{
  "schemaVersion": 1,
  "slug": "output-package-checksum-audit",
  "locale": "en",
  "evidenceClass": "executed-local-fixture-not-provider-generation",
  "providerModelTest": false,
  "productionTaskRun": false,
  "runCommand": "node run-recipe.mjs --out ./my-run",
  "environment": {
    "nodeVersion": "v24.18.0",
    "ffmpeg": null
  },
  "title": "Audit a delivery package for missing, extra and changed files",
  "description": "Run a Node.js SHA-256 audit over an original three-file handoff and reject missing files, extras, same-size byte edits, unsafe paths and symlinks.",
  "goal": "Establish whether a received package has exactly the expected local regular files and byte contents. A checksum manifest detects change relative to a trusted copy; it is not an authenticity signature or media-quality check.",
  "preparation": [
    "Use Node.js with built-in filesystem and crypto modules. The original delivery folder contains delivery-notes.txt, shots.json and captions.srt.",
    "Inspect delivery-manifest.json outside the delivery/ folder. Its three rows bind basename, byte count and SHA-256; excluding the manifest itself avoids a circular self-hash.",
    "Choose a new output directory and preserve the expected manifest separately from any editable received files. The supplied fixture totals 171 bytes before receipts and documentation."
  ],
  "steps": [
    {
      "title": "01. Freeze the expected file inventory",
      "body": "The script writes an original miniature handoff and captures its sorted filename list, byte sizes and SHA-256 values. The expected set is exact: an additional file is reviewable evidence of a mismatch rather than something silently skipped."
    },
    {
      "title": "02. Require safe regular files",
      "body": "Validate unique safe basenames, compare expected and actual inventories, then use lstat to reject a symlink before reading contents. This fixture audits one flat directory, not an arbitrary nested archive or a concurrent untrusted filesystem."
    },
    {
      "title": "03. Check sizes and full byte hashes",
      "body": "For each expected file, compare both size and SHA-256. The same-size mutation flips one byte of delivery-notes.txt, proving that size alone is insufficient. SHA-256 proves equality to this expected manifest, not that its author is trusted."
    },
    {
      "title": "04. Restore and rerun the handoff audit",
      "body": "The suite temporarily removes a file, adds an extra file, changes bytes and replaces a file with a symlink, always restoring originals in finally. It also rejects duplicate manifest paths and ../outside.txt. The restored package passes again, with nine checks retained."
    }
  ],
  "acceptance": [
    "The clean delivery folder contains exactly the three declared regular files.",
    "Every expected SHA-256 is a 64-character lowercase hexadecimal digest.",
    "A missing file and an unexpected extra file are separately rejected.",
    "A one-byte change that preserves file size fails its checksum comparison.",
    "Duplicate manifest paths, a parent path and a symlink are rejected.",
    "After the negative fixtures are restored, the complete package passes again; all nine checks pass."
  ],
  "troubleshooting": [
    {
      "symptom": "All byte sizes match but the audit fails.",
      "change": "Compare the actual SHA-256 of the named file with its expected row; restore the correct bytes instead of removing the hash check."
    },
    {
      "symptom": "An extra export appears in the package.",
      "change": "Decide whether that file belongs in the handoff. Remove only the accidental file, or deliberately revise the expected manifest and have it reviewed."
    },
    {
      "symptom": "A shortcut or symlink is rejected.",
      "change": "Replace only that entry with a real local regular file, then capture the intended file’s bytes and rerun inventory plus SHA-256 checks."
    }
  ],
  "ending": "Keep a trusted manifest and the actual audit receipt with the handoff. The audit does not decode video, establish authorship or protect a manifest that was itself replaced by an attacker.",
  "assetCaption": "Original three-file delivery fixture, executed missing/extra/changed-file cases and a checksum audit diagram. No media or model quality claim."
}