{
  "repository": "openai/codex",
  "ref": "71a4c070369fb761e51fd71009107f398d9f0f81",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "clippy",
      "method": "static_analysis",
      "commands": [
        "cargo clippy --target $EXPR --tests --profile $EXPR --timings -- -D warnings",
        "cargo clippy --fix --tests --allow-dirty {args}",
        "cargo clippy --tests {args}"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-ci-full.yml",
          "locator": "jobs.lint_build.steps[19] (cargo clippy)"
        },
        {
          "path": ".github/workflows/rust-ci-full.yml",
          "locator": "jobs.lint_build_musl.steps[19] (cargo clippy)"
        },
        {
          "path": "justfile",
          "locator": "recipe fix (line 57)"
        },
        {
          "path": "justfile",
          "locator": "recipe clippy (line 60)"
        },
        {
          "path": "codex-rs/clippy.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/rust-lang/rust-clippy",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "eslint",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "sdk/typescript/eslint.config.js",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/eslint/eslint",
      "docs": "https://eslint.org/docs/latest/use/command-line-interface#exit-codes",
      "exit_codes": {
        "0": "no errors",
        "1": "linting errors found",
        "2": "configuration problem or internal error"
      },
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": "ruff-check",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "ruff.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/astral-sh/ruff",
      "docs": "https://docs.astral.sh/ruff/linter/#exit-codes",
      "exit_codes": {
        "0": "no violations",
        "1": "violations found",
        "2": "invalid configuration, CLI options or internal error"
      },
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": "cargo-test",
      "method": "testing",
      "commands": [
        "cargo nextest --tool-config-file codex-voice:$CODEX_VOICE_NEXTEST_CONFIG archive --target ${CODEX_CI_TARGET} --cargo-profile ${CODEX_CI_PROFILE} --timings --archive-file ${archive_dir}/${NEXTEST_ARCHIVE_FILE}",
        "cargo nextest ${nextest_args[@]}",
        "cargo test -p codex-v8-poc --target ${TARGET} --features sandbox --no-run"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-ci-full-nextest-platform.yml",
          "locator": "jobs.archive.steps[14] (Build nextest archive)"
        },
        {
          "path": ".github/workflows/rust-ci-full-nextest-platform.yml",
          "locator": "jobs.shard.steps[8] (tests)"
        },
        {
          "path": ".github/workflows/rusty-v8-release.yml",
          "locator": "jobs.build-windows-source.steps[15] (Smoke link staged artifact with Cargo)"
        },
        {
          "path": ".github/workflows/v8-canary.yml",
          "locator": "jobs.build-windows-source.steps[16] (Smoke link staged artifact with Cargo)"
        }
      ],
      "upstream": "https://github.com/rust-lang/cargo",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "ci-matrix",
      "method": "testing",
      "commands": [
        "test-windows-shard (shard: 4)",
        "shard (shard: 4)",
        "lint_build (include: 9)",
        "lint_build_musl (include: 4)",
        "verify (build-system: 1, target: 2, include: 2)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bazel.yml",
          "locator": "jobs.test-windows-shard.strategy.matrix"
        },
        {
          "path": ".github/workflows/rust-ci-full-nextest-platform.yml",
          "locator": "jobs.shard.strategy.matrix"
        },
        {
          "path": ".github/workflows/rust-ci-full.yml",
          "locator": "jobs.lint_build.strategy.matrix"
        },
        {
          "path": ".github/workflows/rust-ci-full.yml",
          "locator": "jobs.lint_build_musl.strategy.matrix"
        },
        {
          "path": ".github/workflows/rust-release-provisioned-macos.yml",
          "locator": "jobs.verify.strategy.matrix"
        },
        {
          "path": ".github/workflows/rusty-v8-release.yml",
          "locator": "jobs.build-windows-source.strategy.matrix"
        },
        {
          "path": ".github/workflows/v8-canary.yml",
          "locator": "jobs.build-windows-source.strategy.matrix"
        }
      ],
      "upstream": "https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "pytest",
      "method": "testing",
      "commands": [
        "pytest -v --compression gzip --package-target $TARGET --cli-archive $CODEX_REPO_ROOT/verified/codex-provisioned-package-$TARGET$ARTIFACT_SUFFIX.tar.gz --app-server-archive $CODEX_REPO_ROOT/app-server/codex-app-server-package-$TARGET$ARTIFACT_SUFFIX.tar.gz --symbols-archive $CODEX_REPO_ROOT/symbols/codex-symbols-$TARGET$ARTIFACT_SUFFIX.tar.gz test_codex_package.py -k not debug_symbols"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release-provisioned-macos.yml",
          "locator": "jobs.verify.steps[9] (Test the exact verified package, including sandboxed code mode)"
        }
      ],
      "upstream": "https://github.com/pytest-dev/pytest",
      "docs": "https://docs.pytest.org/en/stable/reference/exit-codes.html",
      "exit_codes": {
        "0": "all tests passed",
        "1": "some tests failed",
        "2": "interrupted by the user",
        "3": "internal error",
        "4": "command line usage error",
        "5": "no tests were collected"
      },
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "unittest",
      "method": "testing",
      "commands": [
        "unittest discover -s .github/scripts -p test_select_windows_bazel_targets.py",
        "unittest discover -s .github/scripts -p test_resolve_python_cli_release.py",
        "unittest discover -s .github/scripts -p test_releases.py",
        "unittest discover -s .github/scripts -p test_verify_pypi_release.py",
        "unittest discover -s scripts/codex_package -p test_*.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bazel.yml",
          "locator": "jobs.test-windows-shard.steps[2] (Test Windows Bazel target selector)"
        },
        {
          "path": ".github/workflows/repo-checks.yml",
          "locator": "jobs.build-test.steps[6] (Test downstream Python release resolution)"
        },
        {
          "path": ".github/workflows/repo-checks.yml",
          "locator": "jobs.build-test.steps[7] (Test release version comparison)"
        },
        {
          "path": ".github/workflows/repo-checks.yml",
          "locator": "jobs.build-test.steps[8] (Test PyPI release verification)"
        },
        {
          "path": ".github/workflows/repo-checks.yml",
          "locator": "jobs.build-test.steps[9] (Test Codex package builder)"
        },
        {
          "path": ".github/workflows/repo-checks.yml",
          "locator": "jobs.build-test.steps[10] (Test standalone installer)"
        },
        {
          "path": ".github/workflows/repo-checks.yml",
          "locator": "jobs.build-test.steps[11] (Test macOS signing and notarization)"
        },
        {
          "path": ".github/workflows/rust-ci-full.yml",
          "locator": "jobs.argument_comment_lint_package.steps[6] (Test Python wrapper helpers)"
        },
        {
          "path": ".github/workflows/rust-ci.yml",
          "locator": "jobs.argument_comment_lint_package.steps[7] (Test Python wrapper helpers)"
        }
      ],
      "upstream": "https://github.com/python/cpython",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "jest",
      "method": "testing",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "sdk/typescript/jest.config.cjs",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/jestjs/jest",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": true
    },
    {
      "tool": "codespell",
      "method": "formatting",
      "commands": [
        "uses codespell-project/actions-codespell"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/codespell.yml",
          "locator": "jobs.codespell.steps[2] (Codespell)"
        },
        {
          "path": ".codespellrc",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/codespell-project/codespell",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "prettier",
      "method": "formatting",
      "commands": [
        "prettier --check *.json *.md docs/*.md .github/workflows/*.yml **/*.js",
        "prettier --write *.json *.md docs/*.md .github/workflows/*.yml **/*.js"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/repo-checks.yml",
          "locator": "jobs.build-test.steps[18] (Prettier (run `pnpm run format:fix` to fix))"
        },
        {
          "path": "package.json",
          "locator": "scripts.format"
        },
        {
          "path": "package.json",
          "locator": "scripts.format:fix"
        },
        {
          "path": "package.json",
          "locator": "devDependencies: prettier"
        },
        {
          "path": "sdk/typescript/.prettierrc",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/prettier/prettier",
      "docs": "https://prettier.io/docs/cli#exit-codes",
      "exit_codes": {
        "0": "everything formatted",
        "1": "something was not formatted (--check)",
        "2": "prettier error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "rustfmt",
      "method": "formatting",
      "commands": [
        "cargo fmt -- --config imports_granularity=Item --check"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-ci-full.yml",
          "locator": "jobs.general.steps[3] (cargo fmt)"
        },
        {
          "path": ".github/workflows/rust-ci.yml",
          "locator": "jobs.general.steps[3] (cargo fmt)"
        },
        {
          "path": "codex-rs/rustfmt.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/rust-lang/rustfmt",
      "docs": null,
      "exit_codes": {},
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "cargo-deny",
      "method": "supply_chain",
      "commands": [
        "uses EmbarkStudios/cargo-deny-action"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cargo-deny.yml",
          "locator": "jobs.cargo-deny.steps[3] (Run cargo-deny)"
        },
        {
          "path": "codex-rs/deny.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/EmbarkStudios/cargo-deny",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Format-Table -AutoSize Name, @{Name=Size(GB)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release-windows.yml",
          "locator": "jobs.build-windows-binaries.steps[2] (Print runner specs (Windows))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "New-Item -ItemType Directory -Path $directory"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release-windows.yml",
          "locator": "jobs.build-windows-voice.steps[5] (Download pinned Windows build inputs)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "New-Item -ItemType Directory -Path $package"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release-windows.yml",
          "locator": "jobs.build-windows.steps[14] (Verify packaged executor signatures and bytes)"
        },
        {
          "path": ".github/workflows/rust-release-windows.yml",
          "locator": "jobs.build-windows.steps[15] (Verify packaged Windows voice closure)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "api \"repos/$GITHUB_REPOSITORY/contents/codex-rs/Cargo.toml?ref=latest-alpha-cli\" -H 'Accept: application/vnd.github.raw+json'"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.update-branch.steps[1] (Determine whether to update the GitHub canary branch)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "api \"repos/${GITHUB_REPOSITORY}/releases/latest\""
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.release.steps[8] (Define release name)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash ./test-with-clippy-compat.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-ci-full.yml",
          "locator": "jobs.argument_comment_lint_package.steps[7] (Test argument comment lint package)"
        },
        {
          "path": ".github/workflows/rust-ci.yml",
          "locator": "jobs.argument_comment_lint_package.steps[8] (Test argument comment lint package)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bazel test --compilation_mode=fastbuild --@rules_rust//rust/settings:extra_rustc_flag=-Cdebug-assertions=no --@rules_rust//rust/settings:extra_exec_rustc_flag=-Cdebug-assertions=no --cache_test_results=no --test_output=streamed --test_arg=--test //codex-rs:e2e-benchmarks"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe bench-e2e-smoke (line 115)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bazel test --compilation_mode=opt --cache_test_results=no --test_output=streamed //codex-rs:e2e-benchmarks"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe bench-e2e (line 109)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bazel test --test_tag_filters=-argument-comment-lint //... --keep_going"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe bazel-test (line 156)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cargo run -p codex-app-server-test-client -- --codex-bin ./target/debug/codex {args}"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe app-server-test-client (line 45)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "codesign --verify --strict --verbose=2 $binary"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.package-macos.steps[4] (Verify signed voice runtime)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "codesign --verify --strict --verbose=2 $binary_path"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.package-macos.steps[5] (Verify signed macOS binaries)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "codesign --verify --strict --verbose=2 $dmg_path"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.finalize-macos.steps[4] (Verify signed macOS artifacts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "codesign --verify --strict --verbose=2 $library"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.finalize-macos.steps[4] (Verify signed macOS artifacts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "codesign --verify --strict --verbose=2 $path"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.finalize-macos.steps[4] (Verify signed macOS artifacts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "codesign --verify --strict --verbose=2 $resource"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.finalize-macos.steps[4] (Verify signed macOS artifacts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "codesign --verify --strict --verbose=2 $resource_path"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.package-macos.steps[5] (Verify signed macOS binaries)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "codesign --verify --strict --verbose=2 $root/codex-voice-host"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.package-macos.steps[4] (Verify signed voice runtime)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "else \\"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe argument-comment-lint (line 187)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "hdiutil verify $dmg_path"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.finalize-macos.steps[4] (Verify signed macOS artifacts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "lipo $binary -verify_arch $arch"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.package-macos.steps[4] (Verify signed voice runtime)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "lipo $library -verify_arch $expected_arch"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.finalize-macos.steps[4] (Verify signed macOS artifacts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "lipo $path -verify_arch $expected_arch"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.finalize-macos.steps[4] (Verify signed macOS artifacts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "lipo $resource -verify_arch $expected_arch"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.finalize-macos.steps[4] (Verify signed macOS artifacts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "lipo $root/codex-voice-host -verify_arch $arch"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.package-macos.steps[4] (Verify signed voice runtime)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "nextest ${nextest_args[@]})"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-ci-full-nextest-platform.yml",
          "locator": "jobs.shard.steps[8] (tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "py_compile tools/argument-comment-lint/wrapper_common.py tools/argument-comment-lint/run.py tools/argument-comment-lint/run-prebuilt-linter.py tools/argument-comment-lint/test_wrapper_common.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-ci-full.yml",
          "locator": "jobs.argument_comment_lint_package.steps[5] (Check Python wrapper syntax)"
        },
        {
          "path": ".github/workflows/rust-ci.yml",
          "locator": "jobs.argument_comment_lint_package.steps[6] (Check Python wrapper syntax)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python .github/scripts/check_ci_results.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/blocking-ci.yml",
          "locator": "jobs.required.steps[1] (Require successful dependencies)"
        },
        {
          "path": ".github/workflows/postmerge-ci.yml",
          "locator": "jobs.results.steps[1] (Require successful dependencies)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python .github/scripts/macos-signing/sign_macos_cli_package.py verify package ${profile_args[@]}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release-provisioned-macos.yml",
          "locator": "jobs.verify.steps[4] (Verify signatures, profile, architecture, stapling and Gatekeeper)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python .github/scripts/rusty_v8_bazel.py check-module-bazel"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bazel.yml",
          "locator": "jobs.test.steps[2] (Check rusty_v8 MODULE.bazel checksums)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python .github/scripts/test_run_bazel_with_buildbuddy.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bazel.yml",
          "locator": "jobs.test-windows-shard.steps[1] (Test Bazel command wrapper)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python .github/scripts/verify_bazel_clippy_lints.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/repo-checks.yml",
          "locator": "jobs.build-test.steps[4] (Verify Bazel clippy flags match Cargo workspace lints)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python .github/scripts/verify_cargo_workspace_manifests.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/repo-checks.yml",
          "locator": "jobs.build-test.steps[2] (Verify codex-rs Cargo manifests inherit workspace settings)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python .github/scripts/verify_pypi_release.py openai-codex $SDK_VERSION"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/python-sdk-cli-release.yml",
          "locator": "jobs.publish-python-sdk.steps[4] (Verify Python SDK is available on PyPI)"
        },
        {
          "path": ".github/workflows/python-sdk-release.yml",
          "locator": "jobs.publish-python-sdk.steps[4] (Verify Python SDK is available on PyPI)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python .github/scripts/verify_pypi_release.py openai-codex-cli-bin $PYTHON_RUNTIME_VERSION"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/python-runtime-release.yml",
          "locator": "jobs.publish-python-runtime.steps[4] (Verify Python runtime wheels are available on PyPI)"
        },
        {
          "path": ".github/workflows/python-sdk-cli-release.yml",
          "locator": "jobs.publish-python-runtime.steps[4] (Verify Python runtime wheels are available on PyPI)"
        },
        {
          "path": ".github/workflows/python-sdk-release.yml",
          "locator": "jobs.publish-python-runtime.steps[4] (Verify Python runtime wheels are available on PyPI)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python .github/scripts/verify_tui_core_boundary.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/repo-checks.yml",
          "locator": "jobs.build-test.steps[3] (Verify codex-tui does not import codex-core directly)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check_blob_size.py --base $BASE_SHA --head $HEAD_SHA --max-bytes 512000 --allowlist .github/blob-size-allowlist.txt"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/blob-size-policy.yml",
          "locator": "jobs.check.steps[3] (Check changed blob sizes)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "rust_min_stack }} NEXTEST_PROFILE=local cargo nextest run --no-fail-fast $@"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe test (line 87)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "spctl --assess --type execute --verbose=4 package/CodexCLI.app"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release-provisioned-macos.yml",
          "locator": "jobs.verify.steps[4] (Verify signatures, profile, architecture, stapling and Gatekeeper)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "spec = TARGET_SPECS[sys.argv[1]]"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.sign-macos-binaries.steps[5] (Fetch, sign, and notarize pinned macOS helpers)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "twine check --strict dist/python-sdk/*"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/python-sdk-build.yml",
          "locator": "jobs.build-python-sdk.steps[4] (Build Python SDK package)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "type == \"array\")' >/dev/null 2>&1"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/issue-deduplicator.yml",
          "locator": "jobs.normalize-duplicates-all.steps[0] (Normalize pass 1 output)"
        },
        {
          "path": ".github/workflows/issue-deduplicator.yml",
          "locator": "jobs.normalize-duplicates-open.steps[0] (Normalize pass 2 output)"
        },
        {
          "path": ".github/workflows/issue-labeler.yml",
          "locator": "jobs.apply-labels.steps[0] (Apply labels)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "verify_signed_binary $binary_path $binary"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.finalize-macos.steps[4] (Verify signed macOS artifacts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "verify_signed_binary $direct_zstd_path $binary"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.finalize-macos.steps[4] (Verify signed macOS artifacts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "verify_signed_binary $helper codex-voice-host"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.finalize-macos.steps[4] (Verify signed macOS artifacts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "verify_signed_binary ${direct_archive_dir}/${binary}-${target} $binary"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.finalize-macos.steps[4] (Verify signed macOS artifacts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "verify_signed_binary ${mount_dir}/${binary} $binary"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.finalize-macos.steps[4] (Verify signed macOS artifacts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "verify_signed_binary ${package_dir}/bin/${package_entrypoint} $package_entrypoint"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.finalize-macos.steps[4] (Verify signed macOS artifacts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "verify_signed_binary ${package_dir}/bin/codex-code-mode-host codex-code-mode-host"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.finalize-macos.steps[4] (Verify signed macOS artifacts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "verify_signed_binary ${package_dir}/bin/codex-exec-server codex-exec-server"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/rust-release.yml",
          "locator": "jobs.finalize-macos.steps[4] (Verify signed macOS artifacts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}