{ "checker": { "claims": [ { "claim": "Reports privacy, secret, attribution and reproducibility blockers without printing matches", "command": " --denylist --reports --scrub-plan", "evidence": "\"preserve_attribution\": true\n}\n", "expected": "scrub plan JSON with preserve_attribution true and no matched text", "input": "sample", "kind": "claim", "outcome": "Real input produced the expected result: \"preserve_attribution\": true", "returncode": 2, "source": "privacy, secret, attribution and reproducibility blockers without printing matches.", "source_checked": true, "source_file": "README.md", "verdict": "yes" }, { "claim": "Shallow history blocks the audit", "command": " --denylist --reports --scrub-plan", "evidence": "\"coverage\": 1, \"quality\": 1}, \"report\": \"workspace/20261022T085106.519408Z/report.json\"}\n{\n \"drop_files\": [],\n \"replace_or_remove\": [],\n \"flatten_history\": true,\n \"review_media\": [],\n \"preserve_attribution\": true\n}\n", "expected": "audit reports coverage finding (shallow-history) and does not pass", "input": "shallow depth-1 clone of the pinned repository", "kind": "claim", "outcome": "Real input produced the expected result: \"coverage\": 1", "returncode": 2, "source": "Shallow history blocks.", "source_checked": true, "source_file": "README.md", "verdict": "yes" }, { "claim": "Exit codes 0 PASS 1 FAIL 2 INCOMPLETE", "command": " --denylist --reports --scrub-plan", "evidence": "\"outcome\": \"INCOMPLETE\", \"ready\": false, \"counts\": {\"coverage\": 1, \"quality\": 1}, \"report\": \"workspace/20261022T085107.864987Z/report.json\"}\n{\n \"drop_files\": [],\n \"replace_or_remove\": [],\n \"flatten_history\": true,\n \"review_media\": [],\n \"preserve_attribution\": true\n}\n", "expected": "exit code 2 with outcome INCOMPLETE", "input": "sample repo scan", "kind": "claim", "outcome": "Real input produced the expected result: \"outcome\": \"INCOMPLETE\"", "returncode": 2, "source": "Exit codes: 0 = PASS, 1 = FAIL, 2 = INCOMPLETE.", "source_checked": true, "source_file": "README.md", "verdict": "yes" } ], "cycle_checks": [ { "claim": "Scheduled or looping main behavior", "command": "", "evidence": "Inspected README.md and release_check.py (main at line 1518, plus grep for cron, schedule, sleep, --once, --now, webhook, daemon, threading): release-check is a one-shot CLI audit that scans, writes a report and exits; it has no scheduler, loop or webhook. Nothing was run as a cycle.", "expected": "identify the product trigger", "input": "source inspection", "kind": "cycle", "outcome": "Inspected README.md and release_check.py (main at line 1518, plus grep for cron, schedule, sleep, --once, --now, webhook, daemon, threading): release-check is a one-shot CLI audit that scans, writes a report and exits; it has no scheduler, loop or webhook. Nothing was run as a cycle.", "source": "repository entry points", "verdict": "yes" } ], "details": { "argv": [ "", "", "--denylist", "", "--reports", "", "--scrub-plan" ], "kind": "cli", "needs_browser": false, "needs_credentials": false, "returncode": 2, "scope": "product operation", "stderr": "", "stdout": "{\"outcome\": \"INCOMPLETE\", \"ready\": false, \"counts\": {\"coverage\": 1, \"quality\": 1}, \"report\": \"workspace/20261022T085103.839644Z/report.json\"}\n{\n \"drop_files\": [],\n \"replace_or_remove\": [],\n \"flatten_history\": true,\n \"review_media\": [],\n \"preserve_attribution\": true\n}", "working": true }, "evidence_strength": "readme_checked", "example_checks": [ { "claim": "Quickstart: release-check --help prints usage", "command": " --help", "deferred": false, "evidence": "h, --help show this help message and exit\n --requirements Print required files, README headings and manifest\n shape without scanning\n --denylist DENYLIST\n --reports REPORTS\n --manifest MANIFEST\n --private-repo PRIVATE_REPO\n Known-private repo URL or owner/name; kept out of\n reports\n --verify Execute reviewed manifest quickstart/check argv in a\n fresh local clone and venv\n --timeout TIMEOUT\n --scrub-plan\n --export EXPORT\n --validate-receipt RECEIPT_JSON EXPORT_DIR", "expected": "usage text", "input": "--help", "kind": "example", "outcome": "command completed successfully", "returncode": 0, "source": "README.md Quickstart", "verdict": "yes" }, { "claim": "Print required files without a scan", "command": " --requirements", "deferred": false, "evidence": "nittest\",\n \"discover\",\n \"-s\",\n \"tests\",\n \"-q\"\n ]\n }\n ],\n \"dependency_licenses\": {\n \"example\": {\n \"version\": \"1.0\",\n \"spdx\": \"MIT\",\n \"sha256\": \"0000000000000000000000000000000000000000000000000000000000000000\"\n }\n }\n}\nPassing also requires an external denylist, complete local history and attribution, no unresolved personal/secret/path/hostname/email/media/metadata findings, and --verify in a fresh clone/venv/HOME. Install the project and test tools through declared commands. Export rescans a clean one-commit copy; nothing is published.", "expected": "requirements listing", "input": "--requirements", "kind": "example", "outcome": "command completed successfully", "returncode": 0, "source": "README.md Quickstart: release-check --requirements", "verdict": "yes" } ], "status": "PASS" }, "deviations": [ "python3 -m venv failed on the stock guest because python3.12-venv was not installed; installed it with sudo -n apt-get install -y python3.12-venv and recreated the venv.", "The required depth-1 pinned fetch makes the audit report shallow-history (a blocking coverage finding per README), so the final outcome is INCOMPLETE, not PASS. Not unshallowed, to keep to the pinned procedure.", "The first --verify run timed out in the repo tests step at the default 300s; reran with --timeout 1200, which took about 17 minutes. Verification then passed.", "Checker first rejected a README quote that was hard-wrapped across lines; corrected to the single-line quote.", "Dropped the --requirements-only claim because the checker treats requirements output as setup-only; replaced it with the shallow-history claim.", "/inputs/coldpass-preflight.py does not exist in this VM; ran the checker at as instructed in the task.", "No servers or background processes were started, so none needed stopping. No browser was used." ], "fault_owner": null, "main_blocker": null, "operation": "Install release-check from the pinned README quickstart and run the local release audit (--scrub-plan, and --verify) against the pinned repository with an external denylist.", "operation_scope": "Linux Ubuntu guest, Python 3.12.3 (needs 3.11+), git 2.43, sudo apt for python3.12-venv. Denylist and report root kept outside the repo in No export was created. Full PASS is not reachable from the depth-1 pinned clone: the audit reports shallow-history.", "outcome": "working", "plain_failure": null, "steps": [ "git init; git remote add origin https://github.com/TayHCode/release-check; git fetch --depth 1 origin 5288fe622510581420eb89d02e8246ff3d980bfe; git reset --mixed FETCH_HEAD", "python3 -m venv .venv (failed: ensurepip missing)", "sudo -n apt-get install -y python3.12-venv; rm -rf .venv; python3 -m venv .venv", ". .venv/bin/activate && python -m pip install .", "release-check --help", "release-check --requirements", "release-check --denylist --reports --scrub-plan -> outcome INCOMPLETE, exit 2 (reasons: shallow-history, verification-not-run)", "release-check --denylist ... --reports ... --verify -> FAIL first run (test step timed out at default 300s, exit 124)", "release-check ... --verify --timeout 1200 -> INCOMPLETE, only coverage finding shallow-history left (verification passed)" ], "stuck_step": null, "suggested_fix": null }