Trace CCI-003 from summary artifact to schema contract

[stacknil]

Review scope

Trace one committed config-change investigation summary item to the schema contract named in docs/evidence-pipeline-contract.md.

Sample input

Use the CCI-003 object in demos/config-change-investigation-demo/artifacts/investigation_summary.json.

Key fields:

{
  "investigation_id": "CCI-003",
  "severity": "high",
  "target_system": "vault-gateway",
  "triggering_change_id": "cfg-004",
  "evidence_counts": {
    "policy_denials": 0,
    "follow_on_events": 0
  }
}

Expected output

schemas/investigation_summary.schema.json should make the object reviewable without adding production meaning:

• investigation_id matches ^CCI-[0-9]{3}$
• severity is one of the documented enum values
• evidence_counts.policy_denials and evidence_counts.follow_on_events are non-negative integers
• the artifact remains a bounded evidence summary, not an incident verdict

Acceptance criteria

• Name the artifact path and schema path.
• Confirm whether CCI-003 satisfies the schema fields above.
• Note any unclear field meaning or documentation route with a small correction.
• Do not expand the five-demo matrix or add live telemetry behavior.

Boundaries

Use committed synthetic artifacts only. This is a schema/documentation review, not a request for production integrations, live telemetry, or final incident conclusions.

[vaishnavidesai09]

Hi! I'd like to take this issue if it's available.

I'll review the committed synthetic artifact (demos/config-change-investigation-demo/artifacts/investigation_summary.json) against the schema contract documented in docs/evidence-pipeline-contract.md and verify that:

• investigation_id matches ^CCI-[0-9]{3}$
• severity is one of the documented enum values
• evidence_counts.policy_denials and evidence_counts.follow_on_events are non-negative integers
• The artifact remains a bounded evidence summary rather than implying an incident verdict

I'll also identify the relevant artifact and schema paths, confirm whether CCI-003 satisfies the documented schema requirements, and note any minor documentation clarifications if needed, without expanding the demo scope or introducing production behavior.

Please assign it to me if it's still available. Thanks!

[stacknil]

Thanks for offering to take this, @vaishnavidesai09. Yes, this is still available. Please feel free to work on it.

Please keep the scope narrow:

• Use the committed synthetic artifact demos/config-change-investigation-demo/artifacts/investigation_summary.json.
• Trace the CCI-003 object to schemas/investigation_summary.schema.json and the schema matrix in docs/evidence-pipeline-contract.md.
• Confirm the requested schema points: investigation_id, severity, evidence_counts.policy_denials, and evidence_counts.follow_on_events.
• The v1.2 compatibility matrix records this artifact contract as investigation-summary/v1 with unchanged-v1 compatibility.
• Please start by posting the trace result in this issue. The existing schema test already validates the committed artifact, so open a focused docs/test PR only if you find a concrete documentation ambiguity or missing test case. There is no need to add redundant coverage solely to create a PR.
• Do not expand the five-demo matrix, add live telemetry behavior, or imply an incident verdict.

Thanks!