{
  "kind": "C33EvidenceWorksheet",
  "version": 1,
  "notice": "Prediction-only worksheet. Not an admission policy or verification result.",
  "subject": "REPLACE_WITH_IMAGE_BY_DIGEST",
  "checks": [
    {
      "name": "signature-with-test-key-a",
      "expected": "accept only this digest under the recorded test key A",
      "observed": "NOT_RUN"
    },
    {
      "name": "signature-with-test-key-b",
      "expected": "reject the same digest with unrelated test key B",
      "observed": "NOT_RUN"
    },
    {
      "name": "sbom-coverage-and-provenance",
      "expected": "inspect the subject, builder identity and component coverage separately",
      "observed": "NOT_RUN"
    },
    {
      "name": "runtime-permissions",
      "expected": "inspect effective uid, capabilities, seccomp and mounted paths",
      "observed": "NOT_RUN"
    },
    {
      "name": "cluster-admission-enforcement",
      "expected": "reject unauthorized signatures only when a verified admission policy is installed",
      "observed": "NOT_RUN"
    }
  ]
}