{
  "checker": {
    "claims": [
      {
        "claim": "The scanner detects listed DeepSeek indicators and reports locations and evidence.",
        "command": "<guest-path> scan tests/fixtures/positive --format json --out <guest-path>",
        "evidence": "\"total_findings\": 26,\n    \"by_severity\": {\n      \"critical\": 2,\n      \"high\": 22,\n      \"medium\": 2\n    }\n  },\n  \"findings\": [\n    {\n      \"rule_id\": \"DS-001\",\n      \"rule_name\": \"DeepSeek hosted API endpoint\",\n      \"severity\": \"critical\",\n      \"component\": {\n        \"name\": \"api.deepseek.com\",\n        \"type\": \"hosted-api-endpoint\",\n        \"vendor\": \"DeepSeek\"\n      },\n      \"evidence\": {\n        \"type\": \"api_endpoint\",\n        \"source_file\": \"app.py\",\n        \"line\": 8,\n        \"snippet\": \"base_url=\\\"https://api.deepseek.com\\\",\"\n      },\n      \"regulatory_context\": \"Direct calls to DeepSee",
        "expected": "26 findings in JSON with evidence and source locations",
        "input": "tests/fixtures/positive",
        "kind": "claim",
        "outcome": "Real input produced the expected result: \"total_findings\": 26",
        "returncode": 0,
        "source": "Every finding carries the rule id, severity, `file:line` location and the matched line itself (with anything that looks like a live secret redacted before it can reach a shared report).",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      }
    ],
    "cycle_checks": [
      {
        "claim": "Scheduled or looping main behavior",
        "command": "",
        "evidence": "The README and CLI expose one-shot scans; no scheduler, recurring loop, webhook, or cycle trigger is documented.",
        "expected": "identify the product trigger",
        "input": "source inspection",
        "kind": "cycle",
        "outcome": "The README and CLI expose one-shot scans; no scheduler, recurring loop, webhook, or cycle trigger is documented.",
        "source": "repository entry points",
        "verdict": "yes"
      }
    ],
    "details": {
      "argv": [
        "<guest-path>",
        "scan",
        "tests/fixtures/positive",
        "--format",
        "json",
        "--out",
        "<guest-path>"
      ],
      "expected_file": "<guest-path>",
      "file_checked": true,
      "file_excerpt": "\"total_findings\": 26,\n    \"by_severity\": {\n      \"critical\": 2,\n      \"high\": 22,\n      \"medium\": 2\n    }\n  },\n  \"findings\": [\n    {\n      \"rule_id\": \"DS-001\",\n      \"rule_name\": \"DeepSeek hosted API endpoint\",\n      \"severity\": \"critical\",\n      \"component\": {\n        \"name\": \"api.deepseek.com\",\n        \"type\": \"hosted-api-endpoint\",\n        \"vendor\": \"DeepSeek\"\n      },\n      \"evidence\": {\n        \"type\": \"api_endpoint\",\n        \"source_file\": \"app.py\",\n        \"line\": 8,\n        \"snippet\": \"base_url=\\\"https://api.deepseek.com\\\",\"\n      },\n      \"regulatory_context\": \"Direct calls to DeepSeek-hosted API endpoints mean prompts and data are sent to infrastructure operated by the excluded vendor. References DHS Exclusion and Removal Order #2026-01 (procurement exclusion of DeepSeek products and services).\",\n      \"remediation\": \"Replace the endpoint with an approved model provider. If the endpoint is only in a comment or dead code, remove it and record the removal in your evidence file.\"\n    },\n    {\n      \"rule_id\": \"DS-009\",\n      \"rule_name\": \"DeepSeek model weight file (by filename)\",\n      \"severity\": \"critical\",\n      \"component\": {\n        \"name\": \"deepseek-r1-distill-qwen-7b.gguf\",\n        \"type\": \"ai-model-weights\",\n        \"vendor\": \"DeepSeek\"\n      },\n      \"evidence\": {\n        \"type\": \"artifact_filename\",\n        \"source_file\": \"models/deepseek-r1-distill-qwen-7b.gguf\",\n        \"line\": null,\n        \"snippet\": \"model artifact file named 'deepseek-r1-distill-qwen-7b.gguf'\"\n      },\n      \"regulatory_context\": \"A first-party DeepSeek weight file inside the product directory is a DeepSeek implementation artifact in the most literal sense covered by Order #2026-01.\",\n      \"remediation\": \"Remove the weight file from the product and from any image or bundle that embeds it. If weights were renamed, verify provenance with metadata or fingerprint tooling (see the project roadmap) rather than filenames.\"\n    },\n    {\n      \"rule_id\": \"DS-002\",\n      \"rule_name\": \"DeepSeek API credential / configuration variable\",\n      \"severity\": \"high\",\n      \"component\": {\n        \"name\": \"DEEPSEEK_API_KEY\",\n        \"type\": \"vendor-configuration\",\n        \"vendor\": \"DeepSeek\"\n      },\n      \"evidence\": {\n        \"type\": \"env_var\",\n        \"source_file\": \".env.example\",\n        \"line\": 2,\n        \"snippet\": \"DEEPSEEK_API_KEY=sk--***REDACTED***\"\n      },\n      \"regulatory_context\": \"Configuration for the excluded vendor's API indicates an integration point, even if the key itself is not present in the repository.\",\n      \"remediation\": \"Remove the variable from code, examples and deployment configuration. Rotate any real key that was ever committed, then record the change in your evidence file.\"\n    },\n    {\n      \"rule_id\": \"DS-002\",\n      \"rule_name\": \"DeepSeek API credential / configuration variable\",\n      \"severity\": \"high\",\n      \"component\": {\n        \"name\": \"DEEPSEEK_MODEL\",\n        \"type\": \"vendor-configuration\",\n        \"vendor\": \"DeepSeek\"\n      },\n      \"evidence\": {\n        \"type\": \"env_var\",\n        \"source_file\": \".env.example\",\n        \"line\": 3,\n        \"snippet\": \"DEEPSEEK_MODEL=deepseek-chat\"\n      },\n      \"regulatory_context\": \"Configuration for the excluded vendor's API indicates an integration point, even if the key itself is not present in the repository.\",\n      \"remediation\": \"Remove the variable from code, examples and deployment configuration. Rotate any real key that was ever committed, then record the change in your evidence file.\"\n    },\n    {\n      \"rule_id\": \"DS-003\",\n      \"rule_name\": \"DeepSeek model identifier string\",\n      \"severity\": \"high\",\n      \"component\": {\n        \"name\": \"deepseek-chat\",\n        \"type\": \"ai-model\",\n        \"vendor\": \"DeepSeek\"\n      },\n      \"evidence\": {\n        \"type\": \"model_name\",\n        \"source_file\": \".env.example\",\n        \"line\": 3,\n        \"snippet\": \"DEEPSEEK_MODEL=deepseek-chat\"\n      },\n      \"regulatory_context\": \"A DeepSeek model identifier in code or configuration indicates the product requests, loads or routes to a DeepSeek model, directly or through a gateway.\",\n      \"remediation\": \"Identify the call path that uses this model id, swap it for an approved model, and re-run this scan to confirm the identifier is gone.\"\n    },\n    {\n      \"rule_id\": \"DS-003\",\n      \"rule_name\": \"DeepSeek model identifier string\",\n      \"severity\": \"high\",\n      \"component\": {\n        \"name\": \"deepseek-r1\",\n        \"type\": \"ai-model\",\n        \"vendor\": \"DeepSeek\"\n      },\n      \"evidence\": {\n        \"type\": \"model_name\",\n        \"source_file\": \"Dockerfile\",\n        \"line\": 5,\n        \"snippet\": \"RUN ollama pull deepseek-r1:7b\"\n      },\n      \"regulatory_context\": \"A DeepSeek model identifier in code or configuration indicates the product requests, loads or routes to a DeepSeek model, directly or through a gateway.\",\n      \"remediation\": \"Identify the call path that uses this model id, swap it for an approved model, and re-run this scan to confirm the identifier is gone.\"\n    },\n    {\n      \"rule_id\": \"DS-008\",\n      \"rule_name\": \"DeepSeek reference in container / deployment definition\",\n      \"severity\": \"high\",\n      \"component\": {\n        \"name\": \"deepseek\",\n        \"type\": \"deployment-artifact\",\n        \"vendor\": \"DeepSeek\"\n      },\n      \"evidence\": {\n        \"type\": \"container\",\n        \"source_file\": \"Dockerfile\",\n        \"line\": 5,\n        \"snippet\": \"RUN ollama pull deepseek-r1:7b\"\n      },\n      \"regulatory_context\": \"Container definitions that pull DeepSeek images or models (for example via ollama pull deepseek-*) bake the excluded vendor's models into the deployed artifact.\",\n      \"remediation\": \"Swap the image or model pull for an approved model, rebuild the image, and re-scan the rebuilt definitions.\"\n    },\n    {\n      \"rule_id\": \"DS-005\",\n      \"rule_name\": \"DeepSeek SDK import\",\n      \"severity\": \"high\",\n      \"component\": {\n        \"name\": \"import deepseek\",\n        \"type\": \"vendor-sdk\",\n        \"vendor\": \"DeepSeek\"\n      },\n      \"evidence\": {\n        \"type\": \"sdk_import\",\n        \"source_file\": \"app.py\",\n        \"line\": 3,\n        \"snippet\": \"import deepseek\"\n      },\n      \"regulatory_context\": \"Importing a DeepSeek SDK (first-party or a client wrapper for the DeepSeek API) is direct evidence of a code-level integration with the excluded vendor's service.\",\n      \"remediation\": \"Remove the SDK usage and route the affected feature through an approved provider's SDK. Check dependency manifests too (rule DS-006).\"\n    },\n    {\n      \"rule_id\": \"DS-002\",\n      \"rule_name\": \"DeepSeek API credential / configuration variable\",\n      \"severity\": \"high\",\n      \"component\": {\n        \"name\": \"DEEPSEEK_API_KEY\",\n        \"type\": \"vendor-configuration\",\n        \"vendor\": \"DeepSeek\"\n      },\n      \"evidence\": {\n        \"type\": \"env_var\",\n        \"source_file\": \"app.py\",\n        \"line\": 7,\n        \"snippet\": \"api_key=<secret>\\\"DEEPSEEK_API_KEY\\\"],\"\n      },\n      \"regulatory_context\": \"Configuration for the excluded vendor's API indicates an integration point, even if the key itself is not present in the repository.\",\n      \"remediation\": \"Remove the variable from code, examples and deployment configuration. Rotate any real key that was ever committed, then record the change in your evidence file.\"\n    },\n    {\n      \"rule_id\": \"DS-003\",\n      \"rule_name\": \"DeepSeek model identifier string\",\n      \"severity\": \"high\",\n      \"component\": {\n        \"name\": \"deepseek-chat\",\n        \"type\": \"ai-model\",\n        \"vendor\": \"DeepSeek\"\n      },\n      \"evidence\": {\n        \"type\": \"model_name\",\n        \"source_file\": \"app.py\",\n        \"line\": 13,\n        \"snippet\": \"model=\\\"deepseek-chat\\\",\"\n      },\n      \"regulatory_context\": \"A DeepSeek model identifier in code or configuration indicates the product requests, loads or routes to a DeepSeek model, directly or through a gateway.\",\n      \"remediation\": \"Identify the call path that uses this model id, swap it for an approved model, and re-run this scan to confirm the identifier is gone.\"\n    },\n    {\n      \"rule_id\": \"DS-003\",\n      \"rule_name\": \"DeepSeek model identifier string\",\n      \"severity\": \"high\",\n      \"component\": {\n        \"name\": \"deepseek-reasoner\",\n        \"type\": \"ai-model\",\n        \"vendor\": \"DeepSeek\"\n      },\n      \"evidence\": {\n        \"type\": \"model_name\",\n        \"source_file\": \"app.py\",\n        \"line\": 20,\n        \"snippet\": \"model=\\\"deepseek-reasoner\\\",\"\n      },\n      \"regulatory_context\": \"A DeepSeek model identifier in code or configuration indicates the product requests, loads or routes to a DeepSeek model, directly or through a gateway.\",\n      \"remediation\": \"Identify the call path that uses this model id, swap it for an approved model, and re-run this scan to confirm the identifier is gone.\"\n    },\n    {\n      \"rule_id\": \"DS-002\",\n      \"rule_name\": \"DeepSeek API credential / configuration variable\",\n      \"severity\": \"high\",\n      \"component\": {\n        \"name\": \"DEEPSEEK_API_KEY\",\n        \"type\": \"vendor-configuration\",\n        \"vendor\": \"DeepSeek\"\n      },\n      \"evidence\": {\n        \"type\": \"env_var\",\n        \"source_file\": \"docker-compose.yml\",\n        \"line\": 5,\n        \"snippet\": \"- DEEPSEEK_API_KEY=sk--***REDACTED***\"\n      },\n      \"regulatory_context\": \"Configuration for the excluded vendor's API indicates an integration point, even if the key itself is not present in the repository.\",\n      \"remediation\": \"Remove the variable from code, examples and deployment configuration. Rotate any real key that was ever committed, then record the change in your evidence file.\"\n    },\n    {\n      \"rule_id\": \"DS-008\",\n      \"rule_name\": \"DeepSeek reference in container / deployment definition\",\n      \"severity\": \"high\",\n      \"component\": {\n        \"name\": \"DEEPSEEK\",\n        \"type\": \"deployment-artifact\",\n        \"vendor\": \"DeepSeek\"\n      },\n      \"evidence\": {\n        \"type\": \"container\",\n        \"source_file\": \"docker-compose.yml\",\n        \"line\": 5,\n        \"snippet\": \"- DEEPSEEK_API_KEY=sk--***REDACTED***\"\n      },\n      \"regulatory_context\": \"Container definitions that pull DeepSeek images or models (for example via ollama pull deepseek-*) bake the excluded vendor's models into the deployed artifact.\",\n      \"remediation\": \"Swap the image or model pull for an approved model, rebuild the image, and re-scan the rebuilt definitions.\"\n    },\n    {\n      \"rule_id\": \"DS-003\",\n      \"rule_name\": \"DeepSeek model identifier string\",\n      \"severity\": \"high\",\n      \"component\": {\n        \"name\": \"deepseek-r1\",\n        \"type\": \"ai-model\",\n        \"vendor\": \"DeepSeek\"\n      },\n      \"evidence\": {\n        \"type\": \"model_name\",\n        \"source_file\": \"docker-compose.yml\",\n        \"line\": 7,\n        \"snippet\": \"image: registry.example.invalid/deepseek-r1:latest\"\n      },\n      \"regulatory_context\": \"A DeepSeek model identifier in code or configuration indicates the product requests, loads or routes to a DeepSeek model, directly or through a gateway.\",\n      \"remediation\": \"Identify the call path that uses this model id, swap it for an approved model, and re-run this scan to confirm the identifier is gone.\"\n    },\n    {\n      \"rule_id\": \"DS-008\",\n      \"rule_name\": \"DeepSeek reference in container / deployment definition\",\n      \"severity\": \"high\",\n      \"component\": {\n        \"name\": \"deepseek\",\n        \"type\": \"deployment-artifact\",\n        \"vendor\": \"DeepSeek\"\n      },\n      \"evidence\": {\n        \"type\": \"container\",\n        \"source_file\": \"docker-compose.yml\",\n        \"line\": 7,\n        \"snippet\": \"image: registry.example.invalid/deepseek-r1:latest\"\n      },\n      \"regulatory_context\": \"Container definitions that pull DeepSeek images or models (for example via ollama pull deepseek-*) bake the excluded vendor's models into the deployed artifact.\",\n      \"remediation\": \"Swap the image or model pull for an approved model, rebuild the image, and re-scan the rebuilt definitions.\"\n    },\n    {\n      \"rule_id\": \"DS-010\",\n      \"rule_name\": \"DeepSeek architecture",
      "kind": "cli",
      "needs_browser": false,
      "needs_credentials": false,
      "returncode": 0,
      "scope": "product operation",
      "stderr": "deepseek-scan: 26 finding(s) in 9 file(s); report written to <guest-path>",
      "stdout": "",
      "working": true
    },
    "evidence_strength": "readme_checked",
    "example_checks": [
      {
        "claim": "README positive fixture example scan",
        "command": "<guest-path> scan tests/fixtures/positive --format json --out <guest-path>",
        "deferred": false,
        "evidence": "eway's own domains and model names; or any use that leaves no artifact in the scanned tree.\\n\\nA report with findings is evidence that the listed indicators are present at the listed locations. A report without findings means only that none of the indicators in the current rule set were found in the scanned tree; it is not proof that no DeepSeek-derived component exists in a product. Determinations about obligations under DHS Exclusion and Removal Order #2026-01 or FAR 52.204-30 rest with each organization and its counsel. This tool is an evidence-collection aid, not a legal determination.\"\n}\n",
        "expected": "JSON report has 26 findings",
        "input": "tests/fixtures/positive",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md / Example output",
        "verdict": "yes"
      }
    ],
    "status": "PASS"
  },
  "deviations": [
    "Direct system pip install failed with externally-managed-environment; installation succeeded in a virtual environment."
  ],
  "fault_owner": null,
  "main_blocker": null,
  "operation": "Scan a codebase for DeepSeek indicators and write a JSON evidence report.",
  "operation_scope": "Python 3.10+; installed from the checkout into <guest-path> Scanned the repository's positive fixture.",
  "outcome": "working",
  "plain_failure": null,
  "steps": [
    "Checked Python 3.12.3 against the README requirement of Python 3.10+.",
    "Attempted python3 -m pip install .; system Python rejected it because the environment is externally managed.",
    "Created <guest-path> and installed the checkout with <guest-path> -m pip install .",
    "Ran <guest-path> scan tests/fixtures/positive --format json --out <guest-path>; it reported 26 findings in 9 files.",
    "Validated and replayed probe, claim, example, and cycle evidence successfully."
  ],
  "stuck_step": null,
  "suggested_fix": null
}