{
  "schemaVersion": 1,
  "asOf": "2026-08-26",
  "classification": "controlled-source-staged",
  "sourceArchitecture": {
    "samlTenantBindingSourceStaged": true,
    "scimUsersProvisioningSourceStaged": true,
    "scimEtagConcurrencySourceStaged": true,
    "identityCanaryProtocolAvailable": true,
    "identityCanaryProductionEnvironmentAllowed": false,
    "identityCanaryMinimumEvidenceArtifacts": 12,
    "samlCrossTenantNegativeProbeRequired": true,
    "samlPlatformAdminNonInheritanceProbeRequired": true,
    "scimCrossTenantTokenIsolationProbeRequired": true,
    "scimMemberViewerPrivilegeCeilingProbeRequired": true,
    "scimStaleEtagNoOverwriteProbeRequired": true,
    "scimConcurrentOldEtagSingleWinnerProbeRequired": true,
    "scimManagedMembershipOnlyDeprovisionProbeRequired": true,
    "samlToScimSameTenantLinkageProbeRequired": true,
    "passwordOauthIdentityClaimDeniedProbeRequired": true,
    "rollbackEvidenceRequired": true
  },
  "runtimeEvidence": {
    "isolatedIdentityCanaryPassed": false,
    "samlProviderRuntimeVerified": false,
    "samlCrossTenantIsolationRuntimeVerified": false,
    "scimProvisioningRuntimeVerified": false,
    "scimCrossTenantIsolationRuntimeVerified": false,
    "scimEtagConcurrencyRuntimeVerified": false,
    "scimDeprovisioningRuntimeVerified": false,
    "samlScimLinkageRuntimeVerified": false,
    "productionSsoVerified": false,
    "productionScimVerified": false
  },
  "claimsBoundary": {
    "oktaProductionVerified": false,
    "entraProductionVerified": false,
    "googleWorkspaceProductionVerified": false,
    "fullScimRfcCertificationClaimed": false,
    "scimGroupsSupported": false,
    "productionIdentitySlaClaimed": false,
    "sourceEvidenceEqualsProductionEvidence": false
  },
  "evidence": [
    "docs/ENTERPRISE_SSO_FOUNDATION_V1.md",
    "docs/ENTERPRISE_SSO_TENANT_BINDING_V1.md",
    "docs/ENTERPRISE_SCIM_PROVISIONING_V1.md",
    "docs/ENTERPRISE_IDENTITY_SSO_SCIM_CANARY_V1.md",
    "src/lib/enterprise-identity-canary-receipt.ts",
    "src/lib/enterprise-identity-canary-receipt.test.ts",
    "scripts/evaluate-enterprise-identity-canary-receipt.ts",
    "scripts/check-enterprise-identity-canary.ts",
    "scripts/check-enterprise-sso.ts",
    "scripts/check-enterprise-sso-tenant-binding.ts",
    "scripts/check-enterprise-scim.ts"
  ],
  "disclaimer": {
    "en": "This status describes source controls and a staged isolated identity-canary protocol. It does not prove that a real IdP, SCIM connector, tenant-isolation canary, deprovisioning workflow or production SSO/SCIM rollout has been verified.",
    "es": "Este estado describe controles de código y un protocolo staged de canary de identidad aislado. No demuestra que un IdP real, conector SCIM, canary de aislamiento por tenant, flujo de deprovisioning o despliegue productivo SSO/SCIM hayan sido verificados."
  }
}