{
  "run_id": "20260916_033500",
  "environment": "MOCK DMS ONLY",
  "audit_timestamp": "2026-09-16T11:35:00+08:00",
  "security_verdict": "PASS",
  "checks": {
    "password_plaintext_persistence_count": {
      "count": 0,
      "status": "PASS",
      "detail": "No plaintext passcodes stored in train_dorm_auth, dms_external_operation, or any persistent table."
    },
    "secret_ui_exposure_count": {
      "count": 0,
      "status": "PASS",
      "detail": "No token, appsecret, password, or raw request/response payloads exposed in frontend views or API responses."
    },
    "remote_unlock_callable_entry_count": {
      "count": 0,
      "status": "PASS",
      "detail": "No /train/dms/remote-unlock API endpoint or UI trigger implemented or permitted."
    },
    "teacher_access_to_admin_dms_api": {
      "status": "DENIED",
      "detail": "Strictly restricted by Spring Security @PreAuthorize('hasPermi(...)') with dedicated train:access permissions."
    },
    "student_access_to_admin_dms_api": {
      "status": "DENIED",
      "detail": "Students have no access privileges to /train/access/** endpoints."
    },
    "manual_reconcile_prerequisite_bypass": {
      "bypassed": false,
      "status": "PASS",
      "detail": "reconcile(enrollmentId) strictly enforces enrollment status, accommodation presence, room mapping, and exactly one primary lock."
    },
    "operation_history_sanitized": {
      "sanitized": true,
      "status": "PASS",
      "detail": "DmsSanitizedOperationVO only returns non-sensitive fields (id, type, status, attempt, timestamps, sanitized error message)."
    },
    "live_dms_request_count": {
      "count": 0,
      "status": "PASS",
      "detail": "dms.enabled=false by default in application.yml. All E2E tests target MockDmsServer exclusively."
    }
  }
}