artifact-verification

Use the workflow's canonical checker first, such as spec_holes.py for task specs, and treat its exit code and hole inventory as the report. If the gate is mid-workflow red, run an ad-hoc script asserting content markers, structure counts, and the checker's expected output.

Probe the binary's --help or feature verbs first, then compare git trees with git rev-parse <hash>^{tree} versus the squash commit's tree. Squash-ancestry checks like git merge-base --is-ancestor are invalid because a squash merge creates a new commit.

The protocol likely exercises a degraded path: fresh state lacks the settings that enable the real feature, so the happy path silently falls back. Assert side-effect counters of the real path and confirm degradation warnings are absent from stderr.

.NET assemblies store strings in two encodings: IL literals in the #US heap as UTF-16LE and attribute arguments in the #Blob heap as UTF-8. Search both encodings and confirm a positive control string of the same kind is findable.

The evidence hook records the terminal command's working directory as the root, so an internal cd inside your script does not re-root the event. Re-run the script with the terminal workdir set to the worktree containing the changed paths.

When the file bytes are unchanged since the last verified state, one stat or shasum proving byte-identity plus a one-line statement is sufficient. Deterministic checks need at most one re-run; running them repeatedly on identical bytes adds no evidence.