{
  "codes": {
    "BONUS_WITNESS_OPTIONAL": {
      "remediation": "No action required. If you want the bonus signal, add a witness signature under *.sig/witness/ and publish the witness public key under /trust/witnesses/**/pgp.asc.",
      "severity": "INFO",
      "summary": "Witness countersign not present (optional bonus signal)."
    },
    "BONUS_WITNESS_PRESENT": {
      "remediation": "No action required. This is an optional bonus signal.",
      "severity": "INFO",
      "summary": "Witness countersign present (optional bonus signal)."
    },
    "CREATED_PART_BUCKETS": {
      "component": "shared",
      "remediation": [
        "Review the tool output for details."
      ],
      "severity": "INFO",
      "summary": "Created Part Buckets"
    },
    "CREATED_STATUS_RECORD_PARTS": {
      "component": "shared",
      "remediation": [
        "Review the tool output for details."
      ],
      "severity": "INFO",
      "summary": "Created Status Record Parts"
    },
    "FAIL_ALIAS_MISMATCH": {
      "component": "procurement_gate",
      "remediation": [
        "Update both alias and canonical so they are byte-identical (sha256 match)."
      ],
      "severity": "FAIL",
      "summary": "Alias file is not byte-identical to its canonical target."
    },
    "FAIL_ANCHOR_RECEIPT_INVALID": {
      "component": "bonus_signals",
      "remediation": [
        "Verify bundle sha256 matches receipt.anchor.bundle_sha256.",
        "Ensure receipt.anchor.entry_url is present and points to the external transparency entry.",
        "Detached-sign the receipt with the deploy_txn role keyring and publish receipt .asc."
      ],
      "severity": "FAIL",
      "summary": "Anchoring receipt marked anchored, but receipt/bundle/receipt-signature is invalid."
    },
    "FAIL_BAD_FPR": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Bad Fpr"
    },
    "FAIL_BAD_PROD_FEED": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Bad Prod Feed"
    },
    "FAIL_DEMO_SIGNATURE_INVALID": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Demo Signature Invalid"
    },
    "FAIL_DEPLOY_TXN_POINTER_INVALID": {
      "component": "procurement_gate",
      "remediation": [
        "Re-generate deploy txn pointer and ensure it matches the latest deploy txn record."
      ],
      "severity": "FAIL",
      "summary": "Deploy transaction pointer is invalid or inconsistent."
    },
    "FAIL_DEPLOY_TXN_POINTER_PARSE": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Deploy Txn Pointer Parse"
    },
    "FAIL_DSSE_INVALID_JSON": {
      "component": "procurement_gate",
      "remediation": [
        "Ensure DSSE file is valid JSON with a 'payload' field."
      ],
      "severity": "FAIL",
      "summary": "A DSSE envelope JSON is invalid/unreadable."
    },
    "FAIL_DSSE_PAYLOAD_DECODE": {
      "component": "procurement_gate",
      "remediation": [
        "Ensure DSSE payload is base64url without padding and decodes to valid JSON."
      ],
      "severity": "FAIL",
      "summary": "DSSE payload cannot be base64url-decoded or parsed as JSON."
    },
    "FAIL_DSSE_SUBJECT_MISMATCH": {
      "component": "procurement_gate",
      "remediation": [
        "Re-generate the DSSE envelope so subject.digest.sha256 and subject.bytes match the referenced file bytes."
      ],
      "severity": "FAIL",
      "summary": "DSSE subject digest/bytes do not match the referenced artifact."
    },
    "FAIL_GPG_MISSING": {
      "component": "bonus_signals",
      "remediation": [
        "Install gpg in the CI runner environment (e.g., apt-get install -y gnupg)."
      ],
      "severity": "FAIL",
      "summary": "gpg is missing; signature verification cannot run."
    },
    "FAIL_GPG_SIGNER_MISMATCH": {
      "component": "procurement_gate",
      "remediation": [
        "Verify you are using the correct role key (deploy_txn vs site_release).",
        "Update trust descriptor fingerprints only via a proper key ceremony/rollover."
      ],
      "severity": "FAIL",
      "summary": "Signature verified but signer fingerprint does not match expected role/policy."
    },
    "FAIL_GPG_VERIFY": {
      "component": "procurement_gate",
      "remediation": [
        "Ensure the signature is valid and the correct public keyring is available to gpg."
      ],
      "severity": "FAIL",
      "summary": "Detached signature verification failed."
    },
    "FAIL_INTEGRITY_MISMATCH": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Integrity Mismatch"
    },
    "FAIL_INTERNAL_DRIFT": {
      "component": "ci_integrity",
      "remediation": [
        "Run the tool with --apply to update deterministic pointers/aggregates.",
        "If artifacts are signed/pinned, re-cut + re-sign as required."
      ],
      "severity": "FAIL",
      "summary": "Tool detected drift/inconsistency that requires running with --apply or re-cutting artifacts."
    },
    "FAIL_MIRROR_DRIFT": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Mirror Drift"
    },
    "FAIL_MISSING_DEPLOY_FPR": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Missing Deploy Fpr"
    },
    "FAIL_MISSING_DEPLOY_TXN_POINTER": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Missing Deploy Txn Pointer"
    },
    "FAIL_MISSING_EVIDENCE_BUNDLE": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Missing Evidence Bundle"
    },
    "FAIL_MISSING_POLICY_EVIDENCE_DSSE": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Missing Policy Evidence Dsse"
    },
    "FAIL_MISSING_POLICY_EVIDENCE_DSSE_TRUST": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Missing Policy Evidence Dsse Trust"
    },
    "FAIL_MISSING_POLICY_EVIDENCE_INDEX": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Missing Policy Evidence Index"
    },
    "FAIL_MISSING_PROD_FEED": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Missing Prod Feed"
    },
    "FAIL_MISSING_RELEASE_FPR_ACTIVE": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Missing Release Fpr Active"
    },
    "FAIL_MISSING_ROOT_FPRS": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Missing Root Fprs"
    },
    "FAIL_MISSING_TRUST_PROD": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Missing Trust Prod"
    },
    "FAIL_MISSING_WK_DSSE": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Missing Wk Dsse"
    },
    "FAIL_ONE_INPUT_CONTRACT_INVALID": {
      "component": "procurement_gate",
      "remediation": [
        "Ensure required fields exist and are not null; see procurement one-pager for required contract fields."
      ],
      "severity": "FAIL",
      "summary": "One-input contract schema is invalid or violates required fields."
    },
    "FAIL_POINTER_DIGEST_MISMATCH": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Pointer Digest Mismatch"
    },
    "FAIL_POINTER_EXPIRED": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Pointer Expired"
    },
    "FAIL_POINTER_EXPIRES_MALFORMED": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Pointer Expires Malformed"
    },
    "FAIL_POINTER_SEQUENCE_MISMATCH": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Pointer Sequence Mismatch"
    },
    "FAIL_POLICY_EVIDENCE_DSSE_DRIFT": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Policy Evidence Dsse Drift"
    },
    "FAIL_POLICY_EVIDENCE_DSSE_PARSE": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Policy Evidence Dsse Parse"
    },
    "FAIL_POLICY_EVIDENCE_INDEX_DIGEST_MISMATCH": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Policy Evidence Index Digest Mismatch"
    },
    "FAIL_POLICY_EVIDENCE_POINTER_UPDATE": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Policy Evidence Pointer Update"
    },
    "FAIL_REASON_CODE_UNKNOWN": {
      "component": "reason_codes",
      "remediation": [
        "Update /trust/reason-codes/reason_codes.json to include the missing code, or stop emitting it.",
        "In CI, treat this as internal drift: do not merge until fixed."
      ],
      "severity": "FAIL",
      "summary": "A tool emitted a reason code that is not present in the canonical reason_codes.json registry."
    },
    "FAIL_ROLLBACK_DETECTED_CHAIN_BREAK": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Rollback Detected Chain Break"
    },
    "FAIL_ROLLBACK_DETECTED_SEQUENCE": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Rollback Detected Sequence"
    },
    "FAIL_SCITT_EXPORT_MISMATCH": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Scitt Export Mismatch"
    },
    "FAIL_SEQUENCE_INVALID": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Sequence Invalid"
    },
    "FAIL_SIGNATURE_INVALID": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Signature Invalid"
    },
    "FAIL_SIGNATURE_MIRROR_DRIFT": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Signature Mirror Drift"
    },
    "FAIL_SIGNATURE_WRONG_KEY": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Signature Wrong Key"
    },
    "FAIL_SITE_RELEASE_STATUS_INVALID": {
      "component": "procurement_gate",
      "remediation": [
        "Re-cut + re-sign site-release status artifact and ensure pointers reference the correct status file."
      ],
      "severity": "FAIL",
      "summary": "Site-release status artifact is invalid or inconsistent with pointers."
    },
    "FAIL_SITE_ROOT_NOT_FOUND": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Site Root Not Found"
    },
    "FAIL_STATUS_AGGREGATE_PARSE": {
      "component": "bonus_signals",
      "remediation": [
        "Ensure trust/status/MVG_STATUS_AGGREGATE_<MODE>_LATEST.json exists and is valid JSON."
      ],
      "severity": "FAIL",
      "summary": "Status aggregate missing or unparsable."
    },
    "FAIL_STATUS_POINTER_PARSE": {
      "component": "bonus_signals",
      "remediation": [
        "Ensure /.well-known/mvg-status.<mode>.dsse.json exists and contains a DSSE envelope with a decodable payload."
      ],
      "severity": "FAIL",
      "summary": "Status DSSE pointer missing or unparsable."
    },
    "FAIL_SUBPROCESS": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Subprocess"
    },
    "FAIL_TICKET_PACK_ZIP_SHA_MISMATCH": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Ticket Pack Zip Sha Mismatch"
    },
    "FAIL_VERIFIER_FAILED": {
      "component": "shared",
      "remediation": [
        "Fix the underlying issue and rerun the tool/gate. This is a hard failure.",
        "If this is unexpected drift, recut/rebuild the relevant artifacts and verify again."
      ],
      "severity": "FAIL",
      "summary": "Fail Verifier Failed"
    },
    "FAIL_WELLKNOWN_DRIFT": {
      "component": "procurement_gate",
      "remediation": [
        "Make the two paths byte-identical or redirect one to the other without rewriting content."
      ],
      "severity": "FAIL",
      "summary": "/.well-known and /well-known are not byte-identical (drift)."
    },
    "FAIL_WITNESS_KEYRING_MISSING": {
      "remediation": "Publish the witness public key(s) under /trust/witnesses/**/pgp.asc, then re-run gates. If witness countersign is not intended, remove witness signature files under *.sig/witness/.",
      "severity": "FAIL",
      "summary": "Witness signatures exist but the witness keyring is missing or empty."
    },
    "FAIL_WITNESS_SIG_UNVERIFIABLE": {
      "component": "bonus_signals",
      "remediation": "Remove invalid witness signature files under *.sig/witness/. If you intend to use witness countersign, publish the witness public key under /trust/witnesses/**/pgp.asc and ensure detached signatures verify offline.",
      "severity": "FAIL",
      "summary": "Witness countersign artifacts exist but none verify."
    },
    "GO_DEPLOY_TXN_VERIFIED": {
      "component": "shared",
      "remediation": [
        "No action required."
      ],
      "severity": "GO",
      "summary": "Go Deploy Txn Verified"
    },
    "GO_PROD_SIGNED_PIPELINE_COMPLETE": {
      "component": "shared",
      "remediation": [
        "No action required."
      ],
      "severity": "GO",
      "summary": "Go Prod Signed Pipeline Complete"
    },
    "GO_ROLLBACK_GUARD_BOOTSTRAP": {
      "component": "shared",
      "remediation": [
        "No action required."
      ],
      "severity": "GO",
      "summary": "Go Rollback Guard Bootstrap"
    },
    "GO_ROLLBACK_GUARD_OK": {
      "component": "shared",
      "remediation": [
        "No action required."
      ],
      "severity": "GO",
      "summary": "Go Rollback Guard Ok"
    },
    "GO_SCITT_EXPORT_OK": {
      "component": "shared",
      "remediation": [
        "No action required."
      ],
      "severity": "GO",
      "summary": "Go Scitt Export Ok"
    },
    "GO_TICKET_PACK_VERIFIED": {
      "component": "shared",
      "remediation": [
        "No action required."
      ],
      "severity": "GO",
      "summary": "Go Ticket Pack Verified"
    },
    "HOLD_ARTIFACT_HYGIENE_VIOLATION": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Artifact Hygiene Violation"
    },
    "HOLD_BUCKETIZE_GENESIS_HAS_PREV": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Bucketize Genesis Has Prev"
    },
    "HOLD_BUCKETIZE_LATEST_RECORD_DRIFT": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Bucketize Latest Record Drift"
    },
    "HOLD_BUCKETIZE_SEQUENCE_NOT_MONOTONIC": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Bucketize Sequence Not Monotonic"
    },
    "HOLD_CLI_MISSING": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Cli Missing"
    },
    "HOLD_CSP_INLINE_STYLE_ATTR_PRESENT": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Csp Inline Style Attr Present"
    },
    "HOLD_DEPLOY_ROLE_MISSING": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Deploy Role Missing"
    },
    "HOLD_DEPLOY_TXN_POINTER_EXPIRED": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Deploy Txn Pointer Expired"
    },
    "HOLD_GPG_MISSING": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Gpg Missing"
    },
    "HOLD_GPG_NOT_FOUND": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Gpg Not Found"
    },
    "HOLD_GPG_SIGN_FAILED": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Gpg Sign Failed"
    },
    "HOLD_GPG_VERIFY_FAILED": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Gpg Verify Failed"
    },
    "HOLD_GPG_VERIFY_NO_VALIDSIG": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Gpg Verify No Validsig"
    },
    "HOLD_GPG_VERIFY_WRONG_SIGNER": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Gpg Verify Wrong Signer"
    },
    "HOLD_INVALID_BUCKETIZE_RECORD_PATH": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Invalid Bucketize Record Path"
    },
    "HOLD_INVALID_BUCKETIZE_STATUS_JSON": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Invalid Bucketize Status Json"
    },
    "HOLD_INVALID_BUCKETIZE_STATUS_SEQUENCE": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Invalid Bucketize Status Sequence"
    },
    "HOLD_INVALID_PREV_BUCKETIZE_RECORD_JSON": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Invalid Prev Bucketize Record Json"
    },
    "HOLD_KEYRING_IMPORT_FAILED": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Keyring Import Failed"
    },
    "HOLD_KEYRING_MISSING": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Keyring Missing"
    },
    "HOLD_MISSING_BUCKETIZE_RECORD": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Missing Bucketize Record"
    },
    "HOLD_MISSING_BUCKETIZE_STATUS_ARTIFACT": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Missing Bucketize Status Artifact"
    },
    "HOLD_MISSING_DEMO_DSSE_OR_SIG": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Missing Demo Dsse Or Sig"
    },
    "HOLD_MISSING_DEMO_PUBKEY": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Missing Demo Pubkey"
    },
    "HOLD_MISSING_DEPLOY_FPR": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Missing Deploy Fpr"
    },
    "HOLD_MISSING_DEPLOY_PUBKEY": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Missing Deploy Pubkey"
    },
    "HOLD_MISSING_DEPLOY_TXN_POINTER": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Missing Deploy Txn Pointer"
    },
    "HOLD_MISSING_ENV": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Missing Env"
    },
    "HOLD_MISSING_FPR": {
      "component": "procurement_gate",
      "remediation": [
        "Complete key ceremony and publish the pinned fingerprint, or remain in READY_TO_SIGN state."
      ],
      "severity": "HOLD",
      "summary": "Expected signer fingerprint is missing/withheld (ready-to-sign)."
    },
    "HOLD_MISSING_INPUT": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Missing Input"
    },
    "HOLD_MISSING_PREV_BUCKETIZE_RECORD": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Missing Prev Bucketize Record"
    },
    "HOLD_MISSING_PREV_BUCKETIZE_RECORD_FIELDS": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Missing Prev Bucketize Record Fields"
    },
    "HOLD_MISSING_REQUIRED_FILE": {
      "component": "procurement_gate",
      "remediation": [
        "Publish the required file or correct the pointer URL."
      ],
      "severity": "HOLD",
      "summary": "A required artifact file is missing."
    },
    "HOLD_MISSING_SIGNATURE": {
      "component": "procurement_gate",
      "remediation": [
        "Publish the detached signature using the operator-held key, or remain in READY_TO_SIGN state."
      ],
      "severity": "HOLD",
      "summary": "A required signature is missing (ready-to-sign)."
    },
    "HOLD_MISSING_SIG_DEPLOY_TXN_POINTER": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Missing Sig Deploy Txn Pointer"
    },
    "HOLD_MISSING_SIG_POLICY_EVIDENCE_DSSE": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Missing Sig Policy Evidence Dsse"
    },
    "HOLD_MISSING_SNAPSHOTS_ROOT": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Missing Snapshots Root"
    },
    "HOLD_MISSING_TICKET_PACK_INDEX": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Missing Ticket Pack Index"
    },
    "HOLD_ONE_INPUT_CONTRACT_INCOMPLETE": {
      "component": "procurement_gate",
      "remediation": [
        "Populate the missing required fields (deploy pointer, site-release pointer, status aggregator, etc.)."
      ],
      "severity": "HOLD",
      "summary": "One-input contract is incomplete (missing required URLs/pointers)."
    },
    "HOLD_OVER_BUDGET_MONTH_BUCKET": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Over Budget Month Bucket"
    },
    "HOLD_OVER_BUDGET_PART_BUCKET": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Over Budget Part Bucket"
    },
    "HOLD_POINTER_MISSING": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Pointer Missing"
    },
    "HOLD_POINTER_RECORD_PATH_MISSING": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Pointer Record Path Missing"
    },
    "HOLD_POINTER_SEQUENCE_MISSING": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Pointer Sequence Missing"
    },
    "HOLD_POINTER_SIG_INVALID": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Pointer Sig Invalid"
    },
    "HOLD_POINTER_SIG_MISSING": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Pointer Sig Missing"
    },
    "HOLD_POINTER_THRESHOLD_NOT_MET": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Pointer Threshold Not Met"
    },
    "HOLD_POLICY_EVIDENCE_POINTER_EXPIRED": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Policy Evidence Pointer Expired"
    },
    "HOLD_PREV_BUCKETIZE_RECORD_DIGEST_MISMATCH": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Prev Bucketize Record Digest Mismatch"
    },
    "HOLD_PREV_POINTER_DIGEST_MISSING": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Prev Pointer Digest Missing"
    },
    "HOLD_PUBLISHER_FAILED": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Publisher Failed"
    },
    "HOLD_READY_TO_SIGN": {
      "component": "procurement_gate",
      "remediation": [
        "Complete production signing publication to transition HOLD \u2192 GO."
      ],
      "severity": "HOLD",
      "summary": "Artifact is intentionally READY_TO_SIGN (fail-closed)."
    },
    "HOLD_RECORD_MISSING": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Record Missing"
    },
    "HOLD_RECORD_SHA_MISMATCH": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Record Sha Mismatch"
    },
    "HOLD_RECORD_SIG_INVALID": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Record Sig Invalid"
    },
    "HOLD_RECORD_SIG_MISSING": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Record Sig Missing"
    },
    "HOLD_RECORD_THRESHOLD_NOT_MET": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Record Threshold Not Met"
    },
    "HOLD_ROLLBACK_GUARD_CACHE_MISSING": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Rollback Guard Cache Missing"
    },
    "HOLD_SIGNATURES_MISSING": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Signatures Missing"
    },
    "HOLD_SIGNATURE_MISSING": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Signature Missing"
    },
    "HOLD_SITE_ROOT_MISSING": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Site Root Missing"
    },
    "HOLD_SNAPSHOTS_INBOX_NOT_EMPTY": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Snapshots Inbox Not Empty"
    },
    "HOLD_SRI_MISMATCH": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Sri Mismatch"
    },
    "HOLD_STRAY_SNAPSHOT_FILES_IN_ROOT": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Stray Snapshot Files In Root"
    },
    "HOLD_TICKET_PACK_ZIP_MISSING": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Ticket Pack Zip Missing"
    },
    "HOLD_TRUST_DESCRIPTOR_INVALID_JSON": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Trust Descriptor Invalid Json"
    },
    "HOLD_TRUST_DESCRIPTOR_MISSING": {
      "component": "shared",
      "remediation": [
        "This is a fail-closed HOLD. Publish the required signed artifacts and retry.",
        "If this is expected (READY_TO_SIGN), complete the signing ceremony and republish."
      ],
      "severity": "HOLD",
      "summary": "Hold Trust Descriptor Missing"
    },
    "MOVED_NEW_SNAPSHOT_FILES": {
      "component": "shared",
      "remediation": [
        "Review the tool output for details."
      ],
      "severity": "INFO",
      "summary": "Moved New Snapshot Files"
    },
    "REBALANCED_OVERFULL_BUCKETS": {
      "component": "shared",
      "remediation": [
        "Review the tool output for details."
      ],
      "severity": "INFO",
      "summary": "Rebalanced Overfull Buckets"
    }
  },
  "generated_utc": "2026-02-19T18:34:26Z",
  "notes": [
    "Stable reason codes for MVG CI gates / verifiers.",
    "This file is a machine-readable registry. Codes are stable identifiers; messages are short summaries for audit logs.",
    "Severity semantics: GO/HOLD/FAIL are determined by the tool; reason codes explain why.",
    "All MVG CI gates and verifier tools MUST emit only codes present in this registry."
  ],
  "schema": "mvg.reason_codes@1"
}