{
  "artifact_type": "pingfederate_agent_audit",
  "mode": "read_only",
  "grade": "LAB_READY",
  "score": 80,
  "summary": "The lab is operational for guided demos, with persistence and OIDC runtime still to complete.",
  "capabilities": [
    {
      "id": "saml_sso",
      "label": "SAML SSO A/B",
      "status": "ready",
      "evidence": [
        "SAML applications are configured in IAM Lab.",
        "SP metadata and ACS endpoints are generated from config.",
        "SP initiated and IdP initiated login launchers are available."
      ],
      "next_action": "Connect a live inventory snapshot to prove the PF connection objects continuously."
    },
    {
      "id": "saml_slo",
      "label": "Signed SAML SLO",
      "status": "ready",
      "evidence": [
        "SAML clients expose SLO URLs.",
        "SP initiated LogoutRequest is signed with rsa-sha256.",
        "LogoutResponse omits InResponseTo for PingFederate unsolicited SLO propagation."
      ],
      "next_action": "Add automated browser SLO assertions against both SAML apps before customer demos."
    },
    {
      "id": "idp_sessions",
      "label": "IdP sessions per adapter",
      "status": "ready",
      "evidence": [
        "HTML Form adapter is the expected IdP session boundary.",
        "Hub session state remains disabled by design."
      ],
      "next_action": "Capture IdP session/settings in the live inventory artifact for evidence."
    },
    {
      "id": "oidc_isolation",
      "label": "Dedicated OIDC governance",
      "status": "configured",
      "evidence": [
        "OIDC A/B have separate client ids.",
        "OIDC A/B plans use dedicated JWT access token managers.",
        "OIDC A/B plans use dedicated OIDC policies."
      ],
      "next_action": "Implement OIDC runtime callbacks and token timer visualization."
    },
    {
      "id": "pf_log_agent",
      "label": "PingFederate log agent",
      "status": "available",
      "evidence": [
        "pf-log-agent-scan and pf-log-agent-follow are available.",
        "Logs are redacted before being posted to IAM Lab runs.",
        "Hub/IdP instance tags are preserved for run correlation."
      ],
      "next_action": "Mount real PingFederate log folders read-only from the Mint Docker host."
    },
    {
      "id": "pf_audit",
      "label": "Read-only PF audit",
      "status": "available",
      "evidence": [
        "Audit JSON is available without secrets.",
        "Expected objects are derived from IAM Lab configuration.",
        "Observed objects can be loaded from a PingFederate inventory artifact."
      ],
      "next_action": "Schedule periodic inventory capture and diff reports."
    },
    {
      "id": "governed_write",
      "label": "Governed write path",
      "status": "guarded",
      "evidence": [
        "Write remains disabled by default.",
        "Execution requires explicit approval phrase.",
        "Plans produce reviewable JSON before execution."
      ],
      "next_action": "Add role-based approvals and signed change reports for enterprise use."
    },
    {
      "id": "enterprise_persistence",
      "label": "Enterprise retention and export",
      "status": "gap",
      "evidence": [
        "Current run state is in-memory.",
        "Long retention, export, and multi-tenant separation are not complete."
      ],
      "next_action": "Add PostgreSQL storage, tenant boundaries, and export packages."
    }
  ],
  "gaps": [
    {
      "id": "oidc_isolation",
      "label": "Dedicated OIDC governance",
      "next_action": "Implement OIDC runtime callbacks and token timer visualization."
    },
    {
      "id": "governed_write",
      "label": "Governed write path",
      "next_action": "Add role-based approvals and signed change reports for enterprise use."
    },
    {
      "id": "enterprise_persistence",
      "label": "Enterprise retention and export",
      "next_action": "Add PostgreSQL storage, tenant boundaries, and export packages."
    }
  ],
  "enterprise_readiness": {
    "airbus_demo": "pilot_ready_with_constraints",
    "multi_company": "requires_tenancy_persistence_and_connector_profiles",
    "security_posture": [
      "No inline secrets in the audit.",
      "No PingFederate write action is performed by audit routes.",
      "Customer-specific PingFederate endpoints should be isolated by target profile."
    ]
  },
  "expected_objects": {
    "saml_sp_connections": [
      "lab-pf-saml-sp-iamlab-saml-a-configured",
      "lab-pf-saml-sp-iamlab-saml-b-configured"
    ],
    "saml_sp_entity_ids": [
      "https://saml-a.sabathe.eu/metadata",
      "https://saml-b.sabathe.eu/metadata"
    ],
    "oidc_clients": [
      "oidc-a",
      "oidc-b"
    ],
    "oidc_token_managers": [
      "labatmoidca",
      "labatmoidcb"
    ],
    "oidc_policies": [
      "laboidcpolicyoidca",
      "laboidcpolicyoidcb"
    ],
    "hub_idp_connections": [
      "labidpconnidpnomfa"
    ],
    "idp_adapters": [
      "labhtmlform"
    ],
    "idp_session_policy": [
      "per_adapter"
    ]
  },
  "observed_objects": {
    "status": "not_provided",
    "objects": {}
  },
  "evidence_state": {
    "status": "pending_inventory",
    "matched": {},
    "missing": {
      "saml_sp_connections": [
        "lab-pf-saml-sp-iamlab-saml-a-configured",
        "lab-pf-saml-sp-iamlab-saml-b-configured"
      ],
      "saml_sp_entity_ids": [
        "https://saml-a.sabathe.eu/metadata",
        "https://saml-b.sabathe.eu/metadata"
      ],
      "oidc_clients": [
        "oidc-a",
        "oidc-b"
      ],
      "oidc_token_managers": [
        "labatmoidca",
        "labatmoidcb"
      ],
      "oidc_policies": [
        "laboidcpolicyoidca",
        "laboidcpolicyoidcb"
      ],
      "hub_idp_connections": [
        "labidpconnidpnomfa"
      ],
      "idp_adapters": [
        "labhtmlform"
      ],
      "idp_session_policy": [
        "per_adapter"
      ]
    }
  }
}