{
    "schema": "clariodb-trust-report",
    "version": 1,
    "report_id": "7bb2c877ba223d7e73a553d0fa572d4b",
    "scope": "public",
    "generated_at": "2026-08-28T06:27:18Z",
    "freshness": "current_request",
    "counts": {
        "confirmed": 4,
        "review": 1,
        "critical": 0,
        "unknown": 0,
        "not_applicable": 0,
        "not_covered": 2
    },
    "checks": [
        {
            "id": "AUD-PUB-DEPLOY-001",
            "state": "confirmed",
            "severity": "attention",
            "titleFr": "Intégrité de la version publiée",
            "titleEn": "Published version integrity",
            "summaryFr": "Les deux jeux de condensats sont conformes.",
            "summaryEn": "Both checksum sets are valid.",
            "evidence": {
                "manifest": {
                    "ok": 563,
                    "total": 563
                },
                "delivery": {
                    "ok": 564,
                    "total": 564
                }
            }
        },
        {
            "id": "AUD-PUB-AGENT-001",
            "state": "confirmed",
            "severity": "info",
            "titleFr": "Agent épinglé et réponses signées",
            "titleEn": "Pinned Agent and signed responses",
            "summaryFr": "Le protocole livré prend en charge l’identité épinglée, l’anti-rejeu et les attestations signées.",
            "summaryEn": "The shipped protocol supports pinned identity, anti-replay and signed attestations.",
            "evidence": []
        },
        {
            "id": "AUD-PUB-RETRY-001",
            "state": "confirmed",
            "severity": "info",
            "titleFr": "Aucun retry aveugle après mutation ambiguë",
            "titleEn": "No blind retry after ambiguous mutation",
            "summaryFr": "Les chemins de mutation classent les issues ambiguës et interdisent le rejeu automatique.",
            "summaryEn": "Mutation paths classify ambiguous outcomes and prevent automatic replay.",
            "evidence": []
        },
        {
            "id": "AUD-PUB-ATTEST-001",
            "state": "not_covered",
            "severity": "info",
            "titleFr": "Signature de l’attestation publique",
            "titleEn": "Public attestation signature",
            "summaryFr": "La signature Ed25519 publique n’est pas encore configurée ; le rapport expose uniquement son SHA-256.",
            "summaryEn": "Public Ed25519 signing is not configured yet; the report exposes only its SHA-256.",
            "evidence": {
                "state": "not_configured",
                "public_key_base64": null
            }
        },
        {
            "id": "AUD-PUB-CERT-001",
            "state": "not_covered",
            "severity": "info",
            "titleFr": "Certifications externes",
            "titleEn": "External certifications",
            "summaryFr": "Aucune certification CSA STAR, ISO/IEC 27001, SOC 2/SOC 3 ou OWASP n’est revendiquée à ce jour.",
            "summaryEn": "No CSA STAR, ISO/IEC 27001, SOC 2/SOC 3 or OWASP certification is currently claimed.",
            "evidence": []
        },
        {
            "id": "AUD-PUB-SESSION-001",
            "state": "confirmed",
            "severity": "info",
            "titleFr": "Secrets temporaires isolés de la session PHP",
            "titleEn": "Temporary secrets isolated from the PHP session",
            "summaryFr": "Le navigateur ne reçoit qu’un identifiant de session opaque et la session PHP ne conserve qu’un handle opaque. Les clés dérivées et identifiants actifs sont chiffrés séparément dans le runtime privé, bornés dans le temps et supprimés à la déconnexion.",
            "summaryEn": "The browser receives only an opaque session identifier and the PHP session retains only an opaque handle. Derived keys and active credentials are encrypted separately in private runtime storage, time-bounded, and removed on logout.",
            "evidence": {
                "browser_cookie_contains": "opaque_session_id_only",
                "php_session_contains": "opaque_secret_state_handle_only",
                "encrypted_runtime_contains": [
                    "derived_vault_key",
                    "active_connection_credentials"
                ],
                "encryption": "libsodium_secretbox"
            }
        },
        {
            "id": "AUD-PUB-RESTORE-001",
            "state": "review",
            "severity": "attention",
            "titleFr": "Restauration",
            "titleEn": "Restoration",
            "summaryFr": "ClarioDB fournit une restauration additive asynchrone avec vérification terminale. En Direct, les archives protégées récentes peuvent reprendre depuis un checkpoint atomique ; les issues Agent ambiguës ne sont jamais rejouées. Le remplacement destructif et les tests périodiques automatiques restent non couverts.",
            "summaryEn": "ClarioDB provides asynchronous additive restoration with terminal verification. For Direct connections, recent protected archives can resume from an atomic checkpoint; ambiguous Agent outcomes are never replayed. Destructive replacement and automatic periodic restore tests remain uncovered.",
            "evidence": {
                "coverage": "additive_async_checkpointed"
            }
        }
    ],
    "meta": {
        "version": "0.9.62",
        "certification_guide": ".docs/CERTIFICATIONS-SECURITE-ET-TRANSPARENCE-0.9.44.html"
    },
    "sha256": "sha256:3f981785cb8a65aaab1e5e78f1753d9151cce97b5404f76c894c9d6ebc7ab3c0",
    "attestation": {
        "state": "not_configured",
        "algorithm": "Ed25519",
        "signed_field": "sha256"
    }
}