{
  "edition": "v1",
  "publishedAt": "2026-09-21",
  "scanner": { "package": "@zfinia/crosscheck", "version": "0.1.1", "release": "https://github.com/zFinia/crosscheck/releases/tag/v0.1.1" },
  "verifiedOn": "2026-09-21",
  "cases": [
    {
      "id": "drift-2026-09-c1-lockfile-vs-packagemanager",
      "title": "A second lockfile contradicts the declared package manager",
      "sourceUrl": "https://github.com/santgodev/sebibe-plataforma-educativa",
      "licence": "MIT",
      "packageScope": ".",
      "beforeCommit": "d063962f6b97d84f059f92d0223fdb17e906c012",
      "afterCommit": "1cd92a443970c27ce0757bd0fa16ab3f09f6cb63",
      "fixCommitUrl": "https://github.com/santgodev/sebibe-plataforma-educativa/commit/1cd92a443970c27ce0757bd0fa16ab3f09f6cb63",
      "fixCommittedAt": "2026-09-17T16:57:08Z",
      "maintainerStatement": "Remove package-lock.json to fix Vercel pnpm build",
      "toolVersion": "@zfinia/crosscheck@0.1.1",
      "command": "npx @zfinia/crosscheck@0.1.1 <dir>",
      "expected": "One package-manager contradiction before the fix commit; none after it.",
      "observed": { "before": "outputs/case1-before.txt", "after": "outputs/case1-after.txt", "beforeContradictions": 1, "afterContradictions": 0 },
      "whatThisProves": "The repository declared pnpm in package.json and every CI install step used pnpm, yet an npm lockfile was also committed. The scanner named the contradicting file, and the maintainer's own fix removed exactly that file.",
      "limitations": [
        "The Vercel build failure is reported by the maintainer in the commit message. We did not reproduce that build.",
        "The scan covers configuration only. It does not show which dependency versions actually differed.",
        "This is one repository, selected because it was already fixed. It is not a sample and implies no rate."
      ],
      "correctionStatus": "none"
    },
    {
      "id": "drift-2026-09-c2-install-workflow-vs-maintainer-decision",
      "title": "What the install workflow establishes, and what stays a maintainer decision",
      "sourceUrl": "https://github.com/drewmarsh18/dance-company-app",
      "licence": "none declared — files not redistributed; cited by URL and commit only",
      "packageScope": "apps/mobile, apps/web",
      "beforeCommit": "7c7fc9f1facf2c8d9ad82098c90a4484e5563342",
      "afterCommit": "58bc9fe83d9ba33bc2cfc9b13970c4d64b647dcc",
      "fixCommitUrl": "https://github.com/drewmarsh18/dance-company-app/commit/58bc9fe83d9ba33bc2cfc9b13970c4d64b647dcc",
      "fixCommittedAt": "2026-09-18T17:38:49Z",
      "maintainerStatement": "Remove package-lock.json files that caused EAS to use npm instead of pnpm",
      "toolVersion": "@zfinia/crosscheck@0.1.1",
      "command": "npx @zfinia/crosscheck@0.1.1 <dir>",
      "expected": "Two package-manager contradictions before the fix commit, with different fix confidence; none after it.",
      "observed": { "before": "outputs/case2-before.txt", "after": "outputs/case2-after.txt", "beforeContradictions": 2, "afterContradictions": 0 },
      "whatThisProves": "In apps/mobile the package itself declared pnpm, so the scanner asserted which file to remove. In apps/web only two lockfiles disagreed with nothing declaring a winner, so the scanner deliberately did not assert which to delete. The maintainer, who knew the build system, resolved both the same way.",
      "limitations": [
        "The EAS behaviour is reported by the maintainer in the commit message. We did not run EAS.",
        "This repository contains AGENTS.md and CLAUDE.md. That is a fact about the repository and is not evidence that an AI tool created the conflict; the records do not establish who ran which installer.",
        "The repository declares no licence, so its configuration files are not included in this package."
      ],
      "correctionStatus": "none"
    },
    {
      "id": "drift-2026-09-c3-legitimate-mixed-manager-monorepo",
      "title": "A mixed-manager monorepo where silence is the correct result",
      "sourceUrl": "https://github.com/getsentry/sentry-wizard",
      "licence": "see repository",
      "packageScope": "root + 18 nested packages",
      "beforeCommit": "8dd7649f83b455519a8f690b5561ee85ea146330",
      "afterCommit": null,
      "fixCommitUrl": null,
      "fixCommittedAt": null,
      "maintainerStatement": null,
      "toolVersion": "@zfinia/crosscheck@0.1.1",
      "command": "npx @zfinia/crosscheck@0.1.1 <dir>",
      "expected": "No contradictions, despite yarn.lock at the root and a pnpm lockfile inside an end-to-end test application.",
      "observed": { "frozen": "outputs/case3-frozen.txt", "contradictions": 0 },
      "whatThisProves": "Different package managers in different packages are a legitimate repository shape. Because the rule is evaluated per package rather than per repository, a deliberate pnpm test fixture beside a Yarn root produces no alarm. The repository also contains AGENTS.md and CLAUDE.md and is still clean.",
      "limitations": [
        "Rebuilt from a frozen evaluation manifest. Lockfiles were recorded as present without retaining contents, because the rule depends on presence; they are recreated as empty files.",
        "A clean result means no contradiction in the classes CrossCheck checks. It does not mean the repository is correct.",
        "This is a single point in time at the pinned commit; the repository may have changed since."
      ],
      "correctionStatus": "none"
    }
  ]
}