PackageIndex

Replaces the sample only after all expected generated Work files match the reviewed template shape.

Computes a stable hash over only the approved changed Work files.

Extracts the selected source snapshot through the shared bounded, cancellation-cleaned process runner.

Preserves packed contracts and library entry sets after the required unchanged-source proof.

Copies reviewed content into a previously absent owned directory and stamps its candidate package graph.

Enumerates maintained regular files, excluding only ordinary generated build and test output.

Rejects linked/reparse components before proof IO or cleanup.

Runs the requested command and returns captured output when it exits successfully.

Gets the exact NuGet dependency declaration required for the supplied stable dependency.

Write a candidate lock from the reviewed template and exact producer package identities.

Reject a lock rewritten, removed, or linked by either restore before it becomes host evidence.

Validates the package output directory and returns a markdown-ready report.

Reads the bytes of a required package archive entry.

Renders the validation report as markdown.

Validates that the package version is a prerelease SemVer identity without build metadata.

Validates a package version against the requested release classification policy.

Runs a command and returns stdout, stderr, and exit code without throwing for non-zero exits.

Marks a pipe whose direct child exited before its inherited writers reached EOF.

Returns retained UTF-8 text with an explicit truncation marker when needed.

Writes a manifest that binds validated package ids to artifact file names and SHA-512 hashes.

Reads a package artifact manifest from disk.

Publishes each artifact selected by the checked-in manifest and writes a markdown ledger.

Restores library entries in one aggregate smoke project, verifies tools in isolated workspaces, and replays a promoted Durable template against all installed package archives.

Copies the freshly installed tool's raw NuGet archive from its isolated SDK store to the public proof cache.

Checks each owned store or cache directory before reading, creating or copying below it.

Resolves the installed tool shim path after proving the shim name cannot escape the tool directory.

Returns the named credential or null when it is unavailable.

Validates the producer, complete native evidence, uploaded start receipt, and prepared file inventory before credential acquisition. Every returned path must be a regular file inside the publication directory.

Projects bounded hosted-runner OS/image revision labels. Missing or unsafe observations produce an empty diagnostic identity rather than an invented runner revision.

Runs acquisition, independent authored/installed proofs and cleanup; failed evidence never certifies publication.

Rejects nonzero, launch/timeout and truncated results before interpreting structured evidence.

Requires one exact candidate archive, without reading secrets from its content.

Checks every restored first-party archive against the exact local candidate and forbids project substitution.

Requires canonical provider SQL bytes in each generated test output, never a template-owned recipe.

Writes only the safe receipt model, capped at 64KiB, after proof cleanup.

Hashes the reviewed generated inventory in deterministic path/byte order, excluding build output.

Creates owned CLI/cache roots and removes inherited credentials from a consumer child.

Installs the public template through dotnet new and proves its payload against the frozen producer before execution.

Compares every uncompressed package payload, ignoring only the NuGet signing envelope.

Builds the complete, validated set of package README replacements without writing any files.

Replaces validated generated documents and managed README regions using sibling staging files and ordinary-failure rollback.

Verifies every managed README is already identical to the current rendered release-guidance variant.

Extracts the body owned by the release-guidance marker pair without rewriting the README.

Compares source files and shared build inputs, allowing only the two exact Cloud Tasks central package pins.

Validates the aggregate and producer bundle, copies immutable push inputs, and writes an upload-ready start receipt.

Revalidates producer, aggregate and uploaded start receipt, returning only prepared push paths.

Reads the expected host binary identity from the producer Tailwind archive's release manifest.

Requires a bound evidence or publication file to live directly in its trusted directory.

Resolves an existing host artifact directory beneath the evidence root without traversal or links.

Reads at most one MiB of regular TRX XML; missing or invalid diagnostics cannot override a child exit.

Calculates a JSON witness for package documentation that is generated at HEAD.

Writes a witness as UTF-8 JSON without modifying any repository-owned package surface.

Runs a source-bound correctness proof from the immutable local producer bundle.

Runs the generated ordinary-startup smoke against one privately owned native PostgreSQL cluster. Linux uses /tmp and macOS uses /private/tmp for the cluster root; Windows and other platforms use the system temporary directory. The short Unix paths keep PostgreSQL's socket path within its fixed limit.

Requires the generated child's bounded cleanup observation before sharing the remaining cluster allowance.

Requires exact version/source/archive/receipt inputs and confines no mutable authority to the generated app.

Hashes the projection-v1 package entries protected by roots and selected by an assets target node.

Generates package chooser and readiness dashboard markdown, then reconciles the managed release-guidance region in every qualifying package README.

Generates chooser markdown from the manifest and evaluated project metadata without writing it to disk.

Generates the package chooser and package-index evidence dashboard without writing either file to disk.

Renders the package chooser and readiness documents from entries already resolved for the same request.

Verifies that the checked-in chooser and readiness dashboard files match the current repository truth.

Runs release-readiness checks that protect the package manifest from drifting away from publishable packages.

Resolves the validated package entries used by every canonical package-index rendering path.

Validates that the package-first chooser link resolves to the quickstart file and section anchor.

Resolves the package's release documentation link from its manifest fields.

Validates the manifest command-name contract against project metadata for one package row.

Validates the manifest-declared tool command token for one project.

Finds the release note all publishable public package rows currently share.

Gets a safe relative repository link for generated maintainer guidance that may not be copied into minimal test fixtures.

Builds a canonical GitHub URL for repository-owned maintainer documentation that is not served by AppSurface Docs.

Checks whether a known repository-relative chooser support file exists under the repository root.

Checks whether markdown defines an explicit anchor or slugified heading for a fragment.

Extracts the text from an ATX markdown heading line when the line uses one to six leading hash marks.

Produces the GitHub-style heading slug used by repository markdown anchors for simple heading text.

Resolves a required repository-relative documentation target and validates that it exists under the repository root.

Evaluates package-index evidence for resolved package rows.

Validates all gate rules against resolved package entries and repository files.

Evaluates one project file and returns the package metadata used by the chooser.

Enumerates candidate project files under the repository root.

Determines whether a repository-relative project path belongs in the chooser manifest.

Parses one dotnet msbuild JSON payload into package metadata.

Reads and parses the chooser manifest file.

Launches the package chooser CLI with the current process IO streams and working directory.

Runs the package chooser CLI against the supplied IO streams and working directory.

Parses path-related CLI options into a resolved chooser request.

Converts parsed CLI options into a package artifact request.

Converts parsed CLI options into a protected package publish request.

Converts parsed CLI options into a package smoke install request.

Validates the dedicated read-only release-preparation witness options.

Validates and converts the parser-candidate inspection options.

Acquires the installed native toolchain, creates and starts a private SCRAM-authenticated cluster, and verifies that the generated bootstrap credential reaches the expected server.

Attempts a password-only psql probe without returning or retaining child diagnostics.

Stops and removes this cluster using one caller-shared allowance that includes waiting for another disposal and is capped by the fixture's 20-second maximum. Callers coordinating generated-host and cluster teardown should pass the time remaining from their single cleanup clock.

Rejects non-positive test budgets and values above the production limits.

Resolves one installed PostgreSQL binary directory before the shared acquisition deadline.

Runs initdb using exactly the request's redirected standard input and timeout.

Creates an isolated redirected-input launch, including PostgreSQL's Windows prompt fallback.

Reserves an unused loopback TCP port and releases it before PostgreSQL startup.

Gets whether a TCP listener currently accepts connections on the selected IPv4 loopback port.

Finds and validates the live owned postmaster, or returns null when its PID file/process is absent.

Checks whether a previously observed process identity is still the same live PostgreSQL process.

Records a native boundary on an existing exception without replacing a more specific annotation.

Copies only a supported private stage annotation to a sanitized setup wrapper.

Returns a fixed receipt identifier, or null when no supported native annotation exists.

Requires three distinct successful native OS proofs and the Linux first-Work certificate.

Reads a bounded timing receipt; duplicate, unknown and malformed fields fail closed.

Reevaluates every sample against the independently expected producer and unchanged timing policy.

Reads at most 64KiB of schema-v1 evidence with depth16 and rejects duplicate or unknown fields.

Checks successful assertions, exact source/platform/content identity and every candidate archive.

Packs and validates package artifacts.

Deletes a temporary proof workspace and tolerates cleanup failures after proof evidence has been published.

Atomically publishes scrubbed coverage proof evidence without following an existing symbolic-link destination.

Evaluates one series while retaining all supplied attempts. Failed runs remain in the receipt and are never removed or retried into the same series.

Hashes a command identity and exact argument vector without retaining the original tokens.

Computes stable SHA-256 identity for the complete exact archive set.

Runs the shared proof over a downloaded immutable candidate bundle. The manifest is promoted only after the controller exits successfully and its combined receipt binds the expected run, artifact, and bytes.

Revalidates a retained candidate receipt and promotes its approved manifest beside the immutable downloaded package bundle. Used by protected release jobs before they consume the bundle.

Compares every clean public-feed ZIP entry with the approved candidate, excluding only the root NuGet signature envelope. ZIP packaging metadata may differ. The shared proof consumes exact candidate archives so its manifest hashes remain authoritative; the carrier records both candidate and public archive hashes. Signature trust is the NuGet restore's responsibility, not a claim made by this payload comparison.

Requires each manifest package's exact ZIP entry names and uncompressed contents, except one optional root .signature.p7s entry. Rejects duplicate entries, malformed archives and changes to any other entry. Independently compares the extracted provider recipe, stages candidate archives plus the original manifest, and returns raw public archive SHA-256 values. Callers must validate the staged candidate manifest binding.

Requires independently observed failed lane and activation windows. A successful scenario receipt cannot replace backend termination, cancellation, drained children/host, closed admission, released sessions, and the withheld receipts from the controller's real guard-loss probes.

Compares signed or unsigned archive contents without treating a signature envelope as payload.

Rejects ambiguous duplicate names, including signatures, before excluding the sole signature entry.

Compares entry streams in bounded buffers, allowing different underlying short-read boundaries.

Validates the exact NuGet archive, template manifest, and authored project graph.

Computes the native generated-content receipt hash from one validated archive snapshot.

Validates a generated project after native template expansion and any ordinary build/test run.

Validates coordinated and third-party package pins and confines project references to the supplied root.

Normalizes one untrusted slash-separated archive path and rejects portable filesystem aliases.

Reads at most one known marker from bounded test output, withholding ambiguous or invalid markers.

Restores the validated Docs package from local artifacts in a clean consumer project and verifies its resolved graph.