{
  "schema": "evulgare.acceptance-evidence-indexed-packet.v1",
  "release": "2.0.0-rc.9-WIP",
  "classification": "candidate",
  "packet": {
    "schema": "evulgare.acceptance-evidence-packet.v1",
    "packet_id": "RC9-SECURITY-PRIVACY-CANDIDATE-01",
    "release": "2.0.0-rc.9-WIP",
    "created_at": "2026-08-06T07:35:30Z",
    "previous_packet_sha256": null,
    "dimension": "security_privacy",
    "status": "EVIDENCE_READY_FOR_REVIEW",
    "environment": {
      "environment_id": "RC9-SECURITY-PRIVACY-BOUNDED",
      "environment_class": "REPOSITORY_OR_PUBLIC_READ_ONLY_CANDIDATE",
      "python_version": "3.13.5",
      "application_version": "2.0.0-rc.9-WIP",
      "base_url": "local://evulgare-rc9-work",
      "browser": "",
      "browser_version": "",
      "operating_system": "linux",
      "device_class": "artifact-build-container",
      "graphics_adapter": "",
      "xr_hardware": "",
      "assistive_technology": "",
      "input_methods": [],
      "notes": "Candidate evidence only; no completed human review or release-promotion effect."
    },
    "scope": {
      "release": "2.0.0-rc.9-WIP",
      "routes_or_tasks": [
        "security privacy",
        "bounded non-secret candidate collection"
      ],
      "test_start": "2026-08-06T07:35:00Z",
      "test_end": "2026-08-06T07:35:20Z",
      "normalized_public_data_only": true,
      "external_system_control": false
    },
    "review": {
      "human_reviewed": false,
      "role": "UNASSIGNED_REVIEWER",
      "review_type": "NOT_YET_REVIEWED",
      "independent": false,
      "identity_disclosed": false,
      "reviewed_at": null,
      "review_duration_seconds": 0,
      "residual_unknowns": [
        "Explicit human review remains required; production DAST, dependency/SBOM review, and actual-host security acceptance remain separate."
      ]
    },
    "checks": [
      {
        "id": "SEC-AUTHORIZATION",
        "statement": "Sec Authorization",
        "status": "PASS_WITH_QUALIFICATION",
        "detail": "Static repository and deterministic malformed-input evidence covers this bounded check.",
        "qualification": "Production-host security and independent privacy review remain incomplete.",
        "required": true,
        "evidence_refs": [
          "docs/RC9_SECURITY_PRIVACY_EVIDENCE.json"
        ]
      },
      {
        "id": "SEC-CSRF",
        "statement": "Sec Csrf",
        "status": "PASS_WITH_QUALIFICATION",
        "detail": "Static repository and deterministic malformed-input evidence covers this bounded check.",
        "qualification": "Production-host security and independent privacy review remain incomplete.",
        "required": true,
        "evidence_refs": [
          "docs/RC9_SECURITY_PRIVACY_EVIDENCE.json"
        ]
      },
      {
        "id": "SEC-RATE-LIMIT",
        "statement": "Sec Rate Limit",
        "status": "PASS_WITH_QUALIFICATION",
        "detail": "Static repository and deterministic malformed-input evidence covers this bounded check.",
        "qualification": "Production-host security and independent privacy review remain incomplete.",
        "required": true,
        "evidence_refs": [
          "docs/RC9_SECURITY_PRIVACY_EVIDENCE.json"
        ]
      },
      {
        "id": "SEC-MALFORMED-PAYLOADS",
        "statement": "Sec Malformed Payloads",
        "status": "PASS_WITH_QUALIFICATION",
        "detail": "Static repository and deterministic malformed-input evidence covers this bounded check.",
        "qualification": "Production-host security and independent privacy review remain incomplete.",
        "required": true,
        "evidence_refs": [
          "docs/RC9_SECURITY_PRIVACY_EVIDENCE.json"
        ]
      },
      {
        "id": "SEC-SOURCE-FETCH-SSRF",
        "statement": "Sec Source Fetch Ssrf",
        "status": "PASS_WITH_QUALIFICATION",
        "detail": "Static repository and deterministic malformed-input evidence covers this bounded check.",
        "qualification": "Production-host security and independent privacy review remain incomplete.",
        "required": true,
        "evidence_refs": [
          "docs/RC9_SECURITY_PRIVACY_EVIDENCE.json"
        ]
      },
      {
        "id": "SEC-DEPENDENCIES-SBOM",
        "statement": "Sec Dependencies Sbom",
        "status": "PASS_WITH_QUALIFICATION",
        "detail": "Static repository and deterministic malformed-input evidence covers this bounded check.",
        "qualification": "Production-host security and independent privacy review remain incomplete.",
        "required": true,
        "evidence_refs": [
          "docs/RC9_SECURITY_PRIVACY_EVIDENCE.json"
        ]
      },
      {
        "id": "SEC-NO-SECRET-LEAKAGE",
        "statement": "Sec No Secret Leakage",
        "status": "PASS_WITH_QUALIFICATION",
        "detail": "Static repository and deterministic malformed-input evidence covers this bounded check.",
        "qualification": "Production-host security and independent privacy review remain incomplete.",
        "required": true,
        "evidence_refs": [
          "docs/RC9_SECURITY_PRIVACY_EVIDENCE.json"
        ]
      },
      {
        "id": "PRIV-NO-ANONYMOUS-PERSISTENCE",
        "statement": "Priv No Anonymous Persistence",
        "status": "PASS_WITH_QUALIFICATION",
        "detail": "Static repository and deterministic malformed-input evidence covers this bounded check.",
        "qualification": "Production-host security and independent privacy review remain incomplete.",
        "required": true,
        "evidence_refs": [
          "docs/RC9_SECURITY_PRIVACY_EVIDENCE.json"
        ]
      },
      {
        "id": "PRIV-REVIEW",
        "statement": "Priv Review",
        "status": "PASS_WITH_QUALIFICATION",
        "detail": "Static repository and deterministic malformed-input evidence covers this bounded check.",
        "qualification": "Production-host security and independent privacy review remain incomplete.",
        "required": true,
        "evidence_refs": [
          "docs/RC9_SECURITY_PRIVACY_EVIDENCE.json"
        ]
      }
    ],
    "artifacts": [
      {
        "path": "docs/RC9_SECURITY_PRIVACY_EVIDENCE.json",
        "sha256": "1ecaf90f52a4eae5416f3efd36618712ad399ff52c448edd87bd8d2f2af74db7",
        "bytes": 1778,
        "media_type": "application/json",
        "summary": "Bounded RC9 security privacy candidate evidence.",
        "contains_secrets": false,
        "contains_raw_html": false
      }
    ],
    "qualifications": [
      "Static and deterministic security checks remain bounded to repository-visible behavior."
    ],
    "blockers": [
      "Explicit human review remains required; production DAST, dependency/SBOM review, and actual-host security acceptance remain separate."
    ],
    "promotion_effect": "NONE",
    "authoritative_for_release_promotion": false,
    "public_persistence": false,
    "public_safety_boundary": {
      "synthetic": true,
      "operational": false,
      "real_vehicle_control": false,
      "target_selection": false,
      "payload_or_weapon_control": false,
      "force_authorization": false,
      "external_command_channel": false
    },
    "terminal": "SYNTHETIC_NULL_SINK",
    "packet_sha256": "11961f13a512ed3f6d5e236656a27b98dd2147821c058f18c800c32f0dcd985b"
  },
  "promotion_effect": "NONE",
  "authoritative_for_release_promotion": false,
  "public_persistence": false,
  "terminal": "SYNTHETIC_NULL_SINK",
  "indexed_packet_sha256": "7080be90d1f948fee1246c15b48cfdad137702e6c3bdc4c9d04669474f5d49b2"
}