{
  "updated_utc": "2026-09-11T04:23:15.811617+00:00",
  "saas_commit": "8b67281d0771ee8fdd9a6eb38860a266e5121c9e",
  "sdk_commit": "dbec32c05f9da1f6be4b8932bb0b207cb6d18052",
  "high_critical_gate": "passed",
  "high": 0,
  "critical": 0,
  "spring_boot_version": "4.1.1",
  "docker_image_id": "sha256:a2f946f333cc5da33fc6b454c2a5ae3bf8f71546d80fc7315dd28ec072a1f43a",
  "docker_local_descriptor": "sha256:7caeba64aba3174c9299aca88c18b24c8464f8f06239df67bb4dcee48d45c19f",
  "runtime_uid": "100",
  "archive_sha256": "dea99b9bf4e4ae85d288a3d53c04e9ddcee90c023223f3d7f611fe7d298ff13b",
  "sbom_sha256": "77bd5c31db8c7d4485fe738dbd94eded642c8ef2ba272fc91315d9ad8ecbe931",
  "vulnerabilities_sha256": "bc60ea66e115a8f370e04a060d66bff6b03b5ef7f4f78c338b4ee9b0248ca6d5",
  "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
  "archive_path": "C:\\Users\\steph\\work\\tw-joint-remediation-20260910\\trustweave-saas\\build\\release\\runtime-image.tar",
  "hosted_provenance_verified": false,
  "production_qualified": false,
  "limitations": "Local image, evidence content and digests verified. Hosted attestation, production-profile image startup, promotion/rollback and production custody/recovery exercises remain open."
}