{
  "schema_version": 1,
  "kind": "deterministic-semantic-transcript",
  "suite": "Security review",
  "execution_id": "security-review",
  "fixture": {
    "id": "threat-surface-audit",
    "prompt": "Assess authentication, secrets, dependencies, CI trust boundaries, and abuse paths across the repository.",
    "signals": {
      "change_exists": false,
      "audit_focus": "security",
      "threat_model_required": true,
      "mutation_authorized": false
    },
    "rationale": "Infrastructure-first security and threat modeling."
  },
  "baseline_invocation": {
    "base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
    "modules": [
      "cso"
    ],
    "input": "Assess authentication, secrets, dependencies, CI trust boundaries, and abuse paths across the repository."
  },
  "candidate_invocation": {
    "dispatcher": "review",
    "mode": "Security",
    "depth": "deep",
    "mutation": "report-only",
    "active_modules": [
      "cso"
    ],
    "skipped_modules": [
      "review",
      "health",
      "codex",
      "claude"
    ],
    "web_context": "optional",
    "input": "Assess authentication, secrets, dependencies, CI trust boundaries, and abuse paths across the repository."
  },
  "source_comparisons": [
    {
      "source": "cso",
      "baseline": {
        "base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
        "source_path": "cso/SKILL.md.tmpl",
        "rendered_sha256": "1878443a5ffe2b5535bb39106a97b9003e180501c0dfd4fd77ce873cdb737e79",
        "semantic_signature": {
          "normalized_sha256": "1878443a5ffe2b5535bb39106a97b9003e180501c0dfd4fd77ce873cdb737e79",
          "headings_sha256": "8b7bef1dfbbfeb4ee6d5886bdb9016a05fd8fcc03583449b2a9f9fe157e4f502",
          "questions_sha256": "24f748d3b016feec4d8727b03558d1923f0ecac73201b324fda50400dea15cbc",
          "obligations_sha256": "763f41ebf1ee47b9889fb7750f036e46c84ae016e95ae5ab86125d9a47a69a42",
          "heading_count": 61,
          "question_count": 30,
          "obligation_count": 99
        }
      },
      "mechanical_port": {
        "rendered_sha256": "d79cf702cef33e878da8569c63936e3bdf811b194d8abbce925b6bb759f05cf7",
        "differs_from_baseline": true,
        "allowed_difference": "Canonical GStack 2 carve: exclude the retired shared onboarding wrapper and host hook advisory; resolve retired invocations to six public routes; relocate host/runtime paths; lazy-load pinned carved sections from package-local references."
      },
      "candidate": {
        "target_path": "skills/review/references/legacy/cso.md",
        "rendered_legacy_body_sha256": "d79cf702cef33e878da8569c63936e3bdf811b194d8abbce925b6bb759f05cf7",
        "semantic_signature": {
          "normalized_sha256": "d79cf702cef33e878da8569c63936e3bdf811b194d8abbce925b6bb759f05cf7",
          "headings_sha256": "45365014bc4ff67be80c8747098a368c439104ea76ad4d1c36000fe65192e291",
          "questions_sha256": "e7e23a9ccc1e3677812d260b4f38b16ef8c438e0b2346c045c1334b7045006de",
          "obligations_sha256": "2f83f56fa932b0937d9f968a7e27c974f17772ad8062b9577504dfae600622f6",
          "heading_count": 19,
          "question_count": 2,
          "obligation_count": 44
        }
      },
      "deterministic_comparison": {
        "normalized_body_equal": false,
        "installable_port_equal": true,
        "contract_equal": true,
        "classification": "EQUIVALENT"
      },
      "differences": [
        {
          "classification": "INTENTIONAL_IMPROVEMENT",
          "issue_or_pr": "https://github.com/garrytan/gstack/pull/679",
          "reproduced_defect": "Match the user language",
          "regression_fixture": "evals/parity/regressions/pr-679.json",
          "explanation": "### User-language rule\n\nWrite questions, progress updates, reports, and artifacts in the language used by the user. Source material, code identifiers, commands, and quotations may remain in their original language when translating them would reduce accuracy."
        },
        {
          "classification": "INTENTIONAL_IMPROVEMENT",
          "issue_or_pr": "https://github.com/garrytan/gstack/pull/2030",
          "reproduced_defect": "Record only signal-bearing learnings",
          "regression_fixture": "evals/parity/regressions/pr-2030.json",
          "explanation": "### Signal-gated learning\n\nPersist a learning only when the interaction contains a useful, reusable signal such as an explicit preference, correction, accepted recommendation, or rejected direction. Track helpful and harmful outcomes separately. Do not manufacture a learning merely because a workflow completed."
        },
        {
          "classification": "INTENTIONAL_IMPROVEMENT",
          "issue_or_pr": "https://github.com/garrytan/gstack/pull/1523",
          "reproduced_defect": "Detect the shai-hulud campaign in comprehensive mode only",
          "regression_fixture": "evals/parity/regressions/pr-1523.json",
          "explanation": "### Known-campaign IOC tier\n\nAdd Tier 3 rules that detect the mini-shai-hulud supply-chain campaign: `/proc/*/mem` reads from Claude Code settings hooks, auto-run persistence bridges (folderOpen tasks or settings hooks invoking payloads), packed droppers that decrypt or decompress an embedded blob at load, and the getsession.org C2 IOCs. Every rule matches a deterministic primary-source indicator, surfaces only under comprehensive mode, and carries a TENTATIVE marking. Daily mode's zero-noise contract stays unchanged: none of these rules add findings there."
        },
        {
          "classification": "INTENTIONAL_IMPROVEMENT",
          "issue_or_pr": "https://github.com/garrytan/gstack/pull/1053",
          "reproduced_defect": "Keep the audit report-only unless --fix is passed",
          "regression_fixture": "evals/parity/regressions/pr-1053.json",
          "explanation": "### Opt-in auto-fix boundary\n\nThe default audit is strictly report-only and mutates nothing. Auto-fixes apply only under an explicit `--fix` flag, and only for provably safe patterns where the correct change is deterministic and the breakage risk is near-zero (additive gitignore hardening, TLS-verification flips, non-breaking dependency patches). No business logic and no guessing. Without `--fix`, produce findings and remediation plans and change no files."
        }
      ]
    }
  ],
  "semantic_dimensions": {
    "questions": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "question_order": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "follow_up_pressure": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "smart_skips": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "pushback_strength": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "scope_recommendation": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "active_reasoning_modules": {
      "classification": "EQUIVALENT",
      "evidence": "Structured route selected cso from product/evidence signals."
    },
    "findings": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "evidence": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "artifacts": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "approval_gates": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "mutation_behavior": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "completion_status": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "recommended_next_action": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    },
    "voice": {
      "classification": "EQUIVALENT",
      "evidence": "The candidate exactly matches the deterministic canonical specialist render of the pinned workflow. The retired shared onboarding wrapper is excluded and carved specialist phases are package-local lazy references; specialist questions, pressure, gates, evidence, artifacts, mutation boundaries, exit behavior, and voice remain governed by their source contracts."
    }
  },
  "verdict": "PASS"
}