audrey 1.1.3 → 1.2.0

package/benchmarks/verify-external-evidence.mjs

@@ -1,351 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { validateAdapterRegistry } from './validate-adapter-registry.mjs';
-import { validateGuardBenchArtifacts, validateSchema } from './validate-guardbench-artifacts.mjs';
-import { publicPath } from './public-paths.mjs';
-
-const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
-const DEFAULT_REGISTRY = 'benchmarks/adapters/registry.json';
-const DEFAULT_REGISTRY_SCHEMA = 'benchmarks/schemas/guardbench-adapter-registry.schema.json';
-const DEFAULT_EXTERNAL_RUN_SCHEMA = 'benchmarks/schemas/guardbench-external-run.schema.json';
-const DEFAULT_EVIDENCE_SCHEMA = 'benchmarks/schemas/guardbench-external-evidence.schema.json';
-const DEFAULT_OUT_ROOT = 'benchmarks/output/external';
-const DEFAULT_REPORT = 'benchmarks/output/external/guardbench-external-evidence.json';
-const PENDING_METADATA_STATUSES = new Set(['blocked', 'dry-run-missing-env', 'dry-run-ready']);
-
-function fromRoot(path) {
-  return resolve(ROOT, path);
-}
-
-function readJson(path) {
-  return JSON.parse(readFileSync(path, 'utf-8'));
-}
-
-function writeJson(path, value) {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`, 'utf-8');
-}
-
-export function parseExternalEvidenceArgs(argv = process.argv.slice(2)) {
-  const args = {
-    registry: DEFAULT_REGISTRY,
-    registrySchema: DEFAULT_REGISTRY_SCHEMA,
-    externalRunSchema: DEFAULT_EXTERNAL_RUN_SCHEMA,
-    evidenceSchema: DEFAULT_EVIDENCE_SCHEMA,
-    outRoot: DEFAULT_OUT_ROOT,
-    report: DEFAULT_REPORT,
-    adapters: [],
-    allowPending: false,
-    json: false,
-    write: true,
-  };
-
-  for (let i = 0; i < argv.length; i++) {
-    const token = argv[i];
-    if (token === '--registry' && argv[i + 1]) args.registry = argv[++i];
-    else if (token === '--registry-schema' && argv[i + 1]) args.registrySchema = argv[++i];
-    else if (token === '--external-run-schema' && argv[i + 1]) args.externalRunSchema = argv[++i];
-    else if (token === '--evidence-schema' && argv[i + 1]) args.evidenceSchema = argv[++i];
-    else if (token === '--out-root' && argv[i + 1]) args.outRoot = argv[++i];
-    else if (token === '--report' && argv[i + 1]) args.report = argv[++i];
-    else if (token === '--adapter' && argv[i + 1]) args.adapters.push(argv[++i]);
-    else if (token === '--allow-pending') args.allowPending = true;
-    else if (token === '--json') args.json = true;
-    else if (token === '--no-write') args.write = false;
-    else if (token === '--help' || token === '-h') args.help = true;
-    else throw new Error(`Unknown argument: ${token}`);
-  }
-
-  return args;
-}
-
-function usage() {
-  return `Usage: node benchmarks/verify-external-evidence.mjs [options]
-
-Options:
-  --registry <path>             GuardBench adapter registry. Default: ${DEFAULT_REGISTRY}.
-  --out-root <path>             External evidence root. Default: ${DEFAULT_OUT_ROOT}.
-  --report <path>               Output report path. Default: ${DEFAULT_REPORT}.
-  --adapter <id>                Limit verification to one adapter id. May repeat.
-  --allow-pending               Treat missing, blocked, or dry-run-only evidence as pending.
-  --json                        Print the machine-readable evidence report.
-  --no-write                    Do not write the evidence report.
-`;
-}
-
-function credentialLeaks(text, requiredEnv, env) {
-  const leaks = [];
-  for (const name of requiredEnv) {
-    const value = env[name];
-    if (typeof value === 'string' && value.length >= 8 && text.includes(value)) {
-      leaks.push(name);
-    }
-  }
-  return leaks;
-}
-
-function pendingRow(
-  target,
-  outDir,
-  metadataPath,
-  allowPending,
-  reason,
-  metadata = null,
-  extraFailures = [],
-  secretLeakCount = 0,
-) {
-  return {
-    id: target.id,
-    name: target.name,
-    path: target.path,
-    credentialMode: target.credentialMode,
-    requiredEnv: target.requiredEnv,
-    outDir: publicPath(outDir),
-    metadataPath: publicPath(metadataPath),
-    status: 'pending',
-    evidenceKind: metadata?.dryRun ? 'dry-run' : reason === 'missing' ? 'missing' : 'blocked',
-    metadataStatus: metadata?.status ?? null,
-    dryRun: metadata?.dryRun ?? null,
-    missingEnv: metadata?.missingEnv ?? target.requiredEnv,
-    artifactValidationOk: null,
-    adapterConformanceOk: null,
-    secretLeakCount,
-    failures: allowPending
-      ? extraFailures
-      : [
-          ...extraFailures,
-          reason === 'missing'
-            ? `Missing external run metadata: ${metadataPath}`
-            : `External evidence is pending for ${target.id}: ${metadata?.status ?? reason}`,
-        ],
-  };
-}
-
-function verifyLiveMetadata(target, outDir, metadataPath, metadata, metadataText, schemas, env) {
-  const failures = [];
-  const schemaErrors = validateSchema(metadata, schemas.externalRun, 'guardbench-externalRun');
-  failures.push(...schemaErrors);
-
-  const artifactValidation = validateGuardBenchArtifacts({ dir: outDir });
-  if (!artifactValidation.ok) {
-    failures.push(...artifactValidation.failures.map(failure => `artifact validation: ${failure}`));
-  }
-
-  if (metadata.adapter !== target.id)
-    failures.push(`metadata adapter ${metadata.adapter} does not match registry id ${target.id}`);
-  if (metadata.dryRun !== false) failures.push('metadata must come from a live run, not a dry run');
-  if (metadata.status !== 'passed')
-    failures.push(`metadata status must be passed, got ${metadata.status}`);
-  if (metadata.exitCode !== 0)
-    failures.push(`metadata exitCode must be 0, got ${metadata.exitCode}`);
-  if ((metadata.missingEnv ?? []).length !== 0)
-    failures.push(
-      `metadata still reports missing runtime env: ${(metadata.missingEnv ?? []).join(', ')}`,
-    );
-  for (const name of target.requiredEnv) {
-    if (!(metadata.requiredEnv ?? []).includes(name))
-      failures.push(`metadata requiredEnv missing ${name}`);
-  }
-  if (metadata.artifactValidation?.ok !== true)
-    failures.push('metadata artifactValidation.ok must be true');
-  if (metadata.adapterConformance?.ok !== true)
-    failures.push('metadata adapterConformance.ok must be true');
-  if (!metadata.artifactHashes) failures.push('metadata missing artifactHashes');
-
-  const leakedEnv = credentialLeaks(metadataText, target.requiredEnv, env);
-  failures.push(...leakedEnv.map(name => `metadata leaks runtime credential value for ${name}`));
-
-  return {
-    id: target.id,
-    name: target.name,
-    path: target.path,
-    credentialMode: target.credentialMode,
-    requiredEnv: target.requiredEnv,
-    outDir: publicPath(outDir),
-    metadataPath: publicPath(metadataPath),
-    status: failures.length === 0 ? 'verified' : 'failed',
-    evidenceKind: 'live',
-    metadataStatus: metadata.status ?? null,
-    dryRun: metadata.dryRun ?? null,
-    missingEnv: metadata.missingEnv ?? [],
-    artifactValidationOk: artifactValidation.ok,
-    adapterConformanceOk: metadata.adapterConformance?.ok ?? null,
-    secretLeakCount: leakedEnv.length,
-    failures,
-  };
-}
-
-function verifyTarget(target, options, schemas) {
-  const outDir = resolve(options.outRoot, target.id);
-  const metadataPath = join(outDir, 'external-run-metadata.json');
-
-  if (!existsSync(metadataPath)) {
-    return pendingRow(target, outDir, metadataPath, options.allowPending, 'missing');
-  }
-
-  let metadata = null;
-  let metadataText = '';
-  const parseFailures = [];
-  try {
-    metadataText = readFileSync(metadataPath, 'utf-8');
-    metadata = JSON.parse(metadataText);
-  } catch (error) {
-    parseFailures.push(error.message);
-  }
-
-  if (!metadata) {
-    return {
-      id: target.id,
-      name: target.name,
-      path: target.path,
-      credentialMode: target.credentialMode,
-      requiredEnv: target.requiredEnv,
-      outDir: publicPath(outDir),
-      metadataPath: publicPath(metadataPath),
-      status: 'failed',
-      evidenceKind: 'missing',
-      metadataStatus: null,
-      dryRun: null,
-      missingEnv: target.requiredEnv,
-      artifactValidationOk: null,
-      adapterConformanceOk: null,
-      secretLeakCount: 0,
-      failures: parseFailures,
-    };
-  }
-
-  const metadataSchemaFailures = validateSchema(
-    metadata,
-    schemas.externalRun,
-    'guardbench-externalRun',
-  );
-  const leakedEnv = credentialLeaks(metadataText, target.requiredEnv, options.env);
-  const metadataFailures = [
-    ...metadataSchemaFailures,
-    ...leakedEnv.map(name => `metadata leaks runtime credential value for ${name}`),
-  ];
-
-  if (metadata.dryRun === true || PENDING_METADATA_STATUSES.has(metadata.status)) {
-    return pendingRow(
-      target,
-      outDir,
-      metadataPath,
-      options.allowPending,
-      metadata.status ?? 'pending',
-      metadata,
-      metadataFailures,
-      leakedEnv.length,
-    );
-  }
-
-  return verifyLiveMetadata(
-    target,
-    outDir,
-    metadataPath,
-    metadata,
-    metadataText,
-    schemas,
-    options.env,
-  );
-}
-
-function externalTargetsFromRegistry(registry, adapterIds) {
-  const selected = new Set(adapterIds ?? []);
-  return (registry.adapters ?? [])
-    .filter(adapter => adapter.credentialMode === 'runtime-env')
-    .filter(adapter => selected.size === 0 || selected.has(adapter.id));
-}
-
-export function validateExternalEvidenceReport(report, options = {}) {
-  const schema = readJson(fromRoot(options.schema ?? DEFAULT_EVIDENCE_SCHEMA));
-  return validateSchema(report, schema, 'guardbench-external-evidence');
-}
-
-export async function verifyExternalGuardBenchEvidence(options = {}) {
-  const registryPath = fromRoot(options.registry ?? DEFAULT_REGISTRY);
-  const registrySchemaPath = fromRoot(options.registrySchema ?? DEFAULT_REGISTRY_SCHEMA);
-  const outRoot = fromRoot(options.outRoot ?? DEFAULT_OUT_ROOT);
-  const allowPending = options.allowPending === true;
-  const registry = options.targets ? null : readJson(registryPath);
-  const registryValidation = options.targets
-    ? { ok: true, failures: [] }
-    : await validateAdapterRegistry({ registry: registryPath, schema: registrySchemaPath });
-  const targets = options.targets ?? externalTargetsFromRegistry(registry, options.adapters);
-  const schemas = {
-    externalRun: readJson(fromRoot(options.externalRunSchema ?? DEFAULT_EXTERNAL_RUN_SCHEMA)),
-  };
-  const rows = targets.map(target =>
-    verifyTarget(
-      target,
-      {
-        outRoot,
-        allowPending,
-        env: options.env ?? process.env,
-      },
-      schemas,
-    ),
-  );
-  const unknownAdapters = (options.adapters ?? []).filter(
-    id => !targets.some(target => target.id === id),
-  );
-  const failures = [
-    ...registryValidation.failures.map(failure => `registry: ${failure}`),
-    ...unknownAdapters.map(id => `Unknown runtime-env adapter id: ${id}`),
-    ...rows.flatMap(row => row.failures.map(failure => `${row.id}: ${failure}`)),
-  ];
-  const report = {
-    schemaVersion: '1.0.0',
-    suite: 'GuardBench external evidence verification',
-    generatedAt: new Date().toISOString(),
-    ok: failures.length === 0,
-    allowPending,
-    registry: options.targets ? 'inline-targets' : publicPath(registryPath),
-    outRoot: publicPath(outRoot),
-    adapters: rows,
-    failures,
-  };
-  const schemaFailures = validateExternalEvidenceReport(report, {
-    schema: options.evidenceSchema ?? DEFAULT_EVIDENCE_SCHEMA,
-  });
-  if (schemaFailures.length > 0) {
-    throw new Error(
-      `GuardBench external evidence schema validation failed: ${schemaFailures.join('; ')}`,
-    );
-  }
-  if (options.write !== false) {
-    writeJson(fromRoot(options.report ?? DEFAULT_REPORT), report);
-  }
-  return report;
-}
-
-async function main() {
-  const args = parseExternalEvidenceArgs();
-  if (args.help) {
-    console.log(usage());
-    return;
-  }
-
-  const report = await verifyExternalGuardBenchEvidence(args);
-  if (args.json) {
-    console.log(JSON.stringify(report, null, 2));
-  } else if (report.ok) {
-    const verified = report.adapters.filter(adapter => adapter.status === 'verified').length;
-    const pending = report.adapters.filter(adapter => adapter.status === 'pending').length;
-    console.log(
-      `GuardBench external evidence verification passed: ${verified} verified, ${pending} pending`,
-    );
-  } else {
-    console.error('GuardBench external evidence verification failed:');
-    for (const failure of report.failures) console.error(`- ${failure}`);
-  }
-
-  if (!report.ok) process.exit(1);
-}
-
-if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  main().catch(error => {
-    console.error(error.stack ?? error.message);
-    process.exit(1);
-  });
-}

package/benchmarks/verify-publication-artifacts.mjs

@@ -1,309 +0,0 @@
-import { existsSync, readFileSync } from 'node:fs';
-import { join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { validateAdapterRegistry } from './validate-adapter-registry.mjs';
-import { validateAdapterModuleFile } from './validate-adapter-module.mjs';
-import { validateAdapterSelfTestFile } from './validate-adapter-self-test.mjs';
-import { validateExternalAdapterDryRunMatrix } from './dry-run-external-adapters.mjs';
-import { validateExternalEvidenceReport } from './verify-external-evidence.mjs';
-import { validateGuardBenchArtifacts, validateSchema } from './validate-guardbench-artifacts.mjs';
-import { verifyGuardBenchSubmissionBundle } from './verify-submission-bundle.mjs';
-import { containsLocalPath, findLocalPathLeaks, publicPath, walkFiles } from './public-paths.mjs';
-
-const DEFAULT_ADAPTER = 'benchmarks/adapters/example-allow.mjs';
-const DEFAULT_ARTIFACTS_DIR = 'benchmarks/output';
-const DEFAULT_BUNDLE_DIR = 'benchmarks/output/submission-bundle';
-const DEFAULT_EXTERNAL_DRY_RUN = 'benchmarks/output/external/guardbench-external-dry-run.json';
-const DEFAULT_EXTERNAL_EVIDENCE = 'benchmarks/output/external/guardbench-external-evidence.json';
-const DEFAULT_LEADERBOARD = 'benchmarks/output/leaderboard/guardbench-leaderboard.json';
-const DEFAULT_SCHEMA = 'benchmarks/schemas/guardbench-publication-verification.schema.json';
-
-export function parsePublicationVerifierArgs(argv = process.argv.slice(2)) {
-  const args = {
-    adapter: DEFAULT_ADAPTER,
-    artifactsDir: DEFAULT_ARTIFACTS_DIR,
-    bundleDir: DEFAULT_BUNDLE_DIR,
-    externalDryRun: DEFAULT_EXTERNAL_DRY_RUN,
-    externalEvidence: DEFAULT_EXTERNAL_EVIDENCE,
-    leaderboard: DEFAULT_LEADERBOARD,
-    json: false,
-  };
-
-  for (let i = 0; i < argv.length; i++) {
-    const token = argv[i];
-    if (token === '--adapter' && argv[i + 1]) args.adapter = argv[++i];
-    else if ((token === '--artifacts-dir' || token === '--dir') && argv[i + 1])
-      args.artifactsDir = argv[++i];
-    else if ((token === '--bundle-dir' || token === '--bundle') && argv[i + 1])
-      args.bundleDir = argv[++i];
-    else if (token === '--external-dry-run' && argv[i + 1]) args.externalDryRun = argv[++i];
-    else if (token === '--external-evidence' && argv[i + 1]) args.externalEvidence = argv[++i];
-    else if (token === '--leaderboard' && argv[i + 1]) args.leaderboard = argv[++i];
-    else if (token === '--json') args.json = true;
-    else if (token === '--help' || token === '-h') args.help = true;
-    else throw new Error(`Unknown argument: ${token}`);
-  }
-
-  return args;
-}
-
-function usage() {
-  return `Usage: node benchmarks/verify-publication-artifacts.mjs [options]
-
-Options:
-  --adapter <path>        Default adapter module. Default: ${DEFAULT_ADAPTER}.
-  --artifacts-dir <path>  GuardBench output artifact directory. Default: ${DEFAULT_ARTIFACTS_DIR}.
-  --bundle-dir <path>     GuardBench submission bundle. Default: ${DEFAULT_BUNDLE_DIR}.
-  --external-dry-run <path> GuardBench external adapter dry-run matrix. Default: ${DEFAULT_EXTERNAL_DRY_RUN}.
-  --external-evidence <path> GuardBench external live-evidence verification report. Default: ${DEFAULT_EXTERNAL_EVIDENCE}.
-  --leaderboard <path>    GuardBench leaderboard JSON. Default: ${DEFAULT_LEADERBOARD}.
-  --json                  Print the machine-readable verification report.
-`;
-}
-
-function readJson(path) {
-  return JSON.parse(readFileSync(path, 'utf-8'));
-}
-
-function checkLeaderboard(path) {
-  const leaderboardPath = resolve(path);
-  const failures = [];
-  let leaderboard = null;
-
-  if (!existsSync(leaderboardPath)) {
-    failures.push(`Missing GuardBench leaderboard: ${leaderboardPath}`);
-  } else {
-    try {
-      leaderboard = readJson(leaderboardPath);
-      const schema = readJson('benchmarks/schemas/guardbench-leaderboard.schema.json');
-      failures.push(...validateSchema(leaderboard, schema, 'guardbench-leaderboard'));
-      if (!leaderboard.rows?.some(row => row.verification?.ok === true)) {
-        failures.push('GuardBench leaderboard has no verified rows');
-      }
-    } catch (error) {
-      failures.push(error.message);
-    }
-  }
-
-  return {
-    ok: failures.length === 0,
-    path: publicPath(leaderboardPath),
-    rows: leaderboard?.rows?.length ?? 0,
-    failures,
-  };
-}
-
-function checkExternalDryRun(path) {
-  const matrixPath = resolve(path);
-  const failures = [];
-  let matrix = null;
-
-  if (!existsSync(matrixPath)) {
-    failures.push(`Missing GuardBench external adapter dry-run matrix: ${matrixPath}`);
-  } else {
-    try {
-      matrix = readJson(matrixPath);
-      failures.push(...validateExternalAdapterDryRunMatrix(matrix));
-      if (!matrix.adapters?.some(row => row.id === 'mem0-platform')) {
-        failures.push('GuardBench external adapter dry-run matrix has no mem0-platform row');
-      }
-      if (!matrix.adapters?.some(row => row.id === 'zep-cloud')) {
-        failures.push('GuardBench external adapter dry-run matrix has no zep-cloud row');
-      }
-    } catch (error) {
-      failures.push(error.message);
-    }
-  }
-
-  return {
-    ok: failures.length === 0,
-    path: publicPath(matrixPath),
-    adapters: matrix?.adapters?.length ?? 0,
-    missingEnv: matrix?.adapters?.flatMap(row => row.missingEnv ?? []) ?? [],
-    failures,
-  };
-}
-
-function checkExternalEvidence(path) {
-  const reportPath = resolve(path);
-  const failures = [];
-  let evidence = null;
-
-  if (!existsSync(reportPath)) {
-    failures.push(`Missing GuardBench external evidence report: ${reportPath}`);
-  } else {
-    try {
-      evidence = readJson(reportPath);
-      failures.push(...validateExternalEvidenceReport(evidence));
-      if (evidence.ok !== true) {
-        failures.push('GuardBench external evidence report is not ok');
-      }
-      if (!evidence.adapters?.some(row => row.id === 'mem0-platform')) {
-        failures.push('GuardBench external evidence report has no mem0-platform row');
-      }
-      if (!evidence.adapters?.some(row => row.id === 'zep-cloud')) {
-        failures.push('GuardBench external evidence report has no zep-cloud row');
-      }
-    } catch (error) {
-      failures.push(error.message);
-    }
-  }
-
-  return {
-    ok: failures.length === 0,
-    path: publicPath(reportPath),
-    adapters: evidence?.adapters?.length ?? 0,
-    verified: evidence?.adapters?.filter(row => row.status === 'verified').length ?? 0,
-    pending: evidence?.adapters?.filter(row => row.status === 'pending').length ?? 0,
-    failures,
-  };
-}
-
-function scanTextFile(path) {
-  try {
-    return containsLocalPath(readFileSync(path, 'utf-8'));
-  } catch {
-    return false;
-  }
-}
-
-function checkLocalPathLeaks(options = {}) {
-  const failures = [];
-  const artifactsDir = resolve(options.artifactsDir ?? DEFAULT_ARTIFACTS_DIR);
-  const bundleDir = resolve(options.bundleDir ?? DEFAULT_BUNDLE_DIR);
-  const files = [
-    join(artifactsDir, 'guardbench-manifest.json'),
-    join(artifactsDir, 'guardbench-summary.json'),
-    join(artifactsDir, 'guardbench-raw.json'),
-    join(artifactsDir, 'guardbench-conformance-card.json'),
-    join(artifactsDir, 'adapter-self-test', 'guardbench-adapter-self-test.json'),
-    resolve(options.externalDryRun ?? DEFAULT_EXTERNAL_DRY_RUN),
-    resolve(options.externalEvidence ?? DEFAULT_EXTERNAL_EVIDENCE),
-    resolve(options.leaderboard ?? DEFAULT_LEADERBOARD),
-  ];
-
-  for (const path of files) {
-    if (existsSync(path) && scanTextFile(path)) {
-      failures.push(`${publicPath(path)} contains a local absolute path`);
-    }
-  }
-  if (existsSync(bundleDir)) {
-    for (const file of walkFiles(bundleDir)) {
-      const path = join(bundleDir, file);
-      if (scanTextFile(path)) failures.push(`${publicPath(path)} contains a local absolute path`);
-    }
-  }
-
-  return {
-    ok: failures.length === 0,
-    filesChecked: files.filter(path => existsSync(path)).map(path => publicPath(path)),
-    bundleDir: publicPath(bundleDir),
-    failures,
-  };
-}
-
-export function validatePublicationVerificationReport(report, options = {}) {
-  const schema = readJson(options.schema ?? DEFAULT_SCHEMA);
-  return validateSchema(report, schema, 'guardbench-publication-verification');
-}
-
-export async function verifyGuardBenchPublicationArtifacts(options = {}) {
-  const registry = await validateAdapterRegistry();
-  const adapterModule = await validateAdapterModuleFile({
-    adapter: options.adapter ?? DEFAULT_ADAPTER,
-  });
-  const selfTest = validateAdapterSelfTestFile({
-    report: join(
-      resolve(options.artifactsDir ?? DEFAULT_ARTIFACTS_DIR),
-      'adapter-self-test',
-      'guardbench-adapter-self-test.json',
-    ),
-  });
-  const artifacts = validateGuardBenchArtifacts({
-    dir: options.artifactsDir ?? DEFAULT_ARTIFACTS_DIR,
-  });
-  const bundle = verifyGuardBenchSubmissionBundle({ dir: options.bundleDir ?? DEFAULT_BUNDLE_DIR });
-  const externalDryRun = checkExternalDryRun(options.externalDryRun ?? DEFAULT_EXTERNAL_DRY_RUN);
-  const externalEvidence = checkExternalEvidence(
-    options.externalEvidence ?? DEFAULT_EXTERNAL_EVIDENCE,
-  );
-  const leaderboard = checkLeaderboard(options.leaderboard ?? DEFAULT_LEADERBOARD);
-  const localPaths = checkLocalPathLeaks(options);
-  const checks = {
-    registry,
-    adapterModule,
-    selfTest,
-    artifacts,
-    bundle,
-    externalDryRun,
-    externalEvidence,
-    leaderboard,
-    localPaths,
-  };
-  const failures = Object.entries(checks).flatMap(([name, report]) =>
-    (report.failures ?? []).map(failure => `${name}: ${failure}`),
-  );
-
-  const report = {
-    schemaVersion: '1.0.0',
-    suite: 'GuardBench publication artifact verification',
-    generatedAt: new Date().toISOString(),
-    ok: failures.length === 0,
-    checks,
-    failures,
-  };
-  const reportLocalPathLeaks = findLocalPathLeaks({ checks });
-  if (reportLocalPathLeaks.length > 0) {
-    failures.push(
-      ...reportLocalPathLeaks.map(
-        leak => `publication report contains local absolute path: ${leak}`,
-      ),
-    );
-    report.ok = false;
-    report.failures = failures;
-  }
-  const schemaFailures = validatePublicationVerificationReport(report);
-  if (schemaFailures.length > 0) {
-    throw new Error(
-      `GuardBench publication verification schema validation failed: ${schemaFailures.join('; ')}`,
-    );
-  }
-  return report;
-}
-
-async function main() {
-  const args = parsePublicationVerifierArgs();
-  if (args.help) {
-    console.log(usage());
-    return;
-  }
-
-  const report = await verifyGuardBenchPublicationArtifacts(args);
-  if (args.json) {
-    console.log(JSON.stringify(report, null, 2));
-  } else if (report.ok) {
-    console.log('GuardBench publication artifact verification passed.');
-    console.log(`Registry adapters: ${report.checks.registry.adapters.length}`);
-    console.log(`Submission bundle files: ${report.checks.bundle.files.length}`);
-    console.log(`External dry-run adapters: ${report.checks.externalDryRun.adapters}`);
-    console.log(
-      `External live evidence: ${report.checks.externalEvidence.verified} verified, ${report.checks.externalEvidence.pending} pending`,
-    );
-    console.log(`Leaderboard rows: ${report.checks.leaderboard.rows}`);
-    console.log(
-      `Local path sweep: ${report.checks.localPaths.filesChecked.length} files plus bundle`,
-    );
-  } else {
-    console.error('GuardBench publication artifact verification failed:');
-    for (const failure of report.failures) console.error(`- ${failure}`);
-  }
-
-  if (!report.ok) process.exit(1);
-}
-
-if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  main().catch(error => {
-    console.error(error.stack ?? error.message);
-    process.exit(1);
-  });
-}