{
  "schema_valid": true,
  "schema_errors": [],
  "scan_status_complete_for_python": true,
  "python_files_attempted": 243,
  "tracked_python_files": 243,
  "python_file_counts_match": true,
  "zero_failed_or_skipped": true,
  "asset_count": 1804,
  "cbom_count": 1804,
  "risk_count": 1804,
  "asset_cbom_and_risk_ids_match": true,
  "all_source_locations_exist": true,
  "target_commit_recorded": true,
  "repeat_normalized_findings_and_scores_match": true,
  "scope_counts": {
    "test": 1746,
    "example": 12,
    "production": 46
  },
  "algorithm_family_counts_raw": {
    "rsa": 235,
    "sha2": 591,
    "chacha20": 43,
    "aes": 355,
    "hmac": 19,
    "sha1": 174,
    "md5": 28,
    "ecdsa": 339,
    "sha3": 18,
    "ed25519": 1,
    "diffie-hellman": 1
  },
  "unsupported_rust_files": 109,
  "excluded_python_stub_files": 33,
  "limits": [
    "Complete status applies to requested Python files only; no whole-repository or detection-recall claim.",
    "Raw DSA test call at tests/hazmat/primitives/test_dsa.py:113 is mislabeled as Diffie-Hellman.",
    "Imports, curve identifiers and capability checks are included; detections are not deployed vulnerabilities.",
    "Risk enum combines classical hash weaknesses with quantum concerns; scores are not customer impact.",
    "CBOM does not contain a complete dependency graph.",
    "Repeat uses the same machine and environment, not an independent external reproduction."
  ],
  "artifact_hashes_match": true
}