@marinjursic/prc-linux-arm64 0.1.0

package/bin/fixtures/benchmarks/core-native/suite.yaml

@@ -0,0 +1,59 @@
+schema_version: prc.benchmark-suite/v0.1
+id: prc.benchmark.core-native@0.1
+title: Core native assertion benchmark
+profile_id: prc/core-repository
+cases:
+  - id: baseline-outcomes
+    target: targets/baseline
+    expectations:
+      - assertion_id: PRC-A-CORE-001
+        assessment: pass
+        execution: completed
+      - assertion_id: PRC-A-CORE-007
+        assessment: not_applicable
+        execution: not_run
+      - assertion_id: PRC-A-CORE-012
+        assessment: manual_review
+        execution: completed
+      - assertion_id: PRC-A-CORE-013
+        assessment: unknown
+        execution: blocked
+      - assertion_id: PRC-A-CORE-017
+        assessment: not_applicable
+        execution: not_run
+  - id: dependency-lock-present
+    target: targets/dependency-lock-present
+    expectations:
+      - assertion_id: PRC-A-CORE-007
+        assessment: pass
+        execution: completed
+  - id: dependency-lock-missing
+    target: targets/dependency-lock-missing
+    expectations:
+      - assertion_id: PRC-A-CORE-007
+        assessment: fail
+        execution: completed
+  - id: readme-missing
+    target: targets/readme-missing
+    expectations:
+      - assertion_id: PRC-A-CORE-001
+        assessment: fail
+        execution: completed
+  - id: workflow-malformed
+    target: targets/workflow-malformed
+    expectations:
+      - assertion_id: PRC-A-CORE-017
+        assessment: unknown
+        execution: error
+  - id: workflow-valid
+    target: targets/workflow-valid
+    expectations:
+      - assertion_id: PRC-A-CORE-017
+        assessment: pass
+        execution: completed
+quality_budget:
+  minimum_precision: 1
+  minimum_recall: 1
+  maximum_false_positive_rate: 0
+  maximum_mismatches: 0
+  require_determinism: true

package/bin/fixtures/benchmarks/core-native/targets/baseline/README.md

@@ -0,0 +1,3 @@
+# Benchmark baseline
+
+This fixture exercises repository, inapplicable, manual, and blocked outcomes.

package/bin/fixtures/benchmarks/core-native/targets/baseline/app.go

@@ -0,0 +1 @@
+package benchmarkfixture

package/bin/fixtures/benchmarks/core-native/targets/conflict-template/app.js

@@ -0,0 +1,5 @@
+PRC_CONFLICT_START
+export const environment = "production";
+PRC_CONFLICT_MIDDLE
+export const environment = "staging";
+PRC_CONFLICT_END

package/bin/fixtures/benchmarks/core-native/targets/container-risky-template/Dockerfile

@@ -0,0 +1,2 @@
+FROM scratch
+USER 65532

package/bin/fixtures/benchmarks/core-native/targets/container-valid/Dockerfile

@@ -0,0 +1,2 @@
+FROM scratch
+USER 65532

package/bin/fixtures/benchmarks/core-native/targets/dependency-lock-missing/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "benchmark-lock-missing",
+  "version": "1.0.0",
+  "engines": {"node": ">=22"}
+}

package/bin/fixtures/benchmarks/core-native/targets/dependency-lock-present/package-lock.json

@@ -0,0 +1,6 @@
+{
+  "name": "benchmark-lock-present",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "packages": {}
+}

package/bin/fixtures/benchmarks/core-native/targets/dependency-lock-present/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "benchmark-lock-present",
+  "version": "1.0.0",
+  "engines": {"node": ">=22"}
+}

package/bin/fixtures/benchmarks/core-native/targets/empty-manifest-template/package.json

@@ -0,0 +1 @@
+{}

package/bin/fixtures/benchmarks/core-native/targets/final-newline-template/app.py

@@ -0,0 +1 @@
+print("materialized fixture")

package/bin/fixtures/benchmarks/core-native/targets/foundation-present/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @fixture-maintainer

package/bin/fixtures/benchmarks/core-native/targets/foundation-present/.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly

package/bin/fixtures/benchmarks/core-native/targets/foundation-present/.github/workflows/validate.yml

@@ -0,0 +1,15 @@
+name: Validate foundation fixture
+
+on:
+  push:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - run: npm test

package/bin/fixtures/benchmarks/core-native/targets/foundation-present/CODE_OF_CONDUCT.md

@@ -0,0 +1,3 @@
+# Code of conduct
+
+Be respectful and constructive.

package/bin/fixtures/benchmarks/core-native/targets/foundation-present/CONTRIBUTING.md

@@ -0,0 +1,3 @@
+# Contributing
+
+Run the fixture tests before proposing a change.

package/bin/fixtures/benchmarks/core-native/targets/foundation-present/LICENSE

@@ -0,0 +1 @@
+MIT fixture license text.

package/bin/fixtures/benchmarks/core-native/targets/foundation-present/README.md

@@ -0,0 +1,3 @@
+# Complete foundation fixture
+
+This repository fixture includes the baseline project-governance files.

package/bin/fixtures/benchmarks/core-native/targets/foundation-present/SECURITY.md

@@ -0,0 +1,3 @@
+# Security
+
+Report security defects through the project's documented channel.

package/bin/fixtures/benchmarks/core-native/targets/foundation-present/package-lock.json

@@ -0,0 +1,6 @@
+{
+  "name": "benchmark-foundation",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "packages": {}
+}

package/bin/fixtures/benchmarks/core-native/targets/foundation-present/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "benchmark-foundation",
+  "version": "1.0.0",
+  "private": true,
+  "scripts": {"test": "node --test"},
+  "engines": {"node": ">=22"}
+}

package/bin/fixtures/benchmarks/core-native/targets/foundation-present/tests/example.test.js

@@ -0,0 +1,3 @@
+import test from "node:test";
+
+test("fixture", () => {});

package/bin/fixtures/benchmarks/core-native/targets/go-http-server-timeout-risky-template/go.mod

@@ -0,0 +1,3 @@
+module example.invalid/risky-server
+
+go 1.27

package/bin/fixtures/benchmarks/core-native/targets/go-http-server-timeout-risky-template/server.go

@@ -0,0 +1,18 @@
+package riskyserver
+
+import (
+	"net/http"
+	"time"
+)
+
+func serve() error {
+	server := http.Server{
+		Addr:              ":8080",
+		ReadHeaderTimeout: 5 * time.Second,
+		ReadTimeout:       30 * time.Second,
+		WriteTimeout:      30 * time.Second,
+		IdleTimeout:       60 * time.Second,
+	}
+	_ = server
+	return server.ListenAndServe()
+}

package/bin/fixtures/benchmarks/core-native/targets/go-http-timeout-malformed-template/client.go

@@ -0,0 +1,3 @@
+package malformed
+
+// PRC_INVALID_GO_TOKEN

package/bin/fixtures/benchmarks/core-native/targets/go-http-timeout-malformed-template/go.mod

@@ -0,0 +1,3 @@
+module example.invalid/malformed-client
+
+go 1.27

package/bin/fixtures/benchmarks/core-native/targets/go-http-timeout-risky-template/client.go

@@ -0,0 +1,7 @@
+package riskyclient
+
+import web "net/http"
+
+func fetch(client *web.Client) (*web.Response, error) {
+	return client.Get("https://example.invalid")
+}

package/bin/fixtures/benchmarks/core-native/targets/go-http-timeout-risky-template/go.mod

@@ -0,0 +1,3 @@
+module example.invalid/risky-client
+
+go 1.27

package/bin/fixtures/benchmarks/core-native/targets/go-http-timeout-safe/client.go

@@ -0,0 +1,22 @@
+package safeclient
+
+import (
+	"net/http"
+	"time"
+)
+
+func fetch() (*http.Response, error) {
+	client := http.Client{Timeout: 10 * time.Second}
+	return client.Get("https://example.invalid")
+}
+
+func serve() error {
+	server := http.Server{
+		Addr:              ":8080",
+		ReadHeaderTimeout: 5 * time.Second,
+		ReadTimeout:       30 * time.Second,
+		WriteTimeout:      30 * time.Second,
+		IdleTimeout:       60 * time.Second,
+	}
+	return server.ListenAndServe()
+}

package/bin/fixtures/benchmarks/core-native/targets/go-http-timeout-safe/go.mod

@@ -0,0 +1,3 @@
+module example.invalid/safe-client
+
+go 1.27

package/bin/fixtures/benchmarks/core-native/targets/go-http-timeout-safe/hazards_test.go

@@ -0,0 +1,8 @@
+package safeclient
+
+import "net/http"
+
+func testOnlyHelpers() error {
+	_, _ = http.Get("https://example.invalid")
+	return http.ListenAndServe(":8081", nil)
+}

package/bin/fixtures/benchmarks/core-native/targets/kubernetes-risky-template/deployment.yaml

@@ -0,0 +1,27 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: risky-template
+spec:
+  template:
+    spec:
+      hostNetwork: false
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: app
+          image: example.invalid/app@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
+          securityContext:
+            privileged: false
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+          resources:
+            requests:
+              cpu: 100m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 128Mi

package/bin/fixtures/benchmarks/core-native/targets/kubernetes-valid/deployment.yaml

@@ -0,0 +1,26 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: valid
+spec:
+  template:
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: app
+          image: example.invalid/app@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+          securityContext:
+            privileged: false
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+          resources:
+            requests:
+              cpu: 100m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 128Mi

package/bin/fixtures/benchmarks/core-native/targets/openapi-operation-ids-risky-template/openapi.yaml

@@ -0,0 +1,17 @@
+openapi: 3.2.0
+info:
+  title: Example API
+  version: 1.0.0
+paths:
+  /health:
+    get:
+      operationId: duplicateOperation
+      responses:
+        "200":
+          description: Healthy
+  /status:
+    get:
+      operationId: getStatus
+      responses:
+        "200":
+          description: Current service status

package/bin/fixtures/benchmarks/core-native/targets/openapi-operation-responses-risky-template/openapi.yaml

@@ -0,0 +1,11 @@
+openapi: 3.2.0
+info:
+  title: Example API
+  version: 1.0.0
+paths:
+  /health:
+    get:
+      operationId: getHealth
+      responses:
+        "200":
+          description: Healthy

package/bin/fixtures/benchmarks/core-native/targets/openapi-root-malformed-template/openapi.yaml

@@ -0,0 +1,5 @@
+openapi: 3.2.0
+info:
+  title: Example API
+  version: 1.0.0
+paths: {}

package/bin/fixtures/benchmarks/core-native/targets/openapi-root-risky-template/openapi.yaml

@@ -0,0 +1,5 @@
+openapi: 3.2.0
+info:
+  title: Example API
+  version: 1.0.0
+paths: {}

package/bin/fixtures/benchmarks/core-native/targets/openapi-root-valid/openapi.yaml

@@ -0,0 +1,17 @@
+openapi: 3.2.0
+info:
+  title: Example API
+  version: 1.0.0
+paths:
+  /health:
+    get:
+      operationId: getHealth
+      responses:
+        "200":
+          description: Healthy
+  /status:
+    get:
+      operationId: getStatus
+      responses:
+        default:
+          description: Current service status

package/bin/fixtures/benchmarks/core-native/targets/package-test-command/app.js

@@ -0,0 +1,3 @@
+export function ready() {
+  return true;
+}

package/bin/fixtures/benchmarks/core-native/targets/package-test-command/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "package-test-command-fixture",
+  "private": true,
+  "scripts": {
+    "test": "node --test"
+  }
+}

package/bin/fixtures/benchmarks/core-native/targets/package-test-placeholder/app.js

@@ -0,0 +1,3 @@
+export function ready() {
+  return true;
+}

package/bin/fixtures/benchmarks/core-native/targets/package-test-placeholder/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "package-test-placeholder-fixture",
+  "private": true,
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  }
+}

package/bin/fixtures/benchmarks/core-native/targets/private-key-template/deploy.pem

@@ -0,0 +1,3 @@
+-----BEGIN FIXTURE KEY-----
+QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB
+-----END FIXTURE KEY-----

package/bin/fixtures/benchmarks/core-native/targets/readme-missing/fixture.txt

@@ -0,0 +1 @@
+This target intentionally has no README file.

package/bin/fixtures/benchmarks/core-native/targets/runtime-missing/package-lock.json

@@ -0,0 +1,6 @@
+{
+  "name": "benchmark-runtime-missing",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "packages": {}
+}

package/bin/fixtures/benchmarks/core-native/targets/runtime-missing/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "benchmark-runtime-missing",
+  "version": "1.0.0"
+}

package/bin/fixtures/benchmarks/core-native/targets/terraform-locked/.terraform.lock.hcl

@@ -0,0 +1,3 @@
+provider "registry.terraform.io/hashicorp/null" {
+  version = "3.2.3"
+}

package/bin/fixtures/benchmarks/core-native/targets/terraform-locked/main.tf

@@ -0,0 +1,7 @@
+terraform {
+  required_providers {
+    null = {
+      source = "hashicorp/null"
+    }
+  }
+}

package/bin/fixtures/benchmarks/core-native/targets/terraform-unlocked-template/.terraform.lock.hcl

@@ -0,0 +1,3 @@
+provider "registry.terraform.io/hashicorp/null" {
+  version = "3.2.3"
+}

package/bin/fixtures/benchmarks/core-native/targets/terraform-unlocked-template/main.tf

@@ -0,0 +1,7 @@
+terraform {
+  required_providers {
+    null = {
+      source = "hashicorp/null"
+    }
+  }
+}

package/bin/fixtures/benchmarks/core-native/targets/test-declaration-valid/app.py

@@ -0,0 +1,2 @@
+def ready():
+    return True

package/bin/fixtures/benchmarks/core-native/targets/test-declaration-valid/tests/test_app.py

@@ -0,0 +1,5 @@
+from app import ready
+
+
+def test_ready():
+    assert ready() is True

package/bin/fixtures/benchmarks/core-native/targets/test-path-without-declaration/app.py

@@ -0,0 +1,2 @@
+def ready():
+    return True

package/bin/fixtures/benchmarks/core-native/targets/test-path-without-declaration/tests/test_app.py

@@ -0,0 +1 @@
+# This filename looks like a test, but it declares no collectable test.

package/bin/fixtures/benchmarks/core-native/targets/workflow-malformed/.github/workflows/validate.yml

@@ -0,0 +1 @@
+name: [malformed

package/bin/fixtures/benchmarks/core-native/targets/workflow-no-jobs/.github/workflows/empty.yml

@@ -0,0 +1,9 @@
+name: Empty workflow fixture
+
+on:
+  push:
+
+permissions:
+  contents: read
+
+jobs: {}

package/bin/fixtures/benchmarks/core-native/targets/workflow-risky/.github/workflows/risky.yml

@@ -0,0 +1,10 @@
+name: Risky fixture
+
+on:
+  pull_request_target:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4

package/bin/fixtures/benchmarks/core-native/targets/workflow-valid/.github/workflows/validate.yml

@@ -0,0 +1,14 @@
+name: Validate fixture
+
+on:
+  push:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

package/bin/packs/core-foundation.yaml

@@ -0,0 +1,25 @@
+schema_version: prc.pack/v0.1
+id: prc.pack.core-foundation@0.1
+title: Core repository validated foundation
+description: A small, measured foundation of deterministic repository checks.
+publisher_id: prc-project
+maintenance: active
+engine_apis: [prc.engine/v0.1]
+profile_ids: [prc/core-repository]
+assertions:
+  - assertion_id: PRC-A-CORE-001
+    implementation_id: prc.native.file-present@0.1
+    validated_outcomes: [pass, fail]
+  - assertion_id: PRC-A-CORE-007
+    implementation_id: prc.native.dependency-lock@0.1
+    validated_outcomes: [pass, fail, not_applicable]
+  - assertion_id: PRC-A-CORE-017
+    implementation_id: prc.native.github-workflow-valid@0.1
+    validated_outcomes: [pass, not_applicable, error]
+benchmark:
+  suite_id: prc.benchmark.core-native@0.1
+  suite_path: fixtures/benchmarks/core-native/suite.yaml
+  suite_sha256: 208c180313d0bd0b13d09eaca040eb967fb6664f205b283841f386b9cacd2e7d
+limitations:
+  - The pack covers only three native assertions and is not the complete core profile.
+  - The initial fixtures do not establish cross-platform or large-repository performance.

package/bin/packs/core-native.yaml

@@ -0,0 +1,59 @@
+schema_version: prc.pack/v0.1
+id: prc.pack.core-native@1.0
+title: Core native assertion pack
+description: Catalog-wide deterministic checks measured against the comprehensive core fixture corpus.
+publisher_id: prc-project
+maintenance: active
+engine_apis: [prc.engine/v0.1]
+profile_ids: [prc/core-repository, prc/api, prc/kubernetes]
+assertions:
+  - {assertion_id: PRC-A-CORE-001, implementation_id: prc.native.file-present@0.1, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-002, implementation_id: prc.native.file-present@0.1, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-003, implementation_id: prc.native.file-present@0.1, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-004, implementation_id: prc.native.file-present@0.1, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-005, implementation_id: prc.native.file-present@0.1, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-006, implementation_id: prc.native.file-present@0.1, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-007, implementation_id: prc.native.dependency-lock@0.1, validated_outcomes: [pass, fail, not_applicable]}
+  - {assertion_id: PRC-A-CORE-008, implementation_id: prc.native.github-action-pin@0.1, validated_outcomes: [pass, fail, not_applicable]}
+  - {assertion_id: PRC-A-CORE-009, implementation_id: prc.native.ci-present@0.1, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-010, implementation_id: prc.native.test-suite@0.2, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-011, implementation_id: prc.native.github-workflow-permissions@0.1, validated_outcomes: [pass, fail, not_applicable, error]}
+  - {assertion_id: PRC-A-CORE-012, implementation_id: prc.native.manual-evidence@0.1, validated_outcomes: [manual_review]}
+  - {assertion_id: PRC-A-CORE-013, implementation_id: prc.native.analysis-evidence@0.1, validated_outcomes: [blocked]}
+  - {assertion_id: PRC-A-CORE-014, implementation_id: prc.native.final-newline@0.1, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-015, implementation_id: prc.native.git-revision@0.1, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-016, implementation_id: prc.native.file-present@0.1, validated_outcomes: [pass, fail, not_applicable]}
+  - {assertion_id: PRC-A-CORE-017, implementation_id: prc.native.github-workflow-valid@0.1, validated_outcomes: [pass, not_applicable, error]}
+  - {assertion_id: PRC-A-CORE-018, implementation_id: prc.native.github-workflow-jobs@0.1, validated_outcomes: [pass, fail, not_applicable, error]}
+  - {assertion_id: PRC-A-CORE-019, implementation_id: prc.native.github-workflow-timeouts@0.1, validated_outcomes: [pass, fail, not_applicable, error]}
+  - {assertion_id: PRC-A-CORE-020, implementation_id: prc.native.github-no-pull-request-target@0.1, validated_outcomes: [pass, manual_review, not_applicable, error]}
+  - {assertion_id: PRC-A-CORE-021, implementation_id: prc.native.merge-conflict-markers@0.1, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-022, implementation_id: prc.native.restrictive-file-modes@0.1, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-023, implementation_id: prc.native.inventory-files-nonempty@0.1, validated_outcomes: [pass, fail, not_applicable]}
+  - {assertion_id: PRC-A-CORE-024, implementation_id: prc.native.inventory-files-nonempty@0.1, validated_outcomes: [pass, fail, not_applicable]}
+  - {assertion_id: PRC-A-CORE-025, implementation_id: prc.native.runtime-version@0.1, validated_outcomes: [pass, fail, not_applicable]}
+  - {assertion_id: PRC-A-CORE-026, implementation_id: prc.native.container-base-pin@0.1, validated_outcomes: [pass, fail, not_applicable]}
+  - {assertion_id: PRC-A-CORE-027, implementation_id: prc.native.container-nonroot@0.1, validated_outcomes: [pass, fail, not_applicable]}
+  - {assertion_id: PRC-A-CORE-028, implementation_id: prc.native.terraform-lock@0.1, validated_outcomes: [pass, fail, not_applicable]}
+  - {assertion_id: PRC-A-CORE-029, implementation_id: prc.native.kubernetes-nonroot@0.2, validated_outcomes: [pass, fail, not_applicable]}
+  - {assertion_id: PRC-A-CORE-030, implementation_id: prc.native.kubernetes-resources@0.2, validated_outcomes: [pass, fail, not_applicable]}
+  - {assertion_id: PRC-A-CORE-031, implementation_id: prc.native.private-key-armor@0.1, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-GO-001, implementation_id: prc.native.go-http-timeout@0.1, validated_outcomes: [pass, fail, not_applicable, error]}
+  - {assertion_id: PRC-A-GO-002, implementation_id: prc.native.go-http-server-timeout@0.1, validated_outcomes: [pass, fail, not_applicable, error]}
+  - {assertion_id: PRC-A-API-001, implementation_id: prc.native.openapi-root@0.1, validated_outcomes: [pass, fail, not_applicable, error]}
+  - {assertion_id: PRC-A-API-002, implementation_id: prc.native.openapi-operation-responses@0.1, validated_outcomes: [pass, fail, not_applicable, error]}
+  - {assertion_id: PRC-A-API-003, implementation_id: prc.native.openapi-operation-ids@0.1, validated_outcomes: [pass, fail, not_applicable, error]}
+  - {assertion_id: PRC-A-K8S-001, implementation_id: prc.native.kubernetes-host-access@0.1, validated_outcomes: [pass, fail, not_applicable]}
+  - {assertion_id: PRC-A-K8S-002, implementation_id: prc.native.kubernetes-privilege-escalation@0.1, validated_outcomes: [pass, fail, not_applicable]}
+  - {assertion_id: PRC-A-K8S-003, implementation_id: prc.native.kubernetes-capabilities@0.1, validated_outcomes: [pass, fail, not_applicable]}
+  - {assertion_id: PRC-A-K8S-004, implementation_id: prc.native.kubernetes-seccomp@0.1, validated_outcomes: [pass, fail, not_applicable]}
+benchmark:
+  suite_id: prc.benchmark.core-native@1.0
+  suite_path: fixtures/benchmarks/core-native/suite-comprehensive.yaml
+  suite_sha256: 1035fef3034185344a18bbf3e308143418f1b0bbd7f1fdd0a71a8adc138c9968
+limitations:
+  - Manual-review and adapter-backed assertions are validated only in their fail-closed manual or blocked states.
+  - OpenAPI operation checks cover direct path and webhook operations; referenced Path Items, callbacks, multi-document descriptions, and referenced responses require a future bounded resolver or adapter.
+  - Kubernetes checks inspect selected Pod Security Standard fields in direct workload manifests; rendered templates, custom workload resources, admission enforcement, and deployed state require separate evidence.
+  - Test discovery verifies conventional declarations or an explicit package test command; execution, determinism, coverage, and behavioral adequacy require separate evidence.
+  - The fixture corpus does not yet establish cross-platform, large-repository, or adversarial parser performance.