{"evidence":{"claim_boundary":["This snapshot aggregates published evidence; it is not a certification, audit opinion or production approval.","PASS means the named evidence capture passed its own checks, not that EcoKure is ready for every customer environment.","Pending gates require authorized customer infrastructure, credentials, independent review or a real shadow pilot."],"customer_data":false,"evidence_id":"ENTERPRISE_READINESS_SNAPSHOT_20260829","pending":[{"checks":[{"key":"application_database_postgresql","label":"Application store on PostgreSQL, not a local file","passing":true},{"key":"protected_corpus_postgresql","label":"Protected corpus on PostgreSQL, not a local file","passing":true},{"key":"datastores_separately_configured","label":"Corpus and application stores separately configured","passing":true}],"checks_passing":3,"checks_total":3,"detail":"Validate tenant isolation, backup/restore, RTO/RPO, monitoring and incident procedures in the target environment.","evidence_required":"Isolation test, restore transcript, measured RTO/RPO and alert/incident drill records.","id":"production-boundaries","label":"Production isolation and recovery","next_action":"Agree the target SLO, retention and recovery objectives before the pilot.","owner":"Customer / EcoKure"},{"checks":[],"detail":"Complete threat-model review and penetration testing against the deployed configuration.","evidence_required":"Scoped threat model, test report, remediation register and retest disposition.","external_only":"Closes only on an independent tester. Self-testing cannot close this one by definition, which is the whole point of it.","id":"security-review","label":"External security review","next_action":"Give an independent tester the staging scope and the current SBOM/release manifest.","owner":"Customer / independent tester"},{"checks":[],"detail":"Run one bounded workflow with customer data boundaries, reviewers, SLOs and a signed go/no-go record.","evidence_required":"Pilot charter, control-pack release, review queue, signed EvidencePack and go/no-go decision.","external_only":"Closes on a real customer workflow, their reviewers and their data boundary.","id":"customer-pilot","label":"Real shadow pilot","next_action":"Choose one non-actuating workflow and name its risk owner and reviewer.","owner":"Customer / named workflow owner"},{"checks":[{"key":"canonical_https","label":"Canonical HTTPS base URL and SSO redirect","passing":true},{"key":"transactional_email","label":"Transactional email (Resend API or SMTP) configured","passing":true},{"key":"reviewer_sso","label":"Reviewer SSO registered","passing":false},{"key":"production_secrets","label":"Production secrets present, no placeholders","passing":true}],"checks_passing":3,"checks_total":4,"detail":"Confirm production email delivery, canonical DNS, SSO registration and support/retention arrangements.","evidence_required":"Verified DNS, test delivery, SSO metadata, support contact and retention policy.","id":"operational-services","label":"Operational services","next_action":"Complete the service checklist using customer-approved credentials and domains.","owner":"EcoKure operator"}],"proven":[{"detail":"20 of 20 scenarios; zero critical failures","id":"enterprise-validation","label":"Synthetic enterprise validation","status":"PASS"},{"detail":"Negative controls, tamper rejection, rollback and bypass attempts exercised","id":"adversarial-validation","label":"Synthetic adversarial validation","status":"PASS"},{"detail":"16 of 16 checks passed","id":"full-control-loop","label":"Full tenant control loop","status":"PASS"},{"detail":"2,000 sign/verify operations; synthetic payloads","id":"aws-kms-curve","label":"Live AWS KMS capacity curve","status":"MEASURED"},{"detail":"1,500 repeated sign/verify operations; worst p95 62.94 ms","id":"aws-kms-stability","label":"Repeated live AWS KMS stability","status":"MEASURED"},{"detail":"600 of 600 read-only requests; 40.225 requests/sec at 32 workers","id":"runtime-capacity-boundary","label":"Live runtime concurrency boundary","status":"MEASURED"},{"detail":"Read-only policy inspection; runtime task evidence is recorded separately.","id":"runtime-policy","label":"AWS runtime IAM policy shape","status":"PASS"},{"detail":"Scoped ECS/ECR/CloudWatch authority and a scanned, immutable customer ECR digest are recorded; the supervised ECS task and smoke are recorded separately.","id":"image-authority","label":"Customer-owned image and AWS deployment authority","status":"PASS"},{"detail":"The supervised synthetic smoke passed the runtime, signing, storage, backup/restore, headers and controlled decision paths. Tenant isolation across independent principals and external HTTPS ingress remain review gates.","id":"aws-runtime-smoke","label":"Customer-owned AWS six-check smoke","status":"PARTIAL"},{"detail":"43 locked runtime components inventoried","id":"dependency-lock","label":"Dependency lock and SBOM","status":"PASS"},{"detail":"No known findings returned for the exact package lock at scan time","id":"vulnerability-scan","label":"Lock-bound vulnerability scan","status":"PASS_NO_KNOWN_VULNERABILITIES"},{"detail":"Source and build inputs hashed; the customer image digest is recorded separately.","id":"release-inputs","label":"Release input integrity manifest","status":"PASS_RELEASE_INPUTS_HASHED"}],"status":"REVIEW_REQUIRED","summary":{"external_gates_open":4,"pending_count":4,"proven_count":12},"verification_state":"PUBLIC_READINESS_SNAPSHOT"},"limitations":["This snapshot aggregates published evidence; it is not a certification, audit opinion or production approval.","PASS means the named evidence capture passed its own checks, not that EcoKure is ready for every customer environment.","Pending gates require authorized customer infrastructure, credentials, independent review or a real shadow pilot."],"pack_type":"EcoKure enterprise readiness snapshot EvidencePack","verification_state":"PUBLIC_READINESS_SNAPSHOT"}