{
  "checker": {
    "claims": [
      {
        "claim": "command test inspects a command without executing it or creating an approval",
        "command": "/tmp/pipx/bin/hol-guard command test 'rm -rf ./build'",
        "evidence": "command.filesystem.recursive-delete                             \u2502\n\u2502 Risk classes destructive_shell                                               \u2502\n\u2502 Policy       Not evaluated; this inspection creates no approvals or receipts \u2502\n\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256f\n\u256d\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Command \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256e\n\u2502 rm -rf ./build                                                               \u2502\n\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256f\n\u256d\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Why \u2500\u2500\u2500\u2500\u2500\u2500",
        "expected": "REVIEW verdict classified as recursive-delete, no approval created",
        "input": "rm -rf ./build",
        "kind": "claim",
        "outcome": "Real input produced the expected result: command.filesystem.recursive-delete",
        "returncode": 0,
        "source": "README.md",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      },
      {
        "claim": "plugin-scanner detects Claude Code package formats",
        "command": "/tmp/pipx/bin/plugin-scanner scan tests/fixtures/claude-plugin-good",
        "evidence": "Ecosystems: claude\nDetected packages: 1\n\n\u2500\u2500 Claude Plugin (18/18) \u2500\u2500\n  \u2705 Claude manifest exists                     +4\n\n  \u2705 Claude required fields and semver          +5\n\n  \u2705 Claude marketplace structure               +0\n\n  \u2705 Claude custom paths are relative           +4\n\n  \u2705 Claude hooks and skills are parseable      +5\n\n\u2500\u2500 Security (16/16) \u2500\u2500\n  \u2705 SECURITY.md found                          +3\n\n  \u2705 LICENSE found                              +3\n\n  \u2705 No hardcoded secrets                       +7\n\n  \u2705 Runtime credential access                  +0\n\n  \u2705 No dangerous MCP commands                  +0",
        "expected": "Claude ecosystem detected and scanned",
        "input": "tests/fixtures/claude-plugin-good",
        "kind": "claim",
        "outcome": "Real input produced the expected result: Ecosystems: claude",
        "returncode": 0,
        "source": "README.md",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      }
    ],
    "cycle_checks": [
      {
        "claim": "Scheduled or looping main behavior",
        "command": "",
        "evidence": "Entry points inspected: README.md has no cron, schedule, loop, webhook, --once or --now wording; plugin-scanner and hol-guard CLIs are one-shot commands. src/ contains a guard daemon and internal while-loops, but no documented recurring product cycle. Guard runs on demand per README (hol-guard run/command test).",
        "expected": "identify the product trigger",
        "input": "source inspection",
        "kind": "cycle",
        "outcome": "Entry points inspected: README.md has no cron, schedule, loop, webhook, --once or --now wording; plugin-scanner and hol-guard CLIs are one-shot commands. src/ contains a guard daemon and internal while-loops, but no documented recurring product cycle. Guard runs on demand per README (hol-guard run/command test).",
        "source": "repository entry points",
        "verdict": "yes"
      }
    ],
    "details": {
      "argv": [
        "/tmp/pipx/bin/hol-guard",
        "command",
        "test",
        "rm -rf ./build"
      ],
      "kind": "cli",
      "needs_browser": false,
      "needs_credentials": false,
      "returncode": 0,
      "scope": "product operation",
      "stderr": "",
      "stdout": "\u256d\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 HOL Guard command inspection \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256e\n\u2502 Result       REVIEW                                                          \u2502\n\u2502 Action class filesystem destructive command                                  \u2502\n\u2502 Extension    command.filesystem                                              \u2502\n\u2502 Rule         command.filesystem.recursive-delete                             \u2502\n\u2502 Risk classes destructive_shell                                               \u2502\n\u2502 Policy       Not evaluated; this inspection creates no approvals or receipts \u2502\n\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256f\n\u256d\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Command \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256e\n\u2502 rm -rf ./build                                                               \u2502\n\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256f\n\u256d\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 Why \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256e\n[excerpt truncated]",
      "working": true
    },
    "evidence_strength": "readme_checked",
    "example_checks": [
      {
        "claim": "plugin-scanner scans a Claude Code plugin and reports a score",
        "command": "/tmp/pipx/bin/plugin-scanner scan tests/fixtures/claude-plugin-good",
        "deferred": false,
        "evidence": "nal Security (0/0) \u2500\u2500\n  \u2705 Third-party GitHub Actions pinned to SHAs  +0\n\n  \u2705 No write-all GitHub Actions permissions    +0\n\n  \u2705 No privileged untrusted checkout patterns  +0\n\n  \u2705 Dependabot configured for automation surfaces +0\n\n  \u2705 Dependency manifests have lockfiles        +0\n\n\u2500\u2500 Code Quality (10/10) \u2500\u2500\n  \u2705 No eval or Function constructor            +5\n\n  \u2705 No shell injection patterns                +5\n\nFindings: critical:0, high:0, medium:0, low:0, info:0\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\nFinal Score: 100/100 (A - Excellent)\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\nPolicy profile: default",
        "expected": "Claude ecosystem scanned with 100/100 score",
        "input": "tests/fixtures/claude-plugin-good",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md",
        "verdict": "yes"
      },
      {
        "claim": "plugin-scanner writes a JSON report to --output",
        "command": "/tmp/pipx/bin/plugin-scanner scan tests/fixtures/claude-plugin-good --format json --output .coldpass/scan-example/report.json-checker-14461792bd82443099b38d0d37883a08",
        "deferred": false,
        "evidence": "l or Function constructor\",\n          \"passed\": true,\n          \"points\": 5,\n          \"maxPoints\": 5,\n          \"message\": \"No eval() or new Function() usage detected\",\n          \"findings\": []\n        },\n        {\n          \"name\": \"No shell injection patterns\",\n          \"passed\": true,\n          \"points\": 5,\n          \"maxPoints\": 5,\n          \"message\": \"No shell injection patterns detected\",\n          \"findings\": []\n        }\n      ]\n    }\n  ],\n  \"findings\": [],\n  \"timestamp\": \"2026-10-24T23:16:28.219748+00:00\",\n  \"pluginDir\": \"<guest-path>\"\n}",
        "expected": "JSON file with scan-result.v1 schema",
        "input": "scan tests/fixtures/claude-plugin-good --format json --output .coldpass/scan-example/report.json",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md",
        "verdict": "yes"
      }
    ],
    "status": "PASS"
  },
  "deviations": [
    "Installed hol-guard and plugin-scanner from PyPI via pipx per README; installed version 3.56.0 differs from pyproject.toml version 3.55.1 of the pinned snapshot. The snapshot was not installed from source.",
    "Installed pipx/pip with apt because they were missing (sudo apt-get, Ubuntu 24.04). Install succeeded.",
    "Did not run interactive 'hol-guard init' first-run wizard or 'hol-guard connect' (consent/cloud steps); used the non-interactive commands above instead.",
    "/inputs/coldpass-preflight.py does not exist in this guest; ran <guest-path> with the same flags instead.",
    "No browser or CDP endpoint used: the operations here are local CLI and do not need a browser."
  ],
  "fault_owner": null,
  "main_blocker": null,
  "operation": "Run HOL Guard's local command inspection (hol-guard command test) and the plugin-scanner scan on a Claude plugin fixture, both from the README, and get real results.",
  "operation_scope": "Local CLI only, Linux Ubuntu 24.04 guest, Python 3.12.3. No Guard Cloud, no account, no browser or CDP needed. Installed from PyPI as the README documents, not built from the pinned source snapshot.",
  "outcome": "working",
  "plain_failure": null,
  "steps": [
    "sudo apt-get install -y pipx python3-pip python3-venv (README requires pipx)",
    "pipx install hol-guard (installed 3.56.0)",
    "hol-guard --version; hol-guard status (setup check, rc 0)",
    "hol-guard command test 'rm -rf ./build' (REVIEW, rule command.filesystem.recursive-delete)",
    "pipx install plugin-scanner (README Plugin Scanner section; installed 3.56.0)",
    "plugin-scanner scan tests/fixtures/claude-plugin-good (Ecosystems: claude, Final Score 100/100)",
    "plugin-scanner scan tests/fixtures/claude-plugin-good --format json --output .coldpass/scan-example/report.json (scan-result.v1 file written)",
    "<env-var>=<guest-path> python3 -I <guest-path> --validate --replay (valid true, replay PASS)"
  ],
  "stuck_step": null,
  "suggested_fix": "None needed for this run. Optional: build and test from the pinned commit source to confirm the 3.55.1 snapshot matches the 3.56.0 PyPI release."
}