Proof sample
A verified remediation record proves that a specific finding no longer applies to a new artifact, using independent corroboration evaluated against versioned policy.
This is a synthetic example for illustration.
| Field | Role |
|---|---|
| evidence_snapshot | The original finding, retest results, and corroboration. |
| policy_version | The policy that defined what counts as verified remediation. |
| policy_digest | Digest of the policy version used for verification. |
| decision_fingerprint | Unique identifier for the remediation decision. |
| freshness_state | Whether the retest evidence was within the policy freshness window. |
| trust_state | Qualification state, such as qualified_and_corroborated. |
| dsse_envelope | Signing status protecting the record. |
| downgrade_reason_codes | Records explicit acceptance instead of verified fix. |
| outcome | Honest outcome, such as risk_absent, risk_present, or indeterminate. |
| replay_command | Command to reproduce the remediation verification. |
| runtime_corroboration | Independent runtime evidence supporting the retest conclusion. |
Synthetic verified remediation record (JSON)
{
"artifact_type": "verified_remediation_record",
"evidence_snapshot": {
"original_finding": {
"finding_id": "SAST-2026-4481",
"tool": "primary_sast",
"severity": "high",
"location": "src/payment/validator.ts:112",
"description": "Unsafe deserialization in payment validator",
"detected_in_artifact": "payment-service:2.4.0@build-8801"
},
"fix_artifact": "payment-service:2.4.1@build-8842",
"retest_results": [
{
"tool": "primary_sast",
"finding_id": "SAST-2026-4481",
"status": "not_detected"
},
{
"tool": "secondary_sast",
"finding_id": "SAST-2026-4481-retest",
"status": "not_detected"
}
],
"reviewer_attestation": {
"reviewer": "jsingh@example.org",
"conclusion": "fix_reviewed_and_approved",
"reviewed_at": "2026-07-20T10:15:00Z"
},
"runtime_corroboration": {
"source": "runtime_telemetry",
"status": "exploitable_behavior_not_observed",
"observed_at": "2026-07-20T11:00:00Z"
}
},
"policy_version": "v1.3.2",
"policy_digest": "sha256:a1b2c3...f4e5d6",
"decision_fingerprint": "sha256:3d4e5f...2c1b0a",
"freshness_state": "fresh",
"trust_state": "qualified_and_corroborated",
"dsse_envelope": {
"payload_type": "application/vnd.gosentrix.remediation+json",
"signatures": [
{
"keyid": "remediation-signer-2026",
"sig": "..."
}
]
},
"downgrade_reason_codes": [],
"outcome": "risk_absent",
"replay_command": "gosentrix replay --remediation-id SAST-2026-4481 --fix-artifact payment-service:2.4.1@build-8842 --policy-version v1.3.2"
}The outcome records whether risk is absent, present, or indeterminate—not whether a ticket was closed.
Retest plus reviewer attestation plus runtime telemetry reduces reliance on any single claim.
policy_version and policy_digest bind the conclusion to the rules in force at the time.
downgrade_reason_codes separate accepted risk from verified remediation.
A verified remediation record is evidence that a specific finding no longer applies to a new artifact. It includes the original finding, the retest result, corroborating evidence, and the policy version that defined what counts as verified.
A single scanner retest may be wrong or incomplete. Independent corroboration—such as a second scanner, reviewer attestation, or runtime telemetry—raises confidence that the risk was actually retired.
If a finding is accepted rather than fixed, downgrade_reason_codes record the explicit rationale, such as risk_accepted_with_authorization. This distinguishes acceptance from verified remediation.
No. It verifies the finding is absent in the evaluated artifact. Future regressions require their own evidence and decisions.
The public operating doctrine for release-evidence verification.
How GoSentrix qualifies evidence and evaluates policy.
A worked example of a policy-bound release decision.
Move from ticket closure to verified remediation evidence.
GoSentrix produces remediation records that link original findings, independent retests, and policy versions so fixes are provable.