{
  "run_id": "KrasForge--unk-deaddrop-companion-claude-haiku-5-5-1793151561362691964",
  "checker": {
    "claims": [
      {
        "claim": "Python CLI reports a clipboard-write lead for a suspect JavaScript file",
        "command": "<guest-path> -m unk_scanner <guest-path>",
        "evidence": "\u2026clipboard-write\",\n      \"line\": 1,\n      \"column\": 1,\n      \"detail\": \"training example\"\n    }\n  ],\n  \"limitations\": [\n    \"Syntactic matches only; no data-flow or reachability proof\",\n    \"No general alias resolution or encoded string-table deobfuscation\",\n    \"Encrypted-loader recognition covers only a specific top-level const-binding pattern\",\n    \"A clipboard write or marker alone is not a maliciousness verdict\"\n  ]\n}\n",
        "expected": "JSON findings include kind clipboard-write",
        "input": "<guest-path> containing navigator.clipboard.writeText(\"training example\");",
        "kind": "claim",
        "outcome": "Real input produced the expected result: clipboard-write",
        "returncode": 0,
        "source": "python -m unk_scanner suspect.js > findings.json",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      },
      {
        "claim": "npm/Node CLI scans a held source file and writes analysis JSON",
        "command": "node src/inspect-js.mjs <guest-path>",
        "evidence": "\u2026clipboard-write\",\n      \"line\": 1,\n      \"column\": 1,\n      \"detail\": \"training example\"\n    }\n  ],\n  \"limitations\": [\n    \"Syntactic matches only; no data-flow or reachability proof\",\n    \"No general alias resolution or encoded string-table deobfuscation\",\n    \"Encrypted-loader recognition covers only a specific top-level const-binding pattern\",\n    \"A clipboard write or marker alone is not a maliciousness verdict\"\n  ]\n}\n",
        "expected": "JSON findings include kind clipboard-write",
        "input": "<guest-path>",
        "kind": "claim",
        "outcome": "Real input produced the expected result: clipboard-write",
        "returncode": 0,
        "source": "node src/inspect-js.mjs /path/to/held/source.js > analysis-output.json",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      }
    ],
    "cycle_checks": [
      {
        "claim": "Scheduled or looping main behavior",
        "command": "",
        "evidence": "Entry points inspected (src/inspect-js.mjs, unk_scanner CLI, tools/replay_yara.py, scripts/). The scanner is a one-shot static CLI/API with no cron, scheduler, loop, webhook, --once or --now; .github/workflows/validate.yml is CI only. No product cycle.",
        "expected": "identify the product trigger",
        "input": "source inspection",
        "kind": "cycle",
        "outcome": "Entry points inspected (src/inspect-js.mjs, unk_scanner CLI, tools/replay_yara.py, scripts/). The scanner is a one-shot static CLI/API with no cron, scheduler, loop, webhook, --once or --now; .github/workflows/validate.yml is CI only. No product cycle.",
        "source": "repository entry points",
        "verdict": "yes"
      }
    ],
    "details": {
      "argv": [
        "<guest-path>",
        "-m",
        "unk_scanner",
        "<guest-path>"
      ],
      "kind": "cli",
      "needs_browser": false,
      "needs_credentials": false,
      "returncode": 0,
      "scope": "product operation",
      "stderr": "",
      "stdout": "{\n  \"schemaVersion\": 1,\n  \"sha256\": \"12df5620685192d8654830402dea5fc7f5ae23432ee95f9f79f78ae3a3e51522\",\n  \"artifactMatches\": [],\n  \"bytes\": 51,\n  \"findings\": [\n    {\n      \"kind\": \"clipboard-write\",\n      \"line\": 1,\n      \"column\": 1,\n      \"detail\": \"training example\"\n    }\n[excerpt truncated]",
      "working": true
    },
    "evidence_strength": "readme_checked",
    "example_checks": [
      {
        "claim": "Node test suite runs",
        "command": "npm test",
        "deferred": false,
        "evidence": "compilation alone and disconnected data do not match\n  ---\n  duration_ms: 8.99355\n  type: 'test'\n  ...\n# Subtest: nested functions and out-of-order authentication are not linked\nok 23 - nested functions and out-of-order authentication are not linked\n  ---\n  duration_ms: 1.006252\n  type: 'test'\n  ...\n# Subtest: comments and quoted source are not parsed as loader behavior\nok 24 - comments and quoted source are not parsed as loader behavior\n  ---\n  duration_ms: 0.374558\n  type: 'test'\n  ...\n1..24\n# tests 24\n# suites 0\n# pass 24\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 5058.980516",
        "expected": "24 Node tests pass",
        "input": "npm test",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md ## Use the scanner",
        "verdict": "yes"
      },
      {
        "claim": "Detection-content unit tests run in the README venv",
        "command": "<guest-path> -m unittest discover -s tests",
        "deferred": false,
        "evidence": "......\n----------------------------------------------------------------------\nRan 6 tests in 0.093s\n\nOK",
        "expected": "6 tests pass",
        "input": "python -m unittest discover -s tests -v",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md ## Review the detection content",
        "verdict": "yes"
      },
      {
        "claim": "YARA replay reports aggregate counts over selected files",
        "command": "<guest-path> tools/replay_yara.py --root <guest-path> <guest-path>",
        "deferred": false,
        "evidence": "{\n  \"bytes_scanned\": 51,\n  \"files\": 1,\n  \"matches_by_rule\": {},\n  \"objects\": 1,\n  \"objects_with_matches\": 0,\n  \"rules\": 28,\n  \"skipped\": [],\n  \"skipped_counts\": {}\n}",
        "expected": "JSON counts with 28 rules",
        "input": "sample JS file (no retained case directory shipped in repo)",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md ## Review the detection content",
        "verdict": "yes"
      }
    ],
    "status": "PASS"
  },
  "diagnosis": null
}