{"schema_version":"1.0","timestamp_utc":"2026-09-01T00:00:00.000000Z","hostname":"synthetic-endpoint","session_id":"synthetic-session-001","cwd":"/synthetic/workspace","permission_mode":"plan","hook_event_name":"SessionStart","tool_name":"SessionStart","tool_use_id":null,"repository_id":"synthetic-repository","action_category":"session_start","decision":"advisory","reason":"Synthetic session start for format demonstration.","control_ids":["H-01","H-07","H-23","H-25"],"threat_ids":["T-09","T-14"],"flow_ids":["L-D1"],"hashed_input":null,"redaction_status":"n/a","evidence_source":"SessionStart","correlation_id":"synthetic-session-001","change_ticket_id":null,"prev_hash":"TOREN-EVIDENCE-CHAIN-V1","record_hash":"3d7bf3fbd9845a70020a43ad97a63dd5889d91e3c28b1a9fb2b63e32541b6e4e"}
{"schema_version":"1.0","timestamp_utc":"2026-09-01T00:00:01.000000Z","hostname":"synthetic-endpoint","session_id":"synthetic-session-001","cwd":"/synthetic/workspace","permission_mode":"plan","hook_event_name":"PreToolUse","tool_name":"Read","tool_use_id":"synthetic-tool-use-001","repository_id":"synthetic-repository","action_category":"cloud_credentials","decision":"deny","reason":"Cloud credentials grant privileged infrastructure access (out of pilot scope).","control_ids":["H-11"],"threat_ids":["T-04","T-12"],"flow_ids":["L-D2","L-D8"],"hashed_input":null,"redaction_status":"n/a","evidence_source":"PreToolUse","correlation_id":"synthetic-session-001","change_ticket_id":null,"prev_hash":"3d7bf3fbd9845a70020a43ad97a63dd5889d91e3c28b1a9fb2b63e32541b6e4e","record_hash":"1b62a99ed7cad5cfbe60fececa1c8274efa4c2530807064d0980804e539f2d43"}