{
  "schema": "security-loop-public-preparation/v1",
  "evidence_date": "2026-10-04",
  "status": "preparation-only-model-comparison-pending",
  "study_source_commit": "3dc8d8c7b6a9d46583d8da030a29364d35c7b53e",
  "public_export": "allowlisted copy of study preparation artifacts; no provider credentials or personal context",
  "fixture": "one constructed tenant-authorization defect and its fixed control",
  "model_runs": 0,
  "paid_exa_parallel_calls": 0,
  "actual_model_tokens": null,
  "investigation_cost_usd": null,
  "efficiency_result": null,
  "peer_adjudication": "pending",
  "model_patch_validation": "not-run",
  "integration_tests_passed": 8,
  "verifier": {
    "execution": "real-local-http",
    "http_checks": 14,
    "expected_labels": "author-created",
    "source": "verification.json"
  },
  "distill": {
    "revision": "2417e00dabe498eb8187f4544f001d5a49fbdb45",
    "runtime": "go1.26.4",
    "commands_completed": [
      "lock",
      "build",
      "verify"
    ],
    "token_estimate_is_provider_usage": false
  },
  "packets": [
    {
      "case_id": "case-01",
      "schema": "security-loop-packet/v0",
      "origin": "local-constructed-fixture",
      "source_set_sha256": "e3ee8b146b929b1f4d24bb071cd069b871f13744f578fb70a8a35056b786d988",
      "baseline_bytes": 2184,
      "distill_bytes": 2674,
      "baseline_sha256": "a33da49110af71f49853bad1118b789deed8f45bc6166660e035ff816ac5d6ea",
      "distill_sha256": "2c823187d98e56167582c28f7bb42e27f94b2ae365f326dc82ab4691df155ad7",
      "distill_build_verify_seconds": 0.7382501669926569,
      "stats": {
        "source_count": 3,
        "included_count": 3,
        "excluded_count": 0,
        "chunk_count": 3,
        "duplicate_count": 0,
        "selected_count": 3,
        "selected_tokens": 532
      },
      "unique_evidence_omitted": 0,
      "actual_model_tokens": null,
      "model_runs": 0,
      "binary_sha256": "e265131bcda0b499f702f7d4cd4aea13d31bacc81c81e3634ffe63d49a947925",
      "verified_distill_revision": "2417e00dabe498eb8187f4544f001d5a49fbdb45",
      "model_efficiency_result": null,
      "packet_byte_increase": 490,
      "packet_percent_increase": 22.435897435897434
    },
    {
      "case_id": "case-02",
      "schema": "security-loop-packet/v0",
      "origin": "local-constructed-fixture",
      "source_set_sha256": "fa86389606397885603fd73ebed1f90305236cdd1ae127a2a04c0e42e95b4f03",
      "baseline_bytes": 2206,
      "distill_bytes": 2696,
      "baseline_sha256": "71a387ee5e9823c2e5f43cd2615fe58699add06406e02a286eee7f1e0272c9a7",
      "distill_sha256": "3251429a351625fda3b003107e02ee518eec3f2f1bd7789a0e68dff444752fb6",
      "distill_build_verify_seconds": 0.0693978750059614,
      "stats": {
        "source_count": 3,
        "included_count": 3,
        "excluded_count": 0,
        "chunk_count": 3,
        "duplicate_count": 0,
        "selected_count": 3,
        "selected_tokens": 538
      },
      "unique_evidence_omitted": 0,
      "actual_model_tokens": null,
      "model_runs": 0,
      "binary_sha256": "e265131bcda0b499f702f7d4cd4aea13d31bacc81c81e3634ffe63d49a947925",
      "verified_distill_revision": "2417e00dabe498eb8187f4544f001d5a49fbdb45",
      "model_efficiency_result": null,
      "packet_byte_increase": 490,
      "packet_percent_increase": 22.212148685403445
    }
  ],
  "sourcegraph": {
    "completed_searches": 1,
    "transport_attempts": 2,
    "line_matches": 7,
    "files_matched": 2,
    "capture": "sourcegraph/capture.json",
    "query": "sourcegraph/request.json",
    "response": "sourcegraph/response.raw",
    "initial_attempt": "restricted-network transport failure; retained in private study; not exported here",
    "whole_repository_coverage_established": false
  },
  "nextjs": {
    "saved_source_license_files": 14,
    "saved_bytes": 186162,
    "source_index": "nextjs-source-index.json",
    "full_source_files_in_this_export": false,
    "runtime_reproduction": "not-run",
    "known_public_advisory": "GHSA-f82v-jwr5-mffw",
    "historical_snapshot": false
  },
  "agent_trace": {
    "revision": "b109ec5b3714b842746e97ee8e975329d8582667",
    "event_count": 2,
    "capture_origin": "posthoc-controller-verification-export",
    "real_reader_and_timeline_loaded": true,
    "model_call_events": 0,
    "redaction": "native redaction changes selected hash fields; complete verification remains in verification.json"
  },
  "planned_comparison": {
    "snapshots": 2,
    "paired_repetitions_per_snapshot": 3,
    "agent_runs": 12,
    "execution": "not-run",
    "independent_security_cases": 1,
    "control_snapshots": 1
  },
  "validation_recheck": {
    "status": "passed",
    "tests_run": 8,
    "log": "validation/test-run.txt",
    "record": "validation/test-run.json",
    "paid_provider_calls": 0,
    "scored_model_runs": 0
  }
}