{
  "sdk": "affixio",
  "version": "2.0.4",
  "tested_at": "2026-10-26T10:14:58.086Z",
  "scope": "Isolated local signing, pinned-key verification, replay guard and single-host spend journal helpers with synthetic data. Fetch disabled. Not a payment, deployment or security certification.",
  "tests": [
    {
      "name": "Pinned-key local ML-DSA-65 signature verifies",
      "passed": true
    },
    {
      "name": "Changed payload is rejected",
      "passed": true
    },
    {
      "name": "Wrong trusted key is rejected",
      "passed": true
    },
    {
      "name": "Embedded key alone is not trusted",
      "passed": true
    },
    {
      "name": "Locally known revoked key is rejected",
      "passed": true
    },
    {
      "name": "First replay ID accepted",
      "passed": true
    },
    {
      "name": "Repeated replay ID rejected",
      "passed": true
    },
    {
      "name": "Expired replay timestamp rejected",
      "passed": true
    },
    {
      "name": "First local use admitted",
      "passed": true
    },
    {
      "name": "Second local use refused",
      "passed": true
    },
    {
      "name": "Local spend journal integrity passes",
      "passed": true
    }
  ]
}