{
  "schema": "security-loop-integrity-walkthrough/v1",
  "executed_at_utc": "2026-10-04T11:54:24.100993+00:00",
  "execution": "real-local-pinned-distill-cli",
  "scope": "supplemental public-fixture replay; not a scored model run or the busboy pilot",
  "fixture": "case-01 public constructed tenant-authorization sources and config",
  "distill_revision": "2417e00dabe498eb8187f4544f001d5a49fbdb45",
  "binary_sha256": "e265131bcda0b499f702f7d4cd4aea13d31bacc81c81e3634ffe63d49a947925",
  "runtime": "go1.26.4",
  "binary_vcs_modified": false,
  "trusted_lock_sha256": "6cb95c3e205268b6addbe4c56e360b867a97b1dabddab3c2cdcab83f384c5a14",
  "anchor_source": "retained case-01/context.lock.json; obtained from the existing evidence checkout before mutations",
  "anchor_scope": "local demonstration; distributors must obtain an expected digest through their own trusted channel",
  "path_policy": "argv uses the public CLI name and relative paths; temporary workdir replaced by <workdir> in output if present",
  "paid_provider_calls": 0,
  "model_runs": 0,
  "original_retained_artifacts_changed": false,
  "repeat_build_artifacts": [
    {
      "path": "context.bundle.md",
      "bytes": 2674,
      "sha256": "2c823187d98e56167582c28f7bb42e27f94b2ae365f326dc82ab4691df155ad7",
      "repeat_bytes_identical": true,
      "retained_artifact_bytes_identical": true
    },
    {
      "path": "context.lock.json",
      "bytes": 3001,
      "sha256": "6cb95c3e205268b6addbe4c56e360b867a97b1dabddab3c2cdcab83f384c5a14",
      "repeat_bytes_identical": true,
      "retained_artifact_bytes_identical": true
    },
    {
      "path": "context.manifest.json",
      "bytes": 2957,
      "sha256": "6ec1e0608fb72cf5c9dda22a5f4f2af77d3da871ac7797fd2f55016cb77ed534",
      "repeat_bytes_identical": true,
      "retained_artifact_bytes_identical": true
    },
    {
      "path": "SHA256SUMS",
      "bytes": 274,
      "sha256": "4de1ce4af44a2ca9c192ffcb52f15fb885560fb03b30fc89bbface0d0f3e8aa4",
      "repeat_bytes_identical": true,
      "retained_artifact_bytes_identical": true
    }
  ],
  "commands": [
    {
      "check": "lock public fixture inputs",
      "argv": [
        "distill",
        "lock",
        "config.json",
        "--output",
        "context.lock.json"
      ],
      "exit_code": 0,
      "stdout": "locked sources=3 duplicates=0 selected=3 tokens=532 lock_sha256=6cb95c3e205268b6addbe4c56e360b867a97b1dabddab3c2cdcab83f384c5a14\n",
      "stderr": ""
    },
    {
      "check": "build first artifact",
      "argv": [
        "distill",
        "build",
        "context.lock.json",
        "--output",
        "distill"
      ],
      "exit_code": 0,
      "stdout": "built sources=3 duplicates=0 selected=3 tokens=532 bundle_sha256=2c823187d98e56167582c28f7bb42e27f94b2ae365f326dc82ab4691df155ad7 lock_sha256=6cb95c3e205268b6addbe4c56e360b867a97b1dabddab3c2cdcab83f384c5a14 manifest_sha256=6ec1e0608fb72cf5c9dda22a5f4f2af77d3da871ac7797fd2f55016cb77ed534\n",
      "stderr": ""
    },
    {
      "check": "verify against retained lock digest",
      "argv": [
        "distill",
        "verify",
        "distill",
        "--expected-lock-sha256",
        "6cb95c3e205268b6addbe4c56e360b867a97b1dabddab3c2cdcab83f384c5a14"
      ],
      "exit_code": 0,
      "stdout": "verified sources=3 duplicates=0 selected=3 tokens=532 bundle_sha256=2c823187d98e56167582c28f7bb42e27f94b2ae365f326dc82ab4691df155ad7 lock_sha256=6cb95c3e205268b6addbe4c56e360b867a97b1dabddab3c2cdcab83f384c5a14 manifest_sha256=6ec1e0608fb72cf5c9dda22a5f4f2af77d3da871ac7797fd2f55016cb77ed534\n",
      "stderr": ""
    },
    {
      "check": "build repeat artifact",
      "argv": [
        "distill",
        "build",
        "context.lock.json",
        "--output",
        "repeat"
      ],
      "exit_code": 0,
      "stdout": "built sources=3 duplicates=0 selected=3 tokens=532 bundle_sha256=2c823187d98e56167582c28f7bb42e27f94b2ae365f326dc82ab4691df155ad7 lock_sha256=6cb95c3e205268b6addbe4c56e360b867a97b1dabddab3c2cdcab83f384c5a14 manifest_sha256=6ec1e0608fb72cf5c9dda22a5f4f2af77d3da871ac7797fd2f55016cb77ed534\n",
      "stderr": ""
    },
    {
      "check": "verify repeat artifact",
      "argv": [
        "distill",
        "verify",
        "repeat",
        "--expected-lock-sha256",
        "6cb95c3e205268b6addbe4c56e360b867a97b1dabddab3c2cdcab83f384c5a14"
      ],
      "exit_code": 0,
      "stdout": "verified sources=3 duplicates=0 selected=3 tokens=532 bundle_sha256=2c823187d98e56167582c28f7bb42e27f94b2ae365f326dc82ab4691df155ad7 lock_sha256=6cb95c3e205268b6addbe4c56e360b867a97b1dabddab3c2cdcab83f384c5a14 manifest_sha256=6ec1e0608fb72cf5c9dda22a5f4f2af77d3da871ac7797fd2f55016cb77ed534\n",
      "stderr": ""
    },
    {
      "check": "reject changed locked source",
      "argv": [
        "distill",
        "build",
        "context.lock.json",
        "--output",
        "rejected-source-drift"
      ],
      "exit_code": 1,
      "stdout": "",
      "stderr": "Error: locked inputs or identities drifted; run lock explicitly to review changes\nUsage:\n  distill build <lockfile> [flags]\n\nFlags:\n  -h, --help            help for build\n  -o, --output string   fresh output directory\n\nGlobal Flags:\n      --config string   config file (default is $HOME/.distill.yaml)\n      --verbose         enable verbose output\n\nlocked inputs or identities drifted; run lock explicitly to review changes\n",
      "mutation": {
        "path": "sources/repository.py",
        "append_utf8": "# changed after capture\n",
        "original_sha256": "84e969d18a1a139632b04f72dceffaf63d21af258ed5ff9ab6783f075edb1d67",
        "changed_sha256": "057de98b75324653c8d8c754a7f6cac04c46340bd36bb05e67c289299f3294bc"
      },
      "destination_created": false
    },
    {
      "check": "verify original artifact after rejected build",
      "argv": [
        "distill",
        "verify",
        "distill",
        "--expected-lock-sha256",
        "6cb95c3e205268b6addbe4c56e360b867a97b1dabddab3c2cdcab83f384c5a14"
      ],
      "exit_code": 0,
      "stdout": "verified sources=3 duplicates=0 selected=3 tokens=532 bundle_sha256=2c823187d98e56167582c28f7bb42e27f94b2ae365f326dc82ab4691df155ad7 lock_sha256=6cb95c3e205268b6addbe4c56e360b867a97b1dabddab3c2cdcab83f384c5a14 manifest_sha256=6ec1e0608fb72cf5c9dda22a5f4f2af77d3da871ac7797fd2f55016cb77ed534\n",
      "stderr": ""
    },
    {
      "check": "reject modified bundle",
      "argv": [
        "distill",
        "verify",
        "tampered",
        "--expected-lock-sha256",
        "6cb95c3e205268b6addbe4c56e360b867a97b1dabddab3c2cdcab83f384c5a14"
      ],
      "exit_code": 1,
      "stdout": "",
      "stderr": "Error: context.manifest.json: bundle identity mismatch\nUsage:\n  distill verify <directory> [flags]\n\nFlags:\n      --expected-lock-sha256 string   trusted out-of-band context.lock.json SHA-256\n  -h, --help                          help for verify\n\nGlobal Flags:\n      --config string   config file (default is $HOME/.distill.yaml)\n      --verbose         enable verbose output\n\ncontext.manifest.json: bundle identity mismatch\n",
      "mutation": {
        "path": "tampered/context.bundle.md",
        "append_utf8": "tampered\n",
        "original_sha256": "2c823187d98e56167582c28f7bb42e27f94b2ae365f326dc82ab4691df155ad7",
        "changed_sha256": "7860f2e86092fa83a54e047b8ba71f02a46d0826d7b8710d3976700eecdc3a19"
      }
    },
    {
      "check": "reject different expected lock digest",
      "argv": [
        "distill",
        "verify",
        "distill",
        "--expected-lock-sha256",
        "0000000000000000000000000000000000000000000000000000000000000000"
      ],
      "exit_code": 1,
      "stdout": "",
      "stderr": "Error: trusted lock digest mismatch: got 6cb95c3e205268b6addbe4c56e360b867a97b1dabddab3c2cdcab83f384c5a14, want 0000000000000000000000000000000000000000000000000000000000000000\nUsage:\n  distill verify <directory> [flags]\n\nFlags:\n      --expected-lock-sha256 string   trusted out-of-band context.lock.json SHA-256\n  -h, --help                          help for verify\n\nGlobal Flags:\n      --config string   config file (default is $HOME/.distill.yaml)\n      --verbose         enable verbose output\n\ntrusted lock digest mismatch: got 6cb95c3e205268b6addbe4c56e360b867a97b1dabddab3c2cdcab83f384c5a14, want 0000000000000000000000000000000000000000000000000000000000000000\n"
    }
  ]
}