{
  "schemaVersion": "ai-change-evidence-passport.v1",
  "representation": "representative-demonstration",
  "generatedAt": "2026-08-31T06:52:03.652Z",
  "passport": {
    "id": "PAYMENTS-2026-0817",
    "title": "Payments API — production release",
    "application": "payments-api",
    "environment": "Production",
    "releaseVersion": "v4.17.2",
    "commitSha": "8f32e71",
    "changeRef": "CHG-1942",
    "occurredAt": "2026-08-17T15:04:00+10:00",
    "owner": "Digital Payments Platform",
    "materiality": "Material change — bank-defined classification",
    "reviewQuestion": "Can the reviewer form a defensible view of this release without reconstructing evidence across source systems?",
    "purpose": "Update the AI-assisted payment-description classifier and supporting release configuration.",
    "profile": {
      "id": "BANK-RELEASE-ASSURANCE-DEMO",
      "name": "Material AI-assisted change assurance",
      "version": "0.5-demo",
      "owner": "Representative second-line Technology Risk profile",
      "requirements": [
        {
          "id": "change.reference",
          "kind": "change",
          "label": "Declared change reference",
          "description": "The source change declares an explicit external change identifier.",
          "severity": "required",
          "acceptedStatuses": [
            "observed"
          ]
        },
        {
          "id": "change.scope",
          "kind": "change",
          "label": "Approved change scope",
          "description": "The intended change, owner and approved scope are identifiable.",
          "severity": "required",
          "acceptedStatuses": [
            "observed"
          ]
        },
        {
          "id": "code.merge",
          "kind": "code",
          "label": "Merged code trace",
          "description": "The merged pull request and exact commit are linked.",
          "severity": "required",
          "acceptedStatuses": [
            "observed"
          ]
        },
        {
          "id": "code.review",
          "kind": "code",
          "label": "Code and review trace",
          "description": "The exact commit and pull-request review are linked.",
          "severity": "required",
          "acceptedStatuses": [
            "observed",
            "passed"
          ]
        },
        {
          "id": "test.regression",
          "kind": "test",
          "label": "Regression test result",
          "description": "The release is linked to a completed regression run.",
          "severity": "required",
          "acceptedStatuses": [
            "passed"
          ]
        },
        {
          "id": "security.sast",
          "kind": "security",
          "label": "Static security analysis",
          "description": "The bank-approved SAST check is linked to the release.",
          "severity": "required",
          "acceptedStatuses": [
            "passed"
          ]
        },
        {
          "id": "security.dast",
          "kind": "security",
          "label": "Dynamic security analysis",
          "description": "The bank-approved DAST record is linked to the release.",
          "severity": "required",
          "acceptedStatuses": [
            "passed"
          ]
        },
        {
          "id": "approval.release",
          "kind": "approval",
          "label": "Authorised release decision",
          "description": "The decision and authority are identifiable.",
          "severity": "required",
          "acceptedStatuses": [
            "observed"
          ]
        },
        {
          "id": "artifact.identity",
          "kind": "artifact",
          "label": "Built artefact identity",
          "description": "The exact built artefact and immutable digest are identifiable.",
          "severity": "required",
          "acceptedStatuses": [
            "observed"
          ]
        },
        {
          "id": "deployment.production",
          "kind": "deployment",
          "label": "Production deployment",
          "description": "The artefact, target and deployment time are connected.",
          "severity": "required",
          "acceptedStatuses": [
            "observed",
            "passed"
          ]
        },
        {
          "id": "production.verify",
          "kind": "production",
          "label": "Post-deployment verification",
          "description": "The release is linked to an observed production outcome.",
          "severity": "required",
          "acceptedStatuses": [
            "passed"
          ]
        }
      ]
    },
    "evidence": [
      {
        "id": "ev-change-1942",
        "kind": "change",
        "requirementIds": [
          "change.reference",
          "change.scope"
        ],
        "label": "Change intent",
        "sourceSystem": "ServiceNow",
        "sourceRef": "CHG-1942",
        "result": "Approved scope",
        "status": "observed",
        "lineage": "direct",
        "observedAt": "2026-08-17T09:02:00+10:00",
        "actor": "Payments Product Owner",
        "correlationIds": [
          "CHG-1942",
          "PR-882"
        ],
        "detail": "Materiality, intended model/configuration change and accountable owner recorded in the authoritative change item."
      },
      {
        "id": "ev-code-882",
        "kind": "code",
        "requirementIds": [
          "code.merge",
          "code.review"
        ],
        "label": "Code change",
        "sourceSystem": "GitHub",
        "sourceRef": "PR #882 / 8f32e71",
        "result": "Merged after review",
        "status": "observed",
        "lineage": "direct",
        "observedAt": "2026-08-17T12:18:00+10:00",
        "actor": "A. Engineer",
        "correlationIds": [
          "PR-882",
          "8f32e71",
          "CHG-1942"
        ],
        "detail": "Pull request, head commit, review event and merge event are linked. AI assistance is declared in the PR metadata for this demonstration."
      },
      {
        "id": "ev-test-14591",
        "kind": "test",
        "requirementIds": [
          "test.regression"
        ],
        "label": "Regression suite",
        "sourceSystem": "GitHub Actions",
        "sourceRef": "Run #14591",
        "result": "328 tests passed",
        "status": "passed",
        "lineage": "direct",
        "observedAt": "2026-08-17T13:07:00+10:00",
        "correlationIds": [
          "8f32e71",
          "RUN-14591"
        ],
        "detail": "Completed workflow run references the same head SHA as the merged pull request."
      },
      {
        "id": "ev-sast-4731",
        "kind": "security",
        "requirementIds": [
          "security.sast"
        ],
        "label": "Static analysis",
        "sourceSystem": "SAST",
        "sourceRef": "Scan #4731",
        "result": "Passed",
        "status": "passed",
        "lineage": "derived",
        "observedAt": "2026-08-17T13:11:00+10:00",
        "correlationIds": [
          "8f32e71",
          "RUN-14591"
        ],
        "detail": "Result was obtained through the CI workflow record. The upstream scanner remains authoritative."
      },
      {
        "id": "ev-approval-1432",
        "kind": "approval",
        "requirementIds": [
          "approval.release"
        ],
        "label": "Release approval",
        "sourceSystem": "ServiceNow",
        "sourceRef": "Decision at 14:32",
        "result": "Approved",
        "status": "observed",
        "lineage": "direct",
        "observedAt": "2026-08-17T14:32:00+10:00",
        "actor": "Release Manager",
        "correlationIds": [
          "CHG-1942",
          "8f32e71"
        ],
        "detail": "The approval record identifies the decision and actor. Authority remains a bank-owned assertion for reviewer confirmation."
      },
      {
        "id": "ev-artifact-v4172",
        "kind": "artifact",
        "requirementIds": [
          "artifact.identity"
        ],
        "label": "Build artefact",
        "sourceSystem": "Container registry",
        "sourceRef": "payments-api:v4.17.2",
        "result": "Digest recorded",
        "status": "observed",
        "lineage": "direct",
        "observedAt": "2026-08-17T14:40:00+10:00",
        "correlationIds": [
          "8f32e71",
          "sha256:4c01…9ac2"
        ],
        "detail": "Container tag and digest are connected to the source commit by the build record."
      },
      {
        "id": "ev-deploy-prod-1504",
        "kind": "deployment",
        "requirementIds": [
          "deployment.production"
        ],
        "label": "Production deployment",
        "sourceSystem": "Deployment pipeline",
        "sourceRef": "Deploy #7714",
        "result": "Production at 15:04",
        "status": "observed",
        "lineage": "direct",
        "observedAt": "2026-08-17T15:04:00+10:00",
        "actor": "Release automation",
        "correlationIds": [
          "sha256:4c01…9ac2",
          "DEPLOY-7714"
        ],
        "detail": "Deployment target, artefact digest and completed timestamp are linked in the delivery system."
      },
      {
        "id": "ev-health-5of5",
        "kind": "production",
        "requirementIds": [
          "production.verify"
        ],
        "label": "Production verification",
        "sourceSystem": "Dynatrace",
        "sourceRef": "Release health window",
        "result": "5 of 5 checks passed",
        "status": "passed",
        "lineage": "derived",
        "observedAt": "2026-08-17T15:19:00+10:00",
        "correlationIds": [
          "DEPLOY-7714",
          "payments-api:v4.17.2"
        ],
        "detail": "The monitoring window is correlated to the deployment. This is an observed outcome, not a guarantee of control effectiveness."
      }
    ]
  },
  "evaluation": {
    "status": "human_decision_required",
    "evaluatedAt": "2026-08-31T06:52:03.652Z",
    "satisfied": 10,
    "expected": 11,
    "coveragePercent": 91,
    "directEvidence": 6,
    "derivedEvidence": 2,
    "assertedEvidence": 0,
    "unresolved": 1,
    "requirements": [
      {
        "requirement": {
          "id": "change.reference",
          "kind": "change",
          "label": "Declared change reference",
          "description": "The source change declares an explicit external change identifier.",
          "severity": "required",
          "acceptedStatuses": [
            "observed"
          ]
        },
        "evidence": {
          "id": "ev-change-1942",
          "kind": "change",
          "requirementIds": [
            "change.reference",
            "change.scope"
          ],
          "label": "Change intent",
          "sourceSystem": "ServiceNow",
          "sourceRef": "CHG-1942",
          "result": "Approved scope",
          "status": "observed",
          "lineage": "direct",
          "observedAt": "2026-08-17T09:02:00+10:00",
          "actor": "Payments Product Owner",
          "correlationIds": [
            "CHG-1942",
            "PR-882"
          ],
          "detail": "Materiality, intended model/configuration change and accountable owner recorded in the authoritative change item."
        },
        "outcome": "satisfied",
        "reason": "A source-linked record matched the requirement and its observed status.",
        "determinedBy": "deterministic-rule"
      },
      {
        "requirement": {
          "id": "change.scope",
          "kind": "change",
          "label": "Approved change scope",
          "description": "The intended change, owner and approved scope are identifiable.",
          "severity": "required",
          "acceptedStatuses": [
            "observed"
          ]
        },
        "evidence": {
          "id": "ev-change-1942",
          "kind": "change",
          "requirementIds": [
            "change.reference",
            "change.scope"
          ],
          "label": "Change intent",
          "sourceSystem": "ServiceNow",
          "sourceRef": "CHG-1942",
          "result": "Approved scope",
          "status": "observed",
          "lineage": "direct",
          "observedAt": "2026-08-17T09:02:00+10:00",
          "actor": "Payments Product Owner",
          "correlationIds": [
            "CHG-1942",
            "PR-882"
          ],
          "detail": "Materiality, intended model/configuration change and accountable owner recorded in the authoritative change item."
        },
        "outcome": "satisfied",
        "reason": "A source-linked record matched the requirement and its observed status.",
        "determinedBy": "deterministic-rule"
      },
      {
        "requirement": {
          "id": "code.merge",
          "kind": "code",
          "label": "Merged code trace",
          "description": "The merged pull request and exact commit are linked.",
          "severity": "required",
          "acceptedStatuses": [
            "observed"
          ]
        },
        "evidence": {
          "id": "ev-code-882",
          "kind": "code",
          "requirementIds": [
            "code.merge",
            "code.review"
          ],
          "label": "Code change",
          "sourceSystem": "GitHub",
          "sourceRef": "PR #882 / 8f32e71",
          "result": "Merged after review",
          "status": "observed",
          "lineage": "direct",
          "observedAt": "2026-08-17T12:18:00+10:00",
          "actor": "A. Engineer",
          "correlationIds": [
            "PR-882",
            "8f32e71",
            "CHG-1942"
          ],
          "detail": "Pull request, head commit, review event and merge event are linked. AI assistance is declared in the PR metadata for this demonstration."
        },
        "outcome": "satisfied",
        "reason": "A source-linked record matched the requirement and its observed status.",
        "determinedBy": "deterministic-rule"
      },
      {
        "requirement": {
          "id": "code.review",
          "kind": "code",
          "label": "Code and review trace",
          "description": "The exact commit and pull-request review are linked.",
          "severity": "required",
          "acceptedStatuses": [
            "observed",
            "passed"
          ]
        },
        "evidence": {
          "id": "ev-code-882",
          "kind": "code",
          "requirementIds": [
            "code.merge",
            "code.review"
          ],
          "label": "Code change",
          "sourceSystem": "GitHub",
          "sourceRef": "PR #882 / 8f32e71",
          "result": "Merged after review",
          "status": "observed",
          "lineage": "direct",
          "observedAt": "2026-08-17T12:18:00+10:00",
          "actor": "A. Engineer",
          "correlationIds": [
            "PR-882",
            "8f32e71",
            "CHG-1942"
          ],
          "detail": "Pull request, head commit, review event and merge event are linked. AI assistance is declared in the PR metadata for this demonstration."
        },
        "outcome": "satisfied",
        "reason": "A source-linked record matched the requirement and its observed status.",
        "determinedBy": "deterministic-rule"
      },
      {
        "requirement": {
          "id": "test.regression",
          "kind": "test",
          "label": "Regression test result",
          "description": "The release is linked to a completed regression run.",
          "severity": "required",
          "acceptedStatuses": [
            "passed"
          ]
        },
        "evidence": {
          "id": "ev-test-14591",
          "kind": "test",
          "requirementIds": [
            "test.regression"
          ],
          "label": "Regression suite",
          "sourceSystem": "GitHub Actions",
          "sourceRef": "Run #14591",
          "result": "328 tests passed",
          "status": "passed",
          "lineage": "direct",
          "observedAt": "2026-08-17T13:07:00+10:00",
          "correlationIds": [
            "8f32e71",
            "RUN-14591"
          ],
          "detail": "Completed workflow run references the same head SHA as the merged pull request."
        },
        "outcome": "satisfied",
        "reason": "A source-linked record matched the requirement and its observed status.",
        "determinedBy": "deterministic-rule"
      },
      {
        "requirement": {
          "id": "security.sast",
          "kind": "security",
          "label": "Static security analysis",
          "description": "The bank-approved SAST check is linked to the release.",
          "severity": "required",
          "acceptedStatuses": [
            "passed"
          ]
        },
        "evidence": {
          "id": "ev-sast-4731",
          "kind": "security",
          "requirementIds": [
            "security.sast"
          ],
          "label": "Static analysis",
          "sourceSystem": "SAST",
          "sourceRef": "Scan #4731",
          "result": "Passed",
          "status": "passed",
          "lineage": "derived",
          "observedAt": "2026-08-17T13:11:00+10:00",
          "correlationIds": [
            "8f32e71",
            "RUN-14591"
          ],
          "detail": "Result was obtained through the CI workflow record. The upstream scanner remains authoritative."
        },
        "outcome": "satisfied",
        "reason": "A source-linked record matched the requirement and its observed status.",
        "determinedBy": "deterministic-rule"
      },
      {
        "requirement": {
          "id": "security.dast",
          "kind": "security",
          "label": "Dynamic security analysis",
          "description": "The bank-approved DAST record is linked to the release.",
          "severity": "required",
          "acceptedStatuses": [
            "passed"
          ]
        },
        "outcome": "incomplete",
        "reason": "No source-linked record was matched to this requirement.",
        "determinedBy": "deterministic-rule"
      },
      {
        "requirement": {
          "id": "approval.release",
          "kind": "approval",
          "label": "Authorised release decision",
          "description": "The decision and authority are identifiable.",
          "severity": "required",
          "acceptedStatuses": [
            "observed"
          ]
        },
        "evidence": {
          "id": "ev-approval-1432",
          "kind": "approval",
          "requirementIds": [
            "approval.release"
          ],
          "label": "Release approval",
          "sourceSystem": "ServiceNow",
          "sourceRef": "Decision at 14:32",
          "result": "Approved",
          "status": "observed",
          "lineage": "direct",
          "observedAt": "2026-08-17T14:32:00+10:00",
          "actor": "Release Manager",
          "correlationIds": [
            "CHG-1942",
            "8f32e71"
          ],
          "detail": "The approval record identifies the decision and actor. Authority remains a bank-owned assertion for reviewer confirmation."
        },
        "outcome": "satisfied",
        "reason": "A source-linked record matched the requirement and its observed status.",
        "determinedBy": "deterministic-rule"
      },
      {
        "requirement": {
          "id": "artifact.identity",
          "kind": "artifact",
          "label": "Built artefact identity",
          "description": "The exact built artefact and immutable digest are identifiable.",
          "severity": "required",
          "acceptedStatuses": [
            "observed"
          ]
        },
        "evidence": {
          "id": "ev-artifact-v4172",
          "kind": "artifact",
          "requirementIds": [
            "artifact.identity"
          ],
          "label": "Build artefact",
          "sourceSystem": "Container registry",
          "sourceRef": "payments-api:v4.17.2",
          "result": "Digest recorded",
          "status": "observed",
          "lineage": "direct",
          "observedAt": "2026-08-17T14:40:00+10:00",
          "correlationIds": [
            "8f32e71",
            "sha256:4c01…9ac2"
          ],
          "detail": "Container tag and digest are connected to the source commit by the build record."
        },
        "outcome": "satisfied",
        "reason": "A source-linked record matched the requirement and its observed status.",
        "determinedBy": "deterministic-rule"
      },
      {
        "requirement": {
          "id": "deployment.production",
          "kind": "deployment",
          "label": "Production deployment",
          "description": "The artefact, target and deployment time are connected.",
          "severity": "required",
          "acceptedStatuses": [
            "observed",
            "passed"
          ]
        },
        "evidence": {
          "id": "ev-deploy-prod-1504",
          "kind": "deployment",
          "requirementIds": [
            "deployment.production"
          ],
          "label": "Production deployment",
          "sourceSystem": "Deployment pipeline",
          "sourceRef": "Deploy #7714",
          "result": "Production at 15:04",
          "status": "observed",
          "lineage": "direct",
          "observedAt": "2026-08-17T15:04:00+10:00",
          "actor": "Release automation",
          "correlationIds": [
            "sha256:4c01…9ac2",
            "DEPLOY-7714"
          ],
          "detail": "Deployment target, artefact digest and completed timestamp are linked in the delivery system."
        },
        "outcome": "satisfied",
        "reason": "A source-linked record matched the requirement and its observed status.",
        "determinedBy": "deterministic-rule"
      },
      {
        "requirement": {
          "id": "production.verify",
          "kind": "production",
          "label": "Post-deployment verification",
          "description": "The release is linked to an observed production outcome.",
          "severity": "required",
          "acceptedStatuses": [
            "passed"
          ]
        },
        "evidence": {
          "id": "ev-health-5of5",
          "kind": "production",
          "requirementIds": [
            "production.verify"
          ],
          "label": "Production verification",
          "sourceSystem": "Dynatrace",
          "sourceRef": "Release health window",
          "result": "5 of 5 checks passed",
          "status": "passed",
          "lineage": "derived",
          "observedAt": "2026-08-17T15:19:00+10:00",
          "correlationIds": [
            "DEPLOY-7714",
            "payments-api:v4.17.2"
          ],
          "detail": "The monitoring window is correlated to the deployment. This is an observed outcome, not a guarantee of control effectiveness."
        },
        "outcome": "satisfied",
        "reason": "A source-linked record matched the requirement and its observed status.",
        "determinedBy": "deterministic-rule"
      }
    ]
  },
  "integrity": {
    "algorithm": "SHA-256",
    "canonicalization": "recursively-sorted-json-keys",
    "digest": "d4e6aad2dd9c9e25eed1201a504136a187baf2db2d31d9c48492afb72985abcf",
    "signatureStatus": "unsigned_representative_export",
    "statement": "The digest detects changes to this export envelope. It is not a digital signature, a production seal, or proof of source-system authenticity."
  },
  "limitations": [
    "Representative output — not a live customer artifact.",
    "Source systems remain authoritative.",
    "Missing evidence is unresolved; it is not treated as a failed control.",
    "This prototype does not approve releases or determine APRA compliance."
  ]
}