{
  "_note": "REPRESENTATIVE: real enrichment pending task 02 raw-source generality, as of 2026-05-24. Role-tagged, relation-resolved shape mirrors the controlled agora-pq fixture; a live scan of the Marinade demo target resolves zero region roles and zero cross-region edges (documented upstream coverage gap), so this representative slice stands in until that gap closes. NOT derived from a real scan.",
  "tool_version": "1.2.2",
  "repo_path": "programs/quantum-vault",
  "scan_completed_at": "2026-05-23T18:30:00Z",
  "findings": [
    {
      "id": "CA-004",
      "severity": "High",
      "location": "programs/quantum-vault/src/state/authority.rs:118",
      "role": "on-chain-program",
      "relations": [
        { "target": "crypto:ed25519:vault-authority", "kind": "Holds" },
        { "target": "service:vault-signer", "kind": "Uses" }
      ]
    },
    {
      "id": "CA-002",
      "severity": "Medium",
      "location": "services/vault-signer/src/sign.ts:54",
      "role": "off-chain-service",
      "relations": [
        { "target": "crypto:ed25519:vault-authority", "kind": "Uses" },
        { "target": "app:vault-console", "kind": "DependsOn" }
      ]
    },
    {
      "id": "CA-001",
      "severity": "Info",
      "location": "apps/vault-console/src/lib/verify.ts:27",
      "role": "client-app",
      "relations": [
        { "target": "crypto:ed25519:vault-authority", "kind": "DerivedFrom" }
      ]
    }
  ]
}