feat(inspect+dogfood): broader inspect --json + canonical bundle lock-down (#104)

* feat(inspect+dogfood): broader inspect --json + canonical bundle lock-down

Strand A — `inspect --json` extensions (additive over the schema-locked
envelope):

- New optional `host: { cliVersion, rpcSocketPath }` on `InspectResult`,
  populated only in live-host mode. Answers "is the running host the
  version I think it is?" and "which socket is `inspect` talking to when
  `--home` is non-default?"
- New optional `rendererRuntime.{profile, booted, bootInFlight}`,
  populated only in live-host mode. Answers "has the renderer actually
  attached?" and "is a boot or restart currently in flight?" — the most
  common "screenshot hung" report turns out to be pre-boot.
- New optional `eventLogBytes` populated in both live and offline-replay
  modes via a new `statEventLogBytes()` sibling to
  `countEventLogEntries()`. Answers "does this session's event log look
  truncated?" from the persisted bundle.
- `HostRendererManager` gains read-only `isBooted()`, `isBootInFlight()`,
  and `getCurrentProfileName()` getters wrapping existing private state.
- `loadPackageMetadata()` extracted from `cli/commands/version.ts` to
  `src/util/packageMetadata.ts` so the host can reuse it without
  layering inverted into `cli/`.

Strand B — canonical proof-bundle lock-down:

- New `CanonicalBundleManifestSchema` in
  `src/tools/bundleManifestSchema.ts` requires `sha256` and `bytes` on
  every artifact entry — that's the drift detector.
- `src/tools/validate-bundle.ts` gains `--profile canonical` with eight
  rules (manifest exists + parses, artifacts present + bytes match +
  sha256 match, commands.sh/reproduce.sh present, command-status.tsv
  clean when `result: pass`, notes.md or README.md present) plus a
  `checkCatalogParity()` helper that confirms every `dogfood/<name>/`
  path in `dogfood/CATALOG.md` resolves to a real directory.
- New `src/tools/validate-canonical-bundles.ts` validates the four
  bundles named in `RELEASE.md` in parallel
  (`20260326-week9-release-readiness`, `20260325-week8-contract-locks`,
  `run-command`, `agent-uses-agent-tty`) plus the CATALOG parity check.
- Two missing canonical manifests authored
  (`dogfood/run-command/manifest.json`,
  `dogfood/agent-uses-agent-tty/manifest.json`). The two existing
  manifests (`week9-release-readiness`, `week8-contract-locks`) gain
  `sha256` + `bytes` per artifact — documentation normalization of
  already-present evidence, not a rewrite.
- New `scripts/seed-canonical-manifest.mjs` streaming-hash helper for
  authoring future canonical manifests.
- Wired into `mise run validate-bundles`, `npm run
  validate-bundle:canonical`, and a new step in the `linux-static` CI
  job.

Change-Id: I5277df8a9f2e2d917bbb87b40b1d88cfe3c99be9
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>

* test: relax live-host rendererRuntime assertions to objectContaining

The new optional `booted` and `bootInFlight` fields on
`rendererRuntime` now appear in live-host inspect envelopes, which
broke two strict `.toEqual` assertions in the integration and e2e
suites. Relax both to `expect.objectContaining` so the contract on the
three pre-existing fields stays pinned while the additive extensions
pass through.

The offline-replay assertion in `hello-prompt.test.ts` stays strict
because offline-replay mode deliberately suppresses the renderer
extensions.

Change-Id: If3adc54ea74e94e986ebefc653e2f09f1fb64755
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>

* test(validate-bundle): unit coverage for canonical profile + statEventLogBytes

Addresses Netero P2 [DEREM-1] and P3 [DEREM-2].

DEREM-1: `runCanonicalChecks`, `checkCatalogParity`, and the
`CanonicalBundleManifestSchema` now have branch coverage in
`test/unit/tools/validate-bundle.test.ts`:

- happy path with notes.md + commands.sh
- alternate notes (README.md) and alternate script (reproduce.sh)
- manifest.json missing
- manifest.json not valid JSON
- manifest.json fails CanonicalBundleManifestSchema
- artifact missing on disk
- artifact byte size disagrees with manifest
- artifact sha256 disagrees with manifest
- neither commands.sh nor reproduce.sh present
- neither notes.md nor README.md present
- command-status.tsv absent on pass (skip)
- command-status.tsv with failing row on pass (fail)
- command-status.tsv with no header on pass (fail)
- checkCatalogParity: all resolve, missing dir, glob-skip,
  deduplication

DEREM-2: `statEventLogBytes` gets dedicated tests in
`test/unit/host/eventLog.test.ts` covering missing-file
(ENOENT→undefined), empty file, populated file, empty-path
rejection, and non-ENOENT rethrow (forced via ENOTDIR by stat'ing
through a regular file).

Change-Id: I0b903aa4542e0fc320496a5ce4043fc1dc906e7c
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>

* fix(validate-bundle+host): round-2 review fixes

Addresses Netero/Hisoka/Mafuuu/Meruem/Bisky/Robin/Leorio/Gon/Pariston
findings in DEREM-4 through DEREM-19.

DEREM-4: artifact paths from manifest.json are now containment-checked
against the bundle root via `isPathWithinBundle`; entries that resolve
outside (e.g. `../../.git/config`) push into a new `escapedArtifacts`
bucket that fails `artifacts-present`.

DEREM-5: `artifacts-bytes-match` and `artifacts-sha256-match` now
report the count of artifacts they actually evaluated, e.g. "7 of 10
artifact sha256 digests match the manifest (3 skipped)." Skipped
artifacts (missing, escaped, stat errors, size mismatch) no longer
inflate the "all match" message.

DEREM-6: `isBootInFlight` now has a test that observes the `true`
state during an awaited boot via `createDeferred` and
`bootImplementation`, mirroring the lazily-boots pattern already used
in the file. The previous test only asserted `false` three times.

DEREM-7: `isDirectExecution` extracted to `src/util/isDirectExecution.ts`
with an `importMetaUrl: string` parameter. The three identical copies
in `validate-bundle.ts`, `review-bundle.ts`, and
`validate-canonical-bundles.ts` now import from the util.

DEREM-8: `manifest-exists` byte-count message now reports
`Buffer.byteLength(manifestText, 'utf8')` instead of
`manifestText.length` (UTF-16 code units mislabeled as "bytes").

DEREM-9: stat() errors on canonical artifacts and CATALOG entries are
now distinguished: ENOENT continues to bucket into "missing"; other
errors (EACCES, EIO) propagate or bucket into a new `statErrors`
list so operators see the real cause instead of "Missing: X" when X
exists but is unreadable.

DEREM-10: `validateCanonicalBundles` now wraps each per-bundle
`validateBundle` call in try/catch and synthesizes a
`validation-error` check on crash, matching `runValidateBundleCli`.
A single bundle crash no longer swallows diagnostics from the other
three. Catalog parity also wraps in try/catch.

DEREM-11: host startup no longer crashes if `package.json` is
unreadable. `loadPackageMetadata` is now lazy and memoized per host
process with a `.catch(() => undefined)` fallback; the inspect RPC
omits `cliVersion` instead of throwing, matching its optional schema
contract.

DEREM-12: command-status.tsv "fail" scan now locates the status
column by header name (`status`, case-insensitive) with a column-1
fallback for legacy layouts; cells containing "fail" in other
columns (e.g. a notes column) no longer trigger false positives.

DEREM-13: new test for non-`pass` canonical bundles confirming that
the `command-status-tsv-clean-if-pass` check is absent (not just
passing).

DEREM-14: `commands-sh-exists` check renamed to
`reproduce-script-exists` (and the local `hasCommandsSh` →
`hasReproduceScript`) to match the rule that either `commands.sh` or
`reproduce.sh` satisfies it.

DEREM-15: `InspectHostInfo` (command-first) renamed to `HostInfo` to
match `HostInspectResult`'s entity-first pattern. The exported public
field in `InspectResult` is already `host`, so this also tightens
type-to-field alignment.

DEREM-18, DEREM-19: doc comments added to `statEventLogBytes` and
`bundleManifestSchema.ts` documenting the ENOENT contract and the
canonical-bundle scope respectively.

DEREM-22: the new inspect-extension tests now assert on the human-
readable `lines` output (Host CLI Version, RPC Socket, Event Log
Bytes, renderer extras suffix), not just the JSON `result`.

Change-Id: I81fc1bd41f4552259598b9ebcb04877e1c38cf40
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>

* fix(round-3): decouple host fields, tighten canonical checks, dedupe

DEREM-24: HostInfo.cliVersion is now optional. `rpcSocketPath` (which
the host always knows) surfaces independently when `loadPackageMetadata`
fails. Human output omits the Host CLI Version line in that case rather
than dropping the entire `host` block.

DEREM-25: artifacts-bytes-match and artifacts-sha256-match are no longer
vacuously `ok: true` when every artifact was skipped. Both checks now
require a positive `bytesCheckedCount`/`hashedCount` and report
"No artifacts available to verify" with the skipped count when zero
were evaluated.

DEREM-26: hashFile replaced with a three-line `pipeline(createReadStream,
hash)` from `node:stream/promises`. The Node 24+ runtime handles error
propagation and stream destruction structurally, so the manual Promise
wrapper is unnecessary.

DEREM-27: hasErrorCode extracted to `src/util/hasErrorCode.ts`. The
three in-scope copies in `src/cli/commands/gc.ts`, `src/host/lifecycle.ts`,
and `src/tools/validate-bundle.ts` now import from the util; the private
`NodeError` shim in each file is removed.

DEREM-28: InspectResultSchema gains inline comments documenting when
`host` and `eventLogBytes` are populated; RendererRuntimeSummarySchema
documents the live-mode-only nature of `profile`, `booted`, and
`bootInFlight`. Automation consumers can now distinguish offline-replay,
old-host, and error from the schema alone.

DEREM-29: RendererRuntimeSummarySchema.profile now has `.min(1)` so the
consumer schema matches the producer-side constraint in
`HostInspectResultSchema.rendererProfile`.

Change-Id: I2839a0fa7c81b71af2f4950da609ab395cabaa80
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>

* fix(round-4): atomic renderer snapshot + isFile rethrow

DEREM-23 (re-raise): the inspect RPC handler now reads `state.snapshot()`,
`getCurrentProfileName()`, `isBooted()`, and `isBootInFlight()` in a single
synchronous tick before the `await getPackageMetadata()`. The previous
ordering let concurrent RPC handlers mutate renderer state and the session
snapshot between the reads, producing a result that did not correspond
to any real point in time. Switching to local-var capture closes that
window without taking the renderer manager's lifecycle lock.

DEREM-31: `isFile` now rethrows non-ENOENT stat errors instead of
swallowing them as "not present", matching the DEREM-9 discipline used
for canonical artifact stats. EACCES or EIO on commands.sh / notes.md /
command-status.tsv now propagates with the original error so operators
see the real cause.

Change-Id: Iba753e8177d3772de2ad41831c44347570107fc6
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>

* fix(round-5): sweep ENOENT, dedupe isWithinRoot, orchestrator tests

DEREM-35: statEventLogBytes and countEventLogEntries now use the shared
hasErrorCode util instead of duplicated inline ENOENT checks.

DEREM-36: TSV failing-row scan lowercases the status cell before
comparing to 'fail' so 'FAIL' and 'Fail' are detected, matching the
case-insensitive header lookup.

DEREM-37: validateCanonicalBundles orchestrator gains a 5-case unit
test suite (happy path, per-bundle ok:false, per-bundle crash via
synthesizeCrashResult, catalog mismatch, catalog parity throw). The
DEREM-10 isolation guarantee is now structurally tested.

DEREM-38: isWithinRoot extracted to src/util/isWithinRoot.ts and
shared by validate-bundle.ts (formerly isPathWithinBundle) and
review-bundle.ts (formerly its own isWithinRoot).

DEREM-39: doc comment on validate-canonical-bundles.ts no longer
falsely cites RELEASE.md for agent-uses-agent-tty; that bundle is the
evergreen agent demo, locked here for drift protection on the same
schema as the three release-signoff bundles.

DEREM-33, DEREM-34: removed em-dashes from PR-touched doc and test
comments.

DEREM-40: local hasNotes renamed to hasNotesOrReadme, matching the
DEREM-14 hasReproduceScript fix.

DEREM-41, DEREM-42, DEREM-43: doc comments added to loadPackageMetadata,
checkCatalogParity, and each new optional field on HostInspectResultSchema.

Change-Id: I458a66294d2747048edb9c6f8f8b10a8979ddd80
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>

* fix(round-6): sweep miss in DEREM-39/33 from round 5

DEREM-46: bundleManifestSchema.ts doc comment also falsely claimed all
four canonical bundles are 'named in RELEASE.md'. The DEREM-39 fix in
14db634 corrected the same wording in validate-canonical-bundles.ts but
missed this sibling. Now mirrors the three-release-signoff + one
evergreen-demo distinction.

DEREM-45: em-dash in the checkCatalogParity doc comment introduced in
14db634 (the same commit that fixed DEREM-33 and DEREM-34 elsewhere).
Replaced with a semicolon.

Change-Id: Icaac8482eb8caf6f0bcf9c6e0ac55f7d8ace0d40
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>

* test(inspect): cover DEREM-24 branch where cliVersion is absent

DEREM-50: new test 'surfaces host.rpcSocketPath even when cliVersion is
unavailable' exercises the DEREM-24 fix (host gated only on
rpcSocketPath). Asserts host.cliVersion === undefined, host.rpcSocketPath
populates, and the 'RPC Socket:' line appears while 'Host CLI Version:'
does not. If a future change re-couples the two fields, this test breaks.

Change-Id: I760f5f69766e6b6f382bc85cd0af4d6cdded1642
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>

---------

Signed-off-by: Thomas Kosiewski <tk@coder.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ThomasK33

.github/workflows/ci.yml

@@ -52,6 +52,9 @@ jobs:
       - name: Typecheck
         run: mise run typecheck
 
+      - name: Validate canonical proof bundles
+        run: mise run validate-bundles
+
       - name: Build
         run: mise run build
 

dogfood/20260325-week8-contract-locks/manifest.json

@@ -14,31 +14,45 @@
   "artifacts": [
     {
       "path": "logs/01-golden-envelopes.json",
-      "description": "Pretty-printed Vitest JSON output for the Week 8 golden-envelope suite"
+      "description": "Pretty-printed Vitest JSON output for the Week 8 golden-envelope suite",
+      "sha256": "985c613652551c4e395b444c0256db6c5dd8e17ea952b3ea6dcf148f36af1a2a",
+      "bytes": 21655
     },
     {
       "path": "logs/01-golden-envelopes.stderr.txt",
-      "description": "Captured stderr for the JSON-reporter Vitest run"
+      "description": "Captured stderr for the JSON-reporter Vitest run",
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "bytes": 0
     },
     {
       "path": "logs/02-golden-envelopes.txt",
-      "description": "Human-readable Vitest output showing the full Week 8 golden-envelope suite passing"
+      "description": "Human-readable Vitest output showing the full Week 8 golden-envelope suite passing",
+      "sha256": "1331dd870574ac6a647882e376bc4baffa32cbdc90e6507a1e0908d4f16c3fa2",
+      "bytes": 504
     },
     {
       "path": "logs/02-golden-envelopes.stderr.txt",
-      "description": "Captured stderr for the human-readable Vitest run"
+      "description": "Captured stderr for the human-readable Vitest run",
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "bytes": 0
     },
     {
       "path": "snapshots/01-golden-envelopes.json",
-      "description": "Bundle-local JSON mirror used by the review and validation tooling"
+      "description": "Bundle-local JSON mirror used by the review and validation tooling",
+      "sha256": "985c613652551c4e395b444c0256db6c5dd8e17ea952b3ea6dcf148f36af1a2a",
+      "bytes": 21655
     },
     {
       "path": "screenshots/01-review-page.png",
-      "description": "Screenshot of the generated local review page"
+      "description": "Screenshot of the generated local review page",
+      "sha256": "74b1e45cb7c73056ed4082537a45b98281e98cc64341ca2ab7480fdde24f7650",
+      "bytes": 3866344
     },
     {
       "path": "command-status.tsv",
-      "description": "Per-step exit-code ledger for capture, review-page generation, validation, and screenshot creation"
+      "description": "Per-step exit-code ledger for capture, review-page generation, validation, and screenshot creation",
+      "sha256": "a9ac6f0c136b672582067a912f299cb52a314cdf7b2796d18d5b180251b2186a",
+      "bytes": 1362
     }
   ]
 }

dogfood/20260326-week9-release-readiness/manifest.json

@@ -23,95 +23,141 @@
   "artifacts": [
     {
       "path": "notes.md",
-      "description": "Reviewer-facing narrative explaining what Week 9 functionality was proven and what limitations were observed"
+      "description": "Reviewer-facing narrative explaining what Week 9 functionality was proven and what limitations were observed",
+      "sha256": "773200f78c0c31b649834f74edd53a68cf6c569c75129584007dfcb03ba3cac0",
+      "bytes": 5159
     },
     {
       "path": "commands.sh",
-      "description": "Reproducible capture script for recreating the Week 9 release-readiness bundle"
+      "description": "Reproducible capture script for recreating the Week 9 release-readiness bundle",
+      "sha256": "d37691e848c7073166b9a2cc8bf3bdddd2f315b428667f4270ebb828ef050292",
+      "bytes": 11047
     },
     {
       "path": "command-status.tsv",
-      "description": "Step-by-step exit-code ledger for capture, artifact copies, review-page generation, validation, and formatting checks"
+      "description": "Step-by-step exit-code ledger for capture, artifact copies, review-page generation, validation, and formatting checks",
+      "sha256": "ef1f471884714a5c6934d5c9d13fb542c8b68487e9cd321decffe53f75f3678d",
+      "bytes": 3014
     },
     {
       "path": "logs/01-doctor.json",
-      "description": "Doctor JSON envelope showing home isolation and browser cache accessibility checks under an isolated home"
+      "description": "Doctor JSON envelope showing home isolation and browser cache accessibility checks under an isolated home",
+      "sha256": "8e39a2b7eec4eb11ebe61cc0f550360f71808f8ebed175669cecaf3a9ccd7aa6",
+      "bytes": 3979
     },
     {
       "path": "snapshots/01-doctor.json",
-      "description": "Bundle-local JSON mirror of the doctor output used by validator/review tooling"
+      "description": "Bundle-local JSON mirror of the doctor output used by validator/review tooling",
+      "sha256": "8e39a2b7eec4eb11ebe61cc0f550360f71808f8ebed175669cecaf3a9ccd7aa6",
+      "bytes": 3979
     },
     {
       "path": "logs/03-create-inspect.json",
-      "description": "Initial inspect output for the isolated session immediately after creation"
+      "description": "Initial inspect output for the isolated session immediately after creation",
+      "sha256": "5b2ef102511fcf4932f1b8027b5105b933b99288a77ff27e8b441cb1b94f5f36",
+      "bytes": 1041
     },
     {
       "path": "logs/04-run-echo.json",
-      "description": "Run-command JSON envelope for the Week 9 proof banner command"
+      "description": "Run-command JSON envelope for the Week 9 proof banner command",
+      "sha256": "e6b6728ac88145f64836ff169db9d23fd793e3a07fe6c3c2a0f98de6b46e892c",
+      "bytes": 267
     },
     {
       "path": "logs/05-run-sysinfo.json",
-      "description": "Run-command JSON envelope for the in-session system-information command"
+      "description": "Run-command JSON envelope for the in-session system-information command",
+      "sha256": "18bcec421a0f54dbc6e0373b1f18287d5086a1699294e167daa79bf26101ca15",
+      "bytes": 267
     },
     {
       "path": "logs/06-wait-stable.json",
-      "description": "Renderer wait result proving the terminal frame was stable before capture"
+      "description": "Renderer wait result proving the terminal frame was stable before capture",
+      "sha256": "c90eaf0ae00e714ee418f1a9e7f67b82c9c07f8fb2dd76529750f7417b320838",
+      "bytes": 207
     },
     {
       "path": "logs/07-screenshot.json",
-      "description": "Screenshot JSON envelope for the copied PNG artifact"
+      "description": "Screenshot JSON envelope for the copied PNG artifact",
+      "sha256": "26ace7e437f72673ff415a5ae7c38477e28fa2e40e57657fdd3221a34d338173",
+      "bytes": 699
     },
     {
       "path": "screenshots/01-after-run.png",
-      "description": "Renderer screenshot captured after the two run commands completed"
+      "description": "Renderer screenshot captured after the two run commands completed",
+      "sha256": "6b07d07c3a58035b4d432d4b449fc2e5423b02be422c2aaeb4588e36ef230d1d",
+      "bytes": 22396
     },
     {
       "path": "logs/08-snapshot.json",
-      "description": "Structured snapshot JSON envelope for the same post-run terminal frame"
+      "description": "Structured snapshot JSON envelope for the same post-run terminal frame",
+      "sha256": "f18e2577dbdd4f1e1ba2d4851dbc43bc03adb50ef8f1d94f1b4ff1cb92fd94bc",
+      "bytes": 1969
     },
     {
       "path": "snapshots/02-post-run-structured.json",
-      "description": "Bundle-local JSON mirror of the structured post-run snapshot"
+      "description": "Bundle-local JSON mirror of the structured post-run snapshot",
+      "sha256": "f18e2577dbdd4f1e1ba2d4851dbc43bc03adb50ef8f1d94f1b4ff1cb92fd94bc",
+      "bytes": 1969
     },
     {
       "path": "logs/09-export-asciicast.json",
-      "description": "Asciicast export JSON envelope"
+      "description": "Asciicast export JSON envelope",
+      "sha256": "621e71afbd92115e63fd36c99007d2ea38e1334bdea6485479fdd5df5d0fa905",
+      "bytes": 686
     },
     {
       "path": "recordings/week9.cast",
-      "description": "Exported asciicast recording for the isolated Week 9 proof session"
+      "description": "Exported asciicast recording for the isolated Week 9 proof session",
+      "sha256": "073533533b48cddf4ca7c4b97de1da8e116fd0d54157c1492ea90bf9df2f1f79",
+      "bytes": 1207
     },
     {
       "path": "logs/10-export-webm.json",
-      "description": "WebM export JSON envelope"
+      "description": "WebM export JSON envelope",
+      "sha256": "342641327bfd5f89cdb074f9faff1f195b56c5ee3aa329c3c2afc6fb54911178",
+      "bytes": 746
     },
     {
       "path": "videos/week9.webm",
-      "description": "Exported WebM replay for the isolated Week 9 proof session"
+      "description": "Exported WebM replay for the isolated Week 9 proof session",
+      "sha256": "3677c43c2a4a76e9d93209ac466569f711c4d6469f3cfaab6136b02ed8d613ef",
+      "bytes": 54201
     },
     {
       "path": "logs/11-final-inspect.json",
-      "description": "Final inspect output confirming healthy artifacts and live renderer runtime before teardown"
+      "description": "Final inspect output confirming healthy artifacts and live renderer runtime before teardown",
+      "sha256": "a720a4bee3b2d0ea39bd73d8421fb509fcd4d19e98ae51d4b639aee3d3ae012d",
+      "bytes": 1135
     },
     {
       "path": "snapshots/03-final-inspect.json",
-      "description": "Bundle-local JSON mirror of the final inspect output"
+      "description": "Bundle-local JSON mirror of the final inspect output",
+      "sha256": "a720a4bee3b2d0ea39bd73d8421fb509fcd4d19e98ae51d4b639aee3d3ae012d",
+      "bytes": 1135
     },
     {
       "path": "logs/12-destroy.json",
-      "description": "Destroy output confirming the isolated session was cleaned up"
+      "description": "Destroy output confirming the isolated session was cleaned up",
+      "sha256": "740964f59859ec137d5a1c72a4a6cb97701d618805c993444127e802851f35e0",
+      "bytes": 172
     },
     {
       "path": "logs/13-review-bundle.txt",
-      "description": "Review-bundle output showing the static reviewer page generation path"
+      "description": "Review-bundle output showing the static reviewer page generation path",
+      "sha256": "5f11b2e1ae34c872d7d40aeabba57e875c956433669977334d883fc7b389ac5e",
+      "bytes": 110
     },
     {
       "path": "logs/14-validate-bundle.txt",
-      "description": "Bundle validation stdout for the interactive-renderer profile"
+      "description": "Bundle validation stdout for the interactive-renderer profile",
+      "sha256": "d455b4edd3dc16e741030547ad133e36da6649ef56640d76bad5708cd23cc989",
+      "bytes": 1052
     },
     {
       "path": "index.html",
-      "description": "Generated static review page for the complete Week 9 proof bundle"
+      "description": "Generated static review page for the complete Week 9 proof bundle",
+      "sha256": "d715ed55733a39d9a547ae94d91d5486b68858e5e300bbd53b80c1ef93c13524",
+      "bytes": 77959
     }
   ]
 }