{
  "schemaVersion": 1,
  "generatedAt": "2026-07-31T11:04:28.249Z",
  "enhancements": {
    "generatedAt": "2026-07-31T11:04:28.214Z",
    "consoleDepth": 6,
    "rows": [
      {
        "feature": "health.states",
        "expectedState": {
          "ok": true,
          "states": [
            "MA",
            "NJ"
          ]
        },
        "actualState": {
          "ok": true,
          "states": [
            "MA",
            "NJ"
          ]
        },
        "match": true,
        "notes": "GET /health lists regulated states"
      },
      {
        "feature": "check.ma_licensed_nba_totals",
        "expectedState": {
          "allowed": true,
          "status": 200
        },
        "actualState": {
          "allowed": true,
          "status": 200
        },
        "match": true,
        "notes": "demo-ma-licensed straight NBA/totals"
      },
      {
        "feature": "check.nj_unlicensed_block",
        "expectedState": {
          "allowed": false,
          "status": 403
        },
        "actualState": {
          "allowed": false,
          "status": 403
        },
        "match": true,
        "notes": "demo-unlicensed soccer blocked in NJ"
      },
      {
        "feature": "status.ma_licensed_shape",
        "expectedState": {
          "ok": true,
          "state": "MA",
          "licenseStatus": "active",
          "hasLimits": true
        },
        "actualState": {
          "ok": true,
          "state": "MA",
          "licenseStatus": "active",
          "hasLimits": true
        },
        "match": true,
        "notes": "GET /api/compliance/status panel"
      },
      {
        "feature": "identity.agent_key_prefix",
        "expectedState": {
          "method": "prefix_lookup",
          "timing": "constant",
          "prefixLen": 5
        },
        "actualState": {
          "method": "prefix_lookup",
          "timing": "constant",
          "prefixLen": 5
        },
        "match": true,
        "notes": "agent API keys use fixed prefix for O(1) lookup shape"
      },
      {
        "feature": "runtime.deepEquals.strict_vs_loose",
        "expectedState": {
          "loose": true,
          "strict": false,
          "diverges": true
        },
        "actualState": {
          "loose": true,
          "strict": false,
          "diverges": true
        },
        "match": true,
        "notes": "Bun.deepEquals(a,b) true; Bun.deepEquals(a,b,true) false — same as toStrictEqual"
      },
      {
        "feature": "runtime.deepEquals.docs_matrix",
        "expectedState": {
          "ok": true,
          "cases": 6
        },
        "actualState": {
          "ok": true,
          "cases": 6
        },
        "match": true,
        "notes": "docs strict-inequality matrix (undefined, sparse, class vs plain)"
      },
      {
        "feature": "runtime.escapeHTML",
        "expectedState": {
          "hasLt": true,
          "hasAmp": true,
          "hasQuot": true,
          "rawUnsafe": false
        },
        "actualState": {
          "hasLt": true,
          "hasAmp": true,
          "hasQuot": true,
          "rawUnsafe": false
        },
        "match": true,
        "notes": "Bun.escapeHTML for safe HTML report cells"
      }
    ],
    "passed": 8,
    "total": 8,
    "signature": "ff2899a6365fc7a5dc441e6385d918dd7304ebe239bf01ea8bb5934aa05e7a40"
  },
  "shadow": {
    "generatedAt": "2026-07-31T11:04:28.249Z",
    "base": "http://127.0.0.1:61114/",
    "rows": [
      {
        "state": "MA",
        "partner": "demo-ma-licensed",
        "licenseStatus": "active",
        "realAllowed": true,
        "shadowAllowed": true,
        "match": true
      },
      {
        "state": "NJ",
        "partner": "demo-ma-licensed",
        "licenseStatus": null,
        "realAllowed": false,
        "shadowAllowed": false,
        "match": true,
        "reason": "Partner not licensed in NJ"
      },
      {
        "state": "MA",
        "partner": "demo-nj-licensed",
        "licenseStatus": null,
        "realAllowed": false,
        "shadowAllowed": false,
        "match": true,
        "reason": "Partner not licensed in MA"
      },
      {
        "state": "NJ",
        "partner": "demo-nj-licensed",
        "licenseStatus": "active",
        "realAllowed": true,
        "shadowAllowed": true,
        "match": true
      },
      {
        "state": "MA",
        "partner": "demo-dual-licensed",
        "licenseStatus": "active",
        "realAllowed": true,
        "shadowAllowed": true,
        "match": true
      },
      {
        "state": "NJ",
        "partner": "demo-dual-licensed",
        "licenseStatus": "active",
        "realAllowed": true,
        "shadowAllowed": true,
        "match": true
      },
      {
        "state": "MA",
        "partner": "demo-unlicensed",
        "licenseStatus": null,
        "realAllowed": false,
        "shadowAllowed": false,
        "match": true,
        "reason": "Partner not licensed in MA"
      },
      {
        "state": "NJ",
        "partner": "demo-unlicensed",
        "licenseStatus": null,
        "realAllowed": false,
        "shadowAllowed": false,
        "match": true,
        "reason": "Partner not licensed in NJ"
      }
    ],
    "summary": {
      "allow": 4,
      "block": 4,
      "mismatches": 0
    },
    "signature": "50f6317fd12f09c34558f808ebc4a2c10b3a3275f868e24503561ddfe2eefc57",
    "proof": {
      "algorithm": "sha3-256",
      "digest": "50f6317fd12f09c34558f808ebc4a2c10b3a3275f868e24503561ddfe2eefc57",
      "bunVersion": "1.4.0",
      "generatedAt": "2026-07-31T11:04:28.249Z",
      "hmac": "57d8d3b3f0da353186bab38277fab037d35b32e8f95c942e3474bfc826d38be9"
    }
  },
  "geo": {
    "partners": [
      {
        "nodeId": "demo-ma-licensed",
        "stateCode": "MA",
        "age": 28,
        "location": "Boston",
        "zipCode": "02108"
      },
      {
        "nodeId": "demo-nj-licensed",
        "stateCode": "NJ",
        "age": 32,
        "location": "Atlantic City",
        "zipCode": "08401"
      },
      {
        "nodeId": "demo-dual-licensed",
        "stateCode": "MA",
        "age": 40,
        "location": "Cambridge",
        "zipCode": "02139"
      },
      {
        "nodeId": "demo-unlicensed",
        "stateCode": "MA",
        "age": 22,
        "location": "Worcester",
        "zipCode": "01608"
      }
    ]
  },
  "deepAudit": {
    "zipWindow": {
      "ok": true,
      "days": 90,
      "mode": "enriched",
      "totalPlays": 10,
      "inWindowPlays": 4,
      "label": "ZIP 90d window via enriched_at (4/10 plays)"
    },
    "command": "bun run ops:audit:deep"
  },
  "integrity": {
    "scoreHint": "integrity+hmac",
    "proof": {
      "algorithm": "sha3-256",
      "digest": "5d54a92ab65041bef2aef58fd2518f9169be55b79140bd3bf4ca4fa1c24a2fdc",
      "bunVersion": "1.4.0",
      "generatedAt": "2026-07-31T11:04:28.280Z",
      "hmac": "1d93f6f5986974f174783f82ecc6345a9cf0cea8b6104e283067c5829ecf3b73"
    },
    "checks": [
      {
        "id": "enhancements",
        "ok": true,
        "label": "Enhancements 8/8"
      },
      {
        "id": "shadow",
        "ok": true,
        "label": "Shadow mismatches 0"
      },
      {
        "id": "sha3",
        "ok": true,
        "label": "Board integrity sha3-256"
      },
      {
        "id": "hmac",
        "ok": true,
        "label": "HMAC present (REPORT_SIGNING_SECRET)"
      },
      {
        "id": "geo",
        "ok": true,
        "label": "Geo profiles discrete (state/age/location/zip)"
      },
      {
        "id": "zip-window",
        "ok": true,
        "label": "ZIP 90d window via enriched_at (4/10 plays)"
      }
    ]
  },
  "links": {
    "portal": "/portal/compliance/",
    "registryEnhancements": "/registry/compliance-enhancements.json",
    "registryShadow": "/registry/compliance-shadow.json",
    "api": "/api/compliance",
    "deepAudit": "bun run ops:audit:deep"
  },
  "proton": {
    "note": "Bake is offline-safe. Deploy uses vault-injected CLOUDFLARE_API_TOKEN. Report HMAC uses REPORT_SIGNING_SECRET (mintable or pass://factorywager/Report Signing Secret/password when vaulted).",
    "inject": "bun run proton:inject:factorywager:reasonix",
    "bakeVault": "bun run compliance:bake:vault",
    "reportSigning": "bun run vault:gap:mint-local  # REPORT_SIGNING_SECRET · or pass://factorywager/Report Signing Secret/password",
    "vaultMap": "docs/harness/tenants/proton-integration.md"
  }
}