{
  "schema_version": "1.0",
  "synthetic": true,
  "request": {
    "request_id": "SYN-PHISH-001-classification",
    "question": "Which incident family should an analyst investigate first?",
    "options": ["phishing", "endpoint-malware", "suspicious-login", "data-exfiltration"],
    "evidence_refs": ["EVD-PHISH-01", "EVD-PHISH-02"],
    "state": "A simulated staff mailbox received a brand-impersonation message linking to a synthetic credential page.",
    "policy_version": "synthetic-triage-v1"
  },
  "result": {
    "request_id": "SYN-PHISH-001-classification",
    "provider": "local-fixture",
    "model": "deterministic-scenario-map",
    "model_version": "1",
    "choice": "phishing",
    "evidence_refs": ["EVD-PHISH-01", "EVD-PHISH-02"],
    "probabilities": null,
    "confidence": null,
    "confidence_method": null,
    "calibration_ref": null,
    "status": "proposed"
  },
  "policy": {
    "evidence_sufficiency": "fixture references available; analyst verification required",
    "asset_criticality": 3,
    "escalation": "analyst-review",
    "final_disposition": "pending-human-review",
    "execution_authorized": false
  },
  "limitations": "Synthetic fixture lookup, not model inference or a verified conclusion. References do not establish truth. No action executes."
}