{
  "schemaVersion": 1,
  "generatedAt": "2026-09-05T16:00:51.373677+00:00",
  "notice": "Generated demonstration and deterministic local simulation only. Provisional / Not approved for release. Local review, not external permission, independent observation, certification, or proof of real-world prevention. Unsigned SHA-256 manifest supports internal consistency checks only, not publisher authenticity or release authorization.",
  "scope": "Generated demonstration packs; not full application release approval",
  "packs": [
    {
      "name": "agent-exfiltration",
      "filename": "agent-exfiltration.professional-bundle.zip",
      "url": "/evidence-packs/agent-exfiltration.professional-bundle.zip",
      "sha256": "af3abcfa6da9931bdb149285385aef8976836dd2abf8883d951f9285d3dd827c",
      "bytes": 250280,
      "releaseAuthority": {
        "status": "blocked",
        "artifactType": "download_bundle",
        "releasable": false,
        "previewAllowed": true,
        "releaseLabel": "Provisional / Not approved for release",
        "blockers": [
          "Domain oracle 'ai_agent_mcp' is gap; independent evidence is required.",
          "Current revision approval is missing, expired, invalid, or out of scope.",
          "Requested release scope is not authorized by the signed approval.",
          "Requested artifact input snapshot is not bound to the signed approval.",
          "Requested source snapshot is not bound to the signed approval."
        ],
        "releaseContext": {
          "projectId": "a109aa90-6c3b-41f0-91c3-3439319a0351",
          "revision": "draft-1",
          "artifactType": "download_bundle",
          "recipientId": "local-review",
          "action": "review_artifact",
          "targetId": "a109aa90-6c3b-41f0-91c3-3439319a0351",
          "artifactSnapshotHash": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
          "sourceSnapshotHash": "sha256:589bbb4a6df234182019710414a8557848367ae52c65c0f5d68c44d073fabf1c",
          "artifactBinding": "approved-input-evidence-snapshot",
          "executionScopeHash": "sha256:3d43646aecb27ec0798d6b7c55ed1f1cf2a4284bd16d3f9120e9033c4a042fa8",
          "policyVersion": "circuitproof-approval-v2"
        },
        "releaseContextDigest": "sha256:2447a29c5b7f9098333d82464438e23d93de3d245a5a57c4c290a6511fe3329c",
        "domainEvidence": {
          "domain": "ai_agent_mcp",
          "oracleId": "circuitproof.ai_agent_mcp.oracle",
          "oracleVersion": "v2",
          "observedControls": [],
          "missingEvidence": [
            "access_scope: Required evidence was not observed.",
            "audit_log: Required evidence was not observed.",
            "human_approval_gate: Required evidence was not observed.",
            "prompt_injection_boundary: Required evidence was not observed.",
            "tool_manifest: Required evidence was not observed."
          ],
          "contradictions": [],
          "evidenceIds": [],
          "status": "gap",
          "verificationEligible": false,
          "observationDigest": "sha256:22aeb4ffe05e923742281091bc5b0e9fcb9ffdf51692dc2a6de152438128b556",
          "projectId": "a109aa90-6c3b-41f0-91c3-3439319a0351",
          "revision": "draft-1",
          "definitionHash": "sha256:875c0f5ad8a035cc63c8bfb15848d298f5124d2a88187ad24cfa58ccbef04b3c",
          "evidenceContentDigest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a"
        },
        "authorizationBoundary": "Local review artifacts and the exact approved plan only; not external publication or certification."
      }
    },
    {
      "name": "webhook-replay",
      "filename": "webhook-replay.professional-bundle.zip",
      "url": "/evidence-packs/webhook-replay.professional-bundle.zip",
      "sha256": "d84614f1f609913a8133e45cadbdd73a717a67364576708de5ea79d6a21430e5",
      "bytes": 250959,
      "releaseAuthority": {
        "status": "blocked",
        "artifactType": "download_bundle",
        "releasable": false,
        "previewAllowed": true,
        "releaseLabel": "Provisional / Not approved for release",
        "blockers": [
          "Domain oracle 'api_webhook_database' is gap; independent evidence is required.",
          "Current revision approval is missing, expired, invalid, or out of scope.",
          "Requested release scope is not authorized by the signed approval.",
          "Requested artifact input snapshot is not bound to the signed approval.",
          "Requested source snapshot is not bound to the signed approval."
        ],
        "releaseContext": {
          "projectId": "6359f2ba-725b-444f-867c-369e53d06ac3",
          "revision": "draft-1",
          "artifactType": "download_bundle",
          "recipientId": "local-review",
          "action": "review_artifact",
          "targetId": "6359f2ba-725b-444f-867c-369e53d06ac3",
          "artifactSnapshotHash": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
          "sourceSnapshotHash": "sha256:589bbb4a6df234182019710414a8557848367ae52c65c0f5d68c44d073fabf1c",
          "artifactBinding": "approved-input-evidence-snapshot",
          "executionScopeHash": "sha256:fae986bad1ce03aa33868426d1bcba547d73b39c38ed44c294e95fa637169a40",
          "policyVersion": "circuitproof-approval-v2"
        },
        "releaseContextDigest": "sha256:a372114600bf114c79e0596fa332d9a64d8d3daa47dfd20826194b28f43229cb",
        "domainEvidence": {
          "domain": "api_webhook_database",
          "oracleId": "circuitproof.api_webhook_database.oracle",
          "oracleVersion": "v2",
          "observedControls": [],
          "missingEvidence": [
            "access_scope: Required evidence was not observed.",
            "backup_or_rollback: Required evidence was not observed.",
            "idempotency: Required evidence was not observed.",
            "mutation_audit: Required evidence was not observed.",
            "schema_contract: Required evidence was not observed."
          ],
          "contradictions": [],
          "evidenceIds": [],
          "status": "gap",
          "verificationEligible": false,
          "observationDigest": "sha256:567dfc5c9e60099288fd81a3408151ae3d71cb0e88e57cf20bdb33b6c48a0d77",
          "projectId": "6359f2ba-725b-444f-867c-369e53d06ac3",
          "revision": "draft-1",
          "definitionHash": "sha256:e0ae2621693e2822376c16223f1e9a08c3ab0ed3d3a55acf67e8b0e652d4b84f",
          "evidenceContentDigest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a"
        },
        "authorizationBoundary": "Local review artifacts and the exact approved plan only; not external publication or certification."
      }
    },
    {
      "name": "cad-cam-mismatch",
      "filename": "cad-cam-mismatch.professional-bundle.zip",
      "url": "/evidence-packs/cad-cam-mismatch.professional-bundle.zip",
      "sha256": "22a52affab62b346bac8bf4bb60fce4832a10f26d6419b09ca62f713d938dad1",
      "bytes": 260734,
      "releaseAuthority": {
        "status": "blocked",
        "artifactType": "download_bundle",
        "releasable": false,
        "previewAllowed": true,
        "releaseLabel": "Provisional / Not approved for release",
        "blockers": [
          "Domain oracle 'industrial_ot_cad_cam' is gap; independent evidence is required.",
          "Current revision approval is missing, expired, invalid, or out of scope.",
          "Requested release scope is not authorized by the signed approval.",
          "Requested artifact input snapshot is not bound to the signed approval.",
          "Requested source snapshot is not bound to the signed approval."
        ],
        "releaseContext": {
          "projectId": "355a46c2-298d-49f1-a993-e900d716bc5c",
          "revision": "draft-1",
          "artifactType": "download_bundle",
          "recipientId": "local-review",
          "action": "review_artifact",
          "targetId": "355a46c2-298d-49f1-a993-e900d716bc5c",
          "artifactSnapshotHash": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
          "sourceSnapshotHash": "sha256:589bbb4a6df234182019710414a8557848367ae52c65c0f5d68c44d073fabf1c",
          "artifactBinding": "approved-input-evidence-snapshot",
          "executionScopeHash": "sha256:652c13c1c04c142d21db6595ab45961c0af028cb8e208913f70982ae5074c782",
          "policyVersion": "circuitproof-approval-v2"
        },
        "releaseContextDigest": "sha256:45f68b8473f7804170cd668c753be79a57844283b963b9864d1661bd1653a472",
        "domainEvidence": {
          "domain": "industrial_ot_cad_cam",
          "oracleId": "circuitproof.industrial_ot_cad_cam.oracle",
          "oracleVersion": "v2",
          "observedControls": [],
          "missingEvidence": [
            "access_scope: Required evidence was not observed.",
            "operator_approval: Required evidence was not observed.",
            "revision_match: Required evidence was not observed.",
            "safety_interlock: Required evidence was not observed.",
            "simulation_evidence: Required evidence was not observed."
          ],
          "contradictions": [],
          "evidenceIds": [],
          "status": "gap",
          "verificationEligible": false,
          "observationDigest": "sha256:6fc1ff3f7a4e93940b797a32cf5ec7e90fb0b535f6117ebafd8ddf15ac27d914",
          "projectId": "355a46c2-298d-49f1-a993-e900d716bc5c",
          "revision": "draft-1",
          "definitionHash": "sha256:8156f41f86b862e32863e2dd7f08ca8f9e3a76a8cf1250ad02cc094389137072",
          "evidenceContentDigest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a"
        },
        "authorizationBoundary": "Local review artifacts and the exact approved plan only; not external publication or certification."
      }
    }
  ]
}