{"schema_version":"evidence-package@2.2","spec_version":"devtask.execution@1.0","bundle_id":"devtask-execution-network-egress-deny-canary-1790386268855-1-1790386274828","capability":"devtask.execution@1.0","run_id":"network-egress-deny-canary-1790386268855:1","claim_ladder":"L0","executed_at":"2026-09-26T01:31:14.856Z","trace_events":["devtask_contract_bound:{\"task_id\":\"network-egress-deny-canary-1790386268855\",\"attempt_number\":1,\"contract_hash\":\"9d1f5e68475a22c09b653f0d1d05d47e2d442a2174ac772a2ba249f88e074c40\",\"contract_schema_version\":\"work-contract@1.0\",\"risk_class\":\"R0\",\"protect_existing_tests\":false,\"test_protection_disclosure\":\"disclosed\"}","devtask_attempt_started:{\"task_id\":\"network-egress-deny-canary-1790386268855\",\"attempt_number\":1,\"started_at\":\"2026-09-26T01:31:14.816Z\"}","devtask_execution_context:{\"task_id\":\"network-egress-deny-canary-1790386268855\",\"attempt_number\":1,\"execution_reference\":\"dev_task_attempts:7\",\"sandbox_reference\":\"sandbox-attestation:sha256:8fd9d1693be9c63b9e94b5b68491e69c9f3a6f9b234b8c7a3a5c6f073e30d44f\",\"executor\":\"deepseek\",\"harness_id\":\"agent-loop-server\",\"adapter_version\":\"repo-contribution-pipeline/deepseek@1.0.0\",\"adapter_version_sha256\":\"c36e789ec4f969715737cecd0c76ea879d3c955623e0a61e1fad3439d992e63b\"}","devtask_scope_violation:{\"task_id\":\"network-egress-deny-canary-1790386268855\",\"attempt_number\":1,\"violation_type\":\"scope_violation\",\"detail\":\"93.184.216.34:443 (tcp)\",\"detected_at\":\"2026-09-26T01:31:14.486Z\"}","devtask_negative_claim:{\"task_id\":\"network-egress-deny-canary-1790386268855\",\"attempt_number\":1,\"claim\":\"no_network_outside_scope\",\"verified_by\":\"nftables_blocked_connections_log\",\"strength\":\"observed\",\"result\":false,\"evidence_ref\":{\"artifact\":\"attestation\",\"id\":\"controller_evidence.sandbox_attestation\",\"digest\":\"sha256:4af822adc3950f493fd271442f0e204e271f1f7aee21dff93c1ba9d752582d66\"}}","devtask_negative_claim:{\"task_id\":\"network-egress-deny-canary-1790386268855\",\"attempt_number\":1,\"claim\":\"no_secret_access\",\"verified_by\":\"sandbox_policy:bubblewrap_clearenv\",\"strength\":\"policy_derived\",\"result\":true,\"evidence_ref\":{\"artifact\":\"runtime_trace\",\"id\":\"trace_events:without_negative_claims\",\"digest\":\"sha256:161da935547fb780eb554ccd457546db72e0b205c7783c76728b15cf140230c8\"}}","devtask_negative_claim:{\"task_id\":\"network-egress-deny-canary-1790386268855\",\"attempt_number\":1,\"claim\":\"no_write_outside_allowlist\",\"verified_by\":\"sandbox_policy:snapshot_without_git_or_symlinks\",\"strength\":\"policy_derived\",\"result\":true,\"evidence_ref\":{\"artifact\":\"runtime_trace\",\"id\":\"trace_events:without_negative_claims\",\"digest\":\"sha256:161da935547fb780eb554ccd457546db72e0b205c7783c76728b15cf140230c8\"}}","devtask_outcome:{\"task_id\":\"network-egress-deny-canary-1790386268855\",\"attempt_number\":1,\"outcome\":\"FAILED\",\"completed_at\":\"2026-09-26 01:31:14\",\"reference\":\"dev_tasks.state\"}"],"trace_hash_chain":["caee0f8218a88611d3049d72dd85bd14d8caed6a97d4b5080bcec70a340ecb9a","d657c3e0ac6265828ef65442ada6058542ed51cc37ab86acf287c44b4e468657","2817cb66a683eef41589fcf868b955d4dd32210c499288b1c4a1c58035a82445","c92bcf78911b21ee5af06f760eb7b717e0cbbc5b8b2d87f7f308d59f359d3c6d","7782a462e362fb18f8f6aaa4175891140086a7b94824a7965c3116fcea56e70e","d094b3f4c63a4c6a50c1af5302aed96295a6123f31b2431459b66eee706bf507","3d22404e8fc8fb750e255955ada5c3d0576731b8a336535d850b565668b31d61","a47d88179d93082f0686356f22b2c050fbad9d8e569630b296225febc1f8e9de"],"outcome":"failed","signer_key_id":"ed25519:6920d2455a0674889932c505bed1e95457a0e0def1879996916d26a419ea0a85","controller_evidence":{"contract_snapshot":{"schemaVersion":"work-contract@1.0","title":"Network Egress Deny Canary","rawText":"{\"schema_version\":\"network-egress-deny-canary@1.0\",\"run_id\":\"network-egress-deny-canary-1790386268855\",\"agent_id\":\"network-egress-deny-canary-1790386268855-agent\",\"network_scope_violations\":[{\"dst_ip\":\"93.184.216.34\",\"dst_port\":443,\"protocol\":\"tcp\",\"observed_at\":\"2026-09-26T01:31:14.486Z\"}],\"execution_log_receipts\":[{\"schema_version\":\"observer-receipt@1.0\",\"observer_url\":\"http://10.84.20.3:8420\",\"leaf_index\":1162,\"received_at\":\"2026-09-26T01:31:08.923Z\",\"entry_hash\":\"2c2b9dec4ee40822244c9448c22822ac985f484ad2c83b2e0d8fb18bc887b25d\",\"sequence\":0}]}","acceptanceCriteria":["Operator-getriggerter Canary-Lauf, keine Kundenfreigabe.","Erwartete Netz-/Scope-Verletzung wird beobachtet und im Evidence-Bundle nachgewiesen."],"acceptanceAssertions":[],"protectExistingTests":false,"testProtectionDisclosure":"disclosed","riskClass":"R0","capabilityIds":[],"impactTargetIds":[],"engineSelection":null},"policy_snapshot_sha256":"245e86d8cab8c1cfd0722811303a9b363f20e5efa10322dfa96b198c55137d04","producer":"privileged_controller","task_id":"network-egress-deny-canary-1790386268855","attempt_number":1,"base_commit":null,"result_reference":null,"diff_stat_sha256":null,"diff_full":null,"diff_full_sha256":null,"execution_reference":"dev_task_attempts:7","validation_reference":null,"approval_reference":null,"sandbox_reference":"sandbox-attestation:sha256:8fd9d1693be9c63b9e94b5b68491e69c9f3a6f9b234b8c7a3a5c6f073e30d44f","sandbox_attestation":{"schema_version":"sandbox-attestation@2.0","sandbox_id":"sandbox:network-egress-deny-canary-1790386268855-agent:e3b0c44298fc1c14","agent_id":"network-egress-deny-canary-1790386268855-agent","started_at":"2026-09-26T01:31:08.880Z","completed_at":"2026-09-26T01:31:14.813Z","snapshot_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","policy_sha256":"87f183f6c6723ae796f7bf561845296129857e449ff34377616c0223065fa809","os_isolation_available":true,"git_metadata_absent":true,"controller_checkout_separated":true,"network_policy":"netns_egress_allowlisted_v1","environment_policy":"bubblewrap_clearenv","process_policy":"systemd_scope_limits_and_kill","handoff_manifest_sha256":"4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945","rejected_manifest_sha256":"4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945","network_capture":{"schema_version":"egress-capture@1.0","dns_queries_sha256":"4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945","connections_sha256":"4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945","connection_count":0,"capture_incomplete":false}},"agent_run_id":"network-egress-deny-canary-1790386268855-agent","repository_state":null,"test_integrity_policy":{"schema_version":"test-integrity-policy@1.0","policy":"protect_existing_tests","protected":false,"status":"not_requested","violating_files":[]},"context_sources":{"schema_version":"context-sources@1.0","title":"Context Sources / Injection Surface","sources":[]}},"required_evidence":["contract","attempt","execution_context","validation","outcome","base_commit","diff_full"],"approval_attestation_required":false,"customer_evidence":{"schema_version":"customer-evidence@1.0","brief":{"title":"Network Egress Deny Canary","raw_text":"{\"schema_version\":\"network-egress-deny-canary@1.0\",\"run_id\":\"network-egress-deny-canary-1790386268855\",\"agent_id\":\"network-egress-deny-canary-1790386268855-agent\",\"network_scope_violations\":[{\"dst_ip\":\"93.184.216.34\",\"dst_port\":443,\"protocol\":\"tcp\",\"observed_at\":\"2026-09-26T01:31:14.486Z\"}],\"execution_log_receipts\":[{\"schema_version\":\"observer-receipt@1.0\",\"observer_url\":\"http://10.84.20.3:8420\",\"leaf_index\":1162,\"received_at\":\"2026-09-26T01:31:08.923Z\",\"entry_hash\":\"2c2b9dec4ee40822244c9448c22822ac985f484ad2c83b2e0d8fb18bc887b25d\",\"sequence\":0}]}"},"cost_partial":{"cost_usd":0,"cost_usd_tracked":true,"turns_used":0,"duration_seconds":0,"assigned_model":null,"assigned_engine":"deepseek","token_tracking":"not_available"},"denied":[],"approval":{"proven":false,"actor_id":null,"channel":"operator_canary","confirmed_by":null,"confirmed_at":null,"approved_at":null,"approval_reference":null},"open_risks":[{"code":"coverage_not_measured","description":"Ob der geaenderte Code durch Tests abgedeckt ist, wird nicht automatisch gemessen -- strukturelle Grenze, keine Aussage ueber diesen einzelnen Lauf.","recommended_action":"Optional: Testabdeckung des geaenderten Codes separat pruefen (z.B. Coverage-Tool), falls fuer diesen Auftrag wichtig."},{"code":"domain_correctness_not_verified","description":"Ob die Aenderung fachlich das Richtige tut, wurde nicht automatisiert geprueft -- das bleibt Teil der menschlichen Freigabe.","recommended_action":"Fachliche Korrektheit durch menschliches Review oder eine Domaenen-Pruefung bestaetigen lassen."},{"code":"ci_not_verified","description":"Kein erfolgreiches CI-Ergebnis fuer diesen Lauf vorhanden.","recommended_action":"CI-Lauf abwarten oder manuell nachholen, bevor der Diff als geprueft gilt."},{"code":"tests_not_protected","description":"Bestehende Tests waren fuer diesen Lauf nicht ausdruecklich vor Aenderung/Loeschung geschuetzt.","recommended_action":"Fuer kuenftige Laeufe protect_existing_tests aktivieren, falls ungewollte Aenderungen daran vermieden werden sollen."},{"code":"dependency_tree_not_fully_audited","description":"Nur neu eingefuehrte Abhaengigkeiten wurden gegen bekannte Schwachstellen (OSV.dev) geprueft, nicht der gesamte bestehende Abhaengigkeitsbaum des Ziel-Repos.","recommended_action":"Fuer eine vollstaendige Pruefung ein dediziertes SBOM-/Dependency-Audit-Tool auf dem gesamten Repo einsetzen."}],"customer_summary":"Network Egress Deny Canary\n\nAuftrag:\n{\"schema_version\":\"network-egress-deny-canary@1.0\",\"run_id\":\"network-egress-deny-canary-1790386268855\",\"agent_id\":\"network-egress-deny-canary-1790386268855-agent\",\"network_scope_violations\":[{\"dst_ip\":\"93.184.216.34\",\"dst_port\":443,\"protocol\":\"tcp\",\"observed_at\":\"2026-09-26T01:31:14.486Z\"}],\"execution_log_receipts\":[{\"schema_version\":\"observer-receipt@1.0\",\"observer_url\":\"http://10.84.20.3:8420\",\"leaf_index\":1162,\"received_at\":\"2026-09-26T01:31:08.923Z\",\"entry_hash\":\"2c2b9dec4ee40822244c9448c22822ac985f484ad2c83b2e0d8fb18bc887b25d\",\"sequence\":0}]}\n\nKosten:\n$0.00, 0 Turns, 0m 0s\nEs werden ausschließlich Aggregatkosten erfasst, keine Tokenzahlen.\n\nFreigabe:\nKeine Freigabe protokolliert.\n\nAbgelehnte Aktionen:\nKeine abgelehnten Aktionen in diesem Lauf.\n\nOffene Risiken:\n- Kein erfolgreiches CI-Ergebnis fuer diesen Lauf vorhanden.\n- Ob der geaenderte Code durch Tests abgedeckt ist, wird nicht automatisch gemessen -- strukturelle Grenze, keine Aussage ueber diesen einzelnen Lauf.\n- Nur neu eingefuehrte Abhaengigkeiten wurden gegen bekannte Schwachstellen (OSV.dev) geprueft, nicht der gesamte bestehende Abhaengigkeitsbaum des Ziel-Repos.\n- Ob die Aenderung fachlich das Richtige tut, wurde nicht automatisiert geprueft -- das bleibt Teil der menschlichen Freigabe.\n- Bestehende Tests waren fuer diesen Lauf nicht ausdruecklich vor Aenderung/Loeschung geschuetzt."},"signature":"gvmB1J9Gy/EJXKKfreB16WlDpEpp/seZ4lvGUw12O0wEQkcnMbVqBTtXAEhc45sa0ukICc87H13GjPaT3EbwBA==","public_key":"-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA7ne5p+CojXWK66SIZl3MuGoyZ/X6WkWNG+ldf8TASWM=\n-----END PUBLIC KEY-----\n","observer_receipt":{"schema_version":"observer-receipt@1.0","observer_url":"http://10.84.20.3:8420","leaf_index":1163,"received_at":"2026-09-26T01:31:14.876Z"},"epistemic_gate":{"schema_version":"epistemic-gate-attestation@1.0","gate":{"schema_version":"epistemic-gate@1.0","score":0.6666666666666666,"threshold":0.34,"blind_modules":["tests_ci","deps_scan","injection_check","cost_model_bind"],"decision":"silent","evaluated_at":"2026-09-26T01:35:27.012Z"},"bundle_sha256":"a07e39ae9ccd4bb2f1fbee150c6fa1fb78ff71f2c88e9dd42adc3e79262aee37","signer_key_id":"ed25519:6920d2455a0674889932c505bed1e95457a0e0def1879996916d26a419ea0a85","public_key":"-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA7ne5p+CojXWK66SIZl3MuGoyZ/X6WkWNG+ldf8TASWM=\n-----END PUBLIC KEY-----\n","signature":"ckajVix+CIXAnEv+YSOsO+ejajasLu472/upV13vzyh5cro2HlpYNgk2qiMf+3nLeaIUGD9Oej0dcrXGR8NYCg=="}}