{
  "repository": "nousresearch/hermes-agent",
  "ref": "71736c9f32597bbca9d89cede5aa136e55946b2f",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "eslint",
      "method": "static_analysis",
      "commands": [
        "eslint {staged_files}",
        "eslint ./",
        "eslint .",
        "eslint . --fix",
        "eslint src/ packages/"
      ],
      "triggers": [
        "pre_commit",
        "local"
      ],
      "evidence": [
        {
          "path": "lefthook.yml",
          "locator": "pre-commit.jobs[1]"
        },
        {
          "path": "lefthook.yml",
          "locator": "pre-commit.jobs[2]"
        },
        {
          "path": "lefthook.yml",
          "locator": "pre-commit.jobs[3]"
        },
        {
          "path": "lefthook.yml",
          "locator": "pre-commit.jobs[4]"
        },
        {
          "path": "lefthook.yml",
          "locator": "pre-commit.jobs[5]"
        },
        {
          "path": "lefthook.yml",
          "locator": "pre-commit.jobs[6]"
        },
        {
          "path": "justfile",
          "locator": "recipe lint-web (line 17)"
        },
        {
          "path": "justfile",
          "locator": "recipe lint-bootstrap-installer (line 21)"
        },
        {
          "path": "justfile",
          "locator": "recipe lint-desktop (line 25)"
        },
        {
          "path": "justfile",
          "locator": "recipe lint-tui (line 29)"
        },
        {
          "path": "justfile",
          "locator": "recipe lint-tests (line 33)"
        },
        {
          "path": "justfile",
          "locator": "recipe lint-shared (line 37)"
        }
      ],
      "upstream": "https://github.com/eslint/eslint",
      "docs": "https://eslint.org/docs/latest/use/command-line-interface#exit-codes",
      "exit_codes": {
        "0": "no errors",
        "1": "linting errors found",
        "2": "configuration problem or internal error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "ruff-check",
      "method": "static_analysis",
      "commands": [
        "ruff check --output-format json --exit-zero > $R/head/ruff.json",
        "ruff check --output-format json --exit-zero > $R/base/ruff.json",
        "ruff check .",
        "ruff check --config ./ruff.pre-commit.toml {staged_files}",
        "ruff check ./"
      ],
      "triggers": [
        "pre_commit",
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.lint-diff.steps[4] (Run ruff + ty on HEAD)"
        },
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.lint-diff.steps[5] (Run ruff + ty on base (via git worktree))"
        },
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.ruff-blocking.steps[3] (ruff check  .)"
        },
        {
          "path": "lefthook.yml",
          "locator": "pre-commit.jobs[0]"
        },
        {
          "path": "justfile",
          "locator": "recipe lint-python (line 6)"
        },
        {
          "path": "justfile",
          "locator": "recipe lint-python-fix (line 10)"
        },
        {
          "path": "pyproject.toml",
          "locator": "[tool.ruff]"
        },
        {
          "path": "pyproject.toml",
          "locator": "[dependency-groups] dev: ruff"
        },
        {
          "path": "ruff.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/astral-sh/ruff",
      "docs": "https://docs.astral.sh/ruff/linter/#exit-codes",
      "exit_codes": {
        "0": "no violations",
        "1": "violations found",
        "2": "invalid configuration, CLI options or internal error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "tsc",
      "method": "static_analysis",
      "commands": [
        "tsc --noEmit -p tsconfig.json",
        "tsc -b . --noEmit",
        "tsc -p . --noEmit"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "tests-js/package.json",
          "locator": "scripts.typecheck"
        },
        {
          "path": "tests-js/package.json",
          "locator": "scripts.check"
        },
        {
          "path": "ui-tui/package.json",
          "locator": "scripts.typecheck"
        },
        {
          "path": "ui-tui/package.json",
          "locator": "scripts.check"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.typecheck"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check"
        },
        {
          "path": "website/package.json",
          "locator": "scripts.typecheck"
        },
        {
          "path": "package.json",
          "locator": "devDependencies: typescript"
        },
        {
          "path": "tests-js/package.json",
          "locator": "devDependencies: typescript"
        },
        {
          "path": "ui-tui/package.json",
          "locator": "devDependencies: typescript"
        },
        {
          "path": "web/package.json",
          "locator": "devDependencies: typescript"
        },
        {
          "path": "website/package.json",
          "locator": "devDependencies: typescript"
        }
      ],
      "upstream": "https://github.com/microsoft/TypeScript",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "cargo-test",
      "method": "testing",
      "commands": [
        "cargo test --lib"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-tests.yml",
          "locator": "jobs.bootstrap-installer.steps[3] (cargo test)"
        }
      ],
      "upstream": "https://github.com/rust-lang/cargo",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "node-test",
      "method": "testing",
      "commands": [
        "node --test tests/install/e2e-assets/windows-bundled-helpers.test.mjs",
        "node --test scripts/whatsapp-bridge/*.test.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/install-e2e-windows-run.yml",
          "locator": "jobs.bundled-e2e.steps[3] (Verify native helpers)"
        },
        {
          "path": ".github/workflows/js-tests.yml",
          "locator": "jobs.check.steps[8] (Run WhatsApp bridge node tests)"
        }
      ],
      "upstream": "https://github.com/nodejs/node",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "playwright",
      "method": "testing",
      "commands": [
        "playwright test -c e2e/core/playwright.config.ts local-gateway-attach.spec.ts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/windows-desktop-attach-e2e.yml",
          "locator": "jobs.attach.steps[5] (Attach spec on the dev tree)"
        },
        {
          "path": ".github/workflows/windows-desktop-attach-e2e.yml",
          "locator": "jobs.attach.steps[7] (Attach spec on the packaged build)"
        },
        {
          "path": "tests-js/package.json",
          "locator": "dependencies: @playwright/test"
        },
        {
          "path": "apps/desktop/e2e/core/playwright.config.ts",
          "locator": "config file"
        },
        {
          "path": "apps/desktop/e2e/update/playwright.config.ts",
          "locator": "config file"
        },
        {
          "path": "apps/desktop/playwright.config.ts",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/microsoft/playwright",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "pytest",
      "method": "testing",
      "commands": [
        "pytest ${args[@]}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/live-providers.yml",
          "locator": "jobs.live.steps[5] (Run live canaries)"
        },
        {
          "path": "pyproject.toml",
          "locator": "[tool.pytest]"
        },
        {
          "path": "pyproject.toml",
          "locator": "[dependency-groups] dev: pytest"
        },
        {
          "path": "optional-skills/creative/comfyui/tests/pytest.ini",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/pytest-dev/pytest",
      "docs": "https://docs.pytest.org/en/stable/reference/exit-codes.html",
      "exit_codes": {
        "0": "all tests passed",
        "1": "some tests failed",
        "2": "interrupted by the user",
        "3": "internal error",
        "4": "command line usage error",
        "5": "no tests were collected"
      },
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "vitest",
      "method": "testing",
      "commands": [
        "vitest run",
        "vitest"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "tests-js/package.json",
          "locator": "scripts.test"
        },
        {
          "path": "tests-js/package.json",
          "locator": "scripts.check"
        },
        {
          "path": "ui-tui/package.json",
          "locator": "scripts.check"
        },
        {
          "path": "ui-tui/package.json",
          "locator": "scripts.test"
        },
        {
          "path": "ui-tui/package.json",
          "locator": "scripts.test:watch"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.test"
        },
        {
          "path": "web/package.json",
          "locator": "scripts.check"
        },
        {
          "path": "tests-js/package.json",
          "locator": "devDependencies: vitest"
        },
        {
          "path": "ui-tui/package.json",
          "locator": "devDependencies: vitest"
        },
        {
          "path": "web/package.json",
          "locator": "devDependencies: vitest"
        },
        {
          "path": "apps/desktop/vitest.config.ts",
          "locator": "config file"
        },
        {
          "path": "evals/desktop-pane-fixture/vitest.config.mts",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/vitest-dev/vitest",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "prettier",
      "method": "formatting",
      "commands": [
        "prettier --write src/**/*.{ts,tsx} packages/**/*.{ts,tsx}"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "ui-tui/package.json",
          "locator": "scripts.fmt"
        },
        {
          "path": "ui-tui/package.json",
          "locator": "scripts.fix"
        },
        {
          "path": "ui-tui/package.json",
          "locator": "devDependencies: prettier"
        },
        {
          "path": ".prettierrc",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/prettier/prettier",
      "docs": "https://prettier.io/docs/cli#exit-codes",
      "exit_codes": {
        "0": "everything formatted",
        "1": "something was not formatted (--check)",
        "2": "prettier error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "npm-audit",
      "method": "supply_chain",
      "commands": [
        "npm audit --workspaces=false",
        "npm audit --workspace web",
        "npm audit --workspace ui-tui",
        "npm audit fix --workspaces=false",
        "npm audit fix --workspace web"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.audit:root"
        },
        {
          "path": "package.json",
          "locator": "scripts.audit:web"
        },
        {
          "path": "package.json",
          "locator": "scripts.audit:tui"
        },
        {
          "path": "package.json",
          "locator": "scripts.audit:fix:root"
        },
        {
          "path": "package.json",
          "locator": "scripts.audit:fix:web"
        },
        {
          "path": "package.json",
          "locator": "scripts.audit:fix:tui"
        }
      ],
      "upstream": "https://github.com/npm/cli",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Format-List Status, StatusMessage, SignerCertificate, TimeStamperCertificate"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bootstrap-installer-build.yml",
          "locator": "jobs.windows-x64.steps[8] (Verify signature)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Get-ChildItem -Path $EXPR\\win-update-e2e\\*\\teardown-leftovers.txt -ErrorAction SilentlyContinue"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/windows-install-update-e2e.yml",
          "locator": "jobs.install-update.steps[4] (No machine install left behind)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "New-Item -ItemType Directory -Path $out -Force"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/install-e2e-windows-run.yml",
          "locator": "jobs.e2e.steps[13] (Collect proof + logs)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "New-Item -ItemType Directory -Path gui-e2e-proof -Force"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/install-e2e-windows-run.yml",
          "locator": "jobs.e2e.steps[9] (Stage known-failure receipt)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Start-Sleep -Milliseconds 500"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/tests-os.yml",
          "locator": "jobs.e2e-windows.steps[3] (No leftover Python / Hermes processes)"
        },
        {
          "path": ".github/workflows/windows-install-update-e2e.yml",
          "locator": "jobs.install-update.steps[6] (No leftover Python / Hermes processes)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Test"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/e2e-desktop.yml",
          "locator": "jobs.e2e.steps[13] (Generate visual diff summary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "This check is blocking because the Docker image build uses"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/uv-lockfile-check.yml",
          "locator": "jobs.check.steps[2] (Verify uv.lock is up-to-date)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "ascii-guard lint --exclude-code-blocks docs"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docs-site-checks.yml",
          "locator": "jobs.docs-site-checks.steps[8] (Lint docs diagrams)"
        },
        {
          "path": "website/package.json",
          "locator": "scripts.lint:diagrams"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/run_tests.sh -j 2 tests/scripts/test_termux_python_linkage.py tests/scripts/test_termux_retag_wheel.py tests/scripts/test_termux_build_wheels.py tests/scripts/test_termux_wheelhouse_cache.py tests/scripts/test_termux_runtime_libs.py tests/scripts/test_archive_inputs.py tests/scripts/test_termux_launchers.py tests/pm/test_pm_bionic.py tests/pm/test_stage_only.py tests/pm/test_deb_safety.py tests/scripts/test_stage_apt_repo.py tests/scripts/test_run_tests_shell.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/termux-verify.yml",
          "locator": "jobs.contracts.steps[3] (Run the native linker and wheel contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/run_tests.sh tests/gateway/test_telegram_closewait_windows_live.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/windows-venv-e2e.yml",
          "locator": "jobs.venv-holder-e2e.steps[3] (Run Telegram CLOSE-WAIT reconnect live E2E (#87057))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/run_tests.sh tests/hermes_cli/test_venv_holder_windows_live.py tests/hermes_cli/test_taskkill_identity_windows_live.py tests/hermes_cli/test_git_trampoline_windows_live.py tests/pm/test_held_entry_windows_live.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/windows-venv-e2e.yml",
          "locator": "jobs.venv-holder-e2e.steps[2] (Run venv-holder live E2E)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/run_tests.sh tests/pm/test_long_paths_windows_live.py -- -m platforms and integration -v"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/windows-venv-e2e.yml",
          "locator": "jobs.venv-holder-e2e.steps[6] (Run PM long-path live E2E with long paths off (#130242))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/run_tests.sh tests/scripts/test_fresh_source_install.py -q -j 1"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bootstrap-installer.yml",
          "locator": "jobs.posix.steps[9] (Current installer to PM worker to published command)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash scripts/run_tests.sh tests/tools/test_process_registry_windows_live.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/windows-venv-e2e.yml",
          "locator": "jobs.venv-holder-e2e.steps[4] (Run background-executor spawn parity live E2E (#70716))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash tests/install/macos-bundle-smoke.sh --artifact $ARTIFACT --arch $ARCH --commit $RELEASE_COMMIT ${args[@]} --work $SMOKE_ROOT/work --out $SMOKE_ROOT/out"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-bundle-smoke.yml",
          "locator": "jobs.macos.steps[6] (Install and chat on macOS)"
        },
        {
          "path": ".github/workflows/desktop-bundle-smoke.yml",
          "locator": "jobs.windows.steps[6] (Install and chat on macOS)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash tests/install/macos-bundled-e2e.sh --phase install --manifest-url $BUNDLE_MANIFEST --arch $BUNDLE_ARCH"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/install-e2e-macos-run.yml",
          "locator": "jobs.bundled-e2e.steps[5] (Install OLD signed bundle (${{ inputs.install-ref }}))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash tests/install/macos-bundled-e2e.sh --phase update --manifest-url $BUNDLE_MANIFEST --arch $BUNDLE_ARCH"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/install-e2e-macos-run.yml",
          "locator": "jobs.bundled-e2e.steps[6] (Update to NEW via About -> Update now (${{ inputs.bundle-arch }}))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "buildx imagetools inspect \"${IMAGE_NAME}:${RELEASE_TAG}\" --format '{{json .Manifest.Digest}}'"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docker.yml",
          "locator": "jobs.release-publish-manifest.steps[6] (Record slim manifest-list digest for the release receipt)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "buildx imagetools inspect \"${IMAGE_NAME}:${RELEASE_TAG}-${ARCH}${SUFFIX}\" --format '{{json .Manifest.Digest}}'"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docker.yml",
          "locator": "jobs.release-publish.steps[8] (Record pushed per-arch digest)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "case $PLATFORM/$ARCH/$FORMAT in"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-bundle-smoke.yml",
          "locator": "jobs.macos.steps[4] (Fetch one exact downloadable artifact)"
        },
        {
          "path": ".github/workflows/desktop-bundle-smoke.yml",
          "locator": "jobs.windows.steps[4] (Fetch one exact downloadable artifact)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "codesign --verify --strict --verbose=2 $app"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-bundled-release.yml",
          "locator": "jobs.build-darwin-arm64-release.steps[14] (Verify the build is signed and notarized)"
        },
        {
          "path": ".github/workflows/desktop-bundled-release.yml",
          "locator": "jobs.build-darwin-arm64-commit.steps[14] (Verify the build is signed and notarized)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "codesign --verify --strict --verbose=2 ${apps[0]}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bootstrap-installer-build.yml",
          "locator": "jobs.macos-arm64.steps[7] (Verify the app and dmg are signed and notarized)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "codesign --verify --verbose=2 $dmg"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bootstrap-installer-build.yml",
          "locator": "jobs.macos-arm64.steps[7] (Verify the app and dmg are signed and notarized)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "commit = subprocess.check_output([git, rev-parse, --verify, frefs/tags/{tag}^{{commit}}], text=True).strip()"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-bundled-release.yml",
          "locator": "jobs.termux-deb.steps[17] (Retrieve the previous published Termux package from R2)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "dst = proof },"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/install-e2e-windows-run.yml",
          "locator": "jobs.e2e.steps[13] (Collect proof + logs)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "du -sh _site/docs/assets"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/deploy-site.yml",
          "locator": "jobs.deploy-docs.steps[13] (Merge retained assets from previous deploys)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "e2e_allowed = release or os.environ[EVENT_NAME] == workflow_dispatch"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yaml",
          "locator": "jobs.detect.steps[2] (Force all lanes on release; E2E only on release or dispatch)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "eval ${ATTESTED/BAD=/ATT_BAD=} 2>/dev/null"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/plugin-catalog-ci.yml",
          "locator": "jobs.pinned-source-validate.steps[3] (Clone each entry at its pinned sha and validate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "eval ${ATTESTED/PATHS=/ATT_PATHS=}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/plugin-catalog-ci.yml",
          "locator": "jobs.pinned-source-validate.steps[3] (Clone each entry at its pinned sha and validate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "except (json.JSONDecodeError, TypeError):"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/supply-chain-audit.yml",
          "locator": "jobs.aggregate.steps[0] (Merge review statuses)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "image = json.loads(Path(/tmp/image-artifacts/image-inspect.json).read_text())[0]"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docker.yml",
          "locator": "jobs.build.steps[12] (Save tested image archive (release test))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "log ${MERGE_BASE}..HEAD --format=%ae --no-merges"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/contributor-check.yml",
          "locator": "jobs.check-attribution.steps[1] (Check for unmapped contributor emails)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "log --author=$email --format=%an -1)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/contributor-check.yml",
          "locator": "jobs.check-attribution.steps[1] (Check for unmapped contributor emails)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "metadata --no-deps --format-version 1 --manifest-path \"$tree/apps/bootstrap-installer/src-tauri/Cargo.toml\""
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/stable-release.yml",
          "locator": "jobs.bootstrap-version.steps[1] (Stamp and verify the Cargo and Tauri release identity)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "nix flake check \"${{ inputs.release == true"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/nix.yml",
          "locator": "jobs.flake-check.steps[4] (nix flake check)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --input-type=module -e '"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-bundled-release.yml",
          "locator": "jobs.publish-win32-updater.steps[3] (Publish identical tested bytes without rebuilding)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node ../../node_modules/vitest/vitest.mjs run --project electron scripts/payload-sign-cache.test.mjs scripts/batch-sign-binaries.test.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-bundled-release.yml",
          "locator": "jobs.build-win32-x64-release.steps[13] (Verify native signature cache contracts)"
        },
        {
          "path": ".github/workflows/desktop-bundled-release.yml",
          "locator": "jobs.build-win32-arm64-release.steps[13] (Verify native signature cache contracts)"
        },
        {
          "path": ".github/workflows/desktop-bundled-release.yml",
          "locator": "jobs.build-win32-x64-commit.steps[13] (Verify native signature cache contracts)"
        },
        {
          "path": ".github/workflows/desktop-bundled-release.yml",
          "locator": "jobs.build-win32-arm64-commit.steps[13] (Verify native signature cache contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node ../../node_modules/vitest/vitest.mjs run --project electron scripts/windows-bundle-tools.test.mjs scripts/msix-shared.test.mjs scripts/sign-msix.test.mjs scripts/batch-sign-binaries.test.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/windows-bundle-sdk.yml",
          "locator": "jobs.windows-bundle-tools.steps[3] (Provision from an empty cache and execute the SDK)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node .github/scripts/run-workspace-checks.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/js-tests.yml",
          "locator": "jobs.check.steps[9] (Run all workspace checks)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node apps/desktop/scripts/audit-bundle-arch.mjs --arch=${MATRIX_LABEL##*-} --root=apps/desktop/release"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-bundled-release.yml",
          "locator": "jobs.build-win32-x64-release.steps[15] (Audit bundle architecture)"
        },
        {
          "path": ".github/workflows/desktop-bundled-release.yml",
          "locator": "jobs.build-win32-arm64-release.steps[15] (Audit bundle architecture)"
        },
        {
          "path": ".github/workflows/desktop-bundled-release.yml",
          "locator": "jobs.build-win32-x64-commit.steps[15] (Audit bundle architecture)"
        },
        {
          "path": ".github/workflows/desktop-bundled-release.yml",
          "locator": "jobs.build-win32-arm64-commit.steps[15] (Audit bundle architecture)"
        },
        {
          "path": ".github/workflows/desktop-bundled-release.yml",
          "locator": "jobs.build-darwin-arm64-release.steps[13] (Audit bundle architecture)"
        },
        {
          "path": ".github/workflows/desktop-bundled-release.yml",
          "locator": "jobs.build-darwin-arm64-commit.steps[13] (Audit bundle architecture)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/generate-icons.mjs --check"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/icons-freshness-check.yml",
          "locator": "jobs.check.steps[2] (Regenerate every target, verify structure, diff against committed)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/sandbox/generate-e2e-matrix.mjs --format results --tags $EXPR --artifacts /tmp/e2e-artifacts.ndjson < /tmp/e2e-jobs.ndjson"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/install-e2e.yml",
          "locator": "jobs.report.steps[1]"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/sandbox/generate-e2e-matrix.mjs --tags $EXPR --format markdown >> $GITHUB_STEP_SUMMARY"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/install-e2e.yml",
          "locator": "jobs.generate-matrix.steps[1]"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node tests/install/e2e-assets/bundle-plan.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/install-e2e.yml",
          "locator": "jobs.bundle-inputs.steps[2]"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node tests/install/e2e-assets/red-tracker.mjs --run-id $RUN_ID $DRY_RUN"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/install-e2e-red.yml",
          "locator": "jobs.track.steps[1] (Open, update or close the tracker)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node website/scripts/check-live-search.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docs-search-monitor.yml",
          "locator": "jobs.probe.steps[3] (Probe live docs search)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "paths = data.get(attested_binaries) if isinstance(data, dict) else None"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/plugin-catalog-ci.yml",
          "locator": "jobs.pinned-source-validate.steps[3] (Clone each entry at its pinned sha and validate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python ../../scripts/ci/e2e_screenshot_status.py --results-dir test-results --manifest-output /tmp/e2e-screenshot-manifest.json --artifact-url $RESULTS_URL --output /tmp/e2e-review-status.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/e2e-desktop.yml",
          "locator": "jobs.e2e.steps[11] (Build screenshot review status)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check --only health --base HEAD^1"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.code-health.steps[3] (Ratchet the PR against the base branch tip)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check-case-collisions.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/case-collision-check.yml",
          "locator": "jobs.check-case-collisions.steps[1] (Run case-collision checker)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check-windows-footguns.py --all"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.windows-footguns.steps[2] (Run footgun checker)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check_bash_shebangs.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.windows-footguns.steps[3] (Require portable Bash shebangs)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check_config_yaml_readers.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.windows-footguns.steps[7] (Forbid config.yaml readers that bypass the config backend)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check_config_yaml_writers.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.windows-footguns.steps[6] (Forbid config.yaml writers that bypass the comment-preserving writer)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check_detached_spawns.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.windows-footguns.steps[5] (Forbid detached spawns outside the owned-child helper)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check_no_tmp_literals.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.windows-footguns.steps[4] (Forbid literal /tmp paths outside the baseline)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check_profile_scope_patterns.py --base origin/$EXPR --head origin/pr-head"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.windows-footguns.steps[10] (Profile-scope patterns on added lines (advisory))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/ci/check_agents_md_size.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.windows-footguns.steps[9] (Keep every AGENTS.md under its truncation cap)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/ci/check_blob_size.py --base HEAD^1"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/blob-size-check.yml",
          "locator": "jobs.check-blob-size.steps[1] (Judge files added or modified against the base branch tip)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/ci/check_lazy_deps_imports.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lazy-deps-guard.yml",
          "locator": "jobs.lazy-deps-guard.steps[1] (Check tools.lazy_deps imports in tracked production code)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/ci/check_os_marker_fakes.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.windows-footguns.steps[8] (Forbid unmarked macOS fakes in tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/ci/check_profile_archive_boundary.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docker.yml",
          "locator": "jobs.build.steps[3] (Reject profile exports in the build context)"
        },
        {
          "path": ".github/workflows/docker.yml",
          "locator": "jobs.publish.steps[3] (Reject profile exports in the build context)"
        },
        {
          "path": ".github/workflows/profile-artifact-check.yml",
          "locator": "jobs.check-profile-artifacts.steps[1] (Reject profile exports in the checkout)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/ci/check_public_surface.py --base origin/$EXPR --head origin/pr-head"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.windows-footguns.steps[11] (Public-surface diff vs base (advisory))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/gen-bootstrap-pins.py --check"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bootstrap-installer.yml",
          "locator": "jobs.posix.steps[2] (Generated bootstrap pins match pm/lock.json)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/lint_diff.py --base-ruff $R/base/ruff.json --head-ruff $R/head/ruff.json --base-ty $R/base/ty.json --head-ty $R/head/ty.json --base-ref $EXPR --head-ref $HEAD_REF --output $R/summary.md"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.lint-diff.steps[6] (Generate diff summary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/verify-bootstrap-version-stamp.py --stamp $HERMES_INSTALL_DIR/.hermes-bootstrap-complete --repo $HERMES_INSTALL_DIR --expect-commit $EXPR --expect-branch ci-under-test --no-source-stamp"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bootstrap-installer.yml",
          "locator": "jobs.posix.steps[5] (Verify the shipped version stamp)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python website/scripts/check_doc_links.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docs-site-checks.yml",
          "locator": "jobs.docs-site-checks.steps[7] (Check cross-page links resolve on GitHub and on the site)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python website/scripts/generate-skill-docs.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/deploy-site.yml",
          "locator": "jobs.deploy-docs.steps[8] (Regenerate per-skill docs pages + catalogs)"
        },
        {
          "path": ".github/workflows/docs-site-checks.yml",
          "locator": "jobs.docs-site-checks.steps[5] (Regenerate per-skill docs pages + catalogs)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "raise SystemExit(Loaded Docker image differs from tested image)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docker.yml",
          "locator": "jobs.release-publish.steps[5] (Load tested image)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "raise SystemExit(Tested Docker archive identity mismatch)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docker.yml",
          "locator": "jobs.release-publish.steps[5] (Load tested image)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "release = json.loads(subprocess.check_output(["
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-bundled-release.yml",
          "locator": "jobs.termux-deb.steps[17] (Retrieve the previous published Termux package from R2)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "root = pathlib.Path(tests/e2e/core/upgrade)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/tests.yml",
          "locator": "jobs.e2e-upgrade-plan.steps[1] (List suite directories)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "scripts.ci.python_packages pytest==9.1.1 pytest-asyncio==1.3.0 ruamel.yaml==0.18.17 packaging==26.0"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bootstrap-installer.yml",
          "locator": "jobs.posix.steps[8] (Prepare isolated acceptance-test dependencies)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "scripts.releases.docker verify --tag $RELEASE_TAG --commit $CANDIDATE_COMMIT /tmp/manifest/manifest.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docker.yml",
          "locator": "jobs.release-publish-manifest.steps[8] (Verify manifest identity)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "scripts.releases.stable verify"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-bundled-release.yml",
          "locator": "jobs.validate.steps[5] (Validate tag shape, pyproject lockstep, and ancestry on origin/main)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security create-keychain -p $pw $kc"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bootstrap-installer-build.yml",
          "locator": "jobs.macos-arm64.steps[3] (Import Developer ID certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security import $p12 -k $kc -P $CSC_KEY_PASSWORD -T /usr/bin/codesign"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bootstrap-installer-build.yml",
          "locator": "jobs.macos-arm64.steps[3] (Import Developer ID certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security list-keychains -d user -s $kc $(security list-keychains -d user"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bootstrap-installer-build.yml",
          "locator": "jobs.macos-arm64.steps[3] (Import Developer ID certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $pw $kc >/dev/null"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bootstrap-installer-build.yml",
          "locator": "jobs.macos-arm64.steps[3] (Import Developer ID certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security set-keychain-settings -lut 21600 $kc"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bootstrap-installer-build.yml",
          "locator": "jobs.macos-arm64.steps[3] (Import Developer ID certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security unlock-keychain -p $pw $kc"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bootstrap-installer-build.yml",
          "locator": "jobs.macos-arm64.steps[3] (Import Developer ID certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sha256sum --check image-${ARCH}.tar.sha256"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docker.yml",
          "locator": "jobs.release-publish.steps[2] (Verify tested archive hash (published bytes == tested bytes))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "test-results -name *-actual.png 2>/dev/null"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/e2e-desktop.yml",
          "locator": "jobs.e2e.steps[13] (Generate visual diff summary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "test-results -name *-diff.png 2>/dev/null"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/e2e-desktop.yml",
          "locator": "jobs.e2e.steps[13] (Generate visual diff summary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "throw test_crash_cells.py ran no crash cells: $manifest is missing"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/windows-install-update-e2e.yml",
          "locator": "jobs.install-update.steps[3] (Every crash cell ran)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "timed out\" lock-check.log"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/uv-lockfile-check.yml",
          "locator": "jobs.check.steps[2] (Verify uv.lock is up-to-date)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "ts = datetime.fromisoformat(generated_at.replace(Z, +00:00))"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/skills-index-freshness.yml",
          "locator": "jobs.check-freshness.steps[1] (Probe live index)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/i18n-keys.ts --check"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "ui-tui/package.json",
          "locator": "scripts.i18n:keys:check"
        },
        {
          "path": "ui-tui/package.json",
          "locator": "scripts.check"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "ty check --output-format gitlab --exit-zero > $R/base/ty.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.lint-diff.steps[5] (Run ruff + ty on base (via git worktree))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "ty check --output-format gitlab --exit-zero > $R/head/ty.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.lint-diff.steps[4] (Run ruff + ty on HEAD)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "verify_manifest existing.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docker.yml",
          "locator": "jobs.release-publish-manifest.steps[5] (Create both immutable versioned manifest lists)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "verify_manifest verified.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docker.yml",
          "locator": "jobs.release-publish-manifest.steps[5] (Create both immutable versioned manifest lists)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}