{
  "schema_version": 1,
  "experiment": "Harmless offline README, archive and copied-file identity-consistency lab",
  "scope": "Six synthetic cases with real local Git commits and ZIP byte reads. No network or candidate execution.",
  "python_version": "3.12.14",
  "git_version": "git version 2.51.1",
  "lab_source_sha256": "4baddefb6725e7cae17224c7d91261589c6397408d0137d59661a700974341e6",
  "scenario_count": 6,
  "recorded_check_count": 24,
  "all_checks_passed": true,
  "trusted_expected_receipt": {
    "git_commit": "ce46ae46601acfcfef46bf7ace19499973cbeb8f",
    "source_inventory": {
      "README.md": "c16c9afc4f7386e3bc98f5e0418d59070001b878b5f1e4a47fda49e820c44d65",
      "SKILL.md": "7d2b9e603da2b013b17d1b86fd923553699fd7cb355544ae460d3911f87fdef3",
      "archives/alternate-notes.zip": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
      "archives/notes.zip": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1"
    },
    "skill_sha256": "7d2b9e603da2b013b17d1b86fd923553699fd7cb355544ae460d3911f87fdef3",
    "readme_sha256": "c16c9afc4f7386e3bc98f5e0418d59070001b878b5f1e4a47fda49e820c44d65",
    "committed_archive_sha256": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
    "committed_member_inventory": {
      "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
    },
    "external_archive_sha256": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
    "external_member_inventory": {
      "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
    },
    "installed_inventory": {
      "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
    }
  },
  "scenarios": [
    {
      "case": "unchanged",
      "status": "pass",
      "hypothetical_external_artifact_case": false,
      "expected_controls": {
        "skill_only_matches": true,
        "commit_only_matches": true,
        "full_receipt_matches": true
      },
      "observed_controls": {
        "skill_only_matches": true,
        "commit_only_matches": true,
        "full_receipt_matches": true
      },
      "expected_changed_fields": [],
      "actual_changed_fields": [],
      "observed_receipt": {
        "git_commit": "ce46ae46601acfcfef46bf7ace19499973cbeb8f",
        "source_inventory": {
          "README.md": "c16c9afc4f7386e3bc98f5e0418d59070001b878b5f1e4a47fda49e820c44d65",
          "SKILL.md": "7d2b9e603da2b013b17d1b86fd923553699fd7cb355544ae460d3911f87fdef3",
          "archives/alternate-notes.zip": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
          "archives/notes.zip": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1"
        },
        "skill_sha256": "7d2b9e603da2b013b17d1b86fd923553699fd7cb355544ae460d3911f87fdef3",
        "readme_sha256": "c16c9afc4f7386e3bc98f5e0418d59070001b878b5f1e4a47fda49e820c44d65",
        "committed_archive_sha256": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
        "committed_member_inventory": {
          "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
        },
        "external_archive_sha256": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
        "external_member_inventory": {
          "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
        },
        "installed_inventory": {
          "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
        }
      }
    },
    {
      "case": "readme_destination_changed",
      "status": "pass",
      "hypothetical_external_artifact_case": false,
      "expected_controls": {
        "skill_only_matches": true,
        "commit_only_matches": false,
        "full_receipt_matches": false
      },
      "observed_controls": {
        "skill_only_matches": true,
        "commit_only_matches": false,
        "full_receipt_matches": false
      },
      "expected_changed_fields": [
        "git_commit",
        "source_inventory",
        "readme_sha256"
      ],
      "actual_changed_fields": [
        "git_commit",
        "source_inventory",
        "readme_sha256"
      ],
      "observed_receipt": {
        "git_commit": "163f1f7f8eeb4a66221a15c815b31805609bae6f",
        "source_inventory": {
          "README.md": "7ff3eb8e2618d92c27d982bcf480cae00f770f168e2ff4c7851e54e09c833691",
          "SKILL.md": "7d2b9e603da2b013b17d1b86fd923553699fd7cb355544ae460d3911f87fdef3",
          "archives/alternate-notes.zip": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
          "archives/notes.zip": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1"
        },
        "skill_sha256": "7d2b9e603da2b013b17d1b86fd923553699fd7cb355544ae460d3911f87fdef3",
        "readme_sha256": "7ff3eb8e2618d92c27d982bcf480cae00f770f168e2ff4c7851e54e09c833691",
        "committed_archive_sha256": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
        "committed_member_inventory": {
          "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
        },
        "external_archive_sha256": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
        "external_member_inventory": {
          "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
        },
        "installed_inventory": {
          "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
        }
      }
    },
    {
      "case": "committed_zip_changed",
      "status": "pass",
      "hypothetical_external_artifact_case": false,
      "expected_controls": {
        "skill_only_matches": true,
        "commit_only_matches": false,
        "full_receipt_matches": false
      },
      "observed_controls": {
        "skill_only_matches": true,
        "commit_only_matches": false,
        "full_receipt_matches": false
      },
      "expected_changed_fields": [
        "git_commit",
        "source_inventory",
        "committed_archive_sha256",
        "committed_member_inventory"
      ],
      "actual_changed_fields": [
        "git_commit",
        "source_inventory",
        "committed_archive_sha256",
        "committed_member_inventory"
      ],
      "observed_receipt": {
        "git_commit": "b9f1980c05e4f0b860b072c52570ae123ccc6d61",
        "source_inventory": {
          "README.md": "c16c9afc4f7386e3bc98f5e0418d59070001b878b5f1e4a47fda49e820c44d65",
          "SKILL.md": "7d2b9e603da2b013b17d1b86fd923553699fd7cb355544ae460d3911f87fdef3",
          "archives/alternate-notes.zip": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
          "archives/notes.zip": "9a19eac65a5763cb7eb06bf6e2650cfe910e15b213a2cd245d56c19d91939855"
        },
        "skill_sha256": "7d2b9e603da2b013b17d1b86fd923553699fd7cb355544ae460d3911f87fdef3",
        "readme_sha256": "c16c9afc4f7386e3bc98f5e0418d59070001b878b5f1e4a47fda49e820c44d65",
        "committed_archive_sha256": "9a19eac65a5763cb7eb06bf6e2650cfe910e15b213a2cd245d56c19d91939855",
        "committed_member_inventory": {
          "notes.txt": "d600ac93cf63eaf7edd43046acf9a32ee22fd4f415a37ab2efbd1231b22444fa"
        },
        "external_archive_sha256": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
        "external_member_inventory": {
          "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
        },
        "installed_inventory": {
          "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
        }
      }
    },
    {
      "case": "external_url_bytes_changed",
      "status": "pass",
      "hypothetical_external_artifact_case": true,
      "expected_controls": {
        "skill_only_matches": true,
        "commit_only_matches": true,
        "full_receipt_matches": false
      },
      "observed_controls": {
        "skill_only_matches": true,
        "commit_only_matches": true,
        "full_receipt_matches": false
      },
      "expected_changed_fields": [
        "external_archive_sha256",
        "external_member_inventory"
      ],
      "actual_changed_fields": [
        "external_archive_sha256",
        "external_member_inventory"
      ],
      "observed_receipt": {
        "git_commit": "ce46ae46601acfcfef46bf7ace19499973cbeb8f",
        "source_inventory": {
          "README.md": "c16c9afc4f7386e3bc98f5e0418d59070001b878b5f1e4a47fda49e820c44d65",
          "SKILL.md": "7d2b9e603da2b013b17d1b86fd923553699fd7cb355544ae460d3911f87fdef3",
          "archives/alternate-notes.zip": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
          "archives/notes.zip": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1"
        },
        "skill_sha256": "7d2b9e603da2b013b17d1b86fd923553699fd7cb355544ae460d3911f87fdef3",
        "readme_sha256": "c16c9afc4f7386e3bc98f5e0418d59070001b878b5f1e4a47fda49e820c44d65",
        "committed_archive_sha256": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
        "committed_member_inventory": {
          "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
        },
        "external_archive_sha256": "9a19eac65a5763cb7eb06bf6e2650cfe910e15b213a2cd245d56c19d91939855",
        "external_member_inventory": {
          "notes.txt": "d600ac93cf63eaf7edd43046acf9a32ee22fd4f415a37ab2efbd1231b22444fa"
        },
        "installed_inventory": {
          "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
        }
      }
    },
    {
      "case": "copied_inventory_changed",
      "status": "pass",
      "hypothetical_external_artifact_case": false,
      "expected_controls": {
        "skill_only_matches": true,
        "commit_only_matches": true,
        "full_receipt_matches": false
      },
      "observed_controls": {
        "skill_only_matches": true,
        "commit_only_matches": true,
        "full_receipt_matches": false
      },
      "expected_changed_fields": [
        "installed_inventory"
      ],
      "actual_changed_fields": [
        "installed_inventory"
      ],
      "observed_receipt": {
        "git_commit": "ce46ae46601acfcfef46bf7ace19499973cbeb8f",
        "source_inventory": {
          "README.md": "c16c9afc4f7386e3bc98f5e0418d59070001b878b5f1e4a47fda49e820c44d65",
          "SKILL.md": "7d2b9e603da2b013b17d1b86fd923553699fd7cb355544ae460d3911f87fdef3",
          "archives/alternate-notes.zip": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
          "archives/notes.zip": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1"
        },
        "skill_sha256": "7d2b9e603da2b013b17d1b86fd923553699fd7cb355544ae460d3911f87fdef3",
        "readme_sha256": "c16c9afc4f7386e3bc98f5e0418d59070001b878b5f1e4a47fda49e820c44d65",
        "committed_archive_sha256": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
        "committed_member_inventory": {
          "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
        },
        "external_archive_sha256": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
        "external_member_inventory": {
          "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
        },
        "installed_inventory": {
          "notes.txt": "d600ac93cf63eaf7edd43046acf9a32ee22fd4f415a37ab2efbd1231b22444fa"
        }
      }
    },
    {
      "case": "benign_zip_repack",
      "status": "pass",
      "hypothetical_external_artifact_case": true,
      "expected_controls": {
        "skill_only_matches": true,
        "commit_only_matches": true,
        "full_receipt_matches": false
      },
      "observed_controls": {
        "skill_only_matches": true,
        "commit_only_matches": true,
        "full_receipt_matches": false
      },
      "expected_changed_fields": [
        "external_archive_sha256"
      ],
      "actual_changed_fields": [
        "external_archive_sha256"
      ],
      "observed_receipt": {
        "git_commit": "ce46ae46601acfcfef46bf7ace19499973cbeb8f",
        "source_inventory": {
          "README.md": "c16c9afc4f7386e3bc98f5e0418d59070001b878b5f1e4a47fda49e820c44d65",
          "SKILL.md": "7d2b9e603da2b013b17d1b86fd923553699fd7cb355544ae460d3911f87fdef3",
          "archives/alternate-notes.zip": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
          "archives/notes.zip": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1"
        },
        "skill_sha256": "7d2b9e603da2b013b17d1b86fd923553699fd7cb355544ae460d3911f87fdef3",
        "readme_sha256": "c16c9afc4f7386e3bc98f5e0418d59070001b878b5f1e4a47fda49e820c44d65",
        "committed_archive_sha256": "926cb4bf92e959e2f97d448103023e794b8b53ad38fb75518f52b6fbabdcb9a1",
        "committed_member_inventory": {
          "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
        },
        "external_archive_sha256": "13ec790df37a00ce15c8c042ab62ee21e4be65489094fd02d0c9fbcc643d5b21",
        "external_member_inventory": {
          "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
        },
        "installed_inventory": {
          "notes.txt": "490f63c2951fd2b21f0d35653098efceeaee93885bccfcd01357c59057b0fd95"
        }
      }
    }
  ],
  "checks": [
    "unchanged: exact changed fields",
    "unchanged: observed control outcomes",
    "unchanged: trusted receipt unchanged",
    "unchanged: committed source tree clean",
    "readme_destination_changed: exact changed fields",
    "readme_destination_changed: observed control outcomes",
    "readme_destination_changed: trusted receipt unchanged",
    "readme_destination_changed: committed source tree clean",
    "committed_zip_changed: exact changed fields",
    "committed_zip_changed: observed control outcomes",
    "committed_zip_changed: trusted receipt unchanged",
    "committed_zip_changed: committed source tree clean",
    "external_url_bytes_changed: exact changed fields",
    "external_url_bytes_changed: observed control outcomes",
    "external_url_bytes_changed: trusted receipt unchanged",
    "external_url_bytes_changed: committed source tree clean",
    "copied_inventory_changed: exact changed fields",
    "copied_inventory_changed: observed control outcomes",
    "copied_inventory_changed: trusted receipt unchanged",
    "copied_inventory_changed: committed source tree clean",
    "benign_zip_repack: exact changed fields",
    "benign_zip_repack: observed control outcomes",
    "benign_zip_repack: trusted receipt unchanged",
    "benign_zip_repack: committed source tree clean"
  ],
  "limits": [
    "Identity consistency is not a malware verdict. Equal hashes do not make bytes benign.",
    "Every candidate file contains harmless synthetic text; no candidate is executed.",
    "External URL cases are hypothetical extensions, modeled with local files and no network.",
    "A Git commit binds a committed archive in that snapshot, not bytes served by an external URL.",
    "The trusted receipt is generated from the lab baseline, not from a real security review.",
    "Inventories cover regular file paths and content hashes, not permissions, symlinks or runtime behavior.",
    "The installed-file check follows a safe copy of known text; it does not authorize running an unknown installer first.",
    "The lab does not test agents, approvals, sandbox enforcement, signatures, update systems or TOCTOU defenses.",
    "A benign repack changes archive bytes without changing member contents; a mismatch requires explanation, not a malware label."
  ]
}