{
  "evidence_id": "ev_2047d49dca26f40d65192eab60fe52838ce0b3fa4dcc1afa5bae906c83e5f6e5",
  "subject": null,
  "provider": {
    "id": "rea-process",
    "name": "REA process capture",
    "version": "3"
  },
  "analysis_profile": null,
  "predicate_type": "rea.process-capture",
  "operation": "capture_process_scenario",
  "parameters": {
    "executable_name": "ms_flag_checker",
    "argument_count": 0,
    "event_count": 1,
    "filesystem_observation_path_count": 0,
    "normalization": {
      "paths": false,
      "pids": true,
      "ports": true,
      "time_bucket_ms": 10,
      "patterns": []
    }
  },
  "raw_result": null,
  "normalized_result": {
    "manifest": {
      "rea_version": "6.7.0",
      "provider_version": "3",
      "platform": "linux",
      "architecture": "x64",
      "pty_backend": "node-pty",
      "started_at": "2026-10-23T04:46:36.375Z",
      "completed_at": "2026-10-23T04:46:36.763Z",
      "scenario": {
        "executable": "[workspace]/.qa/ctf/ms_flag_checker",
        "arguments": [],
        "working_directory": "[workspace]/.qa/ctf",
        "environment": {},
        "filesystem_observation_paths": [],
        "terminal": {
          "columns": 80,
          "rows": 24,
          "scrollback": 1000
        },
        "events": [
          {
            "at_ms": 300,
            "type": "input",
            "data": "DUCTF{ezzzpzzz_07bcda8bfe81faf43caa}\n",
            "sensitive": false
          }
        ],
        "timeout_ms": 10000,
        "idle_timeout_ms": 30000,
        "settle_ms": 100,
        "limits": {
          "output_bytes": 1000000,
          "files": 10000,
          "file_bytes": 10000000,
          "processes": 1000,
          "filesystem_depth": 16
        },
        "normalization": {
          "paths": false,
          "pids": true,
          "ports": true,
          "time_bucket_ms": 10,
          "patterns": []
        },
        "executable_sha256": "dcd3bec4f608e11f3a12ce461100aaf5f621851ee63a1f870d7c90d4e3dd51ae"
      },
      "comparison_contract": {
        "working_directory": "[workspace]/.qa/ctf",
        "environment": {},
        "ambient_environment": "unknown",
        "filesystem_observation_paths": [],
        "terminal": {
          "columns": 80,
          "rows": 24,
          "scrollback": 1000
        },
        "events": [
          {
            "at_ms": 300,
            "type": "input",
            "data": "DUCTF{ezzzpzzz_07bcda8bfe81faf43caa}\n",
            "sensitive": false
          }
        ],
        "timeout_ms": 10000,
        "idle_timeout_ms": 30000,
        "settle_ms": 100,
        "limits": {
          "output_bytes": 1000000,
          "files": 10000,
          "file_bytes": 10000000,
          "processes": 1000,
          "filesystem_depth": 16
        },
        "normalization": {
          "paths": false,
          "pids": true,
          "ports": true,
          "time_bucket_ms": 10,
          "patterns": []
        },
        "port_normalization_version": "contextual-endpoints-v2",
        "rendered_line_format": "trailing-spaces-trimmed-v1"
      },
      "full_scenario_sha256": "a7190c092a714d835e8b0b3b1e76525a1903105f3bfcfc238d5975f80c98c1bd",
      "comparison_contract_sha256": "493b68d0841f1ecff5dc3ff9e2dcd3108dd05d4880114a7815023fdebac3093d",
      "selected_executable_sha256": "dcd3bec4f608e11f3a12ce461100aaf5f621851ee63a1f870d7c90d4e3dd51ae",
      "executable_sha256": "dcd3bec4f608e11f3a12ce461100aaf5f621851ee63a1f870d7c90d4e3dd51ae",
      "executable_identity": {
        "state": "path_metadata_unchanged",
        "reason": null
      },
      "normalization_sha256": "5c58aa1aa890197f15f9c59ef755d01120e6e07f356fa1ef2f20787e63b6fa87"
    },
    "normalization": {
      "paths": false,
      "pids": true,
      "ports": true,
      "time_bucket_ms": 10,
      "patterns": []
    },
    "frames": [
      {
        "sequence": 0,
        "at_ms": 0,
        "data": "What is the flag? "
      },
      {
        "sequence": 1,
        "at_ms": 300,
        "data": "DUCTF{ezzzpzzz_07bcda8bfe81faf43caa}\r\n"
      },
      {
        "sequence": 2,
        "at_ms": 300,
        "data": "Incorrect!\r\n"
      }
    ],
    "rendered_frames": [
      {
        "sequence": 0,
        "at_ms": 0,
        "columns": 80,
        "rows": 24,
        "cursor_x": 18,
        "cursor_y": 0,
        "active_buffer": "normal",
        "lines": [
          "What is the flag?",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          ""
        ],
        "serialized_state": "What is the flag? "
      },
      {
        "sequence": 1,
        "at_ms": 300,
        "columns": 80,
        "rows": 24,
        "cursor_x": 0,
        "cursor_y": 1,
        "active_buffer": "normal",
        "lines": [
          "What is the flag? DUCTF{ezzzpzzz_07bcda8bfe81faf43caa}",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          ""
        ],
        "serialized_state": "What is the flag? DUCTF{ezzzpzzz_07bcda8bfe81faf43caa}\u001b[1B\u001b[54D"
      },
      {
        "sequence": 2,
        "at_ms": 300,
        "columns": 80,
        "rows": 24,
        "cursor_x": 0,
        "cursor_y": 2,
        "active_buffer": "normal",
        "lines": [
          "What is the flag? DUCTF{ezzzpzzz_07bcda8bfe81faf43caa}",
          "Incorrect!",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          ""
        ],
        "serialized_state": "What is the flag? DUCTF{ezzzpzzz_07bcda8bfe81faf43caa}\r\nIncorrect!\u001b[1B\u001b[10D"
      }
    ],
    "interaction_events": [
      {
        "sequence": 0,
        "scheduled_at_ms": 300,
        "dispatched_at_ms": 302,
        "type": "input",
        "data": "DUCTF{ezzzpzzz_07bcda8bfe81faf43caa}\n",
        "outcome": "dispatched"
      }
    ],
    "exit": {
      "code": 255,
      "signal": 0,
      "reason": "exited"
    },
    "settlement": {
      "state": "quiesced",
      "elapsed_ms": 59,
      "cleanup_outcome": "not_required"
    },
    "process_samples": [
      {
        "at_ms": 50,
        "pid": 1,
        "parent_pid": 2,
        "command": "[workspace]/.qa/ctf/ms_flag_checker",
        "process_group_id": 1,
        "session_id": 1
      }
    ],
    "filesystem_checkpoints": [
      {
        "name": "before",
        "at_ms": 0,
        "files": [],
        "effects": [],
        "truncated": false
      },
      {
        "name": "after_settlement",
        "at_ms": 387,
        "files": [],
        "effects": [],
        "truncated": false
      }
    ],
    "event_journal": [
      {
        "capture_order": 0,
        "collection": "filesystem_checkpoints",
        "index": 0
      },
      {
        "capture_order": 1,
        "collection": "frames",
        "index": 0
      },
      {
        "capture_order": 2,
        "collection": "rendered_frames",
        "index": 0
      },
      {
        "capture_order": 3,
        "collection": "process_samples",
        "index": 0
      },
      {
        "capture_order": 4,
        "collection": "interaction_events",
        "index": 0
      },
      {
        "capture_order": 5,
        "collection": "frames",
        "index": 1
      },
      {
        "capture_order": 6,
        "collection": "frames",
        "index": 2
      },
      {
        "capture_order": 7,
        "collection": "lifecycle",
        "index": 0
      },
      {
        "capture_order": 8,
        "collection": "rendered_frames",
        "index": 1
      },
      {
        "capture_order": 9,
        "collection": "rendered_frames",
        "index": 2
      },
      {
        "capture_order": 10,
        "collection": "lifecycle",
        "index": 1
      },
      {
        "capture_order": 11,
        "collection": "filesystem_checkpoints",
        "index": 1
      }
    ],
    "files_before": [],
    "files_after": [],
    "filesystem_effects": [],
    "truncated": false,
    "truncation_details": {
      "raw_terminal": {
        "budget_bytes": 1000000,
        "observed_bytes": 68,
        "retained_bytes": 68,
        "observed_frames": 3,
        "retained_frames": 3
      },
      "rendered_terminal": {
        "budget_bytes": 1000000,
        "observed_bytes": 291,
        "retained_bytes": 291,
        "observed_frames": 3,
        "retained_frames": 3
      },
      "normalized_terminal": {
        "budget_bytes": 1000000,
        "retained_bytes": 68,
        "omitted_frames": 0
      },
      "filesystem_before": {
        "files_limit": 10000,
        "depth_limit": 16,
        "enumeration_truncated": false,
        "enumeration_reasons": [],
        "enumeration_omissions": [],
        "hash_budget_bytes": 10000000,
        "hashed_bytes": 0,
        "hash_omissions": []
      },
      "filesystem_after": {
        "files_limit": 10000,
        "depth_limit": 16,
        "enumeration_truncated": false,
        "enumeration_reasons": [],
        "enumeration_omissions": [],
        "hash_budget_bytes": 10000000,
        "hashed_bytes": 0,
        "hash_omissions": []
      },
      "process": {
        "sample_limit": 1000,
        "sampling_partial": false,
        "retained_samples": 1,
        "sample_limit_reached": false,
        "sampling_failures": 0,
        "first_sampling_failure": null,
        "coverage": "sampled"
      }
    },
    "limitations": [
      "The executable digest is a prelaunch file sample; matching path metadata immediately after spawn does not prove an atomic operating-system image binding.",
      "Process trees are sampled and may omit short-lived descendants.",
      "Filesystem observations are before/after snapshots, not syscall traces.",
      "Inherited host environment variables are not recorded and may affect results.",
      "No filesystem observation paths were selected; filesystem effects remain unknown."
    ],
    "residual_unknowns": [
      {
        "scope": "process",
        "reason": "Process trees are sampled and may omit short-lived descendants."
      },
      {
        "scope": "process",
        "reason": "The executable digest is a prelaunch file sample; operating-system image binding is not atomically observed."
      },
      {
        "scope": "environment",
        "reason": "Inherited host environment variables are not recorded."
      },
      {
        "scope": "network",
        "reason": "Network activity is not observed by this capture."
      },
      {
        "scope": "filesystem",
        "reason": "No filesystem observation paths were selected; filesystem effects remain unknown."
      }
    ],
    "cleanup": {
      "owned_process_group": "verified",
      "temporary_root": "removed"
    }
  },
  "confidence": "observed",
  "authority": "controlled-replay",
  "environment": {
    "id": "linux-x64",
    "platform": "linux",
    "architecture": "x64",
    "isolation": "process"
  },
  "limitations": [
    "Artifact identity is unavailable for this observation.",
    "The executable digest is a prelaunch file sample; matching path metadata immediately after spawn does not prove an atomic operating-system image binding.",
    "Process trees are sampled and may omit short-lived descendants.",
    "Filesystem observations are before/after snapshots, not syscall traces.",
    "Inherited host environment variables are not recorded and may affect results.",
    "No filesystem observation paths were selected; filesystem effects remain unknown."
  ],
  "relationship_coverage": null,
  "locations": [],
  "evidence_links": []
}