# Frozen hostile corpus v1

This directory contains one rejected exploit fixture and one accepted boundary
control for each of the 32 canonical archive and input classes in
`manifest.json`. Paths in the manifest are relative to this directory and every
fixture is bound by SHA-256.

`generate-fixtures.mjs` constructs USTAR archives directly and writes bounded
JSON or JSONL inputs. It never extracts an archive or executes fixture content.
The numeric boundaries used by the pairs are frozen in
`manifest.json.fixtureContract`.

The two gzip fixtures are bound to their committed SHA-256 bytes. Because zlib
releases can produce different valid DEFLATE streams, regeneration preserves
the committed stream when its expanded canonical USTAR bytes match; verification
requires both the frozen compressed digest and deterministic expanded bytes.

Regenerate and verify deterministically with Node.js 22 or 24:

```sh
node verification/aas-v1/baseline/v1/hostile/generate-fixtures.mjs
node verification/aas-v1/baseline/v1/hostile/verify-fixtures.mjs
```

The verifier parses archive headers and gzip streams in memory. It does not
materialize archive members. It also rejects any symlink, device, FIFO, socket,
or other special entry that appears in the corpus directory itself.