{"evidence":{"account_id":"836503214034","budget_review":{"actual_usd_before_run":11.39,"budget_name":"ecokure-targetrep-monthly-cap","cap_rechecked_after_run":true,"cap_usd":25.0,"cost_explorer_net_month_to_date_usd_at_close":-1.1618e-06,"cost_note":"Cost Explorer returned a near-zero net amount at close, which may include credits and is not a final invoice. The account budget cap remains the controlling guard."},"captured_at":"2026-09-16T01:34:14Z","checks":[{"evidence":"The ECS task used the reviewed customer runtime role; the app stayed healthy with WEB_CONCURRENCY=1 for the supervised run.","id":"runtime_identity","status":"PASS"},{"algorithm":"ECDSA_SHA_256","id":"kms_sign_verify","message_sha256":"ad4f1df58be97787a2d1f50d3fe6cf510abb483bbf2d532ec28504faad633cc5","status":"PASS"},{"evidence":"The runtime round-trip succeeded and outside-prefix access was denied. A two-principal cross-tenant denial run was not performed in this one-task smoke.","id":"tenant_scope","status":"REVIEW"},{"encrypted":true,"evidence":"An encrypted RDS snapshot was created and restored into a private isolated staging instance, then both temporary resources were deleted.","id":"backup_restore","public":false,"restore_status":"available","snapshot_status":"available","status":"PASS"},{"evidence":"CSP, HSTS, X-Content-Type-Options, X-Frame-Options and Referrer-Policy were present. External ALB/TLS ingress was outside this smoke.","id":"security_headers","status":"PASS","transport_scope":"internal task health endpoint"},{"evidence":"The frozen synthetic request returned the expected controlled BLOCK decision and a persisted record digest. The raw sidecar status is FAIL because the fixture intentionally exercises the blocking branch.","http_status":200,"id":"synthetic_request","record_digest":"024c337e702c5e8b7cd26bffa4fda54c75dfea7cee7d4a2443a3bf8af30a37a0","status":"PASS","verdict":"BLOCK"}],"claim_boundary":["Synthetic target-environment staging smoke only.","Not customer production validation, certification, a security certification, a medical benefit claim or an AWS Well-Architected review.","External HTTPS ingress and independent cross-tenant principals were not run in this one-task smoke.","The ECR scan contains 6 critical and 12 high findings; production use requires remediation or explicit customer acceptance."],"cluster":"ecokure-staging","environment":"customer-owned staging","evidence_id":"AWS_CUSTOMER_STAGING_SMOKE_20260916","image":"836503214034.dkr.ecr.ap-southeast-2.amazonaws.com/ecokure-staging@sha256:0d213d3f9077702468e74ec5c8d80d1bc9a111d05e09091b7e0b022b3277ad15","image_archive_correction":{"corrected_image_digest":"sha256:0d213d3f9077702468e74ec5c8d80d1bc9a111d05e09091b7e0b022b3277ad15","corrected_source_archive_sha256":"77048FF39BE13CA0C28C50C222C18C0D6EA1B19F2773B1BF6F2D32E350619E04","correction_verified":true,"initial_image_digest":"sha256:6d2a5b16bb9730a4a462eb6091d1c7be151c694151ad8a7706811c4aa1a07858","initial_issue":"The first archive omitted four benchmark modules and the default two-worker Gunicorn bootstrap raced during startup."},"network":{"assign_public_ip":false,"nat_path":false,"runtime_subnet_id":"subnet-02a85faa1cccccc06","teardown":"completed; endpoint resources and endpoint security group removed","temporary_private_endpoints":["ECR API","ECR DKR","CloudWatch Logs","STS","Secrets Manager","KMS","S3 gateway"],"vpc_id":"vpc-02fd52742d22875ff"},"overall":"The supervised synthetic smoke passed the runtime, signing, storage, backup/restore, headers and controlled decision paths. Tenant isolation across independent principals and external HTTPS ingress remain review gates.","region":"ap-southeast-2","runtime_probe":{"gate_catalogue":{"gate_count":5,"status":"PASS"},"liveness":"PASS","readiness":"PASS","scoped_evidence_storage":{"object_key":"tenants/smoke-20260916/record.json","outside_prefix_denied":true,"status":"PASS","tenant_roundtrip":true}},"scan":{"findings":27,"interpretation":"The corrected image is runnable staging evidence but is not production hardened. Resolve or explicitly accept these base-image findings before any production deployment.","severity_counts":{"CRITICAL":6,"HIGH":12,"LOW":4,"MEDIUM":5},"status":"COMPLETE"},"task_arn":"arn:aws:ecs:ap-southeast-2:836503214034:task/ecokure-staging/271b63c559034ba884e58c7b498bcc87","task_definition":"arn:aws:ecs:ap-southeast-2:836503214034:task-definition/ecokure-staging-smoke:4","teardown":{"customer_owned_ecr_repository_retained":true,"status":"PASS","temporary_cluster_deleted":true,"temporary_ecs_tasks_stopped":true,"temporary_endpoint_security_group_deleted":true,"temporary_iam_grants_removed":true,"temporary_log_group_deleted":true,"temporary_private_endpoints_deleted":true,"temporary_rds_restore_deleted":true,"temporary_rds_snapshot_deleted":true,"temporary_secret_deleted":true},"verification_state":"PARTIAL"},"limitations":["Synthetic target-environment staging smoke only.","Not customer production validation, certification, a security certification, a medical benefit claim or an AWS Well-Architected review.","External HTTPS ingress and independent cross-tenant principals were not run in this one-task smoke.","The ECR scan contains 6 critical and 12 high findings; production use requires remediation or explicit customer acceptance."],"pack_type":"EcoKure customer-owned AWS staging smoke EvidencePack","verification_state":"PARTIAL"}