": null
    },
    {
      "activation": "reported",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-31T21:56:35Z",
        "conclusion": "success",
        "duration_seconds": 373,
        "started_at": "2026-10-31T21:50:22Z"
      },
      "group": "Build & quality",
      "id": "custom-static-analysis",
      "measurements": {
        "availability": "available",
        "findings": {
          "critical": 0,
          "high": 0,
          "low": 0,
          "medium": 0,
          "total": 0,
          "unrated": 0
        },
        "source": "pull-request-workflow"
      },
      "mode": "advisory",
      "name": "Custom Static Analysis",
      "provider": "Semgrep Community Edition",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328622/job/124667768200",
      "purpose": "Run repository and organization-specific static rules",
      "relevant_stage": "Pull-request development",
      "selection_group": "selected",
      "separate_subject": null,
      "status": "passed",
      "verification_scope": null
    },
    {
      "activation": "reported",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-31T21:49:14Z",
        "conclusion": "success",
        "duration_seconds": 13,
        "started_at": "2026-10-31T21:49:01Z"
      },
      "group": "Security & dependencies",
      "id": "secret-detection",
      "measurements": {
        "availability": "available",
        "findings": {
          "critical": 0,
          "high": 0,
          "low": 0,
          "medium": 0,
          "total": 0,
          "unrated": 0
        },
        "source": "pull-request-workflow"
      },
      "mode": "advisory",
      "name": "Secret Detection",
      "provider": "Gitleaks CLI",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328692/job/124667450429",
      "purpose": "Detect credentials and authentication material in source history",
      "relevant_stage": "Pull-request development",
      "selection_group": "selected",
      "separate_subject": null,
      "status": "passed",
      "verification_scope": null
    },
    {
      "activation": "unverified",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "unavailable"
      },
      "group": "Security & dependencies",
      "id": "deep-sast",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "Deep SAST",
      "provider": "GitHub CodeQL default setup",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Detect security vulnerabilities through semantic source analysis",
      "relevant_stage": "Pull-request development",
      "selection_group": "selected",
      "separate_subject": null,
      "status": "no_result",
      "verification_scope": null
    },
    {
      "activation": "reported",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-31T21:49:21Z",
        "conclusion": "success",
        "duration_seconds": 5,
        "started_at": "2026-10-31T21:49:16Z"
      },
      "group": "Security & dependencies",
      "id": "dependency-change-review",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "Dependency Change Review",
      "provider": "GitHub Dependency Review",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328647/job/124667450152",
      "purpose": "Review security and license risk introduced by dependency changes",
      "relevant_stage": "Pull-request development",
      "selection_group": "selected",
      "separate_subject": null,
      "status": "passed",
      "verification_scope": null
    },
    {
      "activation": "unverified",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "unavailable"
      },
      "group": "Security & dependencies",
      "id": "platform-secret-protection",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "Platform Secret Protection",
      "provider": "GitHub Secret Protection",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/runs/124667462068",
      "purpose": "Verify platform secret scanning and push protection",
      "relevant_stage": "Pull-request development",
      "selection_group": "selected",
      "separate_subject": null,
      "status": "no_result",
      "verification_scope": null
    },
    {
      "activation": "unverified",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "unavailable"
      },
      "group": "Security & dependencies",
      "id": "dependency-remediation",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "Dependency Remediation",
      "provider": "GitHub Dependabot",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/runs/124667545639",
      "purpose": "Verify automated dependency security remediation is configured",
      "relevant_stage": "Pull-request development",
      "selection_group": "selected",
      "separate_subject": null,
      "status": "no_result",
      "verification_scope": null
    },
    {
      "activation": "not_activated",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "manual-lifecycle",
      "execution": {
        "availability": "unavailable"
      },
      "group": "Release & runtime",
      "id": "artifact-provenance",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Artifact Provenance",
      "provider": "GitHub Artifact Attestations",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Attest where and how a release artifact was built",
      "relevant_stage": "Release",
      "selection_group": "relevant-later",
      "separate_subject": null,
      "status": "not_activated",
      "verification_scope": null
    },
    {
      "activation": "not_activated",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "unavailable"
      },
      "group": "Build & quality",
      "id": "static-quality",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Static Quality",
      "provider": "SonarQube",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Evaluate maintainability, reliability, and static quality gates",
      "relevant_stage": "Pull-request development",
      "selection_group": "available-to-adopt",
      "separate_subject": null,
      "status": "not_activated",
      "verification_scope": null
    },
    {
      "activation": "not_activated",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "unavailable"
      },
      "group": "Security & dependencies",
      "id": "dependency-vulnerability",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Dependency Vulnerability",
      "provider": "Snyk Open Source",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Detect known vulnerabilities in resolved dependencies",
      "relevant_stage": "Pull-request development",
      "selection_group": "available-to-adopt",
      "separate_subject": null,
      "status": "not_activated",
      "verification_scope": null
    },
    {
      "activation": "not_activated",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "unavailable"
      },
      "group": "Security & dependencies",
      "id": "license-compliance",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "License Compliance",
      "provider": "FOSSA",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Evaluate dependency licenses against repository policy",
      "relevant_stage": "Pull-request development",
      "selection_group": "available-to-adopt",
      "separate_subject": null,
      "status": "not_activated",
      "verification_scope": null
    },
    {
      "activation": "not_activated",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "unavailable"
      },
      "group": "AI & QA",
      "id": "ai-engineering-review",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "AI Engineering Review",
      "provider": "Codex Code Review",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Review correctness, architecture, maintainability, and regression risk",
      "relevant_stage": "Pull-request development",
      "selection_group": "available-to-adopt",
      "separate_subject": null,
      "status": "not_activated",
      "verification_scope": null
    },
    {
      "activation": "not_activated",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "unavailable"
      },
      "group": "AI & QA",
      "id": "ai-qa-review",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "AI QA Review",
      "provider": "AI QA Review Adapter",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Review tests, edge cases, failure paths, and assertions",
      "relevant_stage": "Pull-request development",
      "selection_group": "available-to-adopt",
      "separate_subject": null,
      "status": "not_activated",
      "verification_scope": null
    },
    {
      "activation": "not_activated",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "unavailable"
      },
      "group": "AI & QA",
      "id": "ai-security-review",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "AI Security Review",
      "provider": "AI Security Review Adapter",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Review authentication, isolation, injection, secrets, and privilege risks",
      "relevant_stage": "Pull-request development",
      "selection_group": "available-to-adopt",
      "separate_subject": null,
      "status": "not_activated",
      "verification_scope": null
    },
    {
      "activation": "not_activated",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "pull-request",
      "execution": {
        "availability": "unavailable"
      },
      "group": "AI & QA",
      "id": "ai-repository-standards-review",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "AI Repository Standards Review",
      "provider": "AI Repository Standards Review Adapter",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Review changes against repository-owned engineering ground truth",
      "relevant_stage": "Pull-request development",
      "selection_group": "available-to-adopt",
      "separate_subject": null,
      "status": "not_activated",
      "verification_scope": null
    },
    {
      "activation": "not_activated",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "manual-lifecycle",
      "execution": {
        "availability": "unavailable"
      },
      "group": "Release & runtime",
      "id": "runtime-soak",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Runtime Soak",
      "provider": "Repository Soak Command",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Detect runtime degradation, leaks, and performance drift over time",
      "relevant_stage": "Pre-release",
      "selection_group": "relevant-later",
      "separate_subject": null,
      "status": "not_activated",
      "verification_scope": null
    },
    {
      "activation": "not_activated",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "manual-lifecycle",
      "execution": {
        "availability": "unavailable"
      },
      "group": "Release & runtime",
      "id": "container-vulnerability",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Container Vulnerability",
      "provider": "Trivy Container Image",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Detect vulnerabilities in container images",
      "relevant_stage": "Release",
      "selection_group": "relevant-later",
      "separate_subject": null,
      "status": "not_activated",
      "verification_scope": null
    },
    {
      "activation": "not_activated",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "manual-lifecycle",
      "execution": {
        "availability": "unavailable"
      },
      "group": "Security & dependencies",
      "id": "iac-misconfiguration",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "IaC Misconfiguration",
      "provider": "Trivy IaC Configuration",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Detect insecure infrastructure-as-code configuration",
      "relevant_stage": "Pull-request development",
      "selection_group": "available-to-adopt",
      "separate_subject": null,
      "status": "not_activated",
      "verification_scope": null
    },
    {
      "activation": "not_activated",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "manual-lifecycle",
      "execution": {
        "availability": "unavailable"
      },
      "group": "Release & runtime",
      "id": "artifact-sbom",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Artifact SBOM",
      "provider": "Trivy Artifact SBOM",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Record the software components contained in an artifact",
      "relevant_stage": "Release",
      "selection_group": "relevant-later",
      "separate_subject": null,
      "status": "not_activated",
      "verification_scope": null
    },
    {
      "activation": "not_activated",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "manual-lifecycle",
      "execution": {
        "availability": "unavailable"
      },
      "group": "Release & runtime",
      "id": "artifact-vulnerability",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Artifact Vulnerability",
      "provider": "Trivy Artifact Vulnerabilities",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Detect vulnerabilities in a built release artifact",
      "relevant_stage": "Release",
      "selection_group": "relevant-later",
      "separate_subject": null,
      "status": "not_activated",
      "verification_scope": null
    },
    {
      "activation": "not_activated",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "manual-lifecycle",
      "execution": {
        "availability": "unavailable"
      },
      "group": "Release & runtime",
      "id": "deployment-policy",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Deployment Policy",
      "provider": "Verification Deployment Policy",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Verify deployment approval and environment policy",
      "relevant_stage": "Deployment",
      "selection_group": "relevant-later",
      "separate_subject": null,
      "status": "not_activated",
      "verification_scope": null
    },
    {
      "activation": "not_activated",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "manual-lifecycle",
      "execution": {
        "availability": "unavailable"
      },
      "group": "Release & runtime",
      "id": "dynamic-application-security",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Dynamic Application Security",
      "provider": "OWASP ZAP Local Baseline",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Detect vulnerabilities in a running application",
      "relevant_stage": "Post-deployment",
      "selection_group": "relevant-later",
      "separate_subject": null,
      "status": "not_activated",
      "verification_scope": null
    },
    {
      "activation": "not_activated",
      "detail": {
        "availability": "unavailable"
      },
      "diagnostic": null,
      "evaluation_scope": "manual-lifecycle",
      "execution": {
        "availability": "unavailable"
      },
      "group": "Release & runtime",
      "id": "runtime-assurance",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Runtime Assurance",
      "provider": "Verification Runtime Assurance",
      "provider_config_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml",
      "provider_run_url": null,
      "purpose": "Verify runtime security and operational safeguards",
      "relevant_stage": "Runtime",
      "selection_group": "relevant-later",
      "separate_subject": null,
      "status": "not_activated",
      "verification_scope": null
    }
  ],
  "decision": "allow",
  "enforced": {
    "passed": 0,
    "total": 0
  },
  "evaluation_stage": "pull-request-development",
  "label": "Latest PR Scorecard",
  "message": "ORANGE 12/16",
  "operation": "change",
  "pages_url": "https://ravisingh11.github.io/ai-software-toolkit-reference-app/",
  "passed": 12,
  "published_at": "2026-11-01T05:59:26Z",
  "repository": "ravisingh11/ai-software-toolkit-reference-app",
  "result_breakdown": {
    "advisory": {
      "blocked": 0,
      "failed": 0,
      "passed": 12,
      "unverified": 4
    },
    "availability": "available",
    "enforced": {
      "blocked": 0,
      "failed": 0,
      "passed": 0,
      "unverified": 0
    },
    "inactive": 17,
    "overall": {
      "blocked": 0,
      "failed": 0,
      "passed": 12,
      "unverified": 4
    }
  },
  "selection_counts": {
    "available-to-adopt": 9,
    "evaluation-context": 0,
    "relevant-later": 8,
    "selected": 16,
    "unknown": 0
  },
  "snapshot_identity": {
    "base_revision": "6126f500b4b3c724961a70de3379dcdade47f3a9",
    "evaluated_revision": "55f159118b0881c01ceb38e8a738ff70b9a45de6",
    "publisher_revision": "6126f500b4b3c724961a70de3379dcdade47f3a9",
    "pull_request_number": 71,
    "runtime_revision": "6126f500b4b3c724961a70de3379dcdade47f3a9"
  },
  "source_run_attempt": 1,
  "source_run_created_at": "2026-10-31T21:48:55Z",
  "source_run_id": 41245328105,
  "source_run_url": "https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328105/attempts/1",
  "status": "ORANGE",
  "subject_digest": "sha256:3616c1568eb99e2a569798d4679d34bd3d3e4d4620f6b5ded9a8816b76ca803a",
  "total": 16,
  "version": 1
}