{
  "schema": "evy.aegis.report-reading-checklist.v1",
  "revision": "o15r14-20261023-1",
  "kind": "EDUCATIONAL_NOT_ASSESSMENT",
  "items": [
    "Confirm the owner, authorized assets, permitted methods and exclusions.",
    "Match the report asset manifest to the exact build you intend to deploy.",
    "Separate baseline observations from observations made during the retest.",
    "Read each finding with its evidence, scope, priority and limitations.",
    "Distinguish file changes retested from owner actions that remain unverified.",
    "Treat an open or newly observed finding as unresolved until separately reviewed.",
    "After any build change, obtain a retest of that build before reusing a conclusion.",
    "Keep the approved change, rollback route, report and remaining risks together."
  ],
  "limits": [
    "A static-build review does not test a running server, authentication or dependencies.",
    "No finding count proves that a website is secure.",
    "This checklist is not an assessment or security certification."
  ]
}