TraceMint evaluation pack v2026-09-22

This pack contains actual output from one deterministic product configuration
check and two parser-only imports. All inputs are small, newly authored CC0
fixtures. They are not customer code or unpublished research.

Recorded product source:
9174a1c9bfbe7147bb59d88ce1d2ea89f1807bc7

The run compared every imported product Python module byte-for-byte with this
commit. The result JSON lists those module hashes, input hashes, Python and
library versions, OS/architecture, observed elapsed time and the actual output.
The product implementation is not included. A licensed matching product source
checkout is required to repeat the product calls.

Reproduce after extracting the ZIP:

  python3 evaluation-runner.py \
    --product-root /path/to/licensed/tracemint \
    --product-commit 9174a1c9bfbe7147bb59d88ce1d2ea89f1807bc7 \
    --fixtures evaluation-fixtures \
    --output repeated-results.json

Use the recorded Python/dependency versions in an isolated environment.
The recorded run used Python 3.11.13, PyYAML 6.0.3 and defusedxml 0.7.1.
No endpoint, API key or model is needed. The runner denies Python socket
connection, DNS-resolution and sendto operations. It never builds or executes
the Dockerfiles. Fixture source and product module mismatches fail the run
before an output is published. The elapsed times will vary between runs.

What was observed:
- Two Dockerfiles inspected by the real local configuration-rule function.
- One dockerfile_root_user finding at risk.Dockerfile line 3 (USER root).
- No matching rule in control.Dockerfile (USER 10001).
- One normalized row from the authored SARIF 2.1.0 file.
- One normalized row from the authored generic CSV file.

What is not established:
- AI detection accuracy, precision, recall, model throughput or hardware sizing.
- An image build, exploit, live container, Kubernetes cluster or cloud state.
- General security of the control fixture or of any application.
- Full scanner-vendor compatibility, source enrichment, AI triage, upload/API
  validation or worker-resource isolation. Only the parser functions ran.
- A commercial service guarantee or product installation acceptance.

The SARIF and CSV descriptions explicitly identify themselves as synthetic
parser inputs. Their file/line fields illustrate mapping; no corresponding
application vulnerability was asserted or discovered.

The compatibility provenance file records a separately reviewed product
configuration baseline. Source admission is distinguished from live testing.
Use the worksheet to record the still-unmeasured parts of your evaluation.

License scope:
The CC0-1.0 dedication in evaluation-fixtures/LICENSE.txt covers only the newly
authored fixture inputs. Product software, models and third-party dependencies
retain their own licenses. The runner invokes installed product functions;
it does not redistribute their implementation.