callstack__agent-device/packages/maestro/test/conformance/fixture-seal.ts

import { createHash } from 'node:crypto';

// Normal CI cannot re-derive fixtures without Java, so verification recomputes
// this tamper-evident seal over generated content. The scheduled regeneration
// job closes the remaining gap by re-running the JVM harness against the pinned
// artifacts and comparing the generated bytes.
export function fixtureContentHash(fixtureWithoutSeal: unknown): string {
  return createHash('sha256').update(JSON.stringify(fixtureWithoutSeal)).digest('hex');
}

export function checkFixtureSeal(parsedFixture: Record<string, unknown>): {
  expected: string;
  actual: unknown;
} {
  const { contentHash, ...content } = parsedFixture;
  return { expected: fixtureContentHash(content), actual: contentHash };
}