{
  "lab_id": "LAB-250-01",
  "recorded_at": "2026-09-07T14:47:48.313978+00:00",
  "environment": "Python 3.14.4",
  "source_sha256": "881d0d1adecce814b28a03ecb5ecbf96ab3801aeb1cc96412515bee1f8b2fff3",
  "validation_output": "test_complete_evidence_control_has_no_finding (test_evidence_quality.EvidenceQualityTests.test_complete_evidence_control_has_no_finding) ... ok\ntest_evidence_missing_a_required_field_is_flagged (test_evidence_quality.EvidenceQualityTests.test_evidence_missing_a_required_field_is_flagged) ... ok\ntest_evidence_record_missing_required_field_is_not_silently_treated_as_complete (test_evidence_quality.EvidenceQualityTests.test_evidence_record_missing_required_field_is_not_silently_treated_as_complete) ... ok\ntest_every_evidence_record_references_a_known_control (test_passport_linkage.PassportLinkageTests.test_every_evidence_record_references_a_known_control) ... ok\ntest_every_exception_references_a_known_control (test_passport_linkage.PassportLinkageTests.test_every_exception_references_a_known_control) ... ok\ntest_every_referenced_control_exists_in_the_catalog (test_passport_linkage.PassportLinkageTests.test_every_referenced_control_exists_in_the_catalog) ... ok\ntest_passport_links_controls_by_id_rather_than_duplicating_their_text (test_passport_linkage.PassportLinkageTests.test_passport_links_controls_by_id_rather_than_duplicating_their_text) ... ok\ntest_covered_finding_yields_approve_with_conditions (test_release_gate.ReleaseGateTests.test_covered_finding_yields_approve_with_conditions) ... ok\ntest_expired_exception_yields_hold_and_is_reported (test_release_gate.ReleaseGateTests.test_expired_exception_yields_hold_and_is_reported) ... ok\ntest_missing_owner_yields_reject_even_with_complete_evidence (test_release_gate.ReleaseGateTests.test_missing_owner_yields_reject_even_with_complete_evidence) ... ok\ntest_no_findings_yields_approve (test_release_gate.ReleaseGateTests.test_no_findings_yields_approve) ... ok\ntest_shipped_dataset_holds_on_the_uncovered_injection_finding (test_release_gate.ReleaseGateTests.test_shipped_dataset_holds_on_the_uncovered_injection_finding) ... ok\ntest_uncovered_finding_yields_hold (test_release_gate.ReleaseGateTests.test_uncovered_finding_yields_hold) ... ok\ntest_control_without_evidence_is_marked_covered_not_silently_passed (test_traceability.TraceabilityTests.test_control_without_evidence_is_marked_covered_not_silently_passed) ... ok\ntest_every_catalog_control_appears_exactly_once_in_the_matrix (test_traceability.TraceabilityTests.test_every_catalog_control_appears_exactly_once_in_the_matrix) ... ok\ntest_every_control_has_a_named_owner_and_reviewer (test_traceability.TraceabilityTests.test_every_control_has_a_named_owner_and_reviewer) ... ok\n\n----------------------------------------------------------------------\nRan 16 tests in 0.003s\n\nOK\n",
  "sample": {
    "schema_version": "1.0.0",
    "recorded_at": "2026-09-07T14:47:48.300453+00:00",
    "lab_id": "LAB-250-01",
    "release_candidate": "private-knowledge-assistant-v1.4.0",
    "recommendation": "hold",
    "versions": {
      "control_catalog": "1.0.0",
      "evidence_records": "1.0.0",
      "system_passport": "private-knowledge-assistant-v1.4.0"
    },
    "traceability_matrix": [
      {
        "control_id": "CTRL-ACCESS-01",
        "obligation_or_risk": "Prevent unauthorized access to retrieval-permitted documents",
        "control_objective": "Only members of an allowed group can retrieve a permitted document",
        "owner": "platform-security-lead",
        "reviewer": "assurance-lead",
        "evidence_count": 1,
        "evidence_complete": true,
        "status": "pass"
      },
      {
        "control_id": "CTRL-CAPACITY-01",
        "obligation_or_risk": "Prevent undetected service degradation under load",
        "control_objective": "Sustained capacity is measured under representative load with defined headroom",
        "owner": "platform-engineering-lead",
        "reviewer": "assurance-lead",
        "evidence_count": 1,
        "evidence_complete": true,
        "status": "pass"
      },
      {
        "control_id": "CTRL-CITATION-01",
        "obligation_or_risk": "Prevent unsupported or fabricated answers",
        "control_objective": "Every returned citation resolves to an active, exact-version source",
        "owner": "ai-engineering-lead",
        "reviewer": "assurance-lead",
        "evidence_count": 1,
        "evidence_complete": true,
        "status": "pass"
      },
      {
        "control_id": "CTRL-DELETION-01",
        "obligation_or_risk": "Prevent deleted documents from remaining discoverable",
        "control_objective": "Deleted documents are absent from the active index, context, and citations",
        "owner": "ai-engineering-lead",
        "reviewer": "assurance-lead",
        "evidence_count": 0,
        "evidence_complete": false,
        "status": "covered"
      },
      {
        "control_id": "CTRL-INJECTION-01",
        "obligation_or_risk": "Prevent retrieved content from overriding governing behavior",
        "control_objective": "Instruction-like text inside retrieved documents is detected and removed before context assembly",
        "owner": "ai-engineering-lead",
        "reviewer": "security-architect",
        "evidence_count": 1,
        "evidence_complete": false,
        "status": "finding"
      }
    ],
    "findings": [
      {
        "control_id": "CTRL-INJECTION-01",
        "reason": "evidence missing required fields",
        "covered_by_exception": false
      }
    ],
    "covered_findings": [
      {
        "control_id": "CTRL-DELETION-01",
        "reason": "no evidence recorded",
        "covered_by_exception": true
      }
    ],
    "expired_exceptions": [],
    "known_limitations": [
      "Synthetic control catalog, evidence records, and system passport only",
      "Deterministic rule-based release gate, not a substitute for independent audit",
      "No production evidence store, ticketing system, or approval workflow is included"
    ]
  },
  "scope": "Synthetic deterministic control prototype; not a production benchmark or independent validation."
}