{
  "schemaVersion": 1,
  "asOf": "2026-08-26",
  "classification": "cross-manifest-consistency-source-controlled",
  "consistent": true,
  "failClosedOnContradiction": true,
  "productionClaimEligible": false,
  "runtimeProofOutstanding": true,
  "trustSummary": {
    "implemented": 5,
    "controlled": 11,
    "planned": 6,
    "not-certified": 2
  },
  "domains": {
    "network": {
      "trustStatus": "planned",
      "sourceClassification": "controlled-source-staged",
      "registeredPrivilegedSurfaces": 9,
      "networkEvaluatedSurfaces": 9,
      "knownDirectBypasses": 0,
      "completeReleaseBindingFingerprintVersion": 18,
      "productionEnforceReady": false,
      "productionEnforcementClaimed": false
    },
    "identity": {
      "sourceClassification": "controlled-source-staged",
      "canaryProtocolAvailable": true,
      "productionSsoVerified": false,
      "productionScimVerified": false
    },
    "sourceExecution": {
      "sourceClassification": "protocol-ready-evidence-not-yet-published",
      "receiptProtocolAvailable": true,
      "exactHeadReceiptPublished": false,
      "cloudflareBuildVerifiedForCurrentHead": false,
      "productionReleaseVerified": false
    },
    "operations": {
      "sourceClassification": "controlled-source-evidence-in-progress",
      "drEvidencePackProtocolAvailable": true,
      "drRequiredDistinctHashes": 8,
      "drEvidencePackRuntimeVerified": false,
      "recurringRestoreEvidenceClaimed": false,
      "contractualSlaClaimed": false
    }
  },
  "assertions": [
    {
      "id": "identity-sso-trust-not-ahead-of-runtime",
      "consistent": true,
      "expectation": "SSO remains planned until production SSO evidence is explicitly verified.",
      "observed": "trust=planned; productionSsoVerified=false"
    },
    {
      "id": "identity-scim-trust-not-ahead-of-runtime",
      "consistent": true,
      "expectation": "SCIM remains planned until production SCIM evidence is explicitly verified.",
      "observed": "trust=planned; productionScimVerified=false"
    },
    {
      "id": "dr-trust-not-ahead-of-runtime",
      "consistent": true,
      "expectation": "DR remains planned while restore evidence is target-only and no isolated/production restore proof is published.",
      "observed": "trust=planned; isolatedPack=false; productionEligible=false; recurring=false"
    },
    {
      "id": "sla-trust-not-ahead-of-operational-evidence",
      "consistent": true,
      "expectation": "Contractual SLA stays planned until a separately governed contractual SLA exists.",
      "observed": "trust=planned; claimed=false; authorized=false"
    },
    {
      "id": "soc2-remains-not-certified",
      "consistent": true,
      "expectation": "SOC 2 must remain not-certified until independent certification evidence exists.",
      "observed": "trust=not-certified"
    },
    {
      "id": "iso27001-remains-not-certified",
      "consistent": true,
      "expectation": "ISO 27001 must remain not-certified until independent certification evidence exists.",
      "observed": "trust=not-certified"
    },
    {
      "id": "branch-protection-remains-planned",
      "consistent": true,
      "expectation": "Repository source policy must not be presented as enforced branch protection.",
      "observed": "trust=planned"
    },
    {
      "id": "release-governance-remains-controlled-without-executed-head-proof",
      "consistent": true,
      "expectation": "Release governance may be controlled in source, but current-HEAD execution and production release proof remain separate.",
      "observed": "trust=controlled; exactHeadReceiptPublished=false; productionReleaseVerified=false"
    },
    {
      "id": "network-enforcement-trust-not-ahead-of-runtime",
      "consistent": true,
      "expectation": "Production network enforcement remains planned until Network Gateway runtime evidence and explicit ENFORCE activation are verified.",
      "observed": "trust=planned; productionEnforceReady=false; productionEnforcementClaimed=false"
    },
    {
      "id": "network-source-closure-not-runtime-enforcement",
      "consistent": true,
      "expectation": "Network Gateway v18 source closure must not imply production ENFORCE readiness or activation.",
      "observed": "classification=controlled-source-staged; sourceClosure=true; fingerprint=v18; productionEnforceReady=false; productionEnforcementClaimed=false"
    },
    {
      "id": "network-runtime-claims-remain-unverified",
      "consistent": true,
      "expectation": "Source-staged Network Gateway runtime evidence remains false until measured environment evidence is persisted.",
      "observed": "runtimeTrueCount=0"
    },
    {
      "id": "identity-runtime-claims-remain-unverified",
      "consistent": true,
      "expectation": "Identity canary protocol availability must not become runtime/vendor/certification proof.",
      "observed": "runtimeTrueCount=0; claimTrueCount=0"
    },
    {
      "id": "source-execution-protocol-not-executed-evidence",
      "consistent": true,
      "expectation": "Exact-HEAD receipt capability must not be represented as an executed build/deploy/release.",
      "observed": "classification=protocol-ready-evidence-not-yet-published; runtimeTrueCount=0; claimTrueCount=0"
    },
    {
      "id": "operational-source-evidence-not-contractual-proof",
      "consistent": true,
      "expectation": "Operational source evidence and engineering targets must not become historical, production-restore or contractual claims.",
      "observed": "classification=controlled-source-evidence-in-progress; engineeringOnly=true; claimTrueCount=0"
    }
  ],
  "violations": [],
  "evidence": [
    "public/.well-known/mirmc-trust.json",
    "public/.well-known/mirmc-network-gateway.json",
    "public/.well-known/mirmc-identity-evidence.json",
    "public/.well-known/mirmc-source-execution-evidence.json",
    "public/.well-known/mirmc-operational-evidence.json",
    "src/lib/enterprise-trust.ts",
    "src/lib/enterprise-network-gateway-public-status.ts",
    "src/lib/enterprise-identity-evidence-public-status.ts",
    "src/lib/enterprise-source-execution-evidence-public-status.ts",
    "src/lib/enterprise-operational-evidence-public-status.ts"
  ],
  "disclaimer": {
    "en": "This index checks consistency among source-backed enterprise evidence surfaces. A consistent index is not runtime verification, a certification, a contractual SLA, a production deployment receipt or release authority.",
    "es": "Este índice comprueba consistencia entre superficies enterprise respaldadas por código. Un índice consistente no es verificación runtime, certificación, SLA contractual, receipt de despliegue productivo ni autoridad de release."
  }
}