{
  "schema_version": 1,
  "updated_at": "2026-07-09T18:21:16.155654967Z",
  "entries": [
    {
      "logical_path": "logs/reproducer_vuln.log",
      "stage": "repro",
      "role": "crash_trace",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "ASan heap-use-after-free report proving the vulnerability on the vulnerable libcurl build",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "logs/reproducer_fixed.log",
      "stage": "repro",
      "role": "validation_verdict",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Clean run proving the fixed libcurl build does not trigger the UAF",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "repro/runtime_manifest.json",
      "stage": "repro",
      "role": "runtime_manifest",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared supplemental repro stage artifact",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "repro/reproducer.c",
      "stage": "repro",
      "role": "primary_reproducer",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Minimal C reproducer source that triggers the CVE-2026-10536 UAF",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "repro/reproduction_steps.sh",
      "stage": "repro",
      "role": "primary_reproducer",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after repro stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "repro/rca_report.md",
      "stage": "repro",
      "role": "root_cause_analysis",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after repro stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "repro/validation_verdict.json",
      "stage": "repro",
      "role": "validation_verdict",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after repro stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "logs/reproducer_vuln.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "logs/reproducer_fixed.log",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "repro/reproducer.c",
      "stage": "repro",
      "role": "proof_log",
      "destination": "public_evidence",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "vuln_variant/reproduction_steps.sh",
      "stage": "vuln_variant",
      "role": "primary_reproducer",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "logs/vuln_variant/reproducer_vuln_duphandle.log",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "logs/vuln_variant/reproducer_vuln_reset_parent.log",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "private_only",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "ASan heap-use-after-free evidence for the reset-parent cleanup-order variant on the vulnerable curl-8_20_0 build.",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "vuln_variant/artifacts/variant_duphandle.c",
      "stage": "vuln_variant",
      "role": "primary_reproducer",
      "destination": "private_only",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Source of the primary variant harness demonstrating the duphandle-triggered UAF.",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "vuln_variant/artifacts/variant_reset_parent.c",
      "stage": "vuln_variant",
      "role": "primary_reproducer",
      "destination": "private_only",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Source of the secondary variant harness demonstrating the reset-parent cleanup-order UAF.",
      "declared_by": "agent_tool"
    },
    {
      "logical_path": "vuln_variant/variant_manifest.json",
      "stage": "vuln_variant",
      "role": "variant_manifest",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "vuln_variant/validation_verdict.json",
      "stage": "vuln_variant",
      "role": "validation_verdict",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "vuln_variant/source_identity.json",
      "stage": "vuln_variant",
      "role": "source_identity",
      "destination": "variant_candidate",
      "required_for_verdict": false,
      "publishable": true,
      "reason": "Auto-declared supplemental vuln_variant stage artifact",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "vuln_variant/patch_analysis.md",
      "stage": "vuln_variant",
      "role": "patch_analysis",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "vuln_variant/runtime_manifest.json",
      "stage": "vuln_variant",
      "role": "runtime_manifest",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared supplemental vuln_variant stage artifact",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "vuln_variant/rca_report.md",
      "stage": "vuln_variant",
      "role": "root_cause_analysis",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after vuln_variant stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "vuln_variant/root_cause_equivalence.json",
      "stage": "vuln_variant",
      "role": "root_cause_analysis",
      "destination": "variant_candidate",
      "required_for_verdict": false,
      "publishable": true,
      "reason": "Auto-declared supplemental vuln_variant stage artifact",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "logs/vuln_variant/reproducer_fixed_duphandle.log",
      "stage": "vuln_variant",
      "role": "proof_log",
      "destination": "variant_candidate",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Referenced by runtime_manifest.proof_artifacts",
      "declared_by": "runtime_manifest"
    },
    {
      "logical_path": "coding/proposed_fix.diff",
      "stage": "coding",
      "role": "proposed_fix",
      "destination": "protection_artifact",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after coding stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "coding/summary_report.md",
      "stage": "coding",
      "role": "summary_report",
      "destination": "protection_artifact",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after coding stage deliverable validation",
      "declared_by": "stage_validator"
    },
    {
      "logical_path": "coding/verify_fix.sh",
      "stage": "coding",
      "role": "fix_verification",
      "destination": "protection_artifact",
      "required_for_verdict": true,
      "publishable": true,
      "reason": "Auto-declared after coding stage deliverable validation",
      "declared_by": "stage_validator"
    }
  ]
}