{
  "schemaVersion": 1,
  "generatedAt": "2026-09-07T16:05:53.938Z",
  "summary": {
    "total": 19,
    "passing": 19,
    "skipped": 0,
    "productionHighCves": 0,
    "productionCriticalCves": 0
  },
  "milestones": {
    "lastDrDrill": "2026-06-12",
    "lastPenTest": "Scheduled 2026 Q3 (CREST-accredited)",
    "lastDependencyAudit": "2026-06-12"
  },
  "verifiers": [
    {
      "id": "verify-audit-hash",
      "label": "Audit chain SHA-256 integrity",
      "claim": "Every AuditEntry's hash chain links — tampering would surface within one CI run.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-audit-hash-chain.ts"
    },
    {
      "id": "verify-retention-worker",
      "label": "Retention worker isolation",
      "claim": "Hospital A's retention override never mutates Hospital B's records.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-retention-worker.ts"
    },
    {
      "id": "verify-rls",
      "label": "Row-Level Security activation",
      "claim": "25 RLS invariants over per-tenant scopes — fail-closed on misconfiguration.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-rls-activation.ts"
    },
    {
      "id": "verify-tenant",
      "label": "Multi-tenant fail-closed",
      "claim": "Cross-tenant query without explicit opt-in throws — verified in CI on every PR.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-tenant-isolation.ts"
    },
    {
      "id": "verify-kms-roundtrip",
      "label": "KMS envelope encryption",
      "claim": "21 round-trip invariants + tamper-detection on encrypted attachments.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-kms-roundtrip.ts"
    },
    {
      "id": "verify-dicom-phi",
      "label": "DICOM PHI envelope encryption",
      "claim": "8 invariants: encrypt/decrypt round-trip + IV uniqueness + AEAD tamper + serializer omission.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-dicom-phi-encryption.ts"
    },
    {
      "id": "verify-dr-drill",
      "label": "Backup + restore parity (DR)",
      "claim": "Quarterly drill: backup → restore → schema parity. Last drill is recorded in the audit chain.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/ci-backup-drill.sh"
    },
    {
      "id": "verify-security-headers",
      "label": "HTTP security headers",
      "claim": "HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — 8/8 PASS.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-security-headers.sh"
    },
    {
      "id": "verify-totp",
      "label": "TOTP (RFC 6238) E2E",
      "claim": "10-step enroll → verify → logout → re-login (challenge) → disable cycle.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-totp-flow.sh"
    },
    {
      "id": "verify-oidc",
      "label": "OIDC SSO Authorization Code",
      "claim": "5-step live drive against Keycloak: start → form-POST → callback → /me with role mapping.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-oidc-keycloak-smoke.sh"
    },
    {
      "id": "verify-similar-cases",
      "label": "Faz 0 AI — similar cases isolation",
      "claim": "Hospital A's case never surfaces in Hospital B's advisory even with byte-identical titles; 5 invariants verified.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-similar-cases.ts"
    },
    {
      "id": "verify-appointment-lifecycle",
      "label": "Appointment workflow lifecycle",
      "claim": "Provider working-hours guard + AppointmentStatus state machine (scheduled→confirmed→checked_in→in_progress→completed; terminal states block).",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-appointment-lifecycle.ts"
    },
    {
      "id": "verify-ai-adapter",
      "label": "Faz 1 AI provider + PHI redaction",
      "claim": "Disabled by default + hospital consent gate + PHI redaction + clinical-safety disclaimer seam. 6 invariants.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-ai-adapter.ts"
    },
    {
      "id": "verify-ai-residency",
      "label": "AI endpoint EU residency",
      "claim": "AI_API_BASE_URL must be on-prem, AWS Bedrock EU, or Azure OpenAI EU. OpenAI proper rejected unless explicit DPO+CISO override.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-ai-residency.ts"
    },
    {
      "id": "verify-ai-consent",
      "label": "Hospital AI consent toggle",
      "claim": "RBAC + confirmation token + agreementVersion check + audit trail on every AI advisory consent change. 5 invariants.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-ai-consent.ts"
    },
    {
      "id": "verify-platform-onboarding",
      "label": "PSA hospital onboarding atomic",
      "claim": "PSA atomic Hospital + Admin + Invite create; PSA-only RBAC; idempotency; audit trail. 5 invariants.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-platform-onboarding.ts"
    },
    {
      "id": "verify-embeddings",
      "label": "Faz 0.5 semantic embeddings + hybrid similar",
      "claim": "Embedding adapter contract + cosine math + hybrid endpoint reranks identical-embedding neighbour to #1; trigram fallback on null. 6 invariants.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-embeddings.ts"
    },
    {
      "id": "verify-ai-metrics",
      "label": "CMO AI metrics + feedback",
      "claim": "Per-hospital AI invocation aggregation + thumbs-up/down feedback collection + model drift detection. 5 invariants.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-ai-metrics.ts"
    },
    {
      "id": "verify-demo-data",
      "label": "Sales demo data integrity",
      "claim": "Base demo tenant + 3 clinical scenarios + consultations + --reset idempotency. 4 invariants.",
      "lastRun": "2026-06-12",
      "status": "pass",
      "evidence": "scripts/verify-demo-data.ts"
    }
  ],
  "documentation": {
    "humanReadable": "/trust",
    "changelog": "/CHANGELOG.md",
    "securityTxt": "/.well-known/security.txt"
  }
}