{
  "entrypoint_kind": "api_remote",
  "entrypoint_detail": "POST /scheduler/webhook to the real Grav scheduler-webhook plugin; the endpoint calls Scheduler::processWebhookTrigger() -> Scheduler::run() -> JobQueue::popWithId()/reconstructJob() on a queued serialized_job payload",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "php built-in web server",
    "Grav CMS",
    "scheduler-webhook plugin",
    "HTTP POST /scheduler/webhook",
    "Scheduler::processWebhookTrigger",
    "Scheduler::run",
    "JobQueue::popWithId",
    "JobQueue::reconstructJob",
    "Job::run"
  ],
  "proof_artifacts": [
    "logs/fixed_composer_1.log",
    "logs/fixed_composer_2.log",
    "logs/fixed_filecache_gap.log",
    "logs/fixed_health_1_body.txt",
    "logs/fixed_health_1_headers.txt",
    "logs/fixed_health_2_body.txt",
    "logs/fixed_health_2_headers.txt",
    "logs/fixed_jobqueue_gap.log",
    "logs/fixed_queue_files_after_1.txt",
    "logs/fixed_queue_files_after_2.txt",
    "logs/fixed_scheduler_1.log",
    "logs/fixed_scheduler_2.log",
    "logs/fixed_scheduler_health_1_body.json",
    "logs/fixed_scheduler_health_1_headers.txt",
    "logs/fixed_scheduler_health_2_body.json",
    "logs/fixed_scheduler_health_2_headers.txt",
    "logs/fixed_server_1.log",
    "logs/fixed_server_2.log",
    "logs/fixed_session_gap.log",
    "logs/fixed_webhook_curl_1.log",
    "logs/fixed_webhook_curl_2.log",
    "logs/fixed_webhook_request_1.txt",
    "logs/fixed_webhook_request_2.txt",
    "logs/fixed_webhook_response_1_body.json",
    "logs/fixed_webhook_response_1_headers.txt",
    "logs/fixed_webhook_response_2_body.json",
    "logs/fixed_webhook_response_2_headers.txt",
    "logs/payload_fixed_1.generate.log",
    "logs/payload_fixed_2.generate.log",
    "logs/payload_vulnerable_1.generate.log",
    "logs/payload_vulnerable_2.generate.log",
    "logs/vulnerable_composer_1.log",
    "logs/vulnerable_composer_2.log",
    "logs/vulnerable_filecache_gap.log",
    "logs/vulnerable_health_1_body.txt",
    "logs/vulnerable_health_1_headers.txt",
    "logs/vulnerable_health_2_body.txt",
    "logs/vulnerable_health_2_headers.txt",
    "logs/vulnerable_jobqueue_gap.log",
    "logs/vulnerable_queue_files_after_1.txt",
    "logs/vulnerable_queue_files_after_2.txt",
    "logs/vulnerable_scheduler_1.log",
    "logs/vulnerable_scheduler_2.log",
    "logs/vulnerable_scheduler_health_1_body.json",
    "logs/vulnerable_scheduler_health_1_headers.txt",
    "logs/vulnerable_scheduler_health_2_body.json",
    "logs/vulnerable_scheduler_health_2_headers.txt",
    "logs/vulnerable_server_1.log",
    "logs/vulnerable_server_2.log",
    "logs/vulnerable_session_gap.log",
    "logs/vulnerable_webhook_curl_1.log",
    "logs/vulnerable_webhook_curl_2.log",
    "logs/vulnerable_webhook_request_1.txt",
    "logs/vulnerable_webhook_request_2.txt",
    "logs/vulnerable_webhook_response_1_body.json",
    "logs/vulnerable_webhook_response_1_headers.txt",
    "logs/vulnerable_webhook_response_2_body.json",
    "logs/vulnerable_webhook_response_2_headers.txt",
    "logs/webhook_plugin_commit.log",
    "logs/webhook_plugin_fetch.log",
    "repro/payload_fixed_1.b64",
    "repro/payload_fixed_1.generate.log",
    "repro/payload_fixed_2.b64",
    "repro/payload_fixed_2.generate.log",
    "repro/payload_vulnerable_1.b64",
    "repro/payload_vulnerable_1.generate.log",
    "repro/payload_vulnerable_2.b64",
    "repro/payload_vulnerable_2.generate.log",
    "repro/proof_vulnerable_1.txt",
    "repro/proof_vulnerable_2.txt",
    "repro/queue_fixed_1.json",
    "repro/queue_fixed_2.json",
    "repro/queue_vulnerable_1.json",
    "repro/queue_vulnerable_2.json",
    "repro/rca_report.md",
    "repro/reproduction_steps.sh",
    "repro/runtime_manifest.json",
    "repro/validation_verdict.json"
  ],
  "notes": "Two vulnerable 2.0.0-beta.1 attempts executed attacker-controlled serialized Grav Scheduler Job objects when POST /scheduler/webhook triggered JobQueue::reconstructJob(); two fixed 2.0.0-beta.2 attempts processed the same unsigned serialized_job queue files through the same remote endpoint but did not execute them, falling back to benign structured fields due to the HMAC fix."
}