[
  {
    "coverage_id": "GET%20%2Fattachment::user-%3Efilesystem::notes-api::path-traversal",
    "canonical_refs": {
      "surface": "GET /attachment",
      "boundary": "user->filesystem",
      "subsystem": "notes-api",
      "attack_class": "path-traversal"
    },
    "surface": "GET /attachment",
    "boundary": "user->filesystem",
    "subsystem": "notes-api",
    "attack_class": "path-traversal",
    "starting_paths": [
      "app/server.py"
    ],
    "ordinary_attack_class_block": null,
    "selected_companion_blocks": [],
    "excluded_blocks": [],
    "prior_status": "none",
    "attempts": [],
    "wave": 1,
    "status": "candidate",
    "agent_id": "verifier-2",
    "reviewed_paths": [
      "app/server.py"
    ],
    "local_checks": [
      {
        "agent_id": "verifier-2",
        "reviewed_paths": [
          "app/server.py"
        ],
        "invariant": "read_attachment() validates path stays within FILES_DIR",
        "method": "source",
        "result": "FAIL: Confirmed missing path validation allows arbitrary file read",
        "artifact": null
      }
    ],
    "result_fingerprints": [
      "path-traversal-attachment-endpoint"
    ],
    "unresolved": []
  },
  {
    "coverage_id": "GET%20%2Favatar::user-%3Efilesystem::notes-api::path-traversal",
    "canonical_refs": {
      "surface": "GET /avatar",
      "boundary": "user->filesystem",
      "subsystem": "notes-api",
      "attack_class": "path-traversal"
    },
    "surface": "GET /avatar",
    "boundary": "user->filesystem",
    "subsystem": "notes-api",
    "attack_class": "path-traversal",
    "starting_paths": [
      "app/server.py"
    ],
    "ordinary_attack_class_block": null,
    "selected_companion_blocks": [],
    "excluded_blocks": [],
    "prior_status": "none",
    "attempts": [],
    "wave": 1,
    "status": "covered",
    "agent_id": "hunter-1",
    "reviewed_paths": [
      "app/server.py"
    ],
    "local_checks": [
      {
        "agent_id": "hunter-1",
        "reviewed_paths": [
          "app/server.py"
        ],
        "invariant": "read_avatar() validates path stays within FILES_DIR/avatars",
        "method": "source",
        "result": "PASS: read_avatar() uses os.path.abspath() and startswith check at lines 45-47",
        "artifact": null
      }
    ],
    "result_fingerprints": [],
    "unresolved": []
  },
  {
    "coverage_id": "GET%20%2Fnote::user-%3Edatabase::notes-api::injection-sql",
    "canonical_refs": {
      "surface": "GET /note",
      "boundary": "user->database",
      "subsystem": "notes-api",
      "attack_class": "injection-sql"
    },
    "surface": "GET /note",
    "boundary": "user->database",
    "subsystem": "notes-api",
    "attack_class": "injection-sql",
    "starting_paths": [
      "app/server.py"
    ],
    "ordinary_attack_class_block": null,
    "selected_companion_blocks": [],
    "excluded_blocks": [],
    "prior_status": "none",
    "attempts": [],
    "wave": 1,
    "status": "covered",
    "agent_id": "hunter-1",
    "reviewed_paths": [
      "app/server.py"
    ],
    "local_checks": [
      {
        "agent_id": "hunter-1",
        "reviewed_paths": [
          "app/server.py"
        ],
        "invariant": "get_note() uses parameterized query with ? placeholders",
        "method": "source",
        "result": "PASS: get_note() uses parameterized query at line 28 with both id and owner",
        "artifact": null
      }
    ],
    "result_fingerprints": [],
    "unresolved": []
  },
  {
    "coverage_id": "GET%20%2Fsearch::user-%3Edatabase::notes-api::injection-sql",
    "canonical_refs": {
      "surface": "GET /search",
      "boundary": "user->database",
      "subsystem": "notes-api",
      "attack_class": "injection-sql"
    },
    "surface": "GET /search",
    "boundary": "user->database",
    "subsystem": "notes-api",
    "attack_class": "injection-sql",
    "starting_paths": [
      "app/server.py"
    ],
    "ordinary_attack_class_block": null,
    "selected_companion_blocks": [],
    "excluded_blocks": [],
    "prior_status": "none",
    "attempts": [],
    "wave": 1,
    "status": "candidate",
    "agent_id": "verifier-1",
    "reviewed_paths": [
      "app/server.py"
    ],
    "local_checks": [
      {
        "agent_id": "verifier-1",
        "reviewed_paths": [
          "app/server.py"
        ],
        "invariant": "search_notes() uses parameterized query with ? placeholders",
        "method": "source",
        "result": "FAIL: Confirmed string interpolation at line 22 allows SQL injection",
        "artifact": null
      }
    ],
    "result_fingerprints": [
      "sql-injection-search-endpoint"
    ],
    "unresolved": []
  },
  {
    "coverage_id": "POST%20%2Fdelete::user-A-%3Euser-B-data::notes-api::idor",
    "canonical_refs": {
      "surface": "POST /delete",
      "boundary": "user-A->user-B-data",
      "subsystem": "notes-api",
      "attack_class": "idor"
    },
    "surface": "POST /delete",
    "boundary": "user-A->user-B-data",
    "subsystem": "notes-api",
    "attack_class": "idor",
    "starting_paths": [
      "app/server.py"
    ],
    "ordinary_attack_class_block": null,
    "selected_companion_blocks": [],
    "excluded_blocks": [],
    "prior_status": "none",
    "attempts": [],
    "wave": 1,
    "status": "candidate",
    "agent_id": "verifier-3",
    "reviewed_paths": [
      "app/server.py"
    ],
    "local_checks": [
      {
        "agent_id": "verifier-3",
        "reviewed_paths": [
          "app/server.py"
        ],
        "invariant": "delete_note() verifies note ownership before deletion",
        "method": "source",
        "result": "FAIL: Confirmed missing ownership check allows cross-user note deletion",
        "artifact": null
      }
    ],
    "result_fingerprints": [
      "idor-delete-endpoint"
    ],
    "unresolved": []
  },
  {
    "coverage_id": "all%20endpoints::unauthenticated-%3Eauthenticated::notes-api::auth-bypass",
    "canonical_refs": {
      "surface": "all endpoints",
      "boundary": "unauthenticated->authenticated",
      "subsystem": "notes-api",
      "attack_class": "auth-bypass"
    },
    "surface": "all endpoints",
    "boundary": "unauthenticated->authenticated",
    "subsystem": "notes-api",
    "attack_class": "auth-bypass",
    "starting_paths": [
      "app/server.py"
    ],
    "ordinary_attack_class_block": null,
    "selected_companion_blocks": [],
    "excluded_blocks": [],
    "prior_status": "none",
    "attempts": [],
    "wave": 1,
    "status": "covered",
    "agent_id": "hunter-1",
    "reviewed_paths": [
      "app/server.py"
    ],
    "local_checks": [
      {
        "agent_id": "hunter-1",
        "reviewed_paths": [
          "app/server.py"
        ],
        "invariant": "All endpoints require valid X-Session header",
        "method": "source",
        "result": "PASS: current_user() check at lines 63-64, 78-80 returns 401 for missing/invalid session",
        "artifact": null
      }
    ],
    "result_fingerprints": [],
    "unresolved": []
  }
]