{
  "generated_at": "2026-05-16T11:48:31+00:00",
  "agent": "Tracelock Evidence Ladder",
  "version": "1.1.0",
  "mode": "read_only_defensive",
  "summary": {
    "total_cases": 4,
    "perfect_score_cases": 4,
    "mean_precision": 1.0,
    "mean_recall": 1.0,
    "all_perfect": true
  },
  "cases": [
    {
      "case_id": "ir-c2-004",
      "case_file": "c2_beacon_case.json",
      "precision": 1.0,
      "recall": 1.0,
      "truth_items": [
        "c2_beacon"
      ],
      "confirmed_items": [
        "c2_beacon"
      ],
      "false_positives": [],
      "missed": [],
      "findings_count": 1,
      "log_steps": 3
    },
    {
      "case_id": "demo-ir-001",
      "case_file": "demo_case.json",
      "precision": 1.0,
      "recall": 1.0,
      "truth_items": [
        "password_spray",
        "persistence_task_created",
        "suspicious_archive_staged",
        "vpn_success_after_spray"
      ],
      "confirmed_items": [
        "password_spray",
        "persistence_task_created",
        "suspicious_archive_staged",
        "vpn_success_after_spray"
      ],
      "false_positives": [],
      "missed": [],
      "findings_count": 4,
      "log_steps": 3
    },
    {
      "case_id": "ir-exfil-003",
      "case_file": "exfil_case.json",
      "precision": 1.0,
      "recall": 1.0,
      "truth_items": [
        "suspicious_archive_staged"
      ],
      "confirmed_items": [
        "suspicious_archive_staged"
      ],
      "false_positives": [],
      "missed": [],
      "findings_count": 2,
      "log_steps": 3
    },
    {
      "case_id": "ir-lateral-002",
      "case_file": "lateral_movement_case.json",
      "precision": 1.0,
      "recall": 1.0,
      "truth_items": [
        "lateral_movement",
        "password_spray",
        "persistence_service",
        "suspicious_archive_staged",
        "vpn_success_after_spray"
      ],
      "confirmed_items": [
        "lateral_movement",
        "password_spray",
        "persistence_service",
        "suspicious_archive_staged",
        "vpn_success_after_spray"
      ],
      "false_positives": [],
      "missed": [],
      "findings_count": 5,
      "log_steps": 3
    }
  ]
}