Particle-Academy/fancy-template

No problems traced to this repository code in these checks. 3 static matches retained as context.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

3 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The three legs pass the same 203 conformance rows: Real input produced the expected result: 203/203 = 100.0%

  Source: The three legs pass the same 203 `template/*` conformance rows

  Input: php php/tests/parity.php (all template/* rows, byte-for-byte across PHP, TypeScript, Python)

  Expected: 203/203 rows match on each leg

  Command: php php/tests/parity.php

  Observed: 203/203 = 100.0% node=exp 203/203 = 100.0% py=exp 203/203 = 100.0% 3 legs equal 211/211 = 100.0% rendered corpus documents: /tmp/fancy-template-parity-11795/rendered

• Three legs produce byte-identical output: Real input produced the expected result: 3 legs equal

  Source: produce byte-identical output on every row and on

  Input: php php/tests/parity.php

  Expected: all three legs equal

  Command: php php/tests/parity.php

  Observed: 3 legs equal template/tokenize 32 32/32 32/32 32/32 32/32 template/resolve 29 29/29 29/29 29/29 29/29 template/filters 37 37/37 37/37 37/37 37/37 template/directives 24 24/24 24/24 24/24 24/24 template/limits 29 29/29 29/29 29/29 29/29 template/profiles 27 27/27 27/27 27/27 27/27 template/inspect 25 25/25 25/25 25/25 25/25 corpus/certif

• Realistic example templates render identically across legs: Real input produced the expected result: 211/211 = 100.0%

  Source: the realistic templates in `examples/` (`php php/tests/parity.php`).

  Input: php php/tests/parity.php (includes corpus certificate, invoice, deck, report)

  Expected: 211/211 rows equal across the three legs

  Command: php php/tests/parity.php

  Observed: 211/211 = 100.0% rendered corpus documents: /tmp/fancy-template-parity-11813/rendered

Examples

• Python leg suite passes (documented offline tests): command completed successfully

  Source: AGENTS.md Testing: cd python && python -m pytest -q

  Input: python -m pytest -q

  Expected: 261 passed

  Command: <guest-path> -m pytest -q

  Observed: ipped . template/limits [python] -- fancy-conformance 0.36.0 29 passed, 0 failed, 0 skipped . template/profiles [python] -- fancy-conformance 0.36.0 27 passed, 0 failed, 0 skipped . template/inspect [python] -- fancy-conformance 0.36.0 25 passed, 0 failed, 0 skipped ............................................................ [ 27%] ........................................................................ [ 55%] ........................................................................ [ 82%] ............................................. [100%] 261 passed in 1.07s

• PHP leg suite passes (documented Pest command): command completed successfully

  Source: AGENTS.md Testing: php vendor/bin/pest --test-directory=php/tests

  Input: pest --test-directory=php/tests

  Expected: 56 passed

  Command: php vendor/bin/pest --test-directory=php/tests

  Observed: tten ✓ it section 9: $index in a cell is a number ✓ it section 9: markup escapes only the value, never the template's own markup ✓ it section 9: a literal token's text is a value too ✓ it section 9: non-ASCII punctuation is left alone ✓ it section 4: validateData in declaration order, depth-first Tests: 56 passed (123 assertions) Duration: 1.62s

• TypeScript leg tests pass (documented npm test): command completed successfully

  Source: AGENTS.md Testing: npm run lint && npm test && npm run build

  Input: npm test

  Expected: 260 passed

  Command: npm test

  Observed: 25 passed, 0 failed, 0 skipped ✓ tests/conformance.test.ts (227 tests) 191ms ✓ tests/security.test.ts (21 tests) 29ms ✓ tests/spec.test.ts (12 tests) 13ms  Test Files  3 passed (3)  Tests  260 passed (260)  Start at  21:54:22  Duration  2.12s (transform 376ms, setup 0ms, import 611ms, tests 233ms, environment 0ms)

• TypeScript leg builds (documented npm run build): command completed successfully

  Source: AGENTS.md Testing: npm run lint && npm test && npm run build

  Input: npm run build

  Expected: Build success

  Command: npm run build

  Observed: > @particle-academy/[email protected] build > tsup src/index.ts --format esm,cjs --dts --clean CLI Building entry: src/index.ts CLI Using tsconfig: tsconfig.json CLI tsup v8.5.1 CLI Target: es2022 CLI Cleaning output folder ESM Build start CJS Build start CJS dist/index.cjs 53.60 KB CJS ⚡️ Build success in 94ms ESM dist/index.js 52.35 KB ESM ⚡️ Build success in 96ms DTS Build start DTS ⚡️ Build success in 1300ms DTS dist/index.d.ts 3.48 KB DTS dist/index.d.cts 3.48 KB

• Sabotage harness breaks every bound (documented): Not run: scripts/sabotage.py reads envelope sibling checkouts (repos/fancy-expr, writer repos) that do not exist in this VM; AGENTS.md says it runs from inside the envelope only.

  Source: AGENTS.md Testing: python -I scripts/sabotage.py

  Expected: documented command completes successfully

  Observed: Not run: scripts/sabotage.py reads envelope sibling checkouts (repos/fancy-expr, writer repos) that do not exist in this VM; AGENTS.md says it runs from inside the envelope only.

• Writer read-back of corpus (documented): Not run: --writers needs the nine writer repo checkouts of the envelope (AGENTS.md); not present. Plain parity run was executed instead via the probe.

  Source: README.md / AGENTS.md: php php/tests/parity.php --writers

  Expected: documented command completes successfully

  Observed: Not run: --writers needs the nine writer repo checkouts of the envelope (AGENTS.md); not present. Plain parity run was executed instead via the probe.

Local or hosted: local

Cross-leg parity run from the README: php php/tests/parity.php renders the 203 template/* conformance rows and the 4 corpus examples through PHP, TypeScript and Python and compares the output byte for byte (result: 211/211 equal, exit 0).

cd <guest-path> && pwd && ls -la && id -u && (git status 2>&1 | head -3) && cat README.md 2>/dev/null | head -200
cd <guest-path> && ls -R python scripts .github examples src tests | head -80 && cat AGENTS.md | head -120 && ls .github/workflows && cat .github/workflows/*.yml | head -150 && python3 --version
cd <guest-path> && cat python/README.md && echo ---- && cat python/pyproject.toml && echo ---- && cat package.json && echo ---- && cat composer.json | head -40 && echo ---- && sed -n 150,260p .github/workflows/ci.yml
cd /tmp && python3 -m venv --help >/dev/null 2>&1 && echo venv-ok; python3 -m pip --version 2>&1; echo "CDP=$CDP_URL $<env-var>"; timeout 20 curl -sI https://github.com | head -1; timeout 20 curl -sI https://pypi.org/simple/fancy-expr/ | head -1; timeout 20 pip download --no-deps -d /tmp/x fancy-expr 2>&1 | tail -2
cd <guest-path> && git init -q && git remote add origin https://github.com/Particle-Academy/fancy-template && timeout 120 git fetch -q --depth 1 origin af965c9885141f982d8a590502f1be7925eede31 && git reset -q --mixed FETCH_HEAD && git status --short | head -20; echo "status-exit=$?"; git log --oneline -1
mkdir -p <guest-path> && cd <guest-path> && python3 -m venv <guest-path> && <guest-path> --version && cd <guest-path> && timeout 300 git clone -q --depth 1 --branch v0.2.0 https://github.com/Particle-Academy/fancy-expr <guest-path> && cd <guest-path> && timeout 400 <guest-path> -m pip install --upgrade pip -q && timeout 400 <guest-path> -m pip install <guest-path> 2>&1 | tail -3 && timeout 400 <guest-path> -m pip install -e ./python --group ./python/pyproject.toml:test 2>&1 | tail -3
cd <guest-path> && grep -rn "scripts\|console\|__main__\|\"bin\"" python/pyproject.toml package.json composer.json | head; ls php php/tests scripts/parity; echo ---; . /etc/os-release; echo $PRETTY_NAME; which php node npm composer uv 2>&1; node -v 2>&1; php -v 2>&1 | head -1; sudo -n true && echo sudo-ok
cd <guest-path> && timeout 300 git clone -q --depth 1 --branch v0.36.0 https://github.com/Particle-Academy/fancy-conformance <guest-path> && cd <guest-path> && FANCY_CONFORMANCE_ROOT=<guest-path> PYTHONPATH=<guest-path> timeout 900 <guest-path> -m pytest -q > <guest-path> 2>&1; echo "pytest-exit=$?"; tail -5 <guest-path>
sudo apt-get -o DPkg::Lock::Timeout=300 update -qq 2>&1 | tail -2; sudo DEBIAN_FRONTEND=noninteractive apt-get -o DPkg::Lock::Timeout=300 install -y -qq software-properties-common ca-certificates curl unzip ><guest-path> 2>&1; echo "apt1=$?"; sudo DEBIAN_FRONTEND=noninteractive timeout 300 add-apt-repository -y ppa:ondrej/php ><guest-path> 2>&1; echo "ppa=$?"; tail -3 <guest-path>
sudo apt-get -o DPkg::Lock::Timeout=300 update -qq 2>&1 | tail -2; sudo DEBIAN_FRONTEND=noninteractive apt-get -o DPkg::Lock::Timeout=300 install -y -qq php8.4-cli php8.4-mbstring php8.4-xml php8.4-curl php8.4-zip > <guest-path> 2>&1; echo "php-install=$?"; tail -3 <guest-path>; php -v 2>&1 | head -1
sudo DEBIAN_FRONTEND=noninteractive apt-get -o DPkg::Lock::Timeout=300 install -y -qq composer > <guest-path> 2>&1; echo "composer-apt=$?"; composer --version 2>&1 | head -1; cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 900 composer install --no-interaction --prefer-dist > <guest-path> 2>&1; echo "composer-install=$?"; tail -4 <guest-path>
cd <guest-path> && timeout 900 php vendor/bin/pest --test-directory=php/tests > <guest-path> 2>&1; echo "pest-exit=$?"; tail -3 <guest-path>; export NODE_USE_ENV_PROXY=1; timeout 900 npm install --no-audit --no-fund > <guest-path> 2>&1; echo "npm-install=$?"; tail -3 <guest-path>; timeout 600 npm run lint > <guest-path> 2>&1; echo "lint=$?"; timeout 600 npm test > <guest-path> 2>&1; echo "npm-test=$?"; tail -4 <guest-path>; timeout 600 npm run build > <guest-path> 2>&1; echo "build=$?"; tail -3 <guest-path>
cd <guest-path> && timeout 900 php php/tests/parity.php > <guest-path> 2>&1; echo "parity-exit=$?"; cat <guest-path> | sed 's/\x1b\[[0-9;]*m//g' | tail -30
cd <guest-path> && sed -n 1,110p php/tests/parity.php
cd <guest-path> && echo "PATH=$PATH"; which node python python3; ls -d /tmp/fancy-template-parity-* 2>/dev/null | tail -2; ls -la /tmp/fancy-template-parity-* 2>/dev/null | tail -8; cat > <guest-path> <<'EOF'
<?php
$p = proc_open(['node', '-v'], [1 => ['pipe','w'], 2 => ['pipe','w']], $pipes, '<guest-path>');
var_dump($p === false ? 'false' : 'ok');
EOF
php -d display_errors=1 <guest-path> 2>&1 | head -5
cd <guest-path> && rm -rf /tmp/fancy-template-parity-* && PATH=<guest-path> timeout 900 php php/tests/parity.php > <guest-path> 2>&1; echo "parity-exit=$?"; sed 's/\x1b\[[0-9;]*m//g' <guest-path> | tail -30
cd <guest-path> && grep -rniE "cron|schedul|webhook|setInterval|while \(true|--once|--now|daemon" --include=*.py --include=*.ts --include=*.php --include=*.md src php/src python/src README.md 2>/dev/null | head -5; echo "grep-done"; grep -n "The three legs pass the same 203" README.md; grep -n "produce byte-identical output on every row and on" README.md; grep -n "the realistic templates in" README.md; sed -n 1,40p scripts/parity/python_driver.py | head -15
cd <guest-path> && VENVPY=<guest-path> && ENVPATH="<guest-path>" && cat > probe.json <<EOF
{"kind":"cli","argv":["php","php/tests/parity.php"],"cwd":"<guest-path>","env":{"PATH":"$ENVPATH"},"expected_text":"211/211 = 100.0%"}
EOF
cat > claims.json <<EOF
[
{"kind":"claim","claim":"The three legs pass the same 203 conformance rows","source":"The three legs pass the same 203 \`template/*\` conformance rows","input":"php php/tests/parity.php (all template/* rows, byte-for-byte across PHP, TypeScript, Python)","expected":"203/203 rows match on each leg","probe_kind":"cli","argv":["php","php/tests/parity.php"],"cwd":"<guest-path>","env":{"PATH":"$ENVPATH"},"expected_text":"203/203 = 100.0%"},
{"kind":"claim","claim":"Three legs produce byte-identical output","source":"produce byte-identical output on every row and on","input":"php php/tests/parity.php","expected":"all three legs equal","probe_kind":"cli","argv":["php","php/tests/parity.php"],"cwd":"<guest-path>","env":{"PATH":"$ENVPATH"},"expected_text":"3 legs equal"},
{"kind":"claim","claim":"Realistic example templates render identically across legs","source":"the realistic templates in \`examples/\` (\`php php/tests/parity.php\`).","input":"php php/tests/parity.php (includes corpus certificate, invoice, deck, report)","expected":"211/211 rows equal across the three legs","probe_kind":"cli","argv":["php","php/tests/parity.php"],"cwd":"<guest-path>","env":{"PATH":"$ENVPATH"},"expected_text":"211/211 = 100.0%"}
]
EOF
cat > examples.json <<EOF
[
{"kind":"example","claim":"Python leg suite passes (documented offline tests)","source":"AGENTS.md Testing: cd python && python -m pytest -q","input":"python -m pytest -q","expected":"261 passed","argv":["$VENVPY","-m","pytest","-q"],"cwd":"<guest-path>","env":{"PATH":"$ENVPATH","FANCY_CONFORMANCE_ROOT":"<guest-path>","PYTHONPATH":"<guest-path>"},"expected_text":"261 passed"},
{"kind":"example","claim":"PHP leg suite passes (documented Pest command)","source":"AGENTS.md Testing: php vendor/bin/pest --test-directory=php/tests","input":"pest --test-directory=php/tests","expected":"56 passed","argv":["php","vendor/bin/pest","--test-directory=php/tests"],"cwd":"<guest-path>","env":{"PATH":"$ENVPATH"},"expected_text":"56 passed"},
{"kind":"example","claim":"TypeScript leg tests pass (documented npm test)","source":"AGENTS.md Testing: npm run lint && npm test && npm run build","input":"npm test","expected":"260 passed","argv":["npm","test"],"cwd":"<guest-path>","env":{"PATH":"$ENVPATH","NODE_USE_ENV_PROXY":"1"},"expected_text":"260 passed"},
{"kind":"example","claim":"TypeScript leg builds (documented npm run build)","source":"AGENTS.md Testing: npm run lint && npm test && npm run build","input":"npm run build","expected":"Build success","argv":["npm","run","build"],"cwd":"<guest-path>","env":{"PATH":"$ENVPATH"},"expected_text":"Build success"},
{"kind":"example","claim":"Sabotage harness breaks every bound (documented)","source":"AGENTS.md Testing: python -I scripts/sabotage.py","reason":"Not run: scripts/sabotage.py reads envelope sibling checkouts (repos/fancy-expr, writer repos) that do not exist in this VM; AGENTS.md says it runs from inside the envelope only."},
{"kind":"example","claim":"Writer read-back of corpus (documented)","source":"README.md / AGENTS.md: php php/tests/parity.php --writers","reason":"Not run: --writers needs the nine writer repo checkouts of the envelope (AGENTS.md); not present. Plain parity run was executed instead via the probe."}
]
EOF
cat > cycles.json <<EOF
{"detected":false,"reason":"Entry points inspected: README.md, python/README.md, AGENTS.md, package.json, composer.json, python/pyproject.toml, and source grep for cron/schedule/webhook/loop/--once/--now found nothing. The product is a template library (inspect/validate/render) with no scheduler, daemon or webhook; it runs only when a caller invokes it.","checks":[]}
EOF
for f in probe claims examples cycles; do <guest-path> -I -c "import json,sys; json.load(open('$f.json')); print('$f ok')" 2>&1; done
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Cross-leg parity run from the README: php php/tests/parity.php renders the 203 template/* conformance rows and the 4 corpus examples through PHP, TypeScript and Python and compares the output byte for byte (result: 211/211 equal, exit 0).","operation_scope":"fancy-template 0.2.0 at af965c9. This is a template library with no CLI or server; the README's render() calls are library APIs, so the parity harness is the only documented runnable operation. Needs PHP 8.4.27 with composer deps, Node 22 with npm deps and a built dist/, and Python >=3.11 with fancy-expr v0.2.0 (not on PyPI) installed; the fancy-conformance v0.36.0 fixtures for the Python tests.","steps":["git init; git remote add origin https://github.com/Particle-Academy/fancy-template; git fetch --depth 1 origin af965c9885141f982d8a590502f1be7925eede31; git reset --mixed FETCH_HEAD (clean status, matches pin)","python3 -m venv <guest-path> (Python 3.12.3)","git clone --depth 1 --branch v0.2.0 https://github.com/Particle-Academy/fancy-expr; <guest-path> -m pip install <guest-path>","<guest-path> -m pip install -e ./python --group ./python/pyproject.toml:test","git clone --depth 1 --branch v0.36.0 https://github.com/Particle-Academy/fancy-conformance; cd python && python -m pytest -q (261 passed)","sudo apt-get install software-properties-common; sudo add-apt-repository ppa:ondrej/php; sudo apt-get install php8.4-cli php8.4-mbstring php8.4-xml php8.4-curl php8.4-zip composer","composer install --no-interaction --prefer-dist","vendor/bin/pest --test-directory=php/tests (56 passed)","npm install --no-audit --no-fund; npm run lint; npm test (260 passed); npm run build","php php/tests/parity.php (exit 0, 211/211 = 100.0%)"],"deviations":["README has no install section; install steps were taken from AGENTS.md Testing and .github/workflows/ci.yml.","fancy-expr is not on PyPI (pip download returned 'no matching distribution'); installed from GitHub tag v0.2.0 as CI does.","Ubuntu 24.04 ships PHP 8.3 only; added ppa:ondrej/php via add-apt-repository and installed php8.4 (8.4.27, meets the CI's patched floor). Composer came from apt, not the getcomposer installer.","parity.php's Python leg calls a bare 'python' (CI gets it from setup-python); the guest has only python3, so the probe runs with the venv bin directory first on PATH (venv Python 3.12.3). First attempt failed with proc_open posix_spawn ENOENT, logged in this session.","Not run: scripts/sabotage.py and parity.php --writers (need envelope sibling checkouts); ruff/mypy lint steps from AGENTS.md not run."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the working path. Optional: ship a CLI or a README install section so the render operation can be run without writing Python/PHP/TypeScript code, and make parity.php use python3 or document the 'python' requirement."}
EOF
<guest-path> -I -c "import json; json.load(open('report.json')); print('report ok')"; cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "validate-exit=$?"; tail -60 <guest-path>