{
  "tool_id": "art-304-aiuc1-evidence-pack-assembler",
  "note": "golden_hash empty until first `node golden-parity.test.mjs --update`.",
  "vectors": [
    {
      "name": "full-receipt-backed-pack-oscal-golden",
      "description": "All mapped controls fully resolved to artifacts; OSCAL export + cadence attestation.",
      "policy_parameters": {
        "aiuc1_version": "2026-Q1",
        "artifacts": {
          "receipts": [
            {
              "id": "r1",
              "digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
            },
            {
              "id": "r2",
              "digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
            }
          ],
          "escalation_closures": [
            {
              "id": "e1",
              "digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
            }
          ],
          "mandates": [
            {
              "id": "m1",
              "digest": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
            }
          ]
        },
        "control_mapping": [
          {
            "control_id": "AIUC-A-01",
            "artifact_refs": [
              "r1"
            ]
          },
          {
            "control_id": "AIUC-B-01",
            "artifact_refs": [
              "r2",
              "e1"
            ]
          },
          {
            "control_id": "AIUC-E-01",
            "artifact_refs": [
              "m1"
            ]
          }
        ],
        "cadence_attestation_input": {
          "max_gap_days_by_control": [
            {
              "control_id": "AIUC-A-01",
              "max_gap_days": 45
            }
          ]
        }
      },
      "output_payload": {
        "aiuc1_version": "2026-Q1",
        "version_mismatch": false,
        "controls": [
          {
            "control_id": "AIUC-A-01",
            "status": "receipt-backed",
            "artifact_digests": [
              "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
            ],
            "claim_strength": "receipt-backed"
          },
          {
            "control_id": "AIUC-B-01",
            "status": "receipt-backed",
            "artifact_digests": [
              "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
              "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
            ],
            "claim_strength": "receipt-backed"
          },
          {
            "control_id": "AIUC-E-01",
            "status": "receipt-backed",
            "artifact_digests": [
              "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
            ],
            "claim_strength": "receipt-backed"
          }
        ],
        "pack_claim_strength": "receipt-backed",
        "oscal_assessment_results": {
          "_source_citation": "arXiv:2604.13767 AI-evidence property-extension mapping (Apache-2.0 reference implementation); documented mapping only, not a runtime dependency.",
          "type": "oscal-assessment-results",
          "aiuc1_version": "2026-Q1",
          "results": [
            {
              "control_id": "AIUC-A-01",
              "state": "satisfied"
            },
            {
              "control_id": "AIUC-B-01",
              "state": "satisfied"
            },
            {
              "control_id": "AIUC-E-01",
              "state": "satisfied"
            }
          ]
        },
        "cadence_attestation": {
          "period_days": 90,
          "rows": [
            {
              "control_id": "AIUC-A-01",
              "max_gap_days": 45,
              "within_cadence": true
            }
          ],
          "all_within_cadence": true
        },
        "anchor": null,
        "insufficient_evidence": false
      },
      "golden_hash": "6dc36ff96075fde1830bbea4ecbe3bb7896a268e423b68c5354eb72203d18fef"
    },
    {
      "name": "mixed-strength-pack",
      "description": "One control fully resolved, one partially resolved (attestation-only).",
      "policy_parameters": {
        "aiuc1_version": "2026-Q1",
        "artifacts": {
          "receipts": [
            {
              "id": "r1",
              "digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
            },
            {
              "id": "r2",
              "digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
            }
          ],
          "escalation_closures": [
            {
              "id": "e1",
              "digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
            }
          ],
          "mandates": [
            {
              "id": "m1",
              "digest": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
            }
          ]
        },
        "control_mapping": [
          {
            "control_id": "AIUC-A-01",
            "artifact_refs": [
              "r1"
            ]
          },
          {
            "control_id": "AIUC-B-01",
            "artifact_refs": [
              "r2",
              "unknown-ref"
            ]
          }
        ]
      },
      "output_payload": {
        "aiuc1_version": "2026-Q1",
        "version_mismatch": false,
        "controls": [
          {
            "control_id": "AIUC-A-01",
            "status": "receipt-backed",
            "artifact_digests": [
              "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
            ],
            "claim_strength": "receipt-backed"
          },
          {
            "control_id": "AIUC-B-01",
            "status": "attestation-only",
            "artifact_digests": [
              "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
            ],
            "claim_strength": "attestation-only"
          }
        ],
        "pack_claim_strength": "attestation-only",
        "oscal_assessment_results": {
          "_source_citation": "arXiv:2604.13767 AI-evidence property-extension mapping (Apache-2.0 reference implementation); documented mapping only, not a runtime dependency.",
          "type": "oscal-assessment-results",
          "aiuc1_version": "2026-Q1",
          "results": [
            {
              "control_id": "AIUC-A-01",
              "state": "satisfied"
            },
            {
              "control_id": "AIUC-B-01",
              "state": "not-satisfied"
            }
          ]
        },
        "cadence_attestation": null,
        "anchor": null,
        "insufficient_evidence": false
      },
      "golden_hash": "134f6d99e745548e51710eb3f0d79b98be314c8c06588cdda66ce94fc4e5aad5"
    },
    {
      "name": "empty-insufficient",
      "description": "No control_mapping; insufficient evidence.",
      "policy_parameters": {
        "aiuc1_version": "2026-Q1",
        "artifacts": {
          "receipts": [],
          "escalation_closures": [],
          "mandates": []
        },
        "control_mapping": []
      },
      "output_payload": {
        "aiuc1_version": "2026-Q1",
        "version_mismatch": false,
        "controls": [],
        "pack_claim_strength": "insufficient",
        "oscal_assessment_results": null,
        "cadence_attestation": null,
        "anchor": null,
        "insufficient_evidence": true
      },
      "golden_hash": "5f1da275294e20572bae6f88aa2faad5742e697ec8190618facced75b4ea80bd"
    }
  ]
}