{
  "advisory": {
    "passed": 15,
    "total": 16
  },
  "change_scope": {
    "availability": "available",
    "metrics": {
      "added_lines": 44,
      "binary_files": 0,
      "changed_lines": 110,
      "excluded_added_lines": 52,
      "excluded_binary_files": 0,
      "excluded_changed_lines": 53,
      "excluded_files": 3,
      "files": 2,
      "max_added_lines_per_file": 39,
      "total_added_lines": 96,
      "total_changed_lines": 163,
      "total_files": 5
    },
    "mode": "advisory",
    "status": "passed",
    "thresholds": {
      "max_added_lines": 300,
      "max_added_lines_per_file": 150,
      "max_changed_lines": 500,
      "max_files": 12
    }
  },
  "controls": [
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-05T03:12:44Z",
        "conclusion": "success",
        "duration_seconds": 7,
        "started_at": "2026-10-05T03:12:37Z"
      },
      "group": "Build & quality",
      "id": "repository-validation",
      "measurements": {
        "availability": "available",
        "contracts": {
          "failed": 0,
          "not_run": 0,
          "passed": 4,
          "total": 4
        },
        "source": "pull-request-workflow"
      },
      "mode": "advisory",
      "name": "Repository Validation",
      "purpose": "Validate repository-owned contracts and configuration",
      "separate_subject": null,
      "status": "passed"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-05T03:12:45Z",
        "conclusion": "success",
        "duration_seconds": 7,
        "started_at": "2026-10-05T03:12:38Z"
      },
      "group": "Build & quality",
      "id": "documentation-validation",
      "measurements": {
        "availability": "available",
        "documentation": {
          "broken_links": 0,
          "links_checked": 232,
          "mapping_failures": 0,
          "markdown_files": 171
        },
        "source": "pull-request-workflow"
      },
      "mode": "advisory",
      "name": "Documentation Validation",
      "purpose": "Validate documentation structure, links, and declared targets",
      "separate_subject": null,
      "status": "passed"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-05T03:12:42Z",
        "conclusion": "success",
        "duration_seconds": 5,
        "started_at": "2026-10-05T03:12:37Z"
      },
      "group": "Build & quality",
      "id": "repository-ground-truth",
      "measurements": {
        "availability": "available",
        "documents": {
          "declared": 6,
          "found": 6,
          "missing": 0
        },
        "source": "pull-request-workflow"
      },
      "mode": "advisory",
      "name": "Repository Ground Truth",
      "purpose": "Validate declared repository architecture and engineering documents",
      "separate_subject": null,
      "status": "passed"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-05T03:12:43Z",
        "conclusion": "success",
        "duration_seconds": 0,
        "started_at": "2026-10-05T03:12:43Z"
      },
      "group": "Build & quality",
      "id": "change-scope",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "PR Size",
      "purpose": "Detect oversized or unexpectedly broad changes",
      "separate_subject": null,
      "status": "passed"
    },
    {
      "detail": {
        "availability": "available",
        "missing_sections": 0,
        "required_sections": 1,
        "title_matches": true
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "Build & quality",
      "id": "pr-metadata",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "PR Metadata",
      "purpose": "Validate pull-request title and body requirements against mutable PR state",
      "separate_subject": null,
      "status": "passed"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-05T03:12:49Z",
        "conclusion": "success",
        "duration_seconds": 11,
        "started_at": "2026-10-05T03:12:38Z"
      },
      "group": "Build & quality",
      "id": "format-and-lint",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "Format and Lint",
      "purpose": "Verify repository formatting and lint rules with the repository-owned command",
      "separate_subject": null,
      "status": "passed"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-05T03:12:51Z",
        "conclusion": "success",
        "duration_seconds": 13,
        "started_at": "2026-10-05T03:12:38Z"
      },
      "group": "Build & quality",
      "id": "migration-validation",
      "measurements": {
        "availability": "available",
        "migrations": {
          "checked": 0,
          "failed": 0
        },
        "source": "pull-request-workflow"
      },
      "mode": "advisory",
      "name": "Migration Validation",
      "purpose": "Validate repository-specific database and data migration safety",
      "separate_subject": null,
      "status": "passed"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-05T03:12:47Z",
        "conclusion": "success",
        "duration_seconds": 9,
        "started_at": "2026-10-05T03:12:38Z"
      },
      "group": "Build & quality",
      "id": "build",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "Build",
      "purpose": "Detect compilation, packaging, and build-time regressions",
      "separate_subject": null,
      "status": "passed"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-05T03:23:45Z",
        "conclusion": "success",
        "duration_seconds": 667,
        "started_at": "2026-10-05T03:12:38Z"
      },
      "group": "Build & quality",
      "id": "unit-tests",
      "measurements": {
        "availability": "available",
        "source": "pull-request-workflow",
        "tests": {
          "failed": 0,
          "passed": 805,
          "skipped": 0,
          "total": 805
        }
      },
      "mode": "advisory",
      "name": "Unit Tests",
      "purpose": "Detect functional regressions in changed behavior",
      "separate_subject": null,
      "status": "passed"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "AI & QA",
      "id": "functional-qa",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Functional QA",
      "purpose": "Exercise the running application as a user to detect functional regressions in changed behavior",
      "separate_subject": null,
      "status": "not_activated"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-05T03:25:06Z",
        "conclusion": "success",
        "duration_seconds": 749,
        "started_at": "2026-10-05T03:12:37Z"
      },
      "group": "Build & quality",
      "id": "changed-code-coverage",
      "measurements": {
        "availability": "available",
        "coverage": {
          "covered_lines": 0,
          "measured_lines": 0,
          "threshold_percent": 90
        },
        "source": "pull-request-workflow"
      },
      "mode": "advisory",
      "name": "Changed Code Coverage",
      "purpose": "Measure test coverage for changed code",
      "separate_subject": null,
      "status": "passed"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-05T03:19:03Z",
        "conclusion": "success",
        "duration_seconds": 385,
        "started_at": "2026-10-05T03:12:38Z"
      },
      "group": "Build & quality",
      "id": "custom-static-analysis",
      "measurements": {
        "availability": "available",
        "findings": {
          "critical": 0,
          "high": 0,
          "low": 0,
          "medium": 0,
          "total": 0,
          "unrated": 0
        },
        "source": "pull-request-workflow"
      },
      "mode": "advisory",
      "name": "Custom Static Analysis",
      "purpose": "Run repository and organization-specific static rules",
      "separate_subject": null,
      "status": "passed"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-05T03:12:46Z",
        "conclusion": "success",
        "duration_seconds": 9,
        "started_at": "2026-10-05T03:12:37Z"
      },
      "group": "Security & dependencies",
      "id": "secret-detection",
      "measurements": {
        "availability": "available",
        "findings": {
          "critical": 0,
          "high": 0,
          "low": 0,
          "medium": 0,
          "total": 0,
          "unrated": 0
        },
        "source": "pull-request-workflow"
      },
      "mode": "advisory",
      "name": "Secret Detection",
      "purpose": "Detect credentials and authentication material in source history",
      "separate_subject": null,
      "status": "passed"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-05T03:13:47Z",
        "conclusion": "success",
        "duration_seconds": 69,
        "started_at": "2026-10-05T03:12:38Z"
      },
      "group": "Security & dependencies",
      "id": "deep-sast",
      "measurements": {
        "availability": "available",
        "findings": {
          "critical": 0,
          "high": 6,
          "low": 0,
          "medium": 0,
          "total": 6,
          "unrated": 0
        },
        "source": "pull-request-workflow"
      },
      "mode": "advisory",
      "name": "Deep SAST",
      "purpose": "Detect security vulnerabilities through semantic source analysis",
      "separate_subject": null,
      "status": "passed"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-05T03:12:45Z",
        "conclusion": "success",
        "duration_seconds": 7,
        "started_at": "2026-10-05T03:12:38Z"
      },
      "group": "Security & dependencies",
      "id": "dependency-change-review",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "Dependency Change Review",
      "purpose": "Review security and license risk introduced by dependency changes",
      "separate_subject": null,
      "status": "passed"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "available",
        "completed_at": "2026-10-05T03:12:44Z",
        "conclusion": "success",
        "duration_seconds": 0,
        "started_at": "2026-10-05T03:12:44Z"
      },
      "group": "Security & dependencies",
      "id": "platform-secret-protection",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "Platform Secret Protection",
      "purpose": "Verify platform secret scanning and push protection",
      "separate_subject": null,
      "status": "passed"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "Security & dependencies",
      "id": "dependency-remediation",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Dependency Remediation",
      "purpose": "Verify automated dependency security remediation is configured",
      "separate_subject": null,
      "status": "not_activated"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "Release & runtime",
      "id": "artifact-provenance",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Artifact Provenance",
      "purpose": "Attest where and how a release artifact was built",
      "separate_subject": null,
      "status": "not_activated"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "Build & quality",
      "id": "static-quality",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Static Quality",
      "purpose": "Evaluate maintainability, reliability, and static quality gates",
      "separate_subject": null,
      "status": "not_activated"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "Security & dependencies",
      "id": "dependency-vulnerability",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "advisory",
      "name": "Dependency Vulnerability",
      "purpose": "Detect known vulnerabilities in resolved dependencies",
      "separate_subject": null,
      "status": "no_result"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "Security & dependencies",
      "id": "license-compliance",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "License Compliance",
      "purpose": "Evaluate dependency licenses against repository policy",
      "separate_subject": null,
      "status": "not_activated"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "AI & QA",
      "id": "ai-engineering-review",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "AI Engineering Review",
      "purpose": "Review correctness, architecture, maintainability, and regression risk",
      "separate_subject": null,
      "status": "not_activated"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "AI & QA",
      "id": "ai-qa-review",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "AI QA Review",
      "purpose": "Review tests, edge cases, failure paths, and assertions",
      "separate_subject": null,
      "status": "not_activated"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "AI & QA",
      "id": "ai-security-review",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "AI Security Review",
      "purpose": "Review authentication, isolation, injection, secrets, and privilege risks",
      "separate_subject": null,
      "status": "not_activated"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "AI & QA",
      "id": "ai-repository-standards-review",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "AI Repository Standards Review",
      "purpose": "Review changes against repository-owned engineering ground truth",
      "separate_subject": null,
      "status": "not_activated"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "Release & runtime",
      "id": "runtime-soak",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Runtime Soak",
      "purpose": "Detect runtime degradation, leaks, and performance drift over time",
      "separate_subject": null,
      "status": "not_activated"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "Release & runtime",
      "id": "container-vulnerability",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Container Vulnerability",
      "purpose": "Detect vulnerabilities in container images",
      "separate_subject": null,
      "status": "not_activated"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "Security & dependencies",
      "id": "iac-misconfiguration",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "IaC Misconfiguration",
      "purpose": "Detect insecure infrastructure-as-code configuration",
      "separate_subject": null,
      "status": "not_activated"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "Release & runtime",
      "id": "artifact-sbom",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Artifact SBOM",
      "purpose": "Record the software components contained in an artifact",
      "separate_subject": null,
      "status": "not_activated"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "Release & runtime",
      "id": "artifact-vulnerability",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Artifact Vulnerability",
      "purpose": "Detect vulnerabilities in a built release artifact",
      "separate_subject": null,
      "status": "not_activated"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "Release & runtime",
      "id": "deployment-policy",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Deployment Policy",
      "purpose": "Verify deployment approval and environment policy",
      "separate_subject": null,
      "status": "not_activated"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "Release & runtime",
      "id": "dynamic-application-security",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Dynamic Application Security",
      "purpose": "Detect vulnerabilities in a running application",
      "separate_subject": null,
      "status": "not_activated"
    },
    {
      "detail": {
        "availability": "unavailable"
      },
      "execution": {
        "availability": "unavailable"
      },
      "group": "Release & runtime",
      "id": "runtime-assurance",
      "measurements": {
        "availability": "unavailable"
      },
      "mode": "not_activated",
      "name": "Runtime Assurance",
      "purpose": "Verify runtime security and operational safeguards",
      "separate_subject": null,
      "status": "not_activated"
    }
  ],
  "decision": "allow",
  "enforced": {
    "passed": 0,
    "total": 0
  },
  "label": "Latest PR Scorecard",
  "message": "ORANGE 15/16",
  "operation": "change",
  "pages_url": "https://ravisingh11.github.io/ai-software-toolkit/",
  "passed": 15,
  "published_at": "2026-10-08T06:12:09Z",
  "repository": "ravisingh11/ai-software-toolkit",
  "result_breakdown": {
    "advisory": {
      "blocked": 0,
      "failed": 0,
      "passed": 15,
      "unverified": 1
    },
    "availability": "available",
    "enforced": {
      "blocked": 0,
      "failed": 0,
      "passed": 0,
      "unverified": 0
    },
    "overall": {
      "blocked": 0,
      "failed": 0,
      "passed": 15,
      "unverified": 1
    }
  },
  "source_run_attempt": 1,
  "source_run_created_at": "2026-10-05T03:12:35Z",
  "source_run_id": 37258502858,
  "source_run_url": "https://github.com/ravisingh11/ai-software-toolkit/actions/runs/37258502858/attempts/1",
  "status": "ORANGE",
  "subject_digest": "sha256:8eecd14c9fc2fcd69adf1e69d661e7792a567845cac246adcffe621f97eb2c87",
  "total": 16,
  "version": 1
}