{
  "tool_id": "art-486-cscf-control-applicability",
  "note": "control_matrix is a synthetic, structurally-representative sample (control numbers/tiers/architecture-applicability shape only, no Swift-authored control text) -- real usage supplies the published CSCF matrix as a policy input, never kernel source. golden_hash empty until first `node golden-parity.test.mjs --update`.",
  "vectors": [
    {
      "name": "a1-mixed-gaps-and-na",
      "policy_parameters": {
        "architecture_type": "A1",
        "cscf_version": "2026",
        "component_inventory": [
          "swift_alliance_access",
          "hsm",
          "jump_server"
        ],
        "control_matrix": [
          {
            "control_number": "1.1",
            "tier": "mandatory",
            "applicable_architecture_types": [
              "A1",
              "A2",
              "A3",
              "A4"
            ],
            "evidence_ref": "SWIFT.io evidence"
          },
          {
            "control_number": "1.2",
            "tier": "mandatory",
            "applicable_architecture_types": [
              "ALL"
            ],
            "evidence_ref": "Network diagram"
          },
          {
            "control_number": "2.1",
            "tier": "mandatory",
            "applicable_architecture_types": [
              "A1",
              "A2"
            ],
            "evidence_ref": "Access control list"
          },
          {
            "control_number": "2.4A",
            "tier": "advisory",
            "applicable_architecture_types": [
              "A1",
              "A2",
              "A3"
            ],
            "evidence_ref": "Logging config export"
          },
          {
            "control_number": "5.1",
            "tier": "mandatory",
            "applicable_architecture_types": [
              "A1",
              "B",
              "C"
            ],
            "evidence_ref": "HSM audit report"
          },
          {
            "control_number": "7.2",
            "tier": "advisory",
            "applicable_architecture_types": [
              "ALL"
            ],
            "evidence_ref": "Pen-test report"
          }
        ],
        "implementation_status": {
          "1.1": {
            "implemented": true,
            "evidence_provided": true
          },
          "1.2": {
            "implemented": true,
            "evidence_provided": true
          },
          "2.1": {
            "implemented": false,
            "evidence_provided": false
          },
          "5.1": {
            "implemented": true,
            "evidence_provided": true
          },
          "7.2": {
            "not_applicable": true,
            "na_reason": "No externally exposed pen-test surface for this architecture"
          }
        }
      },
      "output_payload": {
        "architecture_type": "A1",
        "cscf_version": "2026",
        "component_inventory": [
          "swift_alliance_access",
          "hsm",
          "jump_server"
        ],
        "applicable_mandatory_count": 4,
        "applicable_advisory_count": 2,
        "mandatory_coverage_pct": 75,
        "advisory_coverage_pct": 0,
        "gap_list": [
          {
            "control_number": "2.1",
            "tier": "mandatory",
            "evidence_ref": "Access control list"
          },
          {
            "control_number": "2.4A",
            "tier": "advisory",
            "evidence_ref": "Logging config export"
          }
        ],
        "evidence_index": {
          "1.1": {
            "tier": "mandatory",
            "evidence_ref": "SWIFT.io evidence",
            "evidence_provided": true
          },
          "1.2": {
            "tier": "mandatory",
            "evidence_ref": "Network diagram",
            "evidence_provided": true
          },
          "2.1": {
            "tier": "mandatory",
            "evidence_ref": "Access control list",
            "evidence_provided": false
          },
          "2.4A": {
            "tier": "advisory",
            "evidence_ref": "Logging config export",
            "evidence_provided": false
          },
          "5.1": {
            "tier": "mandatory",
            "evidence_ref": "HSM audit report",
            "evidence_provided": true
          },
          "7.2": {
            "tier": "advisory",
            "evidence_ref": "Pen-test report",
            "evidence_provided": false
          }
        },
        "not_applicable_set": {
          "7.2": "No externally exposed pen-test surface for this architecture"
        },
        "overall_status": "gaps_present"
      },
      "golden_hash": "42319e2d686eb86a501cdea32a7cc3f53c6c5b556c52153e7a64fb53c5912984"
    },
    {
      "name": "arch-b-fully-compliant",
      "policy_parameters": {
        "architecture_type": "B",
        "cscf_version": "2026",
        "component_inventory": [
          "service_bureau_connection"
        ],
        "control_matrix": [
          {
            "control_number": "1.1",
            "tier": "mandatory",
            "applicable_architecture_types": [
              "A1",
              "A2",
              "A3",
              "A4"
            ],
            "evidence_ref": "SWIFT.io evidence"
          },
          {
            "control_number": "1.2",
            "tier": "mandatory",
            "applicable_architecture_types": [
              "ALL"
            ],
            "evidence_ref": "Network diagram"
          },
          {
            "control_number": "2.1",
            "tier": "mandatory",
            "applicable_architecture_types": [
              "A1",
              "A2"
            ],
            "evidence_ref": "Access control list"
          },
          {
            "control_number": "2.4A",
            "tier": "advisory",
            "applicable_architecture_types": [
              "A1",
              "A2",
              "A3"
            ],
            "evidence_ref": "Logging config export"
          },
          {
            "control_number": "5.1",
            "tier": "mandatory",
            "applicable_architecture_types": [
              "A1",
              "B",
              "C"
            ],
            "evidence_ref": "HSM audit report"
          },
          {
            "control_number": "7.2",
            "tier": "advisory",
            "applicable_architecture_types": [
              "ALL"
            ],
            "evidence_ref": "Pen-test report"
          }
        ],
        "implementation_status": {
          "1.2": {
            "implemented": true,
            "evidence_provided": true
          },
          "5.1": {
            "implemented": true,
            "evidence_provided": true
          },
          "7.2": {
            "implemented": true,
            "evidence_provided": true
          }
        }
      },
      "output_payload": {
        "architecture_type": "B",
        "cscf_version": "2026",
        "component_inventory": [
          "service_bureau_connection"
        ],
        "applicable_mandatory_count": 2,
        "applicable_advisory_count": 1,
        "mandatory_coverage_pct": 100,
        "advisory_coverage_pct": 100,
        "gap_list": [],
        "evidence_index": {
          "1.2": {
            "tier": "mandatory",
            "evidence_ref": "Network diagram",
            "evidence_provided": true
          },
          "5.1": {
            "tier": "mandatory",
            "evidence_ref": "HSM audit report",
            "evidence_provided": true
          },
          "7.2": {
            "tier": "advisory",
            "evidence_ref": "Pen-test report",
            "evidence_provided": true
          }
        },
        "not_applicable_set": {},
        "overall_status": "compliant"
      },
      "golden_hash": "0d291574843e43d847731cfaf1f15ea432508bd0279846db5ce65b35655f9e61"
    },
    {
      "name": "arch-c-all-gaps-with-na",
      "policy_parameters": {
        "architecture_type": "C",
        "cscf_version": "2026",
        "component_inventory": [],
        "control_matrix": [
          {
            "control_number": "1.1",
            "tier": "mandatory",
            "applicable_architecture_types": [
              "A1",
              "A2",
              "A3",
              "A4"
            ],
            "evidence_ref": "SWIFT.io evidence"
          },
          {
            "control_number": "1.2",
            "tier": "mandatory",
            "applicable_architecture_types": [
              "ALL"
            ],
            "evidence_ref": "Network diagram"
          },
          {
            "control_number": "2.1",
            "tier": "mandatory",
            "applicable_architecture_types": [
              "A1",
              "A2"
            ],
            "evidence_ref": "Access control list"
          },
          {
            "control_number": "2.4A",
            "tier": "advisory",
            "applicable_architecture_types": [
              "A1",
              "A2",
              "A3"
            ],
            "evidence_ref": "Logging config export"
          },
          {
            "control_number": "5.1",
            "tier": "mandatory",
            "applicable_architecture_types": [
              "A1",
              "B",
              "C"
            ],
            "evidence_ref": "HSM audit report"
          },
          {
            "control_number": "7.2",
            "tier": "advisory",
            "applicable_architecture_types": [
              "ALL"
            ],
            "evidence_ref": "Pen-test report"
          }
        ],
        "implementation_status": {
          "1.2": {
            "not_applicable": true,
            "na_reason": "No local infrastructure in scope for architecture C"
          },
          "5.1": {
            "implemented": false,
            "evidence_provided": false
          },
          "7.2": {
            "implemented": false,
            "evidence_provided": false
          }
        }
      },
      "output_payload": {
        "architecture_type": "C",
        "cscf_version": "2026",
        "component_inventory": [],
        "applicable_mandatory_count": 2,
        "applicable_advisory_count": 1,
        "mandatory_coverage_pct": 0,
        "advisory_coverage_pct": 0,
        "gap_list": [
          {
            "control_number": "5.1",
            "tier": "mandatory",
            "evidence_ref": "HSM audit report"
          },
          {
            "control_number": "7.2",
            "tier": "advisory",
            "evidence_ref": "Pen-test report"
          }
        ],
        "evidence_index": {
          "1.2": {
            "tier": "mandatory",
            "evidence_ref": "Network diagram",
            "evidence_provided": false
          },
          "5.1": {
            "tier": "mandatory",
            "evidence_ref": "HSM audit report",
            "evidence_provided": false
          },
          "7.2": {
            "tier": "advisory",
            "evidence_ref": "Pen-test report",
            "evidence_provided": false
          }
        },
        "not_applicable_set": {
          "1.2": "No local infrastructure in scope for architecture C"
        },
        "overall_status": "gaps_present"
      },
      "golden_hash": "dbb174928dc2e6de9f81447c62db90dc76ee9aec66789f8f0b4763d752978636"
    }
  ]
}