{
  "schema_version": 1,
  "audit_date": "2026-10-18",
  "firmware": "14.10",
  "evidence_revision": "24c888b0bd5d309497084698cf5478a909b41131",
  "label": "Evidence-weighted milestone estimate",
  "endpoint": "Repeatable kernel exploit on firmware 14.10; hypervisor bypass excluded",
  "interpretation": "A subjective milestone rubric, not an objective fraction of unknown work, time remaining, probability of success, or vulnerability coverage.",
  "milestones": [
    {
      "id": "environment",
      "title": "14.10 research environment",
      "weight": 10,
      "earned": 10,
      "note": "Firmware-tagged Lua execution and observable userland behavior are recorded.",
      "evidence": [
        "results/phase1_identity_layout/01_identity_20261015_184244.txt"
      ],
      "checks": [
        {
          "label": "Firmware identified in a captured session",
          "weight": 5,
          "earned": 5
        },
        {
          "label": "Lua/userland experiments produce observable output",
          "weight": 5,
          "earned": 5
        }
      ]
    },
    {
      "id": "tooling",
      "title": "Probe tooling and captured evidence",
      "weight": 10,
      "earned": 10,
      "note": "Runner source and dated output logs are present; counts measure artifacts, not successful exploits.",
      "evidence": [
        "tools/send_probe.py",
        "docs/PROBE_INDEX.md"
      ],
      "checks": [
        {
          "label": "Probe runner and source available",
          "weight": 5,
          "earned": 5
        },
        {
          "label": "Dated raw outputs retained",
          "weight": 5,
          "earned": 5
        }
      ]
    },
    {
      "id": "characterization",
      "title": "Target characterization",
      "weight": 15,
      "earned": 10,
      "note": "Extensive syscall survey (230+ probes), CClosure dispatch confirmed, 17 KASLR techniques tested and mapped, Sony syscall coverage near-complete.",
      "evidence": [
        "results/51b_accessible_syscall_deep_20261016_214832.txt",
        "results/51c_sony_survey_part2_20261016_215838.txt",
        "results/51b_dynlib_cluster_fuzz_20261016_230416.txt",
        "docs/STRATEGY.md"
      ],
      "checks": [
        {
          "label": "Baseline interface observations retained",
          "weight": 5,
          "earned": 5
        },
        {
          "label": "Complete scoped survey with reconciled current summary",
          "weight": 5,
          "earned": 5
        },
        {
          "label": "Target-build analysis validates a kernel candidate",
          "weight": 5,
          "earned": 0
        }
      ]
    },
    {
      "id": "bug",
      "title": "Validated 14.10 kernel vulnerability",
      "weight": 20,
      "earned": 0,
      "note": "No qualifying root-cause analysis and controlled 14.10 reproduction established by the reviewed record. A loader crash alone does not qualify.",
      "evidence": [
        "docs/STRATEGY.md",
        "docs/PROBE_INDEX.md"
      ],
      "checks": [
        {
          "label": "Kernel vulnerability root cause supported on 14.10",
          "weight": 10,
          "earned": 0
        },
        {
          "label": "Controlled reproduction establishes kernel impact",
          "weight": 10,
          "earned": 0
        }
      ]
    },
    {
      "id": "primitive",
      "title": "Demonstrated 14.10 kernel read/write",
      "weight": 25,
      "earned": 0,
      "note": "No verified kernel read/write demonstration found. Loader API names, normal syscall output, and 13.60 dumps do not qualify.",
      "evidence": [
        "results/45c_execution_reality_check_20261016_192713.txt",
        "docs/FINDINGS.md"
      ],
      "checks": [
        {
          "label": "Verified arbitrary kernel read on 14.10",
          "weight": 10,
          "earned": 0
        },
        {
          "label": "Verified controlled kernel write on 14.10",
          "weight": 10,
          "earned": 0
        },
        {
          "label": "Independent evidence distinguishes kernel from userland effects",
          "weight": 5,
          "earned": 0
        }
      ]
    },
    {
      "id": "chain",
      "title": "Repeatable complete kernel exploit",
      "weight": 20,
      "earned": 0,
      "note": "No end-to-end 14.10 kernel exploit with a repeatability record found. Hypervisor bypass is outside this denominator.",
      "evidence": [
        "docs/STRATEGY.md",
        "docs/PROBE_INDEX.md"
      ],
      "checks": [
        {
          "label": "End-to-end kernel exploit from a fresh session",
          "weight": 10,
          "earned": 0
        },
        {
          "label": "Reported multi-run success/failure denominator",
          "weight": 5,
          "earned": 0
        },
        {
          "label": "Recovery and cleanup behavior recorded",
          "weight": 5,
          "earned": 0
        }
      ]
    }
  ],
  "inventory": {
    "lua_probe_files": 230,
    "text_result_files": 247
  },
  "retractions": [
    {
      "evidence": "results/45c_execution_reality_check_20261016_192713.txt",
      "summary": "Earlier fn_addr/ROP execution and W^X-bypass claims are not credited; probe 45c contradicts them."
    }
  ],
  "evidence_hashes": {
    "docs/FINDINGS.md": "4a291caf9c0057e2e57f0a2e95db0878ab888b14a4db469d82fd5ef780fd0693",
    "docs/PROBE_INDEX.md": "c5361046e9070ce85b3a27437b4f278118691b7c00aaa918c9c382fe2dccd0cd",
    "docs/STRATEGY.md": "cc4912a94fc37d594545aaf4df90ee34e4ab8e8a4014a9a0856c6de4d45e0673",
    "results/45c_execution_reality_check_20261016_192713.txt": "5515271b9128072d6296e329c8d41006650dfefe6a4a5ae0bf5a2fe9ecbb5fb6",
    "results/51b_accessible_syscall_deep_20261016_214832.txt": "dc6291a5c5e40f3bc738b9c6af0a3b8f7c416b8c6add75b9d06711c9e6f95c8a",
    "results/51b_dynlib_cluster_fuzz_20261016_230416.txt": "7e5f6df2cc98582f5a50f2efa72b691fc62ee7caedbef03756bed74071501f2a",
    "results/51c_sony_survey_part2_20261016_215838.txt": "2148c479901f42b67e67807d674102f1a7eb9160990f843d8f88be1f515620bb",
    "results/phase1_identity_layout/01_identity_20261015_184244.txt": "79cf512aaf33329f87df871c2dfac2fc3265191b539cb94ffad24b412fb61c62",
    "tools/send_probe.py": "765f07bcec4e2f841e68ac5fc4a4453c932685fbedd37c45486ede538a06148d"
  }
}