{
  "timestamp": "2026-10-04T14:48:07.546Z",
  "standard": "OpenSSF Best Practices Badge (Linux Foundation)",
  "leadAuditor": "AgentDelta & AgentControl",
  "target": "http://127.0.0.1:8080",
  "summary": {
    "total": 10,
    "passed": 10,
    "warnings": 0,
    "failed": 0,
    "scorePercent": 100,
    "badgeLevel": "GOLD"
  },
  "criteria": [
    {
      "id": "OSSF-01",
      "title": "Vulnerability Disclosure Policy",
      "status": "PASS",
      "details": "Vulnerability disclosure policy verified at SECURITY.md.",
      "recommendation": null
    },
    {
      "id": "OSSF-02",
      "title": "Software License & Attribution",
      "status": "PASS",
      "details": "Proprietary enterprise healthcare distribution license with third-party attributions.",
      "recommendation": null
    },
    {
      "id": "OSSF-03",
      "title": "Automated Regression Testing & CI Gates",
      "status": "PASS",
      "details": "Automated local UAT verification harness exists (verify-local-uat.ps1).",
      "recommendation": null
    },
    {
      "id": "OSSF-04",
      "title": "Secrets & Credential Hygiene",
      "status": "PASS",
      "details": "No unmasked production keys in repository; environment abstraction enforced.",
      "recommendation": null
    },
    {
      "id": "OSSF-05",
      "title": "Ruling 12D Signed Encounter Immutability Ratchet",
      "status": "PASS",
      "details": "Signed clinical encounter note immutability strictly enforced.",
      "recommendation": null
    },
    {
      "id": "OSSF-06",
      "title": "ADR-009 Multi-Tenant Practice Isolation",
      "status": "PASS",
      "details": "Multi-tenant practice isolation filter active on all endpoints.",
      "recommendation": null
    },
    {
      "id": "OSSF-07",
      "title": "Static Analysis & Type Checking",
      "status": "PASS",
      "details": "Pre-flight strict-JAC compilation enforced via phase0.ps1.",
      "recommendation": null
    },
    {
      "id": "OSSF-08",
      "title": "Cryptographic Transport Security (HSTS & Frame Protection)",
      "status": "PASS",
      "details": "Transport security headers enforced (HSTS, X-Frame-Options).",
      "recommendation": null
    },
    {
      "id": "OSSF-09",
      "title": "Dependency Hygiene & Package Audit",
      "status": "PASS",
      "details": "Containerized execution isolates Java 21, Tomcat 11, and PostgreSQL 16.",
      "recommendation": null
    },
    {
      "id": "OSSF-10",
      "title": "Hermetic Build Provenance & Commit Tracking",
      "status": "PASS",
      "details": "Health endpoint verified (status=healthy).",
      "recommendation": null
    }
  ]
}