@marinjursic/prc-linux-arm64 0.1.0

package/bin/docs/scanner/supply-chain.md

@@ -0,0 +1,132 @@
+# Software supply-chain profile
+
+The focused `prc/supply-chain@0.2` profile combines repository-native checks
+with two executed analysis gates:
+
+- `PRC-A-SUPPLY-001` generates a normalized CycloneDX 1.7 software bill of
+  materials from the sealed repository inventory with Syft 1.51.0; and
+- `PRC-A-SUPPLY-002` checks packages discoverable in that same inventory for
+  known vulnerabilities with Grype 0.116.1 and a fresh, identity-bound offline
+  database.
+
+Both run only in the explicit `verify-local` capability mode. The scanner never
+pulls images or downloads vulnerability data during a scan.
+
+## Prepare the immutable tools and database
+
+Pull the two reviewed images by immutable digest:
+
+```bash
+docker pull \
+  ghcr.io/anchore/syft@sha256:d2dc3ec86cb2b4e7ddb226ba0305c4523b7c0694c45d9f576b42b4c2f5ce7aa8
+docker pull \
+  ghcr.io/anchore/grype@sha256:1e71065c0a4cff3e6bd3b8add525ffac4343eb4971694eb90a31cf6d4d3e85db
+```
+
+Database acquisition is a separate, explicitly networked operator action. The
+following command asks the exact reviewed Grype image to download and validate
+the current database into an operator-controlled directory:
+
+```bash
+mkdir -m 0700 /safe/path/grype-db
+
+docker run --rm --pull=never \
+  --user "$(id -u):$(id -g)" \
+  --mount type=bind,src=/safe/path/grype-db,dst=/grype-db \
+  --env GRYPE_CHECK_FOR_APP_UPDATE=false \
+  --env GRYPE_DB_CACHE_DIR=/grype-db \
+  ghcr.io/anchore/grype@sha256:1e71065c0a4cff3e6bd3b8add525ffac4343eb4971694eb90a31cf6d4d3e85db \
+  db update
+```
+
+Review this acquisition in environments with egress or software-source policy.
+The scan itself mounts the resulting directory read-only, runs with
+`--network=none`, verifies the database's official archive checksum, and rejects
+a database built more than 120 hours earlier. Refresh it before that boundary.
+
+## Run both gates
+
+```bash
+mkdir -m 0700 /safe/path/prc-state
+
+prc scan \
+  --target PATH \
+  --catalog-root PATH_TO_RELEASE \
+  --profile prc/supply-chain \
+  --mode verify-local \
+  --adapter-manifest PATH_TO_RELEASE/adapters/syft-v1.51.0.yaml \
+  --adapter-manifest PATH_TO_RELEASE/adapters/grype-v0.116.1.yaml \
+  --adapter-data 'prc.adapter.grype@0.116/grype-db=/safe/path/grype-db' \
+  --state-dir /safe/path/prc-state \
+  --format json
+```
+
+The complete adapter set is authorized before either container starts. It runs
+in deterministic adapter-ID and manifest-digest order under one configured
+deadline. The database directory is hashed before planning and before and after
+execution; its digest, file count, byte count, and reserved container
+destination are recorded without persisting the host path.
+
+Each transcript contains a `sha256:` artifact descriptor. With `--state-dir`,
+the corresponding immutable payload is stored at:
+
+```text
+/safe/path/prc-state/artifacts/sha256/<first-two-hex>/<sha256-hex>
+```
+
+The SBOM uses
+`application/vnd.cyclonedx+json;version=1.7`. The vulnerability report uses
+`application/vnd.prc.grype.vulnerability-report+json;version=1` and the public
+`schemas/grype-vulnerability-report.schema.json` contract.
+
+## What the gates prove
+
+The generated-SBOM assertion passes only when the exact catalog-pinned Syft
+manifest produces a completed `sbom-generation` observation with the configured
+`value` outcome. For identical sealed input, the normalizer removes Syft's
+generation timestamp, document serial number, and source component `bom-ref`,
+then canonically orders the retained component, file, license, hash, package
+URL, and dependency content.
+
+The known-vulnerability assertion passes only when the exact catalog-pinned
+Grype manifest reports `not_found`. Any `found` observation fails the critical
+gate. The normalized result retains vulnerability and alias identity, affected
+package and locations, severity, best available CVSS and EPSS values, CISA KEV
+and known-ransomware flags, Grype risk, fix state and versions, and database
+build and provider provenance. Target `.grype.yaml`, VEX, and ignore policy
+cannot suppress the scanner-owned analysis; any ignored match or unsupported
+package alert makes the adapter fail closed.
+
+The engine, not either tool, maps these factual outcomes to Pass or Fail. Both
+executions remain bound to the inventory, snapshot, manifest, image, command,
+artifact, and external-data digests.
+
+## Profile coverage
+
+In addition to the two executed analysis gates, the profile checks:
+
+- repository license presence;
+- dependency lock or checksum coverage and nonempty dependency inputs;
+- configured dependency-update automation;
+- immutable GitHub Actions references;
+- declared runtime versions;
+- immutable container base references; and
+- locked Terraform provider selections.
+
+## Deliberate limitations
+
+This is source-repository analysis, not analysis of a compiled binary, container
+image, installer, deployment bundle, or exact production release. Discovery is
+limited by Syft and Grype cataloger coverage and the scanner's regular-file
+inventory. A clean result is time-bound to the recorded database and does not
+prove that no vulnerability exists, that every dependency is reachable, that
+the built artifact matches the source tree, or that severity and exploitability
+metadata are complete. Vulnerability feeds, package matching, aliases, fixes,
+CVSS, EPSS, KEV, and risk can contain delays, false positives, false negatives,
+or incomplete data. License compatibility, provenance, signatures, runtime
+configuration, and deployed equivalence remain separate assertions.
+
+See the [CycloneDX specification](https://github.com/CycloneDX/specification),
+[Syft v1.51.0 release](https://github.com/anchore/syft/releases/tag/v1.51.0),
+[Grype v0.116.1 release](https://github.com/anchore/grype/releases/tag/v0.116.1),
+and [Grype database documentation](https://oss.anchore.com/docs/guides/vulnerability/database/).

package/bin/docs/scanner/test-discovery.md

@@ -0,0 +1,60 @@
+# Test discovery evidence
+
+`PRC-A-CORE-010` uses `prc.native.test-suite@0.2` to distinguish a
+collectable test declaration from a file that merely has a test-looking name.
+The check reads only inventory-bound repository bytes and never imports code or
+runs a test command.
+
+## What passes
+
+The assertion passes when the scanner verifies either:
+
+- a conventional test path containing a supported language or framework test
+  declaration; or
+- a `package.json` `scripts.test` value that is a nonempty, non-placeholder
+  command.
+
+The native recognizer covers conventional Go `TestXxx(*testing.T)` functions,
+pytest-style `test_` functions, JavaScript and TypeScript `test(...)` or
+`it(...)` declarations, and bounded declaration patterns for common Rust,
+Ruby, JVM, .NET, PHP, Swift, C, C++, and Scala frameworks. A malformed file,
+empty file, comment-only file, skipped JavaScript declaration, or the default
+`no test specified` npm placeholder does not pass.
+
+The conventions follow the [Go testing contract](https://go.dev/doc/code#Testing)
+and [pytest collection rules](https://docs.pytest.org/en/stable/explanation/goodpractices.html#conventions-for-python-test-discovery).
+Package scripts are treated only as declarations; their contents are not run.
+
+## R2 proposal boundary
+
+The scanner-owned missing-test task is narrower than general recognition. It
+currently plans new tests only for Go, Python, JavaScript, and TypeScript source
+files. Before creating a candidate workspace, the anti-gaming audit reconstructs
+the proposed test from the validated patch and requires:
+
+1. a conventional path;
+2. a collectable test declaration;
+3. a recognized behavioral assertion or failure check;
+4. no suppression, skip, constant assertion, or modification to an existing
+   test or specification file.
+
+This prevents an agent from closing the discovery finding with an empty,
+comment-only, invocation-only, skipped, or constant-assertion test. The
+candidate is then rescanned from fresh bytes and must close the exact finding
+without regressing a baseline pass.
+
+## Deliberate limitation
+
+Static discovery does not establish that the test compiles, executes, is
+deterministic, covers important behavior, or would fail for the defect it is
+intended to catch. The current R2 path therefore remains experimental and does
+not edit production code. It independently runs scanner-owned Go, Python, or
+plain-JavaScript test commands in a digest-pinned, network-denied OCI sandbox
+before acceptance.
+Test-first mutation evidence, stronger coverage oracles, and ecosystem-specific
+verifiers are still required before broader autonomous remediation can rely on
+this assertion.
+
+The comprehensive core benchmark includes positive and negative cases for a
+real declaration, a test-looking file without a declaration, a meaningful
+package test command, and the default placeholder command.

package/bin/docs/stylesheets/extra.css

@@ -0,0 +1,183 @@
+:root {
+  --md-primary-fg-color: #3730a3;
+  --md-primary-fg-color--light: #4f46e5;
+  --md-primary-fg-color--dark: #312e81;
+  --md-accent-fg-color: #0f766e;
+}
+
+[data-md-color-scheme="slate"] {
+  --md-accent-fg-color: #5eead4;
+}
+
+.md-typeset h1 {
+  font-weight: 700;
+  letter-spacing: -0.02em;
+}
+
+.md-typeset h2 {
+  font-weight: 650;
+  letter-spacing: -0.012em;
+}
+
+.md-typeset blockquote {
+  border-left-color: var(--md-accent-fg-color);
+}
+
+.task-list-control input[type="checkbox"] {
+  accent-color: var(--md-accent-fg-color);
+}
+
+.md-typeset table:not([class]) {
+  border-radius: 0.2rem;
+  box-shadow: 0 0 0 1px var(--md-typeset-table-color);
+  display: table;
+  width: 100%;
+}
+
+.md-typeset table:not([class]) th {
+  background: color-mix(in srgb, var(--md-primary-fg-color) 9%, transparent);
+  font-weight: 650;
+}
+
+.md-typeset table:not([class]) td,
+.md-typeset table:not([class]) th {
+  padding: 0.7em 0.9em;
+  vertical-align: top;
+}
+
+.md-header__source {
+  height: 1.8rem;
+  margin-left: 0.5rem;
+  width: auto;
+}
+
+.prc-header-star {
+  align-items: center;
+  border: 1px solid currentColor;
+  border-radius: 0.25rem;
+  box-sizing: border-box;
+  color: inherit;
+  display: inline-flex;
+  font-weight: 650;
+  gap: 0.3rem;
+  height: 1.8rem;
+  justify-content: center;
+  line-height: 1;
+  opacity: 0.94;
+  padding: 0 0.55rem;
+  text-decoration: none;
+  vertical-align: top;
+}
+
+.prc-header-star:hover,
+.prc-header-star:focus-visible {
+  background: rgb(255 255 255 / 12%);
+  opacity: 1;
+}
+
+.prc-header-star__icon {
+  display: block;
+  flex: 0 0 1rem;
+  height: 1rem;
+  width: 1rem;
+}
+
+.prc-header-star__icon svg {
+  display: block;
+  height: 100%;
+  margin: 0;
+  width: 100%;
+}
+
+.prc-header-star__label {
+  display: block;
+  font-size: 0.7rem;
+}
+
+.prc-footer-meta {
+  align-items: center;
+  gap: 0.6rem;
+}
+
+.prc-footer-actions {
+  align-items: center;
+  display: flex;
+  gap: 0.15rem;
+  margin-left: auto;
+}
+
+.prc-footer-star {
+  align-items: center;
+  border-radius: 0.2rem;
+  color: var(--md-footer-fg-color--light);
+  display: inline-flex;
+  font-size: 0.64rem;
+  font-weight: 600;
+  gap: 0.3rem;
+  line-height: 1;
+  padding: 0.45rem 0.5rem;
+  text-decoration: none;
+}
+
+.prc-footer-star:hover,
+.prc-footer-star:focus-visible {
+  background: rgb(255 255 255 / 8%);
+  color: var(--md-footer-fg-color);
+}
+
+.prc-footer-star__icon {
+  display: block;
+  height: 0.8rem;
+  width: 0.8rem;
+}
+
+.prc-footer-star__icon svg {
+  display: block;
+  height: 100%;
+  width: 100%;
+}
+
+.prc-footer-actions .md-social {
+  margin: 0;
+  padding: 0;
+}
+
+:focus-visible {
+  outline: 3px solid var(--md-accent-fg-color);
+  outline-offset: 3px;
+}
+
+@media screen and (max-width: 44.984375em) {
+  .md-typeset table:not([class]) {
+    display: block;
+  }
+
+  .md-header__source,
+  .prc-header-star {
+    height: 1.7rem;
+  }
+
+  .prc-header-star {
+    padding: 0 0.4rem;
+  }
+
+  .prc-header-star__label {
+    display: none;
+  }
+
+  .prc-footer-meta {
+    align-items: flex-start;
+    flex-direction: column;
+    gap: 0.1rem;
+    padding: 0.6rem 0.8rem;
+  }
+
+  .prc-footer-meta .md-copyright,
+  .prc-footer-actions {
+    margin: 0;
+  }
+
+  .prc-footer-actions {
+    margin-left: 0;
+  }
+}

package/bin/fixtures/benchmarks/core-native/suite-comprehensive.yaml

@@ -0,0 +1,302 @@
+schema_version: prc.benchmark-suite/v0.2
+id: prc.benchmark.core-native@1.0
+title: Comprehensive core native assertion benchmark
+profile_id: prc/core-repository
+cases:
+  - id: baseline-state-space
+    target: targets/baseline
+    expectations:
+      - {assertion_id: PRC-A-CORE-001, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-002, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-003, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-004, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-005, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-006, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-007, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-CORE-008, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-CORE-009, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-010, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-011, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-CORE-012, assessment: manual_review, execution: completed}
+      - {assertion_id: PRC-A-CORE-013, assessment: unknown, execution: blocked}
+      - {assertion_id: PRC-A-CORE-014, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-015, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-016, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-CORE-017, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-CORE-018, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-CORE-019, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-CORE-020, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-CORE-021, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-022, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-023, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-CORE-024, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-CORE-025, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-CORE-026, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-CORE-027, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-CORE-028, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-CORE-029, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-CORE-030, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-K8S-001, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-K8S-002, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-K8S-003, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-K8S-004, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-CORE-031, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-GO-001, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-GO-002, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-API-001, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-API-002, assessment: not_applicable, execution: not_run}
+      - {assertion_id: PRC-A-API-003, assessment: not_applicable, execution: not_run}
+  - id: foundation-present
+    target: targets/foundation-present
+    expectations:
+      - {assertion_id: PRC-A-CORE-001, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-002, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-003, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-004, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-005, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-006, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-007, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-008, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-009, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-010, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-011, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-012, assessment: manual_review, execution: completed}
+      - {assertion_id: PRC-A-CORE-013, assessment: unknown, execution: blocked}
+      - {assertion_id: PRC-A-CORE-014, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-015, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-016, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-017, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-018, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-019, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-020, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-021, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-022, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-023, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-024, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-025, assessment: pass, execution: completed}
+  - id: readme-missing
+    target: targets/readme-missing
+    expectations:
+      - {assertion_id: PRC-A-CORE-001, assessment: fail, execution: completed}
+  - id: test-declaration-valid
+    target: targets/test-declaration-valid
+    expectations:
+      - {assertion_id: PRC-A-CORE-010, assessment: pass, execution: completed}
+  - id: test-path-without-declaration
+    target: targets/test-path-without-declaration
+    expectations:
+      - {assertion_id: PRC-A-CORE-010, assessment: fail, execution: completed}
+  - id: package-test-command
+    target: targets/package-test-command
+    expectations:
+      - {assertion_id: PRC-A-CORE-010, assessment: pass, execution: completed}
+  - id: package-test-placeholder
+    target: targets/package-test-placeholder
+    expectations:
+      - {assertion_id: PRC-A-CORE-010, assessment: fail, execution: completed}
+  - id: dependency-lock-present
+    target: targets/dependency-lock-present
+    expectations:
+      - {assertion_id: PRC-A-CORE-007, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-023, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-024, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-025, assessment: pass, execution: completed}
+  - id: dependency-lock-missing
+    target: targets/dependency-lock-missing
+    expectations:
+      - {assertion_id: PRC-A-CORE-007, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-016, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-023, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-024, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-025, assessment: pass, execution: completed}
+  - id: runtime-missing
+    target: targets/runtime-missing
+    expectations:
+      - {assertion_id: PRC-A-CORE-025, assessment: fail, execution: completed}
+  - id: workflow-valid
+    target: targets/workflow-valid
+    expectations:
+      - {assertion_id: PRC-A-CORE-008, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-009, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-011, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-017, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-018, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-019, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-020, assessment: pass, execution: completed}
+  - id: workflow-risky
+    target: targets/workflow-risky
+    expectations:
+      - {assertion_id: PRC-A-CORE-008, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-011, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-017, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-018, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-019, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-020, assessment: manual_review, execution: completed}
+  - id: workflow-no-jobs
+    target: targets/workflow-no-jobs
+    expectations:
+      - {assertion_id: PRC-A-CORE-017, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-018, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-019, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-020, assessment: pass, execution: completed}
+  - id: workflow-malformed
+    target: targets/workflow-malformed
+    expectations:
+      - {assertion_id: PRC-A-CORE-011, assessment: unknown, execution: error}
+      - {assertion_id: PRC-A-CORE-017, assessment: unknown, execution: error}
+      - {assertion_id: PRC-A-CORE-018, assessment: unknown, execution: error}
+      - {assertion_id: PRC-A-CORE-019, assessment: unknown, execution: error}
+      - {assertion_id: PRC-A-CORE-020, assessment: unknown, execution: error}
+  - id: container-valid
+    target: targets/container-valid
+    expectations:
+      - {assertion_id: PRC-A-CORE-026, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-027, assessment: pass, execution: completed}
+  - id: container-risky
+    target: targets/container-risky-template
+    setup:
+      - {operation: replace_text, path: Dockerfile, find: scratch, replace: "alpine:latest"}
+      - {operation: replace_text, path: Dockerfile, find: "65532", replace: root}
+    expectations:
+      - {assertion_id: PRC-A-CORE-026, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-027, assessment: fail, execution: completed}
+  - id: terraform-locked
+    target: targets/terraform-locked
+    expectations:
+      - {assertion_id: PRC-A-CORE-028, assessment: pass, execution: completed}
+  - id: terraform-unlocked
+    target: targets/terraform-unlocked-template
+    setup:
+      - {operation: truncate, path: .terraform.lock.hcl}
+    expectations:
+      - {assertion_id: PRC-A-CORE-028, assessment: fail, execution: completed}
+  - id: kubernetes-valid
+    target: targets/kubernetes-valid
+    expectations:
+      - {assertion_id: PRC-A-CORE-029, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-CORE-030, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-K8S-001, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-K8S-002, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-K8S-003, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-K8S-004, assessment: pass, execution: completed}
+  - id: kubernetes-risky
+    target: targets/kubernetes-risky-template
+    setup:
+      - {operation: replace_text, path: deployment.yaml, find: "runAsNonRoot: true", replace: "runAsUser: 0"}
+      - {operation: replace_text, path: deployment.yaml, find: "requests:", replace: "fixtureRequests:"}
+      - {operation: replace_text, path: deployment.yaml, find: "limits:", replace: "fixtureLimits:"}
+      - {operation: replace_text, path: deployment.yaml, find: "hostNetwork: false", replace: "hostNetwork: true"}
+      - {operation: replace_text, path: deployment.yaml, find: "privileged: false", replace: "privileged: true"}
+      - {operation: replace_text, path: deployment.yaml, find: "allowPrivilegeEscalation: false", replace: "allowPrivilegeEscalation: true"}
+      - {operation: replace_text, path: deployment.yaml, find: "drop: [ALL]", replace: "drop: [CHOWN]"}
+      - {operation: replace_text, path: deployment.yaml, find: "type: RuntimeDefault", replace: "type: Unconfined"}
+    expectations:
+      - {assertion_id: PRC-A-CORE-029, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-CORE-030, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-K8S-001, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-K8S-002, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-K8S-003, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-K8S-004, assessment: fail, execution: completed}
+  - id: private-key-materialized
+    target: targets/private-key-template
+    setup:
+      - {operation: replace_text, path: deploy.pem, find: BEGIN FIXTURE, replace: BEGIN PRIVATE}
+      - {operation: replace_text, path: deploy.pem, find: END FIXTURE, replace: END PRIVATE}
+    expectations:
+      - {assertion_id: PRC-A-CORE-031, assessment: fail, execution: completed}
+  - id: conflict-markers-materialized
+    target: targets/conflict-template
+    setup:
+      - {operation: replace_text, path: app.js, find: PRC_CONFLICT_START, replace: "<<<<<<< HEAD"}
+      - {operation: replace_text, path: app.js, find: PRC_CONFLICT_MIDDLE, replace: "======="}
+      - {operation: replace_text, path: app.js, find: PRC_CONFLICT_END, replace: ">>>>>>> feature"}
+    expectations:
+      - {assertion_id: PRC-A-CORE-021, assessment: fail, execution: completed}
+  - id: empty-manifest-materialized
+    target: targets/empty-manifest-template
+    setup:
+      - {operation: truncate, path: package.json}
+    expectations:
+      - {assertion_id: PRC-A-CORE-023, assessment: fail, execution: completed}
+  - id: final-newline-materialized
+    target: targets/final-newline-template
+    setup:
+      - {operation: remove_final_newline, path: app.py}
+    expectations:
+      - {assertion_id: PRC-A-CORE-014, assessment: fail, execution: completed}
+  - id: git-head-materialized
+    target: targets/baseline
+    setup:
+      - {operation: git_head, value: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa}
+    expectations:
+      - {assertion_id: PRC-A-CORE-015, assessment: pass, execution: completed}
+  - id: writable-mode-materialized
+    target: targets/baseline
+    setup:
+      - {operation: chmod, path: app.go, mode: 438}
+    expectations:
+      - {assertion_id: PRC-A-CORE-022, assessment: fail, execution: completed}
+  - id: go-http-timeout-safe
+    target: targets/go-http-timeout-safe
+    expectations:
+      - {assertion_id: PRC-A-GO-001, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-GO-002, assessment: pass, execution: completed}
+  - id: go-http-timeout-risky
+    target: targets/go-http-timeout-risky-template
+    setup:
+      - {operation: replace_text, path: client.go, find: client.Get, replace: web.Get}
+    expectations:
+      - {assertion_id: PRC-A-GO-001, assessment: fail, execution: completed}
+  - id: go-http-timeout-malformed
+    target: targets/go-http-timeout-malformed-template
+    setup:
+      - {operation: replace_text, path: client.go, find: "// PRC_INVALID_GO_TOKEN", replace: "func broken( {"}
+    expectations:
+      - {assertion_id: PRC-A-GO-001, assessment: unknown, execution: error}
+      - {assertion_id: PRC-A-GO-002, assessment: unknown, execution: error}
+  - id: go-http-server-timeout-risky
+    target: targets/go-http-server-timeout-risky-template
+    setup:
+      - {operation: replace_text, path: server.go, find: server.ListenAndServe(), replace: 'http.ListenAndServe(":8080", nil)'}
+    expectations:
+      - {assertion_id: PRC-A-GO-002, assessment: fail, execution: completed}
+  - id: openapi-root-valid
+    target: targets/openapi-root-valid
+    expectations:
+      - {assertion_id: PRC-A-API-001, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-API-002, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-API-003, assessment: pass, execution: completed}
+  - id: openapi-root-risky
+    target: targets/openapi-root-risky-template
+    setup:
+      - {operation: replace_text, path: openapi.yaml, find: 'title: Example API', replace: 'title: ""'}
+    expectations:
+      - {assertion_id: PRC-A-API-001, assessment: fail, execution: completed}
+  - id: openapi-root-malformed
+    target: targets/openapi-root-malformed-template
+    setup:
+      - {operation: replace_text, path: openapi.yaml, find: 'openapi: 3.2.0', replace: 'openapi: ['}
+    expectations:
+      - {assertion_id: PRC-A-API-001, assessment: unknown, execution: error}
+      - {assertion_id: PRC-A-API-002, assessment: unknown, execution: error}
+      - {assertion_id: PRC-A-API-003, assessment: unknown, execution: error}
+  - id: openapi-operation-responses-risky
+    target: targets/openapi-operation-responses-risky-template
+    setup:
+      - {operation: replace_text, path: openapi.yaml, find: '"200":', replace: 'x-internal-note:'}
+    expectations:
+      - {assertion_id: PRC-A-API-002, assessment: fail, execution: completed}
+      - {assertion_id: PRC-A-API-003, assessment: pass, execution: completed}
+  - id: openapi-operation-ids-risky
+    target: targets/openapi-operation-ids-risky-template
+    setup:
+      - {operation: replace_text, path: openapi.yaml, find: getStatus, replace: duplicateOperation}
+    expectations:
+      - {assertion_id: PRC-A-API-002, assessment: pass, execution: completed}
+      - {assertion_id: PRC-A-API-003, assessment: fail, execution: completed}
+quality_budget:
+  minimum_precision: 1
+  minimum_recall: 1
+  maximum_false_positive_rate: 0
+  maximum_mismatches: 0
+  require_determinism: true