{
 "schema": "evy.security-workflow-evidence.v1",
 "generated_by": "EVY_SITE/tools/security-lab-record.mjs",
 "workflow": "EVY_SALES/security-workflow.mjs",
 "workflow_sha256": "78b6072c63c3effac93ac7bce318b7e6282f2f84cb6bf0fbce96ee3d0dfdc684",
 "inputs": "SYNTHETIC asset manifests and evidence hashes; fixed clock",
 "asset_manifests": {
  "A": "de90d78f949eb648fe05a77f881fae54a7e1c392e7d5eaa8eb76021b799e8563",
  "B": "db3fdf7714faddecea76e535fd3b0bca83cf4546b98f2950e2b47c139b7f2571"
 },
 "steps": [
  {
   "step": 1,
   "label": "Request recorded",
   "kind": "NEW_LEAD",
   "accepted": true,
   "duplicate": false
  },
  {
   "step": 2,
   "label": "Scope requested",
   "kind": "SCOPE_REQUESTED",
   "accepted": true,
   "duplicate": false
  },
  {
   "step": 3,
   "label": "Written authorization bound to asset A",
   "kind": "AUTHORIZED_ASSET",
   "accepted": true,
   "duplicate": false
  },
  {
   "step": 4,
   "label": "Assessment completed on asset A",
   "kind": "ASSESSMENT_COMPLETED",
   "accepted": true,
   "duplicate": false
  },
  {
   "step": 5,
   "label": "Approved fix changes the asset A -> B",
   "kind": "FIX_APPLIED",
   "accepted": true,
   "duplicate": false
  },
  {
   "step": 6,
   "label": "Retest attempted on the OLD asset A after the fix",
   "kind": "RETEST_REQUIRED",
   "accepted": false,
   "refusal": "SECURITY_ASSET_BINDING_REQUIRED"
  },
  {
   "step": 7,
   "label": "Retest required on the CURRENT asset B",
   "kind": "RETEST_REQUIRED",
   "accepted": true,
   "duplicate": false
  },
  {
   "step": 8,
   "label": "Report attempted with the OLD asset A evidence",
   "kind": "REPORT_READY",
   "accepted": false,
   "refusal": "SECURITY_ASSET_BINDING_REQUIRED"
  },
  {
   "step": 9,
   "label": "Current report issued for asset B after its retest",
   "kind": "REPORT_READY",
   "accepted": true,
   "duplicate": false
  }
 ],
 "result": {
  "stale_evidence_refused": true,
  "refusals": 2,
  "current_report_bound_to": "B"
 },
 "limitation": "A workflow demonstration on synthetic inputs. Not a customer assessment, not a security certification and not evidence that any website has no vulnerabilities."
}