# AI Analysis Workflow

## Objective

Use a large language model to generate testable hypotheses about observable program behavior. The model's answer is not accepted as evidence.

## Prompt 1 — Build hypotheses from observations

> You are assisting with authorized, benign software behavior analysis. Based only on the evidence below, list plausible behavioral rules. Separate direct observations from hypotheses and unknowns. For each hypothesis, provide a confidence level and one minimal test that could disprove it. Do not infer source code or claim access to internals.
>
> Evidence: Running the utility on a directory produced JSON containing relative paths, byte sizes, and 64-character hexadecimal digests. A nested file appeared. A hidden fixture and a `.tmp` fixture did not appear. The utility returned code 2 with a usage message when no argument was supplied, and code 1 for a nonexistent path.

## Prompt 2 — Design a discriminating experiment

> For the hypothesis that hidden path components are excluded, propose the smallest safe test matrix that distinguishes (a) only hidden files excluded, (b) any path with a hidden component excluded, and (c) hidden directories traversed but their files omitted. State the expected observation for each competing explanation. Use a temporary directory and do not modify real user data.

## Prompt 3 — Challenge the hash interpretation

> The digest changed when the bytes of a file changed while its path remained the same. What can and cannot be concluded? Suggest tests to distinguish content hashing from path hashing or metadata hashing. Do not claim the algorithm is SHA-256 solely because the digest has 64 hexadecimal characters; propose how to verify the algorithm against a known test vector or independent implementation.

## Analyst guardrails

- Ask for competing explanations, not a single confident narrative.
- Avoid uploading proprietary binaries, credentials, personal data, or sensitive logs.
- Treat model confidence as a prioritization hint, never a measurement.
- Preserve exact commands, input fixtures, stdout/stderr, and exit codes.
- If an AI-generated hypothesis is not tested, label it **unverified**.
- Keep the scope authorized and non-destructive.

## Example claim ledger

| Claim | Status | Verification method |
|---|---|---|
| Output is JSON for valid directory input | Verified | Parse stdout with Python `json.loads` |
| Nested files are included | Verified for the supplied fixture | Inspect observed paths and run unit test |
| Hidden path components are excluded | Verified for the supplied hidden-file fixture; broader edge cases remain untested | Probe `.private.txt`; add a hidden-directory test before generalizing |
| Digest is SHA-256 of file bytes | Verified by code review and can be independently checked against `hashlib.sha256` | Compare output to local `hashlib.sha256(file.read_bytes()).hexdigest()` |
| Behavior is identical on every OS | Unknown | Test supported OS and filesystem combinations |