{
  "schema_version": "tracemint.website-evaluation-example.v1",
  "recorded_at": "2026-09-22T10:54:51.358735+00:00",
  "scope": "One local deterministic configuration-rule run and two parser-only imports on authored CC0 fixtures.",
  "product_source": {
    "commit": "9174a1c9bfbe7147bb59d88ce1d2ea89f1807bc7",
    "identity_method": "Every imported product Python module compared byte-for-byte with git show COMMIT:PATH",
    "files": {
      "api/services/__init__.py": {
        "sha256": "c3f13c40ae919ef292bd4f3ae9e0def01091576eab026e1ddd1f98834e8e5825",
        "matches_commit": true
      },
      "api/services/build_provenance.py": {
        "sha256": "5eb5c25bae96b9820116b6ec1b77202676a7d51c8069790bc6d25bf46218067d",
        "matches_commit": true
      },
      "api/services/scanned_file_reader.py": {
        "sha256": "82741887fb80ec6f68c840f6df0272e4a73672f2c52635e3409fe037498e809e",
        "matches_commit": true
      },
      "api/services/supply_chain_posture.py": {
        "sha256": "296e91ee511b8b931e5bbd42c8bcb5b37170f2fa93361fb25896ff2e765ebf17",
        "matches_commit": true
      },
      "tracemint_lib/__init__.py": {
        "sha256": "bb73c5d0f68436a2763d580e378432e9a856b02f608c9e03b15e50a2a47a1a1f",
        "matches_commit": true
      },
      "tracemint_lib/archive_limits.py": {
        "sha256": "66e29ba7ced15a7b8c634dcc7a8dbe26e37f8ca24033f756914678bb4f6d93db",
        "matches_commit": true
      },
      "tracemint_lib/constants/__init__.py": {
        "sha256": "948fe159160352f69df26f9a61c918824945d505abcfa61dc2e2e0efbe3bdf46",
        "matches_commit": true
      },
      "tracemint_lib/constants/defaults.py": {
        "sha256": "651b68c5902a57558ca1d976c66886e61fd83649646fdf34f41dc67451493003",
        "matches_commit": true
      },
      "tracemint_lib/constants/lang.py": {
        "sha256": "935ae67d0bb32e73e15ad9084c9d788f43a9b4268f8cfedb5e2dd7b57b135cbe",
        "matches_commit": true
      },
      "tracemint_lib/constants/paths.py": {
        "sha256": "5cf3273ee7271467c70321c226652893461919f428918733d9663a8c0fa2fc22",
        "matches_commit": true
      },
      "tracemint_lib/constants/platform.py": {
        "sha256": "10587be17deab36659c671c4b91c5d0a4b85f27559cea14f4537046e301c87e6",
        "matches_commit": true
      },
      "tracemint_lib/prompt_security.py": {
        "sha256": "cb0ac4b2a10f8ce8fd827237e708d5a09b31fe1c14cc9c671dab2f630744d07a",
        "matches_commit": true
      },
      "tracemint_lib/vendor_triage/__init__.py": {
        "sha256": "1caf288d8c70d5c201d296df685a36c5272f4d53d26131713571e41a626ca320",
        "matches_commit": true
      },
      "tracemint_lib/vendor_triage/enricher.py": {
        "sha256": "aad860ea2cc63029485971f324239385dc9351fe130576d36ff3ce88e3c0a829",
        "matches_commit": true
      },
      "tracemint_lib/vendor_triage/importers.py": {
        "sha256": "13b2ee429ae4b7b173b5061a0c6217d497c0618674357c80fe8a399c58b34cdc",
        "matches_commit": true
      },
      "tracemint_lib/vendor_triage/schema.py": {
        "sha256": "7ffd083e2109153619f7e13f61003d44cb293983ee2c91422b9efdc0be3e2eb3",
        "matches_commit": true
      },
      "tracemint_lib/vendor_triage/triage.py": {
        "sha256": "fe00bc4413df1a921399645740910d9ddf9d524d6fba1c5d2a8643d83a3ac188",
        "matches_commit": true
      },
      "tracemint_lib/version.py": {
        "sha256": "2b310d51f094ccd3244e919695b520d344daa557fd8916f301b75bf0964e46c5",
        "matches_commit": true
      }
    }
  },
  "runner": {
    "path": "scripts/run-evaluation-example.py",
    "sha256": "6f77cce35baded61a8beaea7380f72e743a8596f68b8280a7d69b72c60c57ba5"
  },
  "environment": {
    "python": "3.11.13",
    "os": "Darwin",
    "os_release": "24.3.0",
    "architecture": "arm64",
    "dependencies": {
      "PyYAML": "6.0.3",
      "defusedxml": "0.7.1"
    }
  },
  "inputs": {
    "dockerfiles/risk.Dockerfile": {
      "sha256": "b0c5cf2d893f7621cccb34ae0a0ab329b07578e1ad5a8928f7bd8d47f6ca3d18",
      "bytes": 58
    },
    "dockerfiles/control.Dockerfile": {
      "sha256": "81ae20513dab0e591f6670727d59b0d35d25208e45847cbd600ac354b502183c",
      "bytes": 59
    },
    "minimal.sarif": {
      "sha256": "2e76325485cd47f8e7d74c32a998e255c25823c847ce6b08217d7a7e6e178564",
      "bytes": 683
    },
    "minimal.csv": {
      "sha256": "7ddb85c1ac9a97ca799ed81cd4133a4e9d756d4eafb7e07c158985b3631f0f8a",
      "bytes": 240
    },
    "LICENSE.txt": {
      "sha256": "580b67a3ae4823a27143c5026b49e79ea084686c2c51ed0fb2fa5a5e5ed79d97",
      "bytes": 921
    }
  },
  "configuration": {
    "scan_entrypoint": "services.supply_chain_posture._scan_local_container_iac",
    "parser_entrypoints": [
      "tracemint_lib.vendor_triage.importers._import_sarif",
      "tracemint_lib.vendor_triage.importers._import_generic_csv"
    ],
    "network_guard": "Python audit hook denies socket connect, DNS resolution and sendto",
    "network_attempts": 0,
    "model_inference": false,
    "application_service_started": false
  },
  "observation": {
    "scan_elapsed_seconds": 0.0006645410321652889,
    "parser_elapsed_seconds": 0.0009148749522864819,
    "timing_scope": "One invocation per check; excludes Python startup, imports, provenance checks and file writing. Not a throughput benchmark.",
    "configuration_scan": {
      "inventory": {
        "scanned_file_count": 2,
        "dockerfile_count": 2,
        "kubernetes_manifest_count": 0,
        "helm_chart_count": 0,
        "terraform_file_count": 0
      },
      "findings": [
        {
          "external_id": "dockerfile_misconfig:dockerfile_root_user:risk.Dockerfile:image:3",
          "family_key": "dockerfile_misconfig:dockerfile_root_user:risk.Dockerfile:image:3",
          "provider": "tracemint",
          "run_id": "local-iac-rules",
          "class": "dockerfile_misconfig",
          "rule_id": "dockerfile_root_user",
          "severity": "high",
          "title": "Dockerfile explicitly runs as root",
          "target": "risk.Dockerfile",
          "line": 3,
          "resource": "image",
          "remediation": "Run the final image stage as an unprivileged user.",
          "image_digest": "",
          "image_ref": "",
          "package": "",
          "version": "",
          "advisory": "",
          "artifact_sha256": "",
          "policy_status": "open",
          "release_blocking": true
        }
      ]
    },
    "parser_imports": {
      "sarif": [
        {
          "finding_id": "tracemint synthetic import fixture-0000",
          "tool": "tracemint synthetic import fixture",
          "rule_name": "SQL Injection",
          "normalized_vuln_type": "sqli",
          "cwe": "CWE-89",
          "severity": "medium",
          "confidence_from_tool": "unknown",
          "file_path": "src/fixture.py",
          "line_start": 4,
          "line_end": 0,
          "source_summary": "",
          "sink_summary": "",
          "trace_summary": [],
          "trace_nodes": [],
          "instance_id": "",
          "kingdom": "",
          "subtype": "",
          "raw_message": "Synthetic report row for parser mapping; no vulnerability assessment was performed.",
          "raw_rule_id": "fixture-sqli",
          "raw_category": "",
          "raw_state": "",
          "repo": "",
          "language": "",
          "framework": "",
          "code_context": {},
          "extra_context": {}
        }
      ],
      "generic_csv": [
        {
          "finding_id": "fixture-001",
          "tool": "TraceMint synthetic import fixture",
          "rule_name": "SQL Injection",
          "normalized_vuln_type": "sqli",
          "cwe": "CWE-89",
          "severity": "medium",
          "confidence_from_tool": "unknown",
          "file_path": "src/fixture.py",
          "line_start": 4,
          "line_end": 0,
          "source_summary": "",
          "sink_summary": "",
          "trace_summary": [],
          "trace_nodes": [],
          "instance_id": "",
          "kingdom": "",
          "subtype": "",
          "raw_message": "Synthetic report row for parser mapping; no vulnerability assessment was performed.",
          "raw_rule_id": "",
          "raw_category": "",
          "raw_state": "",
          "repo": "",
          "language": "",
          "framework": "",
          "code_context": {},
          "extra_context": {}
        }
      ]
    }
  },
  "limits": [
    "No AI model was invoked; no model accuracy, precision, recall or runtime claim follows.",
    "The Dockerfiles were read as text. No image was built and no running container or cluster was inspected.",
    "Zero findings for the control fixture means no matching rule in this tiny input, not a generally secure image.",
    "The authored SARIF and CSV records only exercise field mapping. Source enrichment, AI triage, upload limits and the API worker boundary were not tested.",
    "The product checkout must be separately licensed. No product implementation or model is redistributed."
  ]
}