{
  "posture": {
    "schema": "nordvec.deployment-posture.v4",
    "runtime": "web",
    "classification": "no-customer-data",
    "corroboration": null,
    "embedding": {
      "provider": "mistral",
      "model": "mistral-embed",
      "host": "api.eu.mistral.ai",
      "ownDeployment": false
    },
    "generation": {
      "host": "api.eu.mistral.ai",
      "ownDeployment": false
    },
    "storage": null,
    "egress": {
      "enforced": false,
      "approvedHosts": [
        "api.brevo.com",
        "api.eu.mistral.ai",
        "ingest.de.sentry.io",
        "jksswvisxxgrmfotjfou.supabase.co",
        "s3.fr-par.scw.cloud"
      ],
      "scope": {
        "covered": [
          {
            "path": "application requests",
            "via": "fetch and preconnect"
          }
        ],
        "uncovered": [
          {
            "path": "trace exporter",
            "via": "node http; collector endpoint EU-checked at boot"
          },
          {
            "path": "postgres client",
            "via": "tcp to the configured database instance"
          },
          {
            "path": "redis client",
            "via": "tcp to the configured cache instance"
          },
          {
            "path": "object storage sdk",
            "via": "node http; endpoint EU-checked by the env schema"
          },
          {
            "path": "error transport",
            "via": "@sentry/node over node http; DSN host EU-checked by the env schema"
          },
          {
            "path": "public web fetch",
            "via": "node http through the SSRF seam: every hop validated, resolved once and pinned to a public address"
          },
          {
            "path": "certificate probe",
            "via": "a TLS handshake to the deployment's own configured origins, closed before any request is sent"
          }
        ]
      }
    },
    "subprocessorRegister": {
      "stateHash": "sha256:f3d36178677e6d3a06d4388737c09968267f7202bda26d94858842444ad54330",
      "recordedOn": "2026-10-19",
      "revision": 23
    },
    "connectorEgress": {
      "stateHash": "sha256:4d8bfd3ce2a793c86c0b3056e2564100f68934a736bd595943170db94bb68335"
    },
    "coreDump": {
      "limit": {
        "soft": 0,
        "hard": 0
      },
      "dumpable": null
    },
    "build": {
      "sha": "bd07104d60bf88849e280fc90ceb9c58d452364e",
      "short": "bd07104"
    },
    "observedAt": "2026-11-01T00:25:34.901Z"
  },
  "signature": {
    "algorithm": "ed25519",
    "keyId": "0ba70cd456d565f1",
    "signedAt": "2026-11-01T00:25:34.901Z",
    "signature": "iWgspbqATzbCogOIJA9RRPEb6Iqgl1BNpOazuA8MrHSPx6+mEpHKRnqnYaKFk8eE2FC5utcPQDQdMF460F+FAA=="
  },
  "verification": {
    "publicKey": "/api/trust/provenance-key",
    "signedBytes": "UTF-8 of the canonical JSON of `posture` with `signature.signedAt` added as a top-level `signedAt` field; object keys sorted by Unicode code point at every depth, arrays in their original order, JSON.stringify serialization with no whitespace and undefined-valued fields omitted",
    "signature": "base64 Ed25519 over those bytes, no digest step"
  }
}