{
  "feature_id": "F-149",
  "agent": "security",
  "stage": "security_gate",
  "verdict": "APPROVED",
  "summary": "Fully parameterized SQL CTE. All user input (dates, UUIDs, channel) via $1..$8 placeholders. RBAC enforced via requireReportingPermission('REPORTING_PRODUCTS'). No new secrets.",
  "checks": [
    {"item": "SQL injection prevention", "ok": true, "evidence": "All user values: $1..$8 parameterized; sortBy is validated ('units_sold'|'gross_sales_cents'), not interpolated as user string"},
    {"item": "Authentication", "ok": true, "evidence": "requireReportingPermission('REPORTING_PRODUCTS') on GET /reporting/products"},
    {"item": "No new secrets", "ok": true, "evidence": "No env vars or credentials added"}
  ],
  "issues": []
}