{
  "schema_version": 1,
  "updated_at": "2026-07-05T13:46:07.956446940Z",
  "entries": [
    {
      "logical_path": "repro/reproduction_steps.sh",
      "stage": "repro",
      "role": "primary_reproducer",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after repro stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "repro/rca_report.md",
      "stage": "repro",
      "role": "root_cause_analysis",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after repro stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "repro/validation_verdict.json",
      "stage": "repro",
      "role": "validation_verdict",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after repro stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "repro/runtime_manifest.json",
      "stage": "repro",
      "role": "runtime_manifest",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared supplemental repro stage artifact",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "repro/artifacts/vuln_union_1.body",
      "stage": "repro",
      "role": "request_response",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Unauthenticated REST response body from vulnerable 1.1.11 containing the leaked admin user_login (sqliadmin) via UNION-based SQL injection.",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "repro/artifacts/fixed_union_1.body",
      "stage": "repro",
      "role": "request_response",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Negative-control REST response body from fixed 1.1.12 showing NO leak of the admin username.",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "repro/artifacts/vuln_sleep_1.body",
      "stage": "repro",
      "role": "request_response",
      "destination": "private_only",
      "required_for_verdict": true,
      "publishable": false,
      "reason": "Response body from the vulnerable SLEEP(5) attempt (request took ~5.2s, proving time-based blind SQLi).",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "repro/artifacts/fixed_sleep_1.body",
      "stage": "repro",
      "role": "request_response",
      "destination": "private_only",
      "required_for_verdict": true,
      "publishable": false,
      "reason": "Negative-control response body from the fixed SLEEP(5) attempt (request took ~0.1s, no sleep).",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "logs/reproduction_steps.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "private_only",
      "required_for_verdict": true,
      "publishable": false,
      "reason": "Full reproduction script output log capturing timings, leak counts, plugin versions, and confirmation.",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "repro/artifacts/fixed_sleep_1.body",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "repro/artifacts/fixed_sleep_2.body",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "repro/artifacts/fixed_union_1.body",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "repro/artifacts/fixed_union_2.body",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "repro/artifacts/vuln_sleep_1.body",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "repro/artifacts/vuln_sleep_2.body",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "repro/artifacts/vuln_union_1.body",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "repro/artifacts/vuln_union_2.body",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "logs/vuln_variant_reproduction.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "session_replay",
      "required_for_verdict": false,
      "publishable": true,
      "reason": "Full stdout/stderr log of the variant/bypass analysis runs (vulnerable 1.1.11, fixed 1.1.12, latest 1.1.13 candidate sweeps with SLEEP timings).",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "vuln_variant/reproduction_steps.sh",
      "stage": "repro",
      "role": "primary_reproducer",
      "destination": "session_replay",
      "required_for_verdict": false,
      "publishable": true,
      "reason": "Variant/bypass reproduction script: tests 4 materially-distinct unauthenticated entry points against vulnerable 1.1.11, fixed 1.1.12, and latest 1.1.13 with the SLEEP time oracle; exit 1 = no bypass.",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "vuln_variant/runtime_manifest.json",
      "stage": "repro",
      "role": "runtime_manifest",
      "destination": "session_replay",
      "required_for_verdict": false,
      "publishable": true,
      "reason": "Runtime manifest with per-candidate SLEEP timings on all three builds; confirmation_status=no_bypass.",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "vuln_variant/validation_verdict.json",
      "stage": "judge",
      "role": "validation_verdict",
      "destination": "session_replay",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Structured final verdict: variant_outcome=no_bypass; fix_covers_all_alternate_entry_points.",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "vuln_variant/artifacts/c1_vuln.body",
      "stage": "repro",
      "role": "request_response",
      "destination": "session_replay",
      "required_for_verdict": false,
      "publishable": true,
      "reason": "wc-ajax popup response body on vulnerable 1.1.11 (SLEEP fired, 6.07s) — confirms the alternate wc-ajax entry point reaches the cookie sink.",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "vuln_variant/artifacts/c1_fixed.body",
      "stage": "repro",
      "role": "request_response",
      "destination": "session_replay",
      "required_for_verdict": false,
      "publishable": true,
      "reason": "wc-ajax popup response body on fixed 1.1.12 (no sleep, 0.04s) — confirms the fix blocks the same alternate entry point.",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "vuln_variant/artifacts/c3_vuln.body",
      "stage": "repro",
      "role": "request_response",
      "destination": "session_replay",
      "required_for_verdict": false,
      "publishable": true,
      "reason": "Frontend wishlist page response body on vulnerable 1.1.11 (SLEEP fired, 5.13s) — confirms the alternate page-load entry point reaches the cookie sink.",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "vuln_variant/artifacts/c3_fixed.body",
      "stage": "repro",
      "role": "request_response",
      "destination": "session_replay",
      "required_for_verdict": false,
      "publishable": true,
      "reason": "Frontend wishlist page response body on fixed 1.1.12 (no sleep, 0.10s) — confirms the fix blocks the same alternate page-load entry point.",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "vuln_variant/reproduction_steps.sh",
      "stage": "vuln_variant",
      "role": "primary_reproducer",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "vuln_variant/rca_report.md",
      "stage": "vuln_variant",
      "role": "root_cause_analysis",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "vuln_variant/patch_analysis.md",
      "stage": "vuln_variant",
      "role": "patch_analysis",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "vuln_variant/variant_manifest.json",
      "stage": "vuln_variant",
      "role": "variant_manifest",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "vuln_variant/validation_verdict.json",
      "stage": "vuln_variant",
      "role": "validation_verdict",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "vuln_variant/source_identity.json",
      "stage": "vuln_variant",
      "role": "source_identity",
      "destination": "variant_candidate",
      "required_for_verdict": false,
      "publishable": true,
      "reason": "Auto-declared supplemental vuln_variant stage artifact",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "vuln_variant/runtime_manifest.json",
      "stage": "vuln_variant",
      "role": "runtime_manifest",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared supplemental vuln_variant stage artifact",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "vuln_variant/root_cause_equivalence.json",
      "stage": "vuln_variant",
      "role": "root_cause_analysis",
      "destination": "variant_candidate",
      "required_for_verdict": false,
      "publishable": true,
      "reason": "Auto-declared supplemental vuln_variant stage artifact",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "vuln_variant/artifacts/c0_fixed.body",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "vuln_variant/artifacts/c0_latest.body",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "vuln_variant/artifacts/c0_vuln.body",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "vuln_variant/artifacts/c1_fixed.body",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "vuln_variant/artifacts/c1_latest.body",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "vuln_variant/artifacts/c1_vuln.body",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "vuln_variant/artifacts/c2_fixed.body",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "vuln_variant/artifacts/c2_latest.body",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "vuln_variant/artifacts/c2_vuln.body",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "vuln_variant/artifacts/c3_fixed.body",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "vuln_variant/artifacts/c3_latest.body",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "vuln_variant/artifacts/c3_vuln.body",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    }
  ]
}