{
  "schema": "varexis-declared-evidence-result/1",
  "profile": "audit",
  "policy_id": "synthetic-audit-policy",
  "evaluated_on": "2026-10-16",
  "date_basis": "Caller-supplied date",
  "manifest_sha256": "00bfacdd022b1c1a5119a979b9accf3f542a896a720bbfd3306cc1776019d473",
  "input_sha256": "ad5ca3579c7e840f221b53b0abd5b4e0bc97709c2d0afd34d03af74a20a8eb93",
  "disposition": "REFUSE_RELIANCE",
  "decision_authority": "NONE",
  "sources": [
    {
      "record_id": "VXI-EXT-PROCUREMENT-CLOUDFLARE-LOGPUSH-01-v1",
      "content_sha256": "6108e7baeeeeffb84770876bd0ff3e401a10df83edc1e6124aaf5138550fe973",
      "source_snapshot_sha256": "c7c7d6732af629186ed5444fa13515a480d7b0c472d6ef4474f24d814acc1949",
      "source_reviewed_on": "2026-10-14",
      "url": "/varexis-index/records/cloudflare-logpush-history-evidence-check.json"
    }
  ],
  "matrix": [
    {
      "invocation": "call-001",
      "principal": "review-agent",
      "tool": "cloudflare_logs",
      "resource": "approved-resource",
      "events": {
        "identity": "event-0",
        "authorization": "event-1",
        "tool_action": "event-2",
        "outcome": "event-3"
      },
      "declared_decision": "allow",
      "declared_outcome": "success",
      "source_record_id": "VXI-EXT-PROCUREMENT-CLOUDFLARE-LOGPUSH-01-v1",
      "actual_records_verified": false
    }
  ],
  "changes": [],
  "findings": [
    {
      "status": "INSUFFICIENT_EVIDENCE",
      "code": "CORRELATION_UNRESOLVED",
      "at": "coverage.correlation_complete",
      "requirement": "Document how invocation IDs correlate identity, authority, action and outcome.",
      "source_record_id": "VXI-EXT-PROCUREMENT-CLOUDFLARE-LOGPUSH-01-v1",
      "basis": "VAREXIS_DECLARED_REVIEW_POLICY"
    },
    {
      "status": "INSUFFICIENT_EVIDENCE",
      "code": "CAPTURE_GAP",
      "at": "coverage.gaps",
      "requirement": "Declared capture gaps intersect the requested interval.",
      "source_record_id": "VXI-EXT-PROCUREMENT-CLOUDFLARE-LOGPUSH-01-v1",
      "basis": "VAREXIS_DECLARED_REVIEW_POLICY"
    },
    {
      "status": "INSUFFICIENT_EVIDENCE",
      "code": "MISSING_RECOVERY",
      "at": "coverage.recovery_ref",
      "requirement": "Supply a non-secret recovery artifact reference with hash and capture date; references are not opened or verified.",
      "source_record_id": "VXI-EXT-PROCUREMENT-CLOUDFLARE-LOGPUSH-01-v1",
      "basis": "VAREXIS_DECLARED_REVIEW_POLICY"
    },
    {
      "status": "REFUSE_RELIANCE",
      "code": "EVENT_BINDING_CONFLICT",
      "at": "event-2",
      "requirement": "Resolve conflicting principal/tool/resource identifiers before relying on the inventory.",
      "source_record_id": "VXI-EXT-PROCUREMENT-CLOUDFLARE-LOGPUSH-01-v1",
      "basis": "VAREXIS_DECLARED_REVIEW_POLICY"
    },
    {
      "status": "REFUSE_RELIANCE",
      "code": "CAUSAL_REFERENCE_CONFLICT",
      "at": "event-3",
      "requirement": "Link the event to the matching earlier-or-same-day declared parent; day precision cannot establish within-day ordering.",
      "source_record_id": "VXI-EXT-PROCUREMENT-CLOUDFLARE-LOGPUSH-01-v1",
      "basis": "VAREXIS_DECLARED_REVIEW_POLICY"
    },
    {
      "status": "INSUFFICIENT_EVIDENCE",
      "code": "MISSING_PARENT_EVENT",
      "at": "event-3",
      "requirement": "Supply the parent event referenced by this declaration.",
      "source_record_id": "VXI-EXT-PROCUREMENT-CLOUDFLARE-LOGPUSH-01-v1",
      "basis": "VAREXIS_DECLARED_REVIEW_POLICY"
    }
  ],
  "verification": {
    "customer_artifacts_opened": false,
    "live_permissions_inspected": false,
    "runtime_enforced": false,
    "vendor_behavior_tested": false,
    "compliance_certified": false
  },
  "boundary": "Checks only supplied declarations against VAREXIS-authored rules and dated documentation bindings. A complete declaration does not prove files exist, grants are effective, events happened, sources remain current or deployment is safe. No legal or security advice.",
  "result_sha256": "0339fc36cc443b91bf81feaf57ec6203343eef845106cd18dd6acda92e8a47d4"
}