{
  "repository": "awslabs/aidlc-workflows",
  "ref": "4d9d226e1c6fe903cfbb15a8b7caa82971bc72cf",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "biome",
      "method": "static_analysis",
      "commands": [
        "biome check --error-on-warnings core harness scripts plugins tests"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.gate.steps[3]"
        },
        {
          "path": "package.json",
          "locator": "scripts.check"
        },
        {
          "path": "package.json",
          "locator": "scripts.lint"
        },
        {
          "path": "package.json",
          "locator": "devDependencies: @biomejs/biome"
        },
        {
          "path": "biome.json",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/biomejs/biome",
      "docs": null,
      "exit_codes": {},
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "gitleaks",
      "method": "static_analysis",
      "commands": [
        "gitleaks version",
        "gitleaks git --config=.gitleaks.toml --baseline-path=.gitleaks-baseline.json --log-opts=$SCAN_REF --report-format=sarif --report-path=gitleaks.sarif ."
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/security-scanners.yml",
          "locator": "jobs.gitleaks.steps[1] (Install Gitleaks)"
        },
        {
          "path": ".github/workflows/security-scanners.yml",
          "locator": "jobs.gitleaks.steps[2] (Scan repository history)"
        },
        {
          "path": ".gitleaks.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/gitleaks/gitleaks",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "semgrep",
      "method": "static_analysis",
      "commands": [
        "semgrep scan --oss-only --metrics=off --config=p/typescript --severity=ERROR --error --sarif --output=semgrep.sarif core harness scripts plugins"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/security-scanners.yml",
          "locator": "jobs.semgrep.steps[3] (Scan authored TypeScript)"
        }
      ],
      "upstream": "https://github.com/semgrep/semgrep",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "shellcheck",
      "method": "static_analysis",
      "commands": [
        "shellcheck scripts/install.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.gate.steps[4] (ShellCheck installer)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.verify.steps[5] (ShellCheck installer)"
        }
      ],
      "upstream": "https://github.com/koalaman/shellcheck",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "tsc",
      "method": "static_analysis",
      "commands": [
        "tsc --noEmit -p tsconfig.json",
        "tsc --noEmit -p tsconfig.tests.json",
        "tsc --noEmit -p tsconfig.adapters.json"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.gate.steps[3]"
        },
        {
          "path": "package.json",
          "locator": "scripts.check"
        },
        {
          "path": "package.json",
          "locator": "scripts.typecheck"
        },
        {
          "path": "package.json",
          "locator": "devDependencies: typescript"
        }
      ],
      "upstream": "https://github.com/microsoft/TypeScript",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "eslint",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "package.json",
          "locator": "devDependencies: eslint"
        },
        {
          "path": "tests/fixtures/v05-mr9-sensor-fire/failing-linter/eslint.config.js",
          "locator": "config file"
        },
        {
          "path": "tests/fixtures/v05-mr9-sensor-fire/passing-typescript/eslint.config.js",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/eslint/eslint",
      "docs": "https://eslint.org/docs/latest/use/command-line-interface#exit-codes",
      "exit_codes": {
        "0": "no errors",
        "1": "linting errors found",
        "2": "configuration problem or internal error"
      },
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Add-Content -LiteralPath $env:AIDLC_TEST_GH_MARKER `"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.windows-lifecycle.steps[1] (Install, route through stable shim, and uninstall)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.windows-lifecycle.steps[1] (Install, route through stable shim, and uninstall)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Add-Type -AssemblyName System.IO.Compression.FileSystem"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/deterministic-tests.yml",
          "locator": "jobs.test.steps[8] (Prepare Windows native sandbox probe)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "CHECK_WORK_DEADLINE - $(date +%s) ))"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.check.steps[11] (Exercise recovery with production guards)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Format-Table -AutoSize"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.native-smoke.steps[6] (PSScriptAnalyzer installer)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.native-smoke.steps[5] (PSScriptAnalyzer installer)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Start-Sleep -Milliseconds 100"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.windows-lifecycle.steps[1] (Install, route through stable shim, and uninstall)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.windows-lifecycle.steps[1] (Install, route through stable shim, and uninstall)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Write-Output git: $((Get-Command git -CommandType Application).Source)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_hooks_without_git_bash.steps[4] (Prove sh is unresolvable, then run hook contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "ai-pr-review test -r $destination"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ai-pr-review.yml",
          "locator": "jobs.review.steps[8] (Run review passes sequentially)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "aws_secret_access_key"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ai-issue-review.yml",
          "locator": "jobs.review.steps[10] (Run issue-review passes sequentially)"
        },
        {
          "path": ".github/workflows/ai-pr-review.yml",
          "locator": "jobs.review.steps[8] (Run review passes sequentially)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash .github/scripts/prepare-live-runtime.sh prove"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_live_isolation.steps[5] (Prove POSIX isolation)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash .github/scripts/prepare-live-runtime.sh prove $EXPR"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/full-suite.yml",
          "locator": "jobs.live_linux.steps[12] (Prove isolation)"
        },
        {
          "path": ".github/workflows/full-suite.yml",
          "locator": "jobs.live_macos.steps[12] (Prove isolation)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/ci-check-budget.sh bun install --frozen-lockfile"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.check.steps[3] (Install dependencies)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/ci-check-budget.sh bun run check"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.check.steps[4] (Run contract checks)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/ci-check-budget.sh bun scripts/ci-changelog-guard.ts $CHANGELOG_BASE"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.check.steps[8] (Guard against deleted CHANGELOG entries)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/ci-check-budget.sh bun scripts/package.ts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.check.steps[6] (Prepare test and coverage projections)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/ci-check-budget.sh bun tests/gen-coverage-registry.ts --check --base HEAD^1"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.check.steps[7] (Fail if a unit lost coverage against the first parent)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/ci-check-budget.sh shellcheck scripts/install.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.check.steps[5] (ShellCheck installer)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash tests/run-tests.sh --debug -P 8 --no-llm ${args[@]} --file-timeout 7200 --run-timeout $run_budget > $capture/run.log 2>&1"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.check.steps[9] (Run Linux smoke)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash tests/run-tests.sh --debug -P 8 --no-llm ${args[@]} > $capture/run.log 2>&1 &"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/deterministic-tests.yml",
          "locator": "jobs.test.steps[9] (Run deterministic tier)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash tests/run-tests.sh --debug -P 8 --production-guards --unit --integration --no-llm --file-timeout 7200 --run-timeout \"$run_budget\" --filter '^(t-runner-production-guards"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.check.steps[11] (Exercise recovery with production guards)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash tests/run-tests.sh --debug -P 8 --production-guards --unit --integration --no-llm --file-timeout 7200 --run-timeout 14400 --require-coverage --filter '^(t-runner-production-guards"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/full-suite.yml",
          "locator": "jobs.production_guards.steps[4] (Require production guard coverage)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash tests/run-tests.sh --debug -P 8 --unit --integration --e2e --no-llm --isolated-e2e --file-timeout 7200 --run-timeout 14400 --filter $TEST_MATRIX_FILTER --matrix-plan $RUNNER_TEMP/native-plan.json --matrix-job $EXPR > $capture/run.log 2>&1 &"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/full-suite.yml",
          "locator": "jobs.native_terminal.steps[6] (Run exact native obligations)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash tests/run-tests.sh --debug -P 8 --unit --no-llm --file-timeout 7200 --run-timeout 14400 --filter $TEST_FILTER > $capture/run.log 2>&1 &"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_native_terminal.steps[4] (Run native terminal contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun audit --json > bun-audit.json 2> bun-audit.stderr"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/security-scanners.yml",
          "locator": "jobs.bun-audit.steps[2] (Audit locked dependencies)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun release-tools/scripts/verify-release.ts candidate --directory build/release --tag $RELEASE_TAG --source-digest $AUTHORIZED_SHA"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.publish.steps[9] (Validate complete attested release candidate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun scripts/ci-preview-test-report.ts $RUNNER_TEMP/full-suite-evidence $RUNNER_TEMP/full-suite-jobs.json $report"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.test.steps[5] (Report Full Suite results)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun scripts/ci-preview-test-report.ts --stage-notes $plan $RUNNER_TEMP/preview-test-report/preview-test-report.md"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.release.steps[5] (Stage preview notes)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun scripts/ci-sanitize-logs.ts tests/logs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.check.steps[12] (Sanitize check evidence)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_native_terminal.steps[5] (Sanitize native terminal evidence)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_hooks_without_git_bash.steps[5] (Sanitize hook evidence)"
        },
        {
          "path": ".github/workflows/deterministic-tests.yml",
          "locator": "jobs.test.steps[12] (Sanitize deterministic evidence)"
        },
        {
          "path": ".github/workflows/full-suite.yml",
          "locator": "jobs.native_terminal.steps[7] (Sanitize diagnostic logs)"
        },
        {
          "path": ".github/workflows/full-suite.yml",
          "locator": "jobs.production_guards.steps[5] (Sanitize production guard evidence)"
        },
        {
          "path": ".github/workflows/full-suite.yml",
          "locator": "jobs.live_linux.steps[21] (Sanitize diagnostic logs)"
        },
        {
          "path": ".github/workflows/full-suite.yml",
          "locator": "jobs.live_macos.steps[21] (Sanitize diagnostic logs)"
        },
        {
          "path": ".github/workflows/full-suite.yml",
          "locator": "jobs.live_windows.steps[20] (Sanitize diagnostic logs)"
        },
        {
          "path": ".github/workflows/full-suite.yml",
          "locator": "jobs.release_contract_windows.steps[5] (Sanitize diagnostic logs)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun scripts/ci-test-weights.ts report $TEST_TIER tmp/ci-deterministic/stamp.txt"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/deterministic-tests.yml",
          "locator": "jobs.test.steps[10] (Report outdated test weights)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun scripts/docs-rewrite-links.ts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docs.yml",
          "locator": "jobs.build.steps[5] (Rewrite out-of-tree links to GitHub URLs)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun scripts/package.ts"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.gate.steps[3]"
        },
        {
          "path": "package.json",
          "locator": "scripts.check"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun scripts/package.ts --check"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.gate.steps[3]"
        },
        {
          "path": "package.json",
          "locator": "scripts.check"
        },
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.build.steps[4]"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.verify.steps[4]"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.build.steps[4]"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun scripts/release-promotion.ts verify --tag $RELEASE_TAG --repository $GITHUB_REPOSITORY"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.validate.steps[2] (Validate release tag and source)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.publish.steps[2] (Recheck release source)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.release.steps[3] (Recheck release source)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun scripts/verify-release.ts candidate --directory build/release --tag $RELEASE_TAG --source-digest $AUTHORIZED_SHA"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.publish.steps[8] (Validate complete attested release candidate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun test tests/unit/t238-build-binaries.test.ts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.native-smoke.steps[4]"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.native-smoke.steps[4]"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun test tests/unit/t244-install-management.test.ts -t t244 Windows and completion release surfaces"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.native-smoke.steps[5]"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun tests/reconcile-tests.ts prepare --profile tests/native-terminal-profile.json --cohort nightly-$EXPR-$EXPR --repo . --output $RUNNER_TEMP/native-plan.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/full-suite.yml",
          "locator": "jobs.plan.steps[5] (Prepare native obligations)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun tests/run-tests.ts --debug -P 4 --smoke --no-llm --file-timeout 7200 --run-timeout 14400 --filter ^(?!(smoke-)?t05-run-tests-parallel) > $capture/smoke.log 2>&1"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_wsl_smoke.steps[4] (Run the smoke tier, hook units and a compiled binary inside WSL)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun tests/run-tests.ts --debug -P 4 --unit --no-llm --file-timeout 7200 --run-timeout 14400 --filter '^(t07-hook-audit-logger"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_wsl_smoke.steps[4] (Run the smoke tier, hook units and a compiled binary inside WSL)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "canonical_pr > /tmp/latest-pr.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ai-pr-review.yml",
          "locator": "jobs.review.steps[9] (Publish SHA-bound review)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "case $TEST_TIER in"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/deterministic-tests.yml",
          "locator": "jobs.test.steps[9] (Run deterministic tier)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "case $TEST_TIER:$UNIT_SHARD in"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/deterministic-tests.yml",
          "locator": "jobs.test.steps[0] (Validate test selection)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "elif [ $test_status -eq 124 ]"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ai-issue-review.yml",
          "locator": "jobs.review.steps[10] (Run issue-review passes sequentially)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "mapfile -t bug_test_files < <("
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ai-issue-review.yml",
          "locator": "jobs.review.steps[10] (Run issue-review passes sequentially)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "return `${parts[1]}-${parts.at(-1).replace(/.test.ts$/, )}`"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/full-suite.yml",
          "locator": "jobs.native_terminal.steps[6] (Run exact native obligations)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "run_model sol Security review medium 50000 .ai-review-lenses/security.json $security_prompt $lens_schema"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ai-pr-review.yml",
          "locator": "jobs.review.steps[8] (Run review passes sequentially)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sha256sum --check -"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/security-scanners.yml",
          "locator": "jobs.gitleaks.steps[1] (Install Gitleaks)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sha256sum -c checksums.txt"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.stage-release.steps[6] (Re-verify staged release checksums)"
        },
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.publish.steps[5] (Re-verify staged release checksums)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.stage-release.steps[6] (Re-verify staged release checksums)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.publish.steps[5] (Re-verify staged release checksums)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sha256sum -c checksums.txt)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.unix-lifecycle.steps[1] (Consume the checksummed release candidate)"
        },
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.release.steps[4] (Recheck preview source)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.unix-lifecycle.steps[1] (Consume the checksummed release candidate)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.release.steps[3] (Recheck release source)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "the test report omits them\""
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.test.steps[4] (List Full Suite jobs)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "throw checksum mismatch: $($Matches[2])"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.windows-lifecycle.steps[1] (Install, route through stable shim, and uninstall)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.windows-lifecycle.steps[1] (Install, route through stable shim, and uninstall)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "throw checksummed asset is missing: $($Matches[2])"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.windows-lifecycle.steps[1] (Install, route through stable shim, and uninstall)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.windows-lifecycle.steps[1] (Install, route through stable shim, and uninstall)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "throw installer did not report its checksum-only path"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_windows_install_ps51.steps[4] (Install with the documented one-liner under Windows PowerShell 5.1)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "throw malformed checksum row: $_"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.windows-lifecycle.steps[1] (Install, route through stable shim, and uninstall)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.windows-lifecycle.steps[1] (Install, route through stable shim, and uninstall)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "throw offline installer did not verify release provenance"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/preview-release.yml",
          "locator": "jobs.windows-lifecycle.steps[1] (Install, route through stable shim, and uninstall)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.windows-lifecycle.steps[1] (Install, route through stable shim, and uninstall)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "type == \"array\"' semgrep.sarif > /dev/null"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/security-scanners.yml",
          "locator": "jobs.semgrep.steps[3] (Scan authored TypeScript)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "type == \"array\")' bun-audit.json > /dev/null"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/security-scanners.yml",
          "locator": "jobs.bun-audit.steps[2] (Audit locked dependencies)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "wait $test_pid"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_native_terminal.steps[4] (Run native terminal contracts)"
        },
        {
          "path": ".github/workflows/deterministic-tests.yml",
          "locator": "jobs.test.steps[9] (Run deterministic tier)"
        },
        {
          "path": ".github/workflows/full-suite.yml",
          "locator": "jobs.native_terminal.steps[6] (Run exact native obligations)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}