At this point, we would not emit those attestations. I assume @calle red team and @moneyball Project Loupe would.

As for how such an event should look like: Pick a kind and reference the product queryable with a single-letter tag. Make the git commit ID machine readable. Make the findings actionable. Something like

```json
{
"kind": 4501,
"pubkey": <pubkey>,
"created_at": <timestamp>,
"tags": [
["x", <commit hash>],
["r", <repository url>],
["summary", "No critical findings. One medium: unauthenticated intent handler exposes address book to co-installed apps."],
["criticality", "medium"],
["model", "claude-opus-4-8"],
["prompt", <sha256 of exact prompt text>, <nevent of published prompt>],
["alt", "AI code audit attestation"]
],
"content": "## Audit run\n\nChecked commit `9f2b7c1a…` of ... with prompt `security-sweep-v3` on claude-opus-4-8.\n\n### Findings\n\n**MEDIUM: exported intent handler leaks contacts**\n\n`AddressBookActivity` is exported without permission check…\n\n### Not findings\n\nFlagged and dismissed after review: the `Math.random()` in `ui/Confetti.kt` is cosmetic, not key material.\n\n### Method\n\nFull prompt published at nostr:nevent1…, temperature 0, single pass over `/src/main/`."
}
```