{
  "schemaVersion": "1.0.0",
  "generatedAt": "2025-12-10T00:00:00Z",
  "tenant": "tenant-default",
  "purl": "pkg:maven/org.example/foo@1.2.3",
  "advisoryId": "GHSA-xxxx-yyyy-zzzz",
  "source": "ghsa",
  "status": "affected",
  "justifications": [
    {
      "kind": "known_affected",
      "reason": "Upstream GHSA reports affected range <1.3.0.",
      "evidence": ["concelier:ghsa:obs:6561e41b3e3f4a6e9d3b91c1"],
      "weight": 0.8
    }
  ],
  "conflicts": [
    {
      "field": "affected.versions",
      "reason": "vendor_range_differs",
      "values": ["<1.2.0", "<=1.3.0"],
      "sourceIds": [
        "concelier:redhat:obs:6561e41b3e3f4a6e9d3b91a1",
        "concelier:ghsa:obs:6561e41b3e3f4a6e9d3b91c1"
      ]
    }
  ],
  "observations": [
    {
      "id": "concelier:ghsa:obs:6561e41b3e3f4a6e9d3b91c1",
      "contentHash": "sha256:1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd",
      "fetchedAt": "2025-11-19T00:00:00Z"
    }
  ],
  "provenance": {
    "linksetId": "concelier:ghsa:linkset:6561e41b3e3f4a6e9d3b91d0",
    "linksetHash": "sha256:deaddeaddeaddeaddeaddeaddeaddeaddeaddeaddeaddeaddeaddeaddeaddead",
    "observationHashes": [
      "sha256:1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd"
    ],
    "policyHash": "sha256:0f7c0f7c0f7c0f7c0f7c0f7c0f7c0f7c0f7c0f7c0f7c0f7c0f7c0f7c0f7c0f7c",
    "sbomContextHash": "sha256:421af53f9eeba6903098d292fbd56f98be62ea6130b5161859889bf11d699d18",
    "planCacheKey": "tenant-default|pkg:maven/org.example/foo@1.2.3|GHSA-xxxx-yyyy-zzzz"
  },
  "cache": {
    "cached": true,
    "cachedAt": "2025-12-10T00:00:00Z",
    "ttlSeconds": 300
  }
}