{
  "repository": "openai/codex-security",
  "ref": "93d346eb769c35752ad5f6b3070a4d797b9f799f",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "actionlint",
      "method": "static_analysis",
      "commands": [
        "actionlint -color",
        "actionlint -color github-action/examples/*.yml"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/workflow-quality.yml",
          "locator": "jobs.lint.steps[3] (Check workflow syntax and shell scripts)"
        }
      ],
      "upstream": "https://github.com/rhysd/actionlint",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "clippy",
      "method": "static_analysis",
      "commands": [
        "cargo clippy --locked -- -D warnings",
        "cargo clippy --locked --target $EXPR --lib --example windows-wide-launcher -- -D warnings"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/native-unix.yml",
          "locator": "jobs.primitives.steps[3] (Check Rust source and fetch locked dependencies)"
        },
        {
          "path": ".github/workflows/native-windows.yml",
          "locator": "jobs.primitives.steps[4] (Check Rust source)"
        }
      ],
      "upstream": "https://github.com/rust-lang/rust-clippy",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "ruff-check",
      "method": "static_analysis",
      "commands": [
        "ruff check --config plugins/codex-security/pyproject.toml plugins/codex-security"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.plugin-source.steps[6] (Check plugin source compatibility)"
        }
      ],
      "upstream": "https://github.com/astral-sh/ruff",
      "docs": "https://docs.astral.sh/ruff/linter/#exit-codes",
      "exit_codes": {
        "0": "no violations",
        "1": "violations found",
        "2": "invalid configuration, CLI options or internal error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "shellcheck",
      "method": "static_analysis",
      "commands": [
        "shellcheck .github/scripts/*.sh docker/verify-container-compose.sh github-action/scripts/setup-ubuntu-sandbox.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/workflow-quality.yml",
          "locator": "jobs.lint.steps[3] (Check workflow syntax and shell scripts)"
        }
      ],
      "upstream": "https://github.com/koalaman/shellcheck",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "tsc",
      "method": "static_analysis",
      "commands": [
        "tsc --noEmit"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/action-ci.yml",
          "locator": "jobs.validate.steps[3]"
        },
        {
          "path": "github-action/package.json",
          "locator": "scripts.validate"
        },
        {
          "path": "github-action/package.json",
          "locator": "scripts.typecheck"
        },
        {
          "path": "github-action/package.json",
          "locator": "devDependencies: typescript"
        }
      ],
      "upstream": "https://github.com/microsoft/TypeScript",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "zizmor",
      "method": "static_analysis",
      "commands": [
        "zizmor --offline --strict-collection --min-severity medium --format github --config .github/zizmor.yml .github"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/workflow-quality.yml",
          "locator": "jobs.lint.steps[5] (Check workflow security)"
        }
      ],
      "upstream": "https://github.com/zizmorcore/zizmor",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "cargo-test",
      "method": "testing",
      "commands": [
        "cargo test --locked --lib"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/native-unix.yml",
          "locator": "jobs.primitives.steps[3] (Check Rust source and fetch locked dependencies)"
        }
      ],
      "upstream": "https://github.com/rust-lang/cargo",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "ci-matrix",
      "method": "testing",
      "commands": [
        "behavior (node: 2)",
        "primitives (include: 4)",
        "primitives (include: 2)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/invoice-desk.yml",
          "locator": "jobs.behavior.strategy.matrix"
        },
        {
          "path": ".github/workflows/native-unix.yml",
          "locator": "jobs.primitives.strategy.matrix"
        },
        {
          "path": ".github/workflows/native-windows.yml",
          "locator": "jobs.primitives.strategy.matrix"
        }
      ],
      "upstream": "https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "node-test",
      "method": "testing",
      "commands": [
        "node --test examples/invoice-desk/qa/app.test.mjs .github/scripts/invoice-desk-*.test.mjs",
        "node --test windows-files.test.mjs",
        "node --test .github/scripts/test-ci-selection.mjs .github/scripts/test-verify-pr-source.mjs .github/scripts/test-release-guide.mjs",
        "node --test .github/scripts/test_check_plugin_source_compatibility.mjs",
        "node --test .github/scripts/test_release_progress.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/invoice-desk.yml",
          "locator": "jobs.behavior.steps[2] (Check application behavior and scan orchestration)"
        },
        {
          "path": ".github/workflows/native-windows.yml",
          "locator": "jobs.primitives.steps[5] (Build and verify with Node.js 22)"
        },
        {
          "path": ".github/workflows/native-windows.yml",
          "locator": "jobs.primitives.steps[8] (Verify the same artifact with Node.js 20)"
        },
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.static-checks.steps[4] (Test CI selection, result gating and the release guide)"
        },
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.plugin-source.steps[7] (Test source compatibility checker)"
        },
        {
          "path": ".github/workflows/workflow-quality.yml",
          "locator": "jobs.lint.steps[4] (Test release progress reporting)"
        }
      ],
      "upstream": "https://github.com/nodejs/node",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "pytest",
      "method": "testing",
      "commands": [
        "pytest -q .github/scripts/test_require_native_python_report.py",
        "pytest plugins/codex-security/tests -m $PYTEST_MARKERS -q -n 4 --dist worksteal --max-worker-restart 0 --durations=30 --junitxml=reports/python.xml"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.plugin-source.steps[8] (Test the native Python report gate)"
        },
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.plugin-source.steps[10] (Test Python source contracts)"
        }
      ],
      "upstream": "https://github.com/pytest-dev/pytest",
      "docs": "https://docs.pytest.org/en/stable/reference/exit-codes.html",
      "exit_codes": {
        "0": "all tests passed",
        "1": "some tests failed",
        "2": "interrupted by the user",
        "3": "internal error",
        "4": "command line usage error",
        "5": "no tests were collected"
      },
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "stryker",
      "method": "testing",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "sdk/typescript/stryker.config.json",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/stryker-mutator/stryker-js",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": true
    },
    {
      "tool": "ruff-format",
      "method": "formatting",
      "commands": [
        "ruff format --check --config plugins/codex-security/pyproject.toml plugins/codex-security"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.plugin-source.steps[6] (Check plugin source compatibility)"
        }
      ],
      "upstream": "https://github.com/astral-sh/ruff",
      "docs": "https://docs.astral.sh/ruff/formatter/#exit-codes",
      "exit_codes": {
        "0": "already formatted",
        "1": "files would be reformatted (--check)",
        "2": "error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "rustfmt",
      "method": "formatting",
      "commands": [
        "cargo fmt --check"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/native-unix.yml",
          "locator": "jobs.primitives.steps[3] (Check Rust source and fetch locked dependencies)"
        },
        {
          "path": ".github/workflows/native-windows.yml",
          "locator": "jobs.primitives.steps[4] (Check Rust source)"
        },
        {
          "path": "plugins/codex-security/native/rustfmt.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/rust-lang/rustfmt",
      "docs": null,
      "exit_codes": {},
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "prettier",
      "method": "formatting",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "github-action/package.json",
          "locator": "devDependencies: prettier"
        },
        {
          "path": ".prettierrc.json",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/prettier/prettier",
      "docs": "https://prettier.io/docs/cli#exit-codes",
      "exit_codes": {
        "0": "everything formatted",
        "1": "something was not formatted (--check)",
        "2": "prettier error"
      },
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": "npm-audit",
      "method": "supply_chain",
      "commands": [
        "npm audit --audit-level=high",
        "npm audit --prefix runtime --omit=dev --audit-level=high",
        "npm audit signatures --prefix $consumer --registry=https://registry.npmjs.org/ --json --include-attestations"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/action-ci.yml",
          "locator": "jobs.dependencies.steps[2] (Check action dependencies)"
        },
        {
          "path": ".github/workflows/action-ci.yml",
          "locator": "jobs.dependencies.steps[3] (Check locked CLI dependencies)"
        },
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.release.steps[7] (Verify the public npm package and signed provenance)"
        },
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.action-verify.steps[9] (Validate the packaged Action)"
        },
        {
          "path": ".github/workflows/node-release.yml",
          "locator": "jobs.publish.steps[5] (Verify recovered npm release provenance)"
        }
      ],
      "upstream": "https://github.com/npm/cli",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Not checked"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.complete.steps[0] (Summarize release channels)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash docker/test-container-index.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-validate.yml",
          "locator": "jobs.validate.steps[6] (Test release index assembly)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash docker/verify-container-sandbox.sh codex-security:release-candidate"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-validate.yml",
          "locator": "jobs.validate.steps[12] (Verify hardened Codex command sandbox)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash docker/wolfi/verify-npm-release.sh $lock $version $sha $archive"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/wolfi-build.yml",
          "locator": "jobs.fixture.steps[2] (Exercise release staging on a known published scanner)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "buildx imagetools inspect $reference --raw)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-publish.yml",
          "locator": "jobs.source.steps[4] (Verify an existing immutable container release)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bulk-scan requires a repository CSV"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-validate.yml",
          "locator": "jobs.validate.steps[13] (Reject interactive repository discovery)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun test --timeout 30000 tests-ts/action-release-workflow.test.ts tests-ts/codex-dependency-pins.test.ts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/action-ci.yml",
          "locator": "jobs.validate.steps[5] (Test Action release contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun test --timeout 360000 ./tests-ts/windows-machine-policy.test.ts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.windows-test.steps[11] (Test machine-wide PowerShell policy)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun test sdk/typescript/tests-ts/codex-dependency-pins.test.ts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.eval-contracts.steps[2] (Check the Codex version across the SDK, MCP app and evals)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "case $tag_type in"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.release.steps[4] (Resolve the successful protected release)"
        },
        {
          "path": ".github/workflows/node-release-cut.yml",
          "locator": "jobs.cut.steps[3] (Create the exact merged release tag)"
        },
        {
          "path": ".github/workflows/node-release.yml",
          "locator": "jobs.publish.steps[6] (Revalidate protected release tag)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "case $type in"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-release-labels.yml",
          "locator": "jobs.categorize.steps[0] (Categorize pull request without checking out its code)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cmp - $RUNNER_TEMP/scanner/base-sources.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/wolfi-build.yml",
          "locator": "jobs.build.steps[7] (Prepare the tested digest for publication)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "completed = os.environ[SCAN_EXIT_CODE] == 0"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/invoice-desk-scan.yml",
          "locator": "jobs.scan.steps[10] (Summarize and measure the scan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "const provenance = JSON.parse(readFileSync(0, utf8))"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.release.steps[7] (Verify the public npm package and signed provenance)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "coverage = json.loads((root / invoice-desk-scan/coverage.json).read_text())"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/invoice-desk-scan.yml",
          "locator": "jobs.scan.steps[10] (Summarize and measure the scan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "coverage = result.get(coverage) or {}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/invoice-desk-scan.yml",
          "locator": "jobs.scan.steps[10] (Summarize and measure the scan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "inspect --no-creds --raw docker://$IMAGE:$tag"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-publish.yml",
          "locator": "jobs.promote.steps[4] (Promote and verify each release tag)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "ln -s ../../plugins/codex-security sdk/typescript/_bundled_plugin"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.eval-contracts.steps[8] (Build host plugin for Standard eval integration)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "local type=$1 breaking_marker=$2 scope=$3"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-release-labels.yml",
          "locator": "jobs.categorize.steps[0] (Categorize pull request without checking out its code)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node $GITHUB_WORKSPACE/automation/github-action/scripts/release.mjs verify $RELEASE_VERSION $RELEASE_SHA $CLI_INTEGRITY $GITHUB_WORKSPACE/release-source/github-action"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.action-verify.steps[5] (Reuse an existing immutable Action distribution)"
        },
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.action.steps[3] (Reuse an existing immutable Action distribution)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --experimental-strip-types --test --test-reporter=tap tests/test_helper_files.ts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.windows-test.steps[9] (Test MCP helper paths on Windows)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --experimental-strip-types --test evals/secret-discovery/test_*.mts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.eval-contracts.steps[7] (Test secret discovery eval contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --experimental-strip-types --test evals/standard-time-budget/test_*.mts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.eval-contracts.steps[9] (Test Standard time-budget eval contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --experimental-strip-types --test evals/workflow-routing/test_*.mts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.eval-contracts.steps[10] (Test workflow routing eval contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --experimental-strip-types --test plugins/codex-security/mcp-app/scripts/test_host_build.mts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.plugin-host.steps[3] (Build and test the standalone host runtime)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --experimental-strip-types ../../../sdk/typescript/scripts/run-mcp-test-shard.mts $EXPR $EXPR"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.mcp.steps[6] (Test MCP app)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --experimental-strip-types scripts/run-ci-tests.mts $EXPR ${{ runner.os == Linux"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-quality.yml",
          "locator": "jobs.runner.steps[9] (Test shard layout)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --experimental-strip-types scripts/run-ci-tests.mts $EXPR/3"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-release.yml",
          "locator": "jobs.test.steps[10] (Test TypeScript shard)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --experimental-strip-types scripts/run-ci-tests.mts $EXPR/6 --seed=$EXPR ${{ matrix.os == ubuntu-latest"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.test.steps[7] (Test)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --experimental-strip-types sdk/typescript/scripts/check-devcontainer-cooldown.mts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.static-checks.steps[3] (Check devcontainer dependency cooldown)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --experimental-strip-types sdk/typescript/scripts/compare-test-reports.mts ${baseline_reports[@]} -- ${expanded_reports[@]} >> $GITHUB_STEP_SUMMARY"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-quality.yml",
          "locator": "jobs.compare.steps[4] (Compare inventories and outcomes)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --experimental-strip-types sdk/typescript/scripts/run-ci-tests.mts $EXPR/14 --seed=$EXPR"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.windows-test.steps[8] (Test shard ${{ matrix.shard }})"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --import tsx --test tests/*.test.*"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/action-ci.yml",
          "locator": "jobs.validate.steps[3]"
        },
        {
          "path": "github-action/package.json",
          "locator": "scripts.validate"
        },
        {
          "path": "github-action/package.json",
          "locator": "scripts.test"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --import tsx scripts/check-metadata.ts"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/action-ci.yml",
          "locator": "jobs.validate.steps[3]"
        },
        {
          "path": "github-action/package.json",
          "locator": "scripts.validate"
        },
        {
          "path": "github-action/package.json",
          "locator": "scripts.check-metadata"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --import tsx scripts/cli-integration.ts"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/action-ci.yml",
          "locator": "jobs.validate.steps[8] (Published CLI result and SARIF compatibility (no model calls))"
        },
        {
          "path": "github-action/package.json",
          "locator": "scripts.test:cli"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --input-type=module --eval '"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.release.steps[5] (Wait for the published npm package)"
        },
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.release.steps[7] (Verify the public npm package and signed provenance)"
        },
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.release.steps[11] (Resolve published release history)"
        },
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.release.steps[12] (Publish GitHub Release and generated notes)"
        },
        {
          "path": ".github/workflows/node-release-cut.yml",
          "locator": "jobs.cut.steps[2] (Resolve the stable package version)"
        },
        {
          "path": ".github/workflows/node-release-labels.yml",
          "locator": "jobs.categorize.steps[0] (Categorize pull request without checking out its code)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --input-type=module --eval 'const sdk = await import(\"@openai/codex-security\")"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-release.yml",
          "locator": "jobs.verify.steps[16] (Smoke test package)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --run test:deterministic"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.eval-contracts.steps[6] (Test deterministic triage eval contracts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node .github/scripts/check-ci-results.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.ci.steps[1] (Require selected checks)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node .github/scripts/check_plugin_source_compatibility.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.plugin-source.steps[6] (Check plugin source compatibility)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node .github/scripts/select-ci-checks.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.classify-changes.steps[2] (Select required checks)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node .github/scripts/verify-pr-source.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.classify-changes.steps[1] (Verify pull request source)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node .github/scripts/verify-pr-source.mjs confirm-target"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.ci.steps[2] (Confirm pull request target)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node check.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/native-musl.yml",
          "locator": "jobs.primitives.steps[5] (Build and check musl artifact)"
        },
        {
          "path": ".github/workflows/native-unix.yml",
          "locator": "jobs.primitives.steps[7] (Build and verify macOS with Node.js 22)"
        },
        {
          "path": ".github/workflows/native-unix.yml",
          "locator": "jobs.primitives.steps[10] (Verify the same macOS artifact with Node.js 20)"
        },
        {
          "path": ".github/workflows/native-windows.yml",
          "locator": "jobs.primitives.steps[5] (Build and verify with Node.js 22)"
        },
        {
          "path": ".github/workflows/native-windows.yml",
          "locator": "jobs.primitives.steps[8] (Verify the same artifact with Node.js 20)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node docker/prepare-release-package.mjs $RUNNER_TEMP/scanner-artifacts/*.tgz $lock $RUNNER_TEMP/release-inputs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-validate.yml",
          "locator": "jobs.validate.steps[3] (Prepare the locked scanner package)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node plugins/codex-security/mcp-app/scripts/build_mcp_app.mjs --output plugins/codex-security/mcp --native host"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.eval-contracts.steps[8] (Build host plugin for Standard eval integration)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node proof-policy-windows.mjs build"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/native-windows.yml",
          "locator": "jobs.primitives.steps[5] (Build and verify with Node.js 22)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/apply-patches.mjs"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "github-action/package.json",
          "locator": "scripts.pretest"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/build.mjs --check"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/action-ci.yml",
          "locator": "jobs.validate.steps[3]"
        },
        {
          "path": "github-action/package.json",
          "locator": "scripts.validate"
        },
        {
          "path": "github-action/package.json",
          "locator": "scripts.check-dist"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-package.mjs ../../dist/*.tgz"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.compatibility.steps[6] (Inspect installed package)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-package.mjs ../../dist/*.tgz ../../plugins/codex-security/plugin-files.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.package.steps[6] (Inspect archive contents)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/generate-input-docs.mjs"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "github-action/package.json",
          "locator": "scripts.docs"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/generate-input-docs.mjs --check"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/action-ci.yml",
          "locator": "jobs.validate.steps[3]"
        },
        {
          "path": "github-action/package.json",
          "locator": "scripts.validate"
        },
        {
          "path": "github-action/package.json",
          "locator": "scripts.check-docs"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node sdk/typescript/scripts/check-plugin-source.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-ci.yml",
          "locator": "jobs.package.steps[1] (Check plugin source boundary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node sdk/typescript/scripts/release-automation.mjs initial-published-versions $version"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-release-cut.yml",
          "locator": "jobs.cut.steps[2] (Resolve the stable package version)"
        },
        {
          "path": ".github/workflows/node-release.yml",
          "locator": "jobs.verify.steps[7] (Validate release tag)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node sdk/typescript/scripts/release-automation.mjs release-history $RELEASE_TAG"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.release.steps[11] (Resolve published release history)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node sdk/typescript/scripts/release-automation.mjs release-mode $version"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-release-cut.yml",
          "locator": "jobs.cut.steps[2] (Resolve the stable package version)"
        },
        {
          "path": ".github/workflows/node-release.yml",
          "locator": "jobs.verify.steps[7] (Validate release tag)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node sdk/typescript/scripts/release-automation.mjs release-tag $GITHUB_REF_TYPE $GITHUB_REF $GITHUB_REF_NAME sdk/typescript/package.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-release.yml",
          "locator": "jobs.verify.steps[7] (Validate release tag)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node sdk/typescript/scripts/release-automation.mjs require-increase $version $previous_version >/dev/null"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-release-cut.yml",
          "locator": "jobs.cut.steps[2] (Resolve the stable package version)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node sdk/typescript/scripts/release-automation.mjs require-published-increase $version >/dev/null"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-release-cut.yml",
          "locator": "jobs.cut.steps[2] (Resolve the stable package version)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node sdk/typescript/scripts/release-automation.mjs validate-release-notes $RELEASE_VERSION $release_notes_file >/dev/null"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-release.yml",
          "locator": "jobs.verify.steps[8] (Validate reviewed release notes)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node sdk/typescript/scripts/release-automation.mjs validate-release-notes $version $release_notes_file >/dev/null"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-release-cut.yml",
          "locator": "jobs.cut.steps[2] (Resolve the stable package version)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node sdk/typescript/scripts/release-automation.mjs verify-github-publication $archive $RELEASE_VERSION $RELEASE_SHA $GITHUB_REPOSITORY $verified_run_id"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.release.steps[7] (Verify the public npm package and signed provenance)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node sdk/typescript/scripts/release-automation.mjs verify-provenance $archive $RELEASE_VERSION $RELEASE_SHA $GITHUB_REPOSITORY $RELEASE_RUN_ID"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.release.steps[7] (Verify the public npm package and signed provenance)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node sdk/typescript/scripts/release-automation.mjs verify-publication $archive $release_version $GITHUB_SHA"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-release.yml",
          "locator": "jobs.publish.steps[5] (Verify recovered npm release provenance)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node sdk/typescript/scripts/release-automation.mjs verify-publication ${published_archives[0]} $RELEASE_VERSION $GITHUB_SHA"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-release.yml",
          "locator": "jobs.verify.steps[15] (Recover the published npm release archive)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node sdk/typescript/scripts/release-automation.mjs verify-recovered-provenance $archive $RELEASE_VERSION $RELEASE_SHA $GITHUB_REPOSITORY"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.release.steps[7] (Verify the public npm package and signed provenance)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node sdk/typescript/scripts/release-automation.mjs verify-recovered-provenance $archive $release_version $GITHUB_SHA $GITHUB_REPOSITORY"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-release.yml",
          "locator": "jobs.publish.steps[5] (Verify recovered npm release provenance)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node sdk/typescript/scripts/release-pr.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-release-pr.yml",
          "locator": "jobs.preview.steps[2] (Preview the rolling release proposal)"
        },
        {
          "path": ".github/workflows/node-release-pr.yml",
          "locator": "jobs.reconcile.steps[3] (Reconcile the rolling release proposal)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node sdk/typescript/scripts/smoke-published-package.mjs $PUBLISHED_VERSION"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/published-install-smoke.yml",
          "locator": "jobs.install.steps[2] (Install and start the published package)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "publish and verify separately"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.complete.steps[0] (Summarize release channels)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "read -r tag_type tag_object <<< $existing_ref"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-release-cut.yml",
          "locator": "jobs.cut.steps[3] (Create the exact merged release tag)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "read -r tag_type tag_object <<< $tag_fields"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-release.yml",
          "locator": "jobs.publish.steps[6] (Revalidate protected release tag)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "read -r tag_type tag_object <<< $tag_ref"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.release.steps[4] (Resolve the successful protected release)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "rev-parse --verify refs/tags/npm-v$version^{commit})"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-release.yml",
          "locator": "jobs.source.steps[1] (Resolve the protected container release)"
        },
        {
          "path": ".github/workflows/wolfi-build.yml",
          "locator": "jobs.fixture.steps[2] (Exercise release staging on a known published scanner)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "run --rm codex-security:release-candidate --version)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-validate.yml",
          "locator": "jobs.validate.steps[10] (Verify native image)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sh docker/verify-container-release-version.sh $endpoint $VERSION $digest"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-publish.yml",
          "locator": "jobs.source.steps[4] (Verify an existing immutable container release)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sh docker/verify-container-release-version.sh orgs/${GITHUB_REPOSITORY_OWNER,,}/packages/container/codex-security $VERSION $MANIFEST_DIGEST"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-publish.yml",
          "locator": "jobs.promote.steps[3] (Recheck immutable version and select the latest tag)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sha256sum --check"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/workflow-quality.yml",
          "locator": "jobs.lint.steps[2] (Install actionlint)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "skopeo copy oci:$RUNNER_TEMP/public:scanner docker-daemon:codex-security:public-candidate"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-publish.yml",
          "locator": "jobs.manifest.steps[3] (Upload the approved index and verify its anonymous digest)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "skopeo inspect --no-creds --raw docker://$IMAGE:$1"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-publish.yml",
          "locator": "jobs.complete.steps[0]"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "skopeo inspect --no-creds --raw docker://$IMAGE:$TAG"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/publish-wolfi.yml",
          "locator": "jobs.publish.steps[6] (Promote only the verified Wolfi tag)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "skopeo inspect --raw $archive"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-validate.yml",
          "locator": "jobs.validate.steps[9] (Load the native image from the release artifact)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "skopeo inspect --raw oci:$RUNNER_TEMP/candidate/layout:wolfi > $manifest"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/publish-wolfi.yml",
          "locator": "jobs.publish.steps[1] (Check the public package, immutable tag and local artifacts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "skopeo inspect --raw oci:$RUNNER_TEMP/debian:scanner"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-publish.yml",
          "locator": "jobs.manifest.steps[3] (Upload the approved index and verify its anonymous digest)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "skopeo inspect --raw oci:$candidate/layout:wolfi > $manifest"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/wolfi-build.yml",
          "locator": "jobs.build.steps[7] (Prepare the tested digest for publication)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "throw The restricted policy proof did not report skipped symbolic links and verified directory identity."
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/native-windows.yml",
          "locator": "jobs.primitives.steps[6] (Verify Windows proofs without symbolic links)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "throw The restricted proof did not report skipped symbolic links and verified directory and junction coverage."
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/native-windows.yml",
          "locator": "jobs.primitives.steps[6] (Verify Windows proofs without symbolic links)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "throw new Error(Release latest status must be explicit.)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.release.steps[11] (Resolve published release history)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "verify_provenance container-release refs/heads/main"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-publish.yml",
          "locator": "jobs.source.steps[4] (Verify an existing immutable container release)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "verify_provenance container-release refs/tags/container-v$VERSION --source-digest $RELEASE_SHA"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-publish.yml",
          "locator": "jobs.source.steps[4] (Verify an existing immutable container release)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "verify_release_npm $(command -v npm)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/node-github-release.yml",
          "locator": "jobs.release.steps[3] (Verify npm on PATH)"
        },
        {
          "path": ".github/workflows/node-release.yml",
          "locator": "jobs.publish.steps[3] (Verify npm on PATH)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "verify_tag $VERSION $DEBIAN"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-publish.yml",
          "locator": "jobs.complete.steps[0]"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "verify_tag $VERSION-wolfi-amd64 $WOLFI"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/container-publish.yml",
          "locator": "jobs.complete.steps[0]"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}