{
  "tool_id": "art-467-dora-incident-classifier",
  "note": "Vectors computed directly from the shipped kernel. non-major-clean has no qualifying criteria and no reporting clock; major-incident-with-clock exercises the MAJOR branch with a full initial/intermediate/final reporting clock; major-incident-no-timestamp exercises the MAJOR branch when classification_at is missing (reporting_clock stays null, empty-input-adjacent finite path).",
  "vectors": [
    {
      "name": "non-major-clean",
      "description": "All severity dimensions below threshold -- NON_MAJOR verdict, no reporting clock.",
      "policy_parameters": {
        "incident_id": "INC-2026-0100",
        "classification_at": "2026-07-20T09:00:00Z",
        "clients_affected_pct": 2,
        "duration_minutes": 30,
        "geographical_spread_countries_count": 1,
        "data_losses": false,
        "economic_impact_amount": 5000,
        "critical_services_affected": false,
        "reputational_impact": false
      },
      "output_payload": {
        "incident_id": "INC-2026-0100",
        "verdict": "NON_MAJOR",
        "major_incident": false,
        "qualifying_criteria": [],
        "criteria_detail": [
          {
            "criterion_id": "clients_affected",
            "article": "DORA Art. 18(1)(a); RTS (EU) 2024/1772 clients-affected threshold",
            "met": false,
            "value": "2% (threshold >=10%)"
          },
          {
            "criterion_id": "duration",
            "article": "DORA Art. 18(1)(b); RTS (EU) 2024/1772 duration threshold",
            "met": false,
            "value": "30 min (threshold >=1440 min)"
          },
          {
            "criterion_id": "geographical_spread",
            "article": "DORA Art. 18(1)(c); RTS (EU) 2024/1772 geographical-spread threshold",
            "met": false,
            "value": "1 member state(s) (threshold >=2)"
          },
          {
            "criterion_id": "data_losses",
            "article": "DORA Art. 18(1)(d); RTS (EU) 2024/1772 data-losses criterion (confidentiality/integrity/availability impact)",
            "met": false,
            "value": "No data loss reported"
          },
          {
            "criterion_id": "economic_impact",
            "article": "DORA Art. 18(1)(e); RTS (EU) 2024/1772 economic-impact threshold",
            "met": false,
            "value": "EUR 5000 (threshold >=EUR 100000)"
          },
          {
            "criterion_id": "critical_services_affected",
            "article": "DORA Art. 18(1)(f); RTS (EU) 2024/1772 criticality-of-services criterion",
            "met": false,
            "value": "No critical/important function affected"
          },
          {
            "criterion_id": "reputational_impact",
            "article": "DORA Art. 18(1)(g); RTS (EU) 2024/1772 reputational-impact criterion",
            "met": false,
            "value": "No reputational impact reported"
          }
        ],
        "reporting_clock": null,
        "table_version": "DORA-RTS-2024-1772-CLASSIFICATION+ITS-2025-302-TIMELINES-2026-07",
        "table_source": "DORA (EU) 2022/2554 Art. 18 (classification criteria) + Art. 19 (reporting obligations/timelines); Commission Delegated Regulation (EU) 2024/1772 (RTS on classification criteria for major ICT-related incidents and significant cyber threats); Commission Implementing Regulation (EU) 2025/302 (ITS on standard forms/templates and timelines for major-incident reports). Numeric thresholds pinned at MODERATE confidence -- verify against final consolidated RTS/ITS text at legal review before relying on this verdict for an actual filing.",
        "note": "Deterministic DORA (Art. 18) major-incident classification over caller-declared severity dimensions, plus a DORA Art. 19 reporting-clock (initial/intermediate/final) once classified major. See art-428-cyber-incident-clock.kernel.mjs for the analogous US notification-clock pattern. This kernel classifies and computes deadlines only; it does not itself transmit, file, or submit any regulatory notification, and it is not legal advice. Criticality of the affected function/provider (critical_services_affected) is a caller-supplied input, not computed or judged here."
      },
      "golden_hash": "a77f3a1dd9ad3df840a62797eba6147ab52bb2d739084c7ad80b93a6c92d2615"
    },
    {
      "name": "major-incident-with-clock",
      "description": "Clients-affected + duration + geographic-spread + data-losses + economic-impact + critical-services + reputational all breach threshold -- MAJOR verdict with a full 4h/72h/1-month reporting clock.",
      "policy_parameters": {
        "incident_id": "INC-2026-0200",
        "classification_at": "2026-07-20T09:00:00Z",
        "clients_affected_pct": 15,
        "duration_minutes": 1500,
        "geographical_spread_countries_count": 3,
        "data_losses": true,
        "economic_impact_amount": 250000,
        "critical_services_affected": true,
        "reputational_impact": true
      },
      "output_payload": {
        "incident_id": "INC-2026-0200",
        "verdict": "MAJOR",
        "major_incident": true,
        "qualifying_criteria": [
          "clients_affected",
          "duration",
          "geographical_spread",
          "data_losses",
          "economic_impact",
          "critical_services_affected",
          "reputational_impact"
        ],
        "criteria_detail": [
          {
            "criterion_id": "clients_affected",
            "article": "DORA Art. 18(1)(a); RTS (EU) 2024/1772 clients-affected threshold",
            "met": true,
            "value": "15% (threshold >=10%)"
          },
          {
            "criterion_id": "duration",
            "article": "DORA Art. 18(1)(b); RTS (EU) 2024/1772 duration threshold",
            "met": true,
            "value": "1500 min (threshold >=1440 min)"
          },
          {
            "criterion_id": "geographical_spread",
            "article": "DORA Art. 18(1)(c); RTS (EU) 2024/1772 geographical-spread threshold",
            "met": true,
            "value": "3 member state(s) (threshold >=2)"
          },
          {
            "criterion_id": "data_losses",
            "article": "DORA Art. 18(1)(d); RTS (EU) 2024/1772 data-losses criterion (confidentiality/integrity/availability impact)",
            "met": true,
            "value": "Data loss reported"
          },
          {
            "criterion_id": "economic_impact",
            "article": "DORA Art. 18(1)(e); RTS (EU) 2024/1772 economic-impact threshold",
            "met": true,
            "value": "EUR 250000 (threshold >=EUR 100000)"
          },
          {
            "criterion_id": "critical_services_affected",
            "article": "DORA Art. 18(1)(f); RTS (EU) 2024/1772 criticality-of-services criterion",
            "met": true,
            "value": "Critical/important function affected"
          },
          {
            "criterion_id": "reputational_impact",
            "article": "DORA Art. 18(1)(g); RTS (EU) 2024/1772 reputational-impact criterion",
            "met": true,
            "value": "Reputational impact reported"
          }
        ],
        "reporting_clock": {
          "classification_at": "2026-07-20T09:00:00.000Z",
          "initial_notification_deadline": "2026-07-20T13:00:00.000Z",
          "intermediate_report_deadline": "2026-07-23T09:00:00.000Z",
          "final_report_deadline": "2026-08-20T09:00:00.000Z",
          "note": "Initial notification 4h, intermediate report 72h, final report 1 calendar month -- all clocked from classification_at (see kernel header for citation + confidence caveat)."
        },
        "table_version": "DORA-RTS-2024-1772-CLASSIFICATION+ITS-2025-302-TIMELINES-2026-07",
        "table_source": "DORA (EU) 2022/2554 Art. 18 (classification criteria) + Art. 19 (reporting obligations/timelines); Commission Delegated Regulation (EU) 2024/1772 (RTS on classification criteria for major ICT-related incidents and significant cyber threats); Commission Implementing Regulation (EU) 2025/302 (ITS on standard forms/templates and timelines for major-incident reports). Numeric thresholds pinned at MODERATE confidence -- verify against final consolidated RTS/ITS text at legal review before relying on this verdict for an actual filing.",
        "note": "Deterministic DORA (Art. 18) major-incident classification over caller-declared severity dimensions, plus a DORA Art. 19 reporting-clock (initial/intermediate/final) once classified major. See art-428-cyber-incident-clock.kernel.mjs for the analogous US notification-clock pattern. This kernel classifies and computes deadlines only; it does not itself transmit, file, or submit any regulatory notification, and it is not legal advice. Criticality of the affected function/provider (critical_services_affected) is a caller-supplied input, not computed or judged here."
      },
      "golden_hash": "a7504e920bf36c3e4e56e6c2027d2c3c6bcc27a495292fc179d6a29ddad67a4e"
    },
    {
      "name": "major-incident-no-timestamp",
      "description": "MAJOR verdict (data_losses independent trigger) but classification_at omitted -- reporting_clock stays null and a compliance_flag records the missing timestamp.",
      "policy_parameters": {
        "incident_id": "INC-2026-0300",
        "clients_affected_pct": 20,
        "duration_minutes": 2000,
        "geographical_spread_countries_count": 4,
        "data_losses": true,
        "economic_impact_amount": 500000,
        "critical_services_affected": true,
        "reputational_impact": false
      },
      "output_payload": {
        "incident_id": "INC-2026-0300",
        "verdict": "MAJOR",
        "major_incident": true,
        "qualifying_criteria": [
          "clients_affected",
          "duration",
          "geographical_spread",
          "data_losses",
          "economic_impact",
          "critical_services_affected"
        ],
        "criteria_detail": [
          {
            "criterion_id": "clients_affected",
            "article": "DORA Art. 18(1)(a); RTS (EU) 2024/1772 clients-affected threshold",
            "met": true,
            "value": "20% (threshold >=10%)"
          },
          {
            "criterion_id": "duration",
            "article": "DORA Art. 18(1)(b); RTS (EU) 2024/1772 duration threshold",
            "met": true,
            "value": "2000 min (threshold >=1440 min)"
          },
          {
            "criterion_id": "geographical_spread",
            "article": "DORA Art. 18(1)(c); RTS (EU) 2024/1772 geographical-spread threshold",
            "met": true,
            "value": "4 member state(s) (threshold >=2)"
          },
          {
            "criterion_id": "data_losses",
            "article": "DORA Art. 18(1)(d); RTS (EU) 2024/1772 data-losses criterion (confidentiality/integrity/availability impact)",
            "met": true,
            "value": "Data loss reported"
          },
          {
            "criterion_id": "economic_impact",
            "article": "DORA Art. 18(1)(e); RTS (EU) 2024/1772 economic-impact threshold",
            "met": true,
            "value": "EUR 500000 (threshold >=EUR 100000)"
          },
          {
            "criterion_id": "critical_services_affected",
            "article": "DORA Art. 18(1)(f); RTS (EU) 2024/1772 criticality-of-services criterion",
            "met": true,
            "value": "Critical/important function affected"
          },
          {
            "criterion_id": "reputational_impact",
            "article": "DORA Art. 18(1)(g); RTS (EU) 2024/1772 reputational-impact criterion",
            "met": false,
            "value": "No reputational impact reported"
          }
        ],
        "reporting_clock": null,
        "table_version": "DORA-RTS-2024-1772-CLASSIFICATION+ITS-2025-302-TIMELINES-2026-07",
        "table_source": "DORA (EU) 2022/2554 Art. 18 (classification criteria) + Art. 19 (reporting obligations/timelines); Commission Delegated Regulation (EU) 2024/1772 (RTS on classification criteria for major ICT-related incidents and significant cyber threats); Commission Implementing Regulation (EU) 2025/302 (ITS on standard forms/templates and timelines for major-incident reports). Numeric thresholds pinned at MODERATE confidence -- verify against final consolidated RTS/ITS text at legal review before relying on this verdict for an actual filing.",
        "note": "Deterministic DORA (Art. 18) major-incident classification over caller-declared severity dimensions, plus a DORA Art. 19 reporting-clock (initial/intermediate/final) once classified major. See art-428-cyber-incident-clock.kernel.mjs for the analogous US notification-clock pattern. This kernel classifies and computes deadlines only; it does not itself transmit, file, or submit any regulatory notification, and it is not legal advice. Criticality of the affected function/provider (critical_services_affected) is a caller-supplied input, not computed or judged here."
      },
      "golden_hash": "53c94c4456d669a3682c634fc56b0223b3f97a1681e4c5bb44a695852aed93e4"
    }
  ]
}