{
  "challenge_id": "SIGNALLINK-FEDERAL-REPRO-V1",
  "published_by": "SignalLink Protocol LLC",
  "federal_reference": {
    "source": "NIST National Vulnerability Database",
    "cve": "CVE-2021-44228",
    "purpose": "Reference identifier only for exercising the federal-source provenance workflow. Authoritative vulnerability facts remain with NIST/NVD."
  },
  "canonicalization_rule": "Recursively sort object keys lexicographically, preserve array order, JSON serialize without whitespace, then SHA-256 UTF-8 bytes.",
  "payload": {
    "event": "SIGNALLINK-FEDERAL-REPRO-CHALLENGE-V1",
    "source": "NIST-NVD",
    "cve": "CVE-2021-44228",
    "sequence": 1,
    "framework": "ADA-4WM",
    "provenance_layer": 33
  },
  "expected_canonical": "{\"cve\":\"CVE-2021-44228\",\"event\":\"SIGNALLINK-FEDERAL-REPRO-CHALLENGE-V1\",\"framework\":\"ADA-4WM\",\"provenance_layer\":33,\"sequence\":1,\"source\":\"NIST-NVD\"}",
  "expected_sha256": "b325608828a14df655f1b81d3a452cbd490292e6f3b5af6cae87bb4e1f0e8c77",
  "success_condition": "An independent implementation produces the exact expected canonical string and SHA-256 digest from the published payload.",
  "validation_boundary": "A PASS demonstrates deterministic cross-implementation reproduction only. It is not NIST, CISA, DoD, U.S. Government, GitHub, Vercel, Sigstore, or other third-party certification or endorsement."
}