{
  "checker": {
    "claims": [
      {
        "claim": "Egress preview performs no network action",
        "command": "<guest-path> egress . --privacy controlled-remote --redact strict --json",
        "evidence": "\u2026\"network_action\":\"none\",\"privacy_mode\":\"controlled-remote\",\"redaction_count\":63,\"sensitive_paths_omitted\":0}\n",
        "expected": "JSON reports network_action none",
        "input": "scan egress . --privacy controlled-remote --redact strict --json",
        "kind": "claim",
        "outcome": "Real input produced the expected result: \"network_action\":\"none\"",
        "returncode": 0,
        "source": "`scan egress` is preview-only: it reports selected/omitted files, selected bytes and redaction counts, and performs **no network action**.",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      },
      {
        "claim": "Render writes an HTML report from canonical state",
        "command": "<guest-path> render .scan/state.json --output <guest-path>",
        "evidence": "\u2026project-anatomy-state</code>. It preserves the documented snapshot; original source bytes may still be needed.</p></footer>\n</main>\n<script type=\"application/json\" id=\"project-anatomy-state\">{\"actions\":[],\"artifacts\":[{\"content_identity\":\"directory\",\"evidence_ids\":[\"evidence:69077515d46a71d80b78\"],\"id\":\"artifact:2a8e53b184b6a5e7d8d6\",\"inspected_at\":\"2026-10-28T11:15:45Z\",\"inspection_origin\":\"fresh\",\"locator\":\".coldpass\",\"media_type\":\"inode/directory\",\"path_kind\":\"directory\",\"reason\":\"filesystem metadata inventoried\",\"redaction_count\":0,\"redaction_state\":\"none\",\"size_bytes\":0,\"status\":\"metadata",
        "expected": "HTML file contains the inert project-anatomy-state block",
        "input": ".scan/state.json rendered to <guest-path>",
        "kind": "claim",
        "outcome": "Real input produced the expected result: project-anatomy-state",
        "returncode": 0,
        "source": "scan render .scan/state.json --output .scan/rerendered.html",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      },
      {
        "claim": "SARIF export writes SARIF 2.1.0 from canonical state",
        "command": "<guest-path> sarif .scan/state.json --output <guest-path>",
        "evidence": "\u2026\"version\":\"2.1.0\"}\n",
        "expected": "SARIF file declares version 2.1.0",
        "input": ".scan/state.json exported to <guest-path>",
        "kind": "claim",
        "outcome": "Real input produced the expected result: \"version\":\"2.1.0\"",
        "returncode": 0,
        "source": "scan sarif .scan/state.json --output .scan/results.sarif",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      }
    ],
    "cycle_checks": [
      {
        "claim": "Scheduled or looping main behavior",
        "command": "",
        "evidence": "Inspected README.md and src/scan_core/cli.py, pyproject.toml scripts, and grepped src/scripts/docs/references for cron, schedule, --once, --now, webhook, daemon and watch. Scan is a one-shot CLI with no scheduler, loop or webhook trigger, so no product cycle exists to trigger.",
        "expected": "identify the product trigger",
        "input": "source inspection",
        "kind": "cycle",
        "outcome": "Inspected README.md and src/scan_core/cli.py, pyproject.toml scripts, and grepped src/scripts/docs/references for cron, schedule, --once, --now, webhook, daemon and watch. Scan is a one-shot CLI with no scheduler, loop or webhook trigger, so no product cycle exists to trigger.",
        "source": "repository entry points",
        "verdict": "yes"
      }
    ],
    "details": {
      "argv": [
        "<guest-path>",
        "egress",
        ".",
        "--privacy",
        "controlled-remote",
        "--redact",
        "strict",
        "--json"
      ],
      "kind": "cli",
      "needs_browser": false,
      "needs_credentials": false,
      "returncode": 0,
      "scope": "product operation",
      "stderr": "",
      "stdout": "{\"bytes_selected\":1473944,\"files_omitted_by_policy\":31,\"files_selected\":291,\"network_action\":\"none\",\"privacy_mode\":\"controlled-remote\",\"redaction_count\":63,\"sensitive_paths_omitted\":0}",
      "working": true
    },
    "evidence_strength": "readme_checked",
    "example_checks": [
      {
        "claim": "ScanBench runs the 12 mandatory adversarial fixtures",
        "command": "<guest-path> bench",
        "deferred": false,
        "evidence": "PASS clean-minimal\nPASS hidden-files\nPASS symlink-escape\nPASS prompt-injection\nPASS secret-redaction\nPASS malformed-filename\nPASS unreadable-artifact\nPASS archive-boundary\nPASS unsupported-binary\nPASS generated-and-vendor\nPASS incomplete-discovery\nPASS false-runtime-claim\n\nDimensions\nPASS inventory completeness\nPASS state integrity\nPASS evidence correctness\nPASS privacy integrity\nPASS safety-boundary compliance\nNo blended overall quality score is calculated.",
        "expected": "dimension results PASS",
        "input": "scan bench",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md / Scan modes and ScanBench v1",
        "verdict": "yes"
      },
      {
        "claim": "Historical demo report passes the structural contract",
        "command": "<guest-path> scripts/validate_report.py examples/demo-report.html",
        "deferred": false,
        "evidence": "PASS: Scan 1.2 structure, typed references, artifact/check coverage, reuse and control evidence; semantic/visual review still required",
        "expected": "PASS structure check",
        "input": "examples/demo-report.html",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md / Historical synthetic proof",
        "verdict": "yes"
      },
      {
        "claim": "Generated demo HTML matches the committed version",
        "command": "<guest-path> scripts/build_demo_report.py --check",
        "deferred": false,
        "evidence": "PASS: generated demo matches committed HTML\nPASS: Scan 1.2 structure, typed references, artifact/check coverage, reuse and control evidence; semantic/visual review still required",
        "expected": "generated demo matches committed HTML",
        "input": "--check",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md / Historical synthetic proof",
        "verdict": "yes"
      }
    ],
    "status": "PASS"
  },
  "deviations": [
    "Source was already present, so the README git clone was replaced by the required git init, remote add, fetch --depth 1 of pinned commit 864770cb, and reset --mixed FETCH_HEAD.",
    "pip install used a venv at <guest-path> because system Python is externally managed; product argv uses the absolute venv scan path.",
    "Render and SARIF claims write to <guest-path> instead of the README's .scan paths so replay gets fresh destinations; the README command text is quoted as the source.",
    "Optional MCP bridge (scan-mcp, [mcp] extra) was not installed or exercised; the CLI is the documented primary entrypoint.",
    "The checker path given as /inputs/coldpass-preflight.py does not exist; used <guest-path> instead."
  ],
  "fault_owner": null,
  "main_blocker": null,
  "operation": "Install Scan 0.4.0 from the pinned source and run its offline inspection CLI, including the preview-only egress command, state-driven HTML render and SARIF export, ScanBench, and the documented report validator and demo checks.",
  "operation_scope": "Local Linux guest, Python 3.12.3 venv at <guest-path> (README requires Python 3.11+); no network, browser, credentials, optional MCP extra, or scheduler used. Scan is a one-shot CLI so no cycle exists.",
  "outcome": "working",
  "plain_failure": null,
  "steps": [
    "python3 -m venv <guest-path>",
    "<guest-path> -m pip install .",
    "scan doctor . (PASS except expected WARN git-worktree before git init)",
    "scan . --offline (385 artifacts, deep mode, partial completion, wrote .scan/state.json and report.html)",
    "scan validate .scan/state.json (silent, exit 0)",
    "scan egress . --privacy controlled-remote --redact strict --json (network_action none)",
    "scan render .scan/state.json --output <fresh path> (HTML with project-anatomy-state)",
    "scan sarif .scan/state.json --output <fresh path> (version 2.1.0)",
    "scan bench (12 fixtures PASS)",
    "python scripts/validate_report.py examples/demo-report.html (PASS)",
    "python scripts/build_demo_report.py --check (PASS)",
    "python -m unittest discover -s scripts -p test_*.py (28 tests OK)"
  ],
  "stuck_step": null,
  "suggested_fix": "None required for this run."
}