{
  "kind": "inspection_incomplete",
  "product_version": "0.12.897",
  "wheel_sha256": "a9c3bf17b036c5f661df05ba4a02cf3afa834b44c2492f3e60fb3b66061a0a24",
  "method": "Published detector functions evaluated on authored inert events or disposable configuration files.",
  "scope": "No live agent, runtime adapter, daemon ingestion, product UI, external command or network action was exercised.",
  "cases": [
    {
      "case": "oversized-arguments",
      "inputs": {
        "events_recipe": "[call('echo ' + 'z' * 200000)]",
        "input_command_sha256": "baa8ee911504e50658341e26106d84e7fadcb95f3ab80ec9274b3ea7631a8660"
      },
      "expected_severity": "info",
      "actual_severity": "info",
      "findings": [
        {
          "kind": "inspection_incomplete",
          "session_id": "claude_code:example",
          "runtime": "claude_code",
          "severity": "info",
          "title": "Credential inspection reached a limit",
          "detail": "Some tool payloads exceeded the bounded credential scan. Their contents have not been fully inspected; this does not establish malicious intent.",
          "evidence": {
            "limited_payloads": 1,
            "reasons": [
              "input_size"
            ],
            "observed": "tool_arguments_and_results"
          },
          "first_bad_step": 0,
          "spend_at_risk_usd": 0.0,
          "spend_basis": "unknown",
          "burn_rate_usd_per_min": 0.0,
          "session_cost_usd": 0.0,
          "frameworks": {
            "mapping_version": "2026-09-27.1",
            "owasp_llm": [],
            "owasp_asi": [],
            "atlas": [],
            "mapped": false,
            "mode": "detect",
            "pre_action_control": false
          }
        }
      ]
    },
    {
      "case": "ordinary-arguments",
      "inputs": {
        "events_newest_first": [
          {
            "event_type": "tool_call",
            "ts": "2026-09-27T12:00:00Z",
            "data": {
              "tool": "Bash",
              "args": {
                "command": "git status"
              }
            }
          }
        ]
      },
      "expected_severity": null,
      "actual_severity": null,
      "findings": []
    }
  ]
}