{
  "native_capture": {
    "schema": "1200km.lab.capture.v1",
    "target": "127.0.0.1",
    "ports": "18080-18111",
    "started_epoch": 1790583559.9698563,
    "ended_epoch": 1790583563.5072062,
    "command": [
      "/usr/bin/nmap",
      "-sT",
      "-Pn",
      "-n",
      "-p",
      "18080-18111",
      "--scan-delay",
      "100ms",
      "--max-retries",
      "0",
      "--host-timeout",
      "10s",
      "127.0.0.1"
    ],
    "nmap_version": "Nmap version 7.94SVN ( https://nmap.org )",
    "collector": "Python socket accept listener",
    "synthetic": false,
    "observed_ports": 32,
    "scope": "Open TCP port fan-out on loopback only. Not packet/Zeek capture, external perimeter validation, or full T1595 coverage.",
    "files": {
      "accept.jsonl": "491f5e6b091c795a3f3165c65c452b27ad19d92209eff72daa3d743ce5d614fe",
      "nmap.txt": "8b352a2c1a6bf8de21971ca08d0cf3ce87ad257dc7b8aa259a83d91a74c2113f"
    }
  },
  "detector": {
    "status": "observed",
    "windows": [
      {
        "source": "127.0.0.1",
        "window_start": 1790583540,
        "distinct_ports": 32,
        "distinct_hosts": 1,
        "connections": 32,
        "approved": false,
        "threshold_match": true
      }
    ]
  },
  "matched_windows": 1,
  "anomaly": [
    {
      "source": "127.0.0.1",
      "window_start": 1790583540,
      "distinct_ports": 32,
      "distinct_hosts": 1,
      "connections": 32,
      "approved": false,
      "threshold_match": true,
      "score": {
        "status": "scored",
        "median": 2,
        "mad": 1,
        "score": 20.2346925,
        "anomalous": true,
        "boundary": "Illustrative lab threshold; not a calibrated production model."
      }
    }
  ],
  "baseline": "Explicitly synthetic 30-window toy baseline, NOT a captured or production-trained baseline.",
  "boundary": "Observed loopback open-port fan-out only; thresholds and anomaly calibration are educational, not production validation."
}