{
  "fixture_id": "meshqu-public-demo-2026-08",
  "generator": {
    "name": "packages/meshqu-core/scripts/generate-public-demo-fixture.ts",
    "version": "1.0.0"
  },
  "generated_at": "2026-08-03T00:00:00.000Z",
  "source_commit": "f61a735cfc92bf30296821f7d67ccb335cf9e3e4",
  "receipt_schema_version": 2,
  "bundle_version": "1",
  "canonicalization_profile": "meshqu-canonical/v0",
  "evaluator_version": "1.2.0",
  "synthetic": true,
  "decision_id": "018f9a1e-6d4c-7a3b-9f52-0c1d2e3f4a5b",
  "policy_snapshot_id": "018f9a1e-6d4c-7a3b-9f52-0c1d2e3f4a60",
  "signing_key": {
    "kid": "msk_demo_v2",
    "algorithm": "ed25519",
    "fingerprint_sha256": "2be54ebd3c6a0dded080683251b50d319f7b906da6746bc15a29427783ad7f1d",
    "fingerprint_sha256_input": "decoded SPKI DER bytes"
  },
  "tamper_demo": {
    "description": "Single-field mutation of decision-receipt-v2.json: the recorded debt-to-income ratio is improved after the fact, so a declined application looks like it should have passed. Apply it to the canonical receipt to reproduce tamper/decision-receipt-v2.tampered.json byte-for-byte.",
    "json_pointer": "/context/fields/dti",
    "original_value": 0.52,
    "altered_value": 0.3,
    "expected_failures": [
      "bundle.file_digest_mismatch",
      "integrity.mismatch",
      "snapshot_replay.hash_mismatch"
    ],
    "signature_remains_valid": true,
    "signature_note": "The Ed25519 signature still verifies, and that is the trust model rather than a gap: the v2 envelope signs the integrity hash, timestamp and key identity, not the content. The integrity hash is what binds content to signature. Public copy must not imply the signature alone detects edits."
  },
  "files": [
    {
      "path": "decision-receipt-v2.json",
      "sha256": "b7e88526260b3b75ca053cda66bcfebb75572ca61507ece032d4128cea91e948",
      "bytes": 1428
    },
    {
      "path": "policy-snapshot-v1.json",
      "sha256": "55fcc2f85229a2c3f188e2111411ecb3469f547e9f76365b96c09a4f971be44b",
      "bytes": 1248
    },
    {
      "path": "verification-bundle-v1.json",
      "sha256": "07c40c53ea998ba1c357e6614ba02d3a2d53da19d2672b850ccbabbe0ce5f7f6",
      "bytes": 4740
    },
    {
      "path": "trusted-keys.json",
      "sha256": "c80f1b0546b03ecae8908895498619a2f17d4ccd0e670f2b4e1858e64d7c4a16",
      "bytes": 1113
    }
  ]
}