The certificate report should classify supplied validity metadata at a chosen time. Implement the checks so exact validity boundaries follow the policy and malformed windows are rejected.
Build the implementation in Go under /app, with /app/run.sh as its entry point. Read one JSON request from standard input and write one JSON result to standard output. Input has integer now and certificates with unique string id, integer not_before and not_after. Validity is [not_before,not_after). Return records in input order with id and status valid/not_yet_valid/expired. Reject reversed or empty validity intervals, duplicate IDs and boolean/noninteger times. This inspects synthetic validity metadata only; signatures and trust chains are outside scope.
Reject inputs that violate an explicit validation rule with exit status 2, no standard output, and {"error":"invalid_input"} on standard error. For valid input, exit with status 0. Keep the implementation reusable for new inputs; it must work offline and must not depend on the example data being the only data it receives.
Repair or replace the unfinished /app/run.sh and add source files under /app. Malformed JSON must use the same invalid-input response. Do not read /tests or /oracle from the application.