{
  "graph": {
    "schema": "cain42.e14.supply-chain-graph.v1",
    "stages": [
      "PUBLISHER",
      "SOURCE",
      "REPOSITORY",
      "BUILD",
      "ARTIFACT",
      "DEPENDENCIES",
      "PACKAGE",
      "CAPABILITY",
      "AGENT",
      "DECISION",
      "EXECUTION",
      "EVIDENCE"
    ],
    "nodes": [
      {
        "id": "AGENT:agent-fin",
        "stage": "AGENT"
      },
      {
        "id": "ARTIFACT:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
        "stage": "ARTIFACT"
      },
      {
        "id": "ARTIFACT:c7e35e9713d62620b5ccff8ac1501764c9ee8187617835720dce931f7bfe72b2",
        "stage": "ARTIFACT"
      },
      {
        "id": "BUILD:b-1",
        "stage": "BUILD"
      },
      {
        "id": "BUILD:build-1.0.0",
        "stage": "BUILD"
      },
      {
        "id": "CAPABILITY:cap:03e8823d7a3c135cab092900b69cc82a396d050c0c7e5409b989c753ecf881f3",
        "stage": "CAPABILITY"
      },
      {
        "id": "CAPABILITY:cap:30ef03f7fecd9a3dd5404deaab358360f837eb701b7db6147e1a8b4ec505927f",
        "stage": "CAPABILITY"
      },
      {
        "id": "CAPABILITY:cap:3795533e24704a1c5bde96e8c685b24ce3f9e04c5dd102811d6ee0d2d763fd3b",
        "stage": "CAPABILITY"
      },
      {
        "id": "CAPABILITY:cap:be016deede3cf106ea3cbc9622c941893d7c1d536d99572407af6c461c5ab872",
        "stage": "CAPABILITY"
      },
      {
        "id": "CAPABILITY:cap:ed104a4d9965c1d8112fd22948e3be3bd237d24547af1bcb0376a215c2ec3286",
        "stage": "CAPABILITY"
      },
      {
        "id": "CAPABILITY:cap:f3269b84c6e29a9245d6f0b8f072495325fbfe0a84f4b41f9161bf28eeaae1b7",
        "stage": "CAPABILITY"
      },
      {
        "id": "DECISION:dec_0a0159a3f0d3fa6dfacd563d",
        "stage": "DECISION"
      },
      {
        "id": "DEPENDENCIES:48719f06e462db7e0c35b9d7586bf948a5af177baf1d6feebd23b8aabb2cb5da",
        "stage": "DEPENDENCIES"
      },
      {
        "id": "DEPENDENCIES:d2ffa35c97fcea8cf3e5d9abae3e536f1c3a1666a7a9ac31d02bae291afd264e",
        "stage": "DEPENDENCIES"
      },
      {
        "id": "EVIDENCE:8d55a45eeca4d7491ef1ecedcdaad6f8dbf7c094a3abb887c0bb8138463eb91a",
        "stage": "EVIDENCE"
      },
      {
        "id": "EXECUTION:gat_3564294c620f348c0340cec2",
        "stage": "EXECUTION"
      },
      {
        "id": "PACKAGE:2d9533b0ab0143a1a154f30780065648d5a5d4345cd9f035265861ff75346f20",
        "stage": "PACKAGE"
      },
      {
        "id": "PACKAGE:4835f96cb95414c1b3dd5816bcabc7ae1405283accdbdf990de0f35f07075abb",
        "stage": "PACKAGE"
      },
      {
        "id": "PUBLISHER:publisher:acme",
        "stage": "PUBLISHER"
      },
      {
        "id": "REPOSITORY:acme/fmt",
        "stage": "REPOSITORY"
      },
      {
        "id": "REPOSITORY:acme/http.post",
        "stage": "REPOSITORY"
      },
      {
        "id": "REPOSITORY:acme/kv.get",
        "stage": "REPOSITORY"
      },
      {
        "id": "REPOSITORY:acme/m",
        "stage": "REPOSITORY"
      },
      {
        "id": "REPOSITORY:acme/summarize",
        "stage": "REPOSITORY"
      },
      {
        "id": "REPOSITORY:acme/vault.read",
        "stage": "REPOSITORY"
      },
      {
        "id": "SOURCE:https://git.example/acme/fmt",
        "stage": "SOURCE"
      },
      {
        "id": "SOURCE:https://git.example/acme/http.post",
        "stage": "SOURCE"
      },
      {
        "id": "SOURCE:https://git.example/acme/kv.get",
        "stage": "SOURCE"
      },
      {
        "id": "SOURCE:https://git.example/acme/summarize",
        "stage": "SOURCE"
      },
      {
        "id": "SOURCE:https://git.example/acme/vault.read",
        "stage": "SOURCE"
      },
      {
        "id": "SOURCE:https://git.example/m",
        "stage": "SOURCE"
      }
    ],
    "edges": [
      [
        "AGENT:agent-fin",
        "->",
        "DECISION:dec_0a0159a3f0d3fa6dfacd563d"
      ],
      [
        "ARTIFACT:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
        "->",
        "DEPENDENCIES:48719f06e462db7e0c35b9d7586bf948a5af177baf1d6feebd23b8aabb2cb5da"
      ],
      [
        "ARTIFACT:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
        "->",
        "DEPENDENCIES:d2ffa35c97fcea8cf3e5d9abae3e536f1c3a1666a7a9ac31d02bae291afd264e"
      ],
      [
        "ARTIFACT:c7e35e9713d62620b5ccff8ac1501764c9ee8187617835720dce931f7bfe72b2",
        "->",
        "DEPENDENCIES:d2ffa35c97fcea8cf3e5d9abae3e536f1c3a1666a7a9ac31d02bae291afd264e"
      ],
      [
        "BUILD:b-1",
        "->",
        "ARTIFACT:c7e35e9713d62620b5ccff8ac1501764c9ee8187617835720dce931f7bfe72b2"
      ],
      [
        "BUILD:build-1.0.0",
        "->",
        "ARTIFACT:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
      ],
      [
        "CAPABILITY:cap:ed104a4d9965c1d8112fd22948e3be3bd237d24547af1bcb0376a215c2ec3286",
        "->",
        "AGENT:agent-fin"
      ],
      [
        "DECISION:dec_0a0159a3f0d3fa6dfacd563d",
        "->",
        "EXECUTION:gat_3564294c620f348c0340cec2"
      ],
      [
        "DEPENDENCIES:48719f06e462db7e0c35b9d7586bf948a5af177baf1d6feebd23b8aabb2cb5da",
        "->",
        "PACKAGE:2d9533b0ab0143a1a154f30780065648d5a5d4345cd9f035265861ff75346f20"
      ],
      [
        "DEPENDENCIES:d2ffa35c97fcea8cf3e5d9abae3e536f1c3a1666a7a9ac31d02bae291afd264e",
        "->",
        "PACKAGE:2d9533b0ab0143a1a154f30780065648d5a5d4345cd9f035265861ff75346f20"
      ],
      [
        "DEPENDENCIES:d2ffa35c97fcea8cf3e5d9abae3e536f1c3a1666a7a9ac31d02bae291afd264e",
        "->",
        "PACKAGE:4835f96cb95414c1b3dd5816bcabc7ae1405283accdbdf990de0f35f07075abb"
      ],
      [
        "EXECUTION:gat_3564294c620f348c0340cec2",
        "->",
        "EVIDENCE:8d55a45eeca4d7491ef1ecedcdaad6f8dbf7c094a3abb887c0bb8138463eb91a"
      ],
      [
        "PACKAGE:2d9533b0ab0143a1a154f30780065648d5a5d4345cd9f035265861ff75346f20",
        "->",
        "CAPABILITY:cap:03e8823d7a3c135cab092900b69cc82a396d050c0c7e5409b989c753ecf881f3"
      ],
      [
        "PACKAGE:2d9533b0ab0143a1a154f30780065648d5a5d4345cd9f035265861ff75346f20",
        "->",
        "CAPABILITY:cap:3795533e24704a1c5bde96e8c685b24ce3f9e04c5dd102811d6ee0d2d763fd3b"
      ],
      [
        "PACKAGE:2d9533b0ab0143a1a154f30780065648d5a5d4345cd9f035265861ff75346f20",
        "->",
        "CAPABILITY:cap:be016deede3cf106ea3cbc9622c941893d7c1d536d99572407af6c461c5ab872"
      ],
      [
        "PACKAGE:2d9533b0ab0143a1a154f30780065648d5a5d4345cd9f035265861ff75346f20",
        "->",
        "CAPABILITY:cap:ed104a4d9965c1d8112fd22948e3be3bd237d24547af1bcb0376a215c2ec3286"
      ],
      [
        "PACKAGE:2d9533b0ab0143a1a154f30780065648d5a5d4345cd9f035265861ff75346f20",
        "->",
        "CAPABILITY:cap:f3269b84c6e29a9245d6f0b8f072495325fbfe0a84f4b41f9161bf28eeaae1b7"
      ],
      [
        "PACKAGE:4835f96cb95414c1b3dd5816bcabc7ae1405283accdbdf990de0f35f07075abb",
        "->",
        "CAPABILITY:cap:30ef03f7fecd9a3dd5404deaab358360f837eb701b7db6147e1a8b4ec505927f"
      ],
      [
        "PUBLISHER:publisher:acme",
        "->",
        "DEPENDENCIES:48719f06e462db7e0c35b9d7586bf948a5af177baf1d6feebd23b8aabb2cb5da"
      ],
      [
        "PUBLISHER:publisher:acme",
        "->",
        "SOURCE:https://git.example/acme/fmt"
      ],
      [
        "PUBLISHER:publisher:acme",
        "->",
        "SOURCE:https://git.example/acme/http.post"
      ],
      [
        "PUBLISHER:publisher:acme",
        "->",
        "SOURCE:https://git.example/acme/kv.get"
      ],
      [
        "PUBLISHER:publisher:acme",
        "->",
        "SOURCE:https://git.example/acme/summarize"
      ],
      [
        "PUBLISHER:publisher:acme",
        "->",
        "SOURCE:https://git.example/acme/vault.read"
      ],
      [
        "PUBLISHER:publisher:acme",
        "->",
        "SOURCE:https://git.example/m"
      ],
      [
        "REPOSITORY:acme/fmt",
        "->",
        "BUILD:build-1.0.0"
      ],
      [
        "REPOSITORY:acme/http.post",
        "->",
        "BUILD:build-1.0.0"
      ],
      [
        "REPOSITORY:acme/kv.get",
        "->",
        "BUILD:build-1.0.0"
      ],
      [
        "REPOSITORY:acme/m",
        "->",
        "BUILD:b-1"
      ],
      [
        "REPOSITORY:acme/summarize",
        "->",
        "BUILD:build-1.0.0"
      ],
      [
        "REPOSITORY:acme/vault.read",
        "->",
        "BUILD:build-1.0.0"
      ],
      [
        "SOURCE:https://git.example/acme/fmt",
        "->",
        "REPOSITORY:acme/fmt"
      ],
      [
        "SOURCE:https://git.example/acme/http.post",
        "->",
        "REPOSITORY:acme/http.post"
      ],
      [
        "SOURCE:https://git.example/acme/kv.get",
        "->",
        "REPOSITORY:acme/kv.get"
      ],
      [
        "SOURCE:https://git.example/acme/summarize",
        "->",
        "REPOSITORY:acme/summarize"
      ],
      [
        "SOURCE:https://git.example/acme/vault.read",
        "->",
        "REPOSITORY:acme/vault.read"
      ],
      [
        "SOURCE:https://git.example/m",
        "->",
        "REPOSITORY:acme/m"
      ]
    ],
    "root": "7c92a6fa55ff0e2b56be15b7af32fccbfffc107849552264d99496ed4541bd99",
    "vulnerability_intelligence": "UNKNOWN",
    "authority": "NONE"
  },
  "refused_updates": [
    {
      "scenario": "dependency substitution",
      "admitted": false,
      "codes": [
        "SUPPLY_CHAIN:DEPENDENCY_SUBSTITUTION"
      ],
      "drift": "EXPECTED_CHANGE"
    },
    {
      "scenario": "malicious upgrade (adds PAYMENT, unsigned update)",
      "admitted": false,
      "codes": [
        "SUPPLY_CHAIN:MALICIOUS_UPGRADE"
      ],
      "drift": "SUSPICIOUS_CHANGE"
    },
    {
      "scenario": "downgrade",
      "admitted": false,
      "codes": [
        "SUPPLY_CHAIN:VERSION_ROLLBACK"
      ],
      "drift": "SUSPICIOUS_CHANGE"
    },
    {
      "scenario": "hidden dependency",
      "admitted": false,
      "codes": [
        "SUPPLY_CHAIN:HIDDEN_DEPENDENCY"
      ],
      "drift": "-"
    }
  ]
}