{
  "schema_version": 1,
  "kind": "deterministic-semantic-transcript",
  "suite": "Security review",
  "execution_id": "security-review",
  "fixture": {
    "id": "threat-surface-audit",
    "prompt": "Assess authentication, secrets, dependencies, CI trust boundaries, and abuse paths across the repository.",
    "signals": {
      "change_exists": false,
      "audit_focus": "security",
      "threat_model_required": true,
      "mutation_authorized": false
    },
    "rationale": "Infrastructure-first security and threat modeling."
  },
  "baseline_invocation": {
    "base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
    "modules": [
      "cso"
    ],
    "input": "Assess authentication, secrets, dependencies, CI trust boundaries, and abuse paths across the repository."
  },
  "candidate_invocation": {
    "dispatcher": "review",
    "mode": "Security",
    "depth": "deep",
    "mutation": "report-only",
    "active_modules": [
      "cso"
    ],
    "skipped_modules": [
      "review",
      "health",
      "codex",
      "claude"
    ],
    "web_context": "optional",
    "input": "Assess authentication, secrets, dependencies, CI trust boundaries, and abuse paths across the repository."
  },
  "source_comparisons": [
    {
      "source": "cso",
      "baseline": {
        "base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
        "source_path": "cso/SKILL.md.tmpl",
        "rendered_sha256": "1878443a5ffe2b5535bb39106a97b9003e180501c0dfd4fd77ce873cdb737e79",
        "semantic_signature": {
          "normalized_sha256": "1878443a5ffe2b5535bb39106a97b9003e180501c0dfd4fd77ce873cdb737e79",
          "headings_sha256": "8b7bef1dfbbfeb4ee6d5886bdb9016a05fd8fcc03583449b2a9f9fe157e4f502",
          "questions_sha256": "24f748d3b016feec4d8727b03558d1923f0ecac73201b324fda50400dea15cbc",
          "obligations_sha256": "763f41ebf1ee47b9889fb7750f036e46c84ae016e95ae5ab86125d9a47a69a42",
          "heading_count": 61,
          "question_count": 30,
          "obligation_count": 99
        }
      },
      "mechanical_port": {
        "rendered_sha256": "d79cf702cef33e878da8569c63936e3bdf811b194d8abbce925b6bb759f05cf7",
        "differs_from_baseline": true,
        "allowed_difference": "Canonical GStack 2 carve: exclude the retired shared onboarding wrapper and host hook advisory; resolve retired invocations to six public routes; relocate host/runtime paths; lazy-load pinned carved sections from package-local references."
      },
      "candidate": {
        "target_path": "skills/review/references/legacy/cso.md",
        "rendered_legacy_body_sha256": "d79cf702cef33e878da8569c63936e3bdf811b194d8abbce925b6bb759f05cf7",
        "semantic_signature": {
          "normalized_sha256": "d79cf702cef33e878da8569c63936e3bdf811b194d8abbce925b6bb759f05cf7",
          "headings_sha256": "45365014bc4ff67be80c8747098a368c439104ea76ad4d1c36000fe65192e291",
          "questions_sha256": "e7e23a9ccc1e3677812d260b4f38b16ef8c438e0b2346c045c1334b7045006de",
          "obligations_sha256": "2f83f56fa932b0937d9f968a7e27c974f17772ad8062b9577504dfae600622f6",
          "heading_count": 19,
          "question_count": 2,
          "obligation_count": 44
        }
      },
      "deterministic_comparison": {
        "normalized_body_equal": false,
        "installable_port_equal": true,
        "contract_equal": true,
        "classification": "EQUIVALENT"
      },
      "differences": [
        {
          "classification": "INTENTIONAL_IMPROVEMENT",
          "issue_or_pr": "https://github.com/garrytan/gstack/pull/679",
          "reproduced_defect": "Match the user language",
          "regression_fixture": "evals/parity/regressions/pr-679.json",
          "explanation": "### User-language rule\n\nWrite questions, progress updates, reports, and artifacts in the language used by the user. Source material, code identifiers, commands, and quotations may remain in their original language when translating them would reduce accuracy."
        },
        {
          "classification": "INTENTIONAL_IMPROVEMENT",
          "issue_or_pr": "https://github.com/garrytan/gstack/pull/2030",
          "reproduced_defect": "Record only signal-bearing learnings",
          "regression_fixture": "evals/parity/regressions/pr-2030.json",
          "explanation": "### Signal-gated learning\n\nPersist a learning only when the interaction contains a useful, reusable signal such as an explicit preference, correction, accepted recommendation, or rejected direction. Track helpful and harmful outcomes separately. Do not manufacture a learning merely because a workflow completed."
        }
      ]
    }
  ],
  "semantic_dimensions": {
    "questions": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "question_order": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "follow_up_pressure": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "smart_skips": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "pushback_strength": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "scope_recommendation": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "active_reasoning_modules": {
      "classification": "EQUIVALENT",
      "evidence": "Structured route selected cso from product/evidence signals."
    },
    "findings": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "evidence": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "artifacts": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "approval_gates": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "mutation_behavior": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "completion_status": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "recommended_next_action": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "voice": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    }
  },
  "verdict": "PASS"
}