# Exploitation evidence code

Tested code for the exploitation evidence seed pack, kept as nouns: the pack's tool cards pin
this folder by its digest, which the library's make check computes. The library runs this code only in its tests in CI. Workers run
it under their own permissions, and importing the pack runs nothing.

## What is here

| Path | What it holds |
| --- | --- |
| `exploitation_evidence/lanes/` | Pattern rules, rule cards, the money-flow checks and cash-flow verifier, evidence extraction and the label-leak guard |
| `exploitation_evidence/pipeline/` | The case bundle loader and the route decision: clear, verify, hold or refer |
| `exploitation_evidence/copy.py` | The wording check and the excluded material screen |
| `exploitation_evidence/situations/` | The seeded synthetic case generator and the freeze manifest |
| `exploitation_evidence/evals/` | The exact-match scorer and the pass marks loader |
| `exploitation_evidence/schemas/` | The records every part shares |
| `exploitation_evidence/pack_data.py` | Writes the pack's nouns as the data files the loaders read |
| `examples/cases/` | Twenty synthetic development cases for the tests and for trying the verbs |
| `tests/` | The code's own tests |

Harm areas, pattern rules, rule cards, the pass marks and the toy templates are nouns in
[../nouns.json](../nouns.json), not files here. `make data` writes them into `areas/`, `cards/`,
`evaluation/` and `examples/templates/`, which are generated and never committed. The tests do the
same before they start.

## Run the tests

Use Python 3.12 or newer with the packages in [requirements-test.txt](requirements-test.txt):

    python3 -m pip install -r requirements-test.txt
    make test

From the library root, `make check-exploitation-evidence-code` runs the same tests, and the library's
exploitation-evidence-code workflow runs them on every change under `packs/exploitation-evidence/`.

## What changed in the move and what stayed behind

The code moved from an earlier project without behavior changes. The pack's moved_from field records the repository and commit it moved from, and the move's
commit in this library's history lists each file's original path and digest and every renamed string. Two strings changed with the
package name: generation receipts now name the generator `exploitation-evidence-situations/1`, and the
private templates folder is read from `EXPLOITATION_EVIDENCE_TEMPLATES_DIR`.

Left out on purpose: the stage handlers, stage graph, driver and worker loop that ran cases as leased
tasks on the fabric, the fabric adapter, the model client and budget ledger, the evaluation runner and
its arms, the command line, the web app, API and Worker, the build briefs and their records, and the
private templates. The route functions the stage handlers called moved unchanged into
`exploitation_evidence/pipeline/routing.py`.