{
  "recorded_at": "2026-10-26T15:03:11Z",
  "source": "Read-only GitLab API copy of private maintainer project evidence; links to original pipeline and issue require project access.",
  "feature_ref": "night/fresh-ip-20261025",
  "feature_commit": "fbe94c4c71e19a6e2777f638efe86088ad347bb7",
  "pipeline": {
    "id": 2989642669,
    "url": "https://gitlab.com/morklabs-group/example-shop/-/pipelines/2989642669",
    "scanner_job_id": 17468285720,
    "scanner_job_status": "success",
    "scanner_artifact_sha256": "def1f7c1e389bca3cb124694205f6b54a56269aee2cb0f759a973b476e5f2519"
  },
  "finding": {
    "file": "services/night-consumer/package-lock.json",
    "package": "ip",
    "version": "2.0.1",
    "severity": "High",
    "advisory": "GHSA-2p57-rm9w-gvfp"
  },
  "issue": {
    "iid": 7,
    "url": "https://gitlab.com/morklabs-group/example-shop/-/work_items/7",
    "title": "Revival: replace abandoned ip 2.0.1 in services/night-consumer/package-lock.json",
    "target_branch_marker": "night/fresh-ip-20261025"
  },
  "trigger": {
    "job_id": 17468285725,
    "status": "failed",
    "outcome": "Opened issue #7; the initial CI actor Flow API request returned HTTP 400. Root then used a separately supervised start."
  },
  "fresh_duo_session": {
    "first": {
      "id": 10059012,
      "status": "finished_without_edit_or_mr",
      "outcome": "Stopped safely because raw workload ref name differed from the approved night branch."
    },
    "retry": {
      "id": 10060771,
      "status_at_readback": "created; workload pending and never started",
      "workload_pipeline_id": 2990157923,
      "workload_job_id": 17472302288,
      "workload_ref": "refs/workloads/b038cf2424d",
      "approved_source_sha": "fbe94c4c71e19a6e2777f638efe86088ad347bb7",
      "catalog_guard_version": "v1.3.0"
    }
  },
  "fresh_repair_merge_request": null,
  "limits": "The first supervised flow safely stopped. The SHA-guarded retry did not execute before the approved runner window ended; no fresh ip repair or green repaired consumer test exists. The earlier merged parse-git-config Duo repair and downstream test are separate evidence."
}