From dd70a772e83096425bc809bf4a35faf058ba3c2e Mon Sep 17 00:00:00 2001
From: Guangshuo <zcrab@openai.com>
Date: Fri, 4 Sep 2026 14:09:25 -0700
Subject: [PATCH] test: add inert repository review check fixture

---
 .agents/checks/CRAB-FIXTURE-01/CHECK.md | 33 +++++++++++++++++++++++++
 tests/repository-checks/README.md       | 23 +++++++++++++++++
 tests/repository-checks/fixture.json    | 10 ++++++++
 3 files changed, 66 insertions(+)
 create mode 100644 .agents/checks/CRAB-FIXTURE-01/CHECK.md
 create mode 100644 tests/repository-checks/README.md
 create mode 100644 tests/repository-checks/fixture.json

diff --git a/.agents/checks/CRAB-FIXTURE-01/CHECK.md b/.agents/checks/CRAB-FIXTURE-01/CHECK.md
new file mode 100644
index 0000000..1776abc
--- /dev/null
+++ b/.agents/checks/CRAB-FIXTURE-01/CHECK.md
@@ -0,0 +1,33 @@
+---
+schema_version: 1
+name: CRAB-FIXTURE-01
+revision: "2026-09-04"
+description: Keep repository-review JSON fixtures synthetic and free of sensitive data.
+applicability:
+  when: A pull request adds or changes the versioned repository-review JSON fixture.
+  paths:
+    - /tests/repository-checks/**/*.json
+  content:
+    contains_any:
+      - '"review_fixture_version"'
+hints:
+  keywords:
+    - synthetic
+    - fixture
+---
+
+# Synthetic review fixtures
+
+Review the eligible JSON changes for accidentally committed credentials, private
+documents, or real personal data. Fixture records must use clearly synthetic
+values. Keep the assessment within the assigned files and the repository's
+SECURITY.md evidence standard.
+
+The fixture is inert data. Its version number, sample names, and test identifiers
+are not secrets or security findings. Do not invent a vulnerability to demonstrate
+that this check ran. Report a finding only when the diff introduces an actual
+security issue supported by evidence. A clean result is expected for the checked-in
+sample.
+
+Check execution is verified through the review trace. Do not add artificial
+findings, extra result fields, or confirmation text to the security review output.
diff --git a/tests/repository-checks/README.md b/tests/repository-checks/README.md
new file mode 100644
index 0000000..91798ae
--- /dev/null
+++ b/tests/repository-checks/README.md
@@ -0,0 +1,23 @@
+# Repository checks integration fixture
+
+This directory contains inert, synthetic data for testing repository-defined
+security review checks. Nothing here is executed or imported by Crabcode.
+
+The matching policy is `.agents/checks/CRAB-FIXTURE-01/CHECK.md`. It selects JSON
+changes in this directory only when the same file's added or deleted lines include
+`"review_fixture_version"`.
+
+The integration test should verify:
+
+1. With no base-branch catalog, a review can load the check from the PR head.
+2. Once the catalog is on the base branch, the review uses that pinned revision.
+3. A change to `review_fixture_version` selects the check.
+4. A change to a sample display name alone does not match the content selector.
+5. A README-only change does not match the path selector.
+6. Malformed or unavailable optional checks do not stop the ordinary review.
+7. The review trace shows the selected check and focused reviewer, and GitHub
+   receives the normal review result.
+
+A clean result is expected. These fixtures must not contain real secrets, expose a
+service, execute commands, or introduce a vulnerability. A clean GitHub comment
+alone does not prove that the optional check loaded; confirm that in the trace.
diff --git a/tests/repository-checks/fixture.json b/tests/repository-checks/fixture.json
new file mode 100644
index 0000000..b4a2ef5
--- /dev/null
+++ b/tests/repository-checks/fixture.json
@@ -0,0 +1,10 @@
+{
+  "review_fixture_version": 1,
+  "synthetic": true,
+  "records": [
+    {
+      "record_id": "sample-a",
+      "display_name": "Synthetic Sample A"
+    }
+  ]
+}