{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "Real Airflow `airflow tasks test` DAG execution of GCSToSFTPOperator; operator reaches a real local GCS JSON API endpoint (fake-gcs-server) for bucket listing/download and a real Paramiko SFTP server for storage.",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "python3",
    "apache-airflow",
    "apache-airflow-providers-google",
    "apache-airflow-providers-sftp",
    "google-cloud-storage",
    "fake-gcs-server",
    "paramiko"
  ],
  "proof_artifacts": [
    "logs/reproduction_steps.log",
    "logs/attempt_22.1.0_1.json",
    "artifacts/product_test_22.1.0_1/gcs_api_trace.json",
    "artifacts/product_test_22.1.0_1/fake_gcs_server.log",
    "artifacts/product_test_22.1.0_1/airflow_tasks_test.log",
    "artifacts/product_test_22.1.0_1/airflow_home/dags/cve_2026_49297_repro_dag.py",
    "logs/attempt_22.1.0_2.json",
    "artifacts/product_test_22.1.0_2/gcs_api_trace.json",
    "artifacts/product_test_22.1.0_2/fake_gcs_server.log",
    "artifacts/product_test_22.1.0_2/airflow_tasks_test.log",
    "artifacts/product_test_22.1.0_2/airflow_home/dags/cve_2026_49297_repro_dag.py",
    "logs/attempt_22.2.1_1.json",
    "artifacts/product_test_22.2.1_1/gcs_api_trace.json",
    "artifacts/product_test_22.2.1_1/fake_gcs_server.log",
    "artifacts/product_test_22.2.1_1/airflow_tasks_test.log",
    "artifacts/product_test_22.2.1_1/airflow_home/dags/cve_2026_49297_repro_dag.py",
    "logs/attempt_22.2.1_2.json",
    "artifacts/product_test_22.2.1_2/gcs_api_trace.json",
    "artifacts/product_test_22.2.1_2/fake_gcs_server.log",
    "artifacts/product_test_22.2.1_2/airflow_tasks_test.log",
    "artifacts/product_test_22.2.1_2/airflow_home/dags/cve_2026_49297_repro_dag.py"
  ],
  "notes": "Two vulnerable 22.1.0 product attempts and two fixed 22.2.1 attempts were run. Vulnerable attempts create escaped files outside the SFTP destination; fixed attempts raise ValueError before SFTP write."
}