{
"schema_version": 1,
"policy_id": "hiverelay-blind-public-test-vulnerability-policy-v1",
"release": "1.0.0-rc.1.public-test.1",
"claim_boundary": "LIVE_PUBLIC_TEST_ONLY",
"scope": {
"images": [
"hiverelay/blind-edge@sha256:79a4e8e735681497772c06f6c35544bf4d6d77afdd0ed9f06bc6c5b2ae564fe7",
"hiverelay/blind-daemon@sha256:57b7c2b1645b2c728efd761904b40a838b2db6111b0e9957b081d800ccf98f9f"
],
"platforms": ["linux/amd64", "linux/arm64"],
"surfaces": [
"Debian bookworm OS packages from the digest-pinned base images (no apt-get in build)",
"npm production dependencies from deploy/blind/*/package-lock.json",
"compiled native addon @hiverelay/blind-peercred"
]
},
"gate": {
"description": "Report-only gate for the readiness-zero public-test artifact set; no finding may be silently dropped. Blocking conditions below must be evaluated by independent assurance before any test-activation lease is exercised.",
"blocking_conditions": [
"CRITICAL or HIGH vulnerability with a fixed version available in an npm production dependency that is reachable from the relay request path",
"any vulnerability in @hiverelay/* first-party source introduced by this packaging lane (none permitted; lane adds no code)"
],
"non_blocking_dispositions": {
"OS_PACKAGE_FIXED_AVAILABLE": "Debian base-image package with a fix published after the digest-pinned base was cut; disposition ACCEPT_RISK requires per-finding justification (network exposure, profile, reachability) and is re-evaluated at the next base refresh",
"OS_PACKAGE_NO_FIX": "Debian package without an upstream fix; recorded, disposition WATCH",
"FALSE_POSITIVE": "Scanner attribution error; requires written justification"
}
},
"scanner_requirements": {
"scanner_image": "aquasec/trivy:0.72.0 pinned by digest sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f",
"sbom_image": "anchore/syft:v1.49.0 pinned by digest sha256:13b53ebabe3d215268c90cf8fb9b875f0183908245f376fd4b3a2cb69d21d484",
"record": ["scanner version", "vulnerability DB version/digest and updated-at", "full JSON report per image per platform", "per-finding disposition"]
}
}