{
  "passed": 15,
  "total": 15,
  "totalMs": 7126.8,
  "toolVersions": {
    "conftest": "Conftest: 0.69.0",
    "opa": "Version: 1.19.1",
    "kube-linter": "0.8.3",
    "score-k8s": "score-k8s 0.16.0 (go1.26.4 - linux/amd64)",
    "score-compose": "score-compose 0.45.0 (go1.26.5 - linux/amd64)",
    "tofu": "OpenTofu v1.12.6",
    "trivy": "Version: 0.74.0"
  },
  "checks": [
    {
      "id": "T01",
      "name": "Pinned upstream toolchain present",
      "passed": true,
      "detail": "conftest 0.69.0, score-k8s 0.16.0, kube-linter 0.8.3",
      "ms": 227.4
    },
    {
      "id": "T02",
      "name": "Policy bundle compiles under OPA",
      "passed": true,
      "detail": "3 bundles (cost, kubernetes, score), 34 rule bodies compile under `opa check --strict`",
      "ms": 26.4
    },
    {
      "id": "T03",
      "name": "PCI rules reject a non-compliant database",
      "passed": true,
      "detail": "4 denials on a deliberately non-compliant database",
      "ms": 48.7
    },
    {
      "id": "T04",
      "name": "Unguided manifests are rejected",
      "passed": true,
      "detail": "42 denials across 12 distinct policies",
      "ms": 134.2
    },
    {
      "id": "T05",
      "name": "Golden path converges to zero denials",
      "passed": true,
      "detail": "0 denials after 3 iterations, $359.15/mo",
      "ms": 842.0
    },
    {
      "id": "T06",
      "name": "Agent fixes inputs, never rendered output",
      "passed": true,
      "detail": "1 change(s), all to Score inputs (db_backup_retention_days); 7 rendered objects unmutated and reproducible from those inputs alone",
      "ms": 403.6
    },
    {
      "id": "T07",
      "name": "Independent linter finds nothing",
      "passed": true,
      "detail": "0 findings on 7 rendered objects",
      "ms": 127.1
    },
    {
      "id": "T08",
      "name": "Agent cannot approve production",
      "passed": true,
      "detail": "12/14 tools listed; approve_promotion withheld and refused",
      "ms": 33.6
    },
    {
      "id": "T09",
      "name": "A human in the owning group can",
      "passed": true,
      "detail": "release-manager holds delivery:approve and the call succeeds",
      "ms": 21.2
    },
    {
      "id": "T10",
      "name": "Tool visibility differs per identity",
      "passed": true,
      "detail": "cost-reviewer 3/14 \u00b7 drift-agent 5/14 \u00b7 platform-agent 12/14 \u00b7 release-manager 14/14",
      "ms": 86.0
    },
    {
      "id": "T11",
      "name": "MCP 2025-06-18 protocol conformance",
      "passed": true,
      "detail": "initialize \u00b7 tools/list \u00b7 tools/call \u00b7 resources/list over stdio",
      "ms": 135.7
    },
    {
      "id": "T12",
      "name": "MCP HTTP transport validates Origin",
      "passed": true,
      "detail": "localhost accepted, foreign origin rejected (DNS-rebinding guard)",
      "ms": 0.1
    },
    {
      "id": "T13",
      "name": "Rendering twice is byte-identical",
      "passed": true,
      "detail": "two independent renders, 322 lines, byte-identical",
      "ms": 132.0
    },
    {
      "id": "T14",
      "name": "Committed artefacts reproduce exactly",
      "passed": true,
      "detail": "all 7 recorded properties reproduce (42 denials, 3 iterations, $960.82 -> $359.15, 7 objects, manifests sha256:2a173417f98b)",
      "ms": 2342.6
    },
    {
      "id": "T15",
      "name": "The LLM backend converges too",
      "passed": true,
      "detail": "same manifests and same $359.15/mo as the deterministic reasoner, after 3 iterations and 2 model call(s)",
      "ms": 2566.2
    }
  ]
}