{
  "updated_utc": "2026-09-11T04:23:21.618468+00:00",
  "status": "Local remediation verified; production acceptance incomplete",
  "candidate_pair": {
    "sdk_commit": "dbec32c05f9da1f6be4b8932bb0b207cb6d18052",
    "saas_commit": "8b67281d0771ee8fdd9a6eb38860a266e5121c9e"
  },
  "score": {
    "new_score": 8.9,
    "target": 9.8,
    "target_met": false,
    "production_qualified": false
  },
  "findings": [
    {
      "id": "R18",
      "repository": "SaaS",
      "priority": "P1",
      "confidence": "Reproduced in full backend suite",
      "title": "Custom requestContextFilter bean prevents Spring MVC startup",
      "observation": "The custom @Component RequestContextFilter receives the default bean name requestContextFilter. Spring Boot MVC auto-configuration registers its own bean with that name. The full backend run reproduces BeanDefinitionOverrideException in 11 initial context loads, followed by cached failure-threshold errors in dependent cases.",
      "impact": "ApplicationContextSmokeTest and multiple real integration contexts cannot start. This is a code-level bean-name collision, not a missing Docker or identity-provider prerequisite. The 111 failing test cases are not 111 independent defects.",
      "remediation": "Give the telemetry filter an explicit distinct bean name (or rename the class), preserve Spring\u2019s request-context filter, and keep bean overriding disabled. Re-run real application smoke and all affected integration suites.",
      "acceptance": "Both framework and telemetry filters exist with intended ordering and no duplicate registration. The application boots, MDC is cleaned after errors/async dispatch, and the complete suite passes without enabling bean-definition overriding.",
      "sources": [
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/observability/RequestContextFilter.kt",
          "line": 29,
          "sha256": "61c39a042c732477afe1a462175853ea4ae52ebc7e680016979bc2f12d5b61fe"
        },
        {
          "repo": "SaaS",
          "path": "server/src/test/kotlin/com/geoknoesis/trustweave/saas/server/ApplicationContextSmokeTest.kt",
          "line": 1,
          "sha256": "18bd323f45f9f9e632408fde3577362f3f1806a01b277aa24245082f75074bbb"
        }
      ],
      "status": "Verified defect closure; broader production qualification remains separate",
      "remediation_update": "The explicitly named telemetry filter coexists with Spring MVC without bean overriding. Full application startup and affected integration cases passed in the complete candidate suite.",
      "closure_status": "Verified defect closure; broader production qualification remains separate",
      "original_review_status": "Open"
    },
    {
      "id": "R01",
      "repository": "SaaS",
      "priority": "P1",
      "confidence": "Source-confirmed",
      "title": "Scheduled usage delivery bypasses its transaction boundary",
      "observation": "scheduledDrain() invokes drainOnce() on the same bean. Only drainOnce() has @Transactional. The native claim query uses FOR UPDATE SKIP LOCKED. Under Spring\u2019s default proxy transaction mode, this internal call does not open the intended encompassing transaction.",
      "impact": "The scheduler path cannot rely on row locks covering delivery and persistence. Whether the provider rejects the query or releases locks early must be established with the real scheduled entry point; neither outcome is acceptable as the claimed concurrency guarantee.",
      "remediation": "Move work behind a separate proxied worker or explicit transaction boundary. Prefer short claim/finalize transactions with durable leases; do not merely put a long transaction around HTTP delivery.",
      "acceptance": "Invoke the Spring-managed scheduled entry with PostgreSQL, assert the claim transaction, pause two workers at claim/send boundaries, and kill/restart one worker. Verify recovery and provider idempotency.",
      "sources": [
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/billing/accountly/UsageReporter.kt",
          "line": 39,
          "sha256": "f94ad2e5598e96d523bd756f9c8e2cf75ee58e098faecd850d8962df30f093ae"
        },
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/repository/UsageOutboxRepository.kt",
          "line": 38,
          "sha256": "702648a3cb9a64e3e574e48a391ebe1672d6085b83e505c54b887a1327534447"
        }
      ],
      "status": "Implemented changes; closure acceptance incomplete",
      "remediation_update": "Short independently committed claim/finalize transactions, durable fencing, and NOT_SUPPORTED remote delivery replace self-invoked long transactions. Real Spring proxy regression added.",
      "closure_status": "Implemented changes; closure acceptance incomplete",
      "original_review_status": "Open"
    },
    {
      "id": "R02",
      "repository": "SaaS",
      "priority": "P1",
      "confidence": "Source-confirmed design risk",
      "title": "Outbox lease and outage handling do not bound delivery safely",
      "observation": "A five-minute scheduler lease protects up to 100 sequential events with a default 20-second request timeout. One timeout per event alone can exceed 33 minutes. Generic transport and circuit-open failures consume the ten-attempt poison budget; only HTTP 429/503 are exempt.",
      "impact": "A long batch can outlive its scheduler lease. When transactions are corrected, remote calls inside the transaction can exhaust DB capacity. A prolonged transient outage can leave valid billable events terminally FAILED and dependent on manual intervention.",
      "remediation": "Use per-row durable claim tokens/expiry, bounded batches and deadlines, short transactions, remote idempotency, and classified exponential retry with jitter. Expose authenticated redrive and oldest-pending alerts.",
      "acceptance": "Test lease expiry, provider commit followed by lost response, 429/503, repeated connection failures and recovery after more than ten drain ticks. No valid event is silently abandoned or billed twice.",
      "sources": [
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/billing/accountly/UsageReporter.kt",
          "line": 27,
          "sha256": "f94ad2e5598e96d523bd756f9c8e2cf75ee58e098faecd850d8962df30f093ae"
        },
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/billing/accountly/UsageReporter.kt",
          "line": 37,
          "sha256": "f94ad2e5598e96d523bd756f9c8e2cf75ee58e098faecd850d8962df30f093ae"
        },
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/billing/accountly/AccountlyBillingProperties.kt",
          "line": 13,
          "sha256": "10b14d2382033f16bf7ded56eefef09c661ea6a1a9cf3d16e270481b7b84496b"
        }
      ],
      "status": "Implemented changes; closure acceptance incomplete",
      "remediation_update": "Five-minute leases, stable idempotency keys, bounded batches, delayed transient retries, poison inventory, platform-admin redrive, and atomic audit records implemented. Remote response-loss qualification remains open.",
      "closure_status": "Implemented changes; closure acceptance incomplete",
      "original_review_status": "Open"
    },
    {
      "id": "R03",
      "repository": "SaaS",
      "priority": "P1",
      "confidence": "Reproduced: seven reporter cases fail",
      "title": "Usage reporter tests exercise the obsolete repository contract",
      "observation": "UsageReporterTest stubs findByStatusInAndAttemptsLessThanOrderByCreatedAtAsc, while production calls claimForDelivery. It constructs UsageReporter directly and calls drainOnce(), so it also misses scheduler/proxy semantics.",
      "impact": "Existing assertions do not qualify the changed claim path. Merely replacing mock method names would still leave the transaction defect undetected.",
      "remediation": "Update unit contracts and add real PostgreSQL/Spring proxy integration tests for the scheduled entry point, concurrent claims and retry state transitions.",
      "acceptance": "All existing reporter cases pass against the current method; a deliberately removed transaction or broken claim lease makes an integration test fail.",
      "sources": [
        {
          "repo": "SaaS",
          "path": "server/src/test/kotlin/com/geoknoesis/trustweave/saas/server/billing/accountly/UsageReporterTest.kt",
          "line": 38,
          "sha256": "ce9bb8a66f21cf2551f093990bd96f738226c003f007b365851d9ceebce4209c"
        },
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/billing/accountly/UsageReporter.kt",
          "line": 54,
          "sha256": "f94ad2e5598e96d523bd756f9c8e2cf75ee58e098faecd850d8962df30f093ae"
        }
      ],
      "status": "Implemented changes; closure acceptance incomplete",
      "remediation_update": "Reporter tests now exercise the current delivery-store contract. PostgreSQL concurrency, stale acknowledgement, outage, poison, redrive, and transaction tests added.",
      "closure_status": "Implemented changes; closure acceptance incomplete",
      "original_review_status": "Open"
    },
    {
      "id": "R04",
      "repository": "SaaS",
      "priority": "P1",
      "confidence": "Source-confirmed",
      "title": "Shared rate-limit failures allow every request",
      "observation": "RateLimiter.check catches every Exception from the shared store, logs a warning, and returns success. This policy applies to public token, claim and redemption paths as well as verification. No dedicated failure-policy metric is emitted by this class.",
      "impact": "Counter-table permission loss or a store outage removes abuse limits on sensitive public operations. This is not a JWT/signature bypass, but authentication alone does not replace abuse controls.",
      "remediation": "Define endpoint-specific failure policy. Fail closed with bounded 503 on sensitive mutations; use an explicitly bounded local fallback only for approved read operations. Add low-cardinality metrics and sampled logs.",
      "acceptance": "Break only the counter-table access while the rest of the service remains available. Sensitive operations reject without downstream mutation; approved read fallback remains bounded across concurrent callers.",
      "sources": [
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/security/RateLimiter.kt",
          "line": 50,
          "sha256": "a284a137ebaf8be61e079ff8e3d71a64ba7b826a7e266be68094bfeac2c2a2a7"
        }
      ],
      "status": "Implemented changes; closure acceptance incomplete",
      "remediation_update": "Database failure rejects admission with a static 503 response and bounded telemetry. Capacity exhaustion returns 429 rather than bypassing the shared limiter.",
      "closure_status": "Implemented changes; closure acceptance incomplete",
      "original_review_status": "Open"
    },
    {
      "id": "R05",
      "repository": "SaaS",
      "priority": "P2",
      "confidence": "Source-confirmed design risk",
      "title": "Shared limiter uses caller clocks and lacks a cardinality budget",
      "observation": "The upsert and expiry sweep use Instant.now() from each application instance. Shared rows have no configured maximum, unlike the bounded local map; rejected hits still increment an integer counter.",
      "impact": "Clock skew can make nodes disagree about expiry. High-cardinality traffic and a hot key can load the primary DB. No measured failure threshold is claimed by this review.",
      "remediation": "Use database time for the shared decision, saturate counts, bound statement latency and retention, and define a key-cardinality/pool budget. Consider a dedicated limiter store only if measured DB costs justify it.",
      "acceptance": "Run skewed-clock multi-node tests plus hot-key and high-cardinality load; record p95/p99 latency, pool occupancy, retained rows, cleanup time and rejection correctness.",
      "sources": [
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/security/SharedRateLimitStore.kt",
          "line": 38,
          "sha256": "ccc2c380feadeb2eb3853821b22b4b5e382e2477e6f2168495001bce269f093e"
        },
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/security/SharedRateLimitStore.kt",
          "line": 59,
          "sha256": "ccc2c380feadeb2eb3853821b22b4b5e382e2477e6f2168495001bce269f093e"
        }
      ],
      "status": "Implemented changes; closure acceptance incomplete",
      "remediation_update": "Database time, saturating counters, two-second queries, 1,000-row purge batches, and a transactional 50,000-key capacity ceiling implemented. V39 documents the legacy UTC conversion assumption.",
      "closure_status": "Implemented changes; closure acceptance incomplete",
      "original_review_status": "Open"
    },
    {
      "id": "R06",
      "repository": "SaaS",
      "priority": "P1",
      "confidence": "Reproduced locally",
      "title": "Production plus local profile accepts an ephemeral KMS",
      "observation": "validateForProfiles allows the in-memory provider whenever any profile is dev/test/local. A local Java probe rejects prod alone but accepts prod+local and staging+local. TrustWeaveConfig is disabled only for test, so local does not disable facade construction.",
      "impact": "An accidental profile mix can deploy issuer keys that disappear on restart, leaving persisted issuer identities unable to sign.",
      "remediation": "Make deployed profiles dominate development allowances, reject incompatible profile combinations, and validate the effective persistent provider before startup.",
      "acceptance": "Table-test empty, unknown, mixed, case-varied and production profiles; boot prod+local and staging+local and require rejection. A permitted persistent profile must retain the same signing identity across restart.",
      "sources": [
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/kms/KmsProviderConfig.kt",
          "line": 34,
          "sha256": "029c8ca8e978f7092b2361058a508f3f19dc676f103dae839f315c01e6a6e620"
        },
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/config/TrustWeaveConfig.kt",
          "line": 18,
          "sha256": "6ae7ae7b5c219c5d8e80a2dd7259ec23260174ba4326090810ab6805ee71ab49"
        }
      ],
      "status": "Verified defect closure; broader production qualification remains separate",
      "remediation_update": "Ephemeral custody requires every active profile to be explicitly local/dev/test. Mixed production/local profiles are rejected.",
      "closure_status": "Verified defect closure; broader production qualification remains separate",
      "original_review_status": "Open"
    },
    {
      "id": "R07",
      "repository": "SaaS",
      "priority": "P2",
      "confidence": "Source-confirmed",
      "title": "Bound KMS options are silently unused",
      "observation": "KmsProviderConfig exposes provider-specific options, but TrustWeaveConfig forwards only provider and algorithm to the keys builder. No kmsConfig.options consumer was found.",
      "impact": "An operator can supply a documented option without changing the effective provider configuration. A provider may separately read environment settings; this finding does not claim all environment-based setups fail.",
      "remediation": "Forward typed, validated provider options through the actual factory or reject unsupported configuration explicitly. Publish a secret-safe effective-configuration fingerprint.",
      "acceptance": "A non-default endpoint/namespace is observed by a fake provider; unknown or unused options fail startup and no secret appears in diagnostics.",
      "sources": [
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/kms/KmsProviderConfig.kt",
          "line": 26,
          "sha256": "029c8ca8e978f7092b2361058a508f3f19dc676f103dae839f315c01e6a6e620"
        },
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/config/TrustWeaveConfig.kt",
          "line": 40,
          "sha256": "6ae7ae7b5c219c5d8e80a2dd7259ec23260174ba4326090810ab6805ee71ab49"
        }
      ],
      "status": "Verified defect closure; broader production qualification remains separate",
      "remediation_update": "Explicit Vault options are validated and forwarded. Unknown or malformed settings fail instead of selecting environment fallback. Configuration string output redacts credentials.",
      "closure_status": "Verified defect closure; broader production qualification remains separate",
      "original_review_status": "Open"
    },
    {
      "id": "R08",
      "repository": "SaaS",
      "priority": "P1",
      "confidence": "Source-confirmed",
      "title": "Request logging context includes capability-bearing paths",
      "observation": "RequestContextFilter puts raw request.requestURI into MDC HTTP_PATH. Production JSON logging includes httpPath. PublicClaimController serves /api/public/claim/{offerCode}, where offerCode is used to locate the claim offer.",
      "impact": "Logs emitted while handling a claim can retain its capability value. requestURI excludes query strings; this finding concerns path tokens and does not assert that every request emits a log.",
      "remediation": "Use route templates or an allowlisted path redactor before logging. Apply the same rule to access logs, trace attributes and error diagnostics.",
      "acceptance": "Send unique canary offer codes through success and failure cases; captured logs/traces contain no canary while request correlation and route-level metrics remain useful.",
      "sources": [
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/observability/RequestContextFilter.kt",
          "line": 41,
          "sha256": "61c39a042c732477afe1a462175853ea4ae52ebc7e680016979bc2f12d5b61fe"
        },
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/controller/PublicClaimController.kt",
          "line": 52,
          "sha256": "6d4cd2aa94bde1d68cd8652f215797bea9be674d5863690436a19764ea617152"
        },
        {
          "repo": "SaaS",
          "path": "server/src/main/resources/logback-spring.xml",
          "line": 35,
          "sha256": "9b7d27e152b30bbee3ad1f7b49096bbc8ed254677a56406e56c143d7aa4080fa"
        }
      ],
      "status": "Implemented changes; closure acceptance incomplete",
      "remediation_update": "Request MDC uses trusted route templates. The server observation convention omits raw capability-bearing URLs; real filter tests cover matched/unmatched success and exception paths. Proxy logs, arbitrary exception text and exporter storage/retention still need end-to-end qualification.",
      "closure_status": "Implemented changes; closure acceptance incomplete",
      "original_review_status": "Open"
    },
    {
      "id": "R09",
      "repository": "SaaS",
      "priority": "P2",
      "confidence": "Source-confirmed",
      "title": "Readiness accepts a missing identity realm as healthy",
      "observation": "The dependency probe treats every status below 500 as UP, including 401, 404 and 429. Keycloak uses a public OIDC discovery URL and participates in readiness.",
      "impact": "A deleted realm or incorrect probe URL can remain green after startup. Reachability is useful information, but is insufficient for a functional readiness decision.",
      "remediation": "Separate reachability from readiness. Require successful, valid discovery metadata for the configured issuer, with bounded timeouts and controlled probe caching; keep liveness independent.",
      "acceptance": "Exercise 401/404/429/500, malformed 200, wrong issuer and valid discovery responses. Readiness changes correctly without a liveness restart storm.",
      "sources": [
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/observability/DependencyHealthIndicators.kt",
          "line": 45,
          "sha256": "d03032330bbda622663969e7715a956a4b1aca6ee447edc8a5343027ef9b5028"
        },
        {
          "repo": "SaaS",
          "path": "server/src/main/resources/application.yml",
          "line": 99,
          "sha256": "6a27248d4293cdd2770d89066cea5fa249cf730f518824a4654b7951c35c45c4"
        }
      ],
      "status": "Implemented changes; closure acceptance incomplete",
      "remediation_update": "Readiness requires HTTP 200, bounded valid discovery JSON, matching issuer, and usable JWKS URI. 4xx, malformed discovery, and issuer mismatch are DOWN.",
      "closure_status": "Implemented changes; closure acceptance incomplete",
      "original_review_status": "Open"
    },
    {
      "id": "R10",
      "repository": "SaaS",
      "priority": "P1",
      "confidence": "Source-confirmed recipe defect",
      "title": "Committed Fly recipe disagrees with the application port and datasource contract",
      "observation": "fly.toml routes to 8080 while application.yml defaults to 8081 and the Docker image exposes/checks 8081. The Fly environment supplies no SERVER_PORT override, uses a postgres:// example URL where the datasource expects a JDBC URL, and retains a placeholder Keycloak host.",
      "impact": "The committed recipe is not a reproducible production deployment. External secrets or platform overrides may make an existing deployment work; none were inspected here.",
      "remediation": "Choose one supported port/configuration contract, remove example production fallbacks, require validated datasource/issuer settings, and qualify the actual image through the documented deployment recipe.",
      "acceptance": "Build and boot the image with the declared profile, reach readiness through the configured proxy port, reject missing secrets, and migrate a real supported PostgreSQL instance.",
      "sources": [
        {
          "repo": "SaaS",
          "path": "fly.toml",
          "line": 16,
          "sha256": "ec41bfd650b9ffd1cb160a25912584dd066dc8186183a3e9e6102c37a5a0a080"
        },
        {
          "repo": "SaaS",
          "path": "server/src/main/resources/application.yml",
          "line": 77,
          "sha256": "6a27248d4293cdd2770d89066cea5fa249cf730f518824a4654b7951c35c45c4"
        },
        {
          "repo": "SaaS",
          "path": "Dockerfile",
          "line": 19,
          "sha256": "78e5be51c9ba049266050e71526848972c99529266000cf3468c2a2bc14e8713"
        },
        {
          "repo": "SaaS",
          "path": "server/src/main/resources/application-fly.yml",
          "line": 1,
          "sha256": "8dc41d772d9bf0a3c64f1438ff9d5212b8656fa0c4e132f118d10a034596e12a"
        }
      ],
      "status": "Implemented changes; closure acceptance incomplete",
      "remediation_update": "Fly port and readiness match 8081; placeholder database credentials removed; staging/Fly automatic Flyway baselining disabled. Actual selected-platform startup remains unqualified.",
      "closure_status": "Implemented changes; closure acceptance incomplete",
      "original_review_status": "Open"
    },
    {
      "id": "R11",
      "repository": "Joint",
      "priority": "P1",
      "confidence": "Reproduced source gate failure",
      "title": "Current repositories do not form the pinned SDK/SaaS candidate pair",
      "observation": "The SaaS pin expects a41d482a96dcdd3962c2a0a95fd1da469f310fa9; the sibling SDK HEAD is e0a4464fc6cafa339b94121fd56f33812c6601e4 with local changes. verify-sdk-source.py rejects this pair. The previously qualified SDK candidate is 5e8dc04c0e45dd51b323b6b3c475d302615715af.",
      "impact": "Current local integration tests cannot certify the pinned release pair. This does not prove that SaaS CI against its intended pinned revision fails.",
      "remediation": "Create immutable reviewed candidates in both repositories, update the pin and reviewed source digest manifest deliberately, and run all integration and artifact gates on that exact pair.",
      "acceptance": "Source verifier, clean builds and hosted integration pass on the same recorded pair; all delivered artifacts and reports carry both SHAs and source digests.",
      "sources": [
        {
          "repo": "SaaS",
          "path": ".trustweave-revision",
          "line": 1,
          "sha256": "81328eaed2a4b2b591e7ef149111c70e022f73aacfe15dd6a96d4c1ee7dde312"
        },
        {
          "repo": "SaaS",
          "path": "scripts/verify-sdk-source.py",
          "line": 1,
          "sha256": "1e0282c844fb217dc89b294753dcbcc6e37efd545f72ec9910ea986d27e6fcb9"
        },
        {
          "repo": "SaaS",
          "path": "settings.gradle.kts",
          "line": 15,
          "sha256": "adbed546b7a2a02ffb0872d1fbecff6e5de46b697ce0b7a5ec89fe370eaf4a85"
        }
      ],
      "status": "Implemented changes; closure acceptance incomplete",
      "remediation_update": "Pinned SDK dbec32c05f9da1f6be4b8932bb0b207cb6d18052 and SaaS 8b67281d0771ee8fdd9a6eb38860a266e5121c9e passed the complete backend inventory and coverage gate. Frontend evidence records its own commit and input hashes. Existing original working-tree changes were preserved; isolated candidate commits were used for verification.",
      "closure_status": "Implemented changes; closure acceptance incomplete",
      "original_review_status": "Open"
    },
    {
      "id": "R12",
      "repository": "SaaS",
      "priority": "P2",
      "confidence": "Qualification gap in inspected CI",
      "title": "Release evidence stops before the deployable artifact",
      "observation": "The inspected CI tests backend sources and builds frontend assets, but has no bootJar/container release build, SBOM/provenance attestation, image promotion/rollback qualification or deployed digest verification. Actions use version tags and the Docker base is a floating tag.",
      "impact": "Green source tests do not establish the identity or readiness of the image that is deployed. No specific vulnerable dependency is alleged; no fresh vulnerability scan was run.",
      "remediation": "Build the runtime image once from the qualified pair, pin build inputs, produce SBOM/provenance, enforce a vulnerability policy, verify signatures/digests at promotion, and exercise rollback.",
      "acceptance": "Tampered provenance or mismatched SDK/image digest blocks promotion; an immutable image passes startup, smoke, migration and rollback tests with archived evidence.",
      "sources": [
        {
          "repo": "SaaS",
          "path": ".github/workflows/ci.yml",
          "line": 37,
          "sha256": "608b03c9c57b42e163cc5ddf00cec174b0988ba7e470e6d9b48c348761cd89a6"
        },
        {
          "repo": "SaaS",
          "path": "Dockerfile",
          "line": 8,
          "sha256": "78e5be51c9ba049266050e71526848972c99529266000cf3468c2a2bc14e8713"
        }
      ],
      "status": "Implemented changes; closure acceptance incomplete",
      "remediation_update": "Pinned runtime/scanner/actions, actual image build, CycloneDX SBOM, clean HIGH/CRITICAL scan and eleven release-script tests. Verification checks archive configuration identity, approved-source test contents, required suites/skips, scan coverage/severity and SBOM identity as well as hashes. Hosted attestation/promotion remains open.",
      "closure_status": "Implemented changes; closure acceptance incomplete",
      "original_review_status": "Open"
    },
    {
      "id": "R13",
      "repository": "Joint",
      "priority": "P2",
      "confidence": "Source-confirmed assurance gap",
      "title": "Coverage and browser harness policy leave important paths unqualified",
      "observation": "SaaS backend coverage verification has a 0.40 floor. Frontend coverage has reporters but no thresholds and CI runs ordinary tests. MSW is configured to warn on unexpected requests; the current passing suite emits network warnings. Previous SDK global coverage was 57.41% line / 40.04% branch.",
      "impact": "Passing counts and category scores are not coverage percentages. Proxy, provider response and deployment defects can survive mock-heavy tests. Network warnings need classification rather than blanket suppression.",
      "remediation": "Define critical-path branch and mutation targets, exercise real transaction/provider contracts, and make unexpected browser requests fail deterministically after fixture cleanup. Retain an explicit skip/discovery manifest.",
      "acceptance": "Critical negative cases fail when their guards are removed; risk-based coverage thresholds are enforced in CI and no unapproved test skips or unexpected requests remain.",
      "sources": [
        {
          "repo": "SaaS",
          "path": "server/build.gradle.kts",
          "line": 208,
          "sha256": "f21b4f23cbe6806396c24a74b6f2d335ed29a9657ceddbe1f49de316788cb866"
        },
        {
          "repo": "SaaS",
          "path": "frontend/vitest.config.ts",
          "line": 13,
          "sha256": "ec583aea133ab0f82eef3e81a75bdb54a5b285043b8c2737e224945952fe0a12"
        },
        {
          "repo": "SaaS",
          "path": "frontend/src/test/setup.ts",
          "line": 10,
          "sha256": "7fc43decbd582d5135b727e2be9ee0c5d4b7cf8372f71511edac138a1e2ae2b8"
        }
      ],
      "status": "Implemented changes; closure acceptance incomplete",
      "remediation_update": "302 browser tests, lint, TypeScript/build and bundle budget passed. Test helpers are excluded from coverage: 59.1% lines and 50.94% branches. Claim encryption reaches 95.71% line and 94.11% branch coverage with real cryptography and negative integrity cases; broader critical-path mutation qualification remains open.",
      "closure_status": "Implemented changes; closure acceptance incomplete",
      "original_review_status": "Open"
    },
    {
      "id": "R14",
      "repository": "SaaS",
      "priority": "P2",
      "confidence": "Source-confirmed design risk",
      "title": "User synchronization holds a broad transaction across remote work",
      "observation": "syncAllUsers is transactional, fetches the user list, then calls a method that fetches each user remotely and saves it. Per-user exceptions are caught inside the outer transaction. The list call has no explicit pagination at this layer.",
      "impact": "Large or slow identity-provider responses can lengthen transactions; a database failure may poison the outer transaction despite per-user error counting. Pagination completeness needs an explicit contract; no undocumented provider page-size assumption is made.",
      "remediation": "Fetch bounded pages outside DB transactions, persist each bounded unit through a real transaction boundary, checkpoint progress and make retries idempotent.",
      "acceptance": "Sync more than one provider page, inject a mid-page DB failure and slow identity responses, restart and resume, and demonstrate bounded DB occupancy and correct completion counts.",
      "sources": [
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/services/UserSyncService.kt",
          "line": 64,
          "sha256": "556061da1194a7eca7e6c933d370c3a8b209625c9d6109539a4603ba12804659"
        },
        {
          "repo": "SaaS",
          "path": "server/src/main/kotlin/com/geoknoesis/trustweave/saas/server/services/KeycloakService.kt",
          "line": 97,
          "sha256": "642702ffc0d5a1949dbc2218373f7ddfb2e15c1bb3e43b638c14c4dae92b2993"
        }
      ],
      "status": "Implemented changes; closure acceptance incomplete",
      "remediation_update": "Identity synchronization uses 100-user pages, a durable cursor, detached provider reads, and per-user independently committed writes. Failed pages preserve the cursor; individual failures do not roll back unrelated writes.",
      "closure_status": "Implemented changes; closure acceptance incomplete",
      "original_review_status": "Open"
    },
    {
      "id": "R15",
      "repository": "SDK",
      "priority": "P1",
      "confidence": "Driver-shape reproduced; source-confirmed adapter defect",
      "title": "Vault public-key extraction casts String to Map",
      "observation": "VaultKeyManagementService generateKey/getPublicKey reads keyInfo.data[\"keys\"] and casts it to Map. The pinned driver LogicalResponse.getData() returns Map<String,String>. javap and a local nested-JSON fixture show keys is a java.lang.String; the cast cannot succeed. The compiler reports this at both paths. getDataObject() preserves structured JSON.",
      "impact": "A valid nested Vault key response cannot yield a public key through these extraction paths. Key generation can create a provider-side key and then return failure. This is especially material to SaaS staging, which selects Vault.",
      "remediation": "Parse the driver\u2019s structured response with explicit schema/version/type validation. Cover missing/invalid fields and avoid orphaning/recreating keys on retry. Then qualify the declared Vault algorithm and lifecycle end to end.",
      "acceptance": "A driver-faithful fixture passes generate/get-public-key behavior; malformed versions fail safely. Against an isolated Vault instance, create/sign/independently verify/restart/retrieve/rotate succeeds with stable identity and no private-key leakage.",
      "sources": [
        {
          "repo": "SDK",
          "path": "kms/plugins/hashicorp/src/main/kotlin/org/trustweave/hashicorpkms/VaultKeyManagementService.kt",
          "line": 126,
          "sha256": "c761bde18c0a805903433097a394ec6823573db741b2a60cc5c47db121b2d92c"
        },
        {
          "repo": "SDK",
          "path": "kms/plugins/hashicorp/src/main/kotlin/org/trustweave/hashicorpkms/VaultKeyManagementService.kt",
          "line": 234,
          "sha256": "c761bde18c0a805903433097a394ec6823573db741b2a60cc5c47db121b2d92c"
        },
        {
          "repo": "SDK",
          "path": "kms/plugins/hashicorp/build.gradle.kts",
          "line": 17,
          "sha256": "80dc1e51c7e3c96b63904d30f532213342aaa4505c4acba4c6d9bca0058b697f"
        },
        {
          "repo": "SaaS",
          "path": "server/src/main/resources/application-staging.yml",
          "line": 58,
          "sha256": "dd7a33cf6e7d41ab8bb3e43ab0ebb5274a08e95cc7daeb049e0266bc6ea4cd6a"
        }
      ],
      "status": "Implemented changes; closure acceptance incomplete",
      "remediation_update": "Vault structured responses, Transit routing, configuration, strict Ed25519 encoding, bounded timeouts and full-UUID names are covered by refreshed adapter tests. Standalone module dependencies now use the reviewed catalog. Real provider lifecycle tests do not establish production server restart, rotation or HA.",
      "closure_status": "Implemented changes; closure acceptance incomplete",
      "original_review_status": "Open"
    },
    {
      "id": "R16",
      "repository": "Joint",
      "priority": "P1",
      "confidence": "Explicit qualification gap",
      "title": "No declared production custody profile is fully qualified",
      "observation": "The SDK custody runbook explicitly says not qualified. Its assessed capability catalog has no supported entries; deployment gating is opt-in outside selected factories and compatibility defaults remain LEGACY. The reference wallet adapters remain experimental.",
      "impact": "A strong core SDK score cannot certify all providers, physical authenticators or the SaaS-managed signing path. Broad production-ready claims exceed available evidence.",
      "remediation": "Declare the exact initial production provider/algorithm/wallet surface, enforce its policy at host construction, and complete real signing, denied access, outage, restart, rotation and authorized recovery evidence. Keep excluded adapters explicitly experimental.",
      "acceptance": "The chosen profile has immutable provider/key identity, independent signature verification, negative authorization and replay tests, recovery approval/audit evidence, and no fallback to ephemeral custody.",
      "sources": [
        {
          "repo": "SDK",
          "path": "docs/operations/custody-qualification.md",
          "line": 3,
          "sha256": "30d563932c6ed8d0617104399b251723ffe4ba220adc4f23373edcbd4835d236"
        },
        {
          "repo": "SDK",
          "path": "docs/api-reference/provider-deployment-profiles.md",
          "line": 49,
          "sha256": "13a1cfee86443a9b52b477ad229340f7f87aa38d9508232d64331f1935691e08"
        },
        {
          "repo": "SDK",
          "path": "common/src/main/resources/trustweave-capabilities.json",
          "line": 1,
          "sha256": "efe3eaf977296cae9cf3f3d26a0f9e624d68d7a284d0c27947ba0f7deedf58ed"
        }
      ],
      "status": "Open implementation/scope and qualification",
      "remediation_update": "Production provider/algorithm/platform and custody lifecycle are not yet declared and qualified. Local container tests do not certify restart, rotation, hardware, or HA.",
      "closure_status": "Open implementation/scope and qualification",
      "original_review_status": "Open"
    },
    {
      "id": "R17",
      "repository": "Joint",
      "priority": "P1",
      "confidence": "Explicit qualification gap",
      "title": "Component recovery is not an end-to-end admission and journal recovery proof",
      "observation": "Previous SDK tests qualify component WAL recovery and a read-only ledger integrity helper. The helper depends on a separately trusted checkpoint; it does not itself store that checkpoint, authenticate an external payment journal or fence new admission during reconciliation. SaaS recovery of billing, claims and custody together is not evidenced by those tests.",
      "impact": "A consistent but stale restore can still be unsafe to resume if external effects and authorization consumption are not reconciled. RPO/RTO and replica fencing remain deployment-specific.",
      "remediation": "Own checkpoint custody and journal authentication at the host, keep admission fenced until verification/reconciliation completes, and exercise application-wide restore with custody and external effects.",
      "acceptance": "Restore an isolated production-shaped dataset, reject stale/tampered checkpoints and missing WAL, reconcile acknowledged external effects, prove no reused authorization or duplicate billing, and measure agreed RPO/RTO before opening admission.",
      "sources": [
        {
          "repo": "SDK",
          "path": "docs/operations/configuration-data.md",
          "line": 1,
          "sha256": "8a5bae064f818b5a307607234da93960d670d1e0f8f652d20345d562a6f7384f"
        },
        {
          "repo": "SDK",
          "path": "docs/operations/intent/reliability.md",
          "line": 1,
          "sha256": "bfa5edf6e1229d9df555e82e3d66c3369d6f1e727843b911ccdb5ce15ebeeb4a"
        }
      ],
      "status": "Open implementation/scope and qualification",
      "remediation_update": "End-to-end independently anchored checkpoint, external journal reconciliation, restore admission fencing, and measured RPO/RTO remain open. Local outbox leases do not close these architectural acceptance criteria.",
      "closure_status": "Open implementation/scope and qualification",
      "original_review_status": "Open"
    }
  ],
  "tasks": [
    {
      "id": "T01",
      "wave": 0,
      "repository": "Joint",
      "owner": "Tech lead",
      "effort": "S",
      "title": "Declare the initial production support envelope",
      "acceptance": "Record supported provider, algorithms, wallet flows, deployment platform, PostgreSQL version, tenant scale and excluded experimental operations.",
      "findings": [
        "R16",
        "R17"
      ],
      "depends_on": [],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T02",
      "wave": 0,
      "repository": "Joint",
      "owner": "Release engineering",
      "effort": "M",
      "title": "Select and bind an immutable candidate pair",
      "acceptance": "Both clean candidate SHAs, reviewed source manifest and source verifier agree; preserve existing local work.",
      "findings": [
        "R11"
      ],
      "depends_on": [
        "T01"
      ],
      "status": "Verified scoped acceptance"
    },
    {
      "id": "T03",
      "wave": 1,
      "repository": "SDK",
      "owner": "KMS maintainers",
      "effort": "M",
      "title": "Correct Vault structured response parsing",
      "acceptance": "Faithful nested driver fixtures cover create/get, missing keys, version selection and malformed types.",
      "findings": [
        "R15"
      ],
      "depends_on": [
        "T01"
      ],
      "status": "Verified scoped acceptance"
    },
    {
      "id": "T04",
      "wave": 1,
      "repository": "SDK",
      "owner": "KMS maintainers",
      "effort": "L",
      "title": "Qualify the selected Vault lifecycle",
      "acceptance": "Isolated provider create/sign/independent verification/restart/rotation passes; no orphaned retry keys.",
      "findings": [
        "R15",
        "R16"
      ],
      "depends_on": [
        "T03"
      ],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T05",
      "wave": 1,
      "repository": "SaaS",
      "owner": "Platform backend",
      "effort": "S",
      "title": "Reject incompatible production KMS profiles",
      "acceptance": "Truth table and actual Spring startup reject prod+local, staging+local and unintended ephemeral configurations.",
      "findings": [
        "R06"
      ],
      "depends_on": [],
      "status": "Verified scoped acceptance"
    },
    {
      "id": "T06",
      "wave": 1,
      "repository": "SaaS",
      "owner": "Platform backend",
      "effort": "M",
      "title": "Make KMS options effective and validated",
      "acceptance": "Non-default endpoint/namespace is used; unknown/unconsumed options fail startup; diagnostics redact secrets.",
      "findings": [
        "R07"
      ],
      "depends_on": [
        "T05"
      ],
      "status": "Verified scoped acceptance"
    },
    {
      "id": "T07",
      "wave": 1,
      "repository": "SaaS",
      "owner": "Billing backend",
      "effort": "M",
      "title": "Establish real outbox transaction boundaries",
      "acceptance": "Spring-managed scheduler/proxy tests demonstrate short atomic claim/finalize transactions.",
      "findings": [
        "R01",
        "R03"
      ],
      "depends_on": [],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T08",
      "wave": 1,
      "repository": "SaaS",
      "owner": "Billing backend",
      "effort": "L",
      "title": "Implement durable bounded delivery leases",
      "acceptance": "Two-worker, expired-lease and worker-crash tests preserve claim ownership with fencing tokens and bounded batch runtime.",
      "findings": [
        "R02"
      ],
      "depends_on": [
        "T07"
      ],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T09",
      "wave": 1,
      "repository": "SaaS",
      "owner": "Billing backend",
      "effort": "M",
      "title": "Separate transient retries from poison events",
      "acceptance": "Connection outage beyond ten ticks recovers; permanent rejection enters an audited terminal queue; retry delay and Retry-After are bounded.",
      "findings": [
        "R02"
      ],
      "depends_on": [
        "T08"
      ],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T10",
      "wave": 1,
      "repository": "SaaS",
      "owner": "Billing backend",
      "effort": "M",
      "title": "Prove remote idempotency and authenticated redrive",
      "acceptance": "Provider commit/response-loss and operator redrive produce exactly one remote charge/effect per event key.",
      "findings": [
        "R02"
      ],
      "depends_on": [
        "T09"
      ],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T11",
      "wave": 1,
      "repository": "SaaS",
      "owner": "Security backend",
      "effort": "M",
      "title": "Enforce endpoint-specific limiter failure policy",
      "acceptance": "Counter-only outage causes sensitive mutation rejection and bounded approved read fallback; no blanket allow path.",
      "findings": [
        "R04"
      ],
      "depends_on": [],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T12",
      "wave": 1,
      "repository": "SaaS",
      "owner": "Security backend",
      "effort": "M",
      "title": "Use authoritative time and bounded shared counters",
      "acceptance": "Skewed caller clocks cannot reset budgets; counters saturate and TTL/pool limits survive hot-key and churn load.",
      "findings": [
        "R05"
      ],
      "depends_on": [
        "T11"
      ],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T13",
      "wave": 1,
      "repository": "SaaS",
      "owner": "Observability",
      "effort": "M",
      "title": "Remove capability values from telemetry",
      "acceptance": "Canary path tokens are absent from logs, spans, access logs and error cases while correlation remains intact.",
      "findings": [
        "R08"
      ],
      "depends_on": [],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T14",
      "wave": 1,
      "repository": "SaaS",
      "owner": "Platform backend",
      "effort": "S",
      "title": "Make readiness verify dependency function",
      "acceptance": "401/404/429/500, malformed discovery and issuer mismatch are not UP; liveness remains independent.",
      "findings": [
        "R09"
      ],
      "depends_on": [],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T15",
      "wave": 1,
      "repository": "SaaS",
      "owner": "Deployment engineering",
      "effort": "M",
      "title": "Repair and test the chosen deployment recipe",
      "acceptance": "One port/JDBC/issuer contract builds and boots through its actual proxy; missing secrets fail safely.",
      "findings": [
        "R10"
      ],
      "depends_on": [
        "T01",
        "T46"
      ],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T16",
      "wave": 1,
      "repository": "SaaS",
      "owner": "Test engineering",
      "effort": "M",
      "title": "Replace stale outbox mocks with contract coverage",
      "acceptance": "Current unit cases pass and a regression removing scheduler transaction/lease correctness is detected.",
      "findings": [
        "R03"
      ],
      "depends_on": [
        "T07",
        "T08"
      ],
      "status": "Verified scoped acceptance"
    },
    {
      "id": "T17",
      "wave": 2,
      "repository": "SaaS",
      "owner": "Identity backend",
      "effort": "M",
      "title": "Page and checkpoint user synchronization",
      "acceptance": "Multi-page provider fixtures plus a failed page and restart demonstrate complete, idempotent recovery.",
      "findings": [
        "R14"
      ],
      "depends_on": [],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T18",
      "wave": 2,
      "repository": "SaaS",
      "owner": "Identity backend",
      "effort": "M",
      "title": "Bound synchronization transactions",
      "acceptance": "Slow identity HTTP does not hold a DB transaction; one failed persistence unit does not roll back unrelated successful units.",
      "findings": [
        "R14"
      ],
      "depends_on": [
        "T17"
      ],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T19",
      "wave": 2,
      "repository": "Joint",
      "owner": "Security architecture",
      "effort": "M",
      "title": "Enforce provider policy at host startup",
      "acceptance": "The declared profile rejects unknown/stub/disallowed experimental providers before opening resources; no LEGACY bypass in production entry points.",
      "findings": [
        "R16"
      ],
      "depends_on": [
        "T01",
        "T04",
        "T06"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T20",
      "wave": 2,
      "repository": "Joint",
      "owner": "Custody operations",
      "effort": "L",
      "title": "Exercise signing denial and outage boundaries",
      "acceptance": "Wrong tenant/key/algorithm, expired and replayed proofs fail before provider signing; outage does not select a fallback key.",
      "findings": [
        "R16"
      ],
      "depends_on": [
        "T19"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T21",
      "wave": 2,
      "repository": "Joint",
      "owner": "Custody operations",
      "effort": "L",
      "title": "Exercise authorized recovery and replacement",
      "acceptance": "Restart/access recovery preserve identity; replacement has independent authorization, revoked old binding and durable audit. Physical-device tests apply only if included in T01.",
      "findings": [
        "R16"
      ],
      "depends_on": [
        "T20"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T22",
      "wave": 2,
      "repository": "Joint",
      "owner": "Data engineering",
      "effort": "M",
      "title": "Persist independently trusted recovery checkpoints",
      "acceptance": "Checkpoint authenticity and freshness survive DB compromise/restore; application DB alone cannot rewrite the trust anchor.",
      "findings": [
        "R17"
      ],
      "depends_on": [
        "T01"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T23",
      "wave": 2,
      "repository": "Joint",
      "owner": "Data engineering",
      "effort": "L",
      "title": "Fence admission during restore and reconciliation",
      "acceptance": "No new authorization is admitted until ledger/checkpoint/external journal verification completes; failure remains fenced.",
      "findings": [
        "R17"
      ],
      "depends_on": [
        "T22"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T24",
      "wave": 2,
      "repository": "Joint",
      "owner": "Billing and data",
      "effort": "L",
      "title": "Reconcile external effects after restore",
      "acceptance": "Authenticated journal and local outbox reconcile commit/ack-loss and stale restore without duplicate effects or reused authorization.",
      "findings": [
        "R17"
      ],
      "depends_on": [
        "T10",
        "T23"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T25",
      "wave": 2,
      "repository": "Joint",
      "owner": "SRE",
      "effort": "L",
      "title": "Qualify production-shaped backup and recovery",
      "acceptance": "Record agreed RPO/RTO, dataset size and timings; missing WAL/corrupt backup/stale checkpoint fail closed; recovered service resumes safely.",
      "findings": [
        "R17"
      ],
      "depends_on": [
        "T21",
        "T24"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T26",
      "wave": 2,
      "repository": "SaaS",
      "owner": "Data engineering",
      "effort": "M",
      "title": "Qualify schema upgrades and rollback compatibility",
      "acceptance": "Upgrade from two declared supported schema versions under writes; old/new application compatibility and interrupted migration recovery are explicit.",
      "findings": [
        "R10",
        "R12"
      ],
      "depends_on": [
        "T15"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T27",
      "wave": 2,
      "repository": "Joint",
      "owner": "Security test engineering",
      "effort": "L",
      "title": "Complete cross-tenant negative authorization matrix",
      "acceptance": "Every declared public/admin/tenant mutation has wrong-tenant, wrong-role, expired, replay and identifier-substitution outcomes tied to source and tests.",
      "findings": [
        "R16"
      ],
      "depends_on": [
        "T01"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T28",
      "wave": 2,
      "repository": "Joint",
      "owner": "Security engineering",
      "effort": "M",
      "title": "Qualify outbound network restrictions",
      "acceptance": "Declared DID, webhook and provider clients reject disallowed destinations/redirects and bound size/time; tests use actual host integration.",
      "findings": [],
      "depends_on": [
        "T01"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T29",
      "wave": 3,
      "repository": "SaaS",
      "owner": "Observability",
      "effort": "M",
      "title": "Verify distributed traces through billing and SDK calls",
      "acceptance": "A real incoming request produces correlated outgoing provider spans with trace propagation and authenticated export; prove manual RestClient construction receives instrumentation.",
      "findings": [],
      "depends_on": [
        "T07",
        "T13",
        "T46"
      ],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T30",
      "wave": 3,
      "repository": "SaaS",
      "owner": "Observability",
      "effort": "M",
      "title": "Add queue, limiter and recovery signals",
      "acceptance": "Oldest outbox age, leased/failed rows, limiter degradation, recovery fence and reconciliation failures have bounded labels and verified alerts.",
      "findings": [
        "R02",
        "R04",
        "R17"
      ],
      "depends_on": [
        "T09",
        "T11",
        "T23"
      ],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T31",
      "wave": 3,
      "repository": "Joint",
      "owner": "SRE",
      "effort": "M",
      "title": "Define measurable service objectives and alert ownership",
      "acceptance": "Availability, latency, signing and delivery objectives have error budgets, accountable owners and tested notification acknowledgement.",
      "findings": [],
      "depends_on": [
        "T01",
        "T30"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T32",
      "wave": 3,
      "repository": "Joint",
      "owner": "SRE and security",
      "effort": "M",
      "title": "Qualify telemetry privacy and retention",
      "acceptance": "Access controls and retention are enforced in the selected backend; sensitive canaries never reach storage; cardinality/load limits are measured.",
      "findings": [
        "R08"
      ],
      "depends_on": [
        "T13",
        "T29"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T33",
      "wave": 3,
      "repository": "Joint",
      "owner": "Performance engineering",
      "effort": "L",
      "title": "Run representative multi-node soak and overload tests",
      "acceptance": "Agree workload first; run proposed 72-hour steady/peak soak and burst/fault phases, tracking p99, saturation, queue age, DB growth and recovery. This is a target, not a completed measurement.",
      "findings": [
        "R02",
        "R05",
        "R14"
      ],
      "depends_on": [
        "T08",
        "T12",
        "T18",
        "T31"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T34",
      "wave": 3,
      "repository": "Joint",
      "owner": "Performance engineering",
      "effort": "M",
      "title": "Record scale ceilings and backpressure policy",
      "acceptance": "Document tested tenant/data/request limits, capacity headroom and bounded degradation, including KMS/IdP/billing outages.",
      "findings": [],
      "depends_on": [
        "T33"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T35",
      "wave": 3,
      "repository": "Joint",
      "owner": "Test engineering",
      "effort": "M",
      "title": "Define risk-based coverage and mutation gates",
      "acceptance": "Critical auth/custody/claim/recovery branches have explicit agreed floors (proposed 90% line, 85% branch) and meaningful mutation checks; exceptions are reviewed, not hidden.",
      "findings": [
        "R13"
      ],
      "depends_on": [
        "T16",
        "T20",
        "T24",
        "T27"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T36",
      "wave": 3,
      "repository": "SaaS",
      "owner": "Frontend engineering",
      "effort": "M",
      "title": "Make browser tests deterministic and enforce coverage",
      "acceptance": "Classify current network warnings, add missing fixtures and fail unexpected requests without the prior worker serialization problem; CI runs coverage with agreed floors.",
      "findings": [
        "R13"
      ],
      "depends_on": [],
      "status": "Verified scoped acceptance"
    },
    {
      "id": "T37",
      "wave": 3,
      "repository": "Joint",
      "owner": "Test engineering",
      "effort": "M",
      "title": "Bind test discovery and skips to release evidence",
      "acceptance": "Test IDs/counts, failures, documented optional skips and required provider profiles are archived and checked against the immutable candidate pair.",
      "findings": [
        "R11",
        "R13"
      ],
      "depends_on": [
        "T02",
        "T35",
        "T36"
      ],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T38",
      "wave": 3,
      "repository": "SaaS",
      "owner": "Release engineering",
      "effort": "M",
      "title": "Build the runtime image in CI",
      "acceptance": "bootJar, frontend assets and OCI image are built from the candidate pair; production-profile startup and smoke tests run against that image.",
      "findings": [
        "R12"
      ],
      "depends_on": [
        "T02",
        "T15"
      ],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T39",
      "wave": 3,
      "repository": "SaaS",
      "owner": "Supply-chain security",
      "effort": "M",
      "title": "Pin inputs and generate SBOM/provenance",
      "acceptance": "Actions/base image are immutable; dependency/image scans enforce a defined policy; SBOM and provenance identify both repository commits.",
      "findings": [
        "R12"
      ],
      "depends_on": [
        "T38"
      ],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T40",
      "wave": 3,
      "repository": "Joint",
      "owner": "Release engineering",
      "effort": "M",
      "title": "Verify artifact identity during promotion",
      "acceptance": "A modified image, wrong source pair or untrusted attestation is rejected; the tested digest is the promoted digest.",
      "findings": [
        "R11",
        "R12"
      ],
      "depends_on": [
        "T39"
      ],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T41",
      "wave": 3,
      "repository": "SaaS",
      "owner": "Release engineering",
      "effort": "L",
      "title": "Exercise canary rollout and rollback",
      "acceptance": "Promote a qualified digest with explicit health/error-budget gates and demonstrate rollback with the supported schema compatibility window.",
      "findings": [
        "R12"
      ],
      "depends_on": [
        "T26",
        "T31",
        "T40"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T42",
      "wave": 4,
      "repository": "Joint",
      "owner": "Documentation owners",
      "effort": "M",
      "title": "Publish one production support and operations contract",
      "acceptance": "Setup, configuration precedence, limits, provider scope, backup, rotation, incident and rollback instructions match tested commands and evidence.",
      "findings": [
        "R16",
        "R17"
      ],
      "depends_on": [
        "T25",
        "T34",
        "T41"
      ],
      "status": "Implemented in part; acceptance evidence incomplete"
    },
    {
      "id": "T43",
      "wave": 4,
      "repository": "Joint",
      "owner": "SRE",
      "effort": "M",
      "title": "Run an operator drill from the documentation",
      "acceptance": "An operator other than the author executes restore, custody outage, stuck-delivery redrive and rollback using only published runbooks; gaps are fixed.",
      "findings": [],
      "depends_on": [
        "T42"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T44",
      "wave": 4,
      "repository": "Joint",
      "owner": "Independent reviewer",
      "effort": "M",
      "title": "Re-review closure evidence and remaining risks",
      "acceptance": "All P1 findings are closed by behavior tests, scope exclusions are explicit, and evidence is tied to the exact released candidate pair.",
      "findings": [],
      "depends_on": [
        "T37",
        "T43"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T45",
      "wave": 4,
      "repository": "Joint",
      "owner": "Review owner",
      "effort": "S",
      "title": "Recalculate scores only after acceptance",
      "acceptance": "Each repository is above 9.7 unrounded, every critical category is at least 9.7, and production acceptance gates pass. Target 9.8; no points are awarded simply for adding documentation/tests.",
      "findings": [],
      "depends_on": [
        "T44"
      ],
      "status": "Open: implementation and/or production qualification required"
    },
    {
      "id": "T46",
      "wave": 1,
      "repository": "SaaS",
      "owner": "Platform backend",
      "effort": "S",
      "title": "Remove the Spring request-context bean collision",
      "acceptance": "Explicitly named telemetry filter coexists with Spring MVC, overriding stays disabled, smoke startup and affected integration cases pass.",
      "findings": [
        "R18"
      ],
      "depends_on": [],
      "status": "Verified scoped acceptance"
    }
  ],
  "verification": {
    "backend": {
      "tests": 583,
      "passed": 580,
      "skipped": 3
    },
    "frontend": {
      "saas_commit": "17d13e9a6ee0df29d2a0c7e1215d4abf2b3bb254",
      "tests": 302,
      "passed": 302,
      "failed": 0,
      "coverage_scope": "Application code only, with test helpers and fixtures excluded",
      "crypto_scope": "Real WebCrypto encryption/decryption, wrong-holder and authentication-tag rejection, complete envelope validation; device/browser interoperability remains separate"
    },
    "sdk": {
      "sdk_commit": "dbec32c05f9da1f6be4b8932bb0b207cb6d18052",
      "tests": 667,
      "passed": 667,
      "failed": 0,
      "skipped": 0,
      "modules": {
        "did/registrar-server-spring": {
          "passed": 1,
          "failed": 0,
          "skipped": 0,
          "tests": 1
        },
        "kms/plugins/hashicorp": {
          "passed": 27,
          "failed": 0,
          "skipped": 0,
          "tests": 27
        },
        "credentials/credential-api": {
          "passed": 399,
          "failed": 0,
          "skipped": 0,
          "tests": 399
        },
        "credentials/plugins/status-list/bitstring": {
          "passed": 41,
          "failed": 0,
          "skipped": 0,
          "tests": 41
        },
        "credentials/plugins/status-list/token": {
          "passed": 14,
          "failed": 0,
          "skipped": 0,
          "tests": 14
        },
        "credentials/plugins/status-list/database": {
          "passed": 6,
          "failed": 0,
          "skipped": 0,
          "tests": 6
        },
        "wallet/plugins/file": {
          "passed": 26,
          "failed": 0,
          "skipped": 0,
          "tests": 26
        },
        "wallet/plugins/database": {
          "passed": 28,
          "failed": 0,
          "skipped": 0,
          "tests": 28
        },
        "credentials/plugins/verifiable-intent": {
          "passed": 125,
          "failed": 0,
          "skipped": 0,
          "tests": 125
        }
      },
      "cases": [
        {
          "module": "did/registrar-server-spring",
          "id": "org.trustweave.did.registrar.server.spring.RegistrarErrorResponseTest#errors never expose provider messages and cancellation propagates()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.AlgorithmMappingTest#test resolve key name with custom transit path()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.AlgorithmMappingTest#test from vault key type unknown returns null()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.AlgorithmMappingTest#test from vault key type for all supported types()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.AlgorithmMappingTest#test from vault key type case insensitive()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.AlgorithmMappingTest#test to vault hash algorithm()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.AlgorithmMappingTest#test unsupported algorithm throws exception()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.AlgorithmMappingTest#test to vault key type for all supported algorithms()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.AlgorithmMappingTest#test resolve key name()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.AlgorithmMappingTest#Ed25519 conversion rejects truncated keys and unrelated DER prefixes()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultKeyManagementServiceProviderTest#test provider create with address()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultKeyManagementServiceProviderTest#test provider supports algorithm by name()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultKeyManagementServiceProviderTest#test provider name()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultKeyManagementServiceProviderTest#test provider supported algorithms()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultKeyManagementServiceProviderTest#test provider create with options()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultKeyManagementServiceRoundTripTest#distinct algorithms encode distinctly()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultKeyManagementServiceRoundTripTest#every advertised algorithm round-trips()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultKmsConfigTest#test builder creates valid config()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultKmsConfigTest#test builder with AppRole authentication()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultKmsConfigTest#test from map creates valid config()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultKmsConfigTest#test config with empty address throws exception()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultKmsConfigTest#test from map without address throws exception()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultKmsConfigTest#test builder without address throws exception()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultKmsConfigTest#test from map uses default transit path()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultPublicKeyResponseTest#real driver preserves nested versioned keys only in structured data()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultPublicKeyResponseTest#missing malformed and ambiguous versions never fall back to an old key()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultTransitLifecycleTest#create retrieve sign reject and reopen against real Transit()",
          "status": "passed"
        },
        {
          "module": "kms/plugins/hashicorp",
          "id": "org.trustweave.hashicorpkms.VaultTransitRoutingTest#default client sends Transit requests without KV-v2 rewriting()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.Bbs2023UnsupportedTest#no proof engine claims the bbs-2023 suite()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.Bbs2023UnsupportedTest#a credential claiming the bbs-2023 cryptosuite does not verify()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialLifecycleIntegrationTest#test verification fails with invalid issuer DID()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialLifecycleIntegrationTest#test issuance fails with unsupported format()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialLifecycleIntegrationTest#test full credential lifecycle - issue and verify()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialLifecycleIntegrationTest#test batch verification()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialLifecycleIntegrationTest#test verification fails with credential missing proof()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialLifecycleIntegrationTest#test issuance fails with too many claims()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialLifecycleIntegrationTest#test credential lifecycle with expiration check()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServiceExtensionsTest#test toCbor and fromCbor round trip()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServiceExtensionsTest#test toJsonLd extension function()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServiceExtensionsTest#test all format conversions round trip()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServiceExtensionsTest#test toJwt and fromJwt round trip()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServiceExtensionsTest#test toCbor extension function()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServiceExtensionsTest#test fromJwt extension function()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServiceExtensionsTest#test toJsonLd and fromJsonLd round trip()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServiceExtensionsTest#test fromCbor extension function()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServiceExtensionsTest#test toJwt extension function()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServiceExtensionsTest#test fromJsonLd extension function()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServicesTest#test credentialService with signer and optional parameters()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServicesTest#test createCredentialService with single format()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServicesTest#test createCredentialService with all formats()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServicesTest#test credentialService with didResolver only()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServicesTest#test credentialService with signer function()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServicesTest#test credentialService with all optional parameters()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServicesTest#test createCredentialService with KMS creates service successfully()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.CredentialServicesTest#test createCredentialService with unsupported format()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test hasClaim returns true for existing claim()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test isExpired returns false for non-expired credential()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test getClaim returns claim value()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test isExpired returns true for expired credential()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test isNotEmpty returns false for empty presentation()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test isNotEmpty returns true for non-empty presentation()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test isEmpty returns true for empty presentation()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test hasClaim returns false for non-existing claim()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test hasType returns true for existing type()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test credentialsByType filters credentials by type()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test hasType returns false for non-existing type()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test isExpiredAt checks expiration at specific time()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test typeStrings returns list of type strings()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test allCredentialTypes returns all types from all credentials()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test credentialCount returns correct count()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test isValid returns true for valid credential()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test isValid returns false for expired credential()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test isExpired returns false for credential without expiration()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test isValidAt checks validity at specific time()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test getClaim returns null for non-existing claim()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.extensions.CredentialExtensionsTest#test isEmpty returns false for non-empty presentation()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CanonicalizationKnownAnswerTest#proof options reconstructed the way verification does match the W3C canonical form()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CanonicalizationKnownAnswerTest#signed spec credential minus proof canonicalizes to the same N-Quads (verification-side document)()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CanonicalizationKnownAnswerTest#composed Data Integrity payload matches the spec's combined hash and verifies the spec signature()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CanonicalizationKnownAnswerTest#spec proof options document canonicalizes to the exact N-Quads published by W3C()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CanonicalizationKnownAnswerTest#unsecured spec credential canonicalizes to the exact N-Quads published by W3C()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateContext with both VC contexts()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateNotBefore with clock skew tolerance()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateContext with empty context()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateProofExists with no proof()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateContext with valid VC 1_1 context()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateContext with valid VC 2_0 context()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateTrust with no trust policy()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateContext with invalid context()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateNotBefore when checkNotBefore is false()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateProofExists with proof present()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateExpiration with expired credential()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateNotBefore when validFrom is null()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateTrust with untrusted issuer()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateExpiration when expirationDate is null()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateExpiration when checkExpiration is false()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateNotBefore with valid credential()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateExpiration with valid credential()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateExpiration with clock skew tolerance()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateTrust with non-DID issuer()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateTrust with trusted issuer()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.CredentialValidationTest#test validateNotBefore with future validFrom()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.ErrorHandlingTest#test handleIssuanceErrors with IOException()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.ErrorHandlingTest#test validateEngineAvailability with not ready engine()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.ErrorHandlingTest#test handleIssuanceErrors with generic Exception()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.ErrorHandlingTest#test validateEngineAvailability with available engine()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.ErrorHandlingTest#test validateEngineAvailability with unavailable engine()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.ErrorHandlingTest#test handleIssuanceErrors with IllegalStateException()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.ErrorHandlingTest#test handleIssuanceErrors with Exception without message()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.ErrorHandlingTest#test handleIssuanceErrors with IllegalArgumentException()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.ErrorHandlingTest#test handleIssuanceErrors with successful operation()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.ErrorHandlingTest#test handleIssuanceErrors with TimeoutException()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.ErrorHandlingTest#test validateEngineAvailability with different format()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.ErrorHandlingTest#test handleIssuanceErrors with RuntimeException()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.infrastructure.JsonWebSignature2020KeyBindingTest#a key whose type is not EC is rejected on the ECDSA path()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.infrastructure.JsonWebSignature2020KeyBindingTest#a matching key and algorithm still verifies()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.infrastructure.JsonWebSignature2020KeyBindingTest#a key whose declared curve contradicts the algorithm is rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateCredentialStructure with valid credential()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateCredentialClaimsCount at max count()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateVerificationMethodId with ID exceeding max length()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateCredentialStructure with invalid issuer IRI length()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateCredentialStructure with invalid subject IRI length()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateCredentialStructure with invalid schema ID length()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateCredentialId with ID exceeding max length()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateSchemaId with schema ID exceeding max length()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validatePresentationCredentialsCount at max count()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateCredentialId with valid ID()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateCredentialClaimsCount exceeding max()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validatePresentationStructure with valid presentation()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validatePresentationCredentialsCount exceeding max()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateIri with IRI exceeding max length()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validatePresentationCredentialsCount with valid count()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateCredentialId with ID at max length()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateCredentialClaimsCount with valid count()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateDid with DID exceeding max length()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateSchemaId with valid schema ID()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validatePresentationStructure with invalid holder IRI length()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateVerificationMethodId with valid ID()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validatePresentationStructure with invalid credential in presentation()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateDid with valid DID()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateIri with valid IRI()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.InputValidationTest#test validateCredentialStructure with invalid ID length()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#test dropped credentialSubject claims are rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#test toJakartaObject with deeply nested structure()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#test undefined claim inside credentialSubject array is rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#test canonicalization with empty document fails closed()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#test canonicalization without context fails closed - no plain JSON fallback()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#canonicalization refuses a document with more blank nodes than the limit()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#canonicalization still accepts a document within the blank-node limit()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#test toJakartaObject with very large array()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#test canonicalization with special characters()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#test context dropping the credentialSubject term entirely fails closed()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#test dropped claim is caught even when an extra expanding term masks the property count()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#test non-object credentialSubject fails closed()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#test fully defined nested credentialSubject claims canonicalize successfully()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#test canonicalization with extremely large document()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#test toJakartaObject with many fields()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#test nested undefined credentialSubject claim is rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#test canonicalization with document at size boundary()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsSecurityTest#test canonicalization with unresolvable context fails closed()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#canonicalizeDocument with no credentialSubject does not throw on the subject-id guard()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#test toJakartaObject with deep nesting()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#test canonicalizeDocument without context throws instead of falling back()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#canonicalizeDocument accepts valid absolute credentialSubject ids()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#canonicalizeDocument relative-IRI guard does not reject a JSON null credentialSubject id()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#canonicalizeDocument rejects a relative-IRI credentialSubject id - bare uuid()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#canonicalizeDocument rejects a fragment-only credentialSubject id()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#test toJakartaObject with null handling()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#canonicalizeDocument rejects an invalid (non-relative) id in any subject of a credentialSubject array()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#test toJakartaObject with simple object()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#canonicalizeDocument accepts a credentialSubject with no id - anonymous blank node()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#canonicalizeDocument rejects a bare path credentialSubject id()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#canonicalizeDocument rejects syntactically-invalid (not just relative) credentialSubject ids()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#test toJakartaObject with nested object()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#canonicalizeDocument accepts an absolute urn-uuid credentialSubject id()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#canonicalizeDocument rejects a relative id in any subject of a credentialSubject array()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#test toJakartaObject with array preserves element types()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#test canonicalizeDocument with valid document and defined claim terms()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#test toJakartaObject with boolean values()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#test toJakartaObject with number types()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#test canonicalizeDocument with unresolvable remote context throws()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#test canonicalizeDocument drops undefined claims - fails closed()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#test canonicalizeDocument with complex nested structure()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#test canonicalizeDocument with empty object throws()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#test canonicalizeDocument respects size limit()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#canonicalizeDocument accepts an absolute https credentialSubject id()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#canonicalizeDocument accepts an absolute did credentialSubject id()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.JsonLdUtilsTest#test canonicalizeDocument is deterministic regardless of property order()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.PresentationVerificationTest#test verifyDomain with mismatched domain()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.PresentationVerificationTest#test verifyPresentationSignature with garbage signature fails closed()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.PresentationVerificationTest#test verifyDomain with verifyDomain disabled()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.PresentationVerificationTest#kbJwtMaxAge defaults to 10 minutes when not configured()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.PresentationVerificationTest#kbJwtMaxAge honours a configured Duration()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.PresentationVerificationTest#test verifyChallenge with verifyChallenge disabled()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.PresentationVerificationTest#test verifyDomain with matching domain()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.PresentationVerificationTest#test verifyChallenge with mismatched challenge()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.PresentationVerificationTest#test verifyChallenge with no expected challenge provided()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.PresentationVerificationTest#test verifyChallenge with matching challenge()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.PresentationVerificationTest#test verifyPresentationSignature with unsupported proof type()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.PresentationVerificationTest#kbJwtMaxAge rejects non-positive or non-Duration values()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.PresentationVerificationTest#test verifyPresentationSignature with blank proofValue()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.PresentationVerificationTest#test verifyDomain with no expected domain provided()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.PresentationVerificationTest#test resolvePresentationProofVerificationMethod rejects non-authentication purpose()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.PresentationVerificationTest#test verifyProofFormatSupported with empty engines map()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.RevocationCheckerTest#test checkRevocationStatus with no revocation manager()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.RevocationCheckerTest#test checkRevocationStatus with generic Exception()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.RevocationCheckerTest#test checkRevocationStatus with timeout and FAIL_OPEN policy()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.RevocationCheckerTest#test checkRevocationStatus with non-revoked credential()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.RevocationCheckerTest#test checkRevocationStatus with IllegalStateException()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.RevocationCheckerTest#test checkRevocationStatus with revoked credential()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.RevocationCheckerTest#test checkRevocationStatus with IllegalArgumentException()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.RevocationCheckerTest#test checkRevocationStatus with suspended credential()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.RevocationCheckerTest#test checkRevocationStatus with timeout and FAIL_WITH_WARNING policy()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.RevocationCheckerTest#test checkRevocationStatus with timeout and FAIL_CLOSED policy()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.RevocationCheckerTest#test checkRevocationStatus with IOException and FAIL_CLOSED policy()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.RevocationCheckerTest#test checkRevocationStatus with no credentialStatus()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.RevocationCheckerTest#test checkRevocationStatus with UnknownHostException()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.RevocationCheckerTest#test checkRevocationStatus with ConnectException()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerCborTest#test fromCbor converts CBOR bytes back to credential()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerCborTest#test toCbor converts credential to CBOR bytes()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerCborTest#test fromCbor throws exception for invalid CBOR data()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerCborTest#test CBOR conversion with credential containing nested claims()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerCborTest#test CBOR is more compact than JSON()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerCborTest#test fromCbor handles empty bytes()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerCborTest#test round trip CBOR conversion preserves all data()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerCborTest#test CBOR conversion with credential containing expiration()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJsonLdTest#test toJsonLd handles multiple credential types()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJsonLdTest#test toJsonLd creates valid JSON-LD structure()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJsonLdTest#test fromJsonLd recovers credential structure()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJsonLdTest#test toJsonLd includes context()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJsonLdTest#test JSON-LD with DID issuer()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJsonLdTest#test JSON-LD preserves issuance date()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJsonLdTest#test fromJsonLd handles missing required fields()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJsonLdTest#test toJsonLd handles empty claims()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJsonLdTest#test JSON-LD with complex nested claims()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJsonLdTest#test toJsonLd includes type as array()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJsonLdTest#test JSON-LD round trip preserves all claims()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJwtTest#test JWT round trip preserves all claims()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJwtTest#test fromJwt recovers credential structure()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJwtTest#test JWT with DID issuer()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJwtTest#test fromJwt handles invalid JWT format()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJwtTest#test toJwt handles multiple credential types()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJwtTest#test JWT with complex nested claims()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJwtTest#test fromJwt handles malformed JWT payload()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJwtTest#test fromJwt handles empty JWT()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJwtTest#test toJwt handles empty claims()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.internal.transform.CredentialTransformerJwtTest#test toJwt creates valid JWT format()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.IssuerSerializationTest#an object issuer serializes as an object carrying id and name()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.IssuerSerializationTest#unrecognised members of an object issuer survive the round trip()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.IssuerSerializationTest#an object with id deserializes to an object issuer()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.IssuerSerializationTest#a plain string deserializes to an IRI issuer()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.IssuerSerializationTest#an IRI issuer serializes as a plain string()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.IssuerSerializationTest#a type member on an issuer object is an ordinary member()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.performance.PerformanceBenchmarkTest#test large credential serialization performance()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.performance.PerformanceBenchmarkTest#test CBOR round trip performance()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.performance.PerformanceBenchmarkTest#test JSON deserialization performance()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.performance.PerformanceBenchmarkTest#test CBOR size efficiency()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.performance.PerformanceBenchmarkTest#test memory efficiency of CBOR()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.performance.PerformanceBenchmarkTest#test CBOR decoding performance()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.performance.PerformanceBenchmarkTest#test JSON serialization performance()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.performance.PerformanceBenchmarkTest#test CBOR encoding performance()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.Ed25519Signature2020InteropTest#rewriting the proof created timestamp fails verification()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.Ed25519Signature2020InteropTest#flipping a claim on the externally signed credential fails verification()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.Ed25519Signature2020InteropTest#credential signed by the Digital Bazaar stack verifies through the real engine path()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#test extractPublicKey with JWK()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#test extractKeyId with full verification method ID()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#ensureP1363EcdsaJwsSignature fails closed on garbage input()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#decodeEd25519ProofValue accepts multibase u and legacy raw base64url of exactly 64 bytes()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#ensureP1363EcdsaJwsSignature rejects non-ECDSA algorithms()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#test resolveVerificationMethod with DID resolution failure()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#test resolveVerificationMethod with null resolver()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#decodeEd25519ProofValue fails closed on undecodable input()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#ensureP1363EcdsaJwsSignature passes through correctly sized P1363 input()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#extractPublicKey rejects malformed base58 payload()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#test extractKeyId with multiple hash separators()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#extractPublicKey from base58btc multibase with ed25519 multicodec prefix verifies signatures()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#extractPublicKey from base64url multibase()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#test resolveVerificationMethod with valid DID and resolver()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#extractPublicKey rejects multibase with non-ed25519 multicodec prefix()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#extractPublicKey rejects unsupported multibase prefix()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#test resolveVerificationMethod with null verification method ID uses first verification method if no assertion method()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#extractPublicKey from base58btc multibase with raw 32-byte key()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#test resolveVerificationMethod with non-DID IRI()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#test extractKeyId with null()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#test extractKeyId with fragment only()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#decodeEd25519ProofValue rejects wrong-length candidates in every encoding()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#test extractPublicKey with known did-key multibase value()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#ensureP1363EcdsaJwsSignature transcodes DER input and preserves the signature()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#test resolveVerificationMethod with null verification method ID returns null if no methods()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#test resolveVerificationMethod with null verification method ID uses first assertion method()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest#decodeEd25519ProofValue accepts canonical multibase z encoding of exactly 64 bytes()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofVerificationMethodBindingTest#the issuer's own verification method resolves()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofVerificationMethodBindingTest#a verification method belonging to another DID does not resolve()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.ProofVerificationMethodBindingTest#a foreign DID reusing the issuer's fragment does not resolve()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtCnfHolderBindingSecurityTest#kb-jwt signed by a different DID than cnf is rejected even when envelope holder matches the attacker()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtCnfHolderBindingSecurityTest#cnf binding is enforced for any presentation proof format via verifyCnfHolderBinding()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtCnfHolderBindingSecurityTest#cnf round-trip presentation verifies without opting into enforceHolderBinding()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtCnfHolderBindingSecurityTest#legacy credential without cnf keeps envelope-holder binding behaviour()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtCnfHolderBindingSecurityTest#issuance embeds cnf kid bound to the holder DID()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtCnfHolderBindingSecurityTest#envelope holder differing from cnf DID is rejected even with a genuine holder kb-jwt()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtCnfHolderBindingSecurityTest#presentation proof carrying a different issuer-signed jwt than the credential is rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest#kb-jwt bound to different disclosures fails sd_hash check()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest#issuer key not listed under assertionMethod is rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest#presentation with stripped kb-jwt fails()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest#kb-jwt older than the default max age is rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest#presentation without kb-jwt fails when proof verification is required()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest#holder binding rejects prefix-matching verification method DID()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest#envelope claim not backed by any disclosure is rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest#sd-jwt sign and verify round-trip succeeds()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest#envelope claim value differing from disclosure value is rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest#stripping envelope expirationDate does not bypass expired signed exp()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest#kb-jwt max age is configurable via the kbJwtMaxAge additional option()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest#kb-jwt with wrong audience fails verification()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest#rewriting envelope expirationDate to extend validity is rejected as tampered()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest#signed iss differing from envelope issuer is rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest#kb-jwt presentation round-trip passes full service verification()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest#holder binding accepts exact DID match()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest#kb-jwt with wrong nonce fails verification()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineTest#test createPresentation with selective disclosure()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineTest#test createPresentation()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineTest#test verify with credential missing proof()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineTest#test issue with expiration date()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineTest#test issue without expiration date()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineTest#test verify with expired credential()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineTest#test createPresentation with empty credentials()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineTest#test issue with wrong format()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineTest#test initialize and close()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineTest#test verify with invalid SD-JWT format()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineTest#test verify with valid credential()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineTest#test engine properties()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineTest#test issue with valid request()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineTest#test engine is ready by default()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.SdJwtProofEngineTest#test initialize with config()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineKeyFormatsTest#ES256K JsonWebSignature2020 round-trip with a DER-emitting KMS()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineKeyFormatsTest#credential verification fails closed when multibase carries a non-ed25519 multicodec()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineKeyFormatsTest#credential verifies when issuer DID document only carries publicKeyMultibase()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineKeyFormatsTest#ES256 JsonWebSignature2020 round-trip with a DER-emitting KMS()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineSecurityTest#issuing a credential with claims undefined in its context fails closed()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineSecurityTest#presentation signature covers proof options - tampered challenge fails()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineSecurityTest#JsonWebSignature2020 tampered credentialSubject claim fails verification()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineSecurityTest#JsonWebSignature2020 sign and verify round-trip succeeds()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineSecurityTest#verification method not listed under assertionMethod is rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineSecurityTest#sign and verify round-trip succeeds with proof options covered()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineSecurityTest#tampering with proof created timestamp after signing fails verification()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineSecurityTest#tampering with proof challenge after signing fails verification()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineSecurityTest#proof with keyAgreement proofPurpose is rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineSecurityTest#tampering with proof domain after signing fails verification()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineSecurityTest#tampering with a credentialSubject claim after signing fails verification()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineTest#verify fails closed for a credential whose subject id is an invalid IRI()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineTest#test createPresentation with selective disclosure()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineTest#test createPresentation()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineTest#test verify with credential missing proof()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineTest#test verify with credential missing issuer()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineTest#test verify with expired credential()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineTest#test createPresentation with empty credentials()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineTest#verify canonicalization input rejects an invalid subject id - signing input guard is in the verify path()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineTest#test issue with wrong format()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineTest#test initialize and close()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineTest#test verify with valid credential()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineTest#test engine properties()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineTest#test issue with valid request()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineTest#test issue with proof options()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineTest#test engine is ready by default()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineTest#test initialize with config()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineVc20Test#dual-context credentials are treated as VC 1_1 for field emission()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineVc20Test#tampering with validUntil on a VC 2_0 credential fails verification()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineVc20Test#default issuance remains VC 1_1 with issuanceDate and expirationDate()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineVc20Test#v2 base context is hoisted to the first context position()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineVc20Test#issuing with the v2 base context emits a VC 2_0 credential that verifies()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.proof.internal.engines.VcLdProofEngineVc20Test#dual-context issuance fails closed - the official W3C v1 and v2 contexts are incompatible()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.qr.QrCodeParserTest#test parse HTTP URL with presentation request parameters()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.qr.QrCodeParserTest#test parse credential_offer with malformed JSON throws exception()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.qr.QrCodeParserTest#test parse HTTP URL with credential_offer parameter()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.qr.QrCodeParserTest#test parse presentation request URL with client_id and request_uri()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.qr.QrCodeParserTest#test parse credential offer URL with credential_offer_uri()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.qr.QrCodeParserTest#test parse URL with URL encoding()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.qr.QrCodeParserTest#test parse credential offer URL with single credential_offer JSON parameter()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.qr.QrCodeParserTest#test parse HTTP URL with credential offer parameters()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.qr.QrCodeParserTest#test parse credential_offer JSON without credential_issuer throws exception()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.qr.QrCodeParserTest#test parse credential offer URL with credential_issuer()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.qr.QrCodeParserTest#test parse URL with empty query string throws exception()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.qr.QrCodeParserTest#test parse presentation request URL with only request_uri()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.qr.QrCodeParserTest#test parse unrecognized format throws exception()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.security.SecurityValidationTest#test credential size maximum boundary()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.security.SecurityValidationTest#test status list check size limit()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.security.SecurityValidationTest#test canonicalized document size limit()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.security.SecurityValidationTest#test adversarial input - very long strings at boundaries()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.security.SecurityValidationTest#test Ed25519 signature length constant()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.security.SecurityValidationTest#test verification method ID maximum length boundary()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.security.SecurityValidationTest#test claims count maximum boundary()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.security.SecurityValidationTest#test IRI maximum length boundary()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.security.SecurityValidationTest#test presentation credentials count maximum()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.security.SecurityValidationTest#test presentation size maximum boundary()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.security.SecurityValidationTest#test schema ID maximum length boundary()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.security.SecurityValidationTest#test DID maximum length boundary()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.security.SecurityValidationTest#test credential ID maximum length boundary()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.security.SecurityValidationTest#test security constants are consistent()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerCborTest#test fromCbor converts CBOR bytes back to credential()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerCborTest#test toCbor converts credential to CBOR bytes()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerCborTest#test fromCbor throws exception for invalid CBOR data()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerCborTest#test CBOR conversion with credential containing nested claims()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerCborTest#test CBOR is more compact than JSON()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerCborTest#test fromCbor handles empty bytes()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerCborTest#test round trip CBOR conversion preserves all data()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerCborTest#test CBOR conversion with credential containing expiration()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJsonLdTest#test toJsonLd handles multiple credential types()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJsonLdTest#test toJsonLd creates valid JSON-LD structure()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJsonLdTest#test fromJsonLd recovers credential structure()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJsonLdTest#test toJsonLd includes context()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJsonLdTest#test JSON-LD with DID issuer()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJsonLdTest#test JSON-LD preserves issuance date()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJsonLdTest#test fromJsonLd handles missing required fields()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJsonLdTest#test toJsonLd handles empty claims()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJsonLdTest#test JSON-LD with complex nested claims()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJsonLdTest#test toJsonLd includes type as array()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJsonLdTest#test JSON-LD round trip preserves all claims()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJwtTest#test JWT round trip preserves all claims()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJwtTest#test fromJwt recovers credential structure()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJwtTest#test JWT with DID issuer()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJwtTest#test fromJwt handles invalid JWT format()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJwtTest#test toJwt handles multiple credential types()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJwtTest#test JWT with complex nested claims()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJwtTest#test fromJwt handles malformed JWT payload()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJwtTest#test fromJwt handles empty JWT()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJwtTest#test toJwt handles empty claims()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.transform.CredentialTransformerJwtTest#test toJwt creates valid JWT format()",
          "status": "passed"
        },
        {
          "module": "credentials/credential-api",
          "id": "org.trustweave.credential.VcLdProofEngineFactoryTest#exposes a public VC-LD proof engine()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#expandStatusList applied twice accumulates size()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#buildStatusListVc signs a real VC under the VC 2_0 context via the production proof engine()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#checkStatusByCredentialId fails closed for an unassigned credential()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#buildStatusListVc without configured signer fails closed with ConfigException()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#assignCredentialIndex rejects an explicit out-of-range index()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#getStatusListStatistics reflects revokedCount correctly()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#auto index assignment retries past an index claimed by a concurrent writer()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#expandStatusList builds on the locked size and does not truncate a concurrent expansion()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#updateStatusListBatch does not lose an interleaved concurrent update()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#factory rejects a non-http(s) baseUrl at construction()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#status checks use the stored bits_per_entry not the reading manager's constructor value()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#buildStatusListVc rejects a signed VC whose issuer does not match the status list issuer()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#assignCredentialIndex auto-assigns sequential indices()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#factory rejects a malformed baseUrl at construction()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#getCredentialIndex returns null for unassigned credential()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#revokeCredentials batch revokes all provided credentials()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#bit packing is MSB-first - the left-most bit of each byte is the lowest index()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#expandStatusList preserves the multibase prefix MSB-first bit order and existing bits()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#tampering encodedList breaks the real proof - revocation data is signed()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#expandStatusList does not lose an interleaved concurrent update()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#assignCredentialIndex is idempotent for the same credential()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#decoding rejects legacy un-prefixed encodedList values fail-closed()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#encodedList is multibase u-prefixed gzip-compressed base64url without padding()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#listStatusLists filters by issuerDid()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#buildStatusListVc refuses to sign when the configured key belongs to a different DID()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#buildStatusListVc emits an absolute urn-uuid credentialSubject id when no baseUrl is configured()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#createStatusList enforces the spec minimum of 131072 bits()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#expandStatusList increases the recorded size()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#updateStatusListBatch re-encodes at the locked size and does not truncate a concurrent expansion()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#checkStatusByIndex fails closed when the status list is unknown()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#suspendCredential sets the bit on a suspension-purpose list()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#checkStatusByIndex fails closed with RANGE_ERROR for out-of-range indices()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#factory accepts a valid https baseUrl and yields baseUrl-prefixed subject id()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#unrevokeCredential clears the revocation bit()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#checkStatusByCredentialId fails closed when the status list is unknown()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#deleteStatusList removes the status list()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#buildStatusListVc emits a baseUrl-prefixed absolute credentialSubject id when a baseUrl is configured()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#buildStatusListVc signs via the configured proof engine with the issuer's key()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#revokeCredential sets the bit and checkStatusByCredentialId returns revoked()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#revokeCredential re-encodes at the locked size and does not truncate a concurrent expansion()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/bitstring",
          "id": "org.trustweave.revocation.bitstring.BitstringStatusListManagerTest#revokeCredentials re-encodes at the locked size and does not truncate a concurrent expansion()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/token",
          "id": "org.trustweave.revocation.token.TokenStatusListManagerTest#buildStatusListToken returns a three-part JWT string()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/token",
          "id": "org.trustweave.revocation.token.TokenStatusListManagerTest#buildStatusListToken JWT header contains typ statuslist+jwt()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/token",
          "id": "org.trustweave.revocation.token.TokenStatusListManagerTest#revokeCredential sets the correct bit in the status array()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/token",
          "id": "org.trustweave.revocation.token.TokenStatusListManagerTest#buildStatusListToken JWT payload contains required claims()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/token",
          "id": "org.trustweave.revocation.token.TokenStatusListManagerTest#checkStatusByCredentialId returns not revoked for fresh credential()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/token",
          "id": "org.trustweave.revocation.token.TokenStatusListManagerTest#revokeCredentials batch sets all entries()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/token",
          "id": "org.trustweave.revocation.token.TokenStatusListManagerTest#getStatusListStatistics reflects usedIndices and revokedCount()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/token",
          "id": "org.trustweave.revocation.token.TokenStatusListManagerTest#buildStatusListToken with ttlSeconds includes exp claim()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/token",
          "id": "org.trustweave.revocation.token.TokenStatusListManagerTest#buildStatusListToken JWT payload issuer matches issuerDid()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/token",
          "id": "org.trustweave.revocation.token.TokenStatusListManagerTest#unrevokeCredential clears the bit()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/token",
          "id": "org.trustweave.revocation.token.TokenStatusListManagerTest#buildStatusListToken status_list lst is valid base64url without padding()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/token",
          "id": "org.trustweave.revocation.token.TokenStatusListManagerTest#expandStatusList increases recorded size()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/token",
          "id": "org.trustweave.revocation.token.TokenStatusListManagerTest#2-bit mode revoke and suspend set independent bits()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/token",
          "id": "org.trustweave.revocation.token.TokenStatusListManagerTest#deleteStatusList returns true and removes the entry()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/database",
          "id": "org.trustweave.revocation.database.DatabaseStatusListManagerTest#concurrent allocation across managers preserves unique and stable indices()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/database",
          "id": "org.trustweave.revocation.database.DatabaseStatusListManagerTest#revocation persists and unknown or out of range status never reports active()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/database",
          "id": "org.trustweave.revocation.database.PostgresStatusMutationTest#postgres concurrent revocations and rollback preserve status()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/database",
          "id": "org.trustweave.revocation.database.StatusMutationTest#expansion preserves exact size and rejects invalid growth()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/database",
          "id": "org.trustweave.revocation.database.StatusMutationTest#invalid batches and full-list allocation roll back completely()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/status-list/database",
          "id": "org.trustweave.revocation.database.StatusMutationTest#concurrent single and batch revocations survive across managers()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletFactoryTest#typed encryption key is validated rather than silently ignored()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletFactoryTest#production policy rejects before storage creation()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletFactoryTest#unsafe wallet ids cannot escape or reuse the storage root()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#corruption fails normal reads and is reported by explicit recovery()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#factory typed encryption survives reopen without plaintext leakage()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#status references are unknown until resolved and never imply revoked()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#invalid key length is rejected at construction()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#decrypted credentials are listed correctly()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#relative-path credential id cannot escape the wallet directory()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#query without tag or collection filters still works()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#encrypted store and get round-trip()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#concurrent replacement never exposes partial credential bytes()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#delete with traversal id does not touch files outside the wallet directory()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#wallet without encryption key still round-trips in plaintext()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#query with byTag throws instead of silently returning all credentials()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#plaintext wallet keeps a readable metadata sidecar()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#all standard AES key lengths are accepted()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#absolute-path-looking credential id cannot escape the wallet directory()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#same plaintext stored twice produces different ciphertexts()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#encrypted wallet does not leak the credential id in the metadata sidecar()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#delete removes the encrypted metadata sidecar()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#non-base64 key is rejected at construction()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#query with byCollection throws instead of silently returning all credentials()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#relative and non-normalized storage paths support listing and recovery()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#tampered ciphertext fails with clear storage error instead of corrupt data()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/file",
          "id": "org.trustweave.wallet.file.FileWalletTest#anonymous records retain their storage handles after reopening()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletFactoryTest#factory-created wallet owns its pool and close shuts it down()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletFactoryTest#factory rejects unknown provider names()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletFactoryTest#factory-created wallet works with use block()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#collections are isolated between wallets sharing the same database()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#tagCredential returns false for an unknown credential()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#query byCollection returns only credentials in the collection()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#tagCredential is idempotent()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#multiple byTag calls require all tags()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#close is idempotent()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#query byTag combines with standard predicate filters()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#query byTag returns only credentials carrying the tag()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#close shuts down the pool when the wallet owns it()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#close does not touch an injected DataSource()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#store rejects a credential id already owned by another wallet()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#store upserts on re-store of the same credential()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#query without tag or collection filters returns all matches()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#deleting a credential cleans up its tags and collection memberships()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#query byTag with unknown tag returns empty list instead of all credentials()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#collection lifecycle - create add list remove delete()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#addMetadata merges values and getMetadata returns notes and tags()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#tagCredential then untagCredential round-trips through query byTag()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#list and query find matches beyond the old thousand-row limit()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#store and get round-trip()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#tags are isolated between wallets sharing the same database()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DatabaseWalletTest#addToCollection returns false for unknown credential or collection()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.DeploymentPolicyTest#production rejection precedes configuration or network access()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.PostgresPagingTest#PostgreSQL filters before pagination and has an eligible containment index()",
          "status": "passed"
        },
        {
          "module": "wallet/plugins/database",
          "id": "org.trustweave.wallet.database.PostgresPagingTest#ten thousand records page completely with selective filtering and wallet isolation()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ChainVerifierKnownAnswerTest#each L3 requires its own matching audience and nonce()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ChainVerifierKnownAnswerTest#network fixture rejects recurrence requiring external enforcement()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ChainVerifierKnownAnswerTest#merchant side rejects unevaluable checkout constraints()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ChainVerifierKnownAnswerTest#wrong nonce is rejected even with authentic signed credentials()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ChainVerifierKnownAnswerTest#missing replay expectations fail closed by default()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ChainVerifierKnownAnswerTest#wrong L2 routing breaks the L3 cross-layer sd_hash binding()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ChainVerifierKnownAnswerTest#expired clock fails closed()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ChainVerifierKnownAnswerTest#offline audit opt out is explicit in the result()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CheckoutTrustTest#authenticated cart and merchant replace absent agent assertions()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CheckoutTrustTest#wrong key hash and agent shadow cart are rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CheckoutTrustTest#signed tokens with invalid challenge or lifetime fail closed()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ConstraintCheckerTest#empty or invalid allowlists never authorize an open mandate()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ConstraintCheckerTest#amount_range fails closed when the declared maximum is not numeric at all()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ConstraintCheckerTest#amount_range enforces a maximum larger than Int range()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ConstraintCheckerTest#malformed constraint shapes return violations instead of throwing or dropping entries()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ConstraintCheckerTest#malformed line item constraints fail even under permissive policy()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ConstraintCheckerTest#amount_range fails closed when the declared maximum is not a whole number()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ConstraintCheckerTest#amount_range accepts an amount within a maximum larger than Int range()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ConstraintCheckerTest#budget fails closed when its declared cap is unreadable()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ConstraintCheckerTest#amount_range still enforces an ordinary maximum()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ConstraintCheckerTest#SD-ref allowed_payees accepts a payee that matches a disclosed allowlist entry()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ConstraintCheckerTest#allowlist IDs cannot downgrade to display names and disclosure hashes must match()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ConstraintCheckerTest#SD-ref allowed_payees fails closed for an open mandate when entries are not disclosed()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ConstraintCheckerTest#SD-ref allowed_payees rejects a payee not in the disclosed allowlist()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ConstraintValidationRegressionTest#amount range without required currency must be rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ConstraintValidationRegressionTest#budget must reject a first transaction above its entire cap()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ConstraintValidationRegressionTest#string encoded payment amounts must be rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.ConstraintValidationRegressionTest#negative payment amounts must be rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossLanguageLedgerModelTest#PostgreSQL agrees with Python model through 214 reserve and settlement transitions()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#python-autonomous-payment",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#autonomous-aud",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#autonomous-nonce",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#autonomous-paymentAud",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#autonomous-paymentNonce",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#autonomous-routedL2",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#autonomous-now",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#autonomous-reordered-disclosures",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#autonomous-withheld-payment",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#autonomous-amount-1",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#autonomous-amount-200",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#autonomous-amount-0",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#autonomous-amount-201",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#autonomous-currency",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#python-autonomous-checkout",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#checkout-checkoutAud",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#checkout-checkoutNonce",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#checkout-routedCheckout",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#cart-over-quantity",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#merchant-wrong-audience",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.CrossStackConformanceTest#Python issued immediate positive and adversarial vectors agree()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.Es256AlgorithmPinningTest#a P-256 key presented under a non-ES256 header is rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.Es256AlgorithmPinningTest#a genuine ES256 token verifies()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.Es256AlgorithmPinningTest#a token signed with a curve other than P-256 is rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IntentLedgerDiagnosticsTest#failed health polling withdraws stale gauges and preserves unknown ages()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IntentLedgerDiagnosticsTest#actual ledger connection failures are measured before a connection exists()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IntentLedgerDiagnosticsTest#concurrent operations retain bounded series and coherent cumulative histograms()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IntentLedgerDiagnosticsTest#in flight work is visible while export does not wait for database work()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IntentLedgerDiagnosticsTest#outcomes preserve results exceptions and privacy()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IntentOperationsExerciseTest#instrumented host load failure alert and independent postgres restore()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IntentReliabilityTest#bounded pool sustains mixed multi instance contention without overspend or replay()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IntentReliabilityTest#sustained skewed traffic keeps the pool bounded and the durable ledger consistent()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IntentReliabilityTest#database lock timeout rolls back completely and unrelated mandates progress()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IntentReliabilityTest#counter trigger respects runtime privileges and rolls back failed budget writes()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IntentReliabilityTest#large legacy history migrates atomically and occurrence admission avoids history scans()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IntentReliabilityTest#synchronous commit is enforced without weakening remote apply or leaking pooled settings()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IntentWalRecoveryTest#crash restart and archived WAL restore preserve authorization and settlement at target()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IssuanceRoundTripTest#signed L3 without expiration or issued time is rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IssuanceRoundTripTest#both fulfilments cannot bypass checkout constraints()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IssuanceRoundTripTest#over-budget payment is rejected by constraint enforcement()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IssuanceRoundTripTest#every open mandate must bind the complete agent public key()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IssuanceRoundTripTest#merchant authenticated autonomous checkout verifies and enforces signed quantities()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IssuanceRoundTripTest#payment instrument must be authorized by L2()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IssuanceRoundTripTest#L3 payment presented without its L2 payment mandate is rejected (constraint-bypass guard)()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IssuanceRoundTripTest#chain budget reservation rejects excess and replay without spending on invalid chains()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IssuanceRoundTripTest#issue an immediate chain via KMS and verify it()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.IssuanceRoundTripTest#issue an autonomous chain via KMS and verify it()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.LedgerIntegrityTest#checkpoint detects stale data and includes terminal evidence without exposing identifiers()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.LedgerIntegrityTest#filtered audit role fails instead of authenticating partial data()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.LedgerIntegrityTest#audit rejects inconsistent balances consumption states and evidence without repairing data()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.LedgerIntegrityTest#internally consistent rollback is rejected against external checkpoint()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.LedgerMigrationDocumentationTest#documented schema upgrade is idempotent and preserves legacy reservations()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.LineItemMatcherTest#overlapping alternatives cannot reuse a requirement quota()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.LineItemMatcherTest#invalid shapes quantities and unknown products fail closed()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.LineItemMatcherTest#exact matching allocates positive units to each requirement()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.LineItemMatcherTest#item disclosures must be present and hash bound()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.LineItemMatcherTest#circulation matches exhaustive small cart allocations()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: zero",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: positive",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: maximum integer",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: negative",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: quoted integer",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: fraction",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: integer overflow",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: null amount",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: boolean amount",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: object amount",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: array amount",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: missing amount",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: numeric currency",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: null currency",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: lowercase currency",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: long currency",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: blank currency",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#immediate: missing currency",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: zero",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: positive",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: maximum integer",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: negative",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: quoted integer",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: fraction",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: integer overflow",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: null amount",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: boolean amount",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: object amount",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: array amount",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: missing amount",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: numeric currency",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: null currency",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: lowercase currency",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: long currency",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: blank currency",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PaymentSchemaValidationTest#autonomous: missing currency",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.PostgresIntentLedgerTest#concurrent authorization restart replay and rollback are durable()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.RecurrenceRulesTest#agent UTC dates inclusive frequencies advisory and malformed bounds rejected()",
          "status": "passed"
        },
        {
          "module": "credentials/plugins/verifiable-intent",
          "id": "org.trustweave.credential.vi.RecurrenceRulesTest#merchant subscription metadata must match bounded signed terms()",
          "status": "passed"
        }
      ],
      "report_sha256": {
        "did/registrar-server-spring/TEST-org.trustweave.did.registrar.server.spring.RegistrarErrorResponseTest.xml": "d19951e876c1cc86f367bd26f93918b3a3fd140539c6597dca4675b4e9a84489",
        "kms/plugins/hashicorp/TEST-org.trustweave.hashicorpkms.AlgorithmMappingTest.xml": "71be18348e25d0262c3ae1a6a2564f853b179544a1c93f2fe6ec96ca0d1234d1",
        "kms/plugins/hashicorp/TEST-org.trustweave.hashicorpkms.VaultKeyManagementServiceProviderTest.xml": "e6f1939746c7a37c44d04726bb4df13a53bce5851d3d77e0ebb674886e909808",
        "kms/plugins/hashicorp/TEST-org.trustweave.hashicorpkms.VaultKeyManagementServiceRoundTripTest.xml": "af5157af8132897a230e5ae4c49cbe2a10feebc515191ee543c83474cffd54a2",
        "kms/plugins/hashicorp/TEST-org.trustweave.hashicorpkms.VaultKmsConfigTest.xml": "d21b558d5fa2ca857c2b1fed4d6cdebe7ea3b69360232605c1bd428eb4be6dbf",
        "kms/plugins/hashicorp/TEST-org.trustweave.hashicorpkms.VaultPublicKeyResponseTest.xml": "a396e4d5c3a612a5b2f54d2f20e030ec39225c96b551b1a444c50f3f84fb0bdc",
        "kms/plugins/hashicorp/TEST-org.trustweave.hashicorpkms.VaultTransitLifecycleTest.xml": "eef2f3861a1464a2ec682cbd40ee53884635e75a9132751f7c1c7e9b5f3c8ef6",
        "kms/plugins/hashicorp/TEST-org.trustweave.hashicorpkms.VaultTransitRoutingTest.xml": "96199e62cbfc2b43191defd7a0be45d037a590e7938fd9cedf0b033a775c40a4",
        "credentials/credential-api/TEST-org.trustweave.credential.Bbs2023UnsupportedTest.xml": "2947d20773a6b3b06e72b4cd51a01f05cbe740f7f2c5271a7f76410f17e31f6e",
        "credentials/credential-api/TEST-org.trustweave.credential.CredentialLifecycleIntegrationTest.xml": "1330fcc43dff383670c48b4821c97da8deecb350629517e90ff70518f14a8374",
        "credentials/credential-api/TEST-org.trustweave.credential.CredentialServiceExtensionsTest.xml": "a5545bf58c008c7b422a50f782dff46273ed3f49c04299f1b48c75e55f088443",
        "credentials/credential-api/TEST-org.trustweave.credential.CredentialServicesTest.xml": "9da1523b329c3e39051f0d16aaa67f76713815641e2bc64643b250092f1ebbc5",
        "credentials/credential-api/TEST-org.trustweave.credential.extensions.CredentialExtensionsTest.xml": "1c83f87278447ae47df397226e535b4c26fb1730add71b3e7bd60cc3cb58323e",
        "credentials/credential-api/TEST-org.trustweave.credential.internal.CanonicalizationKnownAnswerTest.xml": "da175b7a846f2d220ed30ad79b7d55e20a45b3cd3152d2d44d7ac15f52b22302",
        "credentials/credential-api/TEST-org.trustweave.credential.internal.CredentialValidationTest.xml": "9d4cbaa510b3a1956378bf63b2d1aab89288975363ff8ab44708998e5e3c7e1f",
        "credentials/credential-api/TEST-org.trustweave.credential.internal.ErrorHandlingTest.xml": "5b370494e25715dec9ee280741ed2bbaf61998ecd4b9edf0fb28b7c87eaa79af",
        "credentials/credential-api/TEST-org.trustweave.credential.internal.infrastructure.JsonWebSignature2020KeyBindingTest.xml": "6b47f4bbebffe7d406b2e978377080d58462581a457c2576750f4b73ff6c69e8",
        "credentials/credential-api/TEST-org.trustweave.credential.internal.InputValidationTest.xml": "2b1b5fdcec1e157e9429f99a7b8e758d51e65bba8625120a73caac5fb251aea9",
        "credentials/credential-api/TEST-org.trustweave.credential.internal.JsonLdUtilsSecurityTest.xml": "bfdf29f2c3d6e8da54b1c3bb40cd0ea6014703124b4607351a3da65b939b0c79",
        "credentials/credential-api/TEST-org.trustweave.credential.internal.JsonLdUtilsTest.xml": "768e190d19231e8b2197f02834aa738f264c20143076fdc81114b027f2c47051",
        "credentials/credential-api/TEST-org.trustweave.credential.internal.PresentationVerificationTest.xml": "42507257f66f226d0fe7cbc56603b651a2c4ddea78b3f1b4d0450e1d1f3a8c12",
        "credentials/credential-api/TEST-org.trustweave.credential.internal.RevocationCheckerTest.xml": "a6f2ead097bbeadac90dacfbf62bb210641563da5219eae8b837aee5968d6c8a",
        "credentials/credential-api/TEST-org.trustweave.credential.internal.transform.CredentialTransformerCborTest.xml": "4aa448c356fba2540bd2e8007724caa3613660e4eb361e0b3f63be72372e5030",
        "credentials/credential-api/TEST-org.trustweave.credential.internal.transform.CredentialTransformerJsonLdTest.xml": "39127f5470f9b030758d1d91fb19b7268a182f28f6f0e68aa4caa7fdd01899a9",
        "credentials/credential-api/TEST-org.trustweave.credential.internal.transform.CredentialTransformerJwtTest.xml": "449e6bbdf9f4c0fb1c40a0bfd0b9500ffe65772fcedc307fc7437de7a1c78255",
        "credentials/credential-api/TEST-org.trustweave.credential.IssuerSerializationTest.xml": "263f806851e8f81bc5ed99c092950c7503022a5fbfd992a11d3e7d7945f5c0f6",
        "credentials/credential-api/TEST-org.trustweave.credential.performance.PerformanceBenchmarkTest.xml": "387a073746a68abed81b241defbbbfae2c88c2f9a10160cb6ea79e86293f31b3",
        "credentials/credential-api/TEST-org.trustweave.credential.proof.internal.engines.Ed25519Signature2020InteropTest.xml": "d877c37db17628b31bba909fa8e629bd2684afee96ac92196bab57ead5647db8",
        "credentials/credential-api/TEST-org.trustweave.credential.proof.internal.engines.ProofEngineUtilsTest.xml": "7fa1d5eaf862ea8859a8b0286d244670fe5ef217acbfb4034ed7b744c4fa86d4",
        "credentials/credential-api/TEST-org.trustweave.credential.proof.internal.engines.ProofVerificationMethodBindingTest.xml": "7187f01476084599edd86c6afc29f5b611c0f00f74ba6553a1b9f744a713bbfd",
        "credentials/credential-api/TEST-org.trustweave.credential.proof.internal.engines.SdJwtCnfHolderBindingSecurityTest.xml": "e2f9df97f5e77549137969ecf9ef5b0a26e92dad62982a10081942c138207e03",
        "credentials/credential-api/TEST-org.trustweave.credential.proof.internal.engines.SdJwtProofEngineSecurityTest.xml": "7347f8d9bab354f1aea8ce1497cc0914f574a41bc3c9caa41384d929d70d4cac",
        "credentials/credential-api/TEST-org.trustweave.credential.proof.internal.engines.SdJwtProofEngineTest.xml": "92c93598ea553a112d7928a6c36422757a6d99091a74f21941ec42445025820f",
        "credentials/credential-api/TEST-org.trustweave.credential.proof.internal.engines.VcLdProofEngineKeyFormatsTest.xml": "bf9fd8749ef7a1e97159ea38529c1ee0db172ba9d65fdb78647d5aff176e9761",
        "credentials/credential-api/TEST-org.trustweave.credential.proof.internal.engines.VcLdProofEngineSecurityTest.xml": "370e8979c5512b9d415370e4b452e034a7cdfb33be04ff6e3021c486b7ae3e4e",
        "credentials/credential-api/TEST-org.trustweave.credential.proof.internal.engines.VcLdProofEngineTest.xml": "9a9fc61055579209702c20688c273f561ec6694142fd319bb5e6974a787255e6",
        "credentials/credential-api/TEST-org.trustweave.credential.proof.internal.engines.VcLdProofEngineVc20Test.xml": "b744e2686bfa44ffabafd1724585176f5a8d03b7a6a3d61391cd03923acd3f4b",
        "credentials/credential-api/TEST-org.trustweave.credential.qr.QrCodeParserTest.xml": "2990991af70fc79f9f15c736bcad7dfbb6665a5da965f90d674554d9804fabb0",
        "credentials/credential-api/TEST-org.trustweave.credential.security.SecurityValidationTest.xml": "fb39425417588d85721ff35a6194f35c300d1296da3b569c8f966d29855f4021",
        "credentials/credential-api/TEST-org.trustweave.credential.transform.CredentialTransformerCborTest.xml": "e24d5058dd74ba7f1a29671b52e2301b39480262552e4d0f60a79825e8342649",
        "credentials/credential-api/TEST-org.trustweave.credential.transform.CredentialTransformerJsonLdTest.xml": "724a40ca26a32ff94c7a33f3795e03fd36d84bce435f8b181782adb6ea586435",
        "credentials/credential-api/TEST-org.trustweave.credential.transform.CredentialTransformerJwtTest.xml": "7a7e146f997ec56d9fa1b71860f34c96250f62ed0f088b974806feb052e30359",
        "credentials/credential-api/TEST-org.trustweave.credential.VcLdProofEngineFactoryTest.xml": "f621e67d9fec2491b03fcfa683c18bb921a95ce2590aee5aca6088af3927f470",
        "credentials/plugins/status-list/bitstring/TEST-org.trustweave.revocation.bitstring.BitstringStatusListManagerTest.xml": "d06a97cbfe9bfbeb2e4be248c78b10f1084f091d21588132f6ab6a0543b7f872",
        "credentials/plugins/status-list/token/TEST-org.trustweave.revocation.token.TokenStatusListManagerTest.xml": "e0e26bfd01d804de3b3e2da2a02b07d6d4ce330c6f5341fc22c7c6925777c763",
        "credentials/plugins/status-list/database/TEST-org.trustweave.revocation.database.DatabaseStatusListManagerTest.xml": "40d24973ddf05fb7ef31bd7de59ffef14341ed97b8e10ac00b7a3bc4e43ba9a8",
        "credentials/plugins/status-list/database/TEST-org.trustweave.revocation.database.PostgresStatusMutationTest.xml": "db4ac99a07d6526268d1d5c99bdcfec975951706519a41a20c15faf0baae1be7",
        "credentials/plugins/status-list/database/TEST-org.trustweave.revocation.database.StatusMutationTest.xml": "1fdf37af97c34ee520f23790b5b64590e607db211acab8fdcc50c42b9c342a7f",
        "wallet/plugins/file/TEST-org.trustweave.wallet.file.FileWalletFactoryTest.xml": "3ad9bd965cf442b783cc4190d6445b884fb27dacacd835e80328ca241ddcd476",
        "wallet/plugins/file/TEST-org.trustweave.wallet.file.FileWalletTest.xml": "84812162fc0ab363ba5c02cb03f922a52f02329a6c3309628dd5d6fb4a6450e5",
        "wallet/plugins/database/TEST-org.trustweave.wallet.database.DatabaseWalletFactoryTest.xml": "dc339354a770df7a13240615858d82be1999cad4a8c69d810abd7375e7cbadad",
        "wallet/plugins/database/TEST-org.trustweave.wallet.database.DatabaseWalletTest.xml": "ca98c45dc13b3477e368d8a78828ed539e5f09ae773e1134552940c91ec936e3",
        "wallet/plugins/database/TEST-org.trustweave.wallet.database.DeploymentPolicyTest.xml": "5c210ca44ac9b897d9840c6dd13c6597edf4a26283503e014cf18ef20a5f6767",
        "wallet/plugins/database/TEST-org.trustweave.wallet.database.PostgresPagingTest.xml": "83fa3e242c726331b3672001ad8c974fa0787c9e7778d29bcc861ef7d4117f0e",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.ChainVerifierKnownAnswerTest.xml": "d4b77ec87573cf47cd3725190cfeeecc2638ee70801bba35952a2666b5c505dd",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.CheckoutTrustTest.xml": "30fb6ba41acda8cc40169d9eb1e0853d4b36b9e7ab025ba625d58d9d55113318",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.ConstraintCheckerTest.xml": "83f44ef3ba000319ad5b2dcbcd7e13adb63c1fb1eccac8541aca39b5b54802e2",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.ConstraintValidationRegressionTest.xml": "caf48a972cd45ce02f44bc068dc76a91e17a1ccbcc6f9433fa59960762e86cd6",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.CrossLanguageLedgerModelTest.xml": "7962f67551f9e5328be8b472e6f1b80199b71d395399332cfa6a2456ed2d9832",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.CrossStackConformanceTest.xml": "42ea25972441d30063f0efe541733275dcbf409f5f96f206a0fb8859aa49a08b",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.Es256AlgorithmPinningTest.xml": "b251359a46bb15a9774a7a1a9566870cb6f3fa151c93b7fd57f8994c53f2c011",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.IntentLedgerDiagnosticsTest.xml": "b32716d88958ec2207dafb8b9cb578cef5f80864d66c61284e434cb2c21d461f",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.IntentOperationsExerciseTest.xml": "157884abf907d9c0a57123f6f31b63c52503e601914245394d597247dd37c841",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.IntentReliabilityTest.xml": "86994c154e7b712019d3ee7fd3d0bd04cfdfb80d53d14fef188b2f02151ed96d",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.IntentWalRecoveryTest.xml": "40145ab9b12d45e500ed12809a7a7d5b6d1768e977bb76e63467ba832655df48",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.IssuanceRoundTripTest.xml": "ef6e53a58a164a51b038c19aad3db6bbf21a0b8d5844f32895a23894e7fd243c",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.LedgerIntegrityTest.xml": "f97f9724a7deb695663ba12e096e7972f3353d2a6cc312c1f599c41879a49cc1",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.LedgerMigrationDocumentationTest.xml": "51ffd0b2aa2568059aa5fe601d447beacbf6392daec2c0605dfb6e6ca1d71210",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.LineItemMatcherTest.xml": "9322a415c6cc22d2bb787f85d39c84271228e10a4554533f008be6295e3385d3",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.PaymentSchemaValidationTest.xml": "eaa5249f86545b2a6abdad2bd7f1f83e18c65599d6307baa8d7fe7a0d49dd1ed",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.PostgresIntentLedgerTest.xml": "f1f99d7c29d50b11c863851ab60048216285d3e9788fe30d4e079795d48f261a",
        "credentials/plugins/verifiable-intent/TEST-org.trustweave.credential.vi.RecurrenceRulesTest.xml": "8ededab1526a5bb5dcbe31962461d30a30f41d2b808bf1a27f5223ec25b505ee"
      },
      "scope": "Nine affected JVM module suites. Android/device builds, production custody restart/rotation/HA and the entire SDK matrix are not certified by this run."
    },
    "runtime": {
      "updated_utc": "2026-09-11T04:23:15.811617+00:00",
      "saas_commit": "8b67281d0771ee8fdd9a6eb38860a266e5121c9e",
      "sdk_commit": "dbec32c05f9da1f6be4b8932bb0b207cb6d18052",
      "high_critical_gate": "passed",
      "high": 0,
      "critical": 0,
      "spring_boot_version": "4.1.1",
      "docker_image_id": "sha256:a2f946f333cc5da33fc6b454c2a5ae3bf8f71546d80fc7315dd28ec072a1f43a",
      "docker_local_descriptor": "sha256:7caeba64aba3174c9299aca88c18b24c8464f8f06239df67bb4dcee48d45c19f",
      "runtime_uid": "100",
      "archive_sha256": "dea99b9bf4e4ae85d288a3d53c04e9ddcee90c023223f3d7f611fe7d298ff13b",
      "sbom_sha256": "77bd5c31db8c7d4485fe738dbd94eded642c8ef2ba272fc91315d9ad8ecbe931",
      "vulnerabilities_sha256": "bc60ea66e115a8f370e04a060d66bff6b03b5ef7f4f78c338b4ee9b0248ca6d5",
      "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
      "archive_path": "C:\\Users\\steph\\work\\tw-joint-remediation-20260910\\trustweave-saas\\build\\release\\runtime-image.tar",
      "hosted_provenance_verified": false,
      "production_qualified": false,
      "limitations": "Local image, evidence content and digests verified. Hosted attestation, production-profile image startup, promotion/rollback and production custody/recovery exercises remain open."
    }
  },
  "additional_findings": [
    {
      "id": "V01",
      "title": "Packaged runtime vulnerabilities",
      "status": "Verified: all 35 initial HIGH/CRITICAL package findings removed; final image scan has zero HIGH/CRITICAL findings. No exceptions added."
    },
    {
      "id": "V02",
      "title": "Framework support lifecycle",
      "status": "Verified on Spring Boot 4.1.1 with updated modules, test annotations, nullability contracts, tracing support and Resilience4j adapter. The deprecated Jackson 2 compatibility module remains a documented migration follow-up."
    },
    {
      "id": "V03",
      "title": "Dashboard test timeout",
      "status": "Verified in the complete browser suite after replacing expensive link-role polling with a loading transition and direct visible-label anchor assertion."
    },
    {
      "id": "V04",
      "title": "Release evidence checked hashes but not policy",
      "status": "Eleven script tests cover stale sources, incomplete discovery, duplicate identities, failed scans, SBOM mismatches and archive metadata. Docker index/config identities are distinguished."
    },
    {
      "id": "V05",
      "title": "JWT subject and error handling",
      "status": "Missing/blank subjects fail before user lookup; authentication errors return a safe 401 Bearer challenge. Regressions pass."
    },
    {
      "id": "V06",
      "title": "Raw request URLs in observation attributes",
      "status": "Removed raw URL attributes while retaining route, method and status; matched/unmatched success/error filter regressions pass. External telemetry privacy qualification remains open."
    },
    {
      "id": "V07",
      "title": "Incomplete encrypted-claim envelopes",
      "status": "Browser and server require the algorithm, canonical encoding and all fixed-length key/nonce/tag fields. Browser decryption rejects malformed envelopes and wrong private-key sizes; wrong-holder and tampering cases pass."
    },
    {
      "id": "V08",
      "title": "Fixture code inflated frontend coverage",
      "status": "Corrected recursive exclusions and verified that no test helper appears in the coverage data. Coverage floors were retained and new encryption tests improve application coverage."
    },
    {
      "id": "V09",
      "title": "Module declarations bypassed the dependency catalog",
      "status": "Wallet, status-list, Vault and intent-test declarations now use reviewed catalog versions; affected JVM regressions pass. Android reference-wallet Bouncy Castle declarations were updated to 1.84, but no Android/device qualification is claimed."
    },
    {
      "id": "V10",
      "title": "Protected claims and serialization failed open",
      "status": "Encrypted fields reject unsupported holders and malformed nontext inputs. Mixed production/development profiles cannot enable the portrait plaintext exception. Serialization errors propagate instead of returning an empty credential, and SD-JWT format requires its matching proof. Six regression tests cover these boundaries."
    }
  ],
  "runtime_checkpoint": {
    "updated_utc": "2026-09-11T03:31:24.749206+00:00",
    "saas_commit": "8d3724f3b66df7756fa569a621b81522872d8304",
    "sdk_commit": "477088ffaff2ddf89300bf93fba31c7ed4fe9eef",
    "high_critical_gate": "passed",
    "high": 0,
    "critical": 0,
    "docker_image_id": "sha256:6b42913116f75f197bb2836cd646029765f8ef1fbc23f82e273a28378203ddb6",
    "runtime_uid": "100",
    "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
    "limitations": "Local tested security-patch checkpoint. Boot 3.5 OSS support has ended; maintained-line migration and hosted provenance/promotion remain separate gates.",
    "archive_sha256": "c2bfffff14a0c0f45eee9915de01ab8540127a652a2ff4714eec1ad9c6ec54d4",
    "sbom_sha256": "f57fa88e76bdeead27b4458c08d6c90be27671b6d197aad21ed2d92edaddc6c0",
    "vulnerabilities_sha256": "5fdafe976d99bf90060acad8812a4155b95c5743fd2514bd05ed3506033e1241"
  },
  "release_limits": "Production acceptance remains open: the supported custody/platform and workload envelope, independently trusted recovery checkpoints, restore admission fencing, external-effect reconciliation, hosted artifact provenance/promotion, operator drills, critical-path mutation coverage and sustained load qualification are not established by these local tests. Some recovery work is unimplemented architecture, not merely missing paperwork."
}