{
 "updated_at": "2026-10-17T07:48:42Z",
 "advisory": {
  "id": "ADV-3",
  "package": "@acme-sim/drill-logger",
  "versions": "2.7.0",
  "fixed": "2.7.1"
 },
 "window": "2026-10-15 11:14 to 11:26 UTC",
 "summary": {
  "CONFIRMED": 0,
  "LIKELY": 2,
  "UNDECIDED": 0,
  "POSSIBLE": 0,
  "BLOCKED": 5,
  "CLEAR": 0,
  "jobs": 7,
  "pipelines": 4
 },
 "carried_decisions": 1,
 "rows": [
  {
   "verdict": "LIKELY",
   "project": "acme-ui",
   "ref": "feat/native-thumbnails",
   "pipeline_id": 2950572440,
   "pipeline_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-ui/-/pipelines/2950572440",
   "job": "test",
   "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-ui/-/jobs/17199086405",
   "install": "npm ci --no-audit --no-fund",
   "rules": [
    "R1"
   ],
   "evidence": [
    "package-lock.json@f4ee32e5:15: @acme-sim/drill-logger@2.7.0",
    "job command: npm ci --no-audit --no-fund (npm 11)",
    "job log line 52: $ npm ci --no-audit --no-fund"
   ],
   "in_reach": [
    "CI_JOB_TOKEN"
   ],
   "decided_by": []
  },
  {
   "verdict": "LIKELY",
   "project": "acme-web",
   "ref": "main",
   "pipeline_id": 2950572871,
   "pipeline_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-web/-/pipelines/2950572871",
   "job": "build-image",
   "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-web/-/jobs/17199090292",
   "install": "docker build --platform linux/amd64 -t \"$AR_REPO/acme-web:$CI_COMMIT_SHORT_SHA\" .",
   "rules": [
    "R7"
   ],
   "evidence": [
    "Dockerfile@3b94760c:4: RUN npm ci --ignore-scripts=false --omit=dev --no-audit --no-fund",
    "package-lock.json@3b94760c:16: @acme-sim/drill-logger@2.7.0",
    "job command: docker build --platform linux/amd64 -t \"$AR_REPO/acme-web:$CI_COMMIT_SHORT_SHA\" ."
   ],
   "in_reach": [
    "CI_JOB_TOKEN",
    "GCP_ID_TOKEN"
   ],
   "decided_by": [
    "tracer"
   ]
  },
  {
   "verdict": "BLOCKED",
   "project": "acme-api",
   "ref": "main",
   "pipeline_id": 2950572653,
   "pipeline_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-api/-/pipelines/2950572653",
   "job": "test",
   "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-api/-/jobs/17199088065",
   "install": "pnpm install --ignore-scripts --frozen-lockfile",
   "rules": [
    "R2"
   ],
   "evidence": [
    "pnpm-lock.yaml@fb972839:0: @acme-sim/drill-logger@2.7.0",
    "job command: pnpm install --ignore-scripts --frozen-lockfile"
   ],
   "in_reach": [
    "CI_JOB_TOKEN"
   ],
   "decided_by": []
  },
  {
   "verdict": "BLOCKED",
   "project": "acme-ui",
   "ref": "main",
   "pipeline_id": 2950572307,
   "pipeline_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-ui/-/pipelines/2950572307",
   "job": "test",
   "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-ui/-/jobs/17199085329",
   "install": "npm ci --ignore-scripts --no-audit --no-fund",
   "rules": [
    "R2"
   ],
   "evidence": [
    "package-lock.json@d88531a7:15: @acme-sim/drill-logger@2.7.0",
    "job command: npm ci --ignore-scripts --no-audit --no-fund"
   ],
   "in_reach": [
    "CI_JOB_TOKEN"
   ],
   "decided_by": []
  },
  {
   "verdict": "BLOCKED",
   "project": "acme-ui",
   "ref": "main",
   "pipeline_id": 2950572307,
   "pipeline_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-ui/-/pipelines/2950572307",
   "job": "lint",
   "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-ui/-/jobs/17199085330",
   "install": "npm ci --ignore-scripts --no-audit --no-fund",
   "rules": [
    "R2"
   ],
   "evidence": [
    "package-lock.json@d88531a7:15: @acme-sim/drill-logger@2.7.0",
    "job command: npm ci --ignore-scripts --no-audit --no-fund"
   ],
   "in_reach": [
    "CI_JOB_TOKEN"
   ],
   "decided_by": []
  },
  {
   "verdict": "BLOCKED",
   "project": "acme-ui",
   "ref": "feat/native-thumbnails",
   "pipeline_id": 2950572440,
   "pipeline_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-ui/-/pipelines/2950572440",
   "job": "lint",
   "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-ui/-/jobs/17199086406",
   "install": "npm ci --ignore-scripts --no-audit --no-fund",
   "rules": [
    "R2"
   ],
   "evidence": [
    "package-lock.json@f4ee32e5:15: @acme-sim/drill-logger@2.7.0",
    "job command: npm ci --ignore-scripts --no-audit --no-fund"
   ],
   "in_reach": [
    "CI_JOB_TOKEN"
   ],
   "decided_by": []
  },
  {
   "verdict": "BLOCKED",
   "project": "acme-web",
   "ref": "main",
   "pipeline_id": 2950572871,
   "pipeline_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-web/-/pipelines/2950572871",
   "job": "install-test",
   "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-web/-/jobs/17199090291",
   "install": "npm ci --ignore-scripts --no-audit --no-fund",
   "rules": [
    "R2"
   ],
   "evidence": [
    "package-lock.json@3b94760c:16: @acme-sim/drill-logger@2.7.0",
    "job command: npm ci --ignore-scripts --no-audit --no-fund"
   ],
   "in_reach": [
    "CI_JOB_TOKEN"
   ],
   "decided_by": []
  }
 ],
 "timeline": [
  {
   "t": "2026-10-15T11:14:00Z",
   "who": "ci",
   "chapter": "Something goes wrong",
   "title": "A build installs the bad version",
   "text": "acme-web's image build installs drill-logger 2.7.0 with install scripts allowed, so the package's own script could run inside the build, right next to the key that deploys the app. A test branch in acme-ui does the same.",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-web/-/pipelines/2950572871",
   "link": "the build"
  },
  {
   "t": "2026-10-15T11:26:37Z",
   "who": "human",
   "chapter": "Finding out",
   "title": "The warning arrives",
   "text": "Someone pastes the drill advisory (\"malicious install script in @acme-sim/drill-logger 2.7.0\") into a private GitLab issue.",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/blob/main/docs/evidence/ADV-3.md",
   "link": "the issue"
  },
  {
   "t": "2026-10-15T11:37:55Z",
   "who": "human",
   "title": "Aftermath is asked to look",
   "text": "A person mentions Aftermath on the issue, and it starts working.",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/blob/main/docs/evidence/ADV-3.md",
   "link": "the comment"
  },
  {
   "t": "2026-10-15T11:39:05Z",
   "who": "flow",
   "title": "Checkpoint 1: what to look for",
   "text": "Aftermath proposes the package, the bad version, the projects and the time window to search. A person checks it and says yes.",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/blob/main/docs/evidence/ADV-3.md",
   "link": "the proposal",
   "approved": "2026-10-15T11:40:09Z"
  },
  {
   "t": "2026-10-15T11:40:28Z",
   "who": "agent",
   "title": "An AI agent looks inside the Docker build",
   "text": "Plain code can't see inside a Docker build, so it marks it \"can't tell\". An agent opens that day's Dockerfile and decides the script likely ran. It is only allowed to say so by quoting the line (line 4).",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/blob/main/docs/evidence/agent-decision-ADV-3.md",
   "link": "its words, verbatim"
  },
  {
   "t": "2026-10-15T11:41:05Z",
   "who": "agent",
   "title": "A second agent double-checks",
   "text": "A verifier re-reads the raw evidence. It may only make a verdict more cautious, never call a build safe. It agrees.",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/blob/main/docs/evidence/agent-decision-ADV-3.md",
   "link": "verbatim"
  },
  {
   "t": "2026-10-15T11:41:29Z",
   "who": "flow",
   "title": "The list of exposed builds",
   "text": "Every build in the window, whether the bad version was installed with scripts on, and which keys it could reach. 2 of 7 were.",
   "url": "#builds",
   "link": "see the list"
  },
  {
   "t": "2026-10-15T11:41:43Z",
   "who": "flow",
   "chapter": "Fixing it",
   "title": "Checkpoint 2: approve the fixes",
   "text": "A person approves. Ordinary, tested code (not the AI) writes the changes.",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/blob/main/docs/evidence/ADV-3.md",
   "link": "the plan",
   "approved": "2026-10-15T11:50:11Z"
  },
  {
   "t": "2026-10-15T11:50:16Z",
   "who": "flow",
   "title": "Fixes written, not applied",
   "text": "One merge request per project (the safe version, scripts off, a guard against the bad version) and a clean-up plan: rebuild acme-web, replace one key, delete one image.",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/merge_requests/6",
   "link": "the plan"
  },
  {
   "t": "2026-10-15T11:56:30Z",
   "who": "human",
   "title": "A person merges the fixes",
   "text": "Every project moves to 2.7.1, and acme-web's build turns install scripts back off.",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-web/-/merge_requests/3",
   "link": "acme-web's fix"
  },
  {
   "t": "2026-10-15T11:57:39Z",
   "who": "human",
   "title": "A person gives the go-ahead",
   "text": "Aftermath can't merge its own plan. A person merging it is the approval for the clean-up.",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/merge_requests/6",
   "link": "the merge"
  },
  {
   "t": "2026-10-15T11:57:41Z",
   "who": "ci",
   "title": "The clean-up runs",
   "text": "It checks who wrote and who approved the plan and that nobody has pulled the emergency stop, rebuilds the app from clean code, replaces the key and tests that the old one is now refused, then deletes the tainted image. Done in 4 min 24 s.",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/pipelines/2950721416",
   "link": "the pipeline"
  },
  {
   "t": "2026-10-15T11:50:18Z",
   "who": "flow",
   "chapter": "Proving it",
   "title": "Checkpoint 3: the receipts",
   "text": "Aftermath checks the receipts from that exact clean-up run and posts the evidence. A person approves.",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/blob/main/docs/evidence/ADV-3.md",
   "link": "the evidence",
   "approved": "2026-10-15T12:04:01Z"
  },
  {
   "t": "2026-10-15T12:04:45Z",
   "who": "human",
   "title": "A person closes the case",
   "text": "Aftermath isn't allowed to close incidents. A person does, with the evidence in front of them.",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/blob/main/docs/evidence/ADV-3.md",
   "link": "the record"
  }
 ],
 "merge_requests": [
  {
   "project": "acme-web",
   "iid": 3,
   "title": "Pin @acme-sim/drill-logger to 2.7.1 and turn install scripts off (ADV-3)",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-web/-/merge_requests/3",
   "merged_at": "2026-10-15T11:56:30.294Z"
  },
  {
   "project": "acme-ui",
   "iid": 4,
   "title": "Pin @acme-sim/drill-logger to 2.7.1 and turn install scripts off (ADV-3)",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-ui/-/merge_requests/4",
   "merged_at": "2026-10-15T11:57:02.102Z"
  },
  {
   "project": "acme-api",
   "iid": 3,
   "title": "Pin @acme-sim/drill-logger to 2.7.1 and turn install scripts off (ADV-3)",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/acme-api/-/merge_requests/3",
   "merged_at": "2026-10-15T11:57:06.124Z"
  },
  {
   "project": "aftermath",
   "iid": 6,
   "title": "Respond to ADV-3: rebuild, rotate and yank exactly what was exposed",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/merge_requests/6",
   "merged_at": "2026-10-15T11:57:39.011Z"
  }
 ],
 "response": {
  "pipeline_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/pipelines/2950721416",
  "duration_s": 264,
  "green": true,
  "jobs": {
   "rotate": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/jobs/17200263789",
   "yank": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/jobs/17200263790",
   "sod": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/jobs/17200263784",
   "killswitch": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/jobs/17200263785",
   "rebuild": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/jobs/17200263787",
   "deploy": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/jobs/17200263788"
  },
  "receipts_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/jobs/17200263791",
  "sod": {
   "opened_by": "ai-aftermath-trace-gitlab-ai-hackathon",
   "merged_by": "a person",
   "pass": true
  },
  "killswitch": {
   "file": "absent",
   "flag": "on",
   "armed": true
  },
  "rotation": {
   "secret": "acme-web-api-key",
   "old_version": "3",
   "new_version": "4",
   "new_probe": 200,
   "old_probe": 401,
   "old_state": "DISABLED"
  },
  "yanks": [
   {
    "digest": "sha256:8ae6b10b87c57031af0ed205beb5bfdb908eed277670fb3c94dc411e2f944e57",
    "result": "deleted"
   }
  ],
  "serving": [
   "sha256:927f9275b2da8f870f1da4868f7f88c53cb7f25c8935a6a17cee1c1e976ca6ba"
  ],
  "rebuild": {
   "digest": "sha256:927f9275b2da8f870f1da4868f7f88c53cb7f25c8935a6a17cee1c1e976ca6ba",
   "source_sha": "f73f1fb5"
  }
 },
 "evidence_note_at": "2026-10-15T12:04:09Z",
 "failed_run": {
  "session": 9527711,
  "what": "The first time this incident ran, Aftermath misread one setting: `npm ci --ignore-scripts=false` means scripts ON, and it read it as OFF. So it concluded nothing had run, and planned no clean-up at all.",
  "caught": "A person saw the empty plan at checkpoint 3, rejected it, and explained why on the issue.",
  "rejected_at": "2026-10-15T11:37:35Z",
  "fix_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/commit/307be22",
  "fix": "307be22: the last flag wins; pinpatch rewrites a scripts-on flag; two new tests"
 },
 "verify": [
  {
   "label": "Watch the old key get refused: the clean-up job's own log (new key 200, old key 401)",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/jobs/17200263789"
  },
  {
   "label": "Read the AI agent's decision, word for word from its session",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/blob/main/docs/evidence/agent-decision-ADV-3.md"
  },
  {
   "label": "The full incident record, including the run that went wrong",
   "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43287016/aftermath/-/blob/main/docs/evidence/ADV-3.md"
  }
 ]
}