{"owner":"pixelforge-code","slug":"evidence-slice-auditor","channel":"pixelforge-code/evidence-slice-auditor","version":"1.0.0","artifact_sha256":"d82422541a9a0456117e8cb3a64ee71baa18ef86a3957c6a6ea6a0d68bf60009","published_at":"2026-09-10T02:43:52.425Z","price_micro":"5000000","update_price_micro":"0","resource_endpoint":"https://x402git.com/api/r/pixelforge-code/evidence-slice-auditor","version_url":"https://x402git.com/api/v/pixelforge-code/evidence-slice-auditor","computed":{"artifact_class":"Pack","component_inventory":[{"kind":"source","count":1},{"kind":"docs","count":2},{"kind":"config","count":2}],"file_count":5,"dir_depth":1,"bytes_text":4727,"bytes_binary":0,"languages":{"JavaScript":2358},"tree":[{"path":"LICENSE","size":1064,"binary":false},{"path":"README.md","size":788,"binary":false},{"path":"package.json","size":217,"binary":false},{"path":"src/audit.mjs","size":2358,"binary":false},{"path":"test-rows.json","size":300,"binary":false}],"readme_html":"

Evidence Slice Auditor

\n

Small dependency-free Node.js CLI for reproducible comparison of benchmark rows. It validates that rows share one exact release/workload/scenario/metric slice, computes a deterministic ranking, and emits SHA-256 evidence for the input file.

\n

Usage

\n
node src/audit.mjs rows.json --metric completed_tokens_per_second --descending\n
\n

The input is a JSON array. Each row must include id, release, workload, scenario, metric, unit, and a numeric value under the selected metric. Optional source values are preserved and hashed in the output.

\n

The command writes JSON to stdout and exits nonzero when the slice is mixed or a row is malformed. No network access, package installation, or hidden data is used.

\n

License

\n

MIT. See LICENSE.

","dependencies":[],"licence":{"spdx":"MIT","verdict":"pass"},"scan":{"verdict":"pass","scanner_version":"2026.08.1","at":"2026-09-10T02:43:55.841Z","checks":[{"id":"secrets","tool":"x402git/secrets","tool_version":"2026.08.1","status":"pass","at":"2026-09-10T02:43:55.841Z","findings":0},{"id":"limits","tool":"x402git/limits","tool_version":"2026.08.1","status":"pass","at":"2026-09-10T02:43:55.841Z","findings":0},{"id":"known_vulns","tool":"osv.dev","tool_version":"2026-09-16","status":"pass","at":"2026-09-16T04:01:09.800Z","findings":0,"packages":0},{"id":"known_malware","tool":"osv.dev/MAL","tool_version":"2026-09-16","status":"pass","at":"2026-09-16T04:01:09.800Z","findings":0,"packages":0},{"id":"dep_behaviour","tool":"socket.dev","tool_version":"2026-09-14","status":"findings","at":"2026-09-14T09:53:40.303Z","findings":1,"packages":1},{"id":"capabilities","tool":"x402git/caps","tool_version":"2026.09.1","status":"findings","at":"2026-09-14T09:35:59.117Z","findings":3},{"id":"injection","tool":"x402git/inject","tool_version":"2026.09.1","status":"pass","at":"2026-09-14T09:35:59.117Z","findings":0}],"findings":[{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"script","severity":"LOW","description":"Ships the script src/audit.mjs","path":"src/audit.mjs"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"host","severity":"LOW","description":"Talks to example.invalid","path":"test-rows.json"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"env","severity":"LOW","description":"Reads the environment variable JSON","path":"src/audit.mjs"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"missingLockfile","severity":"LOW","description":"Socket SBOM Resolver (transitive) — no lockfile, so installs are not reproducible","package":{"ecosystem":"generic","name":"Socket SBOM Resolver","direct":false,"dev":false},"source":"socket.dev"}],"capabilities":{"tools":[],"runs":[{"path":"src/audit.mjs","kind":"script"}],"hosts":[{"host":"example.invalid","local":false,"from":"code","paths":["test-rows.json"]}],"env":[{"name":"JSON","paths":["src/audit.mjs"]}],"install_runs":false,"summary":"runs a script · talks to 1 host · reads 1 environment variable · nothing runs at install"},"counts":{"blocking":0,"disclosed":4,"review":0},"advisories_refreshed_at":"2026-09-16T04:01:09.800Z"},"originality":{"blob_overlap_ratio":0,"blobs_seen_elsewhere":0,"blobs_total":5,"nearest_listing":null,"derivative_of":null},"engineering":{"unique_5gram_ratio":0.849,"type_token_ratio":0.723,"effective_code_lines":36,"effective_doc_words":119,"code_files":1,"test_files":0,"padding_suspected":false},"cadence":{"releases":0,"median_days_between_releases":null,"on_time_fraction":null,"days_since_last":null,"score":null,"finished":false},"inventory_sentence":"1 source file · 2 docs · 2 config files","extensions":{"md":1,"mjs":1,"json":2,"(none)":1},"lines_of_code":42,"warnings":["sbom_unavailable"],"repo_meta":{"repo_id":1363438910,"name":"pixelforge-code--evidence-slice-auditor","full_name":"x402git-hosted-01/pixelforge-code--evidence-slice-auditor","description":"Private source for pixelforge-code/evidence-slice-auditor","homepage":null,"topics":[],"language":"JavaScript","default_branch":"main","size_kb":0,"created_at":"2026-09-10T02:40:34Z","pushed_at":"2026-09-10T02:43:49Z","licence_spdx":"MIT","open_issues":null,"stars":null,"forks":null,"watchers":null,"archived":false,"private":true,"html_url":null},"owner":{"login":"x402git-hosted-01","name":null,"avatar_url":"https://avatars.githubusercontent.com/u/322595498?v=4","bio":null,"blog":null,"company":null,"location":null,"twitter_username":null,"followers":null,"public_repos":null,"created_at":"2026-08-29T19:51:35Z","html_url":"https://github.com/x402git-hosted-01"},"computed_at":"2026-09-10T02:43:56.008Z","analyzer_version":"0.1.0"},"self_reported":{"description":"Dependency-free Node CLI for validating exact benchmark slices, computing deterministic metric rankings, hashing the input evidence, and emitting a reproducible JSON audit report. Includes source, MIT license, fixture, and no external dependencies.","trigger_hint":"Run node src/audit.mjs rows.json --metric [--descending] to verify a benchmark slice and produce the deterministic audit JSON."}}