{
  "schema_version": 1,
  "fixture_id": "northstar-sanitized-memory-observations-001",
  "classification": "synthetic-derived-observations",
  "source_note": "Instructor-authored observations; no memory image is distributed",
  "collection_time": "2026-08-25T09:16:00Z",
  "host": "devbox-17.example",
  "platform": "fictional-course-os-1",
  "tool_version": "course-observer-1.0",
  "sanitization": {
    "real_accounts_present": false,
    "credentials_present": false,
    "personal_data_present": false,
    "raw_memory_present": false,
    "network_identifiers": "TEST-NET and reserved names only"
  },
  "process_views": [
    {
      "process_id": 4000,
      "process_name": "approved-course-runner",
      "parent_process_id": 1,
      "start_time": "2026-08-25T08:59:58Z",
      "view": "active-process-list",
      "source_consistency": "present-in-both-course-views"
    },
    {
      "process_id": 4100,
      "process_name": "benign-telemetry-demo",
      "parent_process_id": 4000,
      "start_time": "2026-08-25T09:00:01Z",
      "view": "active-process-list",
      "source_consistency": "present-in-both-course-views"
    },
    {
      "process_id": 4101,
      "process_name": "node-version-child",
      "parent_process_id": 4100,
      "start_time": "2026-08-25T09:00:05Z",
      "view": "terminated-process-scan",
      "source_consistency": "absent-from-active-list-after-normal-exit"
    }
  ],
  "mapped_regions": [
    {
      "process_id": 4100,
      "region_id": "region-course-001",
      "permission_category": "read-only-data",
      "file_backing": "benign-telemetry-demo-source",
      "executable": false,
      "analyst_note": "Expected source-visible course data"
    },
    {
      "process_id": 4000,
      "region_id": "region-course-002",
      "permission_category": "runtime-generated-code",
      "file_backing": null,
      "executable": true,
      "analyst_note": "Known fictional runtime behavior; validate with provenance before forming an injection hypothesis"
    }
  ],
  "handles": [
    { "process_id": 4100, "object_category": "course-marker", "object_name": "marker-alpha.txt", "access_category": "write-created-file" },
    { "process_id": 4100, "object_category": "course-marker", "object_name": "marker-beta.txt", "access_category": "write-created-file" }
  ],
  "sockets": [
    {
      "process_id": 4100,
      "local_ip": "192.0.2.17",
      "remote_ip": "198.51.100.42",
      "remote_host": "updates.northstar.invalid",
      "state": "synthetic-record-only",
      "analyst_note": "This is a fabricated correlation exercise; the benign demo opens no socket"
    }
  ],
  "integrity_observations": [
    { "observation_id": "integrity-001", "category": "boot-measurement", "result": "course-baseline-match" },
    { "observation_id": "integrity-002", "category": "sensor-health", "result": "one-synthetic-gap-between-09-00-03-and-09-00-04" }
  ],
  "questions": [
    "Which observations are direct facts and which are tool interpretations?",
    "What benign explanation fits the terminated child appearing in only one process view?",
    "Which independent source would validate the synthetic socket ownership record?"
  ]
}