{
  "checks": [
    {
      "details": [
        "schema=https://json.schemastore.org/sarif-2.1.0.json"
      ],
      "evidence_refs": [
        "sarif-file"
      ],
      "id": "sarif:format-version",
      "status": "passed",
      "summary": "SARIF version is 2.1.0.",
      "title": "SARIF version"
    },
    {
      "details": [
        "rules=1"
      ],
      "evidence_refs": [
        "sarif-file"
      ],
      "id": "sarif:runs-present",
      "status": "passed",
      "summary": "1 SARIF run(s) present.",
      "title": "Runs present"
    },
    {
      "details": [
        "errors=0",
        "warnings=1",
        "notes=0",
        "SARIF results are analyzer findings, not a policy verdict by themselves."
      ],
      "evidence_refs": [
        "sarif-file"
      ],
      "id": "sarif:results",
      "status": "inconclusive",
      "summary": "1 result(s), 0 error-level result(s), 1 rule(s).",
      "title": "Results"
    },
    {
      "evidence_refs": [
        "sarif-file"
      ],
      "id": "sarif:github-upload",
      "status": "not_checked",
      "summary": "The receipt summarizes SARIF; it does not upload to GitHub code scanning.",
      "title": "GitHub code-scanning upload"
    }
  ],
  "evidence": [
    {
      "description": "SARIF 2.1.0-compatible static analysis artifact summary.",
      "digest_sha256": "3a067f6dbc47bd7a25f0dd78d617707128a1be1f3acef73777818746d96570c2",
      "id": "sarif-file",
      "kind": "sarif",
      "public_safe": true,
      "redaction_status": "summary_only",
      "reference": "local-public-safe-input:sarif-file",
      "supports": [
        "sarif:format-version",
        "sarif:runs-present",
        "sarif:results",
        "sarif:github-upload"
      ],
      "title": "SARIF file"
    }
  ],
  "excluded_data": [
    {
      "category": "Raw source snippets",
      "reason": "The SARIF adapter summarizes counts and rules. It does not include code snippets, local paths, or fingerprints."
    },
    {
      "category": "Result locations and fingerprints",
      "reason": "The receipt intentionally omits per-result file locations, partial fingerprints, and code-flow details for public safety."
    },
    {
      "category": "GitHub code-scanning state",
      "reason": "Upload status, alert state, dismissal state, and repository code-scanning configuration are not inferred from a local SARIF file."
    }
  ],
  "freshness": {
    "age_seconds": 480600,
    "evidence_collected_at": "2026-06-21T10:30:00Z",
    "generated_at": "2026-06-27T00:00:00Z",
    "notes": "Receipt summarizes a local SARIF file. It does not upload to GitHub code scanning or query upload status.",
    "status": "static_fixture"
  },
  "integrity": {
    "generator": "trust-receipt-generator 0.1.0",
    "payload_sha256": "a6d474728e234a8014e8efad910df43c7eef83ccec327670b9be1979cd66ec7d",
    "source_digests": [
      {
        "digest_sha256": "3a067f6dbc47bd7a25f0dd78d617707128a1be1f3acef73777818746d96570c2",
        "id": "sarif-file"
      }
    ]
  },
  "issued_at": "2026-06-27T00:00:00Z",
  "limitations": [
    "SARIF findings are alerts, not an independent policy verdict.",
    "GitHub code scanning upload status is intentionally not inferred from a local SARIF file.",
    "The adapter summarizes the file and does not preserve result locations or code snippets.",
    "Freshness depends on optional producer invocation metadata when present."
  ],
  "producer": {
    "name": "trust-receipt-generator",
    "source_adapter": "sarif-2.1.0-summary",
    "source_commands": [
      "trust-receipt sarif --input <report.sarif>"
    ],
    "version": "0.1.0"
  },
  "public_safety": {
    "included_data_policy": "Only SARIF version, run count, result count, rule count, and digest are included.",
    "status": "redacted"
  },
  "receipt_id": "tr_sarif-sarif-sample-report",
  "reproduce": [
    {
      "step": "Generate a SARIF report using the source analyzer."
    },
    {
      "command": "trust-receipt sarif --input report.sarif",
      "step": "Generate this receipt."
    }
  ],
  "schema_version": "trust-receipt/v0.1",
  "subject": {
    "claim": "SARIF report contains machine-readable static analysis results.",
    "name": "SARIF report: sarif-sample-report",
    "type": "sarif",
    "version": "2.1.0"
  },
  "summary": {
    "badge": {
      "color": "#b7791f",
      "label": "trust receipt",
      "message": "partial proof with gaps",
      "style": "flat"
    },
    "failed_count": 0,
    "headline": "SARIF summary generated without treating alerts as a certification.",
    "inconclusive_count": 1,
    "not_checked_count": 1,
    "passed_count": 2,
    "verdict": "mixed"
  },
  "unverified": [
    {
      "id": "sarif:producer-policy",
      "reason": "SARIF results are not equivalent to a pass/fail policy unless the producer supplies one.",
      "status": "not_checked",
      "title": "Producer policy not evaluated"
    },
    {
      "id": "sarif:github-upload-status",
      "reason": "The receipt generator does not call GitHub, upload SARIF, or inspect code-scanning alerts.",
      "status": "not_checked",
      "title": "GitHub upload status not checked"
    }
  ]
}