{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "rendered-object-set://sha256/621e8c6f4821c078",
      "digest": {
        "sha256": "621e8c6f4821c078f73d768f0a5ef8e028b203f41c717657d1420d9f0444f407"
      }
    },
    {
      "name": "k8s-live-workloads://namespace/redis",
      "digest": {
        "sha256": "8f22f9b0736c95140b09fb6030598395e3d25159582041b135ca5be76658fd32"
      }
    }
  ],
  "predicateType": "https://cub-scout.dev/receipt/v1",
  "predicate": {
    "version": "v1",
    "claim": "desired workloads from runs/redis-upgrade-app-proof/observations/staging-desired.yaml converged to a ready state in the live cluster",
    "scope": {
      "kind": "WorkloadSet",
      "name": "rendered-install",
      "namespace": "redis"
    },
    "verifier": {
      "tool": "cub-scout",
      "version": "dev"
    },
    "verifiedAt": "2026-07-27T23:06:21Z",
    "freshness": {
      "observedAt": "2026-07-27T23:06:21Z",
      "expiresAt": "2026-07-28T00:06:21Z",
      "ttl": "1h0m0s"
    },
    "predicateName": "workloads-converged",
    "verdict": "PASS",
    "evidence": {
      "workloads": {
        "desiredSource": {
          "type": "file",
          "ref": "runs/redis-upgrade-app-proof/observations/staging-desired.yaml",
          "digest": "11cd3f77927eaf566c58449ae7aafb8a878d42d500b43772de8948c440c4993c",
          "objectCount": 14
        },
        "scope": {
          "kind": "namespace",
          "namespace": "redis"
        },
        "observedAt": "2026-07-27T23:06:21Z",
        "desiredDigest": "621e8c6f4821c078f73d768f0a5ef8e028b203f41c717657d1420d9f0444f407",
        "liveDigest": "8f22f9b0736c95140b09fb6030598395e3d25159582041b135ca5be76658fd32",
        "summary": {
          "desired": 14,
          "converged": 14,
          "progressing": 0,
          "failed": 0,
          "missing": 0,
          "inconclusive": 0
        },
        "workloads": [
          {
            "id": {
              "apiVersion": "apps/v1",
              "kind": "StatefulSet",
              "namespace": "redis",
              "name": "redis-master"
            },
            "status": "converged",
            "kstatusStatus": "Current",
            "kstatusMessage": "All replicas scheduled as expected. Replicas: 1",
            "ageSeconds": 68
          },
          {
            "id": {
              "apiVersion": "apps/v1",
              "kind": "StatefulSet",
              "namespace": "redis",
              "name": "redis-replicas"
            },
            "status": "converged",
            "kstatusStatus": "Current",
            "kstatusMessage": "All replicas scheduled as expected. Replicas: 2",
            "ageSeconds": 68
          },
          {
            "id": {
              "apiVersion": "networking.k8s.io/v1",
              "kind": "NetworkPolicy",
              "namespace": "redis",
              "name": "redis"
            },
            "status": "converged",
            "kstatusStatus": "Current",
            "kstatusMessage": "Resource is current",
            "ageSeconds": 68
          },
          {
            "id": {
              "apiVersion": "policy/v1",
              "kind": "PodDisruptionBudget",
              "namespace": "redis",
              "name": "redis-master"
            },
            "status": "converged",
            "kstatusStatus": "Current",
            "kstatusMessage": "AllowedDisruptions has been computed.",
            "ageSeconds": 68
          },
          {
            "id": {
              "apiVersion": "policy/v1",
              "kind": "PodDisruptionBudget",
              "namespace": "redis",
              "name": "redis-replicas"
            },
            "status": "converged",
            "kstatusStatus": "Current",
            "kstatusMessage": "AllowedDisruptions has been computed.",
            "ageSeconds": 68
          },
          {
            "id": {
              "apiVersion": "v1",
              "kind": "ConfigMap",
              "namespace": "redis",
              "name": "redis-configuration"
            },
            "status": "converged",
            "kstatusStatus": "Current",
            "kstatusMessage": "Resource is always ready",
            "ageSeconds": 68
          },
          {
            "id": {
              "apiVersion": "v1",
              "kind": "ConfigMap",
              "namespace": "redis",
              "name": "redis-health"
            },
            "status": "converged",
            "kstatusStatus": "Current",
            "kstatusMessage": "Resource is always ready",
            "ageSeconds": 68
          },
          {
            "id": {
              "apiVersion": "v1",
              "kind": "ConfigMap",
              "namespace": "redis",
              "name": "redis-scripts"
            },
            "status": "converged",
            "kstatusStatus": "Current",
            "kstatusMessage": "Resource is always ready",
            "ageSeconds": 68
          },
          {
            "id": {
              "apiVersion": "v1",
              "kind": "Namespace",
              "name": "redis"
            },
            "status": "converged",
            "kstatusStatus": "Current",
            "kstatusMessage": "Resource is current",
            "ageSeconds": 87
          },
          {
            "id": {
              "apiVersion": "v1",
              "kind": "ServiceAccount",
              "namespace": "redis",
              "name": "redis-master"
            },
            "status": "converged",
            "kstatusStatus": "Current",
            "kstatusMessage": "Resource is current",
            "ageSeconds": 68
          },
          {
            "id": {
              "apiVersion": "v1",
              "kind": "ServiceAccount",
              "namespace": "redis",
              "name": "redis-replica"
            },
            "status": "converged",
            "kstatusStatus": "Current",
            "kstatusMessage": "Resource is current",
            "ageSeconds": 68
          },
          {
            "id": {
              "apiVersion": "v1",
              "kind": "Service",
              "namespace": "redis",
              "name": "redis-headless"
            },
            "status": "converged",
            "kstatusStatus": "Current",
            "kstatusMessage": "Service is ready",
            "ageSeconds": 68
          },
          {
            "id": {
              "apiVersion": "v1",
              "kind": "Service",
              "namespace": "redis",
              "name": "redis-master"
            },
            "status": "converged",
            "kstatusStatus": "Current",
            "kstatusMessage": "Service is ready",
            "ageSeconds": 68
          },
          {
            "id": {
              "apiVersion": "v1",
              "kind": "Service",
              "namespace": "redis",
              "name": "redis-replicas"
            },
            "status": "converged",
            "kstatusStatus": "Current",
            "kstatusMessage": "Service is ready",
            "ageSeconds": 68
          }
        ]
      }
    },
    "omissions": [
      {
        "missing": "workload-convergence-snapshot",
        "reason": "workloads-converged reflects readiness observed at verifiedAt; it does not prove the workloads stay converged afterward",
        "severity": "info"
      }
    ],
    "inputAttestations": [],
    "nextSteps": [
      {
        "actionType": "read-only",
        "reason": "every desired workload reached a ready/converged state",
        "nextCommand": "cub-scout doctor",
        "nextSurface": "cub-scout"
      }
    ],
    "fingerprint": "sha256:a18678faed5ea0adf175558bd5ff6eaf09574782ef1322cfe53f9507cb6bf17d"
  }
}