{
  "schema_version": 1,
  "generated_at": "2026-11-07T05:09:36Z",
  "sandboxes": [
    {
      "sandbox": "email-dns",
      "collector": "email-dns",
      "level": "audit",
      "description": "A domain used only for these checks, with four mail subdomains. One publishes SPF, a DMARC policy that rejects with aggregate reports, and a DKIM key. One has weak but valid records, one has malformed SPF and DMARC records, and one has no records at all.",
      "limits": [
        "One domain, hosted in Route 53 and read through public DNS.",
        "No subdomain publishes mail servers, so the MX values are checked only at 0.",
        "The collector looks up only common DKIM selectors, so a key at another selector would not be found.",
        "Every lookup answers, so the sandbox does not check what the collector does when one fails."
      ],
      "known_values": 152,
      "latest": {
        "date": "2026-11-07",
        "version": "v0.2.2",
        "result": "passed"
      },
      "passing_since": "2026-10-21",
      "nights": [
        {
          "date": "2026-10-21",
          "version": "v0.2.0",
          "result": "passed"
        },
        {
          "date": "2026-10-22",
          "version": "v0.2.1",
          "result": "passed"
        },
        {
          "date": "2026-10-23",
          "version": "v0.2.2",
          "result": "passed"
        },
        {
          "date": "2026-10-24",
          "version": "v0.2.2",
          "result": "passed"
        },
        {
          "date": "2026-10-25",
          "version": "v0.2.2",
          "result": "passed"
        },
        {
          "date": "2026-10-26",
          "version": "v0.2.2",
          "result": "passed"
        },
        {
          "date": "2026-10-27",
          "version": "v0.2.2",
          "result": "passed"
        },
        {
          "date": "2026-10-28",
          "version": "v0.2.2",
          "result": "passed"
        },
        {
          "date": "2026-10-29",
          "version": "v0.2.2",
          "result": "passed"
        },
        {
          "date": "2026-10-30",
          "version": "v0.2.2",
          "result": "passed"
        },
        {
          "date": "2026-10-31",
          "version": "v0.2.2",
          "result": "passed"
        },
        {
          "date": "2026-11-01",
          "version": "v0.2.2",
          "result": "passed"
        },
        {
          "date": "2026-11-02",
          "version": "v0.2.2",
          "result": "passed"
        },
        {
          "date": "2026-11-03",
          "version": "v0.2.2",
          "result": "passed"
        },
        {
          "date": "2026-11-04",
          "version": "v0.2.2",
          "result": "passed"
        },
        {
          "date": "2026-11-05",
          "version": "v0.2.2",
          "result": "passed"
        },
        {
          "date": "2026-11-06",
          "version": "v0.2.2",
          "result": "passed"
        },
        {
          "date": "2026-11-07",
          "version": "v0.2.2",
          "result": "passed"
        }
      ],
      "checked": {
        "source": "nightly",
        "date": "2026-11-07",
        "version": "v0.2.2"
      },
      "fields": [
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/schema_version",
          "expected": "\"1.0.0\"",
          "collected": "\"1.0.0\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/diagnostics",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/0/domain",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/0/mx",
          "expected": "[]",
          "collected": "[]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/0/spf/record",
          "expected": "\"v=spf1 -all\"",
          "collected": "\"v=spf1 -all\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/0/spf/valid",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/0/dmarc/record",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/0/dmarc/policy",
          "expected": "\"reject\"",
          "collected": "\"reject\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/0/dmarc/subdomain_policy",
          "expected": "\"reject\"",
          "collected": "\"reject\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/0/dmarc/pct",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/0/dmarc/rua",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/0/dmarc/valid",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/0/dkim/0/selector",
          "expected": "\"s1\"",
          "collected": "\"s1\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/0/dkim/0/valid",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/0/dkim/1",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/0/assessment/enforced",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/0/assessment/has_reporting",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/0/assessment/issues",
          "expected": "[]",
          "collected": "[]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/0/errors",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/1/domain",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/1/mx",
          "expected": "[]",
          "collected": "[]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/1/spf/record",
          "expected": "\"v=spf1 ~all\"",
          "collected": "\"v=spf1 ~all\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/1/spf/valid",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/1/dmarc/record",
          "expected": "\"v=DMARC1; p=none\"",
          "collected": "\"v=DMARC1; p=none\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/1/dmarc/policy",
          "expected": "\"none\"",
          "collected": "\"none\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/1/dmarc/subdomain_policy",
          "expected": "\"none\"",
          "collected": "\"none\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/1/dmarc/pct",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/1/dmarc/rua",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/1/dmarc/valid",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/1/dkim",
          "expected": "[]",
          "collected": "[]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/1/assessment/enforced",
          "expected": "false",
          "collected": "false",
          "result": "passed",
          "reason": "Its DMARC policy is p=none, which only monitors."
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/1/assessment/has_reporting",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/1/assessment/issues",
          "expected": "[\"DMARC policy is 'none' (monitoring only)\",\"No DMARC aggregate reporting (rua) configured\",\"Subdomain policy is not 're...",
          "collected": "[\"DMARC policy is 'none' (monitoring only)\",\"No DMARC aggregate reporting (rua) configured\",\"Subdomain policy is not 're...",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/1/errors",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/2/domain",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/2/mx",
          "expected": "[]",
          "collected": "[]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/2/spf/record",
          "expected": "\"v=spf1 ipv4:192.0.2.10 -all\"",
          "collected": "\"v=spf1 ipv4:192.0.2.10 -all\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/2/spf/valid",
          "expected": "false",
          "collected": "false",
          "result": "passed",
          "reason": "Its SPF record uses ipv4:, which is not an SPF mechanism."
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/2/dmarc/record",
          "expected": "\"v=DMARC1; p=quarentine\"",
          "collected": "\"v=DMARC1; p=quarentine\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/2/dmarc/policy",
          "expected": "\"unknown\"",
          "collected": "\"unknown\"",
          "result": "passed",
          "reason": "Its DMARC policy is spelled quarentine, which is not a policy, so the collector reads it as unknown."
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/2/dmarc/subdomain_policy",
          "expected": "\"unknown\"",
          "collected": "\"unknown\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/2/dmarc/pct",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/2/dmarc/valid",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/2/dkim",
          "expected": "[]",
          "collected": "[]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/2/assessment/enforced",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/2/assessment/has_reporting",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/2/assessment/issues",
          "expected": "[\"Invalid SPF record\",\"Invalid DMARC record\",\"No DKIM records found for common selectors (custom selectors not checked)\"...",
          "collected": "[\"Invalid SPF record\",\"Invalid DMARC record\",\"No DKIM records found for common selectors (custom selectors not checked)\"...",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/2/errors",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/3/domain",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/3/mx",
          "expected": "[]",
          "collected": "[]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/3/spf",
          "expected": "null or absent",
          "collected": "null",
          "result": "passed",
          "reason": "The subdomain has no records at all."
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/3/dmarc",
          "expected": "null or absent",
          "collected": "null",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/3/dkim",
          "expected": "[]",
          "collected": "[]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/3/assessment/enforced",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/3/assessment/has_reporting",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/3/assessment/issues",
          "expected": "[\"No SPF record\",\"No DMARC record\",\"No DKIM records found for common selectors (custom selectors not checked)\"]",
          "collected": "[\"No SPF record\",\"No DMARC record\",\"No DKIM records found for common selectors (custom selectors not checked)\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/domains/3/errors",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/summary/total_domains",
          "expected": "4",
          "collected": "4",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/summary/with_mx_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/summary/with_mx_pct",
          "expected": "0",
          "collected": "0",
          "result": "passed",
          "reason": "No subdomain publishes mail servers."
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/summary/with_spf_count",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/summary/with_spf_pct",
          "expected": "75",
          "collected": "75",
          "result": "passed",
          "reason": "Three of the four subdomains publish an SPF record. One of those records is malformed, and it still counts."
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/summary/with_dmarc_count",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/summary/with_dmarc_pct",
          "expected": "75",
          "collected": "75",
          "result": "passed",
          "reason": "Three of the four publish a DMARC record, one of them malformed."
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/summary/with_dkim_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/summary/with_dkim_pct",
          "expected": "25",
          "collected": "25",
          "result": "passed",
          "reason": "One of the four publishes a DKIM key."
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/summary/with_all_three_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/summary/with_all_three_pct",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/summary/enforced_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/summary/enforced_pct",
          "expected": "25",
          "collected": "25",
          "result": "passed",
          "reason": "One of the four has a DMARC policy that rejects all mail that fails the check."
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/summary/with_reporting_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/summary/with_reporting_pct",
          "expected": "25",
          "collected": "25",
          "result": "passed",
          "reason": "One of the four names an address for DMARC aggregate reports."
        },
        {
          "artifact": "artifacts/email-dns.json",
          "pointer": "/summary/all_enforced",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.collector-result.json",
          "pointer": "/collector/name",
          "expected": "\"email-dns\"",
          "collected": "\"email-dns\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.collector-result.json",
          "pointer": "/outcome/status",
          "expected": "\"collected\"",
          "collected": "\"collected\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.collector-result.json",
          "pointer": "/gaps",
          "expected": "[]",
          "collected": "[]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/email-dns.collector-result.json",
          "pointer": "/checks",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        }
      ],
      "requirements": [
        {
          "id": "EMAIL-001",
          "name": "SPF Records Configured",
          "category": "Email Security",
          "needs_other_evidence": false,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": []
        },
        {
          "id": "EMAIL-002",
          "name": "DMARC Records Configured",
          "category": "Email Security",
          "needs_other_evidence": false,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": []
        },
        {
          "id": "EMAIL-003",
          "name": "DMARC Enforcement",
          "category": "Email Security",
          "needs_other_evidence": false,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": []
        },
        {
          "id": "EMAIL-004",
          "name": "DMARC Reporting Enabled",
          "category": "Email Security",
          "needs_other_evidence": false,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": []
        }
      ]
    },
    {
      "sandbox": "tls",
      "collector": "tls",
      "level": "audit",
      "description": "One small nginx host used only for these checks, serving six endpoints. One accepts only TLS 1.2 and 1.3 with a valid certificate. One also accepts TLS 1.0 and 1.1, and one accepts only those two. The other three serve a self-signed certificate, a certificate for a different name, and an expired certificate. Trusted certificates come from Let's Encrypt, and the collector reads the endpoints at the audit level.",
      "limits": [
        "One host behind one address, with no load balancer or CDN in front of it.",
        "Every endpoint answers, by completing a handshake or turning a version down, so the sandbox does not check what the collector does when a host does not answer.",
        "Let's Encrypt certificates renew automatically, so their days left are checked as ranges."
      ],
      "known_values": 280,
      "latest": {
        "date": "2026-11-07",
        "version": "v0.2.0",
        "result": "passed"
      },
      "passing_since": "2026-10-30",
      "nights": [
        {
          "date": "2026-10-30",
          "version": "v0.2.0",
          "result": "passed"
        },
        {
          "date": "2026-10-31",
          "version": "v0.2.0",
          "result": "passed"
        },
        {
          "date": "2026-11-01",
          "version": "v0.2.0",
          "result": "passed"
        },
        {
          "date": "2026-11-02",
          "version": "v0.2.0",
          "result": "passed"
        },
        {
          "date": "2026-11-03",
          "version": "v0.2.0",
          "result": "passed"
        },
        {
          "date": "2026-11-04",
          "version": "v0.2.0",
          "result": "passed"
        },
        {
          "date": "2026-11-05",
          "version": "v0.2.0",
          "result": "passed"
        },
        {
          "date": "2026-11-06",
          "version": "v0.2.0",
          "result": "passed"
        },
        {
          "date": "2026-11-07",
          "version": "v0.2.0",
          "result": "passed"
        }
      ],
      "checked": {
        "source": "nightly",
        "date": "2026-11-07",
        "version": "v0.2.0"
      },
      "fields": [
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/schema_version",
          "expected": "\"1.0.0\"",
          "collected": "\"1.0.0\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/host",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/port",
          "expected": "443",
          "collected": "443",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/reachable",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/tls/negotiated_version",
          "expected": "\"TLS 1.3\"",
          "collected": "\"TLS 1.3\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/tls/protocol_support/tls_1_0",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/tls/protocol_support/tls_1_1",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/tls/protocol_support/tls_1_2",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/tls/protocol_support/tls_1_3",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/certificate/dns_names",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/certificate/public_key_algorithm",
          "expected": "\"ECDSA\"",
          "collected": "\"ECDSA\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/certificate/chain_length",
          "expected": "between 2 and 4",
          "collected": "4",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/certificate/trusted_chain",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/certificate/hostname_valid",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/certificate/expires_in_days",
          "expected": "between 30 and 90",
          "collected": "74",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/assessment/certificate_valid",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/assessment/hostname_valid",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/assessment/expired",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/assessment/expiring_soon",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/assessment/modern_protocol",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/assessment/legacy_protocol_supported",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/assessment/issues",
          "expected": "[]",
          "collected": "[]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/0/errors",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/host",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/port",
          "expected": "8443",
          "collected": "8443",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/reachable",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/tls/negotiated_version",
          "expected": "\"TLS 1.3\"",
          "collected": "\"TLS 1.3\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/tls/protocol_support/tls_1_0",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/tls/protocol_support/tls_1_1",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/tls/protocol_support/tls_1_2",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/tls/protocol_support/tls_1_3",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/certificate/dns_names",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/certificate/public_key_algorithm",
          "expected": "\"ECDSA\"",
          "collected": "\"ECDSA\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/certificate/chain_length",
          "expected": "between 2 and 4",
          "collected": "4",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/certificate/trusted_chain",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/certificate/hostname_valid",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/certificate/expires_in_days",
          "expected": "between 30 and 90",
          "collected": "74",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/assessment/certificate_valid",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/assessment/hostname_valid",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/assessment/expired",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/assessment/expiring_soon",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/assessment/modern_protocol",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/assessment/legacy_protocol_supported",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/assessment/issues",
          "expected": "[\"TLS 1.0 or TLS 1.1 is supported\"]",
          "collected": "[\"TLS 1.0 or TLS 1.1 is supported\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/1/errors",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/2/host",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/2/port",
          "expected": "8444",
          "collected": "8444",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/2/reachable",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/2/tls/negotiated_version",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/2/tls/protocol_support/tls_1_0",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/2/tls/protocol_support/tls_1_1",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/2/tls/protocol_support/tls_1_2",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/2/tls/protocol_support/tls_1_3",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/2/certificate",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/2/assessment/certificate_valid",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/2/assessment/hostname_valid",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/2/assessment/expired",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/2/assessment/expiring_soon",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/2/assessment/modern_protocol",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/2/assessment/legacy_protocol_supported",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/2/assessment/issues",
          "expected": "[\"Endpoint was not reachable over modern TLS\",\"No certificate was presented\",\"TLS 1.2 or TLS 1.3 support was not detecte...",
          "collected": "[\"Endpoint was not reachable over modern TLS\",\"No certificate was presented\",\"TLS 1.2 or TLS 1.3 support was not detecte...",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/host",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/port",
          "expected": "443",
          "collected": "443",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/reachable",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/tls/negotiated_version",
          "expected": "\"TLS 1.3\"",
          "collected": "\"TLS 1.3\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/tls/protocol_support/tls_1_0",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/tls/protocol_support/tls_1_1",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/tls/protocol_support/tls_1_2",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/tls/protocol_support/tls_1_3",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/certificate/subject_common_name",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/certificate/issuer_common_name",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/certificate/dns_names",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/certificate/public_key_algorithm",
          "expected": "\"ECDSA\"",
          "collected": "\"ECDSA\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/certificate/chain_length",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/certificate/trusted_chain",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/certificate/hostname_valid",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/certificate/expires_in_days",
          "expected": "between 30 and 3650",
          "collected": "3634",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/assessment/certificate_valid",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/assessment/hostname_valid",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/assessment/expired",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/assessment/expiring_soon",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/assessment/modern_protocol",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/assessment/legacy_protocol_supported",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/assessment/issues",
          "expected": "[\"Certificate chain is not trusted\"]",
          "collected": "[\"Certificate chain is not trusted\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/3/errors",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/host",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/port",
          "expected": "443",
          "collected": "443",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/reachable",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/tls/negotiated_version",
          "expected": "\"TLS 1.3\"",
          "collected": "\"TLS 1.3\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/tls/protocol_support/tls_1_0",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/tls/protocol_support/tls_1_1",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/tls/protocol_support/tls_1_2",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/tls/protocol_support/tls_1_3",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/certificate/dns_names",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/certificate/public_key_algorithm",
          "expected": "\"ECDSA\"",
          "collected": "\"ECDSA\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/certificate/chain_length",
          "expected": "between 2 and 4",
          "collected": "4",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/certificate/trusted_chain",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/certificate/hostname_valid",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/certificate/expires_in_days",
          "expected": "between 30 and 90",
          "collected": "74",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/assessment/certificate_valid",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/assessment/hostname_valid",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/assessment/expired",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/assessment/expiring_soon",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/assessment/modern_protocol",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/assessment/legacy_protocol_supported",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/assessment/issues",
          "expected": "[\"Certificate hostname does not match the endpoint\"]",
          "collected": "[\"Certificate hostname does not match the endpoint\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/4/errors",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/host",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/port",
          "expected": "443",
          "collected": "443",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/reachable",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/tls/negotiated_version",
          "expected": "\"TLS 1.3\"",
          "collected": "\"TLS 1.3\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/tls/protocol_support/tls_1_0",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/tls/protocol_support/tls_1_1",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/tls/protocol_support/tls_1_2",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/tls/protocol_support/tls_1_3",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/certificate/dns_names",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/certificate/public_key_algorithm",
          "expected": "\"ECDSA\"",
          "collected": "\"ECDSA\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/certificate/chain_length",
          "expected": "between 2 and 4",
          "collected": "4",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/certificate/trusted_chain",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/certificate/hostname_valid",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/certificate/expires_in_days",
          "expected": "at most 0",
          "collected": "-8",
          "result": "passed",
          "reason": "The certificate has expired, so it has no days left."
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/assessment/certificate_valid",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/assessment/hostname_valid",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/assessment/expired",
          "expected": "true",
          "collected": "true",
          "result": "passed",
          "reason": "This endpoint serves a short-lived certificate that was kept past its expiry date on purpose."
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/assessment/expiring_soon",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/assessment/modern_protocol",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/assessment/legacy_protocol_supported",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/assessment/issues",
          "expected": "[\"Certificate is expired\"]",
          "collected": "[\"Certificate is expired\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/endpoints/5/errors",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/summary/total_endpoints",
          "expected": "6",
          "collected": "6",
          "result": "passed",
          "reason": "The collector checks the six endpoints on the sandbox host."
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/summary/reachable_pct",
          "expected": "83",
          "collected": "83",
          "result": "passed",
          "reason": "Five of the six complete a modern handshake. The endpoint that accepts only TLS 1.0 and 1.1 turns it down."
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/summary/certificate_valid_pct",
          "expected": "33",
          "collected": "33",
          "result": "passed",
          "reason": "Two of the six serve a valid certificate. The self-signed, mismatched, and expired certificates fail, and the endpoint that accepts only TLS 1.0 and 1.1 shows no certificate to check."
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/summary/hostname_valid_pct",
          "expected": "66",
          "collected": "66",
          "result": "passed",
          "reason": "Four of the six endpoints have a certificate that matches their name. The mismatched one does not, and the endpoint that accepts only TLS 1.0 and 1.1 shows no certificate."
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/summary/modern_protocol_pct",
          "expected": "83",
          "collected": "83",
          "result": "passed",
          "reason": "Five of the six accept TLS 1.2 or later."
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/summary/expiring_soon_pct",
          "expected": "0",
          "collected": "0",
          "result": "passed",
          "reason": "No certificate expires within 30 days, since each renews with 40 days left. The expired certificate counts as expired rather than expiring soon."
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/summary/legacy_protocol_supported_pct",
          "expected": "33",
          "collected": "33",
          "result": "passed",
          "reason": "Two of the six still accept TLS 1.0 or 1.1."
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/summary/all_certificates_valid",
          "expected": "false",
          "collected": "false",
          "result": "passed",
          "reason": "Three of the certificates fail, so not every certificate is valid."
        },
        {
          "artifact": "artifacts/tls.json",
          "pointer": "/summary/all_modern_protocol",
          "expected": "false",
          "collected": "false",
          "result": "passed",
          "reason": "One endpoint accepts only TLS 1.0 and 1.1."
        },
        {
          "artifact": "artifacts/tls.collector-result.json",
          "pointer": "/collector/name",
          "expected": "\"tls\"",
          "collected": "\"tls\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.collector-result.json",
          "pointer": "/outcome/status",
          "expected": "\"collected\"",
          "collected": "\"collected\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.collector-result.json",
          "pointer": "/gaps",
          "expected": "[]",
          "collected": "[]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/tls.collector-result.json",
          "pointer": "/checks",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        }
      ],
      "requirements": [
        {
          "id": "TLS-001",
          "name": "Public TLS Certificates Valid",
          "category": "Data Encryption",
          "needs_other_evidence": false,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": []
        },
        {
          "id": "TLS-002",
          "name": "Modern TLS Only",
          "category": "Data Encryption",
          "needs_other_evidence": false,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": []
        },
        {
          "id": "TLS-003",
          "name": "TLS Certificate Renewal Window",
          "category": "Data Encryption",
          "needs_other_evidence": false,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": []
        }
      ]
    },
    {
      "sandbox": "aws",
      "collector": "aws",
      "level": "audit",
      "description": "An AWS account used only for these checks, scanned in two regions. The root user has MFA. Of four IAM users, two have MFA and two have an access key. Six S3 buckets have different public access blocks, from every setting on to none. One CloudTrail trail logs every region, a second covers one region, and a third is stopped. Seven security groups include two open to SSH and one open to RDP from anywhere. The collector reads the account at the audit level through a read-only IAM role.",
      "limits": [
        "One standalone account in two regions. Organizations, organization trails, and runs across several accounts are not covered.",
        "Config, GuardDuty, Security Hub, and Inspector are off to keep the cost near zero, so their values are checked only as off or not collected.",
        "There are no databases, instances, load balancers, CloudFront distributions, customer managed KMS keys, or SAML identity providers, so their counts are checked only at 0.",
        "IAM Identity Center has only an account instance, so workforce sign-in is checked only as not in use, and SSO only as not set up.",
        "The collector's role allows every call it makes, so the sandbox does not check what the collector does when a permission is missing."
      ],
      "known_values": 554,
      "latest": {
        "date": "2026-11-07",
        "version": "v0.6.0",
        "result": "passed"
      },
      "passing_since": "2026-10-22",
      "nights": [
        {
          "date": "2026-10-22",
          "version": "v0.5.0",
          "result": "passed"
        },
        {
          "date": "2026-10-23",
          "version": "v0.5.0",
          "result": "passed"
        },
        {
          "date": "2026-10-24",
          "version": "v0.5.0",
          "result": "passed"
        },
        {
          "date": "2026-10-25",
          "version": "v0.5.0",
          "result": "passed"
        },
        {
          "date": "2026-10-26",
          "version": "v0.5.0",
          "result": "passed"
        },
        {
          "date": "2026-10-27",
          "version": "v0.5.0",
          "result": "passed"
        },
        {
          "date": "2026-10-28",
          "version": "v0.5.0",
          "result": "passed"
        },
        {
          "date": "2026-10-29",
          "version": "v0.5.0",
          "result": "passed"
        },
        {
          "date": "2026-10-30",
          "version": "v0.5.0",
          "result": "passed"
        },
        {
          "date": "2026-10-31",
          "version": "v0.5.0",
          "result": "passed"
        },
        {
          "date": "2026-11-01",
          "version": "v0.6.0",
          "result": "passed"
        },
        {
          "date": "2026-11-02",
          "version": "v0.6.0",
          "result": "passed"
        },
        {
          "date": "2026-11-03",
          "version": "v0.6.0",
          "result": "passed"
        },
        {
          "date": "2026-11-04",
          "version": "v0.6.0",
          "result": "passed"
        },
        {
          "date": "2026-11-05",
          "version": "v0.6.0",
          "result": "passed"
        },
        {
          "date": "2026-11-06",
          "version": "v0.6.0",
          "result": "passed"
        },
        {
          "date": "2026-11-07",
          "version": "v0.6.0",
          "result": "passed"
        }
      ],
      "checked": {
        "source": "nightly",
        "date": "2026-11-07",
        "version": "v0.6.0"
      },
      "fields": [
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/schema_version",
          "expected": "\"1.0.0\"",
          "collected": "\"1.0.0\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/provider",
          "expected": "\"aws\"",
          "collected": "\"aws\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts_expected",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/1",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/account_id",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/collection_error_code",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/iam/user_count",
          "expected": "4",
          "collected": "4",
          "result": "passed",
          "reason": "The account has four IAM users."
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/iam/mfa_coverage_pct",
          "expected": "50",
          "collected": "50",
          "result": "passed",
          "reason": "Two of the four IAM users have a virtual MFA device."
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/iam/access_key_user_count",
          "expected": "2",
          "collected": "2",
          "result": "passed",
          "reason": "Two of the four IAM users have an active access key."
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/iam/access_key_rotation_compliant_pct",
          "expected": "between 50 and 100",
          "collected": "100",
          "result": "passed",
          "reason": "Two users have an active access key. One key is replaced every 30 days and the other is never rotated, so the value drops from 100 to 50 once that key is more than 90 days old."
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/iam/root_access_protected",
          "expected": "true",
          "collected": "true",
          "result": "passed",
          "reason": "The root user has MFA turned on."
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/iam/root_mfa_enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed",
          "reason": "The root user has MFA turned on."
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/iam/saml_provider_count",
          "expected": "0",
          "collected": "0",
          "result": "passed",
          "reason": "The account has no SAML identity provider set up in IAM."
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/storage/public_access_blocked_pct",
          "expected": "66",
          "collected": "66",
          "result": "passed",
          "reason": "Four of the six buckets block public access. One turns every setting off and one has no block at all. The account-wide block covers only bucket policies, so those two buckets still allow public ACLs."
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/storage/encryption_pct",
          "expected": "100",
          "collected": "100",
          "result": "passed",
          "reason": "AWS encrypts every bucket by default and no setting turns that off, so the sandbox has no unencrypted bucket."
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/logging/cloudtrail_enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed",
          "reason": "One trail is logging in every region."
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/logging/cloudtrail_multiregion",
          "expected": "true",
          "collected": "true",
          "result": "passed",
          "reason": "The trail that is logging covers every region."
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/network/ssh_open_to_world_pct",
          "expected": "28",
          "collected": "28",
          "result": "passed",
          "reason": "Two of the seven security groups allow SSH from anywhere, one through a port range that includes 22."
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/network/rdp_open_to_world_pct",
          "expected": "14",
          "collected": "14",
          "result": "passed",
          "reason": "One of the seven allows RDP from anywhere over IPv6."
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/backup",
          "expected": "absent",
          "collected": "absent",
          "result": "passed",
          "reason": "There are no databases, so there is no backup retention to report."
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/vuln_scanning/enabled",
          "expected": "left out with not_licensed",
          "collected": "left out with not_licensed",
          "result": "passed",
          "reason": "The collector reads Inspector findings through Security Hub, which is off, so the value is not collected."
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/accounts/0/vuln_scanning/unpatched_pct",
          "expected": "left out with not_licensed",
          "collected": "left out with not_licensed",
          "result": "passed",
          "reason": "Not collected, for the same reason as vulnerability scanning."
        },
        {
          "artifact": "artifacts/aws.cloud-posture.json",
          "pointer": "/workforce_sign_in/in_use",
          "expected": "false",
          "collected": "false",
          "result": "passed",
          "reason": "IAM Identity Center has only an account instance. An account instance can't sign people in to AWS accounts, so it doesn't count as in use."
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/schema_version",
          "expected": "\"1.0.0\"",
          "collected": "\"1.0.0\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/collected_at_level",
          "expected": "\"audit\"",
          "collected": "\"audit\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/failed_accounts",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/1",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_id",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/regions",
          "expected": "[\"us-east-1\",\"us-west-2\"]",
          "collected": "[\"us-east-1\",\"us-west-2\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_alias",
          "expected": "null or absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/credential_report_evaluated",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/iam_users_present",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/iam_user_count",
          "expected": "4",
          "collected": "4",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/mfa_enabled",
          "expected": "50",
          "collected": "50",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/mfa_enabled_user_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/hardware_mfa_enabled",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/hardware_mfa_enabled_user_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/access_key_user_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/access_keys_rotated",
          "expected": "between 50 and 100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/access_keys_rotated_user_count",
          "expected": "between 1 and 2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/users/0/user_name",
          "expected": "\"epack-sandbox-1-mfa-new-key\"",
          "collected": "\"epack-sandbox-1-mfa-new-key\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/users/0/mfa_active",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/users/0/has_access_keys",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/users/0/has_console_access",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/users/1/user_name",
          "expected": "\"epack-sandbox-2-no-mfa-old-key\"",
          "collected": "\"epack-sandbox-2-no-mfa-old-key\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/users/1/mfa_active",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/users/1/has_access_keys",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/users/1/has_console_access",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/users/2/user_name",
          "expected": "\"epack-sandbox-3-mfa-no-key\"",
          "collected": "\"epack-sandbox-3-mfa-no-key\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/users/2/mfa_active",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/users/2/has_access_keys",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/users/2/has_console_access",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/users/3/user_name",
          "expected": "\"epack-sandbox-4-no-mfa-no-key\"",
          "collected": "\"epack-sandbox-4-no-mfa-no-key\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/users/3/mfa_active",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/users/3/has_access_keys",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/users/3/has_console_access",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/users/4",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/saml_provider_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/identity_center_saml_provider_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/identity_center_role_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/root_credential_state_evaluated",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/root_access_protected",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/root_access_keys_exist",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/root_signing_certificates_present",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/password_policy_evaluated",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/password_policy/minimum_length",
          "expected": "14",
          "collected": "14",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/password_policy/require_symbols",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/password_policy/require_numbers",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/password_policy/require_uppercase",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/password_policy/require_lowercase",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/password_policy/allow_users_to_change_password",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/password_policy/expire_passwords",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/password_policy/hard_expiry",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/password_policy/max_password_age_days",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/iam/password_policy/password_reuse_prevention",
          "expected": "24",
          "collected": "24",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/bucket_listing_evaluated",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/account_public_access_block_evaluated",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/account_public_access_block_enabled",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/bucket_count",
          "expected": "6",
          "collected": "6",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/public_access_blocked",
          "expected": "66",
          "collected": "66",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/public_access_blocked_bucket_count",
          "expected": "4",
          "collected": "4",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/public_access_block_unknown_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/default_encryption_enabled",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/default_encryption_enabled_bucket_count",
          "expected": "6",
          "collected": "6",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/default_encryption_evaluated_count",
          "expected": "6",
          "collected": "6",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/default_encryption_inferred_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/default_encryption_unknown_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/versioning_enabled",
          "expected": "50",
          "collected": "50",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/versioning_enabled_bucket_count",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/log_sink_bucket_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/logging_required_bucket_count",
          "expected": "5",
          "collected": "5",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/logging_enabled",
          "expected": "40",
          "collected": "40",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/logging_enabled_bucket_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/tls_enforced_bucket_count",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/tls_enforcement_partial_bucket_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/tls_unenforced_bucket_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/0/name",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/0/region",
          "expected": "\"us-east-1\"",
          "collected": "\"us-east-1\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/0/public_access_blocked",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/0/default_encryption_enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/0/versioning_enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/0/logging_enabled",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/0/tls_enforcement",
          "expected": "\"enforced\"",
          "collected": "\"enforced\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/1/name",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/1/public_access_blocked",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/1/default_encryption_enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/1/versioning_enabled",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/1/logging_enabled",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/1/is_log_sink",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/1/tls_enforcement",
          "expected": "\"enforced\"",
          "collected": "\"enforced\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/2/name",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/2/public_access_blocked",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/2/default_encryption_enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/2/versioning_enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/2/logging_enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/2/tls_enforcement",
          "expected": "\"enforced\"",
          "collected": "\"enforced\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/3/name",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/3/public_access_blocked",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/3/default_encryption_enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/3/versioning_enabled",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/3/logging_enabled",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/3/tls_enforcement",
          "expected": "\"none\"",
          "collected": "\"none\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/4/name",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/4/public_access_blocked",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/4/default_encryption_enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/4/versioning_enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/4/logging_enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/4/tls_enforcement",
          "expected": "\"partial\"",
          "collected": "\"partial\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/5/name",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/5/public_access_blocked",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/5/default_encryption_enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/5/versioning_enabled",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/5/logging_enabled",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/5/tls_enforcement",
          "expected": "\"none\"",
          "collected": "\"none\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/s3/buckets/6",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trail_listing_evaluated",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/multi_region_enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/organization_trail_enabled",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trail_status_evaluated_count",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trail_status_unknown_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trail_buckets_expiring_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trail_bucket_min_expiration_days",
          "expected": "90",
          "collected": "90",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trail_buckets_retained_indefinitely_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trail_buckets_not_in_account_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trail_buckets_object_locked_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trail_buckets_public_access_blocked_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trail_buckets_public_access_not_blocked_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/0/name",
          "expected": "\"epack-sandbox-trail-1-multi-region\"",
          "collected": "\"epack-sandbox-trail-1-multi-region\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/0/home_region",
          "expected": "\"us-east-1\"",
          "collected": "\"us-east-1\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/0/s3_bucket_name",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/0/is_multi_region_trail",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/0/is_logging",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/0/log_file_validation_enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/0/bucket_retention",
          "expected": "\"expiring\"",
          "collected": "\"expiring\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/0/bucket_public_access",
          "expected": "\"blocked\"",
          "collected": "\"blocked\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/1/name",
          "expected": "\"epack-sandbox-trail-2-single-region\"",
          "collected": "\"epack-sandbox-trail-2-single-region\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/1/home_region",
          "expected": "\"us-east-1\"",
          "collected": "\"us-east-1\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/1/is_multi_region_trail",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/1/is_logging",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/1/log_file_validation_enabled",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/2/name",
          "expected": "\"epack-sandbox-trail-3-stopped\"",
          "collected": "\"epack-sandbox-trail-3-stopped\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/2/is_multi_region_trail",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/2/is_logging",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/2/trail_status_evaluated",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/cloudtrail/trails/3",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/network/regions_evaluated_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/network/regions_failed",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/network/security_group_count",
          "expected": "7",
          "collected": "7",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/network/open_to_world_ssh",
          "expected": "28",
          "collected": "28",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/network/open_to_world_ssh_security_group_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/network/open_to_world_rdp",
          "expected": "14",
          "collected": "14",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/network/open_to_world_rdp_security_group_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/network/vpcs/0/region",
          "expected": "\"us-east-1\"",
          "collected": "\"us-east-1\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/network/vpcs/0/is_default",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/network/vpcs/1/region",
          "expected": "\"us-west-2\"",
          "collected": "\"us-west-2\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/network/vpcs/1/is_default",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/network/vpcs/2",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/network/security_groups/3/region",
          "expected": "\"us-east-1\"",
          "collected": "\"us-east-1\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/network/security_groups/4/region",
          "expected": "\"us-west-2\"",
          "collected": "\"us-west-2\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/network/security_groups/7",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/lambda/function_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/lambda/deprecated_runtime_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/lambda/public_function_url_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/lambda/functions/0/name",
          "expected": "\"epack-sandbox-key-rotator\"",
          "collected": "\"epack-sandbox-key-rotator\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/lambda/functions/0/region",
          "expected": "\"us-east-1\"",
          "collected": "\"us-east-1\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/lambda/functions/0/runtime",
          "expected": "\"python3.13\"",
          "collected": "\"python3.13\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/lambda/functions/0/has_resource_policy",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/lambda/functions/1",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/cloudwatch_logs/log_group_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/cloudwatch_logs/log_groups_without_retention_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/cloudwatch_logs/log_groups_without_customer_kms_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/cloudwatch_logs/log_groups/0/name",
          "expected": "\"/aws/lambda/epack-sandbox-key-rotator\"",
          "collected": "\"/aws/lambda/epack-sandbox-key-rotator\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/cloudwatch_logs/log_groups/0/retention_in_days",
          "expected": "30",
          "collected": "30",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/cloudwatch_logs/log_groups/1/name",
          "expected": "\"epack-sandbox-no-retention\"",
          "collected": "\"epack-sandbox-no-retention\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/cloudwatch_logs/log_groups/1/retention_in_days",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/cloudwatch_logs/log_groups/2",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/ssm_parameters/parameter_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/ssm_parameters/secure_string_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/ssm_parameters/secure_strings_without_customer_kms_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/ses/configuration_set_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/ses/configuration_sets_requiring_tls_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/ses/configuration_sets_opportunistic_tls_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/ses/identity_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/access_analyzer/enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/access_analyzer/analyzer_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/access_analyzer/regions_evaluated_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/access_analyzer/regions_with_active_analyzer_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/access_analyzer/inactive_analyzer_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/access_analyzer/organization_analyzer_present",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/access_analyzer/analyzers/0/name",
          "expected": "\"epack-sandbox-external-access\"",
          "collected": "\"epack-sandbox-external-access\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/access_analyzer/analyzers/0/region",
          "expected": "\"us-east-1\"",
          "collected": "\"us-east-1\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/access_analyzer/analyzers/0/type",
          "expected": "\"ACCOUNT\"",
          "collected": "\"ACCOUNT\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/access_analyzer/analyzers/0/status",
          "expected": "\"ACTIVE\"",
          "collected": "\"ACTIVE\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/access_analyzer/analyzers/1",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/identity_center/enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/identity_center/instance_region",
          "expected": "\"us-east-1\"",
          "collected": "\"us-east-1\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/identity_center/instance_status",
          "expected": "\"ACTIVE\"",
          "collected": "\"ACTIVE\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/identity_center/instance_owner_account_id",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/identity_center/instance_type",
          "expected": "\"account\"",
          "collected": "\"account\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/identity_center/regions_checked",
          "expected": "[\"us-east-1\",\"us-west-2\"]",
          "collected": "[\"us-east-1\",\"us-west-2\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/identity_center/user_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/identity_center/external_id_user_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/identity_center/mfa_evidence",
          "expected": "\"manual_required\"",
          "collected": "\"manual_required\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/identity_center/group_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/identity_center/users/*/has_external_id",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/identity_center/users/2",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/identity_center/groups/0/display_name",
          "expected": "\"epack-sandbox-idc-group\"",
          "collected": "\"epack-sandbox-idc-group\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/identity_center/groups/0/member_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/identity_center/groups/1",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/config/enabled",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/guardduty/enabled",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/security_hub/enabled",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/inspector/status_evaluated",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/inspector/status_error_code",
          "expected": "\"InvalidAccessException\"",
          "collected": "\"InvalidAccessException\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/inspector/enabled",
          "expected": "left out with not_licensed",
          "collected": "left out with not_licensed",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/inspector/unpatched_server_percent",
          "expected": "left out with not_licensed",
          "collected": "left out with not_licensed",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/inspector/total_affected_resources",
          "expected": "left out with not_licensed",
          "collected": "left out with not_licensed",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/inspector/total_findings",
          "expected": "left out with not_licensed",
          "collected": "left out with not_licensed",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/inspector/patched_findings",
          "expected": "left out with not_licensed",
          "collected": "left out with not_licensed",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/inspector/unpatched_findings",
          "expected": "left out with not_licensed",
          "collected": "left out with not_licensed",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/account_security/inspector/unpatched_resources",
          "expected": "left out with not_licensed",
          "collected": "left out with not_licensed",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/rds/regions_evaluated_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/rds/database_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/rds/instance_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/rds/encrypted_at_rest",
          "expected": "null",
          "collected": "null",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/rds/encrypted_at_rest_database_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/rds/publicly_accessible",
          "expected": "null",
          "collected": "null",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/rds/publicly_accessible_instance_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/rds/deletion_protection",
          "expected": "null",
          "collected": "null",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/rds/deletion_protection_database_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/rds/backup_retention_adequate",
          "expected": "null",
          "collected": "null",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/rds/backup_retention_adequate_database_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/rds/multi_az_enabled",
          "expected": "null",
          "collected": "null",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/rds/multi_az_enabled_database_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/ec2/instance_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/ec2/unattached_volume_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/stored_images/snapshot_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/stored_images/image_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/kms/customer_managed_key_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/secrets_manager/secret_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/load_balancers/load_balancer_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/ecs/cluster_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/auto_scaling/group_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/waf/web_acl_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/waf/internet_facing_alb_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/waf/covered_internet_facing_alb_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/waf/internet_facing_alb_coverage_pct",
          "expected": "null",
          "collected": "null",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/waf/enabled_distribution_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/waf/covered_distribution_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/waf/distribution_coverage_pct",
          "expected": "null",
          "collected": "null",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/cloudfront/distribution_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.json",
          "pointer": "/accounts/0/monitoring/alarm_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.collector-result.json",
          "pointer": "/collector/name",
          "expected": "\"aws\"",
          "collected": "\"aws\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.collector-result.json",
          "pointer": "/outcome/status",
          "expected": "\"partial\"",
          "collected": "\"partial\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.collector-result.json",
          "pointer": "/outcome/code",
          "expected": "\"not_licensed\"",
          "collected": "\"not_licensed\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.collector-result.json",
          "pointer": "/signed_in_as/provider",
          "expected": "\"aws\"",
          "collected": "\"aws\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.collector-result.json",
          "pointer": "/signed_in_as/kind",
          "expected": "\"role\"",
          "collected": "\"role\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.collector-result.json",
          "pointer": "/signed_in_as/tenant_id",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/aws.collector-result.json",
          "pointer": "/signed_in_as/auth_method",
          "expected": "\"workload_identity\"",
          "collected": "\"workload_identity\"",
          "result": "passed"
        }
      ],
      "requirements": [
        {
          "id": "IDP-001",
          "name": "MFA coverage",
          "category": "Multi-Factor Authentication",
          "needs_other_evidence": true,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/aws.cloud-posture.json",
              "pointer": "/accounts/0/iam/mfa_coverage_pct",
              "expected": "50",
              "collected": "50",
              "result": "passed",
              "reason": "Two of the four IAM users have a virtual MFA device."
            }
          ]
        },
        {
          "id": "CLOUD-001",
          "name": "Highest-Privilege Access Protection",
          "category": "Privileged Access Management",
          "needs_other_evidence": false,
          "expected": "pass",
          "status": "pass",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/aws.cloud-posture.json",
              "pointer": "/accounts/0/iam/root_access_protected",
              "expected": "true",
              "collected": "true",
              "result": "passed",
              "reason": "The root user has MFA turned on."
            }
          ]
        },
        {
          "id": "CLOUD-005",
          "name": "Public Access Blocked",
          "category": "Network Segmentation",
          "needs_other_evidence": false,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/aws.cloud-posture.json",
              "pointer": "/accounts/0/storage/public_access_blocked_pct",
              "expected": "66",
              "collected": "66",
              "result": "passed",
              "reason": "Four of the six buckets block public access. One turns every setting off and one has no block at all. The account-wide block covers only bucket policies, so those two buckets still allow public ACLs."
            }
          ]
        },
        {
          "id": "CLOUD-008",
          "name": "No Open SSH to Internet",
          "category": "Network Segmentation",
          "needs_other_evidence": false,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/aws.cloud-posture.json",
              "pointer": "/accounts/0/network/ssh_open_to_world_pct",
              "expected": "28",
              "collected": "28",
              "result": "passed",
              "reason": "Two of the seven security groups allow SSH from anywhere, one through a port range that includes 22."
            }
          ]
        },
        {
          "id": "CLOUD-009",
          "name": "No Open RDP to Internet",
          "category": "Network Segmentation",
          "needs_other_evidence": false,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/aws.cloud-posture.json",
              "pointer": "/accounts/0/network/rdp_open_to_world_pct",
              "expected": "14",
              "collected": "14",
              "result": "passed",
              "reason": "One of the seven allows RDP from anywhere over IPv6."
            }
          ]
        },
        {
          "id": "CLOUD-006",
          "name": "Audit Logging Enabled",
          "category": "Centralized Logging",
          "needs_other_evidence": false,
          "expected": "pass",
          "status": "pass",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/aws.cloud-posture.json",
              "pointer": "/accounts/0/logging/cloudtrail_enabled",
              "expected": "true",
              "collected": "true",
              "result": "passed",
              "reason": "One trail is logging in every region."
            }
          ]
        },
        {
          "id": "CLOUD-007",
          "name": "Multi-Region Audit Trail",
          "category": "Centralized Logging",
          "needs_other_evidence": false,
          "expected": "pass",
          "status": "pass",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/aws.cloud-posture.json",
              "pointer": "/accounts/0/logging/cloudtrail_multiregion",
              "expected": "true",
              "collected": "true",
              "result": "passed",
              "reason": "The trail that is logging covers every region."
            },
            {
              "artifact": "artifacts/aws.cloud-posture.json",
              "pointer": "/accounts/0/logging/cloudtrail_enabled",
              "expected": "true",
              "collected": "true",
              "result": "passed",
              "reason": "One trail is logging in every region."
            }
          ]
        },
        {
          "id": "CLOUD-004",
          "name": "Storage Encryption",
          "category": "Data Encryption",
          "needs_other_evidence": false,
          "expected": "pass",
          "status": "pass",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/aws.cloud-posture.json",
              "pointer": "/accounts/0/storage/encryption_pct",
              "expected": "100",
              "collected": "100",
              "result": "passed",
              "reason": "AWS encrypts every bucket by default and no setting turns that off, so the sandbox has no unencrypted bucket."
            }
          ]
        },
        {
          "id": "CLOUD-003",
          "name": "Access Key Rotation",
          "category": "Secrets Management",
          "needs_other_evidence": false,
          "expected": null,
          "status": null,
          "result": null,
          "values": [
            {
              "artifact": "artifacts/aws.cloud-posture.json",
              "pointer": "/accounts/0/iam/access_key_rotation_compliant_pct",
              "expected": "between 50 and 100",
              "collected": "100",
              "result": "passed",
              "reason": "Two users have an active access key. One key is replaced every 30 days and the other is never rotated, so the value drops from 100 to 50 once that key is more than 90 days old."
            }
          ]
        }
      ]
    },
    {
      "sandbox": "okta",
      "collector": "okta",
      "level": "audit",
      "description": "An Okta org used only for these checks. It has ten users with different statuses and MFA factors, three administrators, sign-on policies that require MFA for some users and not others, and four apps.",
      "limits": [
        "One small Okta Integrator org.",
        "Runs at audit level. Fields that only an internal run collects are checked only as left out.",
        "Okta's built-in apps vary and aren't documented, so app totals and app coverage are checked as ranges."
      ],
      "known_values": 267,
      "latest": {
        "date": "2026-11-07",
        "version": "v0.4.0",
        "result": "passed"
      },
      "passing_since": "2026-10-20",
      "nights": [
        {
          "date": "2026-10-20",
          "version": "v0.3.0",
          "result": "passed"
        },
        {
          "date": "2026-10-21",
          "version": "v0.4.0",
          "result": "passed"
        },
        {
          "date": "2026-10-22",
          "version": "v0.4.0",
          "result": "passed"
        },
        {
          "date": "2026-10-23",
          "version": "v0.4.0",
          "result": "passed"
        },
        {
          "date": "2026-10-24",
          "version": "v0.4.0",
          "result": "passed"
        },
        {
          "date": "2026-10-25",
          "version": "v0.4.0",
          "result": "passed"
        },
        {
          "date": "2026-10-26",
          "version": "v0.4.0",
          "result": "passed"
        },
        {
          "date": "2026-10-27",
          "version": "v0.4.0",
          "result": "passed"
        },
        {
          "date": "2026-10-28",
          "version": "v0.4.0",
          "result": "passed"
        },
        {
          "date": "2026-10-29",
          "version": "v0.4.0",
          "result": "passed"
        },
        {
          "date": "2026-10-30",
          "version": "v0.4.0",
          "result": "passed"
        },
        {
          "date": "2026-10-31",
          "version": "v0.4.0",
          "result": "passed"
        },
        {
          "date": "2026-11-01",
          "version": "v0.4.0",
          "result": "passed"
        },
        {
          "date": "2026-11-02",
          "version": "v0.4.0",
          "result": "passed"
        },
        {
          "date": "2026-11-03",
          "version": "v0.4.0",
          "result": "passed"
        },
        {
          "date": "2026-11-04",
          "version": "v0.4.0",
          "result": "passed"
        },
        {
          "date": "2026-11-05",
          "version": "v0.4.0",
          "result": "passed"
        },
        {
          "date": "2026-11-06",
          "version": "v0.4.0",
          "result": "passed"
        },
        {
          "date": "2026-11-07",
          "version": "v0.4.0",
          "result": "passed"
        }
      ],
      "checked": {
        "source": "nightly",
        "date": "2026-11-07",
        "version": "v0.4.0"
      },
      "fields": [
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/schema_version",
          "expected": "\"1.0.0\"",
          "collected": "\"1.0.0\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/provider",
          "expected": "\"okta\"",
          "collected": "\"okta\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/org_domain",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/user_security/mfa_coverage_pct",
          "expected": "50",
          "collected": "50",
          "result": "passed",
          "reason": "Five of ten users have an active MFA factor."
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/user_security/mfa_phishing_resistant_pct",
          "expected": "20",
          "collected": "20",
          "result": "passed",
          "reason": "Two of ten users have a WebAuthn factor."
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/user_security/inactive_pct",
          "expected": "between 40 and 50",
          "collected": "40",
          "result": "passed",
          "reason": "Five users sign in every night and four never do. The org owner counts as inactive once 90 days pass without a sign-in, so the value is 40% or 50%."
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/user_security/locked_out_pct",
          "expected": "10",
          "collected": "10",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/privileged_access/privileged_users_count",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/privileged_access/super_admin_count",
          "expected": "2",
          "collected": "2",
          "result": "passed",
          "reason": "The org owner and one more user hold the Super Administrator role."
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/privileged_access/standing_privileged_users_count",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/privileged_access/privileged_mfa_coverage_pct",
          "expected": "66",
          "collected": "66",
          "result": "passed",
          "reason": "Two of three administrators have an MFA factor."
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/privileged_access/privileged_phishing_resistant_pct",
          "expected": "33",
          "collected": "33",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/policy/mfa_required",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/policy/mfa_required_coverage_pct",
          "expected": "40",
          "collected": "40",
          "result": "passed",
          "reason": "Sign-on policies require MFA for four of ten users. From v0.5.0 the value is not collected, since app sign-in policies can also require MFA and the collector does not read them."
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/policy/session_lifetime_max_min",
          "expected": "10080",
          "collected": "10080",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/policy/idle_timeout_max_min",
          "expected": "720",
          "collected": "720",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/app_security/provisioning_enabled_pct",
          "expected": "between 8 and 25",
          "collected": "9",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/app_security/deprovisioning_enabled_pct",
          "expected": "between 8 and 25",
          "collected": "9",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/lifecycle/suspended_pct",
          "expected": "10",
          "collected": "10",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.idp-posture.json",
          "pointer": "/device_access",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/schema_version",
          "expected": "\"1.0.0\"",
          "collected": "\"1.0.0\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/collected_at_level",
          "expected": "\"audit\"",
          "collected": "\"audit\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/org_domain",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/users/total_count",
          "expected": "10",
          "collected": "10",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/users/password_expired",
          "expected": "10",
          "collected": "10",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/users/password_expired_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/users/locked_out",
          "expected": "10",
          "collected": "10",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/users/locked_out_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/users/suspended",
          "expected": "10",
          "collected": "10",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/users/suspended_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/users/inactive",
          "expected": "between 40 and 50",
          "collected": "40",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/users/inactive_count",
          "expected": "between 4 and 5",
          "collected": "4",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/users/inventory/9/login",
          "expected": "present",
          "collected": "present",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/users/inventory/10",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/posture/mfa_coverage",
          "expected": "50",
          "collected": "50",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/posture/mfa_enrolled_users_count",
          "expected": "5",
          "collected": "5",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/posture/mfa_disabled_users_count",
          "expected": "5",
          "collected": "5",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/posture/mfa_phishing_resistant",
          "expected": "20",
          "collected": "20",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/posture/mfa_phishing_resistant_users_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/posture/per_factor_type/0/factor_type",
          "expected": "\"email\"",
          "collected": "\"email\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/posture/per_factor_type/0/enrolled_users",
          "expected": "between 1 and 2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/privileged_access/privileged_users_count",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/privileged_access/super_admin_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/privileged_access/standing_privileged_users_count",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/privileged_access/privileged_mfa_coverage_pct",
          "expected": "66",
          "collected": "66",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/privileged_access/privileged_mfa_enrolled_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/privileged_access/privileged_phishing_resistant_pct",
          "expected": "33",
          "collected": "33",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/privileged_access/privileged_phishing_resistant_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/privileged_access/custom_roles",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policy_count",
          "expected": "4",
          "collected": "4",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/mfa_required_all",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/mfa_required_any",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/mfa_required_coverage_pct",
          "expected": "40",
          "collected": "40",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/mfa_required_users_count",
          "expected": "4",
          "collected": "4",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/0/name",
          "expected": "\"Sandbox MFA required\"",
          "collected": "\"Sandbox MFA required\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/0/type",
          "expected": "\"OKTA_SIGN_ON\"",
          "collected": "\"OKTA_SIGN_ON\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/0/priority",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/0/rule_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/0/scope_summary",
          "expected": "\"group-assigned\"",
          "collected": "\"group-assigned\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/1/name",
          "expected": "\"Sandbox password only\"",
          "collected": "\"Sandbox password only\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/1/type",
          "expected": "\"OKTA_SIGN_ON\"",
          "collected": "\"OKTA_SIGN_ON\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/1/priority",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/1/rule_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/2/name",
          "expected": "\"Sandbox everyone else\"",
          "collected": "\"Sandbox everyone else\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/2/type",
          "expected": "\"OKTA_SIGN_ON\"",
          "collected": "\"OKTA_SIGN_ON\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/2/priority",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/2/rule_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/3/name",
          "expected": "\"Default Policy\"",
          "collected": "\"Default Policy\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/3/type",
          "expected": "\"OKTA_SIGN_ON\"",
          "collected": "\"OKTA_SIGN_ON\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/4/name",
          "expected": "\"Sandbox password only enrollment\"",
          "collected": "\"Sandbox password only enrollment\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/4/type",
          "expected": "\"MFA_ENROLL\"",
          "collected": "\"MFA_ENROLL\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/4/priority",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/5/name",
          "expected": "\"Sandbox MFA enrollment\"",
          "collected": "\"Sandbox MFA enrollment\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/5/type",
          "expected": "\"MFA_ENROLL\"",
          "collected": "\"MFA_ENROLL\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/5/priority",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/6/name",
          "expected": "\"Default Policy\"",
          "collected": "\"Default Policy\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/6/type",
          "expected": "\"MFA_ENROLL\"",
          "collected": "\"MFA_ENROLL\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/7",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/session_lifetime_min_minutes",
          "expected": "60",
          "collected": "60",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/session_lifetime_max_minutes",
          "expected": "10080",
          "collected": "10080",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/idle_timeout_min_minutes",
          "expected": "15",
          "collected": "15",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/idle_timeout_max_minutes",
          "expected": "720",
          "collected": "720",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/device_access/managed_device_required",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/device_access/managed_device_required_coverage_pct",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/device_access/managed_device_required_users_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/device_access/managed_device_required_for_admins",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/device_access/managed_device_required_admins_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/apps/total_count",
          "expected": "between 4 and 12",
          "collected": "11",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/apps/provisioning_enabled",
          "expected": "between 8 and 25",
          "collected": "9",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/apps/provisioning_enabled_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/apps/deprovisioning_enabled",
          "expected": "between 8 and 25",
          "collected": "9",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/apps/deprovisioning_enabled_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/groups/count_by_source/OKTA_GROUP",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/groups/inventory/0/name",
          "expected": "\"Everyone\"",
          "collected": "\"Everyone\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/groups/inventory/0/type",
          "expected": "\"BUILT_IN\"",
          "collected": "\"BUILT_IN\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/groups/inventory/0/member_count",
          "expected": "between 9 and 10",
          "collected": "10",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/groups/inventory/1/name",
          "expected": "\"Sandbox Password Only\"",
          "collected": "\"Sandbox Password Only\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/groups/inventory/1/type",
          "expected": "\"OKTA_GROUP\"",
          "collected": "\"OKTA_GROUP\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/groups/inventory/1/member_count",
          "expected": "6",
          "collected": "6",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/network_zones/gateway_zone_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/network_zones/proxy_zone_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/identity_providers/total_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/api_tokens/total_active_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/api_tokens/recently_used_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/api_tokens/inventory",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/hooks/event_hook_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/hooks/inline_hook_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/hooks/active_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/hooks/inactive_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/system_log/window_days",
          "expected": "7",
          "collected": "7",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/org_settings/status",
          "expected": "\"ACTIVE\"",
          "collected": "\"ACTIVE\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/org_settings/self_service_recovery_enabled",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/users/inventory/9/last_login_at",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/users/inventory/9/factors",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/users/inventory/*/has_active_mfa",
          "expected": "absent",
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/users/inventory/*/has_phishing_resistant_mfa",
          "expected": "absent",
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/privileged_access/inventory/0/role_assignment_source",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/privileged_access/inventory/*/has_active_mfa",
          "expected": "absent",
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/privileged_access/inventory/*/has_phishing_resistant_mfa",
          "expected": "absent",
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/policy/policies/0/rules",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/groups/inventory/1/member_logins",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/system_log/events",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.json",
          "pointer": "/org_settings/notification_contact_logins",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/collector/name",
          "expected": "\"okta\"",
          "collected": "\"okta\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/signed_in_as/provider",
          "expected": "\"okta\"",
          "collected": "\"okta\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/signed_in_as/kind",
          "expected": "\"service_app\"",
          "collected": "\"service_app\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/signed_in_as/tenant_id",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/signed_in_as/id",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/signed_in_as/auth_method",
          "expected": "\"private_key_jwt\"",
          "collected": "\"private_key_jwt\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/signed_in_as/requested_scopes",
          "expected": "[\"okta.apiTokens.read\",\"okta.apps.read\",\"okta.authenticators.read\",\"okta.deviceAssurance.read\",\"okta.eventHooks.read\",\"o...",
          "collected": "[\"okta.apiTokens.read\",\"okta.apps.read\",\"okta.authenticators.read\",\"okta.deviceAssurance.read\",\"okta.eventHooks.read\",\"o...",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/signed_in_as/scopes",
          "expected": "the same as artifacts/okta.collector-result.json /signed_in_as/requested_scopes, which is [\"okta.apiTokens.read\",\"okta.apps.read\",\"okta.authenticators.read\",\"okta.deviceAssurance.read\",\"okta.eventHooks.read\",\"o...",
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/signed_in_as/read_only",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/steps/0/name",
          "expected": "\"sign_in\"",
          "collected": "\"sign_in\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/steps/1/name",
          "expected": "\"people\"",
          "collected": "\"people\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/steps/2/name",
          "expected": "\"apps\"",
          "collected": "\"apps\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/steps/3/name",
          "expected": "\"admin_roles\"",
          "collected": "\"admin_roles\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/steps/4/name",
          "expected": "\"policies\"",
          "collected": "\"policies\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/steps/5/name",
          "expected": "\"device_assurance\"",
          "collected": "\"device_assurance\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/steps/6/name",
          "expected": "\"authenticators\"",
          "collected": "\"authenticators\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/steps/7/name",
          "expected": "\"groups\"",
          "collected": "\"groups\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/steps/8/name",
          "expected": "\"network_zones\"",
          "collected": "\"network_zones\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/steps/9/name",
          "expected": "\"identity_providers\"",
          "collected": "\"identity_providers\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/steps/10/name",
          "expected": "\"api_tokens\"",
          "collected": "\"api_tokens\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/steps/11/name",
          "expected": "\"hooks\"",
          "collected": "\"hooks\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/steps/12/name",
          "expected": "\"system_log\"",
          "collected": "\"system_log\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/steps/13/name",
          "expected": "\"org_settings\"",
          "collected": "\"org_settings\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/steps/14",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/calls/requests/*/start_ms",
          "expected": "present",
          "collected": "present",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-result.json",
          "pointer": "/checks",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-build.json",
          "pointer": "/collector/name",
          "expected": "\"okta\"",
          "collected": "\"okta\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-build.json",
          "pointer": "/collector/version",
          "expected": "the same as artifacts/okta.collector-result.json /collector/version, which is \"0.4.0\"",
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-build.json",
          "pointer": "/collector/commit",
          "expected": "the same as artifacts/okta.collector-result.json /collector/commit, which is \"66bff6e9568eb30df2c5e7e871cf5c2567f2d1ce\"",
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-build.json",
          "pointer": "/schemas/artifacts~1okta.json",
          "expected": "present",
          "collected": "present",
          "result": "passed"
        },
        {
          "artifact": "artifacts/okta.collector-build.json",
          "pointer": "/trace_map/artifacts/artifacts~1okta.json/~1posture~1mfa_coverage/operations",
          "expected": "[\"okta.users.factors.list\",\"okta.users.list\"]",
          "collected": "[\"okta.users.factors.list\",\"okta.users.list\"]",
          "result": "passed"
        }
      ],
      "requirements": [
        {
          "id": "IDP-001",
          "name": "MFA coverage",
          "category": "Multi-Factor Authentication",
          "needs_other_evidence": true,
          "expected": null,
          "status": null,
          "result": null,
          "values": [
            {
              "artifact": "artifacts/okta.idp-posture.json",
              "pointer": "/user_security/mfa_coverage_pct",
              "expected": "50",
              "collected": "50",
              "result": "passed",
              "reason": "Five of ten users have an active MFA factor."
            }
          ]
        },
        {
          "id": "IDP-002",
          "name": "MFA enforced",
          "category": "Multi-Factor Authentication",
          "needs_other_evidence": true,
          "expected": null,
          "status": null,
          "result": null,
          "values": [
            {
              "artifact": "artifacts/okta.idp-posture.json",
              "pointer": "/policy/mfa_required_coverage_pct",
              "expected": "40",
              "collected": "40",
              "result": "passed",
              "reason": "Sign-on policies require MFA for four of ten users. From v0.5.0 the value is not collected, since app sign-in policies can also require MFA and the collector does not read them."
            }
          ]
        },
        {
          "id": "IDP-004",
          "name": "Phishing-Resistant MFA Adoption",
          "category": "Multi-Factor Authentication",
          "needs_other_evidence": false,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/okta.idp-posture.json",
              "pointer": "/user_security/mfa_phishing_resistant_pct",
              "expected": "20",
              "collected": "20",
              "result": "passed",
              "reason": "Two of ten users have a WebAuthn factor."
            }
          ]
        },
        {
          "id": "IDP-003",
          "name": "Privileged User MFA Coverage",
          "category": "Privileged Access Management",
          "needs_other_evidence": false,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/okta.idp-posture.json",
              "pointer": "/privileged_access/privileged_mfa_coverage_pct",
              "expected": "66",
              "collected": "66",
              "result": "passed",
              "reason": "Two of three administrators have an MFA factor."
            }
          ]
        },
        {
          "id": "IDP-006",
          "name": "Highest-Privilege Account Minimization",
          "category": "Privileged Access Management",
          "needs_other_evidence": false,
          "expected": "pass",
          "status": "pass",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/okta.idp-posture.json",
              "pointer": "/privileged_access/super_admin_count",
              "expected": "2",
              "collected": "2",
              "result": "passed",
              "reason": "The org owner and one more user hold the Super Administrator role."
            }
          ]
        },
        {
          "id": "IDP-007",
          "name": "Inactive Account Hygiene",
          "category": "Identity & Access Governance",
          "needs_other_evidence": false,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/okta.idp-posture.json",
              "pointer": "/user_security/inactive_pct",
              "expected": "between 40 and 50",
              "collected": "40",
              "result": "passed",
              "reason": "Five users sign in every night and four never do. The org owner counts as inactive once 90 days pass without a sign-in, so the value is 40% or 50%."
            }
          ]
        }
      ]
    },
    {
      "sandbox": "github-compliant",
      "collector": "github",
      "level": "trust",
      "description": "A GitHub organization on the Free plan with every protection the collector checks turned on. Two public repositories are in scope: one protected by a classic branch protection rule and one by a repository ruleset. Each requires a pull request with one approval that new pushes dismiss, a passing build check, and signed commits, and blocks force pushes and deletions. Code scanning, secret scanning, push protection, and Dependabot are on in both, and the organization requires two-factor authentication. A third repository is archived. The collector reads the organization at the trust level through a GitHub App with read-only permissions.",
      "limits": [
        "Public repositories only, since the organization is on the Free plan.",
        "The trust level reports organization-wide values only, so the sandbox checks no per-repository or member rows.",
        "GitHub shows a ruleset's bypass list only to accounts that can edit the ruleset, and the App only reads, so admin enforcement for the ruleset is never collected.",
        "Every call succeeds, so the sandbox does not check what the collector does when GitHub fails."
      ],
      "known_values": 150,
      "latest": {
        "date": "2026-11-07",
        "version": "v0.3.4",
        "result": "passed"
      },
      "passing_since": "2026-10-22",
      "nights": [
        {
          "date": "2026-10-22",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-23",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-24",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-25",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-26",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-27",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-28",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-29",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-30",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-31",
          "version": "v0.3.4",
          "result": "passed"
        },
        {
          "date": "2026-11-01",
          "version": "v0.3.4",
          "result": "passed"
        },
        {
          "date": "2026-11-02",
          "version": "v0.3.4",
          "result": "passed"
        },
        {
          "date": "2026-11-03",
          "version": "v0.3.4",
          "result": "passed"
        },
        {
          "date": "2026-11-04",
          "version": "v0.3.4",
          "result": "passed"
        },
        {
          "date": "2026-11-05",
          "version": "v0.3.4",
          "result": "passed"
        },
        {
          "date": "2026-11-06",
          "version": "v0.3.4",
          "result": "passed"
        },
        {
          "date": "2026-11-07",
          "version": "v0.3.4",
          "result": "passed"
        }
      ],
      "checked": {
        "source": "nightly",
        "date": "2026-11-07",
        "version": "v0.3.4"
      },
      "fields": [
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/schema_version",
          "expected": "\"1.0.0\"",
          "collected": "\"1.0.0\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/provider",
          "expected": "\"github\"",
          "collected": "\"github\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/org_security/two_factor_required",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/repo_coverage_pct",
          "expected": "66",
          "collected": "66",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/repository_count",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/scanned_repository_count",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/branch_protection/pr_required_pct",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/branch_protection/approving_reviews_pct",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/branch_protection/status_checks_pct",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/branch_protection/signed_commits_pct",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/security_features/vuln_alerts_pct",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/security_features/secret_scanning_pct",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/security_features/code_scanning_pct",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/branch_protection/pr_required_repository_count",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/security_features/code_scanning_repository_count",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/schema_version",
          "expected": "\"1.0.0\"",
          "collected": "\"1.0.0\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/collected_at_level",
          "expected": "\"trust\"",
          "collected": "\"trust\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/access_control/two_factor_required",
          "expected": "true",
          "collected": "true",
          "result": "passed",
          "reason": "The organization requires two-factor authentication for every member."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/scope/include_patterns",
          "expected": "[\"*\"]",
          "collected": "[\"*\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/scope/exclude_patterns",
          "expected": "[]",
          "collected": "[]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/scope/repository_count",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/scope/included_repository_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/scope/repositories_coverage",
          "expected": "66",
          "collected": "66",
          "result": "passed",
          "reason": "Two of the three repositories are in scope. The third is archived, and the collector leaves archived repositories out."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/posture/branch_protection_coverage",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/pull_request_required",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/approving_reviews",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/dismiss_stale_reviews",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/code_owner_reviews",
          "expected": "50",
          "collected": "50",
          "result": "passed",
          "reason": "Only the classic rule requires a review from code owners."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/status_checks",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/signed_commits",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/force_pushes_blocked",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/deletions_blocked",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/linear_history",
          "expected": "50",
          "collected": "50",
          "result": "passed",
          "reason": "Only the classic rule requires a linear history."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/admin_enforcement",
          "expected": "left out with permission_denied",
          "collected": "left out with permission_denied",
          "result": "passed",
          "reason": "The classic rule holds administrators to its rules, but the App cannot see whether the ruleset lets them bypass it, so the percentage is not collected."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/posture/protected_repository_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/pull_request_required",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/approving_reviews",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/dismiss_stale_reviews",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/code_owner_reviews",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/status_checks",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/signed_commits",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/admin_enforcement",
          "expected": "left out with permission_denied",
          "collected": "left out with permission_denied",
          "result": "passed",
          "reason": "Not collected, for the same reason as the percentage."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/force_pushes_blocked",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/deletions_blocked",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/linear_history",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/posture/security_features_coverage",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/vulnerability_alerts",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/code_scanning",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/secret_scanning",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/secret_scanning_push_protection",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/dependabot_security_updates",
          "expected": "100",
          "collected": "100",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/repository_counts/vulnerability_alerts",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/repository_counts/code_scanning",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/repository_counts/secret_scanning",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/repository_counts/secret_scanning_push_protection",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/repository_counts/dependabot_security_updates",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/access_control/default_repository_permission",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/access_control/members_can_create_repositories",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/members",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/codeowners",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/webhooks",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/deploy_keys",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/actions",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/environments",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/audit_log",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/apps",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/tokens",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/collector/name",
          "expected": "\"github\"",
          "collected": "\"github\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/outcome/status",
          "expected": "\"partial\"",
          "collected": "\"partial\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/outcome/code",
          "expected": "\"permission_denied\"",
          "collected": "\"permission_denied\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/outcome/owner",
          "expected": "\"customer\"",
          "collected": "\"customer\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/0/pointer",
          "expected": "\"/branch_protection_rules/admin_enforcement\"",
          "collected": "\"/branch_protection_rules/admin_enforcement\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/0/status",
          "expected": "\"partial\"",
          "collected": "\"partial\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/0/unmeasured",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/0/detail",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/0/missing_permission",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/0/fix",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/1/pointer",
          "expected": "\"/branch_protection_rules/repository_counts/admin_enforcement\"",
          "collected": "\"/branch_protection_rules/repository_counts/admin_enforcement\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/1/status",
          "expected": "\"partial\"",
          "collected": "\"partial\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/1/unmeasured",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/2",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/checks",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/warnings",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/signed_in_as/provider",
          "expected": "\"github\"",
          "collected": "\"github\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/signed_in_as/kind",
          "expected": "\"app_installation\"",
          "collected": "\"app_installation\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/signed_in_as/auth_method",
          "expected": "\"private_key_jwt\"",
          "collected": "\"private_key_jwt\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/signed_in_as/read_only",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/signed_in_as/scopes",
          "expected": "[\"administration:read\",\"contents:read\",\"members:read\",\"metadata:read\",\"organization_administration:read\",\"secret_scannin...",
          "collected": "[\"administration:read\",\"contents:read\",\"members:read\",\"metadata:read\",\"organization_administration:read\",\"secret_scannin...",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/signed_in_as/id",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/calls/requests",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        }
      ],
      "requirements": [
        {
          "id": "IDP-002",
          "name": "MFA enforced",
          "category": "Multi-Factor Authentication",
          "needs_other_evidence": true,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/github.vcs-posture.json",
              "pointer": "/org_security/two_factor_required",
              "expected": "true",
              "collected": "true",
              "result": "passed"
            }
          ]
        },
        {
          "id": "VCS-004",
          "name": "Vulnerability Alerts Enabled",
          "category": "Vulnerability Management",
          "needs_other_evidence": false,
          "expected": "pass",
          "status": "pass",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/github.vcs-posture.json",
              "pointer": "/security_features/vuln_alerts_pct",
              "expected": "100",
              "collected": "100",
              "result": "passed"
            }
          ]
        },
        {
          "id": "VCS-005",
          "name": "Code Scanning Enabled",
          "category": "Vulnerability Management",
          "needs_other_evidence": false,
          "expected": "pass",
          "status": "pass",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/github.vcs-posture.json",
              "pointer": "/security_features/code_scanning_pct",
              "expected": "100",
              "collected": "100",
              "result": "passed"
            }
          ]
        },
        {
          "id": "VCS-002",
          "name": "Branch Protection Coverage",
          "category": "Change Management",
          "needs_other_evidence": false,
          "expected": "pass",
          "status": "pass",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/github.vcs-posture.json",
              "pointer": "/branch_protection/pr_required_pct",
              "expected": "100",
              "collected": "100",
              "result": "passed"
            }
          ]
        },
        {
          "id": "VCS-003",
          "name": "Secret Scanning Enabled",
          "category": "Secrets Management",
          "needs_other_evidence": false,
          "expected": "pass",
          "status": "pass",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/github.vcs-posture.json",
              "pointer": "/security_features/secret_scanning_pct",
              "expected": "100",
              "collected": "100",
              "result": "passed"
            }
          ]
        }
      ]
    },
    {
      "sandbox": "github-noncompliant",
      "collector": "github",
      "level": "audit",
      "description": "A GitHub organization on the Free plan with uneven protection. Five public repositories are in scope. One has a classic rule that requires an approving review, one has a ruleset that requires a pull request with no approvals, one has a ruleset that is turned off, one has a classic rule that only blocks force pushes and deletions, and one has nothing. Security features vary by repository, two-factor authentication is not required, and members get write access to every repository. A sixth repository matches the exclude pattern, and the App is not installed on a seventh. The collector reads the organization at the audit level through a read-only GitHub App, installed on selected repositories, that lacks one permission on purpose.",
      "limits": [
        "Public repositories only, since the organization is on the Free plan.",
        "The owner is the only member, and per-member two-factor status appears only at the internal level, which this sandbox does not run.",
        "No webhooks, deploy keys, runners, deployment environments, or CODEOWNERS files are set up, so their counts are only checked at 0.",
        "The organization does not have GitHub Enterprise Cloud, so the audit log is never collected.",
        "Every call succeeds, so the sandbox does not check what the collector does when GitHub fails."
      ],
      "known_values": 455,
      "latest": {
        "date": "2026-11-07",
        "version": "v0.3.4",
        "result": "passed"
      },
      "passing_since": "2026-10-22",
      "nights": [
        {
          "date": "2026-10-22",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-23",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-24",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-25",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-26",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-27",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-28",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-29",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-30",
          "version": "v0.3.3",
          "result": "passed"
        },
        {
          "date": "2026-10-31",
          "version": "v0.3.4",
          "result": "passed"
        },
        {
          "date": "2026-11-01",
          "version": "v0.3.4",
          "result": "passed"
        },
        {
          "date": "2026-11-02",
          "version": "v0.3.4",
          "result": "passed"
        },
        {
          "date": "2026-11-03",
          "version": "v0.3.4",
          "result": "passed"
        },
        {
          "date": "2026-11-04",
          "version": "v0.3.4",
          "result": "passed"
        },
        {
          "date": "2026-11-05",
          "version": "v0.3.4",
          "result": "passed"
        },
        {
          "date": "2026-11-06",
          "version": "v0.3.4",
          "result": "passed"
        },
        {
          "date": "2026-11-07",
          "version": "v0.3.4",
          "result": "passed"
        }
      ],
      "checked": {
        "source": "nightly",
        "date": "2026-11-07",
        "version": "v0.3.4"
      },
      "fields": [
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/schema_version",
          "expected": "\"1.0.0\"",
          "collected": "\"1.0.0\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/provider",
          "expected": "\"github\"",
          "collected": "\"github\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/org_security/two_factor_required",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/repo_coverage_pct",
          "expected": "71",
          "collected": "71",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/branch_protection/pr_required_pct",
          "expected": "40",
          "collected": "40",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/branch_protection/approving_reviews_pct",
          "expected": "20",
          "collected": "20",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/branch_protection/status_checks_pct",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/branch_protection/signed_commits_pct",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/security_features/vuln_alerts_pct",
          "expected": "40",
          "collected": "40",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/security_features/secret_scanning_pct",
          "expected": "80",
          "collected": "80",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.vcs-posture.json",
          "pointer": "/security_features/code_scanning_pct",
          "expected": "60",
          "collected": "60",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/schema_version",
          "expected": "\"1.0.0\"",
          "collected": "\"1.0.0\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/collected_at_level",
          "expected": "\"audit\"",
          "collected": "\"audit\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/access_control/two_factor_required",
          "expected": "false",
          "collected": "false",
          "result": "passed",
          "reason": "The organization does not require two-factor authentication."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/access_control/default_repository_permission",
          "expected": "\"write\"",
          "collected": "\"write\"",
          "result": "passed",
          "reason": "Members get write access to every repository by default."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/access_control/members_can_create_repositories",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/scope/include_patterns",
          "expected": "[\"*\"]",
          "collected": "[\"*\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/scope/exclude_patterns",
          "expected": "[\"scratch-*\"]",
          "collected": "[\"scratch-*\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/scope/repository_selection",
          "expected": "\"selected\"",
          "collected": "\"selected\"",
          "result": "passed",
          "reason": "The App is installed on every repository but one, so the collector leaves that one out without reading it."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/scope/repository_count",
          "expected": "7",
          "collected": "7",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/scope/included_repository_count",
          "expected": "5",
          "collected": "5",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/scope/repositories_coverage",
          "expected": "71",
          "collected": "71",
          "result": "passed",
          "reason": "Five of the seven repositories are in scope. One matches the exclude pattern scratch-*, and the App is not installed on the other."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/posture/branch_protection_coverage",
          "expected": "60",
          "collected": "60",
          "result": "passed",
          "reason": "Three of the five have protection in force on the default branch. The ruleset that is turned off does not count, and the last repository has none."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/pull_request_required",
          "expected": "40",
          "collected": "40",
          "result": "passed",
          "reason": "Two repositories require a pull request, one through a classic rule and one through a ruleset."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/approving_reviews",
          "expected": "20",
          "collected": "20",
          "result": "passed",
          "reason": "Only the classic rule requires an approving review. The ruleset requires a pull request with no approvals, which does not count as a required review."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/dismiss_stale_reviews",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/code_owner_reviews",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/status_checks",
          "expected": "0",
          "collected": "0",
          "result": "passed",
          "reason": "No repository requires status checks."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/signed_commits",
          "expected": "0",
          "collected": "0",
          "result": "passed",
          "reason": "No repository requires signed commits."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/force_pushes_blocked",
          "expected": "60",
          "collected": "60",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/deletions_blocked",
          "expected": "60",
          "collected": "60",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/linear_history",
          "expected": "20",
          "collected": "20",
          "result": "passed",
          "reason": "One classic rule requires a linear history."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/admin_enforcement",
          "expected": "0",
          "collected": "0",
          "result": "passed",
          "reason": "Every classic rule leaves administrators exempt, and two repositories have no rule in force."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/posture/protected_repository_count",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/pull_request_required",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/approving_reviews",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/dismiss_stale_reviews",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/code_owner_reviews",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/status_checks",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/signed_commits",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/admin_enforcement",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/force_pushes_blocked",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/deletions_blocked",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/branch_protection_rules/repository_counts/linear_history",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/posture/security_features_coverage",
          "expected": "44",
          "collected": "44",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/vulnerability_alerts",
          "expected": "40",
          "collected": "40",
          "result": "passed",
          "reason": "Dependabot alerts are on in two of the five repositories."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/code_scanning",
          "expected": "60",
          "collected": "60",
          "result": "passed",
          "reason": "Three repositories have code scanning, two through default setup and one through a CodeQL workflow."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/secret_scanning",
          "expected": "80",
          "collected": "80",
          "result": "passed",
          "reason": "Secret scanning is on in four repositories."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/secret_scanning_push_protection",
          "expected": "20",
          "collected": "20",
          "result": "passed",
          "reason": "Push protection is on in one repository."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/dependabot_security_updates",
          "expected": "20",
          "collected": "20",
          "result": "passed",
          "reason": "Dependabot security updates are on in one repository."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/repository_counts/vulnerability_alerts",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/repository_counts/code_scanning",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/repository_counts/secret_scanning",
          "expected": "4",
          "collected": "4",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/repository_counts/secret_scanning_push_protection",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/repository_counts/dependabot_security_updates",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/0/vulnerability_alerts",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/0/code_scanning",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/0/secret_scanning",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/0/secret_scanning_push_protection",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/0/dependabot_security_updates",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/1/vulnerability_alerts",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/1/code_scanning",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/1/secret_scanning",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/1/secret_scanning_push_protection",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/1/dependabot_security_updates",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/2/vulnerability_alerts",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/2/code_scanning",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/2/secret_scanning",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/2/secret_scanning_push_protection",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/2/dependabot_security_updates",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/3/vulnerability_alerts",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/3/code_scanning",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/3/secret_scanning",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/3/secret_scanning_push_protection",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/3/dependabot_security_updates",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/4/vulnerability_alerts",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/4/code_scanning",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/4/secret_scanning",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/4/secret_scanning_push_protection",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/4/dependabot_security_updates",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/5",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/0/open_secret_scanning_alerts",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/0/open_code_scanning_alerts",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/0/open_dependabot_alerts",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/1/open_secret_scanning_alerts",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/1/open_code_scanning_alerts",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/1/open_dependabot_alerts",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/2/open_secret_scanning_alerts",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/2/open_code_scanning_alerts",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/2/open_dependabot_alerts",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/3/open_secret_scanning_alerts",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/3/open_code_scanning_alerts",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/3/open_dependabot_alerts",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/4/open_secret_scanning_alerts",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/4/open_code_scanning_alerts",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/per_repo/4/open_dependabot_alerts",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/total_count",
          "expected": "5",
          "collected": "5",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/public_count",
          "expected": "5",
          "collected": "5",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/private_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/archived_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/default_branch_protected_count",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/5",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/0/visibility",
          "expected": "\"PUBLIC\"",
          "collected": "\"PUBLIC\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/0/default_branch",
          "expected": "\"main\"",
          "collected": "\"main\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/0/branch_protection/requires_approving_reviews",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/0/branch_protection/required_approving_review_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/0/branch_protection/is_admin_enforced",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/0/effective_branch_protection/protected",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/0/effective_branch_protection/pull_request_required",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/0/effective_branch_protection/approving_reviews",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/0/effective_branch_protection/required_approving_review_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/0/effective_branch_protection/force_pushes_blocked",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/0/effective_branch_protection/admin_enforcement",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/0/effective_branch_protection/supplied_by/pull_request_required",
          "expected": "[\"classic_branch_protection\"]",
          "collected": "[\"classic_branch_protection\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/0/rulesets",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/branch_protection/requires_approving_reviews",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/branch_protection/requires_linear_history",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/branch_protection/allows_force_pushes",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/effective_branch_protection/protected",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/effective_branch_protection/pull_request_required",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/effective_branch_protection/approving_reviews",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/effective_branch_protection/required_approving_review_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/effective_branch_protection/force_pushes_blocked",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/effective_branch_protection/linear_history",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/effective_branch_protection/admin_enforcement",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/effective_branch_protection/supplied_by/pull_request_required",
          "expected": "[\"repository_ruleset\"]",
          "collected": "[\"repository_ruleset\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/effective_branch_protection/supplied_by/force_pushes_blocked",
          "expected": "[\"repository_ruleset\"]",
          "collected": "[\"repository_ruleset\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/effective_branch_protection/supplied_by/linear_history",
          "expected": "[\"classic_branch_protection\"]",
          "collected": "[\"classic_branch_protection\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/rulesets/0/name",
          "expected": "\"require-pull-request\"",
          "collected": "\"require-pull-request\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/rulesets/0/source_type",
          "expected": "\"Repository\"",
          "collected": "\"Repository\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/rulesets/0/enforcement",
          "expected": "\"active\"",
          "collected": "\"active\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/rulesets/0/bypass_allowed",
          "expected": "left out with permission_denied",
          "collected": "left out with permission_denied",
          "result": "passed",
          "reason": "GitHub shows a ruleset's bypass list only to accounts that can edit it, and the App only reads."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/rulesets/0/bypass_actors",
          "expected": "left out with permission_denied",
          "collected": "left out with permission_denied",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/1/rulesets/1",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/2/branch_protection",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/2/effective_branch_protection/protected",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/2/effective_branch_protection/pull_request_required",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/2/effective_branch_protection/admin_enforcement",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/2/rulesets",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/3/branch_protection/requires_approving_reviews",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/3/branch_protection/allows_force_pushes",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/3/effective_branch_protection/protected",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/3/effective_branch_protection/pull_request_required",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/3/effective_branch_protection/force_pushes_blocked",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/3/effective_branch_protection/admin_enforcement",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/3/effective_branch_protection/supplied_by/force_pushes_blocked",
          "expected": "[\"classic_branch_protection\"]",
          "collected": "[\"classic_branch_protection\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/3/rulesets",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/4/branch_protection",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/4/effective_branch_protection/protected",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/4/effective_branch_protection/admin_enforcement",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/4/rulesets",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/members/member_count",
          "expected": "1",
          "collected": "1",
          "result": "passed",
          "reason": "The owner is the only member."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/members/admin_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/members/outside_collaborator_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/members/has_pending_invitations",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/members/per_member/1",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/codeowners/per_repo/0/present",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/codeowners/per_repo/1/present",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/codeowners/per_repo/2/present",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/codeowners/per_repo/3/present",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/codeowners/per_repo/4/present",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/webhooks/org_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/webhooks/repo_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/deploy_keys/total_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/deploy_keys/read_write_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/actions/org_runner_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/actions/repo_runner_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/actions/org_secret_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/environments/total_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/environments/with_required_reviewers_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/apps/installation_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/audit_log",
          "expected": "left out with not_licensed",
          "collected": "left out with not_licensed",
          "result": "passed",
          "reason": "The audit log API needs GitHub Enterprise Cloud, which the organization does not have, so the audit log is not collected."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/tokens",
          "expected": "left out with permission_denied",
          "collected": "left out with permission_denied",
          "result": "passed",
          "reason": "The App lacks the Personal access tokens permission on purpose, so the token list is not collected, and the collector result names the permission to grant."
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/security_features/findings",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/repositories/per_repo/0/description",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.json",
          "pointer": "/members/per_member/0/two_factor_enabled",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/collector/name",
          "expected": "\"github\"",
          "collected": "\"github\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/outcome/status",
          "expected": "\"partial\"",
          "collected": "\"partial\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/outcome/code",
          "expected": "\"not_licensed\"",
          "collected": "\"not_licensed\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/outcome/owner",
          "expected": "\"nobody\"",
          "collected": "\"nobody\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/0/pointer",
          "expected": "\"/audit_log\"",
          "collected": "\"/audit_log\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/0/missing_permission",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/0/status",
          "expected": "\"not_collected\"",
          "collected": "\"not_collected\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/0/detail",
          "expected": "present",
          "collected": "present",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/0/operation",
          "expected": "\"github.audit_log.list\"",
          "collected": "\"github.audit_log.list\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/3/pointer",
          "expected": "\"/tokens\"",
          "collected": "\"/tokens\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/3/code",
          "expected": "\"permission_denied\"",
          "collected": "\"permission_denied\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/3/operation",
          "expected": "\"github.org_personal_access_tokens.list\"",
          "collected": "\"github.org_personal_access_tokens.list\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/3/missing_permission",
          "expected": "\"organization_personal_access_tokens:read\"",
          "collected": "\"organization_personal_access_tokens:read\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/3/warning",
          "expected": "\"Grant the GitHub App organization_personal_access_tokens:read.\"",
          "collected": "\"Grant the GitHub App organization_personal_access_tokens:read.\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/gaps/4",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/checks",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/warnings/1",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/signed_in_as/provider",
          "expected": "\"github\"",
          "collected": "\"github\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/signed_in_as/kind",
          "expected": "\"app_installation\"",
          "collected": "\"app_installation\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/signed_in_as/auth_method",
          "expected": "\"private_key_jwt\"",
          "collected": "\"private_key_jwt\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/signed_in_as/read_only",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/signed_in_as/scopes",
          "expected": "[\"actions:read\",\"administration:read\",\"contents:read\",\"members:read\",\"metadata:read\",\"organization_administration:read\",...",
          "collected": "[\"actions:read\",\"administration:read\",\"contents:read\",\"members:read\",\"metadata:read\",\"organization_administration:read\",...",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/signed_in_as/id",
          "expected": "present",
          "collected": "present",
          "result": "passed"
        },
        {
          "artifact": "artifacts/github.collector-result.json",
          "pointer": "/calls/requests",
          "expected": "present",
          "collected": "present",
          "result": "passed"
        }
      ],
      "requirements": [
        {
          "id": "IDP-002",
          "name": "MFA enforced",
          "category": "Multi-Factor Authentication",
          "needs_other_evidence": true,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/github.vcs-posture.json",
              "pointer": "/org_security/two_factor_required",
              "expected": "false",
              "collected": "false",
              "result": "passed"
            }
          ]
        },
        {
          "id": "VCS-004",
          "name": "Vulnerability Alerts Enabled",
          "category": "Vulnerability Management",
          "needs_other_evidence": false,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/github.vcs-posture.json",
              "pointer": "/security_features/vuln_alerts_pct",
              "expected": "40",
              "collected": "40",
              "result": "passed"
            }
          ]
        },
        {
          "id": "VCS-005",
          "name": "Code Scanning Enabled",
          "category": "Vulnerability Management",
          "needs_other_evidence": false,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/github.vcs-posture.json",
              "pointer": "/security_features/code_scanning_pct",
              "expected": "60",
              "collected": "60",
              "result": "passed"
            }
          ]
        },
        {
          "id": "VCS-002",
          "name": "Branch Protection Coverage",
          "category": "Change Management",
          "needs_other_evidence": false,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/github.vcs-posture.json",
              "pointer": "/branch_protection/pr_required_pct",
              "expected": "40",
              "collected": "40",
              "result": "passed"
            }
          ]
        },
        {
          "id": "VCS-003",
          "name": "Secret Scanning Enabled",
          "category": "Secrets Management",
          "needs_other_evidence": false,
          "expected": "fail",
          "status": "fail",
          "result": "passed",
          "values": [
            {
              "artifact": "artifacts/github.vcs-posture.json",
              "pointer": "/security_features/secret_scanning_pct",
              "expected": "80",
              "collected": "80",
              "result": "passed"
            }
          ]
        }
      ]
    },
    {
      "sandbox": "clickhouse",
      "collector": "clickhouse",
      "level": "audit",
      "description": "A ClickHouse Cloud organization used only for these checks, with four members, a pending invitation, six API keys, and one service. The service has eight database users and three roles of the customer's, and a settings profile, a quota, and a row policy for its read-only role. ClickHouse Cloud's own users and roles are counted apart from the customer's. The collector reads at the audit level, the console with an API key that can manage the organization, and the service as a read-only database user.",
      "limits": [
        "ClickHouse Cloud has no API that reports SAML SSO or a member's MFA, so both are checked only as not collected.",
        "One service. Organizations with several services aren't covered.",
        "ClickHouse Cloud decides some counts itself, such as its own grants and its system console roles, so those are checked as minimums.",
        "The collector's API key can manage the organization, so the sandbox does not check a read-only key, which can't list members or console roles."
      ],
      "known_values": 305,
      "latest": {
        "date": "2026-11-07",
        "version": "v0.1.0",
        "result": "passed"
      },
      "passing_since": "2026-10-23",
      "nights": [
        {
          "date": "2026-10-23",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-10-24",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-10-25",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-10-26",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-10-27",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-10-28",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-10-29",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-10-30",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-10-31",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-11-01",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-11-02",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-11-03",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-11-04",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-11-05",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-11-06",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-11-07",
          "version": "v0.1.0",
          "result": "passed"
        }
      ],
      "checked": {
        "source": "nightly",
        "date": "2026-11-07",
        "version": "v0.1.0"
      },
      "fields": [
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/schema_version",
          "expected": "\"1.0.0\"",
          "collected": "\"1.0.0\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/collected_at_level",
          "expected": "\"audit\"",
          "collected": "\"audit\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/organization/id",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/organization/sso_enabled",
          "expected": "left out with not_licensed",
          "collected": "left out with not_licensed",
          "result": "passed",
          "reason": "ClickHouse Cloud has no API that reports SAML SSO."
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/members/total_count",
          "expected": "4",
          "collected": "4",
          "result": "passed",
          "reason": "Four members with different console roles."
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/members/admin_count",
          "expected": "1",
          "collected": "1",
          "result": "passed",
          "reason": "One member holds the Admin role."
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/members/mfa_enabled_count",
          "expected": "left out with not_licensed",
          "collected": "left out with not_licensed",
          "result": "passed",
          "reason": "ClickHouse Cloud has no API that reports a member's MFA."
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/members/inventory/0/roles",
          "expected": "[{\"name\":\"Member\",\"type\":\"system\"},{\"name\":\"sandbox-auditor\",\"type\":\"custom\"}]",
          "collected": "[{\"name\":\"Member\",\"type\":\"system\"},{\"name\":\"sandbox-auditor\",\"type\":\"custom\"}]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/members/inventory/0/admin",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/members/inventory/1/roles",
          "expected": "[{\"name\":\"Billing\",\"type\":\"system\"}]",
          "collected": "[{\"name\":\"Billing\",\"type\":\"system\"}]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/members/inventory/2/roles",
          "expected": "[{\"name\":\"Admin\",\"type\":\"system\"}]",
          "collected": "[{\"name\":\"Admin\",\"type\":\"system\"}]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/members/inventory/2/admin",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/members/inventory/3/roles",
          "expected": "[{\"name\":\"Member\",\"type\":\"system\"},{\"name\":\"Service Reader\",\"type\":\"system\"}]",
          "collected": "[{\"name\":\"Member\",\"type\":\"system\"},{\"name\":\"Service Reader\",\"type\":\"system\"}]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/members/inventory/4",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/invitations/total_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/invitations/pending_count",
          "expected": "1",
          "collected": "1",
          "result": "passed",
          "reason": "One invitation is kept pending."
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/invitations/expired_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/invitations/inventory/0/roles",
          "expected": "[{\"name\":\"Member\",\"type\":\"system\"}]",
          "collected": "[{\"name\":\"Member\",\"type\":\"system\"}]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/total_count",
          "expected": "6",
          "collected": "6",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/enabled_count",
          "expected": "5",
          "collected": "5",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/admin_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/never_expires_count",
          "expected": "5",
          "collected": "5",
          "result": "passed",
          "reason": "Five of the six keys never expire."
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/any_address_count",
          "expected": "5",
          "collected": "5",
          "result": "passed",
          "reason": "Five of the six keys can be used from any address."
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/never_used_count",
          "expected": "4",
          "collected": "4",
          "result": "passed",
          "reason": "Only the admin key and the collector's key are used, every night."
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/0/name",
          "expected": "\"epack-collector\"",
          "collected": "\"epack-collector\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/0/roles",
          "expected": "[{\"name\":\"epack-collector\",\"type\":\"custom\"}]",
          "collected": "[{\"name\":\"epack-collector\",\"type\":\"custom\"}]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/0/expires_at",
          "expected": "null",
          "collected": "null",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/0/ip_access_list",
          "expected": "[\"0.0.0.0/0\"]",
          "collected": "[\"0.0.0.0/0\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/0/never_used",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/1/name",
          "expected": "\"sandbox-admin\"",
          "collected": "\"sandbox-admin\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/1/admin",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/1/expires_at",
          "expected": "null",
          "collected": "null",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/1/never_used",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/2/name",
          "expected": "\"sandbox-auditor\"",
          "collected": "\"sandbox-auditor\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/2/roles",
          "expected": "[{\"name\":\"sandbox-auditor\",\"type\":\"custom\"}]",
          "collected": "[{\"name\":\"sandbox-auditor\",\"type\":\"custom\"}]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/2/never_used",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/3/name",
          "expected": "\"sandbox-disabled\"",
          "collected": "\"sandbox-disabled\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/3/state",
          "expected": "\"disabled\"",
          "collected": "\"disabled\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/3/roles",
          "expected": "[]",
          "collected": "[]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/4/name",
          "expected": "\"sandbox-expiring\"",
          "collected": "\"sandbox-expiring\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/4/expires_at",
          "expected": "\"2030-01-01T00:00:00Z\"",
          "collected": "\"2030-01-01T00:00:00Z\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/4/roles",
          "expected": "[]",
          "collected": "[]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/5/name",
          "expected": "\"sandbox-ip-limited\"",
          "collected": "\"sandbox-ip-limited\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/5/ip_access_list",
          "expected": "[\"203.0.113.0/24\"]",
          "collected": "[\"203.0.113.0/24\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/5/any_address",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/api_keys/inventory/6",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/console_roles/custom_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/console_roles/total_count",
          "expected": "at least 12",
          "collected": "12",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/host",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/user",
          "expected": "\"epack_collector\"",
          "collected": "\"epack_collector\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/version",
          "expected": "present",
          "collected": "present",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/1",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/customer_count",
          "expected": "8",
          "collected": "8",
          "result": "passed",
          "reason": "Six users made for these checks, and the default and sql-console users ClickHouse Cloud creates."
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/cloud_managed_count",
          "expected": "11",
          "collected": "11",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/no_password_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/plaintext_password_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/any_host_count",
          "expected": "7",
          "collected": "7",
          "result": "passed",
          "reason": "Seven of the eight can connect from any address. One connects only from 10.0.0.0/8."
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/0/name",
          "expected": "\"analyst\"",
          "collected": "\"analyst\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/0/auth_methods",
          "expected": "[{\"second_factor\":null,\"type\":\"sha256_password\",\"valid_until\":null}]",
          "collected": "[{\"second_factor\":null,\"type\":\"sha256_password\",\"valid_until\":null}]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/1/name",
          "expected": "\"default\"",
          "collected": "\"default\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/1/auth_methods/0/type",
          "expected": "\"sha256_password\"",
          "collected": "\"sha256_password\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/2/name",
          "expected": "\"deploy_bot\"",
          "collected": "\"deploy_bot\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/2/auth_methods",
          "expected": "[{\"second_factor\":null,\"type\":\"ssh_key\",\"valid_until\":null}]",
          "collected": "[{\"second_factor\":null,\"type\":\"ssh_key\",\"valid_until\":null}]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/3/name",
          "expected": "\"epack_collector\"",
          "collected": "\"epack_collector\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/3/auth_methods/0/type",
          "expected": "\"sha256_password\"",
          "collected": "\"sha256_password\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/4/name",
          "expected": "\"legacy_app\"",
          "collected": "\"legacy_app\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/4/auth_methods/0/type",
          "expected": "\"sha256_password\"",
          "collected": "\"sha256_password\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/4/auth_methods/1/type",
          "expected": "\"ssh_key\"",
          "collected": "\"ssh_key\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/5/name",
          "expected": "\"office_only\"",
          "collected": "\"office_only\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/5/host_ip",
          "expected": "[\"10.0.0.0/8\"]",
          "collected": "[\"10.0.0.0/8\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/5/any_host",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/6/name",
          "expected": "\"ops_admin\"",
          "collected": "\"ops_admin\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/6/auth_methods/0/valid_until",
          "expected": "\"2030-01-01T00:00:00Z\"",
          "collected": "\"2030-01-01T00:00:00Z\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/7/name",
          "expected": "\"sql-console\"",
          "collected": "\"sql-console\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/inventory/8",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/cloud_managed/0/name",
          "expected": "\"availability-monitoring-internal\"",
          "collected": "\"availability-monitoring-internal\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/cloud_managed/1/name",
          "expected": "\"backups-internal\"",
          "collected": "\"backups-internal\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/cloud_managed/2/name",
          "expected": "\"hyperdx-alert-internal\"",
          "collected": "\"hyperdx-alert-internal\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/cloud_managed/3/name",
          "expected": "\"management-internal\"",
          "collected": "\"management-internal\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/cloud_managed/4/name",
          "expected": "\"monitoring-internal\"",
          "collected": "\"monitoring-internal\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/cloud_managed/5/name",
          "expected": "\"observability-internal\"",
          "collected": "\"observability-internal\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/cloud_managed/6/name",
          "expected": "\"operator-cert-internal\"",
          "collected": "\"operator-cert-internal\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/cloud_managed/7/name",
          "expected": "\"operator-internal\"",
          "collected": "\"operator-internal\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/cloud_managed/8/name",
          "expected": "\"prometheus-certauth-internal\"",
          "collected": "\"prometheus-certauth-internal\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/cloud_managed/9/name",
          "expected": "\"prometheus-exporter\"",
          "collected": "\"prometheus-exporter\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/users/cloud_managed/10/name",
          "expected": "\"prometheus-internal\"",
          "collected": "\"prometheus-internal\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/roles/customer_count",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/roles/cloud_managed_count",
          "expected": "4",
          "collected": "4",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/roles/inventory/0/name",
          "expected": "\"access_reader\"",
          "collected": "\"access_reader\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/roles/inventory/1/name",
          "expected": "\"app_reader\"",
          "collected": "\"app_reader\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/roles/inventory/2/name",
          "expected": "\"user_admin\"",
          "collected": "\"user_admin\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/roles/cloud_managed/0/name",
          "expected": "\"clickpipes_system\"",
          "collected": "\"clickpipes_system\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/roles/cloud_managed/1/name",
          "expected": "\"default_role\"",
          "collected": "\"default_role\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/roles/cloud_managed/2/name",
          "expected": "\"sql_console_admin\"",
          "collected": "\"sql_console_admin\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/roles/cloud_managed/3/name",
          "expected": "\"sql_console_read_only\"",
          "collected": "\"sql_console_read_only\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/role_grants/customer_count",
          "expected": "7",
          "collected": "7",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/role_grants/with_admin_option_count",
          "expected": "4",
          "collected": "4",
          "result": "passed",
          "reason": "Four role grants let their holders grant the role to others."
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/role_grants/cloud_managed_count",
          "expected": "at least 1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/role_grants/inventory/0",
          "expected": "{\"granted_role_is_default\":true,\"granted_role_name\":\"app_reader\",\"role_name\":null,\"user_name\":\"analyst\",\"with_admin_opti...",
          "collected": "{\"granted_role_is_default\":true,\"granted_role_name\":\"app_reader\",\"role_name\":null,\"user_name\":\"analyst\",\"with_admin_opti...",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/role_grants/inventory/2",
          "expected": "{\"granted_role_is_default\":true,\"granted_role_name\":\"access_reader\",\"role_name\":null,\"user_name\":\"epack_collector\",\"with...",
          "collected": "{\"granted_role_is_default\":true,\"granted_role_name\":\"access_reader\",\"role_name\":null,\"user_name\":\"epack_collector\",\"with...",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/role_grants/inventory/3",
          "expected": "{\"granted_role_is_default\":true,\"granted_role_name\":\"app_reader\",\"role_name\":null,\"user_name\":\"office_only\",\"with_admin_...",
          "collected": "{\"granted_role_is_default\":true,\"granted_role_name\":\"app_reader\",\"role_name\":null,\"user_name\":\"office_only\",\"with_admin_...",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/role_grants/inventory/4",
          "expected": "{\"granted_role_is_default\":true,\"granted_role_name\":\"user_admin\",\"role_name\":null,\"user_name\":\"ops_admin\",\"with_admin_op...",
          "collected": "{\"granted_role_is_default\":true,\"granted_role_name\":\"user_admin\",\"role_name\":null,\"user_name\":\"ops_admin\",\"with_admin_op...",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/grants/customer_count",
          "expected": "at least 11",
          "collected": "14",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/grants/grant_option_count",
          "expected": "1",
          "collected": "1",
          "result": "passed",
          "reason": "One grant, SELECT on one table, lets its user pass it on."
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/grants/cloud_managed_count",
          "expected": "at least 1",
          "collected": "168",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/grants/inventory/0",
          "expected": "{\"access_type\":\"SELECT\",\"column\":null,\"database\":\"app\",\"grant_option\":true,\"is_partial_revoke\":false,\"role_name\":null,\"t...",
          "collected": "{\"access_type\":\"SELECT\",\"column\":null,\"database\":\"app\",\"grant_option\":true,\"is_partial_revoke\":false,\"role_name\":null,\"t...",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/settings_profiles/customer_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/settings_profiles/cloud_managed_count",
          "expected": "at least 1",
          "collected": "15",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/settings_profiles/inventory/0/name",
          "expected": "\"ro_profile\"",
          "collected": "\"ro_profile\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/settings_profiles/inventory/0/apply_to_list",
          "expected": "[\"app_reader\"]",
          "collected": "[\"app_reader\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/settings_profile_elements/inventory/0/profile_name",
          "expected": "\"ro_profile\"",
          "collected": "\"ro_profile\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/settings_profile_elements/inventory/0/setting_name",
          "expected": "\"readonly\"",
          "collected": "\"readonly\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/settings_profile_elements/inventory/0/value",
          "expected": "\"1\"",
          "collected": "\"1\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/settings_profile_elements/inventory/1/user_name",
          "expected": "\"epack_collector\"",
          "collected": "\"epack_collector\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/settings_profile_elements/inventory/1/setting_name",
          "expected": "\"readonly\"",
          "collected": "\"readonly\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/settings_profile_elements/inventory/1/value",
          "expected": "\"1\"",
          "collected": "\"1\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/quotas/customer_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/quotas/inventory/0/name",
          "expected": "\"reader_quota\"",
          "collected": "\"reader_quota\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/quotas/inventory/0/apply_to_list",
          "expected": "[\"app_reader\"]",
          "collected": "[\"app_reader\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/quota_limits/customer_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/quota_limits/inventory/0/limits",
          "expected": "{\"failed_sequential_authentications\":5,\"queries\":1000}",
          "collected": "{\"failed_sequential_authentications\":5,\"queries\":1000}",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/row_policies/customer_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/row_policies/cloud_managed_count",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/row_policies/inventory/0/short_name",
          "expected": "\"tenant_a\"",
          "collected": "\"tenant_a\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/row_policies/inventory/0/database",
          "expected": "\"app\"",
          "collected": "\"app\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/row_policies/inventory/0/table",
          "expected": "\"events\"",
          "collected": "\"events\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.json",
          "pointer": "/services/0/row_policies/inventory/0/apply_to_list",
          "expected": "[\"app_reader\"]",
          "collected": "[\"app_reader\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-result.json",
          "pointer": "/collector/name",
          "expected": "\"clickhouse\"",
          "collected": "\"clickhouse\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-result.json",
          "pointer": "/signed_in_as/provider",
          "expected": "\"clickhouse\"",
          "collected": "\"clickhouse\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-result.json",
          "pointer": "/signed_in_as/kind",
          "expected": "\"api_key\"",
          "collected": "\"api_key\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-result.json",
          "pointer": "/signed_in_as/tenant_id",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-result.json",
          "pointer": "/signed_in_as/auth_method",
          "expected": "\"api_token\"",
          "collected": "\"api_token\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-result.json",
          "pointer": "/steps/0/name",
          "expected": "\"sign_in\"",
          "collected": "\"sign_in\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-result.json",
          "pointer": "/steps/1/name",
          "expected": "\"members\"",
          "collected": "\"members\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-result.json",
          "pointer": "/steps/2/name",
          "expected": "\"api_keys\"",
          "collected": "\"api_keys\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-result.json",
          "pointer": "/steps/3/name",
          "expected": "\"console_roles\"",
          "collected": "\"console_roles\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-result.json",
          "pointer": "/steps/4/name",
          "expected": "\"databases\"",
          "collected": "\"databases\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-result.json",
          "pointer": "/steps/5",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-result.json",
          "pointer": "/gaps/0/pointer",
          "expected": "\"/members/mfa_enabled_count\"",
          "collected": "\"/members/mfa_enabled_count\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-result.json",
          "pointer": "/gaps/1/pointer",
          "expected": "\"/organization/sso_enabled\"",
          "collected": "\"/organization/sso_enabled\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-result.json",
          "pointer": "/gaps/2",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-result.json",
          "pointer": "/calls/requests/*/start_ms",
          "expected": "present",
          "collected": "present",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-result.json",
          "pointer": "/checks",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-build.json",
          "pointer": "/collector/name",
          "expected": "\"clickhouse\"",
          "collected": "\"clickhouse\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-build.json",
          "pointer": "/collector/version",
          "expected": "the same as artifacts/clickhouse.collector-result.json /collector/version, which is \"0.1.0\"",
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-build.json",
          "pointer": "/schemas/artifacts~1clickhouse.json",
          "expected": "present",
          "collected": "present",
          "result": "passed"
        },
        {
          "artifact": "artifacts/clickhouse.collector-build.json",
          "pointer": "/trace_map/artifacts/artifacts~1clickhouse.json/~1members~1total_count/operations",
          "expected": "[\"clickhouse.members.list\"]",
          "collected": "[\"clickhouse.members.list\"]",
          "result": "passed"
        }
      ],
      "requirements": []
    },
    {
      "sandbox": "modal",
      "collector": "modal",
      "level": "audit",
      "description": "A Modal workspace on the Starter plan, used only for these checks. It has an owner, a manager, and a member, three environments, three secrets, one proxy auth token, and three deployed apps: a web endpoint anyone can call, one that needs a proxy auth token, and a job that runs every day. The collector reads the workspace at the audit level with the manager's token.",
      "limits": [
        "Starter has no service users, restricted environments, or environment roles, so service users are checked only at 0 and no environment has roles.",
        "Starter can't limit a proxy auth token to environments, so tokens limited that way aren't checked.",
        "The collector signs in as a Manager, so the sandbox does not check a Member's token, which can't list members.",
        "The members' addresses aren't published, so their rows are checked by count only."
      ],
      "known_values": 171,
      "latest": {
        "date": "2026-11-07",
        "version": "v0.1.0",
        "result": "passed"
      },
      "passing_since": "2026-10-23",
      "nights": [
        {
          "date": "2026-10-23",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-10-24",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-10-25",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-10-26",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-10-27",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-10-28",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-10-29",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-10-30",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-10-31",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-11-01",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-11-02",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-11-03",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-11-04",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-11-05",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-11-06",
          "version": "v0.1.0",
          "result": "passed"
        },
        {
          "date": "2026-11-07",
          "version": "v0.1.0",
          "result": "passed"
        }
      ],
      "checked": {
        "source": "nightly",
        "date": "2026-11-07",
        "version": "v0.1.0"
      },
      "fields": [
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/schema_version",
          "expected": "\"1.0.0\"",
          "collected": "\"1.0.0\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/collected_at_level",
          "expected": "\"audit\"",
          "collected": "\"audit\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/workspace/name",
          "expected": null,
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/members/total_count",
          "expected": "3",
          "collected": "3",
          "result": "passed",
          "reason": "The owner, the manager, and the member."
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/members/owner_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/members/manager_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/members/member_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/members/sign_in",
          "expected": "{\"github_count\":1,\"google_count\":2,\"other_count\":0,\"saml_count\":0}",
          "collected": "{\"github_count\":1,\"google_count\":2,\"other_count\":0,\"saml_count\":0}",
          "result": "passed",
          "reason": "The owner signs in with GitHub, and the manager and the member with Google."
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/members/inventory/3",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/environments/total_count",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/environments/restricted_count",
          "expected": "0",
          "collected": "0",
          "result": "passed",
          "reason": "Starter has no restricted environments."
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/environments/inventory/0/name",
          "expected": "\"dev\"",
          "collected": "\"dev\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/environments/inventory/0/default",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/environments/inventory/1/name",
          "expected": "\"main\"",
          "collected": "\"main\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/environments/inventory/1/default",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/environments/inventory/2/name",
          "expected": "\"prod\"",
          "collected": "\"prod\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/environments/inventory/2/default",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/environments/inventory/3",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/environments/inventory/*/restricted",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/environments/inventory/*/blocks_unauthenticated",
          "expected": "null",
          "collected": "null",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/environments/inventory/*/roles",
          "expected": "null",
          "collected": "null",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/service_users/total_count",
          "expected": "0",
          "collected": "0",
          "result": "passed",
          "reason": "Starter has no service users."
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/service_users/inventory/0",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/proxy_auth_tokens/total_count",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/proxy_auth_tokens/unscoped_count",
          "expected": "1",
          "collected": "1",
          "result": "passed",
          "reason": "The one proxy auth token works in every environment."
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/proxy_auth_tokens/inventory/0/name",
          "expected": "\"sandbox-caller\"",
          "collected": "\"sandbox-caller\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/proxy_auth_tokens/inventory/0/scoped",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/proxy_auth_tokens/inventory/0/environments",
          "expected": "null",
          "collected": "null",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/secrets/total_count",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/secrets/never_used_count",
          "expected": "2",
          "collected": "2",
          "result": "passed",
          "reason": "The daily job reads one of the three secrets. No app reads the other two."
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/secrets/inventory/0/name",
          "expected": "\"api-key\"",
          "collected": "\"api-key\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/secrets/inventory/0/environment",
          "expected": "\"dev\"",
          "collected": "\"dev\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/secrets/inventory/0/keys",
          "expected": "[\"API_KEY\"]",
          "collected": "[\"API_KEY\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/secrets/inventory/0/never_used",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/secrets/inventory/1/name",
          "expected": "\"db-credentials\"",
          "collected": "\"db-credentials\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/secrets/inventory/1/environment",
          "expected": "\"prod\"",
          "collected": "\"prod\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/secrets/inventory/1/keys",
          "expected": "[\"DB_PASSWORD\"]",
          "collected": "[\"DB_PASSWORD\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/secrets/inventory/1/never_used",
          "expected": "false",
          "collected": "false",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/secrets/inventory/2/name",
          "expected": "\"stale-token\"",
          "collected": "\"stale-token\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/secrets/inventory/2/environment",
          "expected": "\"prod\"",
          "collected": "\"prod\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/secrets/inventory/2/keys",
          "expected": "[\"TOKEN\"]",
          "collected": "[\"TOKEN\"]",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/secrets/inventory/2/never_used",
          "expected": "true",
          "collected": "true",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/secrets/inventory/3",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/deployed_count",
          "expected": "3",
          "collected": "3",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/web_endpoint_count",
          "expected": "2",
          "collected": "2",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/unauthenticated_endpoint_count",
          "expected": "1",
          "collected": "1",
          "result": "passed",
          "reason": "Of the two web endpoints, the one in the dev environment needs no proxy auth token."
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/scheduled_function_count",
          "expected": "1",
          "collected": "1",
          "result": "passed",
          "reason": "The daily job runs on a schedule."
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/0/name",
          "expected": "\"sandbox-public-api\"",
          "collected": "\"sandbox-public-api\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/0/environment",
          "expected": "\"dev\"",
          "collected": "\"dev\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/0/state",
          "expected": "\"deployed\"",
          "collected": "\"deployed\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/0/web_endpoints",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/0/unauthenticated_endpoints",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/0/scheduled_functions",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/1/name",
          "expected": "\"sandbox-nightly-job\"",
          "collected": "\"sandbox-nightly-job\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/1/environment",
          "expected": "\"prod\"",
          "collected": "\"prod\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/1/state",
          "expected": "\"deployed\"",
          "collected": "\"deployed\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/1/web_endpoints",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/1/scheduled_functions",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/2/name",
          "expected": "\"sandbox-private-api\"",
          "collected": "\"sandbox-private-api\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/2/environment",
          "expected": "\"prod\"",
          "collected": "\"prod\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/2/state",
          "expected": "\"deployed\"",
          "collected": "\"deployed\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/2/web_endpoints",
          "expected": "1",
          "collected": "1",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/2/unauthenticated_endpoints",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/2/scheduled_functions",
          "expected": "0",
          "collected": "0",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.json",
          "pointer": "/apps/inventory/3",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.collector-result.json",
          "pointer": "/collector/name",
          "expected": "\"modal\"",
          "collected": "\"modal\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.collector-result.json",
          "pointer": "/signed_in_as/provider",
          "expected": "\"modal\"",
          "collected": "\"modal\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.collector-result.json",
          "pointer": "/signed_in_as/kind",
          "expected": "\"user\"",
          "collected": "\"user\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.collector-result.json",
          "pointer": "/signed_in_as/auth_method",
          "expected": "\"api_token\"",
          "collected": "\"api_token\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.collector-result.json",
          "pointer": "/steps/0/name",
          "expected": "\"sign_in\"",
          "collected": "\"sign_in\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.collector-result.json",
          "pointer": "/steps/1/name",
          "expected": "\"members\"",
          "collected": "\"members\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.collector-result.json",
          "pointer": "/steps/2/name",
          "expected": "\"environments\"",
          "collected": "\"environments\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.collector-result.json",
          "pointer": "/steps/3/name",
          "expected": "\"tokens\"",
          "collected": "\"tokens\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.collector-result.json",
          "pointer": "/steps/4/name",
          "expected": "\"workloads\"",
          "collected": "\"workloads\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.collector-result.json",
          "pointer": "/steps/5",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.collector-result.json",
          "pointer": "/gaps/0",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.collector-result.json",
          "pointer": "/checks",
          "expected": "absent",
          "collected": "absent",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.collector-build.json",
          "pointer": "/collector/name",
          "expected": "\"modal\"",
          "collected": "\"modal\"",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.collector-build.json",
          "pointer": "/collector/version",
          "expected": "the same as artifacts/modal.collector-result.json /collector/version, which is \"0.1.0\"",
          "collected": null,
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.collector-build.json",
          "pointer": "/schemas/artifacts~1modal.json",
          "expected": "present",
          "collected": "present",
          "result": "passed"
        },
        {
          "artifact": "artifacts/modal.collector-build.json",
          "pointer": "/trace_map/artifacts/artifacts~1modal.json/~1members~1total_count/operations",
          "expected": "[\"modal.members.list\"]",
          "collected": "[\"modal.members.list\"]",
          "result": "passed"
        }
      ],
      "requirements": []
    }
  ],
  "release_checks": [
    {
      "collector": "email-dns",
      "version": "v0.3.0",
      "commit": "f9621c3cfa3ab55526fc5d12a256b1594af638ff",
      "date": "2026-11-05",
      "result": "passed"
    },
    {
      "collector": "email-dns",
      "version": "v0.2.2",
      "commit": "e9585b8e4e5dfe199305f3186e841bd373e8399f",
      "date": "2026-10-22",
      "result": "passed"
    },
    {
      "collector": "email-dns",
      "version": "v0.2.1",
      "commit": "55ccc0323e4c6669b7b92912deb3dec9f5b5f9c4",
      "date": "2026-10-21",
      "result": "passed"
    },
    {
      "collector": "email-dns",
      "version": "v0.2.0",
      "commit": "dbfcc1f7bd9cb919404a0e6b0e2b0a3cb3596d62",
      "date": "2026-10-20",
      "result": "passed"
    },
    {
      "collector": "tls",
      "version": "v0.3.0",
      "commit": "d444f010d24eca65d7f2387df61090b495dfc95e",
      "date": "2026-11-05",
      "result": "passed"
    },
    {
      "collector": "tls",
      "version": "v0.2.0",
      "commit": "9bfcc2cada1d274ab99f37587bc9a6fb7fd1e775",
      "date": "2026-10-29",
      "result": "passed"
    },
    {
      "collector": "aws",
      "version": "v0.7.2",
      "commit": "ac4d557e92ab579c6e069fa461e5d9f02d4af6f3",
      "date": "2026-11-06",
      "result": "passed"
    },
    {
      "collector": "aws",
      "version": "v0.7.1",
      "commit": "38c8b2ff0cd9dda3ef9d33b0b86e1b401f4c0503",
      "date": "2026-11-06",
      "result": "passed"
    },
    {
      "collector": "aws",
      "version": "v0.7.0",
      "commit": "ddb4e4f76de61ec9c88c4dd9ef411d4a3d98a6df",
      "date": "2026-11-05",
      "result": "passed"
    },
    {
      "collector": "aws",
      "version": "v0.6.0",
      "commit": "f97e116b3d22f9c7a8b43419f63534a4b9d5d083",
      "date": "2026-10-23",
      "result": "passed"
    },
    {
      "collector": "aws",
      "version": "v0.5.0",
      "commit": "8b9f29fe52a1713ac6b6b524ab785f1da103e1a7",
      "date": "2026-10-21",
      "result": "passed"
    },
    {
      "collector": "okta",
      "version": "v0.5.0",
      "commit": "dc21fbb3f1b5f5e0e086b9a51fc6ddc0d512092d",
      "date": "2026-11-05",
      "result": "passed"
    },
    {
      "collector": "okta",
      "version": "v0.4.0",
      "commit": "66bff6e9568eb30df2c5e7e871cf5c2567f2d1ce",
      "date": "2026-10-20",
      "result": "passed"
    },
    {
      "collector": "okta",
      "version": "v0.3.0",
      "commit": "780962d0fea32ae70b5ebf5da893f76364010577",
      "date": "2026-10-20",
      "result": "passed"
    },
    {
      "collector": "github",
      "version": "v0.4.2",
      "commit": "2d4d8f55eb8ca54af40d321068f996180236e288",
      "date": "2026-11-06",
      "result": "passed"
    },
    {
      "collector": "github",
      "version": "v0.4.1",
      "commit": "67fcb8ef773644dc68abd78bf31a98eb3bf251c2",
      "date": "2026-11-06",
      "result": "passed"
    },
    {
      "collector": "github",
      "version": "v0.4.0",
      "commit": "7956dbeb82978d552e91f2ca1f7e68f184d64843",
      "date": "2026-11-05",
      "result": "passed"
    },
    {
      "collector": "github",
      "version": "v0.3.4",
      "commit": "1c844c8f593322b7d445203f663353290416145c",
      "date": "2026-10-30",
      "result": "passed"
    },
    {
      "collector": "github",
      "version": "v0.3.3",
      "commit": "9a732f7b0e4ba5b38d3c4b5092827498613a77a0",
      "date": "2026-10-21",
      "result": "passed"
    },
    {
      "collector": "github",
      "version": "v0.3.2",
      "commit": "575aae3c27e8063e79a36f28227c8da6f57625d5",
      "date": "2026-10-21",
      "result": "passed"
    },
    {
      "collector": "github",
      "version": "v0.3.1",
      "commit": "fbaab61d94b97f4086fbff2f9c6fb7662fd94e64",
      "date": "2026-10-21",
      "result": "passed"
    },
    {
      "collector": "github",
      "version": "v0.3.0",
      "commit": "791d6671e0bd79a1c24b7fe771f0829ac5f9c01c",
      "date": "2026-10-21",
      "result": "passed"
    },
    {
      "collector": "clickhouse",
      "version": "v0.2.0",
      "commit": "d7c7b85859421bcf6a26b63c5daecd44d4181cd0",
      "date": "2026-11-05",
      "result": "passed"
    },
    {
      "collector": "clickhouse",
      "version": "v0.1.0",
      "commit": "e86013cd50fe6136dfdd7301ce9346bd4d0e0f98",
      "date": "2026-10-22",
      "result": "passed"
    },
    {
      "collector": "modal",
      "version": "v0.2.0",
      "commit": "b3c2bc6a42c76ab3365152dcc4bde3696d4ab27f",
      "date": "2026-11-05",
      "result": "passed"
    },
    {
      "collector": "modal",
      "version": "v0.1.0",
      "commit": "8f871854f9dad2f049f04572d0a8c31822143e2a",
      "date": "2026-10-22",
      "result": "passed"
    }
  ]
}