{
  "schema_version": "1.1",
  "pack_id": "sample-eu-ai-act-v1.1",
  "exported_at": "2026-08-02T00:00:00.000Z",
  "workspace_id": "00000000-0000-4000-8000-000000000026",
  "scope": {
    "endpoints": [
      {
        "id": "ep-illustrative-001",
        "provider": "stripe",
        "url_path": "/api/webhooks/stripe",
        "verification": "hmac_sha256"
      }
    ],
    "rotations": [],
    "leaks": [],
    "findings": [
      {
        "id": "finding-stripe-no-verify-001",
        "rule_id": "stripe/no-signature-verification",
        "severity": "critical",
        "file_line": "src/routes/webhooks.ts:42",
        "state": "fixed"
      },
      {
        "id": "finding-github-replay-002",
        "rule_id": "github/missing-replay-protection",
        "severity": "high",
        "file_line": "src/webhooks/github.ts:88",
        "state": "persisting"
      }
    ],
    "audit_log": {
      "rows": [
        {
          "seq": "1",
          "kind": "evidence_pack_exported",
          "payload": {
            "pack_id": "prior-export-000",
            "actor_user_id": "auditor-illustrative"
          },
          "createdAt": "2026-08-01T09:00:00.000Z",
          "hashHex": "769709b1e4c8f290e71098f8b40994aa5e8ea620d96f7bcda3d6739d08eeecfe",
          "prevHashHex": null
        },
        {
          "seq": "2",
          "kind": "rotation_finalized",
          "payload": {
            "rotation_id": "rotation-stripe-whsec-001",
            "provider": "stripe",
            "endpoint": "ep-illustrative-001"
          },
          "createdAt": "2026-08-01T10:15:00.000Z",
          "hashHex": "81796f8d39792194afd536de9956f51bee2c195c6568b7addb055b26ea9f82f2",
          "prevHashHex": "769709b1e4c8f290e71098f8b40994aa5e8ea620d96f7bcda3d6739d08eeecfe"
        },
        {
          "seq": "3",
          "kind": "auditor_token_used",
          "payload": {
            "token_id": "auditor-token-illustrative",
            "page_path": "/auditor/sample"
          },
          "createdAt": "2026-08-01T11:30:00.000Z",
          "hashHex": "4e3109194345d6a9f760a89a7b086ea6e42325cd1b1f8df7ee94da277a816548",
          "prevHashHex": "81796f8d39792194afd536de9956f51bee2c195c6568b7addb055b26ea9f82f2"
        }
      ],
      "signed_batches": []
    }
  },
  "soc2_mapping": {
    "CC6.1": ["leak-aws-key-cloudwatch-001"],
    "CC6.7": ["finding-stripe-no-verify-001", "finding-github-replay-002"],
    "CC7.1": ["rotation-stripe-whsec-001"]
  },
  "iso27001_mapping": {
    "A.5.17": [
      "leak-aws-key-cloudwatch-001",
      "finding-stripe-no-verify-001",
      "finding-github-replay-002"
    ],
    "A.8.24": [
      "rotation-stripe-whsec-001",
      "finding-stripe-no-verify-001",
      "finding-github-replay-002"
    ]
  },
  "eu_ai_act_annex_iii": "high_risk_ai_system",
  "signature": {
    "signing_cmk_arn": "arn:aws:kms:eu-central-1:sample:key/illustrative",
    "signing_algorithm": "ECDSA_SHA_256",
    "manifest_hash_hex": "383a277f9be8f3a82a21e1a74c805508091ce8453c598e30e86b9416abba56f7",
    "signature_der_b64": "MEYCIQCdExkLEZ5RdYDb3Rgum7RRLXWW6Czp3xH4JWKuzPWNlwIhAOvjr4t3cXY7zyouIMCoN7RKF2PngnX8HgWh/Vk5eTYm",
    "signing_public_key_spki_b64": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAtyqkF9tRbZ4HWAF/VbQunybno5kqs2hsQXKu3UszVYT6IImH9HVgcJ5BFnaxLL3MpqAtpraZSLLpBBWd9be3Q=="
  }
}