{
  "repository": "langfuse/langfuse",
  "ref": "d48c2425d925512c0eec2383a46f06e9b177784b",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "cargo-check",
      "method": "static_analysis",
      "commands": [
        "cargo check --locked --all-targets"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "ai-gateway/package.json",
          "locator": "scripts.typecheck"
        },
        {
          "path": "ai-gateway/package.json",
          "locator": "scripts.rust:typecheck"
        }
      ],
      "upstream": "https://github.com/rust-lang/cargo",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "clippy",
      "method": "static_analysis",
      "commands": [
        "cargo clippy --locked --all-targets -- -D warnings"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.tests-ai-gateway.steps[3] (Lint Rust targets)"
        },
        {
          "path": "ai-gateway/package.json",
          "locator": "scripts.lint"
        },
        {
          "path": "ai-gateway/package.json",
          "locator": "scripts.rust:lint"
        },
        {
          "path": "ai-gateway/clippy.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/rust-lang/rust-clippy",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "codeql",
      "method": "static_analysis",
      "commands": [
        "uses github/codeql-action/analyze"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/codeql.yml",
          "locator": "jobs.analyze.steps[3] (Perform CodeQL Analysis)"
        }
      ],
      "upstream": "https://github.com/github/codeql",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "semgrep",
      "method": "static_analysis",
      "commands": [
        "semgrep scan --config p/default --baseline-commit $BASELINE_COMMIT --error"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/semgrep.yml",
          "locator": "jobs.semgrep.steps[1] (Run Semgrep)"
        }
      ],
      "upstream": "https://github.com/semgrep/semgrep",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "tsc",
      "method": "static_analysis",
      "commands": [
        "tsc",
        "tsc --watch"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "ee/package.json",
          "locator": "scripts.build"
        },
        {
          "path": "ee/package.json",
          "locator": "scripts.dev"
        },
        {
          "path": "worker/package.json",
          "locator": "scripts.build"
        },
        {
          "path": "worker/package.json",
          "locator": "scripts.build:test"
        },
        {
          "path": "ee/package.json",
          "locator": "devDependencies: typescript"
        },
        {
          "path": "web/package.json",
          "locator": "devDependencies: typescript"
        },
        {
          "path": "worker/package.json",
          "locator": "devDependencies: typescript"
        }
      ],
      "upstream": "https://github.com/microsoft/TypeScript",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "zizmor",
      "method": "static_analysis",
      "commands": [
        "uses zizmorcore/zizmor-action"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/zizmor.yml",
          "locator": "jobs.zizmor.steps[1] (Run zizmor)"
        }
      ],
      "upstream": "https://github.com/zizmorcore/zizmor",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "cargo-test",
      "method": "testing",
      "commands": [
        "cargo test --locked"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "ai-gateway/package.json",
          "locator": "scripts.test"
        },
        {
          "path": "ai-gateway/package.json",
          "locator": "scripts.rust:test"
        }
      ],
      "upstream": "https://github.com/rust-lang/cargo",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "ci-matrix",
      "method": "testing",
      "commands": [
        "analyze (include: 1)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/codeql.yml",
          "locator": "jobs.analyze.strategy.matrix"
        }
      ],
      "upstream": "https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "fast-check",
      "method": "testing",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "worker/package.json",
          "locator": "devDependencies: fast-check"
        }
      ],
      "upstream": "https://github.com/dubzzz/fast-check",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "node-test",
      "method": "testing",
      "commands": [
        "node --test scripts/model-price-audit/*.test.mjs",
        "node --test scripts/agents/sync-agent-shims.test.mjs",
        "node --test scripts/github/label-cursor-prs.test.mjs",
        "node --test scripts/vitest/ci-reporter.test.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/model-price-audit.yml",
          "locator": "jobs.audit.steps[2] (Test audit guardrails)"
        },
        {
          "path": ".github/workflows/model-price-audit.yml",
          "locator": "jobs.audit.steps[7] (Re-test audit guardrails after agent edits)"
        },
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.lint.steps[9] (agent setup tests)"
        },
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.lint.steps[10] (cursor PR label tests)"
        },
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.lint.steps[12] (vitest CI reporter tests)"
        }
      ],
      "upstream": "https://github.com/nodejs/node",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "vitest",
      "method": "testing",
      "commands": [
        "vitest run --project client",
        "vitest run --project server --project server-isolated --project server-shared-source --project server-unit --project server-shared-source-unit --project in-source",
        "vitest run --project in-source",
        "vitest --project client --project server --project server-isolated --project server-shared-source --project server-unit --project server-shared-source-unit --project in-source",
        "vitest run --project storybook"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.tests-web-client.steps[7] (run test-client)"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.test-client"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.test"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.test:in-source"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.test:watch"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.test-storybook"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.test:e2e:server"
        },
        {
          "path": "worker/package.json",
          "locator": "scripts.test"
        },
        {
          "path": "worker/package.json",
          "locator": "scripts.test:exclude-llm-connections"
        },
        {
          "path": "worker/package.json",
          "locator": "scripts.test:llm-connections-only"
        },
        {
          "path": "worker/package.json",
          "locator": "scripts.coverage"
        },
        {
          "path": "worker/package.json",
          "locator": "scripts.test:native-codec"
        }
      ],
      "upstream": "https://github.com/vitest-dev/vitest",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "playwright",
      "method": "testing",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "web/package.json",
          "locator": "devDependencies: @playwright/test"
        },
        {
          "path": "web/playwright.config.ts",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/microsoft/playwright",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": true
    },
    {
      "tool": "codespell",
      "method": "formatting",
      "commands": [
        "uses codespell-project/actions-codespell"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/codespell.yml",
          "locator": "jobs.codespell.steps[1] (Codespell)"
        },
        {
          "path": ".codespellrc",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/codespell-project/codespell",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "prettier",
      "method": "formatting",
      "commands": [
        "prettier --write **/*.{js,jsx,ts,tsx,css} --experimental-cli",
        "prettier --check **/*.{js,jsx,ts,tsx,css} --experimental-cli"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-api-spec.yml",
          "locator": "jobs.generate-sdk-api-specs.steps[11] (Prepare TypeScript SDK update)"
        },
        {
          "path": "package.json",
          "locator": "scripts.format"
        },
        {
          "path": "package.json",
          "locator": "scripts.format:check"
        },
        {
          "path": "package.json",
          "locator": "devDependencies: prettier"
        },
        {
          "path": "web/package.json",
          "locator": "devDependencies: prettier"
        }
      ],
      "upstream": "https://github.com/prettier/prettier",
      "docs": "https://prettier.io/docs/cli#exit-codes",
      "exit_codes": {
        "0": "everything formatted",
        "1": "something was not formatted (--check)",
        "2": "prettier error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "ruff-format",
      "method": "formatting",
      "commands": [
        "ruff format langfuse/api"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-api-spec.yml",
          "locator": "jobs.generate-sdk-api-specs.steps[9] (Prepare Python SDK update)"
        }
      ],
      "upstream": "https://github.com/astral-sh/ruff",
      "docs": "https://docs.astral.sh/ruff/formatter/#exit-codes",
      "exit_codes": {
        "0": "already formatted",
        "1": "files would be reformatted (--check)",
        "2": "error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "rustfmt",
      "method": "formatting",
      "commands": [
        "cargo fmt --all -- --check",
        "cargo fmt --all"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.tests-ai-gateway.steps[2] (Check Rust formatting)"
        },
        {
          "path": "ai-gateway/package.json",
          "locator": "scripts.lint"
        },
        {
          "path": "ai-gateway/package.json",
          "locator": "scripts.rust:lint"
        },
        {
          "path": "ai-gateway/package.json",
          "locator": "scripts.format"
        }
      ],
      "upstream": "https://github.com/rust-lang/rustfmt",
      "docs": null,
      "exit_codes": {},
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "cargo-deny",
      "method": "supply_chain",
      "commands": [
        "cargo deny --locked check licenses",
        "cargo deny --locked check bans licenses sources",
        "cargo deny --locked check"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/licencecheck.yml",
          "locator": "jobs.rust_license_check.steps[3] (Check ai-gateway dependency licenses)"
        },
        {
          "path": ".github/workflows/licencecheck.yml",
          "locator": "jobs.rust_license_check.steps[4] (Check native addon dependency licenses)"
        },
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.tests-ai-gateway.steps[6] (Check Rust dependency bans, licenses, and sources)"
        },
        {
          "path": "ai-gateway/package.json",
          "locator": "scripts.rust:deny"
        },
        {
          "path": "deny.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/EmbarkStudios/cargo-deny",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash ${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci-runtime-analyst.lock.yml",
          "locator": "jobs.agent.steps[22] (Audit pre-agent workspace)"
        },
        {
          "path": ".github/workflows/dependabot-security-maintainer.lock.yml",
          "locator": "jobs.agent.steps[28] (Audit pre-agent workspace)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash ${RUNNER_TEMP}/gh-aw/actions/check_oauth_tokens.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci-runtime-analyst.lock.yml",
          "locator": "jobs.activation.steps[6] (Check for OAuth tokens)"
        },
        {
          "path": ".github/workflows/dependabot-security-maintainer.lock.yml",
          "locator": "jobs.activation.steps[7] (Check for OAuth tokens)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/ci/retry-on-merge-queue.test.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.lint.steps[11] (merge-queue retry helper tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/ci/write-web-test-env.sh .env.dev$EXPR.example .env.runtime"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.tests-web.steps[7] (Load default env)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/ci/write-web-test-env.sh .env.dev.example .env"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.tests-web.steps[7] (Load default env)"
        },
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.tests-fips.steps[7] (Load default env)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/openapi/assert-generated-current.sh"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/openapi-export-check.yml",
          "locator": "jobs.check-openapi-export.steps[5] (Export OpenAPI specs and fail on drift)"
        },
        {
          "path": "package.json",
          "locator": "scripts.openapi:check"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/openapi/assert-generated-current.test.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/openapi-export-check.yml",
          "locator": "jobs.check-openapi-export.steps[1] (Assert helper rejects drifted specs)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/smoke-image.sh langfuse-ai-gateway:test"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.tests-ai-gateway.steps[10] (Smoke test runtime image)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "buildx imagetools inspect \"${IMAGE}:${TAG}\" --format '{{json .Manifest}}'"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/nodejs-rpm.yml",
          "locator": "jobs.publish.steps[2] (Publish multi-platform manifest)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "case $AUDIT_DRY_RUN_MODE in"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/model-price-audit.yml",
          "locator": "jobs.audit.steps[3] (Validate workflow inputs)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "dotenv -e ../../.env -- tsc --noEmit --skipLibCheck --incremental --tsBuildInfoFile .tsbuildinfo"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "ee/package.json",
          "locator": "scripts.typecheck"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "dotenv -e ../.env -- next build --experimental-build-mode compile"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "web/package.json",
          "locator": "scripts.build:test"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "dotenv -e ../.env -- oxlint --fix ."
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "web/package.json",
          "locator": "scripts.lint:fix"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "dotenv -e ../.env -- oxlint --max-warnings 0"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "web/package.json",
          "locator": "scripts.lint"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "dotenv -e ../.env -- tsc --noEmit --skipLibCheck --incremental --tsBuildInfoFile .tsbuildinfo"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "worker/package.json",
          "locator": "scripts.typecheck"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "dotenv -e ../.env -- tsc -p tsconfig.json --noEmit --skipLibCheck --incremental --tsBuildInfoFile .tsbuildinfo"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "web/package.json",
          "locator": "scripts.typecheck"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "dotenv -e ../.env -- vitest run --project ai-gateway-e2e-server"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "web/package.json",
          "locator": "scripts.test:e2e:ai-gateway"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "dotenv -e ../.env.test -e ../.env -- playwright test --reporter=line"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "web/package.json",
          "locator": "scripts.test:e2e"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "dotenv -e ../.env.test -e ../.env -- vitest run --project server --project server-isolated --project server-shared-source --project server-unit --project server-shared-source-unit --maxWorkers=${VITEST_MAX_WORKERS:-8}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.tests-web.steps[20] (run tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "elif [ $SECRETS_EXPECTED = true ]"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.test-docker-build.steps[2] (Resolve FIPS base images)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "else"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".husky/pre-commit",
          "locator": "line 19"
        },
        {
          "path": ".husky/pre-commit",
          "locator": "line 38"
        },
        {
          "path": ".husky/pre-push",
          "locator": "line 15"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --check $GENERATED_FILE"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/langfuse-skills-sync.yml",
          "locator": "jobs.sync.steps[5] (Validate changes)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --check $MCP_GENERATED_FILE"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/langfuse-skills-sync.yml",
          "locator": "jobs.sync.steps[5] (Validate changes)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --input-type=module <<JS"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rebase-security-pr.yml",
          "locator": "jobs.repair.steps[5] (Merge main and repair dependency conflicts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/agents/sync-agent-shims.mjs --check"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/model-price-audit.yml",
          "locator": "jobs.audit.steps[4] (Run pre-audit checks)"
        },
        {
          "path": ".github/workflows/model-price-audit.yml",
          "locator": "jobs.audit.steps[11] (Validate audit diff)"
        },
        {
          "path": ".github/workflows/model-price-audit.yml",
          "locator": "jobs.audit.steps[12] (Prepare pull request artifact)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/agents/sync-agent-shims.mjs --check --check-paths"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.lint.steps[7] (agent guidance paths resolve)"
        },
        {
          "path": "package.json",
          "locator": "scripts.agents:check"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check.mjs"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.check"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/model-price-audit/discard-edits-without-model-changes.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/model-price-audit.yml",
          "locator": "jobs.audit.steps[9] (Discard edits without price or selectable-model changes)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/model-price-audit/discard-formatting-only-pricing-diff.mjs --base $base_pricing_file --current worker/src/constants/default-model-prices.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/model-price-audit.yml",
          "locator": "jobs.audit.steps[8] (Discard pricing-only formatting changes)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/model-price-audit/prepare-metadata.mjs > $PR_TITLE_PATH"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/model-price-audit.yml",
          "locator": "jobs.audit.steps[12] (Prepare pull request artifact)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/model-price-audit/render-pull-request-body.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/model-price-audit.yml",
          "locator": "jobs.audit.steps[12] (Prepare pull request artifact)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/model-price-audit/validate-and-render-audit-output.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/model-price-audit.yml",
          "locator": "jobs.audit.steps[10] (Write audit summary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/scan-client-bundle.mjs web/.next/static"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.e2e-tests.steps[13] (Scan client bundle for minifier-dropped bindings)"
        },
        {
          "path": "package.json",
          "locator": "scripts.scan:client-bundle"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "oxlint --fix ."
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "ee/package.json",
          "locator": "scripts.lint:fix"
        },
        {
          "path": "worker/package.json",
          "locator": "scripts.lint:fix"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "oxlint --max-warnings 0"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "ee/package.json",
          "locator": "scripts.lint"
        },
        {
          "path": "worker/package.json",
          "locator": "scripts.lint"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "read -r answer < /dev/tty"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".husky/pre-push",
          "locator": "line 12"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "read -r answer </dev/tty"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".husky/pre-commit",
          "locator": "line 34"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "return 1"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".husky/pre-commit",
          "locator": "line 23"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "rev-parse --abbrev-ref HEAD)"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".husky/pre-commit",
          "locator": "line 4"
        },
        {
          "path": ".husky/pre-push",
          "locator": "line 4"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "run_check Formatting pnpm run format:check"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".husky/pre-commit",
          "locator": "line 28"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "run_format_check"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".husky/pre-commit",
          "locator": "line 37"
        },
        {
          "path": ".husky/pre-commit",
          "locator": "line 45"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-reminder.yml",
          "locator": "jobs.remind.steps[1] (Check for unreleased changes)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sha256sum --check --strict"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/build-sandbox-microvm-image.yml",
          "locator": "jobs.build.steps[6] (Install AWS CLI with Lambda MicroVM support)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "shift"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".husky/pre-commit",
          "locator": "line 13"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "snyk container test langfuse/langfuse --file=web/Dockerfile --sarif-file-output=snyk.sarif"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/snyk-web.yml",
          "locator": "jobs.snyk.steps[2] (Run Snyk to check Docker image for vulnerabilities)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "snyk container test langfuse/langfuse-worker --file=worker/Dockerfile --sarif-file-output=snyk.sarif"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/snyk-worker.yml",
          "locator": "jobs.snyk.steps[2] (Run Snyk to check Docker image for vulnerabilities)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tee $RUNNER_TEMP/claude-model-price-audit.txt"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/model-price-audit.yml",
          "locator": "jobs.audit.steps[10] (Write audit summary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tee $RUNNER_TEMP/security-pnpm.log"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rebase-security-pr.yml",
          "locator": "jobs.repair.steps[5] (Merge main and repair dependency conflicts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/typescript-sdk/patch-generated-deprecations.ts --definition-root ../fern/apis/server/definition --api-root ../generated/typescript"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-api-spec.yml",
          "locator": "jobs.generate-sdk-api-specs.steps[7] (Add TypeScript SDK deprecation warnings)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "turbo run lint"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.lint.steps[15] (lint native addon (rustfmt, clippy))"
        },
        {
          "path": "package.json",
          "locator": "scripts.lint"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "turbo run test"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.tests-shared.steps[9] (run SQL-equivalence tests (non-blocking))"
        },
        {
          "path": "package.json",
          "locator": "scripts.test"
        },
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.tests-worker.steps[14] (run native codec tests against ClickHouse)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "turbo run typecheck"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.lint.steps[19] (typecheck)"
        },
        {
          "path": "package.json",
          "locator": "scripts.typecheck"
        },
        {
          "path": ".github/workflows/pipeline.yml",
          "locator": "jobs.tests-in-app-agent-sandbox-runtime.steps[6] (typecheck sandbox runtime)"
        },
        {
          "path": "package.json",
          "locator": "scripts.tc"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "update API spec from langfuse/langfuse ${GITHUB_SHA::7}    --body Generated from langfuse/langfuse `${GITHUB_REF_NAME}` at ${GITHUB_SHA::7}.    ${REVIEWER_ARGS[@]})"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-api-spec.yml",
          "locator": "jobs.push-python-sdk.steps[1] (Push Python SDK update)"
        },
        {
          "path": ".github/workflows/sdk-api-spec.yml",
          "locator": "jobs.push-typescript-sdk.steps[1] (Push TypeScript SDK update)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}