# Audit a delivery package for missing, extra and changed files

Establish whether a received package has exactly the expected local regular files and byte contents. A checksum manifest detects change relative to a trusted copy; it is not an authenticity signature or media-quality check.

This complete kit uses Node standard-library modules only. No media tool installation is required.

Run from this directory and select a NEW output directory. Existing output directories are refused. On a memory-managed workstation, put its local serialization wrapper before the Node command. No provider credentials or off-device fixture requests are used.

```sh
node run-recipe.mjs --out ./my-run
```

Recorded execution: 9 checks passed, including 6 expected rejections. Node v24.18.0. No FFmpeg subprocess.

Preparation

- Use Node.js with built-in filesystem and crypto modules. The original delivery folder contains delivery-notes.txt, shots.json and captions.srt.
- Inspect delivery-manifest.json outside the delivery/ folder. Its three rows bind basename, byte count and SHA-256; excluding the manifest itself avoids a circular self-hash.
- Choose a new output directory and preserve the expected manifest separately from any editable received files. The supplied fixture totals 171 bytes before receipts and documentation.

## 01. Freeze the expected file inventory

The script writes an original miniature handoff and captures its sorted filename list, byte sizes and SHA-256 values. The expected set is exact: an additional file is reviewable evidence of a mismatch rather than something silently skipped.

## 02. Require safe regular files

Validate unique safe basenames, compare expected and actual inventories, then use lstat to reject a symlink before reading contents. This fixture audits one flat directory, not an arbitrary nested archive or a concurrent untrusted filesystem.

## 03. Check sizes and full byte hashes

For each expected file, compare both size and SHA-256. The same-size mutation flips one byte of delivery-notes.txt, proving that size alone is insufficient. SHA-256 proves equality to this expected manifest, not that its author is trusted.

## 04. Restore and rerun the handoff audit

The suite temporarily removes a file, adds an extra file, changes bytes and replaces a file with a symlink, always restoring originals in finally. It also rejects duplicate manifest paths and ../outside.txt. The restored package passes again, with nine checks retained.

Acceptance

- The clean delivery folder contains exactly the three declared regular files.
- Every expected SHA-256 is a 64-character lowercase hexadecimal digest.
- A missing file and an unexpected extra file are separately rejected.
- A one-byte change that preserves file size fails its checksum comparison.
- Duplicate manifest paths, a parent path and a symlink are rejected.
- After the negative fixtures are restored, the complete package passes again; all nine checks pass.

Troubleshooting

All byte sizes match but the audit fails. Compare the actual SHA-256 of the named file with its expected row; restore the correct bytes instead of removing the hash check.

An extra export appears in the package. Decide whether that file belongs in the handoff. Remove only the accidental file, or deliberately revise the expected manifest and have it reviewed.

A shortcut or symlink is rejected. Replace only that entry with a real local regular file, then capture the intended file’s bytes and rerun inventory plus SHA-256 checks.

Public receipt copies normalize only local checkout paths and include publicPathNormalization with the original receipt SHA-256; raw originals are retained outside public assets. The actual receipts are under executed/. failure-receipt.json lists expected negative cases, not failed-suite assertions. Original tiny fixtures are generated again into your new output directory; shipped executed inputs and outputs let you inspect the recorded run. Temporary raw buffers and local HTTP servers are cleaned in finally.

checksums.json records every distributed file except itself and the archive, avoiding self-reference. The ZIP includes that same checksum list. Recompute hashes after download; comparison requires trusting the expected list. execution-receipt.json records executed script hashes before and after the run. The complete kit archive is also bound by the publishing catalog asset inventory.

Keep a trusted manifest and the actual audit receipt with the handoff. The audit does not decode video, establish authorship or protect a manifest that was itself replaced by an attacker.

Sources read on 2026-10-14

- Node.js filesystem API: local file inspection: https://nodejs.org/api/fs.html
- Node.js crypto API: SHA-256 hashing: https://nodejs.org/api/crypto.html