{
    "ok": true,
    "schema": "threat.cafe/audit-pack/v3.0",
    "generated_at": "2026-10-27T19:12:08Z",
    "team_id": "demo",
    "cryptographic_attestation": {
        "key_id": "tc-ed25519-2026-01",
        "pubkey_url": "https://threat.cafe/pubkey.pem",
        "feed_sha256": "5323f1702643db04bd01985be1fe981a45c1deda0f8473589d857b6a9707e57c",
        "feed_signature_b64": "pwSFn6VkyCBCDHDAHu1udfBFuEQGNHfT70qlc5gJqHXnzF5iUJSCI84oSbw5pfuxGT99QOrVhA/d2Ou+eVPUDQ==",
        "receipt_digest": "sha256:13e28304b884b49f988d26a7e6dad892b15fd1ed8ae71e1d00fd0d6c75bf06ac"
    },
    "frameworks": {
        "soc2": [
            "CC6.1 Logical Access Controls",
            "CC6.8 Malicious Software Prevention",
            "CC7.2 System Monitoring & Anomaly Detection"
        ],
        "iso_42001": [
            "Clause 6.1.2 AI Risk Assessment",
            "Annex A.6.2.6 AI System Third-Party Tooling",
            "Annex B.8 Supplier & Supply-Chain Controls"
        ],
        "owasp_agentic_2026": [
            "ASI01 Agent Goal Hijack",
            "ASI02 Tool Misuse",
            "ASI03 Privilege Abuse",
            "ASI04 Supply Chain",
            "ASI05 RCE",
            "AST01..AST10"
        ],
        "cyber_insurance_rider": "Pre-Execution Deterministic Agent Hook & Config-Write Firewall Attestation"
    },
    "summary": {
        "total_events": 4,
        "known_bad_count": 3,
        "no_known_bad_count": 1,
        "unknown_count": 0,
        "blocked_executions": 3
    },
    "events": [
        {
            "event_id": "ev_demo_001",
            "ts": "2026-10-25T08:12:04Z",
            "team_id": "demo",
            "client": "claude-code",
            "host_hash": "a8f19c220b14e812",
            "target": "npm:axios@1.14.1",
            "verdict": "known_bad",
            "policy_action": "block",
            "rule_id": "TC-2026-0001 / RULE_04_INSTALL_LIFECYCLE_HOOK",
            "owasp_asi": "ASI02,ASI04",
            "exit_code": 2
        },
        {
            "event_id": "ev_demo_002",
            "ts": "2026-10-25T08:14:19Z",
            "team_id": "demo",
            "client": "cursor",
            "host_hash": "b4e09188a77c093f",
            "target": "Write:.claude/settings.json",
            "verdict": "known_bad",
            "policy_action": "block",
            "rule_id": "RUNTIME_02_CONFIG_WRITE_FIREWALL",
            "owasp_asi": "ASI01,ASI05",
            "exit_code": 2
        },
        {
            "event_id": "ev_demo_003",
            "ts": "2026-10-25T08:19:51Z",
            "team_id": "demo",
            "client": "claude-code",
            "host_hash": "a8f19c220b14e812",
            "target": "npm:axios@1.14.0",
            "verdict": "no_known_bad",
            "policy_action": "proceed_log",
            "rule_id": "TC-2026-0101",
            "owasp_asi": "",
            "exit_code": 0
        },
        {
            "event_id": "ev_demo_004",
            "ts": "2026-10-25T08:25:10Z",
            "team_id": "demo",
            "client": "openclaw",
            "host_hash": "c912d44e6100fa21",
            "target": "skillssh:designed-by-ai/skills/design-mobile-apps",
            "verdict": "known_bad",
            "policy_action": "block",
            "rule_id": "TC-2026-0034 / RULE_07_CREDENTIAL_PROMPT_HARVEST",
            "owasp_asi": "ASI01,ASI03",
            "exit_code": 2
        }
    ]
}