{
  "repository": "Hmbown/DeepSeek-TUI",
  "ref": "cbb7380f09989228b446a0958ea4620c78060a79",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "cargo-check",
      "method": "static_analysis",
      "commands": [
        "cargo check --workspace --locked",
        "cargo check --workspace --all-targets --all-features --locked",
        "cargo check --target aarch64-unknown-linux-ohos -p codewhale-tui -p codewhale-cli --locked",
        "cargo check --workspace --all-targets --locked"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.msrv.steps[4] (cargo +1.89 check)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test-windows-pr.steps[4] (Check every workspace target compiles on Windows)"
        },
        {
          "path": ".github/workflows/ohos.yml",
          "locator": "jobs.cargo-check.steps[3] (Check Codewhale TUI and CLI with the real SDK/sysroot)"
        },
        {
          "path": ".github/workflows/release-parity.yml",
          "locator": "jobs.parity.steps[8] (Compile check)"
        }
      ],
      "upstream": "https://github.com/rust-lang/cargo",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "clippy",
      "method": "static_analysis",
      "commands": [
        "cargo clippy --workspace --all-targets --all-features --locked -- -D warnings -A clippy::uninlined_format_args -A clippy::too_many_arguments -A clippy::unnecessary_map_or"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[8] (Run clippy)"
        },
        {
          "path": ".github/workflows/release-parity.yml",
          "locator": "jobs.parity.steps[10] (Clippy)"
        }
      ],
      "upstream": "https://github.com/rust-lang/rust-clippy",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "codeql",
      "method": "static_analysis",
      "commands": [
        "uses github/codeql-action/analyze"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/codeql.yml",
          "locator": "jobs.analyze.steps[2] (Perform CodeQL analysis)"
        }
      ],
      "upstream": "https://github.com/github/codeql",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "eslint",
      "method": "static_analysis",
      "commands": [
        "eslint ."
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-candidate.yml",
          "locator": "jobs.web.steps[4] (Check exact candidate web surface)"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.lint"
        },
        {
          "path": ".github/workflows/web.yml",
          "locator": "jobs.lint.steps[4] (Check web surface)"
        },
        {
          "path": "web/package.json",
          "locator": "devDependencies: eslint"
        },
        {
          "path": "web/eslint.config.mjs",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/eslint/eslint",
      "docs": "https://eslint.org/docs/latest/use/command-line-interface#exit-codes",
      "exit_codes": {
        "0": "no errors",
        "1": "linting errors found",
        "2": "configuration problem or internal error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "tsc",
      "method": "static_analysis",
      "commands": [
        "tsc --noEmit",
        "tsc -p tsconfig.json --noEmit"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-candidate.yml",
          "locator": "jobs.web.steps[4] (Check exact candidate web surface)"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check"
        },
        {
          "path": ".github/workflows/telemetry-ingest.yml",
          "locator": "jobs.check.steps[4] (TypeScript type check)"
        },
        {
          "path": "telemetry-ingest/package.json",
          "locator": "scripts.typecheck"
        },
        {
          "path": ".github/workflows/web.yml",
          "locator": "jobs.lint.steps[4] (Check web surface)"
        },
        {
          "path": "pet/package.json",
          "locator": "scripts.typecheck"
        },
        {
          "path": "pet/package.json",
          "locator": "scripts.check"
        },
        {
          "path": "pet/package.json",
          "locator": "devDependencies: typescript"
        },
        {
          "path": "telemetry-ingest/package.json",
          "locator": "devDependencies: typescript"
        },
        {
          "path": "web/package.json",
          "locator": "devDependencies: typescript"
        }
      ],
      "upstream": "https://github.com/microsoft/TypeScript",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "ci-matrix",
      "method": "testing",
      "commands": [
        "extension-host-runtimes (os: 3)",
        "analyze (include: 4)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.extension-host-runtimes.strategy.matrix"
        },
        {
          "path": ".github/workflows/codeql.yml",
          "locator": "jobs.analyze.strategy.matrix"
        }
      ],
      "upstream": "https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "node-test",
      "method": "testing",
      "commands": [
        "node --test .github/scripts/d8-executable.test.js",
        "node --test scripts/release/assemble-release-assets.test.js",
        "node --test scripts/release/ensure-release-assets-absent.test.js",
        "node --test scripts/release/verify-release-inventory.test.js",
        "node --test crates/app-server/tests/runtime_web_client.test.mjs"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[9] (Check release helper contracts)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[10] (Run runtime web client tests)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.integrations.steps[3] (Test reusable GitHub review action)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.extension-host-runtimes.steps[6] (Compile the same entry with the installed runtime and test it)"
        },
        {
          "path": ".github/workflows/release-artifacts.yml",
          "locator": "jobs.smoke.steps[4] (Test release inventory contracts)"
        },
        {
          "path": ".github/workflows/release-candidate.yml",
          "locator": "jobs.web.steps[3] (Run web tests)"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.test"
        },
        {
          "path": ".github/workflows/web.yml",
          "locator": "jobs.lint.steps[3] (Run tests)"
        },
        {
          "path": "pet/package.json",
          "locator": "scripts.test"
        },
        {
          "path": "pet/package.json",
          "locator": "scripts.check"
        }
      ],
      "upstream": "https://github.com/nodejs/node",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "unittest",
      "method": "testing",
      "commands": [
        "unittest scripts/catalog_models_dev_test.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[12] (Check the offline model seed is generated)"
        }
      ],
      "upstream": "https://github.com/python/cpython",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "vitest",
      "method": "testing",
      "commands": [
        "vitest run"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-candidate.yml",
          "locator": "jobs.web.steps[3] (Run web tests)"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.test"
        },
        {
          "path": ".github/workflows/telemetry-ingest.yml",
          "locator": "jobs.check.steps[3] (Run tests)"
        },
        {
          "path": "telemetry-ingest/package.json",
          "locator": "scripts.test"
        },
        {
          "path": ".github/workflows/web.yml",
          "locator": "jobs.lint.steps[3] (Run tests)"
        },
        {
          "path": "telemetry-ingest/package.json",
          "locator": "devDependencies: vitest"
        },
        {
          "path": "web/package.json",
          "locator": "devDependencies: vitest"
        },
        {
          "path": "telemetry-ingest/vitest.config.ts",
          "locator": "config file"
        },
        {
          "path": "web/vitest.config.ts",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/vitest-dev/vitest",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "rustfmt",
      "method": "formatting",
      "commands": [
        "cargo fmt --all -- --check"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[7] (Check formatting)"
        },
        {
          "path": ".github/workflows/release-parity.yml",
          "locator": "jobs.parity.steps[7] (Format check)"
        }
      ],
      "upstream": "https://github.com/rust-lang/rustfmt",
      "docs": null,
      "exit_codes": {},
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "cargo-audit",
      "method": "supply_chain",
      "commands": [
        "cargo audit"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/security-audit.yml",
          "locator": "jobs.self-audit.steps[3] (Run cargo audit)"
        }
      ],
      "upstream": "https://github.com/rustsec/rustsec",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "cargo-deny",
      "method": "supply_chain",
      "commands": [
        "uses EmbarkStudios/cargo-deny-action"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cargo-deny.yml",
          "locator": "jobs.deny.steps[1]"
        },
        {
          "path": "deny.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/EmbarkStudios/cargo-deny",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "npm-audit",
      "method": "supply_chain",
      "commands": [
        "npm audit --json > $EXPR/npm-audit.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/security-audit.yml",
          "locator": "jobs.npm-audit.steps[2] (Audit locked dependencies)"
        }
      ],
      "upstream": "https://github.com/npm/cli",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Add-Type -TypeDefinition @'"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/windows-arm64-export-probe.yml",
          "locator": "jobs.probe.steps[1] (Resolve every imported pair in a native ARM64 process)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "New-Item -ItemType Directory -Force probe"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/windows-arm64-export-probe.yml",
          "locator": "jobs.probe.steps[1] (Resolve every imported pair in a native ARM64 process)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash .github/scripts/agent-task-metadata.test.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[9] (Check release helper contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash .github/scripts/update-homebrew-tap.test.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[9] (Check release helper contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash packaging/aur/render.test.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[9] (Check release helper contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/check-readme-locales.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[26] (Check README locale link symmetry)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/preflight.sh --check"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/main-landing.yml",
          "locator": "jobs.preflight.steps[2] (Preflight)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/release/check-feature-release-notes.test.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[9] (Check release helper contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/release/generate-release-body.test.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[9] (Check release helper contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/release/install-dogfood.test.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[9] (Check release helper contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/release/prepare-release.test.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[9] (Check release helper contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/release/prune-actions-caches.test.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[9] (Check release helper contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/release/require-rc-receipt.test.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[9] (Check release helper contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/release/require-release-tag-checkout.test.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[9] (Check release helper contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/release/validate-crate-publish-order.test.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[9] (Check release helper contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/release/verify-remote-tag.test.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[9] (Check release helper contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cf workers types"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "web/package.json",
          "locator": "scripts.cf-typegen"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "done < $evidence/required-tests.txt"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[25] (Shared-process workspace qualification)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "log --format=%B -n1 $commit)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/dco.yml",
          "locator": "jobs.dco.steps[1] (Report missing Signed-off-by (dry-run advisory))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node .github/scripts/release-workflows.test.js"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[9] (Check release helper contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node marketplace/scripts/check-marketplace.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/marketplace-sync.yml",
          "locator": "jobs.catalog.steps[4] (Check catalog and real bundle manifests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node marketplace/scripts/check-marketplace.mjs --core core"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/marketplace-sync.yml",
          "locator": "jobs.catalog.steps[6] (Check current skill mirrors)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node repo/scripts/release/assemble-release-assets.js --verify artifacts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.release.steps[3] (Revalidate exact authoritative asset set)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node repo/scripts/release/verify-release-inventory.js --draft --asset-dir artifacts --publish ${GITHUB_REPOSITORY} ${TAG}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.release.steps[8] (Verify the draft's exact asset set, then publish it at once)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/audit-dependencies.mjs"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "web/package.json",
          "locator": "scripts.audit:dependencies"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/build-pet.mjs --check"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "pet/package.json",
          "locator": "scripts.check"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-cloud-facts.mjs"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-candidate.yml",
          "locator": "jobs.web.steps[4] (Check exact candidate web surface)"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check:facts"
        },
        {
          "path": ".github/workflows/web.yml",
          "locator": "jobs.lint.steps[4] (Check web surface)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-cloudflare-deploy-env.mjs"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/web.yml",
          "locator": "jobs.deploy.steps[4] (Check Cloudflare deploy environment)"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check:deploy-env"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-docs.mjs"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-candidate.yml",
          "locator": "jobs.web.steps[4] (Check exact candidate web surface)"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check:docs"
        },
        {
          "path": ".github/workflows/web.yml",
          "locator": "jobs.lint.steps[4] (Check web surface)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-facts.mjs"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-candidate.yml",
          "locator": "jobs.web.steps[4] (Check exact candidate web surface)"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check:facts"
        },
        {
          "path": ".github/workflows/web.yml",
          "locator": "jobs.lint.steps[4] (Check web surface)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-kv-id.mjs"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "web/package.json",
          "locator": "scripts.predeploy"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-locales.mjs"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "web/package.json",
          "locator": "scripts.check:locales"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/compare-deployed-facts.mjs --require-current"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/web.yml",
          "locator": "jobs.deploy.steps[6] (Verify exact deployed revision)"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check:deployed-facts"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/derive-install.mjs"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-candidate.yml",
          "locator": "jobs.web.steps[4] (Check exact candidate web surface)"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check:docs"
        },
        {
          "path": ".github/workflows/web.yml",
          "locator": "jobs.lint.steps[4] (Check web surface)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/gt-site.mjs check"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "web/package.json",
          "locator": "scripts.check:locales"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/release/assemble-release-assets.js --verify release-assets"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-artifacts.yml",
          "locator": "jobs.assemble.steps[4] (Sign the checksum manifest when the release key is configured)"
        },
        {
          "path": ".github/workflows/release-artifacts.yml",
          "locator": "jobs.smoke.steps[3] (Verify 34-asset bridge inventory and checksum manifests (single binary))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/release/fetch-compiled-host-proof.js --repo ${GITHUB_REPOSITORY} --run-id ${QUALIFICATION_RUN} --source-sha ${GITHUB_SHA} --target ${TARGET_PLATFORM} --output ${proof_dir}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-artifacts.yml",
          "locator": "jobs.build.steps[18] (Stage exact qualified optional host image)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/release/verify-release-inventory.js --manifest ${GITHUB_REPOSITORY} ${TAG}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-republish.yml",
          "locator": "jobs.resolve.steps[2] (Require a complete published release)"
        },
        {
          "path": ".github/workflows/sync-cnb.yml",
          "locator": "jobs.sync.steps[1] (Push triggering ref to CNB)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/render-terminal-capture.mjs --check"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-candidate.yml",
          "locator": "jobs.web.steps[4] (Check exact candidate web surface)"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check:docs"
        },
        {
          "path": ".github/workflows/web.yml",
          "locator": "jobs.lint.steps[4] (Check web surface)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/sync-latest-release.mjs"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "web/package.json",
          "locator": "scripts.sync:latest-release"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/sync-latest-release.mjs --check"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-candidate.yml",
          "locator": "jobs.web.steps[4] (Check exact candidate web surface)"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check:latest-release"
        },
        {
          "path": ".github/workflows/web.yml",
          "locator": "jobs.lint.steps[4] (Check web surface)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node web/scripts/check-cloud-facts.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.sync-release-record.steps[3] (Prove the record passes the web fact gates)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node web/scripts/check-facts.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.sync-release-record.steps[3] (Prove the record passes the web fact gates)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node web/scripts/check-locales.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[29] (Check website locale dictionary parity)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node web/scripts/sync-latest-release.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.sync-release-record.steps[2] (Refresh the release record from the published release)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node web/scripts/sync-latest-release.mjs --check"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.sync-release-record.steps[3] (Prove the record passes the web fact gates)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "preserving required Lint context.\""
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[30] (Skip Rust lint for light change)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "preserving required Test context.\""
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[0] (Skip tests for light change)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test-windows-pr.steps[0] (Skip Windows check for light change)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python -B scripts/check-command-core-navigation-proof.py --graph $graph"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[10] (Check core navigation source and normal dependency boundary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python -B scripts/test_check_command_config_proof.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[14] (Check portable config policy boundary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python -B scripts/test_check_command_core_navigation_proof.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[10] (Check core navigation source and normal dependency boundary)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[15] (Check portable core navigation boundary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python -B scripts/test_convert_plugin.py -v"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.plugin-conversion.steps[4] (Check offline plugin conversion)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python ../scripts/export-design-tokens.py --check"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-candidate.yml",
          "locator": "jobs.web.steps[4] (Check exact candidate web surface)"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check:tokens"
        },
        {
          "path": ".github/workflows/web.yml",
          "locator": "jobs.lint.steps[4] (Check web surface)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python pet/scripts/check-shared.py target/debug/codewhale"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pet.yml",
          "locator": "jobs.recorder.steps[6] (Build the standalone shared owner and verify its transport)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check-bundled-plugin-claims.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[7] (Check bundled plugin claims)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check-command-crate-boundaries.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[13] (Check command-contract prototype boundary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check-command-crate-boundaries.py --baseline-ref ${baseline}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[13] (Check command-contract prototype boundary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check-command-migration-manifest.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[14] (Check command migration manifest)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check-command-migration-manifest.py --baseline-ref ${baseline}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[14] (Check command migration manifest)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check-config-example.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[11] (Check provider registry drift)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check-contributor-credit.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[5] (Check contributor credit)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check-persistence-backlog-budget.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[30] (Check persistence-backlog RSS budget)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.macos-budget.steps[4] (Check persistence-backlog RSS budget)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check-provider-registry.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[11] (Check provider registry drift)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check-readme-translations.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[25] (Check README translations stay in sync)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check-reqwest-builders.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[15] (Check reqwest client constructors)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check-tui-locale-parity.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[27] (Check TUI locale pack parity)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/release/check-windows-imports.py --expected-machine $EXPR --output $EXPR/windows-imports-$EXPR @binaries"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-artifacts.yml",
          "locator": "jobs.build.steps[19] (Check every staged Windows executable import)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/release/check-windows-imports.py --output $evidenceDirectory @binaries"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-artifacts.yml",
          "locator": "jobs.windows-installer.steps[4] (Check Windows installer and embedded executables)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/release/publish-crates.test.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[9] (Check release helper contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/tencent-lighthouse/test_bootstrap_ssh.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.integrations.steps[1] (Check Lighthouse SSH policy)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/test_check_blocking_calls_budget.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[16] (Test dead-code and blocking-calls budget scripts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/test_check_command_crate_boundaries.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[13] (Check command-contract prototype boundary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/test_check_command_migration_manifest.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[14] (Check command migration manifest)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/test_check_dead_code_budget.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[16] (Test dead-code and blocking-calls budget scripts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/test_check_persistence_backlog_budget.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[23] (Test persistence-backlog measurement and checker harnesses)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/test_check_reqwest_builders.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[15] (Check reqwest client constructors)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/test_check_runtime_contract_budget.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[20] (Test runtime-contract measurement harness)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/test_measure_persistence_backlog.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[23] (Test persistence-backlog measurement and checker harnesses)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/test_measure_runtime_contract.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[20] (Test runtime-contract measurement harness)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sh scripts/check-portable-config.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[14] (Check portable config policy boundary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sh scripts/check-portable-core-navigation.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[15] (Check portable core navigation boundary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sh scripts/check-tui-product-vocabulary.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint.steps[28] (Check TUI product vocabulary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sh scripts/dev-cache.test.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[9] (Check release helper contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sh scripts/prepare-linux-test-sandbox.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.safety-gate.steps[4] (Install Linux system dependencies)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[10] (Install Linux system dependencies)"
        },
        {
          "path": ".github/workflows/release-parity.yml",
          "locator": "jobs.parity.steps[4] (Install Linux system dependencies)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sh scripts/with-hermetic-test-home.sh cargo nextest run --workspace --all-features --locked --profile ci"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[23] (Run tests)"
        },
        {
          "path": ".github/workflows/release-parity.yml",
          "locator": "jobs.parity.steps[13] (Workspace tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sh scripts/with-hermetic-test-home.sh cargo nextest run -p codewhale-engine -p codewhale-tui -p codewhale-runtime --lib --locked --no-tests=fail -E 'test(auto_review)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.safety-gate.steps[9] (Hermetic safety and authorization tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sh scripts/with-hermetic-test-home.sh cargo test --workspace --all-features --locked -- --format=pretty 2>&1"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[25] (Shared-process workspace qualification)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sh scripts/with-hermetic-test-home.sh cargo test --workspace --all-features --locked --doc"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[29] (Run doctests)"
        },
        {
          "path": ".github/workflows/release-parity.yml",
          "locator": "jobs.parity.steps[14] (Workspace doctests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sh scripts/with-hermetic-test-home.sh cargo test -p codewhale-execpolicy --locked"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.safety-gate.steps[9] (Hermetic safety and authorization tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sh scripts/with-hermetic-test-home.sh cargo test -p codewhale-protocol --test parity_protocol --locked"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-parity.yml",
          "locator": "jobs.parity.steps[15] (Protocol schema parity)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sh scripts/with-hermetic-test-home.sh cargo test -p codewhale-state --test parity_state --locked"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-parity.yml",
          "locator": "jobs.parity.steps[16] (State persistence parity)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sh scripts/with-hermetic-test-home.sh cargo test -p codewhale-workflow --locked"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.workflow-rlm-cache.steps[5] (Run workflow crate tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sh scripts/with-hermetic-test-home.test.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.versions.steps[9] (Check release helper contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "unset RUST_TEST_THREADS"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[25] (Shared-process workspace qualification)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "wrangler deploy --dry-run --outdir=.wrangler/dry-run"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/telemetry-ingest.yml",
          "locator": "jobs.check.steps[5] (Bundle check)"
        },
        {
          "path": "telemetry-ingest/package.json",
          "locator": "scripts.check"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}