stylegallery 0.1.0 → 0.1.1

package/scripts/test-summarize-sentinel-calibration.mjs

@@ -1,226 +0,0 @@
-#!/usr/bin/env node
-
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import { BASELINE_ENVIRONMENT, BASELINE_REFERENCE, sha256 } from "./baseline-contract.mjs";
-
-const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const summarizer = path.join(repositoryRoot, "scripts", "summarize-sentinel-calibration.mjs");
-const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "stylegallery-pr4-summary-"));
-const png = fs.readFileSync(path.join(repositoryRoot, BASELINE_REFERENCE.baseline.path));
-const dom = Buffer.from("<section class=card_grid></section>\n");
-const ax = Buffer.from("- region \"Project cards\"\n");
-const pngHash = sha256(png);
-const metadataHash = sha256(JSON.stringify({ environment: BASELINE_ENVIRONMENT, reference: BASELINE_REFERENCE }));
-
-function playwrightReport() {
-  return {
-    config: { projects: [{ id: "chromium", name: "chromium" }], version: "1.61.0", workers: 1 },
-    errors: [],
-    stats: { expected: 1, flaky: 0, skipped: 0, unexpected: 0 },
-    suites: [{
-      file: "consumer-reference-sentinels.spec.mjs",
-      specs: [{
-        ok: true,
-        tests: [{
-          expectedStatus: "passed",
-          projectId: "chromium",
-          projectName: "chromium",
-          results: [{ errors: [], status: "passed" }],
-          status: "expected",
-        }],
-        title: "canonical consumer reference preserves computed layout before its locator screenshot",
-      }],
-    }],
-  };
-}
-
-function writeJson(file, value) {
-  fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
-}
-
-function writeRun(root, run) {
-  const runRoot = path.join(root, `run-${String(run).padStart(2, "0")}`);
-  fs.mkdirSync(runRoot, { recursive: true });
-  fs.writeFileSync(path.join(runRoot, "actual.png"), png);
-  fs.writeFileSync(path.join(runRoot, "dom.html"), dom);
-  fs.writeFileSync(path.join(runRoot, "ax.txt"), ax);
-  writeJson(path.join(runRoot, "playwright.json"), playwrightReport());
-  writeJson(path.join(runRoot, "exit.json"), { exit_code: 0, run, schema_version: "1.0" });
-  writeJson(path.join(runRoot, "comparison.json"), {
-    actual_sha256: pngHash,
-    assertion: "visual_geometry_matches_proposed_baseline",
-    diff_pixels: 0,
-    expected_sha256: BASELINE_REFERENCE.baseline.sha256,
-    max_diff_pixels: 0,
-    run,
-    schema_version: "1.0",
-    status: "passed",
-    threshold: 0,
-  });
-  writeJson(path.join(runRoot, "metadata.json"), {
-    architecture: "amd64",
-    ax_sha256: sha256(ax),
-    dom_sha256: sha256(dom),
-    environment: BASELINE_ENVIRONMENT,
-    metadata_sha256: metadataHash,
-    png_sha256: pngHash,
-    reference: BASELINE_REFERENCE,
-    run,
-    schema_version: "1.0",
-  });
-  return runRoot;
-}
-
-function invoke(name, mutate, identity = {}) {
-  const input = path.join(tempRoot, name, "raw");
-  const outputFile = path.join(input, "calibration.json");
-  for (let run = 1; run <= 20; run += 1) writeRun(input, run);
-  mutate?.(path.join(input, "run-01"));
-  const sha = identity.sha ?? "0".repeat(40);
-  const checkoutSha = identity.checkoutSha ?? sha;
-  const executionRepository = identity.executionRepository ?? "changeroa/StyleGallery";
-  const headSha = identity.headSha ?? "1".repeat(40);
-  const repository = identity.repository ?? "changeroa/StyleGallery";
-  const runId = identity.runId ?? "123";
-  const artifactName = identity.artifactName ?? `chromium-sentinel-calibration-${runId}-${sha}`;
-  const child = spawnSync(process.execPath, [
-    summarizer,
-    "--input", input,
-    "--output", outputFile,
-    "--repository", repository,
-    "--execution-repository", executionRepository,
-    "--workflow", ".github/workflows/validate.yml",
-    "--run-id", runId,
-    "--run-attempt", "1",
-    "--sha", sha,
-    "--checkout-sha", checkoutSha,
-    "--head-sha", headSha,
-    "--artifact-name", artifactName,
-    "--json",
-  ], { cwd: repositoryRoot, encoding: "utf8" });
-  return {
-    output: fs.existsSync(outputFile) && fs.lstatSync(outputFile).isFile() ? JSON.parse(fs.readFileSync(outputFile, "utf8")) : null,
-    report: JSON.parse(child.stdout),
-    status: child.status,
-  };
-}
-
-const results = [];
-try {
-  const valid = invoke("valid");
-  results.push({
-    actual: { outputRuns: valid.output?.runs.length, report: valid.report, status: valid.status },
-    expected: "20 truth-derived stable runs awaiting external verification and zero diff statistics",
-    name: "valid_raw_calibration",
-    ok: valid.status === 0 && valid.report.ok === true && valid.report.status === "awaiting_external_verification"
-      && valid.output?.status === "awaiting_external_verification"
-      && valid.output?.committed_ci.external_verification === null
-      && valid.output?.runs.length === 20 && new Set(valid.output.runs.map((run) => run.png_sha256)).size === 1,
-  });
-  const pullRequestMergeSha = "11f4668fe5988720c27e88ec7203ecd1685a40df";
-  const pullRequestHeadSha = "8b8eaed41094286138973157b581a1d9ab9957a8";
-  const validFork = invoke("valid_explicit_fork", undefined, {
-    executionRepository: "ark-jo/StyleGallery",
-    headSha: pullRequestHeadSha,
-    runId: "29258810962",
-    sha: pullRequestMergeSha,
-  });
-  results.push({
-    actual: { committedCi: validFork.output?.committed_ci, report: validFork.report, status: validFork.status },
-    expected: "canonical upstream plus explicit execution fork with distinct merge/head SHAs",
-    name: "valid_explicit_fork_pull_request_identity",
-    ok: validFork.status === 0 && validFork.report.ok === true
-      && validFork.report.status === "awaiting_external_verification"
-      && validFork.output?.status === "awaiting_external_verification"
-      && validFork.output?.committed_ci.external_verification === null
-      && validFork.output?.committed_ci.repository === "changeroa/StyleGallery"
-      && validFork.output?.committed_ci.execution_repository === "ark-jo/StyleGallery"
-      && validFork.output?.committed_ci.sha === pullRequestMergeSha
-      && validFork.output?.committed_ci.checkout_sha === pullRequestMergeSha
-      && validFork.output?.committed_ci.head_sha === pullRequestHeadSha,
-  });
-  const invalidCases = [
-    ["missing_exit", (root) => fs.rmSync(path.join(root, "exit.json")), "calibration_raw_file_missing"],
-    ["nonzero_exit", (root) => writeJson(path.join(root, "exit.json"), { exit_code: 1, run: 1, schema_version: "1.0" }), "calibration_exit_unsuccessful"],
-    ["fake_playwright", (root) => writeJson(path.join(root, "playwright.json"), {}), "calibration_playwright_identity"],
-    ["duplicate_metadata", (root) => fs.copyFileSync(path.join(root, "metadata.json"), path.join(root, "metadata-copy.json")), "calibration_raw_file_unknown"],
-    ["unknown_metadata", (root) => {
-      const file = path.join(root, "metadata.json");
-      const metadata = JSON.parse(fs.readFileSync(file, "utf8"));
-      writeJson(file, { ...metadata, completed: true });
-    }, "calibration_metadata_property_unknown"],
-    ["duplicate_metadata_property", (root) => {
-      const file = path.join(root, "metadata.json");
-      const metadata = fs.readFileSync(file, "utf8").replace('"schema_version": "1.0"', '"schema_version": "1.0",\n  "schema_version": "1.0"');
-      fs.writeFileSync(file, metadata);
-    }, "calibration_metadata_missing_invalid"],
-    ["missing_comparison", (root) => fs.rmSync(path.join(root, "comparison.json")), "calibration_raw_file_missing"],
-    ["relaxed_comparison_threshold", (root) => {
-      const file = path.join(root, "comparison.json");
-      const comparison = JSON.parse(fs.readFileSync(file, "utf8"));
-      writeJson(file, { ...comparison, threshold: 0.1 });
-    }, "calibration_comparison_mismatch"],
-    ["invalid_run_directory", (root) => {
-      fs.rmSync(root, { recursive: true });
-      fs.writeFileSync(root, "not a directory\n");
-    }, "calibration_run_directory_invalid"],
-    ["invalid_input_file", (root) => {
-      const input = path.dirname(root);
-      fs.rmSync(input, { recursive: true });
-      fs.writeFileSync(input, "not a directory\n");
-    }, "calibration_input_invalid"],
-    ["symlinked_input_directory", (root) => {
-      const input = path.dirname(root);
-      const external = path.join(tempRoot, "external-input");
-      fs.cpSync(input, external, { recursive: true });
-      fs.rmSync(input, { recursive: true });
-      fs.symlinkSync(external, input);
-    }, "calibration_input_invalid"],
-    ["invalid_output_directory", (root) => fs.mkdirSync(path.join(path.dirname(root), "calibration.json")), "calibration_output_invalid"],
-    ["unknown_root_file", (root) => fs.writeFileSync(path.join(path.dirname(root), "forged.json"), "{}\n"), "calibration_run_directory_unknown"],
-    ["symlinked_run_directory", (root) => {
-      const external = path.join(tempRoot, "external-run");
-      fs.cpSync(path.join(path.dirname(root), "run-02"), external, { recursive: true });
-      fs.rmSync(root, { recursive: true });
-      fs.symlinkSync(external, root);
-    }, "calibration_run_directory_invalid"],
-    ["artifact_directory", (root) => {
-      fs.rmSync(path.join(root, "actual.png"));
-      fs.mkdirSync(path.join(root, "actual.png"));
-    }, "calibration_artifact_hash_mismatch"],
-    ["oversized_metadata", (root) => fs.appendFileSync(path.join(root, "metadata.json"), " ".repeat(1024 * 1024)), "calibration_raw_file_oversized"],
-    ["oversized_png", (root) => fs.appendFileSync(path.join(root, "actual.png"), Buffer.alloc(5 * 1024 * 1024)), "calibration_raw_file_oversized"],
-  ];
-  for (const [name, mutate, expected] of invalidCases) {
-    const actual = invoke(name, mutate);
-    const codes = actual.report.failures.map((failure) => failure.code);
-    results.push({ actual: { codes, outputExists: actual.output !== null, status: actual.status }, expected, name, ok: actual.status !== 0 && actual.output === null && actual.report.status === "incomplete" && codes.includes(expected) });
-  }
-  const identityCases = [
-    ["checkout_sha_not_tested_sha", { checkoutSha: "1".repeat(40) }],
-    ["artifact_bound_to_head_sha", { artifactName: `chromium-sentinel-calibration-123-${"1".repeat(40)}` }],
-    ["unrecognized_execution_repository", { executionRepository: "untrusted/StyleGallery" }],
-    ["swapped_canonical_and_execution_repository", { executionRepository: "changeroa/StyleGallery", repository: "ark-jo/StyleGallery" }],
-  ];
-  for (const [name, identity] of identityCases) {
-    const actual = invoke(name, undefined, identity);
-    const codes = actual.report.failures.map((failure) => failure.code);
-    results.push({
-      actual: { codes, outputExists: actual.output !== null, status: actual.status },
-      expected: "calibration_committed_ci_invalid",
-      name,
-      ok: actual.status !== 0 && actual.output === null && codes.includes("calibration_committed_ci_invalid"),
-    });
-  }
-} finally {
-  fs.rmSync(tempRoot, { force: true, recursive: true });
-}
-
-const failures = results.filter((result) => !result.ok).map((result) => `missing_semantic:${result.name}:${result.expected}`);
-const report = { failures, ok: failures.length === 0, results };
-process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
-if (!report.ok) process.exitCode = 1;

package/scripts/test-validate-baseline-manifest.mjs

@@ -1,234 +0,0 @@
-#!/usr/bin/env node
-
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import { BASELINE_METADATA_SHA256, BASELINE_REFERENCE, sha256 } from "./baseline-contract.mjs";
-import { baselineSchemaParity } from "./baseline-schema-parity.mjs";
-
-const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const validator = path.join(repositoryRoot, "scripts", "validate-baseline-manifest.mjs");
-const canonical = JSON.parse(fs.readFileSync(path.join(repositoryRoot, "consumer-reference", "baselines", "calibration.json"), "utf8"));
-const canonicalManifest = JSON.parse(fs.readFileSync(path.join(repositoryRoot, "consumer-reference", "baselines", "manifest.json"), "utf8"));
-const schema = JSON.parse(fs.readFileSync(path.join(repositoryRoot, "consumer-reference", "schema", "calibration-record.schema.json"), "utf8"));
-const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "stylegallery-pr4-calibration-"));
-const completedEvidence = {
-  artifactId: "8283099324",
-  artifactName: "chromium-sentinel-calibration-29260372260-18229be570766d3b42f5600955120bfcba690b76",
-  artifactApiDigest: "sha256:3f11a517b447e1b5a1da17d9ee66ba2dd947fc8a0a482c447556ef00652e6074",
-  artifactExpiresAt: "2026-07-27T15:01:36Z",
-  artifactSize: 70310,
-  checkoutSha: "18229be570766d3b42f5600955120bfcba690b76",
-  headSha: "3bfdd25ec9a2df4ca84e19541365d48842a73f59",
-  rawEvidenceSha256: "1f125d5b321063b364e19283897c78c126d73eb1b3368d14686c494b1296dfab",
-  runId: "29260372260",
-  source: "https://github.com/ark-jo/StyleGallery/actions/runs/29260372260",
-  verifiedAt: "2026-07-13T15:04:41Z",
-};
-
-function externalVerification() {
-  return {
-    artifact: {
-      api_digest: completedEvidence.artifactApiDigest,
-      expires_at: completedEvidence.artifactExpiresAt,
-      id: completedEvidence.artifactId,
-      name: completedEvidence.artifactName,
-      size_in_bytes: completedEvidence.artifactSize,
-    },
-    repository_relationship: {
-      execution_is_fork: true,
-      parent: "changeroa/StyleGallery",
-      source: "changeroa/StyleGallery",
-    },
-    source: completedEvidence.source,
-    verified_at: completedEvidence.verifiedAt,
-  };
-}
-
-function completeRecord(committedCi = {}) {
-  const runs = Array.from({ length: 20 }, (_, index) => ({
-    architecture: "amd64",
-    ax_sha256: "a".repeat(64),
-    completed: true,
-    dom_sha256: "b".repeat(64),
-    metadata_sha256: BASELINE_METADATA_SHA256,
-    png_sha256: BASELINE_REFERENCE.baseline.sha256,
-    run: index + 1,
-    screenshot_diff_pixels: 0,
-  }));
-  return {
-    ...canonical,
-    committed_ci: {
-      artifact_name: completedEvidence.artifactName,
-      checkout_sha: completedEvidence.checkoutSha,
-      execution_repository: "ark-jo/StyleGallery",
-      external_verification: externalVerification(),
-      head_sha: completedEvidence.headSha,
-      raw_evidence_sha256: completedEvidence.rawEvidenceSha256,
-      repository: "changeroa/StyleGallery",
-      run_attempt: "1",
-      run_id: completedEvidence.runId,
-      sha: completedEvidence.checkoutSha,
-      workflow: ".github/workflows/validate.yml",
-      ...committedCi,
-    },
-    status: "completed",
-    runs,
-  };
-}
-
-const cases = [
-  ["nineteen_of_twenty", (record) => ({ ...record, runs: record.runs.slice(0, 19) }), "calibration_run_count"],
-  ["duplicate_run", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, run: 19 } : run) }), "calibration_run_duplicate"],
-  ["missing_run", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, run: 21 } : run) }), "calibration_run_set"],
-  ["architecture_variance", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, architecture: "arm64" } : run) }), "calibration_architecture_variance"],
-  ["environment_mismatch", (record) => ({ ...record, environment: { ...record.environment, architecture: "arm64" } }), "calibration_environment_mismatch"],
-  ["hash_variance", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, png_sha256: "e".repeat(64) } : run) }), "calibration_hash_variance"],
-  ["metadata_variance", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, metadata_sha256: "f".repeat(64) } : run) }), "calibration_metadata_variance"],
-  ["incomplete_run", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, completed: false } : run) }), "calibration_run_incomplete"],
-  ["nonzero_diff", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, screenshot_diff_pixels: 1 } : run) }), "calibration_diff_nonzero"],
-  ["malformed_hash", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, png_sha256: "x" } : run) }), "calibration_hash_invalid"],
-  ["wrong_stable_baseline_hash", (record) => ({ ...record, runs: record.runs.map((run) => ({ ...run, png_sha256: "d".repeat(64) })) }), "calibration_baseline_hash_mismatch"],
-  ["wrong_stable_metadata_hash", (record) => ({ ...record, runs: record.runs.map((run) => ({ ...run, metadata_sha256: "c".repeat(64) })) }), "calibration_metadata_hash_mismatch"],
-  ["unknown_run_property", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, forged: true } : run) }), "calibration_run_property_unknown"],
-  ["checkout_sha_not_tested_sha", (record) => ({ ...record, committed_ci: { ...record.committed_ci, checkout_sha: record.committed_ci.head_sha } }), "calibration_committed_ci_invalid"],
-  ["artifact_bound_to_head_sha", (record) => ({ ...record, committed_ci: { ...record.committed_ci, artifact_name: `chromium-sentinel-calibration-${record.committed_ci.run_id}-${record.committed_ci.head_sha}` } }), "calibration_committed_ci_invalid"],
-  ["unrecognized_execution_repository", (record) => ({ ...record, committed_ci: { ...record.committed_ci, execution_repository: "untrusted/StyleGallery" } }), "calibration_committed_ci_invalid"],
-  ["swapped_canonical_and_execution_repository", (record) => ({ ...record, committed_ci: { ...record.committed_ci, execution_repository: "changeroa/StyleGallery", repository: "ark-jo/StyleGallery" } }), "calibration_committed_ci_invalid"],
-  ["missing_execution_repository", (record) => {
-    const { execution_repository: omitted, ...committedCi } = record.committed_ci;
-    return { ...record, committed_ci: committedCi };
-  }, "calibration_committed_ci_invalid"],
-  ["completed_missing_external_verification", (record) => {
-    const { external_verification: omitted, ...committedCi } = record.committed_ci;
-    return { ...record, committed_ci: committedCi };
-  }, "calibration_external_verification_missing"],
-  ["forged_external_artifact_id", (record) => ({ ...record, committed_ci: { ...record.committed_ci, external_verification: { ...record.committed_ci.external_verification, artifact: { ...record.committed_ci.external_verification.artifact, id: "8283099325" } } } }), "calibration_external_verification_invalid"],
-  ["forged_external_artifact_digest", (record) => ({ ...record, committed_ci: { ...record.committed_ci, external_verification: { ...record.committed_ci.external_verification, artifact: { ...record.committed_ci.external_verification.artifact, api_digest: `sha256:${"f".repeat(64)}` } } } }), "calibration_external_verification_invalid"],
-  ["raw_digest_substituted_for_artifact_digest", (record) => ({ ...record, committed_ci: { ...record.committed_ci, external_verification: { ...record.committed_ci.external_verification, artifact: { ...record.committed_ci.external_verification.artifact, api_digest: `sha256:${record.committed_ci.raw_evidence_sha256}` } } } }), "calibration_external_verification_invalid"],
-  ["forged_external_source", (record) => ({ ...record, committed_ci: { ...record.committed_ci, external_verification: { ...record.committed_ci.external_verification, source: "https://github.com/ark-jo/StyleGallery/actions/runs/1" } } }), "calibration_external_verification_invalid"],
-  ["forged_fork_parent_relationship", (record) => ({ ...record, committed_ci: { ...record.committed_ci, external_verification: { ...record.committed_ci.external_verification, repository_relationship: { ...record.committed_ci.external_verification.repository_relationship, parent: "untrusted/StyleGallery" } } } }), "calibration_external_verification_invalid"],
-  ["invalid_committed_ci", (record) => ({ ...record, committed_ci: { artifact_name: "forged", extra: true, run_id: "abc", sha: "x" } }), "calibration_committed_ci_property_unknown"],
-  ["owner_approval_preclaim", (record) => ({ ...record, baseline_owner_approval: "approved" }), "baseline_owner_approval_invalid"],
-  ["pending_evidence_preclaim", (record) => ({ ...record, status: "awaiting_committed_ci" }), "calibration_pending_evidence_forbidden"],
-];
-
-const results = [];
-try {
-  const schemaParity = baselineSchemaParity(schema, canonical, completedEvidence);
-  results.push({ actual: { schemaParity }, expected: "recursive schema/runtime identity parity", name: "schema_runtime_parity", ok: schemaParity });
-  const validFixture = path.join(tempRoot, "valid-completed.json");
-  fs.writeFileSync(validFixture, `${JSON.stringify(completeRecord(), null, 2)}\n`);
-  const validChild = spawnSync(process.execPath, [validator, "--calibration", validFixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
-  const validOutput = JSON.parse(validChild.stdout);
-  results.push({ actual: { codes: validOutput.failures.map((failure) => failure.code), status: validChild.status }, expected: "completed calibration and exit:0", name: "valid_completed_calibration", ok: validChild.status === 0 && validOutput.ok === true });
-  const awaitingExternalFixture = path.join(tempRoot, "valid-awaiting-external-verification.json");
-  fs.writeFileSync(awaitingExternalFixture, `${JSON.stringify({
-    ...completeRecord({ external_verification: null }),
-    status: "awaiting_external_verification",
-  }, null, 2)}\n`);
-  const awaitingExternalChild = spawnSync(process.execPath, [validator, "--calibration", awaitingExternalFixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
-  const awaitingExternalOutput = JSON.parse(awaitingExternalChild.stdout);
-  results.push({
-    actual: { codes: awaitingExternalOutput.failures.map((failure) => failure.code), status: awaitingExternalChild.status },
-    expected: "pre-upload calibration awaits external verification and exits 0",
-    name: "valid_awaiting_external_verification",
-    ok: awaitingExternalChild.status === 0 && awaitingExternalOutput.ok === true,
-  });
-  const pendingFixture = path.join(tempRoot, "valid-awaiting-committed-ci.json");
-  fs.writeFileSync(pendingFixture, `${JSON.stringify({ ...canonical, committed_ci: null, runs: [], status: "awaiting_committed_ci" }, null, 2)}\n`);
-  const pendingChild = spawnSync(process.execPath, [validator, "--calibration", pendingFixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
-  const pendingOutput = JSON.parse(pendingChild.stdout);
-  results.push({
-    actual: { codes: pendingOutput.failures.map((failure) => failure.code), status: pendingChild.status },
-    expected: "initial pending record and exit:0",
-    name: "valid_awaiting_committed_ci",
-    ok: pendingChild.status === 0 && pendingOutput.ok === true,
-  });
-  const pullRequestFixture = path.join(tempRoot, "valid-pull-request-merge-head.json");
-  const mergeSha = "11f4668fe5988720c27e88ec7203ecd1685a40df";
-  const headSha = "8b8eaed41094286138973157b581a1d9ab9957a8";
-  fs.writeFileSync(pullRequestFixture, `${JSON.stringify({
-    ...completeRecord({
-      artifact_name: `chromium-sentinel-calibration-29258810962-${mergeSha}`,
-      checkout_sha: mergeSha,
-      execution_repository: "ark-jo/StyleGallery",
-      external_verification: null,
-      head_sha: headSha,
-      repository: "changeroa/StyleGallery",
-      run_id: "29258810962",
-      sha: mergeSha,
-    }),
-    status: "awaiting_external_verification",
-  }, null, 2)}\n`);
-  const pullRequestChild = spawnSync(process.execPath, [validator, "--calibration", pullRequestFixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
-  const pullRequestOutput = JSON.parse(pullRequestChild.stdout);
-  results.push({
-    actual: { codes: pullRequestOutput.failures.map((failure) => failure.code), status: pullRequestChild.status },
-    expected: "distinct canonical pull-request merge checkout and head SHAs",
-    name: "valid_pull_request_merge_and_head_identity",
-    ok: pullRequestChild.status === 0 && pullRequestOutput.ok === true,
-  });
-  for (const [name, mutate, expected] of cases) {
-    const fixture = path.join(tempRoot, `${name}.json`);
-    fs.writeFileSync(fixture, `${JSON.stringify(mutate(completeRecord()), null, 2)}\n`);
-    const child = spawnSync(process.execPath, [validator, "--calibration", fixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
-    const output = JSON.parse(child.stdout);
-    const codes = Array.isArray(output.failures) ? output.failures.map((failure) => failure.code) : [];
-    results.push({ actual: { codes, status: child.status }, expected, name, ok: child.status !== 0 && codes.includes(expected) });
-  }
-  const manifestFixture = path.join(tempRoot, "unknown-manifest-nested.json");
-  fs.writeFileSync(manifestFixture, `${JSON.stringify({
-    ...canonicalManifest,
-    calibration: { ...canonicalManifest.calibration, forged: true },
-    source: { ...canonicalManifest.source, forged: true },
-  }, null, 2)}\n`);
-  const manifestChild = spawnSync(process.execPath, [validator, "--manifest", manifestFixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
-  const manifestOutput = JSON.parse(manifestChild.stdout);
-  const manifestCodes = manifestOutput.failures.map((failure) => failure.code);
-  results.push({
-    actual: { codes: manifestCodes, status: manifestChild.status },
-    expected: "baseline_calibration_property_unknown and baseline_source_property_unknown",
-    name: "unknown_manifest_nested_properties",
-    ok: manifestChild.status !== 0 && manifestCodes.includes("baseline_calibration_property_unknown") && manifestCodes.includes("baseline_source_property_unknown"),
-  });
-  const alternateFile = path.join(repositoryRoot, "package.json");
-  const alternateManifestFixture = path.join(tempRoot, "alternate-baseline.json");
-  fs.writeFileSync(alternateManifestFixture, `${JSON.stringify({
-    ...canonicalManifest,
-    baseline: { path: "package.json", sha256: sha256(fs.readFileSync(alternateFile)) },
-  }, null, 2)}\n`);
-  const alternateChild = spawnSync(process.execPath, [validator, "--manifest", alternateManifestFixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
-  const alternateOutput = JSON.parse(alternateChild.stdout);
-  const alternateCodes = alternateOutput.failures.map((failure) => failure.code);
-  results.push({
-    actual: { codes: alternateCodes, status: alternateChild.status },
-    expected: "baseline_baseline_reference_mismatch",
-    name: "alternate_in_repo_baseline",
-    ok: alternateChild.status !== 0 && alternateCodes.includes("baseline_baseline_reference_mismatch"),
-  });
-  const directoryManifestFixture = path.join(tempRoot, "directory-baseline.json");
-  fs.writeFileSync(directoryManifestFixture, `${JSON.stringify({ ...canonicalManifest, baseline: { path: "tests", sha256: "a".repeat(64) } }, null, 2)}\n`);
-  const directoryChild = spawnSync(process.execPath, [validator, "--manifest", directoryManifestFixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
-  const directoryOutput = JSON.parse(directoryChild.stdout);
-  results.push({ actual: { codes: directoryOutput.failures.map((failure) => failure.code), status: directoryChild.status }, expected: "baseline_baseline_file_invalid", name: "directory_manifest_target", ok: directoryChild.status !== 0 && directoryOutput.failures.some((failure) => failure.code === "baseline_baseline_file_invalid") });
-  for (const [name, content, expected] of [
-    ["null_calibration", "null\n", "calibration_record_invalid"],
-    ["duplicate_calibration_property", '{"schema_version":"1.0","schema_version":"1.0"}\n', "baseline_json_invalid"],
-  ]) {
-    const fixture = path.join(tempRoot, `${name}.json`);
-    fs.writeFileSync(fixture, content);
-    const child = spawnSync(process.execPath, [validator, "--calibration", fixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
-    const output = JSON.parse(child.stdout);
-    results.push({ actual: { codes: output.failures.map((failure) => failure.code), status: child.status }, expected, name, ok: child.status !== 0 && output.failures.some((failure) => failure.code === expected) });
-  }
-} finally {
-  fs.rmSync(tempRoot, { force: true, recursive: true });
-}
-
-const failures = results.filter((result) => !result.ok).map((result) => `missing_semantic:${result.name}:${result.expected}`);
-const report = { failures, ok: failures.length === 0, results };
-process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
-if (!report.ok) process.exitCode = 1;