{
  "verdict": "PASS",
  "gate": "check-web-readonly --hosted (tools/check-web-hosted.ts)",
  "checkedAt": "2026-10-22T12:50:12.963Z",
  "commit": "db378bcdbdda905b91c7b9dd76797bf08dff3fc2",
  "controls": 70,
  "files": 20,
  "outputDigest": "35dd93f250a2209cec43766bb809d8a53d124cb04caa8ebe62bc1ab035e02200",
  "perFile": {
    "config.json": "6660ba99280eb6b8b8e9995f7431e43f27a6b9d86dd991a69ed818cbd2255100",
    "static/assets/capabilities-64Kv7Z2T.js": "a8c1bbe049c53907edee50e0a8be4bc52da31739a7a95cf4b56952dd0d686459",
    "static/assets/custody-DqLvoD_H.js": "61400d7116e230e64407279f0b3dd8f08afb0a0f5fe9f84ea79adb39d0efe412",
    "static/assets/Diagrams-osMXfXz1.js": "f272096063b0e9855f00f601397db7ce6dddf29ee27b17cb1139ce7588fec70a",
    "static/assets/how-it-works-C-dmzrIS.js": "c1993cbdfa5c96d503f7477fb3ad9675540d857d264c8dbfbf85321e9a8d259f",
    "static/assets/index-BCpqtRDk.js": "c96689897e300eb6c89d6b429ccf4832e8521a25bcade5582c6fbe174e04e18b",
    "static/assets/issuer-DUm4sSlb.js": "2818d85b5cae6751ef61e995c69bd3d3bee7f83553a4ad221ea4d62b37c30590",
    "static/assets/LedgerReading-Cfq-d5xp.js": "9af7adda79570e64e3db5d2c4ca1c57035b1b2623c5be897eb4fe368d9874ea8",
    "static/assets/observer-D398amAi.js": "7e45cb92e90e83767c9355b94f1cbe0de6c692b845cbb9ee40f170002c246ab5",
    "static/assets/routes-D0V2ntZo.js": "112cdb368c2d87a4f09216dfd6998763b63f8f2ba37704765d8919e4d77ffbd9",
    "static/assets/styles-B_rDWS2l.css": "c2df22c18740f4d54138691c0fab77b18e2701ca8813557678d0ae2020b7e4e3",
    "static/assets/wallet-mxt6HQru.js": "7a46f0ab09d507c7ea440b3eb37e2c692a350f15d85afd010554ffee086bb6ce",
    "static/capabilities/index.html": "ee2697917c20b9a4e7be4171fb428962372d66229062bb2c0391f01dcc06f470",
    "static/custody/index.html": "469610873d7032304f621d775d6d78df5dfeafcfe808f74f3983114fcebdaffe",
    "static/how-it-works/index.html": "03a7017a5663670fcbd8a8e7113b1d5cd0a6bd2723dd232f8f418df97f0d2191",
    "static/index.html": "299f208c8113f536a79888b57cc7540b61ec93621a2eabfaedee1b8787cc034c",
    "static/issuer/index.html": "71c086bfbeeeb3b5e540c1b0075585fe8a5b24f9c05363cb7de6863d4dce7e36",
    "static/observer/index.html": "912531112c9039d411abf53d18b72bf7a3a93396dc319719a731a466bee84baa",
    "static/third-party-licenses.txt": "4418cf3aa788a8137aa32fc2614b6624fe718ba71b7a4228fd80b46bded3cec7",
    "static/wallet/index.html": "222254f5d9d14f40b5dac8eab601dbb617e409131a4174ce749e3ca5719ba51c"
  },
  "doesNotCheck": [
    "1. EGRESS. It reads files; what a visitor's browser sends is not in them. The policy's connect-src 'self' is checked as written, not as a browser enforces it.",
    "2. The SERVED bytes and headers. It checks the output before upload; step 7 of web/hosted/README.md compares the deployed site with gate-verdict.json, and that comparison detects a change at the moment it runs, nothing later.",
    "3. The BUILD MACHINE. An inventory of the output cannot show that the build never read a private store, or that every file came from the named commit; the isolated build and its tree check are what address that.",
    "4. Whether the PROSE is true. Wording is claims-check's and the wording tests' question; this gate checks that the ruled D-H2 sentences are present, not that every other sentence is right.",
    "5. Anything a script asks a visitor for after hydration, by a form control or a dialog such as prompt(). The check reads the prerendered HTML; React's DOM code names input elements internally, so the bundle cannot be read for them.",
    "6. A decryption routine under a name it does not list. It forbids WebAssembly, the named mpt-crypto and ElGamal identifiers and any cryptography package in the licence list, which is a named set.",
    "7. A package inlined without its module path. The licence list is collected from the module graph the build reported, and the gate requires that list to equal the admitted set.",
    "8. A ledger value on a page outside /observer and /issuer is found only if it is a ciphertext, a 64-hex value, a classic or X-address, an issuance ID or a marked value, read in the source, decoded, and with tags removed; a figure written as prose is not.",
    "9. NO ISSUER FIGURE (D-H3): the build container holds no key, so no figure can be computed. This gate refuses a number in the same clause after 'decrypt' or 'plaintext', or followed by a parenthetical naming either, on any page. That is a pattern, not an understanding of the sentence: a figure phrased another way is prose, and code that runs during the build could write one (item 3).",
    "10. A link into the repository that a script assembles at run time. This gate reads files and finds a literal in any of them; the browser check reads the links each page renders. A URL a script uses without rendering it as a link is seen by neither."
  ]
}