{
  "schema": "declawd.maintenance-review/v1",
  "reviewed_at": "2026-11-02T17:46:15Z",
  "cli": {
    "version": "0.3.3",
    "c2pa": "0.91.8",
    "zip": "9.2.2",
    "rust_packages_audited": 382,
    "rsa_advisory": "RUSTSEC-2023-0071",
    "rsa_exception_expires": "2026-11-28",
    "informational_notice": "RUSTSEC-2024-0370"
  },
  "inspector": {
    "web": "0.15.5",
    "wasm": "0.13.4",
    "wasm_sha256": "e6a3817fc7a4d5dddc66a26e9e21d5159bc73f60e95f27e76e249b3e70a37b95",
    "settings_controls": {
      "configured_reader": "binding and signature validation returned",
      "disabled_verification": "validation lists empty",
      "malformed_settings": "configuration parse error",
      "scope": "Exact shipped package and settings path only. Reported issue252 is not reproduced here."
    },
    "browser_cases": [
      {
        "name": "signed",
        "sha256": "ffea8ab2855f3c524b84f67ab136b9d36c43684843fce884c339e447e25418d7",
        "states": {
          "embedded_record": "present",
          "content_binding": "passed",
          "signature": "passed",
          "issuer_trust": "untrusted",
          "timestamp_trust": "unavailable",
          "revocation": "unavailable",
          "remote_manifest": "unavailable"
        }
      },
      {
        "name": "naive-derivative",
        "sha256": "b024bb1b90075096aabecac47a33442ac2084d1062da86891217aea2869b1cd1",
        "states": {
          "embedded_record": "present",
          "content_binding": "failed",
          "signature": "passed",
          "issuer_trust": "untrusted",
          "timestamp_trust": "unavailable",
          "revocation": "unavailable",
          "remote_manifest": "unavailable"
        }
      },
      {
        "name": "provenance-derivative",
        "sha256": "73b57a2f87eacf201e275f0387f0c67e131799909be3d9bde394db8d40756430",
        "states": {
          "embedded_record": "present",
          "content_binding": "passed",
          "signature": "passed",
          "issuer_trust": "untrusted",
          "timestamp_trust": "unavailable",
          "revocation": "unavailable",
          "remote_manifest": "unavailable"
        }
      },
      {
        "name": "stripped",
        "sha256": "828e34f09b8cfbff0369b85afa6550fffeaa761531e4304d3ff756f20fd721e1",
        "states": {
          "embedded_record": "absent",
          "content_binding": "unavailable",
          "signature": "unavailable",
          "issuer_trust": "unavailable",
          "timestamp_trust": "unavailable",
          "revocation": "unavailable",
          "remote_manifest": "unavailable"
        }
      },
      {
        "name": "signed-jpeg",
        "sha256": "30189993e5e293b4bca928a07412d78e129108f73a257bf16dffbb8c9e7fdbb9",
        "states": {
          "embedded_record": "present",
          "content_binding": "passed",
          "signature": "passed",
          "issuer_trust": "untrusted",
          "timestamp_trust": "unavailable",
          "revocation": "unavailable",
          "remote_manifest": "unavailable"
        }
      },
      {
        "name": "assertion-text",
        "sha256": "26a3d28e89b70230144fba4eb04fdb24e47bc8dcca49472dac4ab29b0fa1d3d0",
        "states": {
          "embedded_record": "present",
          "content_binding": "passed",
          "signature": "failed",
          "issuer_trust": "untrusted",
          "timestamp_trust": "unavailable",
          "revocation": "unavailable",
          "remote_manifest": "unavailable"
        }
      },
      {
        "name": "remote-manifest",
        "sha256": "4bc7efcd81ac0fdc1564ce2deeca7e00374e050b9c6b99dc1d878fc32e3af92a",
        "states": {
          "embedded_record": "unavailable",
          "content_binding": "unavailable",
          "signature": "unavailable",
          "issuer_trust": "unavailable",
          "timestamp_trust": "unavailable",
          "revocation": "unavailable",
          "remote_manifest": "unavailable"
        }
      },
      {
        "name": "expired-policy",
        "sha256": "ffea8ab2855f3c524b84f67ab136b9d36c43684843fce884c339e447e25418d7",
        "states": {
          "embedded_record": "present",
          "content_binding": "passed",
          "signature": "passed",
          "issuer_trust": "unavailable",
          "timestamp_trust": "unavailable",
          "revocation": "unavailable",
          "remote_manifest": "unavailable"
        }
      },
      {
        "name": "screenshot",
        "sha256": "ffea8ab2855f3c524b84f67ab136b9d36c43684843fce884c339e447e25418d7",
        "states": {
          "embedded_record": "present",
          "content_binding": "passed",
          "signature": "passed",
          "issuer_trust": "untrusted",
          "timestamp_trust": "unavailable",
          "revocation": "unavailable",
          "remote_manifest": "unavailable"
        }
      }
    ],
    "browser_errors": [],
    "network_scope": "Captured requests were limited to the local test origin. Live revocation and remote manifests remain disabled."
  },
  "local_evidence": [
    {
      "path": "output/refresh-2026-11-02/maintenance/settings-controls.txt",
      "sha256": "8cc55df61f40d3290562914304d2d1db2d6885a3e2ed5dbad0e19d1a572dd6e0",
      "bytes": 4225
    },
    {
      "path": "output/refresh-2026-11-02/maintenance/inspector-browser/c2pa-browser.json",
      "sha256": "697c8b87d782e4f0a8c8891784e55b380697849cb11b2b8e86391ff47bc2e1a0",
      "bytes": 31917
    },
    {
      "path": "output/refresh-2026-11-02/maintenance/cli-rust-audit.json",
      "sha256": "289f7cf07a0a55812b8fa61573ca21c3e9f7d609759c47f753ab42fc3a7e698d",
      "bytes": 931
    },
    {
      "path": "output/refresh-2026-11-02/maintenance/wasm-source-audit.json",
      "sha256": "00b3185f5f40577d819975d45722d2d8584d7843991ee2859c1f60370ef9d6ac",
      "bytes": 6877
    },
    {
      "path": "output/refresh-2026-11-02/maintenance/npm-audit.json",
      "sha256": "ff23e53d2661139d70d89f4fc7d8ac9c93256aed959d3262bf5037671af9f760",
      "bytes": 361
    }
  ],
  "limitations": [
    "Full raw logs remain in the private refresh output. The published test and package pins permit reproduction.",
    "The frozen browser WASM dependency inventory differs from the current CLI inventory.",
    "No image exploit from the Buchanan report was executed."
  ]
}