{
 "item1_prod_cred_probe": {
  "verdict": "BLOCKED-topology",
  "detail": "all prod DBs on RFC1918 (172.31.2.15 pg/mariadb, 10.215.102.41 mysql MerchantX_ma); only public DB host across all 10 clones = 14.225.11.28 (already validated). Prod DB unreachable without in-network pivot (runner = active, gated separately).",
  "public_db_hosts_found": [
   "14.225.11.28:3306",
   "14.225.11.28:5432"
  ]
 },
 "item2_token_liveness": {
  "verdict": "DEAD",
  "detail": "sc_data.token_info: 1280 total, 797 not-logged-out, 0 unexpired (latest expiry 2025-07-16, >1yr stale). UAT is a frozen July-2025 snapshot. No live sessions => no account takeover via UAT tokens.",
  "counts": {
   "total": 1280,
   "not_logged_out": 797,
   "live_unexpired": 0,
   "live_and_active": 0,
   "latest_expiry": "2025-07-16 16:34:14"
  }
 },
 "item3_jasypt": {
  "verdict": "DORMANT",
  "detail": "jasypt.encryptor.bean=encryptorBean present but encryptor password externalized (not in repo). 2x ENC() values (datasource, send.mail) cannot be decrypted offline without the key."
 }
}