{
  "schemaVersion": 1,
  "version": "v2.7.0",
  "state": "required-not-collected",
  "mandatory": [
    "requirements",
    "rfc",
    "adr",
    "threat-model",
    "privacy-review",
    "readiness-scorecard",
    "tests",
    "security",
    "accessibility",
    "performance",
    "migration",
    "rollback",
    "documentation-impact",
    "compatibility",
    "sbom",
    "provenance",
    "release-verification",
    "post-release-review"
  ],
  "gates": {
    "critical": 100,
    "important": 95,
    "standard": 90
  },
  "acceptance": [
    "Operating system, provider, framework, host, plugin, MCP, and package matrices have dated evidence.",
    "Appeal, correction, expiry, advisory, and revocation workflows pass.",
    "Certification limitations are explicit and independently reviewable."
  ]
}