{
  "tool_id": "art-409-dpa-art28-completeness-checker",
  "note": "golden_hash computed directly via executionHash at fixture-authoring time. Present/absent/partial Art-28 element cases.",
  "vectors": [
    {
      "name": "all-clauses-present",
      "description": "All 12 Article 28(3) elements declared present -- ART28_COMPLETE.",
      "policy_parameters": {
        "clause_status": {
          "subject_matter": "present",
          "duration": "present",
          "nature_purpose": "present",
          "data_categories": "present",
          "controller_instructions_only": "present",
          "confidentiality": "present",
          "article32_security": "present",
          "subprocessor_authorization": "present",
          "data_subject_rights_assistance": "present",
          "breach_dpia_assistance": "present",
          "deletion_or_return": "present",
          "audit_rights": "present"
        }
      },
      "output_payload": {
        "verdict": "ART28_COMPLETE",
        "art28_complete": true,
        "coverage_pct": 100,
        "present_count": 12,
        "weak_count": 0,
        "missing_count": 0,
        "total_elements": 12,
        "clauses": [
          {
            "id": "subject_matter",
            "label": "Subject-matter of the processing",
            "status": "present"
          },
          {
            "id": "duration",
            "label": "Duration of the processing",
            "status": "present"
          },
          {
            "id": "nature_purpose",
            "label": "Nature and purpose of the processing",
            "status": "present"
          },
          {
            "id": "data_categories",
            "label": "Type of personal data and categories of data subjects",
            "status": "present"
          },
          {
            "id": "controller_instructions_only",
            "label": "Processing only on documented controller instructions",
            "status": "present"
          },
          {
            "id": "confidentiality",
            "label": "Confidentiality commitment for authorised persons",
            "status": "present"
          },
          {
            "id": "article32_security",
            "label": "Article 32 security measures",
            "status": "present"
          },
          {
            "id": "subprocessor_authorization",
            "label": "Sub-processor authorization (general or specific) + flow-down obligations",
            "status": "present"
          },
          {
            "id": "data_subject_rights_assistance",
            "label": "Assistance with data-subject-rights requests",
            "status": "present"
          },
          {
            "id": "breach_dpia_assistance",
            "label": "Assistance with Article 32-36 breach notification and DPIA",
            "status": "present"
          },
          {
            "id": "deletion_or_return",
            "label": "Deletion or return of personal data at end of processing",
            "status": "present"
          },
          {
            "id": "audit_rights",
            "label": "Information availability and audit/inspection rights",
            "status": "present"
          }
        ],
        "missing_clause_ids": [],
        "weak_clause_ids": [],
        "not_legal_advice": true,
        "disclosure": "This is a compliance reading over the text the caller supplied, not legal advice and not a determination that any agreement is compliant."
      },
      "compliance_flags": [
        "DPA_ART28_COMPLETE"
      ],
      "golden_hash": "b986ba4709524f247ed830dd8dcf7c72b16a459bc287e8f62e4a45ff8858ee58"
    },
    {
      "name": "all-clauses-missing",
      "description": "No clause_status declared -- every element defaults to missing -- ART28_INCOMPLETE_MISSING_CLAUSES.",
      "policy_parameters": {
        "clause_status": {}
      },
      "output_payload": {
        "verdict": "ART28_INCOMPLETE_MISSING_CLAUSES",
        "art28_complete": false,
        "coverage_pct": 0,
        "present_count": 0,
        "weak_count": 0,
        "missing_count": 12,
        "total_elements": 12,
        "clauses": [
          {
            "id": "subject_matter",
            "label": "Subject-matter of the processing",
            "status": "missing"
          },
          {
            "id": "duration",
            "label": "Duration of the processing",
            "status": "missing"
          },
          {
            "id": "nature_purpose",
            "label": "Nature and purpose of the processing",
            "status": "missing"
          },
          {
            "id": "data_categories",
            "label": "Type of personal data and categories of data subjects",
            "status": "missing"
          },
          {
            "id": "controller_instructions_only",
            "label": "Processing only on documented controller instructions",
            "status": "missing"
          },
          {
            "id": "confidentiality",
            "label": "Confidentiality commitment for authorised persons",
            "status": "missing"
          },
          {
            "id": "article32_security",
            "label": "Article 32 security measures",
            "status": "missing"
          },
          {
            "id": "subprocessor_authorization",
            "label": "Sub-processor authorization (general or specific) + flow-down obligations",
            "status": "missing"
          },
          {
            "id": "data_subject_rights_assistance",
            "label": "Assistance with data-subject-rights requests",
            "status": "missing"
          },
          {
            "id": "breach_dpia_assistance",
            "label": "Assistance with Article 32-36 breach notification and DPIA",
            "status": "missing"
          },
          {
            "id": "deletion_or_return",
            "label": "Deletion or return of personal data at end of processing",
            "status": "missing"
          },
          {
            "id": "audit_rights",
            "label": "Information availability and audit/inspection rights",
            "status": "missing"
          }
        ],
        "missing_clause_ids": [
          "subject_matter",
          "duration",
          "nature_purpose",
          "data_categories",
          "controller_instructions_only",
          "confidentiality",
          "article32_security",
          "subprocessor_authorization",
          "data_subject_rights_assistance",
          "breach_dpia_assistance",
          "deletion_or_return",
          "audit_rights"
        ],
        "weak_clause_ids": [],
        "not_legal_advice": true,
        "disclosure": "This is a compliance reading over the text the caller supplied, not legal advice and not a determination that any agreement is compliant."
      },
      "compliance_flags": [
        "DPA_ART28_GAPS_FOUND",
        "DPA_MISSING_MANDATORY_CLAUSE"
      ],
      "golden_hash": "92b95a30b420223c20dd071ff3898fbf66c08fd32e9a39814de3692bea12bc08"
    },
    {
      "name": "partial-mixed-missing-and-weak",
      "description": "Mix of present, missing, and weak-language elements -- ART28_INCOMPLETE_MISSING_CLAUSES (missing takes precedence over weak in the verdict).",
      "policy_parameters": {
        "clause_status": {
          "subject_matter": "present",
          "duration": "present",
          "nature_purpose": "present",
          "data_categories": "present",
          "controller_instructions_only": "present",
          "confidentiality": "weak",
          "article32_security": "present",
          "subprocessor_authorization": "missing",
          "data_subject_rights_assistance": "present",
          "breach_dpia_assistance": "weak",
          "deletion_or_return": "present",
          "audit_rights": "missing"
        }
      },
      "output_payload": {
        "verdict": "ART28_INCOMPLETE_MISSING_CLAUSES",
        "art28_complete": false,
        "coverage_pct": 66.67,
        "present_count": 8,
        "weak_count": 2,
        "missing_count": 2,
        "total_elements": 12,
        "clauses": [
          {
            "id": "subject_matter",
            "label": "Subject-matter of the processing",
            "status": "present"
          },
          {
            "id": "duration",
            "label": "Duration of the processing",
            "status": "present"
          },
          {
            "id": "nature_purpose",
            "label": "Nature and purpose of the processing",
            "status": "present"
          },
          {
            "id": "data_categories",
            "label": "Type of personal data and categories of data subjects",
            "status": "present"
          },
          {
            "id": "controller_instructions_only",
            "label": "Processing only on documented controller instructions",
            "status": "present"
          },
          {
            "id": "confidentiality",
            "label": "Confidentiality commitment for authorised persons",
            "status": "weak"
          },
          {
            "id": "article32_security",
            "label": "Article 32 security measures",
            "status": "present"
          },
          {
            "id": "subprocessor_authorization",
            "label": "Sub-processor authorization (general or specific) + flow-down obligations",
            "status": "missing"
          },
          {
            "id": "data_subject_rights_assistance",
            "label": "Assistance with data-subject-rights requests",
            "status": "present"
          },
          {
            "id": "breach_dpia_assistance",
            "label": "Assistance with Article 32-36 breach notification and DPIA",
            "status": "weak"
          },
          {
            "id": "deletion_or_return",
            "label": "Deletion or return of personal data at end of processing",
            "status": "present"
          },
          {
            "id": "audit_rights",
            "label": "Information availability and audit/inspection rights",
            "status": "missing"
          }
        ],
        "missing_clause_ids": [
          "subprocessor_authorization",
          "audit_rights"
        ],
        "weak_clause_ids": [
          "confidentiality",
          "breach_dpia_assistance"
        ],
        "not_legal_advice": true,
        "disclosure": "This is a compliance reading over the text the caller supplied, not legal advice and not a determination that any agreement is compliant."
      },
      "compliance_flags": [
        "DPA_ART28_GAPS_FOUND",
        "DPA_MISSING_MANDATORY_CLAUSE",
        "DPA_WEAK_CLAUSE_LANGUAGE"
      ],
      "golden_hash": "298ef4b93a95a0f12599a6614ea1d10ca8be50c2ef74f9ed28013060e86f9ce8"
    },
    {
      "name": "weak-only-boundary",
      "description": "Every element declared weak (none missing, none present) -- ART28_INCOMPLETE_WEAK_CLAUSES, the boundary case between complete and missing-driven incomplete.",
      "policy_parameters": {
        "clause_status": {
          "subject_matter": "weak",
          "duration": "weak",
          "nature_purpose": "weak",
          "data_categories": "weak",
          "controller_instructions_only": "weak",
          "confidentiality": "weak",
          "article32_security": "weak",
          "subprocessor_authorization": "weak",
          "data_subject_rights_assistance": "weak",
          "breach_dpia_assistance": "weak",
          "deletion_or_return": "weak",
          "audit_rights": "weak"
        }
      },
      "output_payload": {
        "verdict": "ART28_INCOMPLETE_WEAK_CLAUSES",
        "art28_complete": false,
        "coverage_pct": 0,
        "present_count": 0,
        "weak_count": 12,
        "missing_count": 0,
        "total_elements": 12,
        "clauses": [
          {
            "id": "subject_matter",
            "label": "Subject-matter of the processing",
            "status": "weak"
          },
          {
            "id": "duration",
            "label": "Duration of the processing",
            "status": "weak"
          },
          {
            "id": "nature_purpose",
            "label": "Nature and purpose of the processing",
            "status": "weak"
          },
          {
            "id": "data_categories",
            "label": "Type of personal data and categories of data subjects",
            "status": "weak"
          },
          {
            "id": "controller_instructions_only",
            "label": "Processing only on documented controller instructions",
            "status": "weak"
          },
          {
            "id": "confidentiality",
            "label": "Confidentiality commitment for authorised persons",
            "status": "weak"
          },
          {
            "id": "article32_security",
            "label": "Article 32 security measures",
            "status": "weak"
          },
          {
            "id": "subprocessor_authorization",
            "label": "Sub-processor authorization (general or specific) + flow-down obligations",
            "status": "weak"
          },
          {
            "id": "data_subject_rights_assistance",
            "label": "Assistance with data-subject-rights requests",
            "status": "weak"
          },
          {
            "id": "breach_dpia_assistance",
            "label": "Assistance with Article 32-36 breach notification and DPIA",
            "status": "weak"
          },
          {
            "id": "deletion_or_return",
            "label": "Deletion or return of personal data at end of processing",
            "status": "weak"
          },
          {
            "id": "audit_rights",
            "label": "Information availability and audit/inspection rights",
            "status": "weak"
          }
        ],
        "missing_clause_ids": [],
        "weak_clause_ids": [
          "subject_matter",
          "duration",
          "nature_purpose",
          "data_categories",
          "controller_instructions_only",
          "confidentiality",
          "article32_security",
          "subprocessor_authorization",
          "data_subject_rights_assistance",
          "breach_dpia_assistance",
          "deletion_or_return",
          "audit_rights"
        ],
        "not_legal_advice": true,
        "disclosure": "This is a compliance reading over the text the caller supplied, not legal advice and not a determination that any agreement is compliant."
      },
      "compliance_flags": [
        "DPA_ART28_GAPS_FOUND",
        "DPA_WEAK_CLAUSE_LANGUAGE"
      ],
      "golden_hash": "d8b9bf70db140c5113216ad9dcc7868d01b6374654ada63ae6ee6732b89cb374"
    }
  ]
}