{
  "counts": {
    "api_catalogue": 848,
    "canonical_sources": 488,
    "client_selected_models": 20,
    "documents": 2,
    "findings": 125,
    "native_function_metadata": 67,
    "records": 1668,
    "route_catalogue": 120
  },
  "existing_record_schema_sha256": "c8e196c10f8b20811b735a128c2bf374463ad73f9b24cbc603f863ca96f2ff4e",
  "finding_counts_by_scope": {
    "Ghidra continuation and selector recovery": 12,
    "Ghidra native pass": 6,
    "Offline export and SSO": 5,
    "Package metadata": 16,
    "Runtime account-entry tests": 2,
    "Visitt API, authentication and offline": 12,
    "Visitt native shell": 17,
    "Visitt workflows": 10,
    "Visitt+ native shell": 20,
    "Visitt+ portal": 25
  },
  "input_artifact": {
    "byte_length": 4664943,
    "id": "artifact:sha256:803c382f87f02fad05704bc6c0c0434564b94b8b3f42f31992689a2ce6182ab9",
    "sha256": "803c382f87f02fad05704bc6c0c0434564b94b8b3f42f31992689a2ce6182ab9"
  },
  "integration_mode": "append versioned supplement; preserve September corpus and original dates",
  "limits": [
    "One login-code request action per app with the same newly generated disposable address; both UIs returned account-not-found messages. No successful signup, authenticated workflow, upload, deliberate GraphQL invocation, schema introspection or business mutation. No HTTP request/response capture was taken; email delivery is unverified. Native UI binding attempt did not succeed. Normal browser initialization may make its own network requests.",
    "Installed app versions and current hosted frontend snapshots are independent. Expo OTA introduces another independent update layer.",
    "Backend resolver logic, actual session cookie flags, server authorization, tenant configuration, AI models/prompts, delivery/financial outcomes, runtime permissions and complete native internals remain unknown.",
    "Missing authenticated evidence does not prove missing product capability."
  ],
  "mapping_decisions": [
    "Visitt+ uses companies=[Visitt]; metadata.apps retains the app label.",
    "125 findings map to claim or analysis; catalogues and native metadata map to analysis; canonical provenance maps to source.",
    "Metadata-only withheld local artifacts use portable canonical URNs; they are not public download URLs.",
    "Full technical dossier and team brief are Markdown strings embedded in documents; no standalone Markdown files.",
    "Original ledger IDs and historical-phase caveats are retained; native body ends and file intervals keep their original conventions.",
    "Only finding records link to dossier anchors; catalogue/source records use artifact_path=null and are retrieved by MCP get_record or website record views."
  ],
  "namespace": "visitt-rea",
  "publication_date": "2026-10-13",
  "publication_exclusions": [
    "Original extraction archive",
    "Raw app binaries and resources",
    "Complete extracted JavaScript / GraphQL document bodies",
    "Complete Ghidra pseudocode / assembly dumps",
    "Private workstation and toolchain paths",
    "Disposable identifier and mailbox-provider details",
    "Client configuration, credentials and unrelated account state"
  ],
  "schema_version": "visitt-rea-portable-supplement-1.0",
  "source_contract_sha256": "f52193ccbe0f73108c3247dd258f32e1015985c60f7bf59685fbded428f4332c",
  "source_snapshot_dates": [
    "2026-10-11",
    "2026-10-12"
  ],
  "transfer_commit": "681937eec5b68c93dbc8e27bf9f6d707f70e33d4",
  "transfer_sha256": "a23f033ba516d9b21799879c9d2a014bccd35da50bee691f1d784c0579b2150d",
  "publication_transform": "New technical_finding/technical_catalogue kinds; source adapter; public record paths; exact workflow links. Historical records unchanged.",
  "workflow_links": 32,
  "workflows_with_links": 15,
  "local_validation": "Transfer digests, record IDs, source references and relationship targets checked here. Raw source audit and five native reruns supplied by the source investigation; raw binaries not available on this host.",
  "verification": {
    "finding_count": 125,
    "native_dossier_count": 67,
    "fresh_native_rerun_count": 5,
    "correction_field_count": 15,
    "corrected_finding_ids": [
      "CORE-07",
      "CORE-08",
      "GHIDRA-01",
      "GHIDRA-03",
      "GHIDRA-04",
      "META-03",
      "META-15",
      "RUNTIME-02",
      "W01",
      "W02",
      "W03",
      "core-data-contracts"
    ],
    "limits": "Verification is bounded to retained packages, client assets and selected native code. It does not establish successful signup, authenticated workflows, tenant configuration, backend behavior or complete semantic recovery. Original source snapshot dates remain unchanged. Fresh repetitions do not increase the 67 unique native dossier count."
  },
  "published_files": {
    "records.json": "9ba70536f1486a7bb35a2c34800ef61be935c6f301ba0f717f6e674ed4d204d2",
    "records.jsonl": "b931b0a73747013798b969e464e6b4ffd6867ccd1db156f56ba8576438c8f13f",
    "sources.json": "936434b159fad466cc604df00fbad51875a40b469015337f9da6cdd3ffbe6fe6",
    "workflow-links.json": "537a49951aa5476bb57fece756cd072f0817840af68c32d91a0a82b6f48a00fd"
  },
  "local_public_source_verification": {
    "checked_at": "2026-10-13T10:15:19.070179+00:00",
    "files": [
      {
        "finding": "cw09",
        "url": "https://app.visitt.io/assets/create-amenity-booking-page-BrDScwSI.js",
        "bytes": 2822,
        "sha256": "2e59ee418304f11fcb58e8a2996d2a2348e59f0e7790edebc3c22a82af6b3f2f",
        "matches_snapshot_hash": true
      },
      {
        "finding": "cw10",
        "url": "https://app.visitt.io/assets/billing-page-BDpigqhH.js",
        "bytes": 51281,
        "sha256": "ab96acd0ad4fb36dc468f50585820956bae8bc933874f6598d6b79d7c192da12",
        "matches_snapshot_hash": true
      },
      {
        "finding": "cw05",
        "url": "https://app.visitt.io/assets/vendor-company-coi-requirements-section-CfNoJxA8.js",
        "bytes": 4454,
        "sha256": "1a5c5f7e7b64fa671021ddaf7f38c6f945f101b260ec35e1d54c900e3357db41",
        "matches_snapshot_hash": true
      },
      {
        "finding": "core-inspection-offline-limit",
        "url": "https://app.visitt.io/assets/index-BrIEt02s.js",
        "bytes": 3173144,
        "sha256": "2b0d91321326d8701f4f94bef7e31c443161c3bef66a8163b60d7293771b4434",
        "matches_snapshot_hash": true
      },
      {
        "finding": "w09",
        "url": "https://portal.visitt.io/assets/vui-form-phone-input-CRH0sSU4.js",
        "bytes": 1074295,
        "sha256": "078f0df7d1964a18d6c07dceb71643e28b3e8ce18d9d6244e0bbf3bcccbf770f",
        "matches_snapshot_hash": true
      }
    ],
    "scope": "Five current public client files match their retained SHA256. This checks source identity, not runtime outcomes or every finding."
  }
}