{
  "schema": "MAKNOW_SAFE_LOCAL_SCENARIO_v1",
  "lesson_id": "SEC-016",
  "lab_id": "SEC016-LAB1",
  "purpose": "Construct and challenge a version-pinned ASVS/SSDF verification baseline using fixed synthetic evidence only; no real scanning, exploitation, credentials or external target.",
  "environment": "Portable synthetic local fixture only; no production account, real credential, external target or irreversible network side effect is required.",
  "fixture": "A fully local synthetic web-service release contains a fixed threat-model summary, harmless control-test outputs, code-review evidence and build provenance metadata. The learner receives a small preselected set of version-pinned ASVS references plus SSDF practice references and builds a baseline without scanning or attacking any real system.",
  "expected_artifact": "Security Verification Baseline Traceability Record v1",
  "failure_probes": [
    "Remove the version from one ASVS reference and verify the baseline refuses a stable requirement identity claim.",
    "Relabel NIST SSDF 1.2 Initial Public Draft as FINAL and verify the source-status gate rejects the row.",
    "Remove evidence from a selected requirement/practice and verify the row remains OPEN rather than PASS.",
    "Mark an item NOT_APPLICABLE without rationale and verify the decision is rejected until the applicability boundary is documented.",
    "Remove one evidence locator and verify the baseline can no longer support PASS for that row."
  ],
  "safety_constraints": "Synthetic defensive environment only; no real credentials, production systems, external targets, exploitation, vulnerability scanning or covert access."
}