{
  "expectations": [
    {
      "text": "wiki.config.yaml has language: javascript (or nodejs) inferred from package.json",
      "passed": true,
      "evidence": "wiki.config.yaml ecosystem.language=javascript. package.json present with 'main':'src/index.js' and dependencies — basis for the Node detection."
    },
    {
      "text": "framework: express is set when express is in package.json dependencies; alternatively, framework: null (or absent) is acceptable ONLY if a detection-trace entry explicitly notes 'express detected but not configured as framework' — silent omission is a failure",
      "passed": true,
      "evidence": "wiki.config.yaml ecosystem.framework=express, framework_version=4.18.0. detection_trace[0]='package.json: dependencies.express ^4.18.0'."
    },
    {
      "text": "ecosystem.database.driver: postgresql is set; host: db.local, port: 5432, database: appdb parsed from the connection string in src/db.js",
      "passed": true,
      "evidence": "ecosystem.database.driver=postgresql; environments.dev: host=db.local, port=5432, database=appdb. src/db.js connection string: postgres://wikiuser@db.local:5432/appdb (parsed and redacted)."
    },
    {
      "text": "Credentials are referenced by secret name (user_secret: WIKI_DB_DEV_USER or similar) — no plaintext password OR username appears in wiki.config.yaml",
      "passed": true,
      "evidence": "user_secret=WIKI_DB_DEV_USER, password_secret=WIKI_DB_DEV_PASSWORD. grep wikiuser wiki.config.yaml: no match. The detection_trace entry redacted the username placeholder ('postgres://<user>@db.local:5432/appdb')."
    },
    {
      "text": "ecosystem.orm.profiles is either an empty list [] OR contains exactly ['raw_sql'] — none of the shipped ORM profile names (jpa, sqlalchemy, django, prisma, typeorm, activerecord, entity_framework) appear, since the fixture has no ORM library",
      "passed": true,
      "evidence": "ecosystem.orm.profiles=[raw_sql] (single element). orm_detect.js --profile auto returned orm_detected=null, entities=[]; the config falls back to raw_sql per the prompt's spec. No shipped ORM names appear."
    },
    {
      "text": "Policy stanza (block_ddl, block_privilege, dml_mode, audit.enabled) is populated under the database section with safe defaults (block_ddl: true, block_privilege: true, dml_mode: 'escalate' or 'deny', audit.enabled: true)",
      "passed": true,
      "evidence": "ecosystem.database.policy: block_ddl=true, block_privilege=true, dml_mode=escalate, escalate_unbounded_reads=true. ecosystem.database.audit.enabled=true."
    },
    {
      "text": "Wiki scaffold (wiki/, raw/, graph/, audit/, log/, outputs/) exists at the configured wiki_root after onboard completes (auto-init triggered)",
      "passed": true,
      "evidence": "ls work/ shows wiki, raw, graph, audit, log, outputs (all 6 dirs). init_wiki.js was invoked first and created the scaffold."
    },
    {
      "text": "events.jsonl contains one op='init' event AND one op='onboard' event (or equivalent), each with ISO timestamps",
      "passed": true,
      "evidence": "events.jsonl has 2 lines: line1 op=init at 2026-05-03T18:47:50.780000+00:00; line2 op=onboard at 2026-05-03T18:48:30.097000+00:00."
    }
  ],
  "summary": {"passed": 8, "failed": 0, "total": 8, "pass_rate": 1.0},
  "eval_feedback": {"overall": "All 8 expectations satisfied. JavaScript + Express + PostgreSQL detected; pg connection string parsed for host/port/db; orm_detect returned no ORM and config falls back to raw_sql; credentials referenced by secret name with no plaintext leakage; init+onboard events logged."}
}