[
  {
    "schema_version": "1.0",
    "timestamp_utc": "2026-09-01T00:00:00.000000Z",
    "hostname": "synthetic-endpoint",
    "session_id": "synthetic-session-001",
    "cwd": "/synthetic/workspace",
    "permission_mode": "plan",
    "hook_event_name": "SessionStart",
    "tool_name": "SessionStart",
    "tool_use_id": null,
    "repository_id": "synthetic-repository",
    "action_category": "session_start",
    "decision": "advisory",
    "reason": "Synthetic session start for format demonstration.",
    "control_ids": [
      "H-01",
      "H-07",
      "H-23",
      "H-25"
    ],
    "threat_ids": [
      "T-09",
      "T-14"
    ],
    "flow_ids": [
      "L-D1"
    ],
    "hashed_input": null,
    "redaction_status": "n/a",
    "evidence_source": "SessionStart",
    "correlation_id": "synthetic-session-001",
    "change_ticket_id": null,
    "prev_hash": "TOREN-EVIDENCE-CHAIN-V1",
    "record_hash": "3d7bf3fbd9845a70020a43ad97a63dd5889d91e3c28b1a9fb2b63e32541b6e4e"
  },
  {
    "schema_version": "1.0",
    "timestamp_utc": "2026-09-01T00:00:01.000000Z",
    "hostname": "synthetic-endpoint",
    "session_id": "synthetic-session-001",
    "cwd": "/synthetic/workspace",
    "permission_mode": "plan",
    "hook_event_name": "PreToolUse",
    "tool_name": "Read",
    "tool_use_id": "synthetic-tool-use-001",
    "repository_id": "synthetic-repository",
    "action_category": "cloud_credentials",
    "decision": "deny",
    "reason": "Cloud credentials grant privileged infrastructure access (out of pilot scope).",
    "control_ids": [
      "H-11"
    ],
    "threat_ids": [
      "T-04",
      "T-12"
    ],
    "flow_ids": [
      "L-D2",
      "L-D8"
    ],
    "hashed_input": null,
    "redaction_status": "n/a",
    "evidence_source": "PreToolUse",
    "correlation_id": "synthetic-session-001",
    "change_ticket_id": null,
    "prev_hash": "3d7bf3fbd9845a70020a43ad97a63dd5889d91e3c28b1a9fb2b63e32541b6e4e",
    "record_hash": "1b62a99ed7cad5cfbe60fececa1c8274efa4c2530807064d0980804e539f2d43"
  }
]