# Project Integrity Evidence Kit 0.1.0

The package contains one executable source file: `bin/pib-snapshot.mjs`.

The extractor runs only against a clean Unity Git checkout. It enumerates the bounded repository surfaces documented in the README and writes one local `pib-repository-snapshot-v0.1` JSON file. It has no dependencies, lifecycle scripts, network client, telemetry, or service process.

Generate the accepted and candidate files under the same explicit comparison contract. Only `revisionLabel`, candidate `changedPaths`, and revision-owned evidence should differ.

The first release deliberately leaves serialized-reference coverage bounded because distinguishing every project, package, and built-in reference safely requires a richer Unity-aware extractor. Do not change that coverage value to `complete` without adding and validating that evidence.

The CLI refuses symbolic links in the inspected project surface so that a repository-relative path cannot cause it to read outside the verified checkout. It sanitizes package requirements and resolved versions to avoid exporting registry URLs, Git URLs, local package paths, or embedded credentials.
