From e862118f777816dcca1319346499e7ee9709d3e6 Mon Sep 17 00:00:00 2001
From: Riverbraid <f7pbmpwbfn@privaterelay.appleid.com>
Date: Sun, 16 Aug 2026 18:06:16 -0400
Subject: [PATCH] chore: preserve adopted legacy verification fixtures

---
 fixtures/legacy/refusal-gold/index.js   | 69 +++++++++++++++++++
 fixtures/legacy/refusal-gold/verify.mjs | 92 +++++++++++++++++++++++++
 fixtures/lifecycle/verify-parked.cjs    | 10 +++
 3 files changed, 171 insertions(+)
 create mode 100644 fixtures/legacy/refusal-gold/index.js
 create mode 100644 fixtures/legacy/refusal-gold/verify.mjs
 create mode 100644 fixtures/lifecycle/verify-parked.cjs

diff --git a/fixtures/legacy/refusal-gold/index.js b/fixtures/legacy/refusal-gold/index.js
new file mode 100644
index 0000000..7ae7b82
--- /dev/null
+++ b/fixtures/legacy/refusal-gold/index.js
@@ -0,0 +1,69 @@
+/**
+ * Riverbraid-Refusal-Gold: index.js
+ * Boundary logic and deterministic refusal surface
+ */
+export const RB_PETAL_ID = 'Riverbraid-Refusal-Gold';
+
+const REFUSAL_CODES = {
+  R01: 'PROTOCOL_VIOLATION',
+  R02: 'ENTROPY_TOKEN_DETECTED',
+  R03: 'BOUNDARY_BREACH',
+  R05: 'EMPTY_INPUT'
+};
+
+function join(parts) {
+  return parts.join('');
+}
+
+const FORBIDDEN_TOKENS = [
+  join(['Math', '.', 'random']),
+  join(['Date', '.', 'now']),
+  join(['crypto', '.', 'random', 'UUID']),
+  join(['new', ' ', 'Date', '(']),
+  join(['performance', '.', 'now'])
+];
+
+export function evaluate(input) {
+  if (!input || (typeof input === 'string' && input.trim().length === 0)) {
+    return refusal('R05');
+  }
+  if (typeof input !== 'string') {
+    return refusal('R01');
+  }
+  for (const token of FORBIDDEN_TOKENS) {
+    if (input.includes(token)) {
+      return refusal('R02');
+    }
+  }
+  return {
+    refused: false,
+    petal: RB_PETAL_ID,
+    status: 'PASS'
+  };
+}
+
+function refusal(code) {
+  return {
+    refused: true,
+    petal: RB_PETAL_ID,
+    code,
+    reason: REFUSAL_CODES[code] ?? 'UNKNOWN'
+  };
+}
+
+export function getStatus() {
+  return {
+    status: 'STATIONARY',
+    petal: RB_PETAL_ID
+  };
+}
+
+export function verify() {
+  return {
+    repo: 'Riverbraid-Refusal-Gold',
+    ring: 1,
+    invariant: 'REFUSAL_STATIONARY',
+    status: 'DECLARED_ONLY',
+    claim_boundary: 'declared-conditions-only'
+  };
+}
\ No newline at end of file
diff --git a/fixtures/legacy/refusal-gold/verify.mjs b/fixtures/legacy/refusal-gold/verify.mjs
new file mode 100644
index 0000000..f60e0f0
--- /dev/null
+++ b/fixtures/legacy/refusal-gold/verify.mjs
@@ -0,0 +1,92 @@
+import fs from "node:fs";
+import crypto from "node:crypto";
+const repo = "Riverbraid-Refusal-Gold";
+const invariant = "REFUSAL_STATIONARY";
+const requiredFiles = [
+  "verify.mjs",
+  "index.js",
+  "protocol.steps",
+  "package.json",
+  "AUTHORITY.md",
+  "RING.md"
+];
+const missing = requiredFiles.filter((file) => !fs.existsSync(file));
+let protocolOk = false;
+let indexExportsVerify = false;
+let deterministicSurfaceOk = false;
+let failureCodes = [];
+
+if (missing.length > 0) {
+  failureCodes.push("REQUIRED_FILES_MISSING");
+}
+
+try {
+  const protocol = JSON.parse(fs.readFileSync("protocol.steps", "utf8").replace(/^\uFEFF/, ""));
+  protocolOk =
+    protocol.invariant === invariant &&
+    Array.isArray(protocol.steps) &&
+    protocol.steps.length > 0;
+  if (!protocolOk) {
+    failureCodes.push("PROTOCOL_STEPS_INVALID");
+  }
+} catch {
+  failureCodes.push("PROTOCOL_STEPS_PARSE_FAILED");
+}
+
+try {
+  const index = fs.readFileSync("index.js", "utf8");
+  indexExportsVerify =
+    index.includes("export function verify") ||
+    index.includes("export { verify") ||
+    index.includes("module.exports") && index.includes("verify");
+  const banned = [
+    "Date.now",
+    "new Date",
+    "Math.random",
+    "crypto.randomUUID",
+    "randomUUID"
+  ];
+  deterministicSurfaceOk = banned.every((term) => !index.includes(term));
+  if (!indexExportsVerify) {
+    failureCodes.push("INDEX_VERIFY_EXPORT_MISSING");
+  }
+  if (!deterministicSurfaceOk) {
+    failureCodes.push("NONDETERMINISTIC_SURFACE_DETECTED");
+  }
+} catch {
+  failureCodes.push("INDEX_READ_FAILED");
+}
+
+const ok =
+  missing.length === 0 &&
+  protocolOk &&
+  indexExportsVerify &&
+  deterministicSurfaceOk;
+
+const hash = crypto.createHash("sha256");
+for (const file of requiredFiles) {
+  if (fs.existsSync(file)) {
+    hash.update(file);
+    hash.update("\0");
+    hash.update(fs.readFileSync(file));
+    hash.update("\0");
+  }
+}
+
+const output = {
+  repo,
+  ring: 1,
+  invariant,
+  status: ok ? "VERIFIED" : "FILES_PRESENT_UNVERIFIED",
+  verification_scope: "ring1-file-surface-and-determinism-scan",
+  claim_boundary: "declared-conditions-only",
+  required_files: requiredFiles,
+  missing_files: missing,
+  protocol_valid: protocolOk,
+  index_exports_verify: indexExportsVerify,
+  deterministic_surface_ok: deterministicSurfaceOk,
+  failure_codes: ok ? [] : failureCodes,
+  digest: "sha256:" + hash.digest("hex")
+};
+fs.writeFileSync("verify-output.json", JSON.stringify(output, null, 2) + "\n", "utf8");
+process.exit(ok ? 0 : 1);
diff --git a/fixtures/lifecycle/verify-parked.cjs b/fixtures/lifecycle/verify-parked.cjs
new file mode 100644
index 0000000..adbe13c
--- /dev/null
+++ b/fixtures/lifecycle/verify-parked.cjs
@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+"use strict";
+const fs = require("fs");
+function fail(code) { console.error(code); process.exit(1); }
+for (const file of ["README.md", "repo.role.json", "package.json", "verify-parked.cjs"]) {
+  if (!fs.existsSync(file)) fail(`MISSING_REQUIRED_FILE:${file}`);
+}
+const role = JSON.parse(fs.readFileSync("repo.role.json", "utf8").replace(/^\uFEFF/, ""));
+if (role.status !== "parked") fail("ROLE_STATUS_MUST_BE_PARKED");
+console.log(`PARKED_REPO_VERIFIED:${role.name}`);