stylegallery 0.1.0

package/scripts/test-summarize-sentinel-calibration.mjs

@@ -0,0 +1,226 @@
+#!/usr/bin/env node
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { BASELINE_ENVIRONMENT, BASELINE_REFERENCE, sha256 } from "./baseline-contract.mjs";
+
+const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const summarizer = path.join(repositoryRoot, "scripts", "summarize-sentinel-calibration.mjs");
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "stylegallery-pr4-summary-"));
+const png = fs.readFileSync(path.join(repositoryRoot, BASELINE_REFERENCE.baseline.path));
+const dom = Buffer.from("<section class=card_grid></section>\n");
+const ax = Buffer.from("- region \"Project cards\"\n");
+const pngHash = sha256(png);
+const metadataHash = sha256(JSON.stringify({ environment: BASELINE_ENVIRONMENT, reference: BASELINE_REFERENCE }));
+
+function playwrightReport() {
+  return {
+    config: { projects: [{ id: "chromium", name: "chromium" }], version: "1.61.0", workers: 1 },
+    errors: [],
+    stats: { expected: 1, flaky: 0, skipped: 0, unexpected: 0 },
+    suites: [{
+      file: "consumer-reference-sentinels.spec.mjs",
+      specs: [{
+        ok: true,
+        tests: [{
+          expectedStatus: "passed",
+          projectId: "chromium",
+          projectName: "chromium",
+          results: [{ errors: [], status: "passed" }],
+          status: "expected",
+        }],
+        title: "canonical consumer reference preserves computed layout before its locator screenshot",
+      }],
+    }],
+  };
+}
+
+function writeJson(file, value) {
+  fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function writeRun(root, run) {
+  const runRoot = path.join(root, `run-${String(run).padStart(2, "0")}`);
+  fs.mkdirSync(runRoot, { recursive: true });
+  fs.writeFileSync(path.join(runRoot, "actual.png"), png);
+  fs.writeFileSync(path.join(runRoot, "dom.html"), dom);
+  fs.writeFileSync(path.join(runRoot, "ax.txt"), ax);
+  writeJson(path.join(runRoot, "playwright.json"), playwrightReport());
+  writeJson(path.join(runRoot, "exit.json"), { exit_code: 0, run, schema_version: "1.0" });
+  writeJson(path.join(runRoot, "comparison.json"), {
+    actual_sha256: pngHash,
+    assertion: "visual_geometry_matches_proposed_baseline",
+    diff_pixels: 0,
+    expected_sha256: BASELINE_REFERENCE.baseline.sha256,
+    max_diff_pixels: 0,
+    run,
+    schema_version: "1.0",
+    status: "passed",
+    threshold: 0,
+  });
+  writeJson(path.join(runRoot, "metadata.json"), {
+    architecture: "amd64",
+    ax_sha256: sha256(ax),
+    dom_sha256: sha256(dom),
+    environment: BASELINE_ENVIRONMENT,
+    metadata_sha256: metadataHash,
+    png_sha256: pngHash,
+    reference: BASELINE_REFERENCE,
+    run,
+    schema_version: "1.0",
+  });
+  return runRoot;
+}
+
+function invoke(name, mutate, identity = {}) {
+  const input = path.join(tempRoot, name, "raw");
+  const outputFile = path.join(input, "calibration.json");
+  for (let run = 1; run <= 20; run += 1) writeRun(input, run);
+  mutate?.(path.join(input, "run-01"));
+  const sha = identity.sha ?? "0".repeat(40);
+  const checkoutSha = identity.checkoutSha ?? sha;
+  const executionRepository = identity.executionRepository ?? "changeroa/StyleGallery";
+  const headSha = identity.headSha ?? "1".repeat(40);
+  const repository = identity.repository ?? "changeroa/StyleGallery";
+  const runId = identity.runId ?? "123";
+  const artifactName = identity.artifactName ?? `chromium-sentinel-calibration-${runId}-${sha}`;
+  const child = spawnSync(process.execPath, [
+    summarizer,
+    "--input", input,
+    "--output", outputFile,
+    "--repository", repository,
+    "--execution-repository", executionRepository,
+    "--workflow", ".github/workflows/validate.yml",
+    "--run-id", runId,
+    "--run-attempt", "1",
+    "--sha", sha,
+    "--checkout-sha", checkoutSha,
+    "--head-sha", headSha,
+    "--artifact-name", artifactName,
+    "--json",
+  ], { cwd: repositoryRoot, encoding: "utf8" });
+  return {
+    output: fs.existsSync(outputFile) && fs.lstatSync(outputFile).isFile() ? JSON.parse(fs.readFileSync(outputFile, "utf8")) : null,
+    report: JSON.parse(child.stdout),
+    status: child.status,
+  };
+}
+
+const results = [];
+try {
+  const valid = invoke("valid");
+  results.push({
+    actual: { outputRuns: valid.output?.runs.length, report: valid.report, status: valid.status },
+    expected: "20 truth-derived stable runs awaiting external verification and zero diff statistics",
+    name: "valid_raw_calibration",
+    ok: valid.status === 0 && valid.report.ok === true && valid.report.status === "awaiting_external_verification"
+      && valid.output?.status === "awaiting_external_verification"
+      && valid.output?.committed_ci.external_verification === null
+      && valid.output?.runs.length === 20 && new Set(valid.output.runs.map((run) => run.png_sha256)).size === 1,
+  });
+  const pullRequestMergeSha = "11f4668fe5988720c27e88ec7203ecd1685a40df";
+  const pullRequestHeadSha = "8b8eaed41094286138973157b581a1d9ab9957a8";
+  const validFork = invoke("valid_explicit_fork", undefined, {
+    executionRepository: "ark-jo/StyleGallery",
+    headSha: pullRequestHeadSha,
+    runId: "29258810962",
+    sha: pullRequestMergeSha,
+  });
+  results.push({
+    actual: { committedCi: validFork.output?.committed_ci, report: validFork.report, status: validFork.status },
+    expected: "canonical upstream plus explicit execution fork with distinct merge/head SHAs",
+    name: "valid_explicit_fork_pull_request_identity",
+    ok: validFork.status === 0 && validFork.report.ok === true
+      && validFork.report.status === "awaiting_external_verification"
+      && validFork.output?.status === "awaiting_external_verification"
+      && validFork.output?.committed_ci.external_verification === null
+      && validFork.output?.committed_ci.repository === "changeroa/StyleGallery"
+      && validFork.output?.committed_ci.execution_repository === "ark-jo/StyleGallery"
+      && validFork.output?.committed_ci.sha === pullRequestMergeSha
+      && validFork.output?.committed_ci.checkout_sha === pullRequestMergeSha
+      && validFork.output?.committed_ci.head_sha === pullRequestHeadSha,
+  });
+  const invalidCases = [
+    ["missing_exit", (root) => fs.rmSync(path.join(root, "exit.json")), "calibration_raw_file_missing"],
+    ["nonzero_exit", (root) => writeJson(path.join(root, "exit.json"), { exit_code: 1, run: 1, schema_version: "1.0" }), "calibration_exit_unsuccessful"],
+    ["fake_playwright", (root) => writeJson(path.join(root, "playwright.json"), {}), "calibration_playwright_identity"],
+    ["duplicate_metadata", (root) => fs.copyFileSync(path.join(root, "metadata.json"), path.join(root, "metadata-copy.json")), "calibration_raw_file_unknown"],
+    ["unknown_metadata", (root) => {
+      const file = path.join(root, "metadata.json");
+      const metadata = JSON.parse(fs.readFileSync(file, "utf8"));
+      writeJson(file, { ...metadata, completed: true });
+    }, "calibration_metadata_property_unknown"],
+    ["duplicate_metadata_property", (root) => {
+      const file = path.join(root, "metadata.json");
+      const metadata = fs.readFileSync(file, "utf8").replace('"schema_version": "1.0"', '"schema_version": "1.0",\n  "schema_version": "1.0"');
+      fs.writeFileSync(file, metadata);
+    }, "calibration_metadata_missing_invalid"],
+    ["missing_comparison", (root) => fs.rmSync(path.join(root, "comparison.json")), "calibration_raw_file_missing"],
+    ["relaxed_comparison_threshold", (root) => {
+      const file = path.join(root, "comparison.json");
+      const comparison = JSON.parse(fs.readFileSync(file, "utf8"));
+      writeJson(file, { ...comparison, threshold: 0.1 });
+    }, "calibration_comparison_mismatch"],
+    ["invalid_run_directory", (root) => {
+      fs.rmSync(root, { recursive: true });
+      fs.writeFileSync(root, "not a directory\n");
+    }, "calibration_run_directory_invalid"],
+    ["invalid_input_file", (root) => {
+      const input = path.dirname(root);
+      fs.rmSync(input, { recursive: true });
+      fs.writeFileSync(input, "not a directory\n");
+    }, "calibration_input_invalid"],
+    ["symlinked_input_directory", (root) => {
+      const input = path.dirname(root);
+      const external = path.join(tempRoot, "external-input");
+      fs.cpSync(input, external, { recursive: true });
+      fs.rmSync(input, { recursive: true });
+      fs.symlinkSync(external, input);
+    }, "calibration_input_invalid"],
+    ["invalid_output_directory", (root) => fs.mkdirSync(path.join(path.dirname(root), "calibration.json")), "calibration_output_invalid"],
+    ["unknown_root_file", (root) => fs.writeFileSync(path.join(path.dirname(root), "forged.json"), "{}\n"), "calibration_run_directory_unknown"],
+    ["symlinked_run_directory", (root) => {
+      const external = path.join(tempRoot, "external-run");
+      fs.cpSync(path.join(path.dirname(root), "run-02"), external, { recursive: true });
+      fs.rmSync(root, { recursive: true });
+      fs.symlinkSync(external, root);
+    }, "calibration_run_directory_invalid"],
+    ["artifact_directory", (root) => {
+      fs.rmSync(path.join(root, "actual.png"));
+      fs.mkdirSync(path.join(root, "actual.png"));
+    }, "calibration_artifact_hash_mismatch"],
+    ["oversized_metadata", (root) => fs.appendFileSync(path.join(root, "metadata.json"), " ".repeat(1024 * 1024)), "calibration_raw_file_oversized"],
+    ["oversized_png", (root) => fs.appendFileSync(path.join(root, "actual.png"), Buffer.alloc(5 * 1024 * 1024)), "calibration_raw_file_oversized"],
+  ];
+  for (const [name, mutate, expected] of invalidCases) {
+    const actual = invoke(name, mutate);
+    const codes = actual.report.failures.map((failure) => failure.code);
+    results.push({ actual: { codes, outputExists: actual.output !== null, status: actual.status }, expected, name, ok: actual.status !== 0 && actual.output === null && actual.report.status === "incomplete" && codes.includes(expected) });
+  }
+  const identityCases = [
+    ["checkout_sha_not_tested_sha", { checkoutSha: "1".repeat(40) }],
+    ["artifact_bound_to_head_sha", { artifactName: `chromium-sentinel-calibration-123-${"1".repeat(40)}` }],
+    ["unrecognized_execution_repository", { executionRepository: "untrusted/StyleGallery" }],
+    ["swapped_canonical_and_execution_repository", { executionRepository: "changeroa/StyleGallery", repository: "ark-jo/StyleGallery" }],
+  ];
+  for (const [name, identity] of identityCases) {
+    const actual = invoke(name, undefined, identity);
+    const codes = actual.report.failures.map((failure) => failure.code);
+    results.push({
+      actual: { codes, outputExists: actual.output !== null, status: actual.status },
+      expected: "calibration_committed_ci_invalid",
+      name,
+      ok: actual.status !== 0 && actual.output === null && codes.includes("calibration_committed_ci_invalid"),
+    });
+  }
+} finally {
+  fs.rmSync(tempRoot, { force: true, recursive: true });
+}
+
+const failures = results.filter((result) => !result.ok).map((result) => `missing_semantic:${result.name}:${result.expected}`);
+const report = { failures, ok: failures.length === 0, results };
+process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+if (!report.ok) process.exitCode = 1;

package/scripts/test-validate-baseline-manifest.mjs

@@ -0,0 +1,234 @@
+#!/usr/bin/env node
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { BASELINE_METADATA_SHA256, BASELINE_REFERENCE, sha256 } from "./baseline-contract.mjs";
+import { baselineSchemaParity } from "./baseline-schema-parity.mjs";
+
+const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const validator = path.join(repositoryRoot, "scripts", "validate-baseline-manifest.mjs");
+const canonical = JSON.parse(fs.readFileSync(path.join(repositoryRoot, "consumer-reference", "baselines", "calibration.json"), "utf8"));
+const canonicalManifest = JSON.parse(fs.readFileSync(path.join(repositoryRoot, "consumer-reference", "baselines", "manifest.json"), "utf8"));
+const schema = JSON.parse(fs.readFileSync(path.join(repositoryRoot, "consumer-reference", "schema", "calibration-record.schema.json"), "utf8"));
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "stylegallery-pr4-calibration-"));
+const completedEvidence = {
+  artifactId: "8283099324",
+  artifactName: "chromium-sentinel-calibration-29260372260-18229be570766d3b42f5600955120bfcba690b76",
+  artifactApiDigest: "sha256:3f11a517b447e1b5a1da17d9ee66ba2dd947fc8a0a482c447556ef00652e6074",
+  artifactExpiresAt: "2026-07-27T15:01:36Z",
+  artifactSize: 70310,
+  checkoutSha: "18229be570766d3b42f5600955120bfcba690b76",
+  headSha: "3bfdd25ec9a2df4ca84e19541365d48842a73f59",
+  rawEvidenceSha256: "1f125d5b321063b364e19283897c78c126d73eb1b3368d14686c494b1296dfab",
+  runId: "29260372260",
+  source: "https://github.com/ark-jo/StyleGallery/actions/runs/29260372260",
+  verifiedAt: "2026-07-13T15:04:41Z",
+};
+
+function externalVerification() {
+  return {
+    artifact: {
+      api_digest: completedEvidence.artifactApiDigest,
+      expires_at: completedEvidence.artifactExpiresAt,
+      id: completedEvidence.artifactId,
+      name: completedEvidence.artifactName,
+      size_in_bytes: completedEvidence.artifactSize,
+    },
+    repository_relationship: {
+      execution_is_fork: true,
+      parent: "changeroa/StyleGallery",
+      source: "changeroa/StyleGallery",
+    },
+    source: completedEvidence.source,
+    verified_at: completedEvidence.verifiedAt,
+  };
+}
+
+function completeRecord(committedCi = {}) {
+  const runs = Array.from({ length: 20 }, (_, index) => ({
+    architecture: "amd64",
+    ax_sha256: "a".repeat(64),
+    completed: true,
+    dom_sha256: "b".repeat(64),
+    metadata_sha256: BASELINE_METADATA_SHA256,
+    png_sha256: BASELINE_REFERENCE.baseline.sha256,
+    run: index + 1,
+    screenshot_diff_pixels: 0,
+  }));
+  return {
+    ...canonical,
+    committed_ci: {
+      artifact_name: completedEvidence.artifactName,
+      checkout_sha: completedEvidence.checkoutSha,
+      execution_repository: "ark-jo/StyleGallery",
+      external_verification: externalVerification(),
+      head_sha: completedEvidence.headSha,
+      raw_evidence_sha256: completedEvidence.rawEvidenceSha256,
+      repository: "changeroa/StyleGallery",
+      run_attempt: "1",
+      run_id: completedEvidence.runId,
+      sha: completedEvidence.checkoutSha,
+      workflow: ".github/workflows/validate.yml",
+      ...committedCi,
+    },
+    status: "completed",
+    runs,
+  };
+}
+
+const cases = [
+  ["nineteen_of_twenty", (record) => ({ ...record, runs: record.runs.slice(0, 19) }), "calibration_run_count"],
+  ["duplicate_run", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, run: 19 } : run) }), "calibration_run_duplicate"],
+  ["missing_run", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, run: 21 } : run) }), "calibration_run_set"],
+  ["architecture_variance", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, architecture: "arm64" } : run) }), "calibration_architecture_variance"],
+  ["environment_mismatch", (record) => ({ ...record, environment: { ...record.environment, architecture: "arm64" } }), "calibration_environment_mismatch"],
+  ["hash_variance", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, png_sha256: "e".repeat(64) } : run) }), "calibration_hash_variance"],
+  ["metadata_variance", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, metadata_sha256: "f".repeat(64) } : run) }), "calibration_metadata_variance"],
+  ["incomplete_run", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, completed: false } : run) }), "calibration_run_incomplete"],
+  ["nonzero_diff", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, screenshot_diff_pixels: 1 } : run) }), "calibration_diff_nonzero"],
+  ["malformed_hash", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, png_sha256: "x" } : run) }), "calibration_hash_invalid"],
+  ["wrong_stable_baseline_hash", (record) => ({ ...record, runs: record.runs.map((run) => ({ ...run, png_sha256: "d".repeat(64) })) }), "calibration_baseline_hash_mismatch"],
+  ["wrong_stable_metadata_hash", (record) => ({ ...record, runs: record.runs.map((run) => ({ ...run, metadata_sha256: "c".repeat(64) })) }), "calibration_metadata_hash_mismatch"],
+  ["unknown_run_property", (record) => ({ ...record, runs: record.runs.map((run, index) => index === 19 ? { ...run, forged: true } : run) }), "calibration_run_property_unknown"],
+  ["checkout_sha_not_tested_sha", (record) => ({ ...record, committed_ci: { ...record.committed_ci, checkout_sha: record.committed_ci.head_sha } }), "calibration_committed_ci_invalid"],
+  ["artifact_bound_to_head_sha", (record) => ({ ...record, committed_ci: { ...record.committed_ci, artifact_name: `chromium-sentinel-calibration-${record.committed_ci.run_id}-${record.committed_ci.head_sha}` } }), "calibration_committed_ci_invalid"],
+  ["unrecognized_execution_repository", (record) => ({ ...record, committed_ci: { ...record.committed_ci, execution_repository: "untrusted/StyleGallery" } }), "calibration_committed_ci_invalid"],
+  ["swapped_canonical_and_execution_repository", (record) => ({ ...record, committed_ci: { ...record.committed_ci, execution_repository: "changeroa/StyleGallery", repository: "ark-jo/StyleGallery" } }), "calibration_committed_ci_invalid"],
+  ["missing_execution_repository", (record) => {
+    const { execution_repository: omitted, ...committedCi } = record.committed_ci;
+    return { ...record, committed_ci: committedCi };
+  }, "calibration_committed_ci_invalid"],
+  ["completed_missing_external_verification", (record) => {
+    const { external_verification: omitted, ...committedCi } = record.committed_ci;
+    return { ...record, committed_ci: committedCi };
+  }, "calibration_external_verification_missing"],
+  ["forged_external_artifact_id", (record) => ({ ...record, committed_ci: { ...record.committed_ci, external_verification: { ...record.committed_ci.external_verification, artifact: { ...record.committed_ci.external_verification.artifact, id: "8283099325" } } } }), "calibration_external_verification_invalid"],
+  ["forged_external_artifact_digest", (record) => ({ ...record, committed_ci: { ...record.committed_ci, external_verification: { ...record.committed_ci.external_verification, artifact: { ...record.committed_ci.external_verification.artifact, api_digest: `sha256:${"f".repeat(64)}` } } } }), "calibration_external_verification_invalid"],
+  ["raw_digest_substituted_for_artifact_digest", (record) => ({ ...record, committed_ci: { ...record.committed_ci, external_verification: { ...record.committed_ci.external_verification, artifact: { ...record.committed_ci.external_verification.artifact, api_digest: `sha256:${record.committed_ci.raw_evidence_sha256}` } } } }), "calibration_external_verification_invalid"],
+  ["forged_external_source", (record) => ({ ...record, committed_ci: { ...record.committed_ci, external_verification: { ...record.committed_ci.external_verification, source: "https://github.com/ark-jo/StyleGallery/actions/runs/1" } } }), "calibration_external_verification_invalid"],
+  ["forged_fork_parent_relationship", (record) => ({ ...record, committed_ci: { ...record.committed_ci, external_verification: { ...record.committed_ci.external_verification, repository_relationship: { ...record.committed_ci.external_verification.repository_relationship, parent: "untrusted/StyleGallery" } } } }), "calibration_external_verification_invalid"],
+  ["invalid_committed_ci", (record) => ({ ...record, committed_ci: { artifact_name: "forged", extra: true, run_id: "abc", sha: "x" } }), "calibration_committed_ci_property_unknown"],
+  ["owner_approval_preclaim", (record) => ({ ...record, baseline_owner_approval: "approved" }), "baseline_owner_approval_invalid"],
+  ["pending_evidence_preclaim", (record) => ({ ...record, status: "awaiting_committed_ci" }), "calibration_pending_evidence_forbidden"],
+];
+
+const results = [];
+try {
+  const schemaParity = baselineSchemaParity(schema, canonical, completedEvidence);
+  results.push({ actual: { schemaParity }, expected: "recursive schema/runtime identity parity", name: "schema_runtime_parity", ok: schemaParity });
+  const validFixture = path.join(tempRoot, "valid-completed.json");
+  fs.writeFileSync(validFixture, `${JSON.stringify(completeRecord(), null, 2)}\n`);
+  const validChild = spawnSync(process.execPath, [validator, "--calibration", validFixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
+  const validOutput = JSON.parse(validChild.stdout);
+  results.push({ actual: { codes: validOutput.failures.map((failure) => failure.code), status: validChild.status }, expected: "completed calibration and exit:0", name: "valid_completed_calibration", ok: validChild.status === 0 && validOutput.ok === true });
+  const awaitingExternalFixture = path.join(tempRoot, "valid-awaiting-external-verification.json");
+  fs.writeFileSync(awaitingExternalFixture, `${JSON.stringify({
+    ...completeRecord({ external_verification: null }),
+    status: "awaiting_external_verification",
+  }, null, 2)}\n`);
+  const awaitingExternalChild = spawnSync(process.execPath, [validator, "--calibration", awaitingExternalFixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
+  const awaitingExternalOutput = JSON.parse(awaitingExternalChild.stdout);
+  results.push({
+    actual: { codes: awaitingExternalOutput.failures.map((failure) => failure.code), status: awaitingExternalChild.status },
+    expected: "pre-upload calibration awaits external verification and exits 0",
+    name: "valid_awaiting_external_verification",
+    ok: awaitingExternalChild.status === 0 && awaitingExternalOutput.ok === true,
+  });
+  const pendingFixture = path.join(tempRoot, "valid-awaiting-committed-ci.json");
+  fs.writeFileSync(pendingFixture, `${JSON.stringify({ ...canonical, committed_ci: null, runs: [], status: "awaiting_committed_ci" }, null, 2)}\n`);
+  const pendingChild = spawnSync(process.execPath, [validator, "--calibration", pendingFixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
+  const pendingOutput = JSON.parse(pendingChild.stdout);
+  results.push({
+    actual: { codes: pendingOutput.failures.map((failure) => failure.code), status: pendingChild.status },
+    expected: "initial pending record and exit:0",
+    name: "valid_awaiting_committed_ci",
+    ok: pendingChild.status === 0 && pendingOutput.ok === true,
+  });
+  const pullRequestFixture = path.join(tempRoot, "valid-pull-request-merge-head.json");
+  const mergeSha = "11f4668fe5988720c27e88ec7203ecd1685a40df";
+  const headSha = "8b8eaed41094286138973157b581a1d9ab9957a8";
+  fs.writeFileSync(pullRequestFixture, `${JSON.stringify({
+    ...completeRecord({
+      artifact_name: `chromium-sentinel-calibration-29258810962-${mergeSha}`,
+      checkout_sha: mergeSha,
+      execution_repository: "ark-jo/StyleGallery",
+      external_verification: null,
+      head_sha: headSha,
+      repository: "changeroa/StyleGallery",
+      run_id: "29258810962",
+      sha: mergeSha,
+    }),
+    status: "awaiting_external_verification",
+  }, null, 2)}\n`);
+  const pullRequestChild = spawnSync(process.execPath, [validator, "--calibration", pullRequestFixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
+  const pullRequestOutput = JSON.parse(pullRequestChild.stdout);
+  results.push({
+    actual: { codes: pullRequestOutput.failures.map((failure) => failure.code), status: pullRequestChild.status },
+    expected: "distinct canonical pull-request merge checkout and head SHAs",
+    name: "valid_pull_request_merge_and_head_identity",
+    ok: pullRequestChild.status === 0 && pullRequestOutput.ok === true,
+  });
+  for (const [name, mutate, expected] of cases) {
+    const fixture = path.join(tempRoot, `${name}.json`);
+    fs.writeFileSync(fixture, `${JSON.stringify(mutate(completeRecord()), null, 2)}\n`);
+    const child = spawnSync(process.execPath, [validator, "--calibration", fixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
+    const output = JSON.parse(child.stdout);
+    const codes = Array.isArray(output.failures) ? output.failures.map((failure) => failure.code) : [];
+    results.push({ actual: { codes, status: child.status }, expected, name, ok: child.status !== 0 && codes.includes(expected) });
+  }
+  const manifestFixture = path.join(tempRoot, "unknown-manifest-nested.json");
+  fs.writeFileSync(manifestFixture, `${JSON.stringify({
+    ...canonicalManifest,
+    calibration: { ...canonicalManifest.calibration, forged: true },
+    source: { ...canonicalManifest.source, forged: true },
+  }, null, 2)}\n`);
+  const manifestChild = spawnSync(process.execPath, [validator, "--manifest", manifestFixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
+  const manifestOutput = JSON.parse(manifestChild.stdout);
+  const manifestCodes = manifestOutput.failures.map((failure) => failure.code);
+  results.push({
+    actual: { codes: manifestCodes, status: manifestChild.status },
+    expected: "baseline_calibration_property_unknown and baseline_source_property_unknown",
+    name: "unknown_manifest_nested_properties",
+    ok: manifestChild.status !== 0 && manifestCodes.includes("baseline_calibration_property_unknown") && manifestCodes.includes("baseline_source_property_unknown"),
+  });
+  const alternateFile = path.join(repositoryRoot, "package.json");
+  const alternateManifestFixture = path.join(tempRoot, "alternate-baseline.json");
+  fs.writeFileSync(alternateManifestFixture, `${JSON.stringify({
+    ...canonicalManifest,
+    baseline: { path: "package.json", sha256: sha256(fs.readFileSync(alternateFile)) },
+  }, null, 2)}\n`);
+  const alternateChild = spawnSync(process.execPath, [validator, "--manifest", alternateManifestFixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
+  const alternateOutput = JSON.parse(alternateChild.stdout);
+  const alternateCodes = alternateOutput.failures.map((failure) => failure.code);
+  results.push({
+    actual: { codes: alternateCodes, status: alternateChild.status },
+    expected: "baseline_baseline_reference_mismatch",
+    name: "alternate_in_repo_baseline",
+    ok: alternateChild.status !== 0 && alternateCodes.includes("baseline_baseline_reference_mismatch"),
+  });
+  const directoryManifestFixture = path.join(tempRoot, "directory-baseline.json");
+  fs.writeFileSync(directoryManifestFixture, `${JSON.stringify({ ...canonicalManifest, baseline: { path: "tests", sha256: "a".repeat(64) } }, null, 2)}\n`);
+  const directoryChild = spawnSync(process.execPath, [validator, "--manifest", directoryManifestFixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
+  const directoryOutput = JSON.parse(directoryChild.stdout);
+  results.push({ actual: { codes: directoryOutput.failures.map((failure) => failure.code), status: directoryChild.status }, expected: "baseline_baseline_file_invalid", name: "directory_manifest_target", ok: directoryChild.status !== 0 && directoryOutput.failures.some((failure) => failure.code === "baseline_baseline_file_invalid") });
+  for (const [name, content, expected] of [
+    ["null_calibration", "null\n", "calibration_record_invalid"],
+    ["duplicate_calibration_property", '{"schema_version":"1.0","schema_version":"1.0"}\n', "baseline_json_invalid"],
+  ]) {
+    const fixture = path.join(tempRoot, `${name}.json`);
+    fs.writeFileSync(fixture, content);
+    const child = spawnSync(process.execPath, [validator, "--calibration", fixture, "--json"], { cwd: repositoryRoot, encoding: "utf8" });
+    const output = JSON.parse(child.stdout);
+    results.push({ actual: { codes: output.failures.map((failure) => failure.code), status: child.status }, expected, name, ok: child.status !== 0 && output.failures.some((failure) => failure.code === expected) });
+  }
+} finally {
+  fs.rmSync(tempRoot, { force: true, recursive: true });
+}
+
+const failures = results.filter((result) => !result.ok).map((result) => `missing_semantic:${result.name}:${result.expected}`);
+const report = { failures, ok: failures.length === 0, results };
+process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+if (!report.ok) process.exitCode = 1;