{"schemaVersion":1,"reportPath":"/reports/9a5615c8-ec6c-4b1f-8817-d5febb04890c","status":{"id":"9a5615c8-ec6c-4b1f-8817-d5febb04890c","scanId":"bbb4c8bd-22bf-4bea-a51e-68658a3bef7d","invalidatedAt":null,"invalidationReason":null,"replacedBy":null,"snapshotAvailable":true,"policyAllowed":true,"createdAt":"2026-10-12T22:55:56.423Z","observationRevision":0,"previousScanId":null,"previousReportId":null,"current":true},"summary":{"id":"9a5615c8-ec6c-4b1f-8817-d5febb04890c","scanId":"bbb4c8bd-22bf-4bea-a51e-68658a3bef7d","artifact":{"name":"express","version":"5.3.0","integrity":"sha512-qCqy1xSoaugxOD4IVHb1ZWdkvCF2W3aE2okKouWj8VwJ+ztskSiXoBnCSJqfKT+cVPJhuJqe9YLbY425+Zh00g==","tarballUrl":"https://registry.npmjs.org/express/-/express-5.3.0.tgz"},"observedAt":"2026-10-12T22:55:54.595Z","classifiedAt":"2026-10-12T22:55:56.429Z","classifierRevision":"classifier_v3","matrix":{"id":"8b9775d8-5acc-4186-a456-b008ad7a2ffa","revision":"production_2db44d825b68aeb5839111e38b0ad23c","platform":"linux_amd64_glibc","harnessRevision":"load_v2","planRevision":"explicit_exports_v1","policyRevision":"runtime_limits_v2","images":[{"profileId":"node_24_21_0","kind":"node","version":"24.21.0","imageId":"sha256:12a6a4db05cc9f4f55fe7e4731983c5476658c748b722cac3332c4bfc986c2f1","builtAt":"2026-10-04T15:20:38.392Z","sourceImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"node_26_10_0","kind":"node","version":"26.10.0","imageId":"sha256:8cef3b37b8edb5af9da80cb7416bd2c8b35b87fea1bc72c9abbb204ee000bd9c","builtAt":"2026-10-04T15:20:47.161Z","sourceImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"bun_1_4_2","kind":"bun","version":"1.4.2","imageId":"sha256:6d19a3cc65d5015ba20193b7610af27ad603eed4ea29caf4dd4ccc04ad5ca7ef","builtAt":"2026-10-04T15:21:07.160Z","sourceImage":"oven/bun:1.4.2-debian@sha256:53710ce0f14eef8312521c586a7ae1d9aeab4011840f09f1966073b68fc2e2ab","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"deno_2_9_7","kind":"deno","version":"2.9.7","imageId":"sha256:1a5c5f412e04bff71a674b122f4216fac988b0fddc9d36be588224490adc292e","builtAt":"2026-10-04T15:21:22.570Z","sourceImage":"denoland/deno:debian-2.9.7@sha256:869d374bdaddda4fde029c492d7219199b0e821c2c53cca5357b3a6f5b9336fc","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"}]},"outcome":"pass","evidenceLevel":"smoke_tested","coverageComplete":true,"limitations":["Only installation and loading were observed; functional correctness and package safety are not established.","Subpath batches share module caches and globals; root modes use separate fresh sandboxes.","Package-visible harness observations can be tampered with. They are not adversarial attestation.","Evidence applies to these exact artifacts, dependency snapshot, runtime images and Linux amd64/glibc policy.","Runtime error codes are captured observations and can also be thrown by package code."],"preparation":{"id":"21d048b7-469b-4cb7-a52a-a165cc84539b","outcome":"pass","failure":null,"profileRevision":"npm_11_19_0_linux_amd64_v2","snapshot":{"id":"b9c2130e-9708-48da-9f1b-97697f9e6155","generation":"48618c60-d1e9-4469-b4d8-ae0014b13cec","lockDigest":"cb9036b55b12736f412e2c1741b269434ae21b856724619ad80af3285e96b7d7","treeDigest":"b730b4bea70d400fa5de829242a1c80583d724cd4a9b58deeaa41616f26b5d11","profileRevision":"npm_11_19_0_linux_amd64_v2","installerImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7"},"installedCount":65,"omittedOptionalCount":0},"omissions":{"counts":{"pattern":0,"non_executable":0,"not_exported":0,"invalid_subpath":0,"coverage_limit":0},"samples":[]},"cells":[{"runId":"d3afce7c-5f24-407d-8cfa-1f053814ade8","profileId":"node_24_21_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":445.9076000000059,"failure":null},{"runId":"df1d0b5c-41f1-4ab1-ab8a-0fc57392a8e7","profileId":"node_24_21_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":453.38773899999796,"failure":null},{"runId":"2e1433d4-da6c-4427-b817-0aecb353fbed","profileId":"node_24_21_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null},{"runId":"3210a7fe-a7ce-4b29-aa14-784df279e9c7","profileId":"node_24_21_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null},{"runId":"4721504c-55c1-44f8-94f4-0541459709d5","profileId":"node_26_10_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":439.20356699998956,"failure":null},{"runId":"243d8fef-32c3-4e44-a783-94026cfefdf9","profileId":"node_26_10_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":420.808526000008,"failure":null},{"runId":"9f016f8f-c1f7-417b-a632-9d739fd98b4f","profileId":"node_26_10_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null},{"runId":"682c4da9-04a5-4634-90d5-f142e3f3aec1","profileId":"node_26_10_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null},{"runId":"ab9c5b67-e7ed-47a0-9c68-d53c31b79487","profileId":"bun_1_4_2","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":465.5188879999914,"failure":null},{"runId":"43e03d34-2114-4138-ae46-0d07fa9f45b5","profileId":"bun_1_4_2","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":440.96327599999495,"failure":null},{"runId":"f6d66c17-7628-4ec3-81f6-090f6ea73549","profileId":"bun_1_4_2","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null},{"runId":"63ce1658-3f3b-4c18-8291-5c002745d249","profileId":"bun_1_4_2","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null},{"runId":"33f0b7ea-95bd-42a0-8fcd-0b466cecbd87","profileId":"deno_2_9_7","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":628.6644320000196,"failure":null},{"runId":"c7bf4909-8b13-493d-947b-3c4e17b75c19","profileId":"deno_2_9_7","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":615.3829430000042,"failure":null},{"runId":"188513ee-a360-4684-b87a-36fb297dde3e","profileId":"deno_2_9_7","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null},{"runId":"79853afe-5126-4b01-8f03-7a37ea83f451","profileId":"deno_2_9_7","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null}],"runtimes":[{"profileId":"node_24_21_0","outcome":"pass"},{"profileId":"node_26_10_0","outcome":"pass"},{"profileId":"bun_1_4_2","outcome":"pass"},{"profileId":"deno_2_9_7","outcome":"pass"}],"missingOptionalPeers":[],"missingOptionalPeersTruncated":false}}