{
  "schema_version": 1,
  "updated_at": "2026-07-08T04:47:40.184247639Z",
  "accepted": [
    {
      "logical_path": "repro/reproduction_steps.sh",
      "stage": "repro",
      "role": "primary_reproducer",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after repro stage deliverable validation",
      "sha256": "f7c79a957e539d4ac20bc61e1ac17a12db0f26dc81e29256550b8c5f9c71b076",
      "size_bytes": 29864,
      "content_type": "text/x-shellscript",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_result.txt",
      "stage": "repro",
      "role": "request_response",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Evidence that vulnerable version (beta.470) returns HTTP 200 with host IPs for Member on POST /terminal/auth/ips and HTTP 200 authenticated:true on POST /terminal/auth",
      "sha256": "b3e678a35a6cad960e683792b5d35238d50fd778d1b5f005d25a273b77112427",
      "size_bytes": 161,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/fixed_result.txt",
      "stage": "repro",
      "role": "request_response",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Evidence that fixed version (commit 847166a3f) returns HTTP 403 for Member on both terminal endpoints, proving the can.access.terminal middleware blocks the bypass",
      "sha256": "28a7fe60721c22e2048c5487173846b7585b150d3fbec790e3c83133a42ecb23",
      "size_bytes": 43694,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "repro/rca_report.md",
      "stage": "repro",
      "role": "root_cause_analysis",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after repro stage deliverable validation",
      "sha256": "f761ed0212699c4e5fcd46e47810462bad1b13d1673f3e5383bd34c915a01ec9",
      "size_bytes": 10476,
      "content_type": "text/markdown",
      "declared_by": "backfill"
    },
    {
      "logical_path": "repro/validation_verdict.json",
      "stage": "repro",
      "role": "validation_verdict",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after repro stage deliverable validation",
      "sha256": "141f7233aed4fd0d1ecd75fe5c13bdf74de77798ff217009b450107be99d768f",
      "size_bytes": 799,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "repro/runtime_manifest.json",
      "stage": "repro",
      "role": "runtime_manifest",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared supplemental repro stage artifact",
      "sha256": "0f042b57c3e59dd0ab0cf2f053785805355785d388bcd4223d02957872ff3419",
      "size_bytes": 1213,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/reproduction_steps.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "a7d50ee636a2cfd3b511e15f1916c0575d726547695e47a2017a9d844064c7c8",
      "size_bytes": 48322,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/ws_client_vuln.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "812d438754f741d0d41b94021f049cfb0d6cb5f112b825ecae32819e73cfeefe",
      "size_bytes": 245,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/managed_host_vuln.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "37cb16c11828b4762f1c8f7f15c443bb76fff7b75d9d0165bf7fc303d071de5d",
      "size_bytes": 1191,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_result.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "b3e678a35a6cad960e683792b5d35238d50fd778d1b5f005d25a273b77112427",
      "size_bytes": 161,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/fixed_result.txt",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "28a7fe60721c22e2048c5487173846b7585b150d3fbec790e3c83133a42ecb23",
      "size_bytes": 43694,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/ws_client_fixed.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "0c27668a3b212dd2802cb85f36fa8b3320eef736ab77589b9bc73da8d7f9d93d",
      "size_bytes": 45,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/terminal_vuln.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "a2a2960527a23dbcf06cce3b4c7fb7d716452f85880196dbe88ac3e2e2b91b32",
      "size_bytes": 2196,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/terminal_fixed.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "d634093910c715e9398fedef4d09b784927c4e04fd653dd823eaa4d7a4c2b861",
      "size_bytes": 1620,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/managed_host_fixed.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "a5a13269a66d7a008e166f439d857e099c1c5c72467a553f1ec69882c6b3e7cd",
      "size_bytes": 106,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/server.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "29f7a6eff4a595edc0170ffdc1f0c96a1a2d625df9949dd66ad83fc4917a4f67",
      "size_bytes": 603,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/reproduction_steps.sh",
      "stage": "vuln_variant",
      "role": "primary_reproducer",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "sha256": "fce2304417cc5ff51687b4809dbca20d117ab1a828206d09bacef0cd164756ce",
      "size_bytes": 13801,
      "content_type": "text/x-shellscript",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/rca_report.md",
      "stage": "vuln_variant",
      "role": "root_cause_analysis",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "sha256": "b52e258b35b694cf3ebcf185de8cbc1110023e54e61ae2a06bd47fd3c792e653",
      "size_bytes": 10721,
      "content_type": "text/markdown",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/patch_analysis.md",
      "stage": "vuln_variant",
      "role": "patch_analysis",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "sha256": "432d323a279886bc82d3e1e8b9999c55ece879fb77fd574db150551c154c7084",
      "size_bytes": 6200,
      "content_type": "text/markdown",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/variant_manifest.json",
      "stage": "vuln_variant",
      "role": "variant_manifest",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "sha256": "dffec2943166ea302b8a9da5b4344c52ca6424de62e85e1e489fbf7e530279aa",
      "size_bytes": 4427,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/validation_verdict.json",
      "stage": "vuln_variant",
      "role": "validation_verdict",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "sha256": "12ff42a6d3ddaece0691ea967efbb16867a6ca611ebfa329f34e788287cdf126",
      "size_bytes": 2544,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/runtime_manifest.json",
      "stage": "vuln_variant",
      "role": "runtime_manifest",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared supplemental vuln_variant stage artifact",
      "sha256": "93582337e985a12988231feb8b6ae44a7f872f6d37e330665e0c3536985877d9",
      "size_bytes": 1113,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/source_identity.json",
      "stage": "vuln_variant",
      "role": "source_identity",
      "destination": "variant_candidate",
      "required_for_verdict": false,
      "publishable": true,
      "reason": "Auto-declared supplemental vuln_variant stage artifact",
      "sha256": "c65efd12c8908ff8173a01c7df900427cea553362cc3045fa0a2edc4818eb126",
      "size_bytes": 1091,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "vuln_variant/root_cause_equivalence.json",
      "stage": "vuln_variant",
      "role": "root_cause_analysis",
      "destination": "variant_candidate",
      "required_for_verdict": false,
      "publishable": true,
      "reason": "Auto-declared supplemental vuln_variant stage artifact",
      "sha256": "a9013d1ec6d0239bf9ecf91b68cd67907d5025fd57c14607a7592e2c19460b75",
      "size_bytes": 1449,
      "content_type": "application/json",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/reproduction_steps.log",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "1a617deb04879ea741c0a15e79127e0268695dc833e9def61f3fa23bbc86f0db",
      "size_bytes": 3461,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/fixed_api_token_private_key_probe.log",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "b46503e9df13c58be905f9eb7ab5ecc4d9dbf9d9c7a02add7848a00432cf2578",
      "size_bytes": 560,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/vulnerable_api_token_private_key_probe.log",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "03d6bb7fedda288661cdeb867ea01f8a89820df6916d117dc581ed1d96960e71",
      "size_bytes": 560,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/vulnerable_version.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "6d4fb33ebc408ac016f3690ca1846534e854bdba37025776d020832eef7508be",
      "size_bytes": 41,
      "content_type": "text/plain",
      "declared_by": "backfill"
    },
    {
      "logical_path": "logs/vuln_variant/fixed_version.txt",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "sha256": "fc256177a0837c4ba954722a9a3d083c0c4f6c0e1e9eea62189696d23bb6c4e0",
      "size_bytes": 41,
      "content_type": "text/plain",
      "declared_by": "backfill"
    }
  ],
  "rejected": []
}