{
  "schema_version": 1,
  "updated_at": "2026-07-08T04:47:40.089024542Z",
  "accepted": [
    {
      "logical_path": "repro/reproduction_steps.sh",
      "stage": "repro",
      "role": "primary_reproducer",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after repro stage deliverable validation",
      "sha256": "9384de93a12b8559440af2a9098810157fd1b5ebdc01c4409a72d9642e465876",
      "size_bytes": 17463,
      "content_type": "text/x-shellscript",
      "declared_by": "backfill"
    },
    {
      "logical_path": "repro/rca_report.md",
      "stage": "repro",
      "role": "root_cause_analysis",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after repro stage deliverable validation",
      "sha256": "e283ee3bb2ac2563b2bb0934416386213b9f6be842c69f5daad1379c09e7fedf",
      "size_bytes": 13407,
      "content_type": "text/markdown",
      "declared_by": "backfill"
    },
    {
      "logical_path": "repro/validation_verdict.json",
      "stage": "repro",
      "role": "validation_verdict",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after repro stage deliverable validation",
      "sha256": "f1700dd7f7a3b29dd185555a0f0078bf0501a77ec8702b9cd441ec9226d18ba1",
      "size_bytes": 1335,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "repro/runtime_manifest.json",
      "stage": "repro",
      "role": "runtime_manifest",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared supplemental repro stage artifact",
      "sha256": "d22d49bce25a63e7b06f5bd8691045ceff4371f736c42eda5a869f1096b7b40c",
      "size_bytes": 981,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/reproduction_steps.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "0b9d200bee32ad8522a8b4ad6f34c4a1447bd1b12da47ab471a1264c5cba762d",
      "size_bytes": 5537,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_rce_marker.txt",
      "stage": "repro",
      "role": "marker_output",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "RCE marker file created by injected PHP executing through nginx->php-fpm (PRUVA_RCE_CONFIRMED 8.5.3 <timestamp>).",
      "sha256": "addfa5000aaec4d407dde4a05efefbb1a6c4d5aa4947891c9cfd1bd596037014",
      "size_bytes": 52,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_bypass_response.json",
      "stage": "repro",
      "role": "request_response",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Bypass exploit HTTP response showing status:0 (copy succeeded) — arbitrary file write confirmed.",
      "sha256": "f39fcc44cdf3ff9d2b9d2b42169a3ec735b0c9f432ba3984b95194b5b119fbd2",
      "size_bytes": 122,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_header.inc.php.modified",
      "stage": "repro",
      "role": "crash_trace",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "The overwritten header.inc.php containing the injected PRUVA RCE PHP code (valid header preserved).",
      "sha256": "764f96ebbffe313892dd01dcd0d2834b014cec693e2f64bbf4df229dba7002c9",
      "size_bytes": 3698,
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/fixed_bypass_response.json",
      "stage": "repro",
      "role": "request_response",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Fixed-version response to the same exploit: NoPermission at patched line 22 (negative control).",
      "sha256": "35ff7a1c972570f3743a011552e31052a2109d26deb4ebbaa0c7392e510ffd7d",
      "size_bytes": 289,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/fixed_header_before.sha256",
      "stage": "repro",
      "role": "other",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Fixed-version header.inc.php sha256 before exploit (negative control integrity).",
      "sha256": "e5df7d952a371a0620444dd9d4d21f2d3c02e9c906a1e4d17c9081fdc765a25b",
      "size_bytes": 65,
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/fixed_header_after.sha256",
      "stage": "repro",
      "role": "other",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Fixed-version header.inc.php sha256 after exploit (unchanged = no write on fixed).",
      "sha256": "e5df7d952a371a0620444dd9d4d21f2d3c02e9c906a1e4d17c9081fdc765a25b",
      "size_bytes": 65,
      "declared_by": "backfill"
    },
    {
      "logical_path": "artifacts/data_vuln_bypass.json",
      "stage": "repro",
      "role": "request_response",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "The exact crafted JSON request body (course_id array with participant_role=3 + video_hash traversal).",
      "sha256": "b60a5bca8497a2c8829a5cfc0eef6f7686d794ec78ebe192fbaa6332d69fad3f",
      "size_bytes": 265,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_nobypass_response.json",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "2e63119f7cb9e754cfd0636b51f64532d61e3dc100598138a983299277034953",
      "size_bytes": 289,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_bypass_response.json",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "f39fcc44cdf3ff9d2b9d2b42169a3ec735b0c9f432ba3984b95194b5b119fbd2",
      "size_bytes": 122,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_header.inc.php.modified",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "764f96ebbffe313892dd01dcd0d2834b014cec693e2f64bbf4df229dba7002c9",
      "size_bytes": 3698,
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_header_head.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "6ce0f6e31a8ef3f01ad2ea837709ed607bb4a4732169a0654f773740221ad7e0",
      "size_bytes": 166,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_rce_marker.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "addfa5000aaec4d407dde4a05efefbb1a6c4d5aa4947891c9cfd1bd596037014",
      "size_bytes": 52,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/fixed_bypass_response.json",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "35ff7a1c972570f3743a011552e31052a2109d26deb4ebbaa0c7392e510ffd7d",
      "size_bytes": 289,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/fixed_header_before.sha256",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "e5df7d952a371a0620444dd9d4d21f2d3c02e9c906a1e4d17c9081fdc765a25b",
      "size_bytes": 65,
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/fixed_header_after.sha256",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "e5df7d952a371a0620444dd9d4d21f2d3c02e9c906a1e4d17c9081fdc765a25b",
      "size_bytes": 65,
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/reproduction_steps.sh",
      "stage": "vuln_variant",
      "role": "primary_reproducer",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "sha256": "583f6850181296a085df3a9f785f6e087b44db0856939b1b2f0c30a4d9213c1b",
      "size_bytes": 15621,
      "content_type": "text/x-shellscript",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/fixed_overlay_write_bypass.json",
      "stage": "vuln_variant",
      "role": "request_response",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Key proof: on the FIXED version (26.2.20260224), the bypass request with array course_id returns 'Invalid argument' (from write() type guard) instead of 'Permission denied!', proving the isTeacher/isParticipant authz check was bypassed",
      "sha256": "94b4a5c392d07d7d99ed2a659e2f93a7f2c90c24ad3c2e97fcd3fe63af4001b5",
      "size_bytes": 448,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/fixed_overlay_write_control.json",
      "stage": "vuln_variant",
      "role": "request_response",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Control proof: on the FIXED version, a non-teacher user with plain int course_id is correctly denied with 'Permission denied!'",
      "sha256": "21eb66fd1801a02763fc2b8e59a9567379225197fbaddf20bbd8a4cdd2ccad08",
      "size_bytes": 119,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_overlay_write_bypass.json",
      "stage": "vuln_variant",
      "role": "request_response",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Vulnerable version bypass response showing same authz bypass behavior, confirming isParticipant() was never changed between versions",
      "sha256": "94b4a5c392d07d7d99ed2a659e2f93a7f2c90c24ad3c2e97fcd3fe63af4001b5",
      "size_bytes": 448,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/rca_report.md",
      "stage": "vuln_variant",
      "role": "root_cause_analysis",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "sha256": "12b9f93803d1e5cca479798ab247f1fe9b4475ce049abfc38fd79a1b437542d2",
      "size_bytes": 16788,
      "content_type": "text/markdown",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/patch_analysis.md",
      "stage": "vuln_variant",
      "role": "patch_analysis",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "sha256": "c6467c76ab8faf2ec6d3482068e8da881d938c506bb3ea4e3da106cd8384eb3c",
      "size_bytes": 8267,
      "content_type": "text/markdown",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/variant_manifest.json",
      "stage": "vuln_variant",
      "role": "variant_manifest",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "sha256": "8ccf725c8d7e62eb966cd4a5a96867108d47695b0f6821658da458fdb94d6a2d",
      "size_bytes": 4039,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/validation_verdict.json",
      "stage": "vuln_variant",
      "role": "validation_verdict",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "sha256": "5f15497896d616d9121dd50b721b91ce83d7c3833b9d4b69ac64f2ccebc47efd",
      "size_bytes": 2800,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/source_identity.json",
      "stage": "vuln_variant",
      "role": "source_identity",
      "destination": "variant_candidate",
      "required_for_verdict": false,
      "publishable": true,
      "reason": "Auto-declared supplemental vuln_variant stage artifact",
      "sha256": "af44e34c0a3f823b23691cc01f7b8ec84ea9270f28e045ed8ff685086ed419fc",
      "size_bytes": 1217,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/runtime_manifest.json",
      "stage": "vuln_variant",
      "role": "runtime_manifest",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared supplemental vuln_variant stage artifact",
      "sha256": "9cababaf6f58681ea85b1396df7bfc46ac6eac29f80af198981398293d7b1766",
      "size_bytes": 1036,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant_reproduction.log",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "27d3cb4d93efdb0e76721670a9b512b46b8d3233c0679bf34c034feb72fd9e51",
      "size_bytes": 6125,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/root_cause_equivalence.json",
      "stage": "vuln_variant",
      "role": "root_cause_analysis",
      "destination": "variant_candidate",
      "required_for_verdict": false,
      "publishable": true,
      "reason": "Auto-declared supplemental vuln_variant stage artifact",
      "sha256": "7d138fc6e15e27aff9cce55766a04aae479a18e883c83871010b3e924c3dc061",
      "size_bytes": 2119,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_overlay_write_control.json",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "21eb66fd1801a02763fc2b8e59a9567379225197fbaddf20bbd8a4cdd2ccad08",
      "size_bytes": 119,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_overlay_write_bypass.json",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "94b4a5c392d07d7d99ed2a659e2f93a7f2c90c24ad3c2e97fcd3fe63af4001b5",
      "size_bytes": 448,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/fixed_overlay_write_control.json",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "21eb66fd1801a02763fc2b8e59a9567379225197fbaddf20bbd8a4cdd2ccad08",
      "size_bytes": 119,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/fixed_overlay_write_bypass.json",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "94b4a5c392d07d7d99ed2a659e2f93a7f2c90c24ad3c2e97fcd3fe63af4001b5",
      "size_bytes": 448,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant_summary.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "982295d22e8629355b16a6544421f4ecee97e6f2e53e85c2e07e8809c58441fa",
      "size_bytes": 77,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/fixed_variant_summary.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "e4e6ed0f8ec8c7e796ef73f5f1ef8221a4596ed561496c700e02828f87ad74af",
      "size_bytes": 77,
      "content_type": "text/plain",
      "declared_by": "backfill"
    }
  ],
  "rejected": []
}