{
  "schema_version": 1,
  "system": "Northstar fictional developer tool",
  "classification": "inert-architecture-packet",
  "trust_boundaries": [
    { "stage": "source", "current_control": "reviewed branch", "gap": "release workflow can select an unreviewed revision", "evidence": "source revision and review record" },
    { "stage": "dependencies", "current_control": "lockfile", "gap": "maintainer and registry changes are not policy events", "evidence": "lockfile, publisher, registry, and exception record" },
    { "stage": "build", "current_control": "ephemeral worker", "gap": "builder identity is not verified at promotion", "evidence": "SLSA 1.2 provenance and subject digest" },
    { "stage": "signing", "current_control": "artifact signature", "gap": "signer authorization is not bound to product and channel", "evidence": "signing identity, workflow, product, channel, and approval" },
    { "stage": "update", "current_control": "signature check in main process", "gap": "download, verification, privilege, health, and rollback are coupled", "evidence": "stage-specific verification and result events" },
    { "stage": "plugins", "current_control": "in-process extension API", "gap": "plugins inherit product authority", "evidence": "plugin identity, declared capability, policy decision, and sensitive operation" }
  ],
  "fictional_release": {
    "version": "4.2.1-course",
    "source_revision": "northstar-course-revision-421",
    "subject_digest": "course-digest-review-421",
    "builder": "northstar-course-builder-b",
    "signer": "Northstar Training Signer B",
    "sbom_format": "SPDX-course-summary",
    "provenance_format": "SLSA-1.2-course-summary",
    "promotion_status": "paused-for-review"
  },
  "acceptance_tests": [
    "A revoked fictional signer cannot authorize a new release.",
    "An unavailable update service leaves the installed known-good version usable.",
    "A failed health check triggers an authorized rollback to an immutable approved digest.",
    "A plugin permission increase requires explicit review and can be disabled independently.",
    "Verification and telemetry failures stop promotion without exposing secrets."
  ]
}