{
  "id": "CG-CONTRACTS-0.1.0-TEST-VECTORS",
  "version": "0.1.0",
  "canonicalization": "UTF-8 JSON with object keys sorted lexicographically, arrays preserved, and no insignificant whitespace",
  "digestAlgorithm": "SHA-256",
  "vectors": [
    {
      "id": "CGVEC-ABOM-001",
      "description": "Privacy-safe AI Bill of Materials with no source, secret values, repository name, customer identity, or absolute paths",
      "artifact": {
        "claimBoundary": "This A-BOM inventories privacy-safe observed and unknown surfaces. It does not prove runtime enforcement, exploitation, or complete security.",
        "documentType": "ai_bill_of_materials",
        "generatedAt": "2026-07-16T00:00:00.000Z",
        "generator": {
          "name": "CapitalGuard",
          "version": "1.3.0"
        },
        "material": {
          "agents": [
            {
              "capabilities": [],
              "detected": true,
              "evidenceRefs": [
                "CGE-CONFIG-CODEX"
              ],
              "id": "agent.codex",
              "kind": "agent",
              "name": "Codex",
              "trust": "unknown",
              "version": "unknown"
            }
          ],
          "connectors": [],
          "evidence": [
            {
              "confidence": "high",
              "contentIncluded": false,
              "id": "CGE-CONFIG-CODEX",
              "observed": true,
              "source": "configuration_presence"
            },
            {
              "confidence": "high",
              "contentIncluded": false,
              "id": "CGE-SURFACE-CREDENTIAL",
              "observed": true,
              "source": "aggregate_path_metadata"
            },
            {
              "confidence": "high",
              "contentIncluded": false,
              "id": "CGE-SURFACE-INSTRUCTION",
              "observed": true,
              "source": "aggregate_path_metadata"
            },
            {
              "confidence": "high",
              "contentIncluded": false,
              "id": "CGE-SURFACE-WORKFLOW",
              "observed": true,
              "source": "workflow"
            }
          ],
          "instructionSources": [
            {
              "category": "untrusted_repository_instruction",
              "evidenceRefs": [
                "CGE-SURFACE-INSTRUCTION"
              ],
              "id": "surface.instructions",
              "observedCount": 2,
              "sensitiveValuesIncluded": false
            }
          ],
          "mcpServers": [],
          "permissions": [],
          "policies": [
            {
              "evidenceRefs": [],
              "id": "policy.capitalguard-standard",
              "mode": "installed",
              "name": "CapitalGuard Standard",
              "version": "1.0.0"
            }
          ],
          "privacy": {
            "absolutePathsIncluded": false,
            "aggregateOnly": true,
            "customerIdentityIncluded": false,
            "mode": "shareable",
            "repositoryNameIncluded": false,
            "secretValuesIncluded": false,
            "sourceContentsIncluded": false
          },
          "schemaVersion": "cg-abom-material-0.1.0",
          "secretCategories": [
            {
              "category": "credential_material",
              "evidenceRefs": [
                "CGE-SURFACE-CREDENTIAL"
              ],
              "id": "secret.credential_material",
              "observedCount": 1,
              "sensitiveValuesIncluded": false
            }
          ],
          "tools": [
            {
              "capabilities": [],
              "detected": true,
              "evidenceRefs": [
                "CGE-CONFIG-CODEX"
              ],
              "id": "tool.codex",
              "kind": "tool",
              "name": "Codex",
              "trust": "unknown",
              "version": "unknown"
            }
          ],
          "workflows": [
            {
              "category": "delivery_infrastructure",
              "evidenceRefs": [
                "CGE-SURFACE-WORKFLOW"
              ],
              "id": "workflow.delivery_infrastructure",
              "observedCount": 1,
              "sensitiveValuesIncluded": false
            }
          ]
        },
        "schemaVersion": "cg-abom-0.1.0",
        "semanticDigestAlgorithm": "sha256",
        "semanticDigestSha256": "35782b6be5b3b90cb4b3594b7c0c58d1858a91470b9c6caffc03c356f8c1e9f2",
        "subject": {
          "identity": "private",
          "kind": "repository"
        }
      },
      "expectedSemanticDigestSha256": "35782b6be5b3b90cb4b3594b7c0c58d1858a91470b9c6caffc03c356f8c1e9f2"
    },
    {
      "id": "CGVEC-EVENT-CHAIN-001",
      "description": "Three-event tamper-evident scan, inventory, and completed Guardprint chain",
      "artifact": {
        "batchDigestAlgorithm": "sha256",
        "batchDigestSha256": "747663cf4a04f7f32a9543b744cc47aa61af1a3705adabc70b7c0461153bc1fa",
        "claimBoundary": "These events contain privacy-safe evidence metadata. They do not prove unsupported runtime enforcement, exploitation, or complete security.",
        "events": [
          {
            "eventId": "CG-EVT-TEST-VECTOR-0001",
            "evidenceRefs": [],
            "occurredAt": "2026-07-16T00:00:00.000Z",
            "outcome": {
              "artifactDigestSha256": null,
              "controlId": null,
              "criticalCount": 0,
              "findingCount": 0,
              "highCount": 0,
              "mediumCount": 0,
              "observedCount": 0,
              "status": "started"
            },
            "previousEventHashSha256": null,
            "privacy": {
              "absolutePathsIncluded": false,
              "customerIdentityIncluded": false,
              "repositoryNameIncluded": false,
              "secretValuesIncluded": false,
              "sourceContentsIncluded": false
            },
            "schemaVersion": "cg-security-event-0.1.0",
            "sequence": 1,
            "source": {
              "component": "local_scanner",
              "version": "1.3.0"
            },
            "type": "scan.started",
            "eventHashSha256": "83e19d98cb771236d886f3067516f6338f0f428aa62cf71f01930fb42e0c356a"
          },
          {
            "eventId": "CG-EVT-TEST-VECTOR-0002",
            "evidenceRefs": [
              "CGE-CONFIG-CODEX",
              "CGE-SURFACE-CREDENTIAL",
              "CGE-SURFACE-INSTRUCTION",
              "CGE-SURFACE-WORKFLOW"
            ],
            "occurredAt": "2026-07-16T00:00:00.000Z",
            "outcome": {
              "artifactDigestSha256": "35782b6be5b3b90cb4b3594b7c0c58d1858a91470b9c6caffc03c356f8c1e9f2",
              "controlId": null,
              "criticalCount": 0,
              "findingCount": 0,
              "highCount": 0,
              "mediumCount": 0,
              "observedCount": 4,
              "status": "completed"
            },
            "previousEventHashSha256": "83e19d98cb771236d886f3067516f6338f0f428aa62cf71f01930fb42e0c356a",
            "privacy": {
              "absolutePathsIncluded": false,
              "customerIdentityIncluded": false,
              "repositoryNameIncluded": false,
              "secretValuesIncluded": false,
              "sourceContentsIncluded": false
            },
            "schemaVersion": "cg-security-event-0.1.0",
            "sequence": 2,
            "source": {
              "component": "local_scanner",
              "version": "1.3.0"
            },
            "type": "inventory.completed",
            "eventHashSha256": "e73bee1f85307c29d0b3dc052d605d58e2ad5e88acf45f93fcfbfae4ca50b0c8"
          },
          {
            "eventId": "CG-EVT-TEST-VECTOR-0003",
            "evidenceRefs": [],
            "occurredAt": "2026-07-16T00:00:00.000Z",
            "outcome": {
              "artifactDigestSha256": "3760cdf9552aafd900f35cb4857291947176701987ce8a8a5798b06584904085",
              "controlId": null,
              "criticalCount": 1,
              "findingCount": 5,
              "highCount": 2,
              "mediumCount": 1,
              "observedCount": 5,
              "status": "completed"
            },
            "previousEventHashSha256": "e73bee1f85307c29d0b3dc052d605d58e2ad5e88acf45f93fcfbfae4ca50b0c8",
            "privacy": {
              "absolutePathsIncluded": false,
              "customerIdentityIncluded": false,
              "repositoryNameIncluded": false,
              "secretValuesIncluded": false,
              "sourceContentsIncluded": false
            },
            "schemaVersion": "cg-security-event-0.1.0",
            "sequence": 3,
            "source": {
              "component": "local_scanner",
              "version": "1.3.0"
            },
            "type": "scan.completed",
            "eventHashSha256": "a5f87bbd3128cab19ae39b1e4ec46f637e496fb51b99c2fc712b67cb5e93395f"
          }
        ],
        "generatedAt": "2026-07-16T00:00:00.000Z",
        "schemaVersion": "cg-security-event-batch-0.1.0"
      },
      "expectedBatchDigestSha256": "747663cf4a04f7f32a9543b744cc47aa61af1a3705adabc70b7c0461153bc1fa",
      "expectedFinalEventHashSha256": "a5f87bbd3128cab19ae39b1e4ec46f637e496fb51b99c2fc712b67cb5e93395f"
    },
    {
      "id": "CGVEC-EVIDENCE-BUNDLE-001",
      "description": "Cross-linked AccessGraph, A-BOM, and security-event evidence from one scan timestamp",
      "artifact": {
        "bundleDigestAlgorithm": "sha256",
        "bundleDigestSha256": "732e449bd7ab337b30cf9a8bd36da7faccc7f865f791ddfc10aed1a7f61ea83b",
        "claimBoundary": "This bundle binds privacy-safe evidence artifacts. It does not prove runtime enforcement, exploitation, complete remediation, or complete security.",
        "material": {
          "abom": {
            "claimBoundary": "This A-BOM inventories privacy-safe observed and unknown surfaces. It does not prove runtime enforcement, exploitation, or complete security.",
            "documentType": "ai_bill_of_materials",
            "generatedAt": "2026-07-16T00:00:00.000Z",
            "generator": {
              "name": "CapitalGuard",
              "version": "1.3.0"
            },
            "material": {
              "agents": [
                {
                  "capabilities": [],
                  "detected": true,
                  "evidenceRefs": [
                    "CGE-CONFIG-CODEX"
                  ],
                  "id": "agent.codex",
                  "kind": "agent",
                  "name": "Codex",
                  "trust": "unknown",
                  "version": "unknown"
                }
              ],
              "connectors": [],
              "evidence": [
                {
                  "confidence": "high",
                  "contentIncluded": false,
                  "id": "CGE-CONFIG-CODEX",
                  "observed": true,
                  "source": "configuration_presence"
                },
                {
                  "confidence": "high",
                  "contentIncluded": false,
                  "id": "CGE-SURFACE-CREDENTIAL",
                  "observed": true,
                  "source": "aggregate_path_metadata"
                },
                {
                  "confidence": "high",
                  "contentIncluded": false,
                  "id": "CGE-SURFACE-INSTRUCTION",
                  "observed": true,
                  "source": "aggregate_path_metadata"
                },
                {
                  "confidence": "high",
                  "contentIncluded": false,
                  "id": "CGE-SURFACE-WORKFLOW",
                  "observed": true,
                  "source": "workflow"
                }
              ],
              "instructionSources": [
                {
                  "category": "untrusted_repository_instruction",
                  "evidenceRefs": [
                    "CGE-SURFACE-INSTRUCTION"
                  ],
                  "id": "surface.instructions",
                  "observedCount": 2,
                  "sensitiveValuesIncluded": false
                }
              ],
              "mcpServers": [],
              "permissions": [],
              "policies": [
                {
                  "evidenceRefs": [],
                  "id": "policy.capitalguard-standard",
                  "mode": "installed",
                  "name": "CapitalGuard Standard",
                  "version": "1.0.0"
                }
              ],
              "privacy": {
                "absolutePathsIncluded": false,
                "aggregateOnly": true,
                "customerIdentityIncluded": false,
                "mode": "shareable",
                "repositoryNameIncluded": false,
                "secretValuesIncluded": false,
                "sourceContentsIncluded": false
              },
              "schemaVersion": "cg-abom-material-0.1.0",
              "secretCategories": [
                {
                  "category": "credential_material",
                  "evidenceRefs": [
                    "CGE-SURFACE-CREDENTIAL"
                  ],
                  "id": "secret.credential_material",
                  "observedCount": 1,
                  "sensitiveValuesIncluded": false
                }
              ],
              "tools": [
                {
                  "capabilities": [],
                  "detected": true,
                  "evidenceRefs": [
                    "CGE-CONFIG-CODEX"
                  ],
                  "id": "tool.codex",
                  "kind": "tool",
                  "name": "Codex",
                  "trust": "unknown",
                  "version": "unknown"
                }
              ],
              "workflows": [
                {
                  "category": "delivery_infrastructure",
                  "evidenceRefs": [
                    "CGE-SURFACE-WORKFLOW"
                  ],
                  "id": "workflow.delivery_infrastructure",
                  "observedCount": 1,
                  "sensitiveValuesIncluded": false
                }
              ]
            },
            "schemaVersion": "cg-abom-0.1.0",
            "semanticDigestAlgorithm": "sha256",
            "semanticDigestSha256": "35782b6be5b3b90cb4b3594b7c0c58d1858a91470b9c6caffc03c356f8c1e9f2",
            "subject": {
              "identity": "private",
              "kind": "repository"
            }
          },
          "accessGraph": {
            "schemaVersion": "cg-accessgraph-1.1.0",
            "standardVersion": "1.0.0",
            "generatedAt": "2026-07-16T00:00:00.000Z",
            "guardprint": "3760cdf9552aafd900f35cb4857291947176701987ce8a8a5798b06584904085",
            "guardprintAlgorithm": "sha256",
            "comparisonToPreviousScan": "baseline_created",
            "guardprintMaterial": {
              "agentSurfaces": [
                {
                  "configurationDetected": true,
                  "id": "claude_code"
                },
                {
                  "configurationDetected": true,
                  "id": "codex"
                },
                {
                  "configurationDetected": true,
                  "id": "copilot"
                },
                {
                  "configurationDetected": true,
                  "id": "cursor"
                },
                {
                  "configurationDetected": false,
                  "id": "tool_bridge"
                }
              ],
              "assetSurfaces": [
                {
                  "id": "auth_billing_database",
                  "observedPathCount": 2
                },
                {
                  "id": "credentials",
                  "observedPathCount": 1
                },
                {
                  "id": "customer_data",
                  "observedPathCount": 0
                },
                {
                  "id": "delivery_infrastructure",
                  "observedPathCount": 3
                },
                {
                  "id": "untrusted_instructions",
                  "observedPathCount": 1
                }
              ],
              "controlResults": [
                {
                  "id": "CGS-ATTEST-001",
                  "status": "manual"
                },
                {
                  "id": "CGS-AUTH-001",
                  "status": "pass"
                },
                {
                  "id": "CGS-DATA-001",
                  "status": "pass"
                },
                {
                  "id": "CGS-DRIFT-001",
                  "status": "pass"
                },
                {
                  "id": "CGS-HUMAN-001",
                  "status": "pass"
                },
                {
                  "id": "CGS-INJ-001",
                  "status": "manual"
                },
                {
                  "id": "CGS-INV-001",
                  "status": "pass"
                },
                {
                  "id": "CGS-POL-001",
                  "status": "pass"
                },
                {
                  "id": "CGS-PRIV-001",
                  "status": "manual"
                },
                {
                  "id": "CGS-REPORT-001",
                  "status": "pass"
                },
                {
                  "id": "CGS-SEC-001",
                  "status": "fail"
                },
                {
                  "id": "CGS-TRACE-001",
                  "status": "pass"
                }
              ],
              "findingSummary": {
                "critical": 1,
                "high": 2,
                "medium": 1,
                "triggered": 5
              },
              "privacyBoundary": {
                "aggregateCategoriesOnly": true,
                "customerIdentityIncluded": false,
                "repositoryNameIncluded": false,
                "secretValuesIncluded": false,
                "sourceContentsIncluded": false
              },
              "scanLimits": {
                "findingLimitReached": false,
                "truncated": false
              },
              "schemaVersion": "cg-guardprint-material-1.0.0",
              "standardVersion": "1.0.0"
            },
            "claimBoundary": "CapitalGuard detects exposure and installs preventive guardrails. It does not guarantee complete remediation or breach prevention."
          },
          "binding": {
            "abomSemanticDigestSha256": "35782b6be5b3b90cb4b3594b7c0c58d1858a91470b9c6caffc03c356f8c1e9f2",
            "accessGraphGuardprintSha256": "3760cdf9552aafd900f35cb4857291947176701987ce8a8a5798b06584904085",
            "finalEventHashSha256": "a5f87bbd3128cab19ae39b1e4ec46f637e496fb51b99c2fc712b67cb5e93395f",
            "securityEventBatchDigestSha256": "747663cf4a04f7f32a9543b744cc47aa61af1a3705adabc70b7c0461153bc1fa"
          },
          "generatedAt": "2026-07-16T00:00:00.000Z",
          "securityEvents": {
            "batchDigestAlgorithm": "sha256",
            "batchDigestSha256": "747663cf4a04f7f32a9543b744cc47aa61af1a3705adabc70b7c0461153bc1fa",
            "claimBoundary": "These events contain privacy-safe evidence metadata. They do not prove unsupported runtime enforcement, exploitation, or complete security.",
            "events": [
              {
                "eventId": "CG-EVT-TEST-VECTOR-0001",
                "evidenceRefs": [],
                "occurredAt": "2026-07-16T00:00:00.000Z",
                "outcome": {
                  "artifactDigestSha256": null,
                  "controlId": null,
                  "criticalCount": 0,
                  "findingCount": 0,
                  "highCount": 0,
                  "mediumCount": 0,
                  "observedCount": 0,
                  "status": "started"
                },
                "previousEventHashSha256": null,
                "privacy": {
                  "absolutePathsIncluded": false,
                  "customerIdentityIncluded": false,
                  "repositoryNameIncluded": false,
                  "secretValuesIncluded": false,
                  "sourceContentsIncluded": false
                },
                "schemaVersion": "cg-security-event-0.1.0",
                "sequence": 1,
                "source": {
                  "component": "local_scanner",
                  "version": "1.3.0"
                },
                "type": "scan.started",
                "eventHashSha256": "83e19d98cb771236d886f3067516f6338f0f428aa62cf71f01930fb42e0c356a"
              },
              {
                "eventId": "CG-EVT-TEST-VECTOR-0002",
                "evidenceRefs": [
                  "CGE-CONFIG-CODEX",
                  "CGE-SURFACE-CREDENTIAL",
                  "CGE-SURFACE-INSTRUCTION",
                  "CGE-SURFACE-WORKFLOW"
                ],
                "occurredAt": "2026-07-16T00:00:00.000Z",
                "outcome": {
                  "artifactDigestSha256": "35782b6be5b3b90cb4b3594b7c0c58d1858a91470b9c6caffc03c356f8c1e9f2",
                  "controlId": null,
                  "criticalCount": 0,
                  "findingCount": 0,
                  "highCount": 0,
                  "mediumCount": 0,
                  "observedCount": 4,
                  "status": "completed"
                },
                "previousEventHashSha256": "83e19d98cb771236d886f3067516f6338f0f428aa62cf71f01930fb42e0c356a",
                "privacy": {
                  "absolutePathsIncluded": false,
                  "customerIdentityIncluded": false,
                  "repositoryNameIncluded": false,
                  "secretValuesIncluded": false,
                  "sourceContentsIncluded": false
                },
                "schemaVersion": "cg-security-event-0.1.0",
                "sequence": 2,
                "source": {
                  "component": "local_scanner",
                  "version": "1.3.0"
                },
                "type": "inventory.completed",
                "eventHashSha256": "e73bee1f85307c29d0b3dc052d605d58e2ad5e88acf45f93fcfbfae4ca50b0c8"
              },
              {
                "eventId": "CG-EVT-TEST-VECTOR-0003",
                "evidenceRefs": [],
                "occurredAt": "2026-07-16T00:00:00.000Z",
                "outcome": {
                  "artifactDigestSha256": "3760cdf9552aafd900f35cb4857291947176701987ce8a8a5798b06584904085",
                  "controlId": null,
                  "criticalCount": 1,
                  "findingCount": 5,
                  "highCount": 2,
                  "mediumCount": 1,
                  "observedCount": 5,
                  "status": "completed"
                },
                "previousEventHashSha256": "e73bee1f85307c29d0b3dc052d605d58e2ad5e88acf45f93fcfbfae4ca50b0c8",
                "privacy": {
                  "absolutePathsIncluded": false,
                  "customerIdentityIncluded": false,
                  "repositoryNameIncluded": false,
                  "secretValuesIncluded": false,
                  "sourceContentsIncluded": false
                },
                "schemaVersion": "cg-security-event-0.1.0",
                "sequence": 3,
                "source": {
                  "component": "local_scanner",
                  "version": "1.3.0"
                },
                "type": "scan.completed",
                "eventHashSha256": "a5f87bbd3128cab19ae39b1e4ec46f637e496fb51b99c2fc712b67cb5e93395f"
              }
            ],
            "generatedAt": "2026-07-16T00:00:00.000Z",
            "schemaVersion": "cg-security-event-batch-0.1.0"
          }
        },
        "schemaVersion": "cg-evidence-bundle-0.1.0"
      },
      "expectedBundleDigestSha256": "732e449bd7ab337b30cf9a8bd36da7faccc7f865f791ddfc10aed1a7f61ea83b"
    }
  ]
}