{
  "id": "investigation-summary:9e228f2a-4391-46bf-98a8-95be922c970f",
  "type": "pcap-investigation-summary",
  "label": "PCAP investigation summary",
  "model": "gpt-4.1-2025-04-14",
  "stale": false,
  "status": "analyst-review-required",
  "content": "# PCAP investigation summary\n\n## What happened\n\nThe host 10.0.90.215 \\(Bobby-Tiger-PC\\) downloaded two executable files via HTTP from external servers 209.141.34.8 and 217.23.14.81, with SHA-256 hashes 2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85 and 5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf respectively.\n\nThese downloads correspond to transfers of potential PE \\(Portable Executable\\) files named test1.exe and f4.exe, suggesting a candidate for ingress tool transfer \\(ATT&CK T1105\\), but there is no evidence establishing whether the files were executed, nor proof of malicious purpose or system compromise during the capture.\n\n## Who was involved\n\n- The main device involved is Bobby-Tiger-PC \\(10.0.90.215\\), with observed Windows accounts bobby-tiger-pc$ and bobby.tiger.\n\n## Supported technique candidates\n\n- Ingress Tool Transfer is a candidate technique due to observed executable downloads \\(ATT&CK T1105\\), but adversary presence is not confirmed.\n\n## What remains uncertain\n\n- It remains unknown whether either of the downloaded executables were launched or if any further action was taken on the host.\n\n## Next check\n\n- Check endpoint telemetry on 10.0.90.215 to determine if the files 2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85 and 5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf were executed or triggered further activity.\n\nAnalyst-review draft. Exact evidence references and provider provenance are retained in the structured record.",
  "summary": "The host 10.0.90.215 (Bobby-Tiger-PC) downloaded two executable files via HTTP from external servers 209.141.34.8 and 217.23.14.81, with SHA-256 hashes 2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85 and 5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf respectively. These downloads correspond to transfers of potential PE (Portable Executable) files named test1.exe and f4.exe, suggesting a candidate for ingress tool transfer (ATT&CK T1105), but there is no evidence establishing whether the files were executed, nor proof of malicious purpose or system compromise during the capture.",
  "coverage": {
    "warnings": [],
    "projection": "pcap-brief-evidence-v1",
    "source_digest": "9a1a4d3498dd5afb35f8698f4b731d20e3366895114aea266e43304aad3d1bba",
    "candidate_total": 0,
    "omitted_records": {
      "findings": 0,
      "artifacts": 2,
      "candidates": 0,
      "identities": 0,
      "techniques": 0,
      "selected_network_events": 0
    },
    "included_records": {
      "limits": 1,
      "capture": 1,
      "findings": 7,
      "transfers": 2,
      "identities": 3,
      "techniques": 1,
      "reputation_coverage": 1
    },
    "supplement_scope": "Bounded selected packet metadata, direct reputation, identities and transfer relationships; no payload bodies, prior-case content or exhaustive inventory. Full data remains in source analysis.",
    "source_characters": 6321,
    "enrichment_retained_targets": 16
  },
  "filename": "2019-03-19-traffic-analysis-exercise.pcap",
  "provider": "openai",
  "report_id": "pcap:bd9602ed-341a-4123-aae3-9fafa5731518",
  "created_at": "2026-09-22T19:07:06.749100+00:00",
  "structured": {
    "iocs": [],
    "ttps": [
      {
        "text": "Ingress Tool Transfer is a candidate technique due to observed executable downloads (ATT&CK T1105), but adversary presence is not confirmed.",
        "basis": "assessment",
        "status": "behavior_candidate",
        "evidence": [
          {
            "end": 186,
            "quote": "{\"attack_id\":\"T1105\",\"frames\":[1523,1553,1713],\"name\":\"Ingress Tool Transfer\",\"status\":\"Heuristic technique candidate, not established adversary activity\",\"tactic\":\"command-and-control\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#technique/T1105",
            "source_id": "S0016",
            "source_sha256": "81c9ab7ff199abe558c9acba6c6da47a8f824671aa4b1ac6721ba1efb6e4324d"
          },
          {
            "end": 364,
            "quote": "{\"client_ip\":\"10.0.90.215\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":754,\"response_frame\":1523,\"server_ip\":\"209.141.34.8\",\"sha256\":\"2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85\",\"url_without_query_or_fragment\":\"http://209.141.34.8/test1.exe\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#artifact/artifact-0a0a4527e8ee1e79f9cdb1d2",
            "source_id": "S0004",
            "source_sha256": "057e0dd9b19425ee0f73603e3e0c7f62374ce8d180fef7d3e14fd62184e3d927"
          },
          {
            "end": 362,
            "quote": "{\"client_ip\":\"10.0.90.215\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1553,\"response_frame\":1713,\"server_ip\":\"217.23.14.81\",\"sha256\":\"5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf\",\"url_without_query_or_fragment\":\"http://217.23.14.81/f4.exe\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#artifact/artifact-ac09c3d76fae46bbebbe3b10",
            "source_id": "S0005",
            "source_sha256": "218655cc92584ee6af409509663adc44c3836836b5ea14c3bfa098cda5f50ba4"
          }
        ],
        "attack_id": "T1105"
      }
    ],
    "identities": [
      {
        "kind": "ip",
        "text": "The main device involved is Bobby-Tiger-PC (10.0.90.215), with observed Windows accounts bobby-tiger-pc$ and bobby.tiger.",
        "basis": "observed",
        "value": "10.0.90.215",
        "evidence": [
          {
            "end": 328,
            "quote": "{\"bindings\":[{\"account\":\"\",\"frame_number\":51,\"owner_ip\":\"10.0.90.215\",\"relationship\":\"kerberos-client-principal\"},{\"account\":\"\",\"frame_number\":59,\"owner_ip\":\"10.0.90.215\",\"relationship\":\"kerberos-client-principal\"}],\"ip_addresses\":[\"10.0.90.215\"],\"mac_addresses\":[\"64:32:a8:57:2b:42\"],\"type\":\"account\",\"value\":\"bobby-tiger-pc$\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#identity/identity-7f15c55aaa7b4dae55509316",
            "source_id": "S0006",
            "source_sha256": "d7ba9afc9e21a329613ac0589d38025fc3743feaeacdb2b7c00d53545e9fba1d"
          },
          {
            "end": 326,
            "quote": "{\"bindings\":[{\"account\":\"\",\"frame_number\":524,\"owner_ip\":\"10.0.90.215\",\"relationship\":\"kerberos-client-principal\"},{\"account\":\"\",\"frame_number\":532,\"owner_ip\":\"10.0.90.215\",\"relationship\":\"kerberos-client-principal\"}],\"ip_addresses\":[\"10.0.90.215\"],\"mac_addresses\":[\"64:32:a8:57:2b:42\"],\"type\":\"account\",\"value\":\"bobby.tiger\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#identity/identity-53c02616b1b7ab4c7ed2ee14",
            "source_id": "S0007",
            "source_sha256": "28d1f44fe3ee09d5b806f6c7a24b9c0e374a2897d42010955bf2954e9e91ad5d"
          },
          {
            "end": 352,
            "quote": "{\"bindings\":[{\"account\":\"\",\"frame_number\":384,\"owner_ip\":\"0.0.0.0\",\"relationship\":\"dhcp-client-assertion\"},{\"account\":\"\",\"frame_number\":749,\"owner_ip\":\"0.0.0.0\",\"relationship\":\"dhcp-client-assertion\"}],\"ip_addresses\":[\"10.0.90.215\"],\"mac_addresses\":[\"64:32:a8:57:2b:42\",\"64:32:a8:57:2b:42,64:32:a8:57:2b:42\"],\"type\":\"hostname\",\"value\":\"Bobby-Tiger-PC\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#identity/identity-44bb048d33715df6c60da072",
            "source_id": "S0008",
            "source_sha256": "8cce4842924b42ba0ca63a6cb3f031057f64afcef5d84b65b26eb580e89730d7"
          }
        ]
      }
    ],
    "next_steps": [
      {
        "text": "Check endpoint telemetry on 10.0.90.215 to determine if the files 2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85 and 5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf were executed or triggered further activity.",
        "basis": "assessment",
        "evidence": [
          {
            "end": 364,
            "quote": "{\"client_ip\":\"10.0.90.215\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":754,\"response_frame\":1523,\"server_ip\":\"209.141.34.8\",\"sha256\":\"2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85\",\"url_without_query_or_fragment\":\"http://209.141.34.8/test1.exe\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#artifact/artifact-0a0a4527e8ee1e79f9cdb1d2",
            "source_id": "S0004",
            "source_sha256": "057e0dd9b19425ee0f73603e3e0c7f62374ce8d180fef7d3e14fd62184e3d927"
          },
          {
            "end": 362,
            "quote": "{\"client_ip\":\"10.0.90.215\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1553,\"response_frame\":1713,\"server_ip\":\"217.23.14.81\",\"sha256\":\"5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf\",\"url_without_query_or_fragment\":\"http://217.23.14.81/f4.exe\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#artifact/artifact-ac09c3d76fae46bbebbe3b10",
            "source_id": "S0005",
            "source_sha256": "218655cc92584ee6af409509663adc44c3836836b5ea14c3bfa098cda5f50ba4"
          }
        ]
      }
    ],
    "uncertainties": [
      {
        "text": "It remains unknown whether either of the downloaded executables were launched or if any further action was taken on the host.",
        "basis": "assessment",
        "evidence": [
          {
            "end": 397,
            "quote": "{\"internal_lookup\":{\"matched_observables\":0,\"no_exact_match\":48,\"observable_limit\":5000,\"observables_checked\":48,\"observables_total\":48,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false},\"visibility\":\"Encrypted application payloads are not decrypted. No endpoint execution, persistence or actor attribution is established by a download or connection alone.\",\"warnings\":[]}",
            "start": 0,
            "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#coverage",
            "source_id": "S0002",
            "source_sha256": "5b2023868cb7b26c0132422b73b2664465693e2239a1924d17612a36d2d082c8"
          }
        ]
      }
    ],
    "what_happened": [
      {
        "text": "The host 10.0.90.215 (Bobby-Tiger-PC) downloaded two executable files via HTTP from external servers 209.141.34.8 and 217.23.14.81, with SHA-256 hashes 2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85 and 5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf respectively.",
        "basis": "observed",
        "evidence": [
          {
            "end": 364,
            "quote": "{\"client_ip\":\"10.0.90.215\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":754,\"response_frame\":1523,\"server_ip\":\"209.141.34.8\",\"sha256\":\"2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85\",\"url_without_query_or_fragment\":\"http://209.141.34.8/test1.exe\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#artifact/artifact-0a0a4527e8ee1e79f9cdb1d2",
            "source_id": "S0004",
            "source_sha256": "057e0dd9b19425ee0f73603e3e0c7f62374ce8d180fef7d3e14fd62184e3d927"
          },
          {
            "end": 362,
            "quote": "{\"client_ip\":\"10.0.90.215\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1553,\"response_frame\":1713,\"server_ip\":\"217.23.14.81\",\"sha256\":\"5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf\",\"url_without_query_or_fragment\":\"http://217.23.14.81/f4.exe\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#artifact/artifact-ac09c3d76fae46bbebbe3b10",
            "source_id": "S0005",
            "source_sha256": "218655cc92584ee6af409509663adc44c3836836b5ea14c3bfa098cda5f50ba4"
          }
        ]
      },
      {
        "text": "These downloads correspond to transfers of potential PE (Portable Executable) files named test1.exe and f4.exe, suggesting a candidate for ingress tool transfer (ATT&CK T1105), but there is no evidence establishing whether the files were executed, nor proof of malicious purpose or system compromise during the capture.",
        "basis": "assessment",
        "evidence": [
          {
            "end": 472,
            "quote": "{\"explanation\":\"HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\",\"frames\":[754,1523],\"metrics\":{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":811520,\"destination\":\"10.0.90.215\",\"response_count\":1,\"source\":\"209.141.34.8\",\"uri\":\"/test1.exe\"},\"rule_id\":\"script-or-executable-transfer\",\"title\":\"Script, archive, or executable",
            "start": 0,
            "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#finding/finding-bb2975e364354c73399c85c6",
            "source_id": "S0014",
            "source_sha256": "4f8f36bb97db465b6bf4898c4ffedffdb43bd64d8bddb149fe70d07fb956c371"
          },
          {
            "end": 479,
            "quote": "{\"explanation\":\"HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\",\"frames\":[1553,1713],\"metrics\":{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":176128,\"destination\":\"10.0.90.215\",\"response_count\":1,\"source\":\"217.23.14.81\",\"uri\":\"/f4.exe\"},\"rule_id\":\"script-or-executable-transfer\",\"title\":\"Script, archive, or executable transfer",
            "start": 0,
            "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#finding/finding-c205c2d47a5f745257bd49d6",
            "source_id": "S0015",
            "source_sha256": "b096513044ac382a2d9ab3dab5b5ed2ba7607994758ae2f73e017244aad8feb1"
          },
          {
            "end": 186,
            "quote": "{\"attack_id\":\"T1105\",\"frames\":[1523,1553,1713],\"name\":\"Ingress Tool Transfer\",\"status\":\"Heuristic technique candidate, not established adversary activity\",\"tactic\":\"command-and-control\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#technique/T1105",
            "source_id": "S0016",
            "source_sha256": "81c9ab7ff199abe558c9acba6c6da47a8f824671aa4b1ac6721ba1efb6e4324d"
          }
        ]
      }
    ]
  },
  "validation": "schema-and-exact-quote-binding; not semantic proof",
  "word_count": 143,
  "analysis_id": "bd9602ed-341a-4123-aae3-9fafa5731518",
  "token_usage": {
    "total_tokens": 6239,
    "prompt_tokens": 5591,
    "completion_tokens": 648
  },
  "authoritative": false,
  "effective_tlp": "TLP:CLEAR",
  "source_sha256": "696f94d14ca75007f111ceb0db88203c166e8e063fabc3f0bf4b6135ec9f2683",
  "capture_sha256": "257ba51a573232f7c2a8b43b55e127e793abe0bf067bd55f40dbee398fde6520",
  "prompt_version": "pcap-investigation-summary-v5",
  "requested_model": "gpt-4.1",
  "source_manifest": [
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "5e7af07119abf7b839672f7244abd2b28b057abc7bef716486ca5277c0112586",
      "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#capture",
      "source_id": "S0001"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "5b2023868cb7b26c0132422b73b2664465693e2239a1924d17612a36d2d082c8",
      "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#coverage",
      "source_id": "S0002"
    },
    {
      "kind": "intelligence_lead",
      "offset": 0,
      "sha256": "d8e89b32b8c1c23cbd08adf8b0cc31b389aebda97ee0f7e872bdf4937f1ba3b2",
      "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#enrichment-coverage",
      "source_id": "S0003"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "057e0dd9b19425ee0f73603e3e0c7f62374ce8d180fef7d3e14fd62184e3d927",
      "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#artifact/artifact-0a0a4527e8ee1e79f9cdb1d2",
      "source_id": "S0004"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "218655cc92584ee6af409509663adc44c3836836b5ea14c3bfa098cda5f50ba4",
      "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#artifact/artifact-ac09c3d76fae46bbebbe3b10",
      "source_id": "S0005"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "d7ba9afc9e21a329613ac0589d38025fc3743feaeacdb2b7c00d53545e9fba1d",
      "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#identity/identity-7f15c55aaa7b4dae55509316",
      "source_id": "S0006"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "28d1f44fe3ee09d5b806f6c7a24b9c0e374a2897d42010955bf2954e9e91ad5d",
      "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#identity/identity-53c02616b1b7ab4c7ed2ee14",
      "source_id": "S0007"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "8cce4842924b42ba0ca63a6cb3f031057f64afcef5d84b65b26eb580e89730d7",
      "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#identity/identity-44bb048d33715df6c60da072",
      "source_id": "S0008"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "6c865a002649a5c886dc5544aa3744b28a7ba3311439913d230fe1cdc94ec305",
      "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#finding/finding-9181c2380707d2d0c00c13c3",
      "source_id": "S0009"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "0250236cbdaa1947a99bf2c31eb107d2b995408f69dce96d26980857f866a099",
      "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#finding/finding-5d6cd53c5a16d13e00a5b5ed",
      "source_id": "S0010"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "1cfdd7914d65e5378a9e6b1e2586186dfd4a30b4c2922ccdc809e5096998a6c1",
      "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#finding/finding-8e765d03c4fb3a618220f69b",
      "source_id": "S0011"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "cf6701c44c99a3429e0ba10104721d3821841e0239f20f3fd02bae4a2bf3043b",
      "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#finding/finding-996d06a530124645b869ae41",
      "source_id": "S0012"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "597501acb7396aa9afb31625f3a6a961c9a6bfe80bde73b64d53c0ad8b6c260a",
      "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#finding/finding-9a92d80bd96fe252c458b732",
      "source_id": "S0013"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "4f8f36bb97db465b6bf4898c4ffedffdb43bd64d8bddb149fe70d07fb956c371",
      "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#finding/finding-bb2975e364354c73399c85c6",
      "source_id": "S0014"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "b096513044ac382a2d9ab3dab5b5ed2ba7607994758ae2f73e017244aad8feb1",
      "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#finding/finding-c205c2d47a5f745257bd49d6",
      "source_id": "S0015"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "81c9ab7ff199abe558c9acba6c6da47a8f824671aa4b1ac6721ba1efb6e4324d",
      "reference": "/api/pcap/analyses/bd9602ed-341a-4123-aae3-9fafa5731518#technique/T1105",
      "source_id": "S0016"
    }
  ],
  "token_usage_note": "Provider-reported counts when available; never estimated from character length.",
  "generation_seconds": 4.937,
  "generation_attempts": [
    {
      "attempt": 1,
      "validation": "passed",
      "token_usage": {
        "total_tokens": 6239,
        "prompt_tokens": 5591,
        "completion_tokens": 648,
        "prompt_tokens_details": {
          "audio_tokens": 0,
          "cached_tokens": 0
        },
        "completion_tokens_details": {
          "audio_tokens": 0,
          "reasoning_tokens": 0,
          "accepted_prediction_tokens": 0,
          "rejected_prediction_tokens": 0
        }
      },
      "finish_reason": "stop",
      "provider_returned_model": "gpt-4.1-2025-04-14"
    }
  ],
  "validation_adjustments": [],
  "provider_returned_model": "gpt-4.1-2025-04-14"
}