driftproof 0.11.0 → 0.11.2

package/README.md

@@ -13,17 +13,19 @@ there were too few draws to tell, the receipt says so.
  — live badge for the bundled `commit-message-conventions` example, generated from its own receipt.
 
 **[Quickstart](https://driftproofhq.com/#quickstart)** ·
-**[Latest report](https://driftproofhq.com/reports/008/)** ·
+**[Latest report](https://driftproofhq.com/reports/010/)** ·
 [driftproofhq.com](https://driftproofhq.com)
 
 Driftproof **consumes** the [`agentskills.io/evals`](https://agentskills.io) eval
 format; it does not invent its own.
 
-📊 **Eight published reports** (each re-derived from committed receipts, nothing
-hand-entered), spanning six published report types, the newest being release
-drift. All eight share one band-based, floor-gated verdict rule and
-differ in what moves underneath the skill — or, in the value report, in which
-axes are measured; or, in the instrument re-measurement, in the instrument itself:
+📊 **Ten published reports** (each re-derived from committed files, nothing
+hand-entered: Driftproof's receipts, or for Report #010 the upstream harness's own
+output), spanning seven published report types, the newest being instrument
+comparison. The nine that measure with Driftproof read its own arms by one
+band-based, floor-gated verdict rule and differ in what moves underneath the
+skill — or, in the value report, in which axes are measured; or, in the instrument re-measurement, in the
+instrument itself; or, in the instrument comparison, in which instrument measures:
 
 - **[Report #001](https://driftproofhq.com/reports/001/)** — *release drift*: ten
   public agent skills across a current-vs-previous Sonnet release; 9 of 10 showed
@@ -76,11 +78,25 @@ axes are measured; or, in the instrument re-measurement, in the instrument itsel
   receipts, which is what makes the delta attributable to the model rather than
   to the instrument. One case sits inside the verdict on the effect floor alone
   and the report names it.
+- **[Report #009](https://driftproofhq.com/reports/009/)** — *instrument
+  comparison*: three skills from one plugin, one case each, measured by Claude
+  Code's native plugin eval and by Driftproof on the same SKILL.md bytes, task
+  prompts and rubrics. The two tools apply different treatments and grade
+  differently, so the report reads them side by side, ranks neither, and states
+  what each can and cannot establish. Both tools judged with `claude-opus-5`,
+  which departs from the judge policy, so its figures are not comparable with
+  Reports #001 to #008.
+- **[Report #010](https://driftproofhq.com/reports/010/)** — *instrument
+  comparison*: one skill's own behavioural eval from its upstream repository, run
+  five times under each of two Claude Code configurations at one commit: 8 passed
+  and 2 failed, both failures on one expectation the skill's ADR instructions do
+  not state. No Driftproof measurement was taken and no Driftproof judge ran, and
+  the report does not isolate what caused the variation.
 
 ✍️ The launch essay, **[Three model releases later: what actually happens to agent
-skills](https://driftproofhq.com/writing/three-releases/)**, reads all eight reports
+skills](https://driftproofhq.com/writing/three-releases/)**, reads all ten reports
 together: what moves underneath a skill, what the skill costs to run, and what a
-corrected instrument did to three published results. Revised 2026-09-01; every
+corrected instrument did to three published results. Revised 2026-09-22; every
 figure in it is gate-checked against the report page it cites.
 
 ## Why
@@ -305,7 +321,7 @@ A receipt is the unit of evidence — one JSON document conforming to
     "model_release_date": "2025-10-01",
     "provider": "anthropic",
     "surface": "claude-cli",
-    "runner_version": "0.11.0",
+    "runner_version": "0.11.2",
     "date_utc": "2026-07-27T…Z",
     "registry": "registered",
     "transcripts": "hashes-only",
@@ -384,7 +400,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: driftproofhq/driftproof@v0.11.0
+      - uses: driftproofhq/driftproof@v0.11.2
         with:
           skill-dir: skills/my-skill
           models: claude-haiku-4-5
@@ -479,7 +495,7 @@ site, so it reflects a real dated run, not a hand-set color.
 
 ## Reports
 
-Eight reports are published, spanning six report types. A report page lives at a
+Ten reports are published, spanning seven report types. A report page lives at a
 draft path — `docs/reports/NNN-draft/` — until the publish sequence renames it, and
 `scripts/build-public.sh` excludes every `*-draft/` path from the published tree
 (see the roll at the top of this README, and
@@ -487,6 +503,8 @@ draft path — `docs/reports/NNN-draft/` — until the publish sequence renames
 Each report and every verdict in it are **re-derived from the receipts** committed
 under [`receipts/`](receipts/)
 (`receipts/report-001/` … `receipts/report-006/`) — nothing is hand-entered.
+Report #010 takes no Driftproof measurement and has no receipts: it is re-derived
+from the upstream harness's output files, published beside its page.
 
 Driftproof does **not** commit third-party skill content. Each `SKILL.md` is
 fetched at run time from a pinned commit and verified by sha256 against

package/config.js

@@ -9,7 +9,7 @@ const PROJECT_NAME = 'driftproof';
 // Bumped whenever the runner's behaviour or receipt-generation semantics change
 // in a way that could affect results. Recorded into every receipt as
 // run.runner_version so a receipt is reproducible against a known engine.
-const RUNNER_VERSION = '0.11.0';
+const RUNNER_VERSION = '0.11.2';
 
 // The eval format we CONSUME (we deliberately do not invent our own).
 const SUITE_FORMAT = 'agentskills.io/evals';

package/lib/hygiene.js

@@ -23,6 +23,8 @@
 // Patterns are written so a regex literal cannot match its own text: a
 // metacharacter or a character class follows each fixed prefix.
 
+const zlib = require('zlib');
+
 const dec = (b64) => JSON.parse(Buffer.from(b64, 'base64').toString('utf8'));
 
 // Build-box host + private IP, base64 so the plaintext never lands in a file.
@@ -54,7 +56,70 @@ function scanPath(rel) {
   return /(^|\/)\.env(\.|$)/.test(rel) ? [{ file: rel, kind: 'env-file' }] : [];
 }
 
+// A PNG'S TEXT-BEARING REGIONS (spec 038 A-038-5, the classification spec 027 already made for the
+// repository gate's confidentiality scan, applied here).
+//
+// THE THREAT MODEL IS ACCIDENTAL PLAINTEXT DISCLOSURE by a person or an agent writing the tree
+// (CONSTITUTION § Threat model). A PNG carries text in its tEXt, iTXt and zTXt chunks, and carries
+// pixels in IDAT, which is deflate output: nobody types into it, and a run of bytes that happens to
+// decode as an address there is a coincidence of compression, not a disclosure. Scanned as one
+// string, a 2 MB screenshot is two million chances of that coincidence, and it has fired twice on
+// this repository's own committed captures.
+//
+// So: every chunk but IDAT is scanned, chunk type names included, and IDAT is not. A name RENDERED
+// INTO a screenshot is pixels, which no byte scan sees either way - that is the gap this scan has
+// always had, and it is unchanged. Everything that is not a PNG is scanned whole, as before.
+//
+// FAIL CLOSED WHERE THE FILE STOPS BEING A PNG (spec 038 approval F-3). Bytes after IEND are no chunk
+// at all, and a chunk whose length runs past the end of the file is a truncated file: either way the
+// remainder, from where the walk lost the structure, is scanned whole, as every file was before this
+// classification. And a text chunk is read in the encoding it carries text in: a zTXt chunk's text
+// and a compressed iTXt chunk's text are inflated and scanned as well as their raw bytes. A chunk
+// that does not inflate is scanned raw, which it already was.
+const PNG_SIG = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+const INFLATE_CAP = 16 * 1024 * 1024;
+function inflated(data) {
+  try { return zlib.inflateSync(data, { maxOutputLength: INFLATE_CAP }).toString('latin1'); } catch (_e) { return null; }
+}
+function pngTextBearing(buf) {
+  const parts = [];
+  const rest = (from) => { parts.push(buf.slice(from).toString('latin1')); return parts.join('\n'); };
+  let off = 8;
+  while (off + 8 <= buf.length) {
+    const len = buf.readUInt32BE(off);
+    const type = buf.slice(off + 4, off + 8).toString('latin1');
+    const start = off + 8;
+    const end = start + len;
+    if (end + 4 > buf.length) return rest(off);   // a truncated chunk: it and all after it, whole
+    const data = buf.slice(start, end);
+    if (type !== 'IDAT') parts.push(type, data.toString('latin1'));
+    if (type === 'zTXt') parts.push(zTXtText(data));
+    if (type === 'iTXt') parts.push(iTXtText(data));
+    off = end + 4;
+    if (type === 'IEND') return rest(off);         // bytes after IEND, whole
+  }
+  return rest(off);                                // fewer than a chunk header's bytes, no IEND
+}
+// keyword \0 method data
+function zTXtText(data) {
+  const z = data.indexOf(0);
+  return (z >= 0 && inflated(data.slice(z + 2))) || '';
+}
+// keyword \0 flag method language \0 translated keyword \0 text; the text is deflated when flag is 1
+function iTXtText(data) {
+  const z = data.indexOf(0);
+  if (z < 0 || data[z + 1] !== 1) return '';
+  const lang = data.indexOf(0, z + 3);
+  const tr = lang >= 0 ? data.indexOf(0, lang + 1) : -1;
+  return (tr >= 0 && inflated(data.slice(tr + 1))) || '';
+}
+
 function scanContent(rel, content) {
+  // A reader may hand this bytes rather than text. A PNG is then read as its text-bearing regions;
+  // anything else is decoded and scanned whole.
+  if (Buffer.isBuffer(content)) {
+    return scanContent(rel, content.slice(0, 8).equals(PNG_SIG) ? pngTextBearing(content) : content.toString('utf8'));
+  }
   const hits = [];
   for (const p of PATTERNS) {
     const m = content.match(p.re);
@@ -104,10 +169,10 @@ function scanFiles(files, read, readLink) {
     }
     let c;
     try { c = read(rel); } catch (_e) { continue; }
-    if (typeof c !== 'string') continue;
+    if (typeof c !== 'string' && !Buffer.isBuffer(c)) continue;
     hits.push(...scanContent(rel, c));
   }
   return hits;
 }
 
-module.exports = { PATTERNS, EMAIL_ALLOW, HOSTIP, scanPath, scanContent, scanFiles };
+module.exports = { PATTERNS, EMAIL_ALLOW, HOSTIP, PNG_SIG, pngTextBearing, scanPath, scanContent, scanFiles };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "driftproof",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "A dated proof that this skill, this hash, this model, still helps: run a skill's eval suite with and without the skill across model versions, emit hash-verified dated receipts, and diff receipts into drift reports.",
   "license": "Apache-2.0",
   "keywords": [
@@ -36,7 +36,7 @@
     "diff": "node bin/driftproof diff"
   },
   "dependencies": {
-    "ajv": "^8.17.1"
+    "ajv": "^8.18.0"
   },
   "optionalDependencies": {
     "@anthropic-ai/sdk": "^0.39.0"

package/spec/RECEIPT.md

@@ -183,7 +183,7 @@ carry a numeric `mean`.
 ## Which schema validates which receipt (the coexistence rule)
 
 - **A producer emits the current version.** `config.js` `RECEIPT_SCHEMA_VERSION`
-  decides it, and at this revision that is **v0.6**.
+  decides it, and at this revision that is **v0.7**.
 - **A reader validates against the receipt's own `schema_version`**, never
   against the newest schema it happens to have. `validateReceipt()` selects the
   schema by that field, which is why a v0.1 receipt from the first report still