{
  "schema_id": "mvg.transparency.inclusion_proof@1",
  "schema_version": 1,
  "issued_utc": "2026-03-03T08:56:20Z",
  "root_dsse_url": "/transparency/procurement-ticket-pack/demo/root.dsse.json",
  "log_url": "/transparency/procurement-ticket-pack/demo/log.ndjson",
  "log_sha256": "6bdc98bb683fdc70ab4fc496487fdc35d276b9a98192403bdd7aeabd42032529",
  "root_sha256": "c8967afafff8a5dc1ae207f18515bd1da6a330edb9323d934d244aec8c9c9356",
  "tree_size": 18,
  "leaf_index": 17,
  "leaf_sha256": "e0074aa1cb0c8b16a1e46b5c09a6dc065c6cf12f34c48c89924f097e8a7eaf45",
  "audit_path": [
    "8424c9462e97084c588df088afa52a603ec1e221077f4fdee460f0666f5675c2",
    "174791c18507dd635490a498599abeea6011fd413daaf0d9dd0a3594ddc3f473",
    "61164cbb5af612869d96ed1f544cefa17d012cf1974e5bc351a47f236cb64202",
    "e925e7c0fb9760e72b1661a1ceb524748e69d868193358a51f900ebe96ca8a7b",
    "d5ee521a65211e661d6986176bd02786bcd989b353cdfff10480580c504138b3"
  ],
  "entry": {
    "schema_id": "mvg.transparency.procurement_ticket_pack_chain_entry@2",
    "schema_version": 2,
    "trust_mode": "DEMO",
    "issued_utc": "2026-02-18T08:54:09Z",
    "pointer_url": "/.well-known/mvg-procurement-ticket-pack.demo.dsse.json",
    "subject": {
      "name": "trust/procurement-ticket-pack/MVG_PROCUREMENT_TICKET_PACK_INDEX_DEMO_LATEST.json",
      "sha256": "04da9e7f53b78cc41f786a337b2607e33899ad576c981fff7d9566ef2ee15ed9",
      "bytes": 1373
    },
    "artifacts": {
      "ticket_pack_zip": {
        "path": "/downloads/MVG_Procurement_Ticket_Pack_DEMO_ONE_SHOT_GO_v51.4.zip",
        "sha256": "6602ce117e7aa1b4a6d8b2297e56a823c2098e9eea22e39c0352d7e08abeb47b",
        "bytes": 133522
      },
      "embedded_site_release_verifier_zip": {
        "path_in_ticket_pack": "MVG_Procurement_Ticket_Pack_DEMO_ONE_SHOT_GO_v51.4/verifiers/MVG_Public_SiteRelease_Verifier_v50.4.zip",
        "sha256": "b09aefb479041e862ccdf0272b2919e9d48c92b6e16cb8eb90ad8a1ce30841be",
        "bytes": 6894
      },
      "embedded_site_release_evidence_bundle_zip": {
        "path_in_ticket_pack": "MVG_Procurement_Ticket_Pack_DEMO_ONE_SHOT_GO_v51.4/evidence/MVG_SiteRelease_Evidence_Bundle_MVG-SITE-DEMO-20260218.1.zip",
        "sha256": "baf100181f319cb01a39b806c03134f02aeb19ed708f6ab10e8721d146867640",
        "bytes": 115604
      },
      "security_review_packet_pdf": {
        "path": "/trust/security-review/packet.pdf",
        "sha256": "2f692c53e8499e38ac177cd5d35e0879663924f9cddea23526f43bec1422ce16",
        "bytes": 23205,
        "scope": "PUBLIC_REDACTED"
      },
      "company_descriptor_json": {
        "path": "/.well-known/mvg-company.json",
        "sha256": "33a29cbc4c30c866f305ed8d17f1f1c5b90d9fa000c4f98ccde96312e5f8ae09",
        "bytes": 2100,
        "scope": "PUBLIC"
      },
      "company_descriptor_json_asc": {
        "path": "/.well-known/mvg-company.json.asc",
        "sha256": "813fd5a30f4c15a26095719dcd094083b17c2a3301348c7d85c40fa6e472a3b8",
        "bytes": 228,
        "scope": "PUBLIC"
      },
      "governance_descriptor_json": {
        "path": "/.well-known/mvg-governance.json",
        "sha256": "73a5c8c7a291cca7eb1279f2dc8e0e402f021db4784345433332a73b46c9d9d8",
        "bytes": 3315,
        "scope": "PUBLIC"
      },
      "governance_descriptor_json_asc": {
        "path": "/.well-known/mvg-governance.json.asc",
        "sha256": "4228098fac2e505d26c10f7385c966b6e96db1fe51363dfaabf56988e78026bb",
        "bytes": 228,
        "scope": "PUBLIC"
      },
      "aims_descriptor_json": {
        "path": "/.well-known/mvg-aims.json",
        "sha256": "864ff071239a1895b6679094bb16ec81103247e4ffb017d963df6d4c6f792e06",
        "bytes": 3626,
        "scope": "PUBLIC"
      },
      "aims_descriptor_json_asc": {
        "path": "/.well-known/mvg-aims.json.asc",
        "sha256": "f585668d13bf7f296c08eeea49ccdb83ac3c216b5ce077f4bd2bb2144b969595",
        "bytes": 228,
        "scope": "PUBLIC"
      },
      "safety_ir_descriptor_json": {
        "path": "/.well-known/mvg-safety-ir.json",
        "sha256": "c2782c72f186806d2b9037fe0986ea062c20b2b47d58185b68b14f7bbe3299cf",
        "bytes": 4517,
        "scope": "PUBLIC"
      },
      "safety_ir_descriptor_json_asc": {
        "path": "/.well-known/mvg-safety-ir.json.asc",
        "sha256": "4646b3da59eaf57350a5796facc13f412e21c8d59b5522f492b613210d43fb1e",
        "bytes": 228,
        "scope": "PUBLIC"
      },
      "privacy_policy_pdf": {
        "path": "/legal/privacy/MVG_Privacy_Policy_v1.0.4.pdf",
        "sha256": "c295122df19d087e6530c85c43e4825f22d365ea0b704bcdc3030f9c5ab1d038",
        "bytes": 16204,
        "scope": "PUBLIC"
      },
      "controls_mapping_pdf": {
        "path": "/downloads/controls-mapping/controls_mapping_v1.pdf",
        "sha256": "902f1fd4bd8deeb880cd03cfa0819b40cea12bcdbe9956cf0bc42919e99767cb",
        "bytes": 78219,
        "scope": "PUBLIC"
      },
      "controls_mapping_csv": {
        "path": "/downloads/controls-mapping/controls_mapping_v1.csv",
        "sha256": "2250c1fbb5cc7b5ba04f965ba18d839c36c6580de29f201a771f8509f7ed199f",
        "bytes": 6215,
        "scope": "PUBLIC"
      },
      "controls_mapping_sha256sums": {
        "path": "/downloads/controls-mapping/SHA256SUMS.controls_mapping",
        "sha256": "c7201bcb16386a9e8d0e7c81654420d6ed150a2c3848bbd44ca289d1bb1e2ee1",
        "bytes": 366,
        "scope": "PUBLIC"
      },
      "genai_controls_map_pdf": {
        "path": "/downloads/controls-mapping/owasp_genai_mvg_map_v1.pdf",
        "sha256": "c4f3c8c90ae4910b031826d00fa012551f2aa027a82219649f0d12601fa9677b",
        "bytes": 532100,
        "scope": "PUBLIC"
      },
      "genai_controls_map_csv": {
        "path": "/downloads/controls-mapping/owasp_genai_mvg_map_v1.csv",
        "sha256": "8cdb5acdc8cc3c546df985bf3e6792f3605b7413a638337ce360b8f78358cf09",
        "bytes": 3582,
        "scope": "PUBLIC"
      },
      "genai_controls_map_sha256": {
        "path": "/downloads/controls-mapping/owasp_genai_mvg_map_v1.sha256",
        "sha256": "c185a76fa2618dfbe484a91f869e57f362492899ae4cd70d7692590b264c1c35",
        "bytes": 186,
        "scope": "PUBLIC"
      },
      "advisories_ndjson": {
        "path": "/security/advisories/advisories.ndjson",
        "sha256": "aa56b4327e03a1258392d1628cf1ef49fd34a6a83a8dcd71637ec7669d5d5349",
        "bytes": 391,
        "entries": 1,
        "latest_adv_id": "MVG-ADV-2026-0000",
        "scope": "PUBLIC"
      },
      "advisories_root_dsse": {
        "path": "/security/advisories/advisories.root.dsse.json",
        "sha256": "0be880332883aae6018f5f0bb1ff9edf52581de906a34788f28efa4267aa177f",
        "bytes": 1193,
        "scope": "PUBLIC"
      },
      "advisories_sha256sums": {
        "path": "/security/advisories/SHA256SUMS.advisories",
        "sha256": "80cbe9ae88c277817cca11a554688e798618d8852e0b73ae4b6891ee685de629",
        "bytes": 374,
        "scope": "PUBLIC"
      },
      "advisories_sha256sums_asc": {
        "path": "/security/advisories/SHA256SUMS.advisories.asc",
        "sha256": "08f5436137b22587ff960d22c219e697c0426162dc3653a416b89d7b26020f69",
        "bytes": 228,
        "scope": "PUBLIC"
      }
    },
    "receipts_delta": {
      "company": "unchanged",
      "governance": "unchanged",
      "aims": "unchanged",
      "safety_ir": "unchanged"
    },
    "receipts_changed": [],
    "advisories_delta": {
      "feed": "unchanged",
      "root": "unchanged",
      "manifest": "unchanged",
      "manifest_sig": "unchanged"
    },
    "advisories_changed": []
  }
}