The Canary Repository
An intentionally broken reference codebase for studio2201 tools. Validating security scanners through deterministic failure, negative testing, and fail-closed CI assertions.
01
Why Canary Exists: Negative Testing
Security tools are only as credible as their negative tests. Canary provides realistic, deliberately flawed fixtures to verify that all five studio2201 tools reliably detect flaws and halt deployment.
Deterministic Exit Code 1
Every tool in the suite exits with code 1 when a policy threshold or security invariant is breached, enabling robust pre-commit hooks and CI gate assertions.
Fail-Closed CI Verification
Canary's continuous integration testbed passes green only when all five tools trigger expected failure verdicts, ensuring security rules cannot silently regress into false negatives.
02
Single-Command Demonstration
Execute ./demo.sh to sequentially trigger all five failures, verify exit code 1 on each, and print a 76-column terminal scorecard.
# Clone and run the automated negative verification suite:
git clone https://github.com/studio2201/canary.git
cd canary
./demo.sh03
5-Tool Failure Breakdown
Side-by-side comparison of deliberate flaws, inspection commands, failure verdicts, exit codes, and required remediations across the studio2201 suite.
Snip vibe-code
Flaw: Live Stripe/Anthropic API keys in diff and SQL migration missing RLS.
CLI Command: snip audit fixtures/snip/staged.patch
Terminal Verdict: BLOCK (2 critical secrets, 1 high RLS omission)
Exit Code: 1 (finding threshold exceeded)
Remediation: Move keys to environment variables; add ENABLE ROW LEVEL SECURITY.
Vigil dormancy
Flaw: Manifest referencing packages dormant >450–570 days (colors, nom, request).
CLI Command: vigil policy check --max-dormancy 180 fixtures/vigil/package.json
Terminal Verdict: DORMANT (avg risk score 98.4 exceeds 45.0 threshold)
Exit Code: 1 (dormancy policy failed)
Remediation: Replace abandoned packages with actively maintained forks.
Aegis pqc sdk
Flaw: Classical 1024-bit RSA keygen and ECDSA call sites violating post-2030 policy.
CLI Command: aegis policy check fixtures/aegis/legacy_crypto.rs
Terminal Verdict: NON-COMPLIANT (10 legacy call sites exceed 0 cap)
Exit Code: 1 (cryptographic policy failed)
Remediation: Migrate to NIST FIPS 203/204 ML-KEM-768 and ML-DSA-65 algorithms.
Proven attestor
Flaw: Attested binary modified by 1 byte after attestation signing.
CLI Command: proven verify fixtures/proven/canary_artifact --attestation fixtures/proven/attestation.json
Terminal Verdict: TAMPERED (SHA-256 and Merkle root mismatch)
Exit Code: 1 (verification failed)
Remediation: Re-derive binary via bit-reproducible pipeline matching attested digest.
Boneyard tech-debt
Flaw: Repo catalog average Boneyard Index 72.0 > 50.0 cap with 2 critical repos.
CLI Command: boneyard policy check --policy fixtures/boneyard/policy.toml -i fixtures/boneyard/catalog.json
Terminal Verdict: DEBT BREACH (org index threshold exceeded)
Exit Code: 1 (governance policy failed)
Remediation: Pin unpinned dependencies, retire dead code, allocate debt sprints.
04
GitHub Actions Negative Testbed
Continuous negative verification in .github/workflows/canary.yml. Runs on push and pull requests targeting master to assert fail-closed behavior.
# CI installs tools via universal installer and validates failure verdicts:
curl -fsSL https://studio2201.com/install.sh | sh -s all
chmod +x ./demo.sh
./demo.sh # Asserts exit code 1 across snip, vigil, aegis, proven, boneyard