{
  "proposal_id": "SYNC-SCANNER-JSON-DIGEST-20261101",
  "revision": 1,
  "scope": "equivalent JSON serialization of the already-accepted filename-to-exact-lowercase-SHA256 shape; local and receiver profiles identical",
  "candidate_binary_sha256": "d7dbd0ef57312ab9507874bb5fd67c49bef637b6d7dee121e526227307af4bf0",
  "source_change_manifest_sha256": "20e7ded830d575006969db85bda144b179bb886e44ba92947d4790d110131cf0",
  "tests": {
    "local": "12 passed, 37 deselected; pinned real Gitleaks",
    "receiver": "go test -count=1 ./... with pinned real Gitleaks; passed in 150.087s"
  },
  "expected_result": "RApp source-pin and JSON SHA256 manifests pass; actual keys and bare digest secret assignments remain blocked",
  "verification": "same pinned scanner, full receiver suite, negative secret tests, actual blocked blob classified by candidate, native dry-run and receiver rejection/clean probes before any activation",
  "rollback": "restore exact original source revision and prior approved receiver artifact/config; retain failed receipts",
  "cost_estimate_eur": {
    "additional_service_commitment": 0,
    "execution": "existing local compute; native preflight pending"
  },
  "risk_estimate_eur": {
    "status": "requires supervisor valuation before native rollout",
    "scope": "security-profile exception; preserve original narrow filename-extension/lowercase-64-hex constraint, all history traversal and all other detection rules"
  },
  "authority": "not approved; source candidate only, live inventory refused by current ops-mason-builder Kubernetes identity",
  "native_preflight": "required; no privileged changes executed"
}