{
  "schema_version": "fasttool-evidence-receipt/v1",
  "tool_slug": "sarif-finding-delta-release-gate",
  "tool_version": "0.3.0",
  "canonical_url": "https://fasttool.app/tools/sarif-finding-delta-release-gate/",
  "created_at": "2026-07-28T00:00:00.000Z",
  "input_source": "generated_fixture",
  "input_hashes": {
    "cli_sha256": "1b7f5ae01c9e296a447939d972354455cac7669385fac3ef4da35f927d86fb8a",
    "action_sha256": "f96971337bba977851065f00bcbf5b010a6f93468e04b2f22d3a6011e980f9dd"
  },
  "artifact_hashes": {
    "fasttool-evidence-cli-v0.3.0.tgz": "a2233b702af5ad82ac6fcd4e9b22eaa5702d1b6157ebc8f5e2708198d702e505",
    "fasttool-evidence-action-v0.3.0.zip": "1cba40b4ad2ccfa1b8345ae93e0cb42862b360896da843f4bd414c15fd6c0584",
    "README.md": "29a3bed91563139a4b33bd6f9656243195c31bc802386dc4e78a3c4c88b53887",
    "fasttool-evidence-v0.3.0-release-manifest.json": "33fba6cdd1fcc31c40bc3951d86bffacd1d263a5a84dcb41596c47a3a2d688f6"
  },
  "artifacts": [
    {
      "name": "fasttool-evidence-cli-v0.3.0.tgz",
      "media_type": "application/gzip",
      "byte_length": 168215,
      "sha256": "a2233b702af5ad82ac6fcd4e9b22eaa5702d1b6157ebc8f5e2708198d702e505"
    },
    {
      "name": "fasttool-evidence-action-v0.3.0.zip",
      "media_type": "application/zip",
      "byte_length": 369896,
      "sha256": "1cba40b4ad2ccfa1b8345ae93e0cb42862b360896da843f4bd414c15fd6c0584"
    },
    {
      "name": "README.md",
      "media_type": "text/markdown",
      "byte_length": 1542,
      "sha256": "29a3bed91563139a4b33bd6f9656243195c31bc802386dc4e78a3c4c88b53887"
    },
    {
      "name": "fasttool-evidence-v0.3.0-release-manifest.json",
      "media_type": "application/json",
      "byte_length": 2080,
      "sha256": "33fba6cdd1fcc31c40bc3951d86bffacd1d263a5a84dcb41596c47a3a2d688f6"
    }
  ],
  "source_refs": [
    "https://fasttool.app/tools/sarif-finding-delta-release-gate/",
    "https://fasttool.app/tools/receipt-verifier/",
    "https://docs.npmjs.com/cli/commands/npm-pack",
    "https://docs.github.com/actions/creating-actions/metadata-syntax-for-github-actions",
    "https://github.com/rd0-x/fasttool-evidence",
    "https://github.com/rd0-x/fasttool-evidence/releases/tag/v0.3.0",
    "https://fasttool.app/.well-known/fasttool-evidence/0.3.0.json"
  ],
  "assumptions": [
    "The consuming runtime provides Node.js 20 or newer."
  ],
  "warnings": [
    "This immutable package records build identity, not live publication. Verify GitHub Release, Marketplace and npm through the external publication attestation.",
    "Receipt v1 requires a live canonical FastTool tool route. The SARIF flagship anchors this multi-engine distribution receipt; the package also contains GitHub Actions, OpenAPI and LLM regression engines."
  ],
  "limits": [
    "SHA-256 integrity does not establish security, authorship, deployment, ownership, or legal admissibility.",
    "Consumers must independently verify the release commit, pin its full 40-character SHA, and check the external publication attestation before relying on a public channel."
  ],
  "fixture_id": "fasttool-evidence-distribution-v0.3.0",
  "verification_url": "https://fasttool.app/tools/receipt-verifier/",
  "parent_receipt_hashes": [],
  "engine_sha256": "745e106617fa09a99fe643d0e32481d58fa6862d883a64e040c4d3848b776680",
  "distribution_identity": {
    "package": "@fasttool/evidence",
    "version": "0.3.0",
    "engines": [
      "github-actions",
      "openapi",
      "sarif",
      "llm-regression"
    ],
    "identity_note": "Receipt v1 requires a live canonical FastTool tool route. The SARIF flagship anchors this multi-engine distribution receipt; it does not mean the package is SARIF-only."
  },
  "verification": {
    "status": "producer_self_check",
    "independent_review_claimed": false
  },
  "result_summary": {
    "build_state": "release_candidate",
    "release_version": "0.3.0",
    "artifact_count": 4,
    "publication_claims_embedded": false
  },
  "receipt_core_sha256": "6091fc311e4feaab2c91b8ca356255481f8fd82c547545f3663bb2c68bce267d"
}