{
  "schema_version": 1,
  "updated_at": "2026-07-08T04:47:28.898888433Z",
  "accepted": [
    {
      "logical_path": "repro/reproduction_steps.sh",
      "stage": "repro",
      "role": "primary_reproducer",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after repro stage deliverable validation",
      "sha256": "d05de2ccfe709659bb9f2c2402e774f6c4656a6642f0dc26e9a8c3a34ecd1305",
      "size_bytes": 21179,
      "content_type": "text/x-shellscript",
      "declared_by": "backfill"
    },
    {
      "logical_path": "repro/rca_report.md",
      "stage": "repro",
      "role": "root_cause_analysis",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after repro stage deliverable validation",
      "sha256": "53694f07133521d5b03ec657f1e3c001070b9fecd5cb6a6363facb1e53aea83c",
      "size_bytes": 8522,
      "content_type": "text/markdown",
      "declared_by": "backfill"
    },
    {
      "logical_path": "repro/validation_verdict.json",
      "stage": "repro",
      "role": "validation_verdict",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after repro stage deliverable validation",
      "sha256": "af7efca514c32e001404ffb8cf4b79061f5868360e5519a3a280517d873ce6e6",
      "size_bytes": 798,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "repro/runtime_manifest.json",
      "stage": "repro",
      "role": "runtime_manifest",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared supplemental repro stage artifact",
      "sha256": "d30df5a89d8806d4823fc477db66f901ccb5d1959ba04fa8143b545e5bcde4cc",
      "size_bytes": 1342,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/demo_response.txt",
      "stage": "repro",
      "role": "request_response",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "SSE response from the unauthenticated POST to /api/tunnel/tailscale-install against 9router@0.4.39: HTTP 200 (no auth) showing Downloading install script -> Running install script -> sudo consumed attacker stdin, proving the unauth production path reached the spawn-sudo injection point.",
      "sha256": "48fc6a8e21ca6728e0897aed18993c852b65d7f64a1de673e1b93513b642b3c5",
      "size_bytes": 252,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/reproduction_steps.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "ae2c91dd7cb54a4c44cd850cdd073fc0e60339bebb9eb7334bb7f0dd19bdd671",
      "size_bytes": 2016,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_1_response.txt",
      "stage": "repro",
      "role": "request_response",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Vulnerable HTTP response stream proving route reached install script path.",
      "sha256": "8f1e71b0884a69fecb4d09eb3a32dec48dbd504bdee4bce0f9a7cc9a8e9150bb",
      "size_bytes": 293,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/fixed_1_response.txt",
      "stage": "repro",
      "role": "request_response",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Fixed negative-control response showing unauthenticated request is blocked.",
      "sha256": "3be5b8e53fdc8b0a2996590589456db33504977f3d1ce9bb75016c8a707e1a71",
      "size_bytes": 24,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/vuln_middleware_matcher.txt",
      "stage": "repro",
      "role": "root_cause_analysis",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Vulnerable 0.4.39 middleware matcher — explicit allow-list that excludes /api/tunnel/*, proving the authz bypass root cause.",
      "sha256": "26e9019cdd16ec2855f6f6ccf7ebec5bc72e2da3411d5540c8cedefcf4bf4695",
      "size_bytes": 201,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/fixed_middleware_matcher.txt",
      "stage": "repro",
      "role": "patch_analysis",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Fixed 0.4.45 middleware matcher — catch-all that covers /api/tunnel/*, proving the authz fix.",
      "sha256": "011e963524211343f47a18c9e498f1b98286f247d77acaeae0014817214aa478",
      "size_bytes": 60,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/vuln_install_code.txt",
      "stage": "repro",
      "role": "root_cause_analysis",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Vulnerable install code: spawn(\"sudo\",[\"-S\",\"sh\"]) + stdin.write(sudoPassword) + stdin.write(installScript) — the command injection vector.",
      "sha256": "1a5be359539a949567573968240f1b1df8bdcc4421a0a463a1f42c8ccdcc6828",
      "size_bytes": 2000,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/fixed_install_code.txt",
      "stage": "repro",
      "role": "patch_analysis",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Fixed install code: input validation + writeFileSync + spawn(\"sudo\",[\"-S\",\"sh\",file]) — the injection fix.",
      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "size_bytes": 0,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/vuln_1_http_code.txt",
      "stage": "repro",
      "role": "marker_output",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Vulnerable build HTTP status 200 — proves the endpoint is unauthenticated.",
      "sha256": "c11e3f4837efde2441e23a7b9da02131f53bf59fddeb7147c4ab81afe400460f",
      "size_bytes": 4,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/fixed_1_http_code.txt",
      "stage": "repro",
      "role": "marker_output",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Fixed build HTTP status 401 — proves the authz fix blocks the unauthenticated request.",
      "sha256": "5d94ef1d04a57469912deb42e29ecee5168b983c775efa906cb9268596ba9f84",
      "size_bytes": 4,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_1_server.log",
      "stage": "repro",
      "role": "request_response",
      "destination": "public_evidence",
      "required_for_verdict": false,
      "publishable": true,
      "reason": "Vulnerable 0.4.39 server log showing \"Tailscale install error: sudo: a password is required\" — server-side confirmation the spawn-sudo code path executed.",
      "sha256": "5c8fc1d586bba0f645f7950faf992e0c6a43df7d68e5691eb5311ea59a5b6cf3",
      "size_bytes": 1890,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/vuln_1_marker.txt",
      "stage": "repro",
      "role": "marker_output",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Marker file created by attacker-controlled command through vulnerable HTTP endpoint.",
      "sha256": "4873da2ba7cc08db77480c51a5a9ef2795fbde304dec459c12d2e7d6601ad9c0",
      "size_bytes": 78,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/vuln_2_marker.txt",
      "stage": "repro",
      "role": "marker_output",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Second marker file confirming repeatable command execution through vulnerable HTTP endpoint.",
      "sha256": "01715ee9d8cfdab7fd769086fb2410e35a369f82a5625b58a10f964b67402ff4",
      "size_bytes": 78,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_1_response.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "8f1e71b0884a69fecb4d09eb3a32dec48dbd504bdee4bce0f9a7cc9a8e9150bb",
      "size_bytes": 293,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_1_server.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "5c8fc1d586bba0f645f7950faf992e0c6a43df7d68e5691eb5311ea59a5b6cf3",
      "size_bytes": 1890,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_1_sudo_shim.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "8af7b7c3656a106c277c8eb06bba74493b39213c0e9fed3a42eaf0bd7c5481a1",
      "size_bytes": 389,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/vuln_1_http_code.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "c11e3f4837efde2441e23a7b9da02131f53bf59fddeb7147c4ab81afe400460f",
      "size_bytes": 4,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/vuln_1_marker.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "4873da2ba7cc08db77480c51a5a9ef2795fbde304dec459c12d2e7d6601ad9c0",
      "size_bytes": 78,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_2_response.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "8f1e71b0884a69fecb4d09eb3a32dec48dbd504bdee4bce0f9a7cc9a8e9150bb",
      "size_bytes": 293,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_2_sudo_shim.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "f4bd0f28ff411ea9349f332190607856488b643fb3a2abdb4d83cac1fad1076e",
      "size_bytes": 389,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/vuln_2_http_code.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "c11e3f4837efde2441e23a7b9da02131f53bf59fddeb7147c4ab81afe400460f",
      "size_bytes": 4,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/vuln_2_marker.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "01715ee9d8cfdab7fd769086fb2410e35a369f82a5625b58a10f964b67402ff4",
      "size_bytes": 78,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/fixed_1_response.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "3be5b8e53fdc8b0a2996590589456db33504977f3d1ce9bb75016c8a707e1a71",
      "size_bytes": 24,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/fixed_1_server.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "629f26df30cc123a59b2c53eae82e37ec4978821e327a6ac2a5a508abea2b2f4",
      "size_bytes": 1539,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/fixed_1_http_code.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "5d94ef1d04a57469912deb42e29ecee5168b983c775efa906cb9268596ba9f84",
      "size_bytes": 4,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/fixed_1_marker.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "62ae6c1798f4097cd5b0dfc974d5529256a9ae9dfedaa554be52905710cb8b86",
      "size_bytes": 16,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/fixed_2_response.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "3be5b8e53fdc8b0a2996590589456db33504977f3d1ce9bb75016c8a707e1a71",
      "size_bytes": 24,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/fixed_2_http_code.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "5d94ef1d04a57469912deb42e29ecee5168b983c775efa906cb9268596ba9f84",
      "size_bytes": 4,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/fixed_2_marker.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "62ae6c1798f4097cd5b0dfc974d5529256a9ae9dfedaa554be52905710cb8b86",
      "size_bytes": 16,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/vuln_middleware_matcher.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "26e9019cdd16ec2855f6f6ccf7ebec5bc72e2da3411d5540c8cedefcf4bf4695",
      "size_bytes": 201,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/fixed_middleware_matcher.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "011e963524211343f47a18c9e498f1b98286f247d77acaeae0014817214aa478",
      "size_bytes": 60,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/vuln_install_code.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "1a5be359539a949567573968240f1b1df8bdcc4421a0a463a1f42c8ccdcc6828",
      "size_bytes": 2000,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/fixed_install_code.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "size_bytes": 0,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/reproduction_steps.sh",
      "stage": "vuln_variant",
      "role": "primary_reproducer",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "sha256": "1fcb008147b6dfc5f39515eb97439f9aa4ef3c499cdb621517c60b7fd2b19466",
      "size_bytes": 11981,
      "content_type": "text/x-shellscript",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/reproduction_steps.log",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "e0ecf15765c36a1fe7ffd3e18abf501d970e65fae685e346ecf3e88b410faaf9",
      "size_bytes": 2289,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/validation_verdict.json",
      "stage": "vuln_variant",
      "role": "validation_verdict",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "sha256": "477cf841641e2b837eb8dccc46e78abd686d1aae2d822edf8d7dcb37f233f56e",
      "size_bytes": 3215,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/variant_manifest.json",
      "stage": "vuln_variant",
      "role": "variant_manifest",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "sha256": "c480601412a692ce73c09c5d90fdd2b0ada3cd8e1d4ba31f39489bb3ec112cc6",
      "size_bytes": 3818,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/patch_analysis.md",
      "stage": "vuln_variant",
      "role": "patch_analysis",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "sha256": "58b18bd6e25a69a9eea3795273cc106bf09ab7a3e519545b58ed38aa47d7caf4",
      "size_bytes": 6950,
      "content_type": "text/markdown",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/rca_report.md",
      "stage": "vuln_variant",
      "role": "root_cause_analysis",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "sha256": "0a69827075045827a7567738b807b521802586ed7a936d41dcf3b13d6d387e28",
      "size_bytes": 9241,
      "content_type": "text/markdown",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/runtime_manifest.json",
      "stage": "vuln_variant",
      "role": "runtime_manifest",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared supplemental vuln_variant stage artifact",
      "sha256": "73e4ee92ca25867fb8d1cea1769028f2630dea9826ea51d83952d4593238a8b0",
      "size_bytes": 2490,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/root_cause_equivalence.json",
      "stage": "vuln_variant",
      "role": "root_cause_analysis",
      "destination": "variant_candidate",
      "required_for_verdict": false,
      "publishable": true,
      "reason": "Auto-declared supplemental vuln_variant stage artifact",
      "sha256": "be1d0ca7a9c602f61c4a7b4fd6faac2c6fd7abdc4a5138d5665b83710129ed4f",
      "size_bytes": 906,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/fixed_c0_parent_install_baseline_http_code.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "97a58cc66d1cd6b51466af8ed52d6a38053b5572fee09a0ae8859c26b82bdf67",
      "size_bytes": 4,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/fixed_c0_parent_install_baseline_marker.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "62ae6c1798f4097cd5b0dfc974d5529256a9ae9dfedaa554be52905710cb8b86",
      "size_bytes": 16,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/fixed_c0_parent_install_baseline_response.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "d1bb9fe2702465ad807fee27ca8a69eb06d9d63af43ec5932d8aa2dae4e844bb",
      "size_bytes": 42,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/fixed_c1_install_trailing_slash_http_code.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "f619e0b0036458929950b76340df8b3fdf6ab0b4cf09daa70ca0dbd7d4815d8b",
      "size_bytes": 4,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/fixed_c1_install_trailing_slash_marker.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "62ae6c1798f4097cd5b0dfc974d5529256a9ae9dfedaa554be52905710cb8b86",
      "size_bytes": 16,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/fixed_c1_install_trailing_slash_response.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "99cd8034277f5314e823702dbb3ebc6d9b486178da6b83c7d24f76873e0c9982",
      "size_bytes": 29,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/fixed_c2_start_daemon_http_code.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "5d94ef1d04a57469912deb42e29ecee5168b983c775efa906cb9268596ba9f84",
      "size_bytes": 4,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/fixed_c2_start_daemon_marker.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "62ae6c1798f4097cd5b0dfc974d5529256a9ae9dfedaa554be52905710cb8b86",
      "size_bytes": 16,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/fixed_c2_start_daemon_response.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "3be5b8e53fdc8b0a2996590589456db33504977f3d1ce9bb75016c8a707e1a71",
      "size_bytes": 24,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/fixed_c3_cli_tools_mitm_http_code.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "97a58cc66d1cd6b51466af8ed52d6a38053b5572fee09a0ae8859c26b82bdf67",
      "size_bytes": 4,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/fixed_c3_cli_tools_mitm_marker.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "62ae6c1798f4097cd5b0dfc974d5529256a9ae9dfedaa554be52905710cb8b86",
      "size_bytes": 16,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/fixed_c3_cli_tools_mitm_response.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "d1bb9fe2702465ad807fee27ca8a69eb06d9d63af43ec5932d8aa2dae4e844bb",
      "size_bytes": 42,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/fixed_server.log",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "26ba8d545f72924c5f3772ff370ad93b4b0b79c20ebe4572a14dfe47ebcbfb27",
      "size_bytes": 1161,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/fixed_version.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "25ff46d00a03bdd9201b82a4e201350656f0850ec9073cf6b910957c55a1635d",
      "size_bytes": 146,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/latest_version.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "e5a53f429d9c24c58b4c64a480c3d51e4b27d4a8a2302906fe940a68cbf36bd0",
      "size_bytes": 26,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/route_files.log",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "6a005537107bc7d2162ef4b74f1b98b0f96e72b5b375e08a2a98b7db28c0cc20",
      "size_bytes": 3710,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/shell_sink_scan.log",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "a6edc07eda35f2c32ad356e074e7e719c6d49cb8324501993d1b11eee035f63b",
      "size_bytes": 31150,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/vuln_c0_parent_install_baseline_http_code.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "c11e3f4837efde2441e23a7b9da02131f53bf59fddeb7147c4ab81afe400460f",
      "size_bytes": 4,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/vuln_c0_parent_install_baseline_marker.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "dd3844d5c619a35d315c24e8343a9a68e5eb23bb78e0294fa1709b4b3c68de60",
      "size_bytes": 100,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/vuln_c0_parent_install_baseline_response.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "8f1e71b0884a69fecb4d09eb3a32dec48dbd504bdee4bce0f9a7cc9a8e9150bb",
      "size_bytes": 293,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/vuln_c1_install_trailing_slash_http_code.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "f619e0b0036458929950b76340df8b3fdf6ab0b4cf09daa70ca0dbd7d4815d8b",
      "size_bytes": 4,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/vuln_c1_install_trailing_slash_marker.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "62ae6c1798f4097cd5b0dfc974d5529256a9ae9dfedaa554be52905710cb8b86",
      "size_bytes": 16,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/vuln_c1_install_trailing_slash_response.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "99cd8034277f5314e823702dbb3ebc6d9b486178da6b83c7d24f76873e0c9982",
      "size_bytes": 29,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/vuln_c2_start_daemon_http_code.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "c11e3f4837efde2441e23a7b9da02131f53bf59fddeb7147c4ab81afe400460f",
      "size_bytes": 4,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/vuln_c2_start_daemon_marker.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "62ae6c1798f4097cd5b0dfc974d5529256a9ae9dfedaa554be52905710cb8b86",
      "size_bytes": 16,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/vuln_c2_start_daemon_response.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97",
      "size_bytes": 16,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/vuln_c3_cli_tools_mitm_http_code.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "5d94ef1d04a57469912deb42e29ecee5168b983c775efa906cb9268596ba9f84",
      "size_bytes": 4,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/vuln_c3_cli_tools_mitm_marker.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "62ae6c1798f4097cd5b0dfc974d5529256a9ae9dfedaa554be52905710cb8b86",
      "size_bytes": 16,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/vuln_c3_cli_tools_mitm_response.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "3be5b8e53fdc8b0a2996590589456db33504977f3d1ce9bb75016c8a707e1a71",
      "size_bytes": 24,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/vuln_server.log",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "807b74cec7c0750c76c4e05c8ac0245e7fe6a88a7c029e71c1eaee095633a4de",
      "size_bytes": 1658,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/vuln_sudo_shim.log",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "a064883be027a940e2372ad370b29026176031c256c870a544b326983341ff76",
      "size_bytes": 1781,
      "content_type": "text/plain",
      "declared_by": "backfill"
    }
  ],
  "rejected": [
    {
      "logical_path": "logs/vuln_variant/source_scan_initial.log",
      "reason": "artifact exceeds backfill size limit: 1411756 bytes > 1048576 bytes"
    }
  ]
}