{
  "schemaVersion": "kingy-independent-runtime-credential-export-followup/1.0.0",
  "checkedAt": "2026-10-17T07:52:18.862758+00:00",
  "findingClosedInPreparedSource": true,
  "scope": "Credential-bearing native runtime receipt publication preparation; real all240 public scan/deployment remain pending.",
  "verified": [
    "Original raw runtime receipt bytes still match frozen private hash and permissions are0600.",
    "Public derivative omits all command/argv-style fields, preserves executable/PID/parent only, and binds private original SHA256.",
    "Top-level report artifact uses the public derivative; recursive audit exporter explicitly excludes raw receipt and includes public-native-runtime folder.",
    "Actual current privacy scanner rejects a process key in HTML, its JSON-escaped form in nested ZIP, and the prohibited raw receipt archive path; benign hash-bound derivative passes.",
    "Earlier assistant-step private-message collection and staged-file hash-binding remain present in the modified scanner."
  ],
  "controls": {
    "rootFocusedCollectorChecks": 9,
    "independentEndToEndSyntheticChecks": 4,
    "allPassed": true,
    "syntheticPrivateOriginalBytesUnchanged": true
  },
  "inputSha256": {
    "privateOriginal": "7951780d66b1663cba86e5e01fa9475af7c6def1ebb6d4748ec79f1bdbf83cf7",
    "publicDerivative": "00fedc0d00fee9cfc8e07b2795bbd80bb0ae55a42502c28ce4a7ecb1157d246b",
    "reportInputSource": "b2190d87cfe658963d6a7718f3c96137b3cbaa05151a23ec774b235128e3a2fc",
    "privacyScannerSource": "fb299dd7d3cfca6569bd5377371d7f052449056900c26c8b890e10a2526668d5",
    "rootControlReceipt": "4133f99bacb9f4b06031efc7f8cba57cc9e9cb74e2aff2b7217beeed7a66c99b",
    "independentControlReceipt": "d10e0932248102b37850c1151586959cf2c423241009b9ff6a804740bcce0410",
    "testSource": "5b9987fae41b4de3eb8a72a4ab4cc9f0b7e7443ca75f04e94e0b7a14cc2639c7"
  },
  "privateValuesPrintedByThisFollowup": false,
  "actualCredentialValuesPrinted": false,
  "freshReferencesOrQualityRead": false,
  "nativeUiActions": 0,
  "modelCalls": 0,
  "actualPublicBundleScanned": false,
  "publicationApproved": false,
  "launchApproved": false,
  "notes": "No additional credential-bearing artifact path was identified in this review. Root separately reported an opaque exact-value scan found only the raw receipt; this followup did not repeat that private-value search."
}