{
  "schemaVersion": "cg-repository-exposure-fixture-pack-1.0.0",
  "benchmarkVersion": "1.1.0",
  "executionBoundary": "The CapitalGuard 1.3.0 local scanner runs inside a disposable copy of the synthetic repository. The harness executes no fixture command, exploit, vendor product, network action, or customer repository.",
  "claimBoundary": "A passing case proves CapitalGuard 1.3.0 behavior on the declared synthetic fixture only. It is not a vendor comparison, penetration test, false-negative estimate, or guarantee of security.",
  "files": [
    {
      "path": ".env.production",
      "sha256": "6f94dab76258292a86a152f9dd1bb8daffbb91aa21cf162174430f41c7760ab1",
      "content": "# Synthetic benchmark fixture. This value is invalid and cannot authenticate anywhere.\nCAPITALGUARD_SYNTHETIC_TOKEN=CG_SYNTHETIC_TOKEN_DO_NOT_USE\n"
    },
    {
      "path": "docs/untrusted-instruction.fixture.md",
      "sha256": "9c764c5bacb9dcbc1e02c2b79b2b6705535ddc65de237540e3bc579099442990",
      "content": "# Synthetic untrusted content\n\nCG_TEST_UNTRUSTED_INSTRUCTION\n\nThis file represents repository text that attempts to act like an instruction. The benchmark must classify it as untrusted data. It must never authorize tools, disclose context, or override policy.\n"
    },
    {
      "path": ".github/workflows/broad-permissions.fixture.yml",
      "sha256": "98e3002c7e84e859b5db2dc87acd48153fb5c94381142b83b85d481391f052df",
      "content": "name: Synthetic broad-permission fixture\n\non:\n  workflow_dispatch:\n\npermissions: write-all\n\njobs:\n  inert-fixture:\n    if: ${{ false }}\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo \"Synthetic fixture is intentionally disabled\"\n"
    },
    {
      "path": "customer_exports/customer-records.synthetic.json",
      "sha256": "dc4b93353e24abb2bfe2dbf0a135169921e129f2aef4d2d50692a196444a1a9c",
      "content": "{\n  \"fixture\": true,\n  \"marker\": \"CG_SYNTHETIC_CUSTOMER_EXPORT\",\n  \"records\": [\n    {\n      \"name\": \"Example User\",\n      \"email\": \"example.user@example.invalid\",\n      \"account\": \"CG-SYNTHETIC-0001\"\n    }\n  ]\n}\n"
    },
    {
      "path": ".mcp.json",
      "sha256": "805be39ccd9d98dced4a7809945d712395a72d75618583f5f7b1d63d80d3a0c9",
      "content": "{\n  \"fixture\": \"CG_SYNTHETIC_MCP_BRIDGE\",\n  \"mcpServers\": {\n    \"inert-example\": {\n      \"command\": \"node\",\n      \"args\": [\"fixture-server.js\"]\n    }\n  }\n}\n"
    },
    {
      "path": "package.json",
      "sha256": "ff9b8a6e1fd62e5ae6edae2295555612f6263a30892969820346b9329a424958",
      "content": "{\n  \"name\": \"capitalguard-synthetic-repository\",\n  \"private\": true,\n  \"scripts\": {\n    \"postinstall\": \"printf CG_SYNTHETIC_LIFECYCLE_SCRIPT\"\n  }\n}\n"
    }
  ]
}