{
  "checker": {
    "claims": [
      {
        "claim": "zipcheck detects a high-expansion zip bomb without extracting it",
        "command": "<guest-path> --fail-on none <guest-path>",
        "evidence": "1 suspicious, 0 clean, 0 unknown  (0.00s)\nuse -v for notes and member samples; --json for machine output\n",
        "expected": "reported as suspicious",
        "input": "bomb.zip declaring 300000000 bytes from 291706 bytes on disk",
        "kind": "claim",
        "outcome": "Real input produced the expected result: 1 suspicious",
        "returncode": 0,
        "source": "Static zip-bomb / archive-bomb detection that never extracts anything.",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      },
      {
        "claim": "--fail-on none exits 0 even when suspicious",
        "command": "<guest-path> --fail-on none <guest-path>",
        "evidence": "0 dangerous, 1 suspicious, 0 clean, 0 unknown  (0.00s)\nuse -v for notes and member samples; --json for machine output\n",
        "expected": "summary line shows 1 suspicious",
        "input": "bomb.zip",
        "kind": "claim",
        "outcome": "Real input produced the expected result: 0 dangerous, 1 suspicious",
        "returncode": 0,
        "source": "zipcheck --fail-on none archive.zip",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      }
    ],
    "cycle_checks": [
      {
        "claim": "Scheduled or looping main behavior",
        "command": "",
        "evidence": "Entry points inspected (src/zipcheck CLI, README Usage) and grep for cron/schedule/watch/--once/daemon/webhook found nothing. zipcheck is a one-shot CLI that scans the files it is given and exits; no product scheduler or loop exists.",
        "expected": "identify the product trigger",
        "input": "source inspection",
        "kind": "cycle",
        "outcome": "Entry points inspected (src/zipcheck CLI, README Usage) and grep for cron/schedule/watch/--once/daemon/webhook found nothing. zipcheck is a one-shot CLI that scans the files it is given and exits; no product scheduler or loop exists.",
        "source": "repository entry points",
        "verdict": "yes"
      }
    ],
    "details": {
      "argv": [
        "<guest-path>",
        "--fail-on",
        "none",
        "<guest-path>"
      ],
      "kind": "cli",
      "needs_browser": false,
      "needs_credentials": false,
      "returncode": 0,
      "scope": "product operation",
      "stderr": "",
      "stdout": "  SUSPICIOUS  <guest-path>\n    format:    zip (ZIP, 1 parsed entries)\n    on disk:   285 KiB\n    declared:  286 MiB  (1,028:1)\n    members:   1\n    [MEDIUM] HIGH_EXPANSION: Declared expansion is unusually large\n            The archive declares 300000000 bytes of output from 291706 bytes on disk (1,028:1). Extract it only inside a resource-limited sandbox.\n\n1 file(s): 0 dangerous, 1 suspicious, 0 clean, 0 unknown  (0.00s)\nuse -v for notes and member samples; --json for machine output",
      "working": true
    },
    "evidence_strength": "readme_checked",
    "example_checks": [
      {
        "claim": "JSON output reports the suspicious verdict for the bomb sample",
        "command": "<guest-path> --json --fail-on none <guest-path>",
        "deferred": false,
        "evidence": "truncated\": false,\n      \"findings\": [\n        {\n          \"code\": \"HIGH_EXPANSION\",\n          \"severity\": \"medium\",\n          \"severity_value\": 2,\n          \"title\": \"Declared expansion is unusually large\",\n          \"detail\": \"The archive declares 300000000 bytes of output from 291706 bytes on disk (1,028:1). Extract it only inside a resource-limited sandbox.\",\n          \"evidence\": {\n            \"declared_uncompressed\": 300000000,\n            \"file_size\": 291706,\n            \"ratio\": 1028.4327370708863\n          }\n        }\n      ],\n      \"nested\": [],\n      \"duration_ms\": 3.398\n    }\n  ]\n}",
        "expected": "verdict suspicious in JSON",
        "input": "--json --fail-on none bomb.zip",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md ## Usage (--json, machine-readable)",
        "verdict": "yes"
      },
      {
        "claim": "Repository test suite (documented Development commands)",
        "command": "<guest-path> -m pytest -q",
        "deferred": false,
        "evidence": "........................................................................ [ 69%]\n................................                                         [100%]",
        "expected": "tests pass",
        "input": "python -m pytest",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md ## Development",
        "verdict": "yes"
      }
    ],
    "status": "PASS"
  },
  "deviations": [
    "zip binary not present in the guest, so the bomb fixture was generated with a stdlib zipfile script (<guest-path>) instead of the zip CLI",
    "Installed into a venv rather than pipx/uv (both documented; venv is the README pip path)",
    "Did not run tools/generate_samples.py (needs a RAR binary and produces large files); used a 300 MB zero-filled deflate bomb instead",
    "Browser CDP endpoint checked (HTTP 200) but not used; zipcheck is a CLI"
  ],
  "fault_owner": null,
  "main_blocker": null,
  "operation": "Scan an archive for zip-bomb risk with the zipcheck CLI (static metadata check, no extraction)",
  "operation_scope": "Linux guest, Python 3.12.3, venv at <guest-path> with zipcheck[aes] 0.3.0 installed from the checkout; sample archives generated in <guest-path>; no browser or credentials needed",
  "outcome": "working",
  "plain_failure": null,
  "steps": [
    "python3 -m venv <guest-path>",
    "<guest-path> -m pip install '.[aes]'  (README Install, from checkout)",
    "<guest-path> <guest-path>  -> CLEAN",
    "<guest-path> --fail-on none <guest-path>  -> SUSPICIOUS, HIGH_EXPANSION, 1 suspicious",
    "<guest-path> --json --fail-on none <guest-path>  -> verdict suspicious",
    "python -m pip install -e '.[dev]' and python -m pytest (README Development)"
  ],
  "stuck_step": null,
  "suggested_fix": "None required for this run."
}