{
  "tool_id": "art-359-idv-session-receipt-builder",
  "note": "IDV/KYC session evidence receipt builder (IS-1). Vector 1: clean asserted pass. Vector 2: injection-detected + liveness-failed, still receipted. Vector 3: PII-shaped input rejected by validator.",
  "vectors": [
    {
      "name": "pass_clean_session",
      "description": "Complete session metadata, injection-detection clear, liveness passed, document check passed -- clean session receipt, all asserted fields present.",
      "policy_parameters": {
        "session_id": "sess-2026-0001",
        "verifier_id": "vendor-alpha-idv",
        "verifier_version": "3.2.1",
        "timestamp": "2026-07-18T09:00:00Z",
        "capture_chain": {
          "manifest_digest": "sha256:aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa1"
        },
        "injection_detection": {
          "vendor": "DetectCo",
          "vendor_version": "1.4.0",
          "verdict": false,
          "confidence": 0.97
        },
        "liveness": {
          "method": "active-challenge",
          "verdict": true,
          "score": 0.94
        },
        "document_check": {
          "digest": "sha256:bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb2",
          "verdict": true
        },
        "device_signal": {
          "summary": "consistent-device-fingerprint",
          "risk_score": 0.05
        }
      },
      "output_payload": {
        "rejected": false,
        "session": {
          "session_id": "sess-2026-0001",
          "verifier_id": "vendor-alpha-idv",
          "verifier_version": "3.2.1",
          "timestamp": "2026-07-18T09:00:00Z",
          "capture_chain": {
            "manifest_present": true,
            "manifest_digest": "sha256:aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa1",
            "label": "asserted"
          },
          "injection_detection": {
            "vendor": "DetectCo",
            "vendor_version": "1.4.0",
            "verdict": false,
            "confidence": 0.97,
            "label": "asserted"
          },
          "liveness": {
            "method": "active-challenge",
            "verdict": true,
            "score": 0.94,
            "label": "asserted"
          },
          "document_check": {
            "digest": "sha256:bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb2",
            "verdict": true,
            "label": "asserted"
          },
          "device_signal": {
            "summary": "consistent-device-fingerprint",
            "risk_score": 0.05,
            "label": "asserted"
          }
        },
        "session_complete": true,
        "missing_fields": [],
        "session_receipt": {
          "prior_attempt_hash": "sess-2026-0001",
          "receipt_hash": "daa28884d5033cc20ebcc39329d291fef0bc766b00da62e5b50c34f607c65050"
        },
        "note": "Hash-chained IDV/KYC session evidence receipt. Attests the session record AS DECLARED by the verifier -- not detection quality, not subject genuineness. All verifier-sourced fields are labeled \"asserted\". Zero PII: digests/booleans/scores only, raw-data-shaped inputs are rejected."
      },
      "golden_hash": "30198f13494273b92e76886b5d7f65dc193ea99f622bcc95a4e690c2db8db5f5"
    },
    {
      "name": "fail_injection_detected",
      "description": "Injection-detection flags a virtual-camera injection and liveness fails -- session receipt still built (attests the record as declared, including a failing verdict), flags surface the failure.",
      "policy_parameters": {
        "session_id": "sess-2026-0002",
        "verifier_id": "vendor-alpha-idv",
        "verifier_version": "3.2.1",
        "timestamp": "2026-07-18T09:05:00Z",
        "capture_chain": {
          "manifest_digest": null
        },
        "injection_detection": {
          "vendor": "DetectCo",
          "vendor_version": "1.4.0",
          "verdict": true,
          "confidence": 0.88
        },
        "liveness": {
          "method": "active-challenge",
          "verdict": false,
          "score": 0.31
        },
        "document_check": {
          "digest": "sha256:cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc3",
          "verdict": false
        },
        "device_signal": {
          "summary": "emulator-signature-detected",
          "risk_score": 0.91
        }
      },
      "output_payload": {
        "rejected": false,
        "session": {
          "session_id": "sess-2026-0002",
          "verifier_id": "vendor-alpha-idv",
          "verifier_version": "3.2.1",
          "timestamp": "2026-07-18T09:05:00Z",
          "capture_chain": {
            "manifest_present": false,
            "manifest_digest": null,
            "label": "asserted"
          },
          "injection_detection": {
            "vendor": "DetectCo",
            "vendor_version": "1.4.0",
            "verdict": true,
            "confidence": 0.88,
            "label": "asserted"
          },
          "liveness": {
            "method": "active-challenge",
            "verdict": false,
            "score": 0.31,
            "label": "asserted"
          },
          "document_check": {
            "digest": "sha256:cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc3",
            "verdict": false,
            "label": "asserted"
          },
          "device_signal": {
            "summary": "emulator-signature-detected",
            "risk_score": 0.91,
            "label": "asserted"
          }
        },
        "session_complete": true,
        "missing_fields": [],
        "session_receipt": {
          "prior_attempt_hash": "sess-2026-0002",
          "receipt_hash": "08bb627aa4b970f8b19e9153f363a61634b6bf334b5bbd38cc7a4e7b014e3b0d"
        },
        "note": "Hash-chained IDV/KYC session evidence receipt. Attests the session record AS DECLARED by the verifier -- not detection quality, not subject genuineness. All verifier-sourced fields are labeled \"asserted\". Zero PII: digests/booleans/scores only, raw-data-shaped inputs are rejected."
      },
      "golden_hash": "b20056da5cbf3bb59b5c003178a626670bff32f3f46ad4af2cbba28eb6a797db"
    },
    {
      "name": "rejected_pii_shaped_input",
      "description": "Caller supplies a raw-data-shaped field (document_image) instead of a digest -- validator rejects the input before compute, zero PII ever enters the payload.",
      "policy_parameters": {
        "session_id": "sess-2026-0003",
        "verifier_id": "vendor-alpha-idv",
        "verifier_version": "3.2.1",
        "timestamp": "2026-07-18T09:10:00Z",
        "document_image": "base64-would-go-here-this-is-raw-capture-data-not-a-digest",
        "capture_chain": {
          "manifest_digest": "sha256:dd44dd44dd44dd44dd44dd44dd44dd44dd44dd44dd44dd44dd44dd44dd44dd4"
        },
        "injection_detection": {
          "vendor": "DetectCo",
          "vendor_version": "1.4.0",
          "verdict": false,
          "confidence": 0.9
        },
        "liveness": {
          "method": "active-challenge",
          "verdict": true,
          "score": 0.9
        },
        "document_check": {
          "digest": "sha256:ee55ee55ee55ee55ee55ee55ee55ee55ee55ee55ee55ee55ee55ee55ee55ee5",
          "verdict": true
        },
        "device_signal": {
          "summary": "consistent-device-fingerprint",
          "risk_score": 0.05
        }
      },
      "output_payload": {
        "rejected": true,
        "rejection_reason": "raw-data-shaped input on PII-risk field(s), not a digest/boolean/score",
        "pii_violations": [
          "document_image"
        ],
        "session": null
      },
      "golden_hash": "076d12967ae3fd8d5b50423e902fdbad470fd44dd75c7ddae2f8a85164a40665"
    }
  ]
}