{
  "documentType": "codex-security.scan-manifest",
  "scan": {
    "artifacts": [
      {
        "mediaType": "application/json",
        "path": "findings.json",
        "sha256": "a475d1baebf8e1208b1b7c7df70e2dcc0871fb08c6cbb9f872ff099812b0bfa2"
      },
      {
        "mediaType": "application/json",
        "path": "coverage.json",
        "sha256": "46e16d98f28591153e84d0bcc4353e43c8431297adca20303e2a6e8d712be791"
      },
      {
        "mediaType": "application/octet-stream",
        "path": "artifacts/02_discovery/candidate_ledger.jsonl",
        "sha256": "c4122f31b3fcd81672ddd6f18420f35b3566f6735d92fb7263f1224be8b90c25"
      },
      {
        "mediaType": "application/octet-stream",
        "path": "artifacts/02_discovery/inventory_summary.json",
        "sha256": "c45672697af5751a7d7fa4fd0010bce932780666d4017ee50a3cd832559e495a"
      },
      {
        "mediaType": "application/octet-stream",
        "path": "artifacts/02_discovery/work_ledger.jsonl",
        "sha256": "b7b2ff94436433b242d4d7ff9ddb02b0c72d55bbf7afbbc52e68e198ad744617"
      }
    ],
    "completedAt": "2026-07-29T03:01:03.286860Z",
    "coverageRef": "coverage.json",
    "findingsRef": "findings.json",
    "id": "45fc7c79-225a-4c49-a5d0-2d456346a5f5",
    "producer": {
      "name": "codex-security-plugin",
      "version": "0.1.14"
    },
    "scope": {
      "artifactsReviewed": [
        "artifacts/01_context/threat_model.md",
        "artifacts/02_discovery/in_scope_files.txt",
        "artifacts/02_discovery/work_ledger.jsonl",
        "artifacts/02_discovery/candidate_ledger.jsonl"
      ],
      "context": "Continuation of the 2026-06-24 Codex Security review. Code remained local/Codeup and was not uploaded to GitHub or modified.",
      "excludePaths": [],
      "includePaths": [
        "."
      ],
      "limitations": [
        "No authorized production ingress, reverse-proxy, database-schema, or live OAuth/callback test was performed.",
        "Binary and non-UTF8 files were fully byte-read and inventoried but not semantically decoded.",
        "Dependency advisory resolution was not performed against a current package advisory service."
      ],
      "runtimeStatus": "Static validation only; no production endpoint, credential, payment, database mutation, or external callback was exercised.",
      "summary": "Standard repository scan of the immutable local ai_api Git revision from the authorized Codeup/local workflow. All 6,288 tracked files were inventoried and read; security-relevant first-party surfaces received source/control/sink review.",
      "validationMode": "Large internal repository static source-control-sink trace with explicit deployment proof gaps."
    },
    "sealedAt": "2026-07-29T03:01:03.286860Z",
    "startedAt": "2026-07-29T02:40:25.389801Z",
    "status": "completed",
    "target": {
      "displayName": "ai_api",
      "kind": "git_revision",
      "revision": "a782c32b3a1c823e4f803ca07137187fbd2d32cb",
      "targetId": "target_sha256_45649abc0fb1796e90962e6b91b69d3dc30f656eb9aa20d048dd4165f65a078c"
    },
    "threatModel": {
      "assets": [
        "User identities and bearer tokens",
        "Orders, balances, refunds, settlement and payment state",
        "Biometric templates and face synchronization data",
        "Health, examination, and weight records",
        "Tenant, school, store, merchant, and device ownership",
        "Runtime and third-party credentials"
      ],
      "assumptions": [
        "Deployment may add controls not represented in the repository; these are recorded as proof gaps rather than assumed.",
        "Missing allowlists, credentials, or mappings must not weaken enforcement.",
        "A valid identifier alone is not sufficient device, bank-user, or object authorization."
      ],
      "attackerCapabilities": [
        "Send crafted HTTP parameters, headers, JSON, files, and concurrent requests",
        "Possess a low-privilege user or terminal account",
        "Know or enumerate business and device identifiers",
        "Read a repository clone or application logs when granted access"
      ],
      "securityObjectives": [
        "Authenticate callback, device, and bank identity boundaries",
        "Enforce tenant, owner, role, and object authorization",
        "Keep configuration controls fail-closed",
        "Protect credentials, biometric data, health data, and payment state",
        "Make payment and import workflows atomic and replay-safe"
      ],
      "summary": "The service processes payments, orders, balances, tenant data, biometric material, health records, device traffic, and third-party callbacks across public API, merchant, terminal, persistence, and vendor trust boundaries.",
      "trustBoundaries": [
        "Internet or untrusted client to API routes",
        "Authenticated user to privileged business action",
        "Terminal or device to server",
        "Third-party callback to trusted persistence",
        "Application to database, cache, queue, storage, and logs",
        "Operator configuration to runtime enforcement"
      ]
    }
  },
  "schemaVersion": "1.0"
}