{
  "kind": "Owned synthetic control demonstration; not a client audit",
  "version": 1,
  "sourceSha256": "5525d6e5f7451b84a30da711a25ad8c5466a3be35f3030ed38b97e4fe6f408b9",
  "coverage": "Sequential in-memory approval, duplicate-request and failed-write cases; no LLM evaluation, distributed concurrency, real authentication, external API or production environment.",
  "findings": [
    {
      "id": "approval",
      "title": "Model assertion cannot supply approval",
      "impact": "An action could proceed without the required human authority.",
      "severity": "High within this demonstration",
      "fix": "Check trusted approval at the action boundary.",
      "before": {
        "pass": false,
        "observed": "recorded; 1 records"
      },
      "after": {
        "pass": true,
        "observed": "blocked; 0 records"
      }
    },
    {
      "id": "retry",
      "title": "A repeated request creates one record",
      "impact": "Retrying the same intent could duplicate a business record.",
      "severity": "High within this demonstration",
      "fix": "Use a stable operation key and return the prior result.",
      "before": {
        "pass": false,
        "observed": "2 records; 2 writes; same result: false"
      },
      "after": {
        "pass": true,
        "observed": "1 records; 1 writes; same result: true"
      }
    },
    {
      "id": "failure",
      "title": "A failed write is not reported as recorded",
      "impact": "The user could rely on work that was never persisted.",
      "severity": "High within this demonstration",
      "fix": "Represent the failed write as unconfirmed instead of claiming success.",
      "before": {
        "pass": false,
        "observed": "recorded; 0 records"
      },
      "after": {
        "pass": true,
        "observed": "unconfirmed; 0 records"
      }
    }
  ],
  "positiveControl": "Approved valid operation recorded once"
}