{"bundleSchema":"d0-proof-bundle/1.0.0","attestationSchema":"d0-attestation/1","generatedAt":"2026-10-12T15:40:15.589Z","scan":{"id":"a80d4758-1cbe-4549-b592-c7f36f3f0579","name":"lodash","version":"4.18.1","artifactSha256":"696942c2a488c9d7428e9ca5f12ccf03b52de01dcdbfe4d4751d392f0491ae16","registry":"https://registry.npmjs.org"},"registry":{"version":1,"commitment":"2ddcedcd2fda9ffcea5b63845d9e20814dc6dbb8b753628d4536c450339cf448","entries":[{"publicKeyHex":"a5c7b61d4cdb56a79ae9dbfab384d1cca0c4549d20da40c73313a34dfc5ede90","publicKeyDer":"MCowBQYDK2VwAyEApce2HUzbVqea6dv6s4TRzKDEVJ0g2kDHMxOjTfxe3pA=","role":"static_lifecycle","registeredAt":"2026-10-12T15:37:23.761Z","registryVersion":1,"revoked":false,"operator":"local-operator (single machine)"},{"publicKeyHex":"880fb0adaa2cc188785e957fee966cf939a4c572d370921c16352d955a8b77bb","publicKeyDer":"MCowBQYDK2VwAyEAiA+wraoswYh4XpV/7pZs+TmkxXLTcJIcFjUtlVqLd7s=","role":"dependency_advisory","registeredAt":"2026-10-12T15:37:23.761Z","registryVersion":1,"revoked":false,"operator":"local-operator (single machine)"},{"publicKeyHex":"fff189949f9aca2ac8679a34f0332456a467dab2df766cfd323e5ac20e2eb115","publicKeyDer":"MCowBQYDK2VwAyEA//GJlJ+ayirIZ5o08DMkVqRn2rLfdmz9Mj5awg4usRU=","role":"artifact_integrity","registeredAt":"2026-10-12T15:37:23.761Z","registryVersion":1,"revoked":false,"operator":"local-operator (single machine)"}],"storage":"off-chain local registry, anchored by commitment","onChainProgramDeployed":false,"operator":"local-operator (single machine)"},"scanners":[{"payload":{"schemaVersion":"d0-attestation/1","domain":"DEPENDENCY-ZERO/ATTESTATION","scanId":"a80d4758-1cbe-4549-b592-c7f36f3f0579","resolvedName":"lodash","resolvedVersion":"4.18.1","artifactSha256":"696942c2a488c9d7428e9ca5f12ccf03b52de01dcdbfe4d4751d392f0491ae16","scannerPublicKey":"a5c7b61d4cdb56a79ae9dbfab384d1cca0c4549d20da40c73313a34dfc5ede90","scannerRole":"static_lifecycle","scannerVersion":"d0-scanner/2.0.0","policyVersion":"d0-policy/1.0.0","findingsCommitment":"919d6de0a58084531cfac1c4f4dec06f5725e37ba5ea96e1bd07e563c4e1ad90","findingCount":2,"proposedVerdict":"review","riskScore":24,"completionStatus":"completed","timestamp":1791819615589},"signature":"cfcd2f870648db48a6b451bdf40ea53792b787920321cd45130fa6d48e127df5e6b898fe2540039f6de0bfd249747a366994e22f9e73cf93cb8f1863f7e01e07"},{"payload":{"schemaVersion":"d0-attestation/1","domain":"DEPENDENCY-ZERO/ATTESTATION","scanId":"a80d4758-1cbe-4549-b592-c7f36f3f0579","resolvedName":"lodash","resolvedVersion":"4.18.1","artifactSha256":"696942c2a488c9d7428e9ca5f12ccf03b52de01dcdbfe4d4751d392f0491ae16","scannerPublicKey":"880fb0adaa2cc188785e957fee966cf939a4c572d370921c16352d955a8b77bb","scannerRole":"dependency_advisory","scannerVersion":"d0-scanner/2.0.0","policyVersion":"d0-policy/1.0.0","findingsCommitment":"e9912a3fd85902a8f66bd2aefb404eb0e01cdcfdebbea64c69feb47fb5f39ad8","findingCount":0,"proposedVerdict":"allow","riskScore":0,"completionStatus":"completed","timestamp":1791819615589},"signature":"c4536e7daf9b493233d6971ce195ed5254f5c5855ea9e254a53e6fc8a5be1cb67609014a00677eb8da2d59938efc478c6c6745f784965b9dfeab8efef16c3d08"},{"payload":{"schemaVersion":"d0-attestation/1","domain":"DEPENDENCY-ZERO/ATTESTATION","scanId":"a80d4758-1cbe-4549-b592-c7f36f3f0579","resolvedName":"lodash","resolvedVersion":"4.18.1","artifactSha256":"696942c2a488c9d7428e9ca5f12ccf03b52de01dcdbfe4d4751d392f0491ae16","scannerPublicKey":"fff189949f9aca2ac8679a34f0332456a467dab2df766cfd323e5ac20e2eb115","scannerRole":"artifact_integrity","scannerVersion":"d0-scanner/2.0.0","policyVersion":"d0-policy/1.0.0","findingsCommitment":"e9912a3fd85902a8f66bd2aefb404eb0e01cdcfdebbea64c69feb47fb5f39ad8","findingCount":0,"proposedVerdict":"allow","riskScore":0,"completionStatus":"completed","timestamp":1791819615589},"signature":"a6c11ef04f3c149efc24337c3c5261b319feb701c21a194b0fca189939944208a0011ef18a5e1fbf0cb450a5668bdf53f1853454accb1492e87abcfaa6351d0a"}],"consensus":{"verified":true,"result":"review","quorumRequired":3,"quorumMet":3,"policyVersion":"d0-consensus/1.0.0","votes":[{"role":"static_lifecycle","publicKeyHex":"a5c7b61d4cdb56a79ae9dbfab384d1cca0c4549d20da40c73313a34dfc5ede90","verdict":"review","riskScore":24,"rationale":"","operator":"local-operator (single machine)"},{"role":"dependency_advisory","publicKeyHex":"880fb0adaa2cc188785e957fee966cf939a4c572d370921c16352d955a8b77bb","verdict":"allow","riskScore":0,"rationale":"","operator":"local-operator (single machine)"},{"role":"artifact_integrity","publicKeyHex":"fff189949f9aca2ac8679a34f0332456a467dab2df766cfd323e5ac20e2eb115","verdict":"allow","riskScore":0,"rationale":"","operator":"local-operator (single machine)"}],"rejected":[],"unavailableRoles":[],"rationale":"1 scanner(s) returned REVIEW.","blockOverride":false},"attestation":{"schemaVersion":"d0-attestation/1","mechanism":"spl-memo","mechanismLabel":"Solana Devnet commitment anchored via Memo","cluster":"devnet","commitmentHash":"a3ba712a18bc8df2ee53bf84f0e0b98dc62270cf7164d0b0eeb1e7f2bca3d378","scanId":"a80d4758-1cbe-4549-b592-c7f36f3f0579","artifactSha256":"696942c2a488c9d7428e9ca5f12ccf03b52de01dcdbfe4d4751d392f0491ae16","confirmationStatus":"confirmed","blockTime":1791819616,"explorerUrl":"https://explorer.solana.com/tx/5JzGpb77p616QM8hdQa6xU5f8TrunsvFoQuSVsFUt9n6zZS2sXmAJ9ULxJhYEGweMxDosVBbSLVyScz3rAfAFnLd?cluster=devnet","submittedAt":"2026-10-12T15:40:15.596Z","confirmedAt":"2026-10-12T15:40:16.295Z","memoData":"D0/d0-attestation/1 | c=a3ba712a18bc8df2ee53bf84f0e0b98dc62270cf7164d0b0eeb1e7f2bca3d378 | scan=a80d4758-1cbe-4549-b592-c7f36f3f0579 | artifact=696942c2a488c9d7428e9ca5f12ccf03b52de01dcdbfe4d4751d392f0491ae16 | consensus=review","memoProgramId":"MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr","idempotencyKey":"ece9649afa51b4e6252cd1aef4142f23","status":"confirmed","transactionSignature":"5JzGpb77p616QM8hdQa6xU5f8TrunsvFoQuSVsFUt9n6zZS2sXmAJ9ULxJhYEGweMxDosVBbSLVyScz3rAfAFnLd","slot":510311917,"confirmed":true,"error":null},"commitment":"a3ba712a18bc8df2ee53bf84f0e0b98dc62270cf7164d0b0eeb1e7f2bca3d378","memoData":"D0/d0-attestation/1 | c=a3ba712a18bc8df2ee53bf84f0e0b98dc62270cf7164d0b0eeb1e7f2bca3d378 | scan=a80d4758-1cbe-4549-b592-c7f36f3f0579 | artifact=696942c2a488c9d7428e9ca5f12ccf03b52de01dcdbfe4d4751d392f0491ae16 | consensus=review","expectedMemoProgramId":"MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr","cluster":"devnet","trustModel":{"independentOperators":false,"note":"All scanner keys in this bundle are controlled by a single operator on a single host. Signatures prove internal consistency and tamper-evidence, not independent third-party verification or Byzantine fault tolerance."}}