← PROJECT INTEGRITY BOT / LOCAL EVIDENCE
SOURCE VISIBLE · VERSION 0.1.0
CLEAN UNITY GIT CHECKOUT / CORE SNAPSHOT GENERATOR

Two clean checkouts.
One reviewable repository pair.

Run one dependency-free source file against the accepted and candidate Unity revisions. It writes bounded `pib-repository-snapshot-v0.1` JSON locally, so path/meta, GUID, package, and changed-path Git LFS evidence can reach the existing browser evaluator without uploading a repository.

RUNTIME
Node 20+ · Git
INPUT
Clean, non-sparse checkout
OUTPUT
One local UTF-8 JSON file
NETWORK
None
SHA-256F3A7F3DDFF4CFE5390D2CD0D23ECED21FC84C38AE08C9B4E8949AD3CC31C13B5Checksum file ↘
01 / EVIDENCE BOUNDARY

Observe repository structure.
Keep the repository local.

The kit exposes the minimum structural evidence needed for a real comparison. It is deliberately narrower than the private-pilot extractor and makes its sensitive fields explicit.

INCLUDED

Repository-owned evidence

  • Assets, Packages, and ProjectSettings path inventory
  • File sizes, path kinds, and Unity `.meta` GUID pairs
  • Sanitized direct and resolved package state
  • Candidate changed-path names
  • Git filter attributes and bounded LFS pointer form
EXCLUDED FROM JSON

Contents and external coordinates

  • Absolute project paths and repository location
  • C# source, Unity YAML bodies, logs, and binary contents
  • Git object IDs and LFS object hashes
  • Registry, Git, and local package URLs or paths
  • Credentials, personal, player, signing, and store data
BOUNDED / 0.1.0

Serialized references

  • No Unity object-body parsing
  • No package or built-in GUID resolution
  • No semantic reference claim
  • No import, load, test, or build execution
  • No automatic repair or branch write
02 / EXTRACT AND RUN

Inspect one source file.
Run it in each checkout.

The tarball has no dependencies or lifecycle scripts. Extract it, inspect the CLI source, then generate the accepted and candidate snapshots under the same declared contract.

01

Inspect and extract

Verify the SHA-256, list the archive, and read `bin/pib-snapshot.mjs`. No package installation is required.

02

Generate accepted evidence

Run baseline mode in the clean accepted checkout with the real serialization and path-case labels.

03

Generate candidate evidence

Run candidate mode in the clean candidate checkout and name the accepted base ref used for changed paths.

04

Review and compare locally

Inspect both JSON files, paste them into the browser evaluator, and keep bounded coverage visible.

03 / EXACT SNAPSHOT CONTRACT

Declare comparability.
Do not infer it from a checkout.

The comparison ID and every repository-contract label must match. Only the revision label and revision-owned evidence should move.

CLI argumentComparison ruleMeaning
--modeChanges per checkoutbaseline or candidate; candidate requires one accepted base ref
--comparison-idMust matchA short, non-secret pull-request or comparison label
--revision-labelChanges per checkoutThe accepted or candidate revision label shown in the result
--serialization-modeMust matchForceText, Mixed, or ForceBinary as verified in Unity
--path-case-modeMust matchcase-sensitive or case-insensitive for the checkout filesystem
--base-refCandidate onlyThe accepted comparison point used only to enumerate changed paths
--outputLocal destinationA JSON path outside Assets, Packages, and ProjectSettings
--expected-changeOptional / repeatableA stable finding ID that should remain visible as expected
--project-rootOptionalThe clean Unity Git checkout; defaults to the current repository
--overwriteOptional / explicitAllow replacement of the exact requested output file
ACCEPTED CHECKOUT
node package/bin/pib-snapshot.mjs \
  --mode baseline \
  --comparison-id "pr-931" \
  --revision-label "main@accepted" \
  --serialization-mode "ForceText" \
  --path-case-mode "case-sensitive" \
  --output "../reference.json"
CANDIDATE CHECKOUT
node package/bin/pib-snapshot.mjs \
  --mode candidate \
  --base-ref "origin/main" \
  --comparison-id "pr-931" \
  --revision-label "pr-931" \
  --serialization-mode "ForceText" \
  --path-case-mode "case-sensitive" \
  --output "../candidate.json"
04 / FAILURE BEHAVIOR

No complete snapshot
from an incomplete checkout.

The generator writes nothing when the checkout is dirty or sparse, a required project file is missing, a relevant path is a symbolic link, metadata or package state is malformed, an inventory exceeds its ceiling, or the output location is unsafe.

It reads `.meta`, project-version, package JSON, Git path/attribute metadata, and at most 1 KiB of a current changed Git object when pointer-form detection requires it. File bodies, URLs, object IDs, absolute paths, and the project root are not serialized.

Compare two reviewed snapshots
PRIMARY UNITY AND GIT REFERENCES
UNITY METADATAAsset and folder `.meta` files carry GUID identityUNITY SERIALIZATIONForce Text, Mixed, and Force Binary are explicit project modesPACKAGE LOCKPackage Manager records its resolved dependency graphGIT FILE INVENTORYIndex and non-ignored working-tree pathsGIT CHANGED PATHSName-only revision differences with NUL-safe outputGIT ATTRIBUTESEffective per-path filter evidence