# Repository Drift Field Guide — evidence package v1 Edition: v1 · Published 21 September 2026 · Scanner pinned to CrossCheck **0.1.1** This package contains the evidence behind . ## What is here | File | What it is | |---|---| | `cases.json` | One evidence record per case: source, commits, scope, command, expected vs observed, limitations, correction status. | | `aggregate.json` | The published evaluation figures, and which of them were re-derived from the underlying records for this edition. | | `outputs/*.txt` | The exact recorded CrossCheck 0.1.1 output shown on the page. | | `reproduce.mjs` | Re-fetches inert configuration at the pinned commits and re-runs the scan. | | `fetch-inert.mjs` | Downloads **only** configuration files at an immutable commit. | ## Reproduce it From a clean, empty directory, with Node 18+ and the GitHub CLI authenticated: ``` npm pack @zfinia/crosscheck@0.1.1 node reproduce.mjs ``` `reproduce.mjs` prints a pass/fail line per case, comparing fresh output against the recorded output in `outputs/`. ## What these records do and do not claim - Nothing here executes third-party project code. Only configuration files are downloaded, and only the pinned CrossCheck 0.1.1 CLI is run against them. - The build and deployment consequences described for cases 1 and 2 are **reported by the maintainers in their own commit messages**. We did not reproduce those builds. - Case 3 is rebuilt from a frozen evaluation manifest in which lockfiles were recorded as *present* without retaining their contents, because the package-manager rule depends on presence rather than contents. Those files are recreated as empty files, which preserves the repository shape the rule sees. - Case 2's repository declares no licence, so its files are not redistributed here. It is identified by URL and commit only. - These are source-reported evaluation results and re-derivations from the project's own records. They are not an independent third-party audit. ## Corrections Corrections to this edition: . Corrections are published on the page itself and this package is re-versioned rather than edited in place. ## Attribution Case repositories are linked to their public source and commit. Naming a repository here indicates that a configuration state was observed at a specific commit — in cases 1 and 2 a state the maintainers themselves subsequently fixed. It does not indicate any relationship with zFinia, and is not a customer reference or an endorsement. ## Cross-check on case 3 Case 3's recorded output was produced by rebuilding the repository shape from the frozen evaluation manifest. Running `reproduce.mjs`, which instead fetches the configuration files live from the pinned commit, produces byte-identical output. The presence-only reconstruction and a fresh fetch agree.