{
  "run_id": "ASR-1.0.0-e7968940323817b9",
  "first_recorded_at": "2026-09-25T09:59:10.761495+00:00",
  "immutable": true,
  "report": {
    "report_version": "bkc-assurance/1.0",
    "suite_version": "1.0.0",
    "commit_ref": "unknown",
    "generated_at": "2026-09-29T06:18:53.242Z",
    "endpoints_covered": 54,
    "governance_modules": [
      "notify-connectors.functions.ts",
      "certified-admin.functions.ts",
      "certified-preprod.functions.ts"
    ],
    "governance_operations": 12,
    "queue_operations": [
      {
        "op": "getConnectorConsole",
        "owner": "admin",
        "reads_payload": false
      },
      {
        "op": "updateConnectorConfig",
        "owner": "admin",
        "reads_payload": false
      },
      {
        "op": "testConnector",
        "owner": "admin",
        "reads_payload": false
      },
      {
        "op": "drainConnectorQueue",
        "owner": "admin",
        "reads_payload": false
      },
      {
        "op": "getSigningKeyset",
        "owner": "admin",
        "reads_payload": false
      },
      {
        "op": "rotateSigningKeyNow",
        "owner": "admin",
        "reads_payload": false
      }
    ],
    "checks": [
      {
        "id": "TI-A1",
        "suite": "tenant-isolation",
        "title": "Moduli analizzati",
        "expectation": "La suite trova i moduli *.functions.ts da analizzare."
      },
      {
        "id": "TI-A2",
        "suite": "tenant-isolation",
        "title": "Endpoint pubblici dichiarati",
        "expectation": "Nessuna server function non autenticata è priva di dichiarazione."
      },
      {
        "id": "TI-A3",
        "suite": "tenant-isolation",
        "title": "Motivazione ed esposizione",
        "expectation": "Ogni endpoint pubblico ha motivazione e classe di esposizione."
      },
      {
        "id": "TI-A4",
        "suite": "tenant-isolation",
        "title": "Nessun endpoint fantasma",
        "expectation": "L'allowlist non contiene endpoint inesistenti."
      },
      {
        "id": "TI-A5",
        "suite": "tenant-isolation",
        "title": "Service-role confinato",
        "expectation": "Nessun import service-role a livello di modulo."
      },
      {
        "id": "TI-A6",
        "suite": "tenant-isolation",
        "title": "Governance autenticata",
        "expectation": "Ogni operazione di governance è autenticata con meccanismo dichiarato."
      },
      {
        "id": "NQ-A1",
        "suite": "notify-queue",
        "title": "Coda admin-only",
        "expectation": "Le sei operazioni della coda richiedono ruolo admin."
      },
      {
        "id": "NQ-A2",
        "suite": "notify-queue",
        "title": "Payload non leggibile",
        "expectation": "La console non può selezionare la colonna payload."
      },
      {
        "id": "NQ-A3",
        "suite": "notify-queue",
        "title": "Run-id preservato",
        "expectation": "Ogni elemento resta legato al proprio run_id e gli update sono scoped per id."
      },
      {
        "id": "NQ-A4",
        "suite": "notify-queue",
        "title": "Drenaggio non bloccante",
        "expectation": "Il drenaggio della coda non può cambiare l'esito del gate."
      },
      {
        "id": "CI-A1",
        "suite": "connector-isolation",
        "title": "Slack assente",
        "expectation": "Esito, promotion_ready e hash del gate restano identici."
      },
      {
        "id": "CI-A2",
        "suite": "connector-isolation",
        "title": "DNS email fallito",
        "expectation": "Il gate non cambia esito né timeline."
      },
      {
        "id": "CI-A3",
        "suite": "connector-isolation",
        "title": "Provider in timeout",
        "expectation": "Il connettore in timeout non propaga eccezioni al nucleo."
      },
      {
        "id": "CI-A4",
        "suite": "connector-isolation",
        "title": "Nucleo prima dei connettori",
        "expectation": "Il sigillo del nucleo precede ogni chiamata esterna."
      }
    ],
    "tests_total": 14,
    "tests_passed": 14,
    "outcome": "PASS",
    "evidence": {
      "source_registry": "src/lib/tenant-isolation.ts",
      "tenant_tests": "src/lib/__tests__/tenant-isolation.test.ts",
      "connector_tests": "src/lib/__tests__/connector-isolation.test.ts",
      "public_page": "/assurance"
    }
  },
  "integrity": {
    "sha256": "e7968940323817b91cd9deeb75ad2a03a70792e55280ba2e980f0c68b647dab2",
    "signature": "ecdsa-p256-sha256:2ed85d538bf90b64eb5d4e2934e0412df951608566bdad2ee6f62c4188d4775be11117bf1f86397137f3689430344ae014efbd60b243d85f623fb1916a13343a",
    "key_id": "bkc-test-20260819-59c490",
    "alg": "ECDSA_P256_SHA256"
  }
}