{"schema":"cadence.public-trust-view","schema_version":1,"feed_state":"live","feed_message":null,"snapshot":{"id":"20260917T123743Z-b047d59a3681","url":"https://emixd12.github.io/habit-tracking-app/trust/35222021571/dpl_4VbtFaFa4qEYQ2WJPdPo5fWWw9Vs/dpl_9NYrBAxhXgjThfnqKYvyVmxxBiEV/20260917T123743Z-b047d59a3681.json","source_commit":"b047d59a368136f283cf981f42e21b937ec13101","application_deployment_id":"dpl_4VbtFaFa4qEYQ2WJPdPo5fWWw9Vs","application_deployment_url":"https://cadence-blush-three.vercel.app","marketing_deployment_id":"dpl_9NYrBAxhXgjThfnqKYvyVmxxBiEV","marketing_deployment_url":"https://cadence-marketing-two.vercel.app","workflow_url":"https://github.com/emixd12/habit-tracking-app/actions/runs/35222021571","built_at":"2026-09-17T12:37:43Z","verified_at":"2026-09-17T12:37:43Z","freshness_deadline":"2026-09-18T12:37:43Z"},"checks":[{"id":"source_to_deployment_provenance","label":"Source to deployment provenance","status":"failed","scope":"Both named Ready Vercel deployments and their public Git commit metadata.","scope_limit":"It does not prove that later configuration or provider state is unchanged.","summary":"The named deployments are not both Ready from the expected source commit.","unavailable_reason":null,"completed_at":"2026-09-17T12:37:43Z","freshness_deadline":"2026-09-18T12:37:43Z","evidence_url":"https://emixd12.github.io/habit-tracking-app/trust/35222021571/dpl_4VbtFaFa4qEYQ2WJPdPo5fWWw9Vs/dpl_9NYrBAxhXgjThfnqKYvyVmxxBiEV/20260917T123743Z-b047d59a3681.details.json"},{"id":"production_dependency_vulnerabilities","label":"Production dependency scanning","status":"unavailable","scope":"Production dependencies declared by the lockfile, npm advisory data, and Dependabot status.","scope_limit":"It covers declared production dependencies and the tool's data at completion time only.","summary":"SBOM has 253 components with SHA-256 a83638268de169098cc8759be1f89a35360eeeb49dbc227c44a23bd330b08b4c; audit totals: 5 (1 critical, 3 high, 1 moderate, 0 low); Dependabot aggregate unavailable.","unavailable_reason":"The workflow token could not read the Dependabot aggregate result.","completed_at":null,"freshness_deadline":null,"evidence_url":"https://emixd12.github.io/habit-tracking-app/trust/35222021571/dpl_4VbtFaFa4qEYQ2WJPdPo5fWWw9Vs/dpl_9NYrBAxhXgjThfnqKYvyVmxxBiEV/20260917T123743Z-b047d59a3681.details.json"},{"id":"code_scanning","label":"Code scanning","status":"stale","scope":"Configured GitHub code-scanning analyzers for the named public repository and source commit.","scope_limit":"It covers configured analyzers and rules only and cannot establish the absence of defects.","summary":"CodeQL completed for the named commit and reported zero open repository alerts.","unavailable_reason":null,"completed_at":"2026-09-17T12:37:43Z","freshness_deadline":"2026-09-24T12:37:43Z","evidence_url":"https://emixd12.github.io/habit-tracking-app/trust/35222021571/dpl_4VbtFaFa4qEYQ2WJPdPo5fWWw9Vs/dpl_9NYrBAxhXgjThfnqKYvyVmxxBiEV/20260917T123743Z-b047d59a3681.details.json"},{"id":"secret_scanning","label":"Secret scanning","status":"unavailable","scope":"GitHub secret scanning and push protection for the named public repository.","scope_limit":"It covers patterns and repository history visible to the configured platform only.","summary":"The provider did not expose a safe aggregate result.","unavailable_reason":"The workflow token could not read this aggregate provider result.","completed_at":null,"freshness_deadline":null,"evidence_url":"https://emixd12.github.io/habit-tracking-app/trust/35222021571/dpl_4VbtFaFa4qEYQ2WJPdPo5fWWw9Vs/dpl_9NYrBAxhXgjThfnqKYvyVmxxBiEV/20260917T123743Z-b047d59a3681.details.json"},{"id":"public_artifact_integrity","label":"Public artifact integrity","status":"stale","scope":"6 allowlisted public application and marketing assets.","scope_limit":"It covers generated public files, not private operational records or live-route availability.","summary":"6 of 6 public assets matched status, type, size, and digest bounds.","unavailable_reason":null,"completed_at":"2026-09-17T12:37:43Z","freshness_deadline":"2026-09-18T12:37:43Z","evidence_url":"https://emixd12.github.io/habit-tracking-app/trust/35222021571/dpl_4VbtFaFa4qEYQ2WJPdPo5fWWw9Vs/dpl_9NYrBAxhXgjThfnqKYvyVmxxBiEV/20260917T123743Z-b047d59a3681.details.json"},{"id":"application_live_route_comparison","label":"Application routes","status":"stale","scope":"10 explicit unauthenticated application route contracts.","scope_limit":"It covers the sampled routes and responses at completion time, not every authenticated workflow.","summary":"10 of 10 application routes matched the registry.","unavailable_reason":null,"completed_at":"2026-09-17T12:37:43Z","freshness_deadline":"2026-09-18T12:37:43Z","evidence_url":"https://emixd12.github.io/habit-tracking-app/trust/35222021571/dpl_4VbtFaFa4qEYQ2WJPdPo5fWWw9Vs/dpl_9NYrBAxhXgjThfnqKYvyVmxxBiEV/20260917T123743Z-b047d59a3681.details.json"},{"id":"marketing_live_route_comparison","label":"Marketing routes","status":"stale","scope":"17 generated marketing HTML and Markdown route contracts.","scope_limit":"It covers declared marketing routes at completion time, not every external cache or network path.","summary":"17 of 17 marketing routes matched the generated manifest.","unavailable_reason":null,"completed_at":"2026-09-17T12:37:43Z","freshness_deadline":"2026-09-18T12:37:43Z","evidence_url":"https://emixd12.github.io/habit-tracking-app/trust/35222021571/dpl_4VbtFaFa4qEYQ2WJPdPo5fWWw9Vs/dpl_9NYrBAxhXgjThfnqKYvyVmxxBiEV/20260917T123743Z-b047d59a3681.details.json"},{"id":"hosted_migration_boundary","label":"Hosted migration boundary","status":"failed","scope":"Hosted Supabase migration history compared with the tracked migration boundary.","scope_limit":"It proves migration-history alignment only, not correctness of user-owned data.","summary":"Hosted migration boundary does not match the tracked source boundary.","unavailable_reason":null,"completed_at":"2026-09-17T12:37:43Z","freshness_deadline":"2026-09-18T12:37:43Z","evidence_url":"https://emixd12.github.io/habit-tracking-app/trust/35222021571/dpl_4VbtFaFa4qEYQ2WJPdPo5fWWw9Vs/dpl_9NYrBAxhXgjThfnqKYvyVmxxBiEV/20260917T123743Z-b047d59a3681.details.json"},{"id":"cross_account_rls_isolation","label":"Cross-account RLS isolation","status":"not_run","scope":"Disposable-account ordinary-client ownership checks across the public data API.","scope_limit":"It covers only the tested tables and operations at completion time.","summary":"The authorized cross-account RLS smoke did not run in this collection.","unavailable_reason":null,"completed_at":null,"freshness_deadline":null,"evidence_url":"https://emixd12.github.io/habit-tracking-app/trust/35222021571/dpl_4VbtFaFa4qEYQ2WJPdPo5fWWw9Vs/dpl_9NYrBAxhXgjThfnqKYvyVmxxBiEV/20260917T123743Z-b047d59a3681.details.json"}]}