outcome: PASS

gate: dns

subject: synthetic dns target

scenario: authoritative A/AAAA resolution is present


outcome: FAIL

subject: synthetic dns target

scenario: NXDOMAIN is a direct contradiction


outcome: BLOCKED

subject: synthetic dns target

scenario: resolver timeout is unknown and fails closed


gate: tls

subject: synthetic tls target

scenario: hostname-valid unexpired chain


subject: synthetic tls target

scenario: certificate hostname mismatch


subject: synthetic tls target

scenario: malformed certificate observation timestamp


gate: origin

subject: synthetic origin target

scenario: API route maps to expected origin


subject: synthetic origin target

scenario: route reaches placeholder origin


gate: cors

subject: synthetic cors target

scenario: exact frontend origin receives credentialed allow


subject: synthetic cors target

scenario: wildcard credentialed response rejects


subject: synthetic cors target

scenario: prefix-confusable origin rejects without mutation


gate: csrf

subject: synthetic csrf target

scenario: session-bound token and exact origin accepted


subject: synthetic csrf target

scenario: missing CSRF token rejects without mutation


subject: synthetic csrf target

scenario: replayed stale token rejects


gate: runtime

subject: synthetic runtime target

scenario: isolated worker runtime matches containment floor


subject: synthetic runtime target

scenario: unreadable cgroup counter vetoes readiness


subject: synthetic runtime target

scenario: converter environment contains only secret names evidence


gate: database

subject: synthetic database target

scenario: platform DB adapter connectivity succeeds


subject: synthetic database target

scenario: direct database client bypasses platform package


subject: synthetic database target

scenario: connectivity permission unavailable


subject: synthetic private-s3 target

scenario: private encrypted bucket and lifecycle paths verified


subject: synthetic private-s3 target

scenario: anonymous object read succeeds


subject: synthetic private-s3 target

scenario: lifecycle inspection access denied


gate: stripe-tax

subject: synthetic stripe-tax target

scenario: configured launch jurisdiction calculates tax


subject: synthetic stripe-tax target

scenario: tax disabled in launch jurisdiction


subject: synthetic stripe-tax target

scenario: duplicate provider event has one durable effect


gate: platform-package

subject: synthetic platform-package target

scenario: required platform packages are verified


subject: synthetic platform-package target

scenario: consumer React seam remains unverified


gate: health

subject: synthetic health target

scenario: liveness reports process alive without dependency claim


subject: synthetic health target

scenario: health body is unavailable despite transport success


evidence:
mandatory_failed: actual=0; expected=0
mandatory_blocked: actual=0; expected=0

gate: readiness

subject: synthetic readiness target

scenario: all mandatory dependency gates pass


subject: synthetic readiness target

scenario: one blocked dependency blocks readiness


subject: synthetic readiness target

scenario: stale PASS evidence cannot establish readiness


gate: rollback

subject: synthetic rollback target

scenario: rollback restores prior digest and passes readiness


subject: synthetic rollback target

scenario: rollback digest differs from approved target


evidence:
event_attempt: actual=1; expected=2
state_mutations: actual=0; expected=0

subject: synthetic rollback target

scenario: late completion from superseded rollback attempt is ignored


gate: sbom

subject: synthetic sbom target

scenario: nonempty CycloneDX SBOM binds deployed image


subject: synthetic sbom target

scenario: empty SBOM blocks deployment


gate: provenance

subject: synthetic provenance target

scenario: verified provenance binds source builder materials and output


subject: synthetic provenance target

scenario: provenance output digest mismatches image


subject: synthetic provenance target

scenario: unsigned provenance fails closed


gate: vulnerability

subject: synthetic vulnerability target

scenario: fresh scan has no blocked findings


evidence:
blocked_findings: actual=1; expected=0
valid_exceptions: actual=0; expected=1

subject: synthetic vulnerability target

scenario: blocked critical finding has no exception


subject: synthetic vulnerability target

scenario: expired exception cannot waive finding


subject: synthetic vulnerability target

scenario: duplicate scan report is idempotently ignored