{"schema_version":"qscout.public.trust.workflow.v1","service":"qscout-api","version":"4.0.0","git_sha":"e46cb851b8ebebc3a923c2d5f43a0f57e2d69f2a","served_at_iso":"2026-09-30T06:28:27.539791+00:00","honesty":{"connectors_are_one_way":false,"outbound_still_dry_run_by_default":true,"dry_run_by_default":true,"no_bidirectional_sync":false,"bidirectional_inbound":"/public/trust/workflow/inbound","bidirectional_requires_tenant_hmac":true,"no_siem_stream_documented_here":true,"closed_loop_is_rescan_verified":true,"closed_loop_not_ticket_status_only":true,"conflict_rule":"presence of the vulnerability with a closed ticket is a conflict, not a pass"},"source_modules":{"jira":"qscout.workflow.connectors.jira","servicenow":"qscout.workflow.connectors.servicenow","webhook":"qscout.workflow.connectors.webhook","envelope":"qscout.workflow.connectors.base.envelope","closed_loop":"qscout.workflow.closed_loop"},"connectors":{"jira":{"connector_id":"workflow.jira","dry_run_default":true,"direction":"outbound_create_plus_inbound_status","field_mapping":{"project.key":"configured project_key (default SEC)","summary":"finding.title (truncated 255)","description":"finding.description or title","issuetype":"Bug","labels":["qscout","post-quantum","<severity lower>"],"qscout_envelope_hash":"envelope.hash"},"live_requirements":["base_url (public HTTPS)","auth_header (operator-supplied; never in response body)","dry_run=false"]},"servicenow":{"connector_id":"workflow.servicenow","dry_run_default":true,"direction":"one_way_incident_create","table_default":"incident","field_mapping":{"short_description":"finding.title (truncated 160)","description":"finding.description","urgency":"1 if CRITICAL/HIGH else 2 if MEDIUM else 3","u_qscout_finding_id":"envelope.finding_id","u_qscout_envelope_hash":"envelope.hash"},"live_requirements":["instance_url (public HTTPS)","auth_header (operator-supplied)","dry_run=false"]},"webhook":{"connector_id":"workflow.webhook","dry_run_default":true,"direction":"one_way_https_post","body":"qscout.workflow.finding-envelope.v1 JSON"}},"envelope_schema":{"schema":"qscout.workflow.finding-envelope.v1","fields":["schema","connector_id","finding_id","title","severity","module","target","hndl_score","delivered_at","hash"],"hash":"sha256 of canonical JSON (sort_keys, compact separators) over body without hash field","example":{"schema":"qscout.workflow.finding-envelope.v1","connector_id":"workflow.jira","finding_id":"finding-demo-001","title":"TLS 1.0 still accepted on api.example.com","severity":"HIGH","module":"hybrid_tls_scanner","target":"api.example.com","hndl_score":null,"delivered_at":"2026-07-27T00:00:00+00:00","hash":"<sha256 hex>"}},"closed_loop":{"sequence":["finding","ticket_create (jira|servicenow, dry-run by default)","ticket_status_poll","re_scan_verify (verify_closure: exposure must be gone)","auto_close","signed_closure_artifact"],"verify_closure":{"module":"qscout.workflow.actions.remediation.verify_closure","requires":["ticket_status closed/resolved","rescan_exposure_present == false","qscout_verified == true"],"verdict_verified_closed":"only when re-scan confirms exposure absent — not ticket status alone"},"signed_closure_artifact":{"schema":"qscout.workflow.signed-closure.v1","canonicalization":"json.dumps sort_keys compact separators","signatures":{"sha256":"always present; offline-verifiable","ml_dsa_65":"when signing key available; fail-open to sha256-only with status note"},"includes_in_signed_body":["finding_id","connector","external_id","ticket_status","ticket_url","verification","auto_closed","closed_at","dry_run"],"offline_verify":"qscout.workflow.closed_loop.verify_closure_artifact_offline"},"function":"qscout.workflow.closed_loop.run_closed_loop"},"acceptance_reader_path":["1. GET this document; note inbound route and dry_run_by_default.","2. Trace closed_loop.sequence end to end.","3. Confirm closed_loop.verify_closure requires re-scan absence of exposure.","4. Confirm signed_closure_artifact uses canonical JSON + sha256 (+ ML-DSA-65 when keys present)."],"not_claimed":["continuous SIEM stream","unconfigured-tenant automatic Jira reopen","auto-remediation of customer systems","Pulse as continuous crypto drift monitoring"]}