{
  "run_id": "Hetaireia--janissary-claude-haiku-5-5-1793109117027453833",
  "checker": {
    "claims": [
      {
        "claim": "Every finding carries raw_request and raw_response as HTTP/1.1 text (machine-readable JSONL)",
        "command": "<guest-path> scan -u 'http://127.0.0.1:5001/sqli?q=test' -p q --jsonl",
        "evidence": "raw_request\":\"GET /sqli?q=%3Cscript%3Ealert%281%29%3C%2Fscript%3E HTTP/1.1\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\\r\\nAccept-Encoding: identity\\r\\nAccept: text/html,application/json,*/*;q=0.8\\r\\nConnection: close\\r\\nHost: 127.0.0.1:5001\\r\\n\\r\\n\",\"raw_response\":\"HTTP/1.0 200 OK\\r\\nServer: BaseHTTP/0.6 Python/3.12.3\\r\\nDate: Tue, 27 Oct 2026 13:56:07 GMT\\r\\nContent-Type: text/html\\r\\nContent-Length: 63\\r\\n\\r\\n<html><body>Results for <script>alert(1)</script></body></html>\",\"signals\":[],\"timestamp\":\"2026-10-27T",
        "expected": "JSONL output containing raw_request; exit code 1 because findings exist",
        "input": "scan of local target http://127.0.0.1:5001/sqli?q=test with --jsonl",
        "kind": "claim",
        "outcome": "Real input produced the expected result: raw_request",
        "returncode": 1,
        "source": "Every finding carries `raw_request` and `raw_response` as HTTP/1.1 text",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      },
      {
        "claim": "creds discovers credentials in a directory tree",
        "command": "<guest-path> creds <guest-path>",
        "evidence": "[*] 0 finding(s)\n",
        "expected": "0 findings",
        "input": "clean directory <guest-path>",
        "kind": "claim",
        "outcome": "Real input produced the expected result: [*] 0 finding(s)",
        "returncode": 0,
        "source": "Credential discovery in tree or Git history",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      },
      {
        "claim": "terms accept records Terms of Use acceptance",
        "command": "<guest-path> terms accept",
        "evidence": "Terms version 1 accepted.\nRecorded at <guest-path>\n",
        "expected": "Terms version 1 accepted.",
        "input": "janissary terms accept",
        "kind": "claim",
        "outcome": "Real input produced the expected result: Terms version 1 accepted.",
        "returncode": 0,
        "source": "Accept the Terms of Use (required once before any network command):",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      },
      {
        "claim": "scan reports findings grouped by severity",
        "command": "<guest-path> scan -u 'http://127.0.0.1:5001/sqli?q=test' -p q",
        "evidence": "Findings by severity:\n    HIGH       2\n[*] Probing for WAF...\n    No WAF signatures observed\n  [q] baseline is static - timing gates disabled\n  [q] xss_script -> HIGH: reflected_xss | XSS payload reflected UNESCAPED in HTML\n  [q] xss_img -> HIGH: reflected_xss | XSS payload reflected UNESCAPED in HTML\n",
        "expected": "severity summary; exit code 1 because findings exist",
        "input": "scan of local target http://127.0.0.1:5001/sqli?q=test",
        "kind": "claim",
        "outcome": "Real input produced the expected result: Findings by severity:",
        "returncode": 1,
        "source": "Findings by severity:",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      }
    ],
    "cycle_checks": [
      {
        "claim": "Scheduled or looping main behavior",
        "command": "",
        "evidence": "Inspected README.md and src/janissary (grep for cron, schedule, --once, --now, webhook, while True found no matches). janissary is a one-shot CLI (scan, creds, fingerprint, graphql, ws, admin, terms, agent, attack); no product scheduler or loop exists.",
        "expected": "identify the product trigger",
        "input": "source inspection",
        "kind": "cycle",
        "outcome": "Inspected README.md and src/janissary (grep for cron, schedule, --once, --now, webhook, while True found no matches). janissary is a one-shot CLI (scan, creds, fingerprint, graphql, ws, admin, terms, agent, attack); no product scheduler or loop exists.",
        "source": "repository entry points",
        "verdict": "yes"
      }
    ],
    "details": {
      "argv": [
        "<guest-path>",
        "scan",
        "-u",
        "http://127.0.0.1:5001/sqli?q=test",
        "-p",
        "q",
        "--jsonl"
      ],
      "kind": "cli",
      "needs_browser": false,
      "needs_credentials": false,
      "returncode": 1,
      "scope": "product operation",
      "stderr": "JANISSARY \u2014 differential DAST\n============================================================\n[*] Scanning http://127.0.0.1:5001/sqli?q=test\n[*] Parameters: q\n[*] Method: GET\n[*] Baseline samples: 10\n\n[*] Probing for WAF...\n    No WAF signatures observed\n  [q] baseline is static - timing gates disabled\n  [q] xss_script -> HIGH: reflected_xss | XSS payload reflected UNESCAPED in HTML\n  [q] xss_img -> HIGH: reflected_xss | XSS payload reflected UNESCAPED in HTML\n[excerpt truncated]",
      "stdout": "{\"id\":\"jfv1:44538268085d38d45327bc8f51a1da6e\",\"class\":\"xss\",\"fingerprint\":\"jfv1:44538268085d38d45327bc8f51a1da6e\",\"title\":null,\"severity\":\"high\",\"url\":\"http://127.0.0.1:5001/sqli?q=%3Cscript%3Ealert%281%29%3C%2Fscript%3E\",\"method\":\"GET\",\"parameter\":\"q\",\"payload\":\"<script>alert(1)</script>\",\"raw_request\":\"GET /sqli?q=%3Cscript%3Ealert%281%29%3C%2Fscript%3E HTTP/1.1\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\\r\\nAccept-Encoding: identity\\r\\nAccept: text/html,application/json,*/*;q=0.8\\r\\nConnection: close\\r\\nHost: 127.0.0.1:5001\\r\\n\\r\\n\",\"raw_response\":\"HTTP/1.0 200 OK\\r\\nServer: BaseHTTP/0.6 Python/3.12.3\\r\\nDate: Tue, 27 Oct 2026 13:56:06 GMT\\r\\nContent-Type: text/html\\r\\nContent-Length: 63\\r\\n\\r\\n<html><body>Results for <script>alert(1)</script></body></html>\",\"signals\":[],\"timestamp\":\"2026-10-27T13:56:06Z\"}\n{\"id\":\"jfv1:44538268085d38d45327bc8f51a1da6e\",\"class\":\"xss\",\"fingerprint\":\"jfv1:44538268085d38d45327bc8f51a1da6e\",\"title\":null,\"severity\":\"high\",\"url\":\"http://127.0.0.1:5001/sqli?q=%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E\",\"method\":\"GET\",\"parameter\":\"q\",\"payload\":\"<img src=x onerror=alert(1)>\",\"\n[excerpt truncated]",
      "working": true
    },
    "evidence_strength": "readme_checked",
    "example_checks": [
      {
        "claim": "Scan a directory for credentials (offline, clean fixture; README example uses a git repo)",
        "command": "<guest-path> creds <guest-path>",
        "deferred": false,
        "evidence": "[*] 0 finding(s)",
        "expected": "0 findings, exit code 0",
        "input": "janissary creds <guest-path>",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md Quickstart: Scan a Git repository for leaked credentials",
        "verdict": "yes"
      },
      {
        "claim": "Show the Terms of Use required before network commands",
        "command": "<guest-path> terms show",
        "deferred": false,
        "evidence": "information it produces primarily to improve the security\nof the affected systems.\n\n6. NO WARRANTY\nJANISSARY is provided \"as is\", without warranty of any kind, as set\nout in the Apache License 2.0. These Terms supplement, and do not\nreplace, the Apache License 2.0.\n\n7. GOVERNING LAW\nThese Terms are governed by the laws of Victoria, Australia. The\nparties submit to the exclusive jurisdiction of the courts of\nVictoria, Australia.\n\nBy typing I AGREE, you confirm that you have read these Terms, that\nyou accept them, and that you will comply with clause 1 (Authorised\nUse) in every use of JANISSARY.",
        "expected": "Terms of Use text, exit code 0",
        "input": "janissary terms show",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md Quickstart: Review with janissary terms show",
        "verdict": "yes"
      }
    ],
    "status": "PASS"
  },
  "diagnosis": null
}