{
  "schema": "varexis-declared-evidence-result/1",
  "profile": "admission",
  "policy_id": "synthetic-review-policy",
  "evaluated_on": "2026-10-16",
  "date_basis": "Caller-supplied date",
  "manifest_sha256": "c8c43e58a526681ba83ec58d170c579af97c5ba3bebfb5235666d481641c5f8f",
  "input_sha256": "76250e2f89569c1873a7fecef5aa5ae4c7d09ed0e345cb52f643130e27adc5b5",
  "disposition": "REFUSE_RELIANCE",
  "decision_authority": "NONE",
  "sources": [
    {
      "record_id": "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1",
      "content_sha256": "31bcff69fce09710d75d7f21be3bd97d7e5e3b4f9f3a44d8903e1e3b4b549c72",
      "source_snapshot_sha256": "efb07a282354db948fa9d9d3c36b24633824c2c821e748792793c14c4669e526",
      "source_reviewed_on": "2026-10-11",
      "url": "/varexis-index/records/playwright-mcp-browser-session-trust.json"
    },
    {
      "record_id": "VXI-EXT-TOOL-TRUST-GITHUB-01-v1",
      "content_sha256": "572335e5f6d8f99afe3760a11daf78adbf89833501909166782351350be027f8",
      "source_snapshot_sha256": "efb07a282354db948fa9d9d3c36b24633824c2c821e748792793c14c4669e526",
      "source_reviewed_on": "2026-10-11",
      "url": "/varexis-index/records/github-mcp-repository-access-trust.json"
    }
  ],
  "matrix": [
    {
      "connector": "browser",
      "tool": "playwright_mcp",
      "principal": "agent-review",
      "authentication": "browser_session",
      "requested": [
        {
          "action": "read",
          "resource": "docs-alpha",
          "recipient": "local-agent"
        }
      ],
      "declared": [
        {
          "action": "read",
          "resource": "docs-alpha",
          "recipient": "local-agent"
        }
      ],
      "authorized": [
        {
          "action": "read",
          "resource": "docs-alpha",
          "recipient": "local-agent"
        }
      ],
      "source_record_id": "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1",
      "effective_permissions_verified": false
    },
    {
      "connector": "repo",
      "tool": "github_mcp",
      "principal": "agent-review",
      "authentication": "oauth",
      "requested": [
        {
          "action": "read",
          "resource": "repo-alpha",
          "recipient": "local-agent"
        },
        {
          "action": "write",
          "resource": "repo-beta",
          "recipient": "external-recipient"
        }
      ],
      "declared": [
        {
          "action": "read",
          "resource": "repo-alpha",
          "recipient": "local-agent"
        },
        {
          "action": "write",
          "resource": "repo-beta",
          "recipient": "external-recipient"
        }
      ],
      "authorized": [
        {
          "action": "read",
          "resource": "repo-alpha",
          "recipient": "local-agent"
        }
      ],
      "source_record_id": "VXI-EXT-TOOL-TRUST-GITHUB-01-v1",
      "effective_permissions_verified": false
    }
  ],
  "changes": [
    {
      "connector": "browser",
      "kind": "added_capability",
      "capability": {
        "action": "read",
        "resource": "docs-alpha",
        "recipient": "local-agent"
      }
    },
    {
      "connector": "repo",
      "kind": "added_capability",
      "capability": {
        "action": "write",
        "resource": "repo-beta",
        "recipient": "external-recipient"
      }
    }
  ],
  "findings": [
    {
      "status": "REFUSE_RELIANCE",
      "code": "AUTHORITY_EXPIRED",
      "at": "repo",
      "requirement": "Obtain a current owner authority declaration before relying on this plan.",
      "source_record_id": "VXI-EXT-TOOL-TRUST-GITHUB-01-v1",
      "basis": "VAREXIS_DECLARED_REVIEW_POLICY"
    },
    {
      "status": "REQUIRE_REVIEW",
      "code": "EXCESS_DECLARED_AUTHORITY",
      "at": "repo",
      "requirement": "Narrow or explicitly authorize this additional action/resource/recipient tuple.",
      "source_record_id": "VXI-EXT-TOOL-TRUST-GITHUB-01-v1",
      "basis": "VAREXIS_DECLARED_REVIEW_POLICY"
    },
    {
      "status": "INSUFFICIENT_EVIDENCE",
      "code": "MISSING_IDENTITY",
      "at": "repo.identity_ref",
      "requirement": "Supply a non-secret identity artifact reference with hash and capture date; references are not opened or verified.",
      "source_record_id": "VXI-EXT-TOOL-TRUST-GITHUB-01-v1",
      "basis": "VAREXIS_DECLARED_REVIEW_POLICY"
    },
    {
      "status": "REFUSE_RELIANCE",
      "code": "REQUEST_OUTSIDE_AUTHORITY",
      "at": "repo.repo-beta.write",
      "requirement": "The exact action, resource and recipient must appear in the owner-authorized declaration.",
      "source_record_id": "VXI-EXT-TOOL-TRUST-GITHUB-01-v1",
      "basis": "VAREXIS_DECLARED_REVIEW_POLICY"
    }
  ],
  "verification": {
    "customer_artifacts_opened": false,
    "live_permissions_inspected": false,
    "runtime_enforced": false,
    "vendor_behavior_tested": false,
    "compliance_certified": false
  },
  "boundary": "Checks only supplied declarations against VAREXIS-authored rules and dated documentation bindings. A complete declaration does not prove files exist, grants are effective, events happened, sources remain current or deployment is safe. No legal or security advice.",
  "result_sha256": "3471f99a06655e0efd7808874161a93ba74f860eaf0ca7d3634f4ce6fed98f67"
}