{
  "surveillanceSchemaVersion": "1.0",
  "benchmarkKey": "gateway-authorization",
  "observedAt": "2026-10-26T07:47:39.924902+00:00",
  "status": "pass",
  "benchmark": "DN Almanak Gateway Authorization Boundary",
  "benchmarkVersion": "surveillance-1.0",
  "evidenceLevel": "scheduled-code-executed-gateway-auth-boundary",
  "upstreamRepository": "almanak-co/sdk",
  "upstreamCommit": "39cfabb780d297f5f90e2f3ee68215dfb382b5f2",
  "dnRepositoryCommit": "47914ec6d55af20e64526d82c26e40e0b99c9a6c",
  "githubRunId": "40287893999",
  "assertions": {
    "valid token allowed": true,
    "missing token rejected": true,
    "invalid token rejected": true,
    "ExecutionService.Execute authenticated": true,
    "secure startup fail-closed": true,
    "hosted mode authentication required": true,
    "constant-time comparison": true,
    "auth-failure throttling": true
  },
  "controls": {},
  "boundaryFinding": {},
  "limitations": [
    "Scheduled code-executed surveillance against the pinned Almanak upstream commit.",
    "A failure triggers E3 review but may still require diagnosis of environment/setup causes.",
    "This is not a production penetration test or certification."
  ],
  "sourceArtifact": "gateway-authorization.json"
}