{
  "_pruva_terminal_reconciliation": {
    "authored_artifact_closure_sha256": "d1ae671c5b3d83876cd14a291cfdbcf78056fc62b050334310374acc0a754bdc",
    "authored_runtime_manifest_sha256": "42b62128660ef97d7bcbddb655e5c7bae049e2cf280f8409910ef26877d752ea",
    "authored_verdict_sha256": "7f2019cea1b0e2987276d526d06d9e17eec4794113ba9c3a269619071da6daeb",
    "claim_matching": "evaluated",
    "schema_version": 2,
    "status": "completed"
  },
  "attacker_controlled_input": "java.util.logging.LogRecord fields (sourceClassName) published by an attacker-controlled inbound agent process",
  "claim_outcome": "confirmed",
  "claimed_impact_class": "xss",
  "claimed_surface": "viewer_document",
  "crash_observed": false,
  "end_to_end_target_reached": true,
  "evidence_scope": "production_path",
  "exploit_chain_demonstrated": true,
  "exploitability_confidence": "high",
  "inferred": false,
  "observed_impact_class": "xss",
  "read_write_primitive_observed": false,
  "repro_result": "confirmed",
  "sanitizer_used": false,
  "trigger_path": "agent JNLP4 connect -> agent-side hudson.slaves.SlaveComputer ring buffer -> admin GET /log/agentlog/ -> Functions.printLogRecordHtml renders metadata unescaped -> stored XSS executes in admin browser",
  "validated_surface": "viewer_document"
}