{
  "repository": "QwenLM/qwen-code",
  "ref": "815c1d376833ceaf2d7b1439bf46be1bfce28c95",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "codeql",
      "method": "static_analysis",
      "commands": [
        "uses github/codeql-action/analyze"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/codeql.yml",
          "locator": "jobs.codeql.steps[2] (Perform CodeQL Analysis)"
        }
      ],
      "upstream": "https://github.com/github/codeql",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "eslint",
      "method": "static_analysis",
      "commands": [
        "eslint . --ext .ts,.tsx --max-warnings 0",
        "eslint integration-tests --max-warnings 0",
        "eslint . --ext .ts,.tsx",
        "eslint integration-tests",
        "eslint . --fix"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.quality_static.steps[7] (Run Lint)"
        },
        {
          "path": "package.json",
          "locator": "scripts.lint:ci"
        },
        {
          "path": "Makefile",
          "locator": "target lint (line 36)"
        },
        {
          "path": "package.json",
          "locator": "scripts.lint"
        },
        {
          "path": "Makefile",
          "locator": "target preflight (line 42)"
        },
        {
          "path": "package.json",
          "locator": "scripts.preflight"
        },
        {
          "path": "package.json",
          "locator": "scripts.lint:fix"
        },
        {
          "path": "package.json",
          "locator": "devDependencies: eslint"
        },
        {
          "path": "eslint.config.js",
          "locator": "config file"
        },
        {
          "path": "packages/mobile-mcp/eslint.config.mjs",
          "locator": "config file"
        },
        {
          "path": "packages/vscode-ide-companion/eslint.config.mjs",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/eslint/eslint",
      "docs": "https://eslint.org/docs/latest/use/command-line-interface#exit-codes",
      "exit_codes": {
        "0": "no errors",
        "1": "linting errors found",
        "2": "configuration problem or internal error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "mypy",
      "method": "static_analysis",
      "commands": [
        "mypy --config-file packages/sdk-python/pyproject.toml packages/sdk-python/src"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-sdk-python.yml",
          "locator": "jobs.release-sdk-python.steps[10] (Run Python quality gates)"
        },
        {
          "path": ".github/workflows/sdk-python.yml",
          "locator": "jobs.sdk-python.steps[5] (Run Mypy)"
        },
        {
          "path": "package.json",
          "locator": "scripts.typecheck:sdk:python"
        }
      ],
      "upstream": "https://github.com/python/mypy",
      "docs": "https://mypy.readthedocs.io/en/stable/command_line.html",
      "exit_codes": {
        "0": "no type errors",
        "1": "type errors found",
        "2": "crash or invalid invocation"
      },
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "ruff-check",
      "method": "static_analysis",
      "commands": [
        "ruff check --config packages/sdk-python/pyproject.toml packages/sdk-python"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-sdk-python.yml",
          "locator": "jobs.release-sdk-python.steps[10] (Run Python quality gates)"
        },
        {
          "path": ".github/workflows/sdk-python.yml",
          "locator": "jobs.sdk-python.steps[3] (Run Ruff)"
        },
        {
          "path": "package.json",
          "locator": "scripts.lint:sdk:python"
        }
      ],
      "upstream": "https://github.com/astral-sh/ruff",
      "docs": "https://docs.astral.sh/ruff/linter/#exit-codes",
      "exit_codes": {
        "0": "no violations",
        "1": "violations found",
        "2": "invalid configuration, CLI options or internal error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "tsc",
      "method": "static_analysis",
      "commands": [
        "tsc -p integration-tests/tsconfig.json --pretty false"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.verify-node-repl-package.steps[8] (Test standalone Node REPL package)"
        },
        {
          "path": "package.json",
          "locator": "scripts.typecheck"
        },
        {
          "path": "package.json",
          "locator": "scripts.typecheck:integration"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.integration_no_ak.steps[12] (Run required no-AK integration gate)"
        },
        {
          "path": ".github/workflows/live-host-release.yml",
          "locator": "jobs.build.steps[4] (Test Live Host)"
        },
        {
          "path": ".github/workflows/live-host.yml",
          "locator": "jobs.test.steps[3] (Typecheck Live Host)"
        },
        {
          "path": ".github/workflows/release-chrome-extension.yml",
          "locator": "jobs.build.steps[5] (Run Tests)"
        },
        {
          "path": ".github/workflows/release-managed-runtime.yml",
          "locator": "jobs.release.steps[6] (Build the matching CLI prerequisites)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.quality_typecheck.steps[8] (Typecheck Project)"
        },
        {
          "path": "Makefile",
          "locator": "target preflight (line 42)"
        },
        {
          "path": "package.json",
          "locator": "scripts.preflight"
        }
      ],
      "upstream": "https://github.com/microsoft/TypeScript",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "cargo-test",
      "method": "testing",
      "commands": [
        "cargo test -p cua-driver-core --locked model_payload",
        "cargo test --manifest-path src-tauri/Cargo.toml"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.validate-version.steps[3] (Test model payload filtering)"
        },
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.desktop_shell.steps[6] (Compile and test the desktop crate)"
        }
      ],
      "upstream": "https://github.com/rust-lang/cargo",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "ci-matrix",
      "method": "testing",
      "commands": [
        "web_shell_e2e_smoke (shard: 4)",
        "codeql (include: 3)",
        "desktop_shell (os: 2)",
        "build (include: 7)",
        "sdk-python (python-version: 3)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.web_shell_e2e_smoke.strategy.matrix"
        },
        {
          "path": ".github/workflows/codeql.yml",
          "locator": "jobs.codeql.strategy.matrix"
        },
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.desktop_shell.strategy.matrix"
        },
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.build.strategy.matrix"
        },
        {
          "path": ".github/workflows/sdk-python.yml",
          "locator": "jobs.sdk-python.strategy.matrix"
        },
        {
          "path": ".github/workflows/tui-parity.yml",
          "locator": "jobs.installed-distribution.strategy.matrix"
        }
      ],
      "upstream": "https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "node-test",
      "method": "testing",
      "commands": [
        "node --test --test-concurrency=1 $EXPR",
        "node --test --test-concurrency=1 $EXPR 2>&1",
        "node --test scripts/tests/package-managed-agent-reference.test.mjs scripts/tests/managed-agent-upgrade.test.mjs scripts/tests/generate-managed-agent-configuration-reference.test.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[22] (GitHub CI helper checks)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[41] (Run .github/scripts helper tests)"
        },
        {
          "path": ".github/workflows/release-managed-agent-reference.yml",
          "locator": "jobs.build.steps[12] (Test the packager and the upgrade command)"
        }
      ],
      "upstream": "https://github.com/nodejs/node",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "playwright",
      "method": "testing",
      "commands": [
        "playwright test test/coord-norm.test.ts test/mobile-ui-dump.test.ts test/payload-filter.test.ts test/server-payload-filter.test.ts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-mobile-mcp.yml",
          "locator": "jobs.build-and-publish.steps[7] (Test)"
        },
        {
          "path": "packages/mobile-mcp/playwright.config.ts",
          "locator": "config file"
        },
        {
          "path": "packages/web-shell/playwright.config.ts",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/microsoft/playwright",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "pytest",
      "method": "testing",
      "commands": [
        "pytest -c packages/sdk-python/pyproject.toml packages/sdk-python/tests -q"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-sdk-python.yml",
          "locator": "jobs.release-sdk-python.steps[10] (Run Python quality gates)"
        },
        {
          "path": ".github/workflows/sdk-python.yml",
          "locator": "jobs.sdk-python.steps[6] (Run Pytest)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:sdk:python"
        }
      ],
      "upstream": "https://github.com/pytest-dev/pytest",
      "docs": "https://docs.pytest.org/en/stable/reference/exit-codes.html",
      "exit_codes": {
        "0": "all tests passed",
        "1": "some tests failed",
        "2": "interrupted by the user",
        "3": "internal error",
        "4": "command line usage error",
        "5": "no tests were collected"
      },
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "vitest",
      "method": "testing",
      "commands": [
        "vitest run --root ./integration-tests ./chat-transcript-document.test.ts --retry=0",
        "vitest run --config ./scripts/tests/vitest.config.ts",
        "vitest run scripts/tests/install-script.test.js scripts/tests/opentui-preview-install.test.js --config scripts/tests/vitest.config.ts --retry=0 --bail=1 --maxWorkers=1 --minWorkers=1 --dangerouslyIgnoreUnhandledErrors=false",
        "vitest run --root ./integration-tests --poolOptions.forks.maxForks 2 sdk-typescript",
        "vitest run helpers/hosted-relay-headers.test.ts"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.web_shell_e2e_smoke.steps[21] (Run transcript document browser gate)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_windows.steps[12] (Run tests and generate reports)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:scripts"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:scripts:unit"
        },
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.build.steps[21] (Run desktop release tests)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:release"
        },
        {
          "path": ".github/workflows/e2e.yml",
          "locator": "jobs.web-shell-browser-regression.steps[6] (Run transcript document browser gate)"
        },
        {
          "path": ".github/workflows/release-chrome-extension.yml",
          "locator": "jobs.build.steps[5] (Run Tests)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:ci"
        },
        {
          "path": ".github/workflows/release-sdk.yml",
          "locator": "jobs.build-sdk.steps[16] (Run Tests)"
        },
        {
          "path": ".github/workflows/release-sdk.yml",
          "locator": "jobs.build-sdk.steps[17] (Run SDK Integration Tests)"
        },
        {
          "path": ".github/workflows/release-sdk.yml",
          "locator": "jobs.release-sdk.steps[16] (Run Tests)"
        }
      ],
      "upstream": "https://github.com/vitest-dev/vitest",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "prettier",
      "method": "formatting",
      "commands": [
        "prettier --experimental-cli --write ."
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target format (line 39)"
        },
        {
          "path": "package.json",
          "locator": "scripts.format"
        },
        {
          "path": "Makefile",
          "locator": "target preflight (line 42)"
        },
        {
          "path": "package.json",
          "locator": "scripts.preflight"
        },
        {
          "path": "package.json",
          "locator": "devDependencies: prettier"
        },
        {
          "path": ".prettierrc.json",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/prettier/prettier",
      "docs": "https://prettier.io/docs/cli#exit-codes",
      "exit_codes": {
        "0": "everything formatted",
        "1": "something was not formatted (--check)",
        "2": "prettier error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "ruff-format",
      "method": "formatting",
      "commands": [
        "ruff format --check --config packages/sdk-python/pyproject.toml packages/sdk-python"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-sdk-python.yml",
          "locator": "jobs.release-sdk-python.steps[10] (Run Python quality gates)"
        },
        {
          "path": ".github/workflows/sdk-python.yml",
          "locator": "jobs.sdk-python.steps[4] (Run Ruff Format)"
        }
      ],
      "upstream": "https://github.com/astral-sh/ruff",
      "docs": "https://docs.astral.sh/ruff/formatter/#exit-codes",
      "exit_codes": {
        "0": "already formatted",
        "1": "files would be reformatted (--check)",
        "2": "error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Check"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/qwen-triage-finalize.yml",
          "locator": "jobs.finalize.steps[0] (Finalize CI evidence and deferred approval)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "NOOP_NOTICE_GRACE_SEC / 60 ))"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/qwen-fleet-shepherd.yml",
          "locator": "jobs.shepherd.steps[0] (Shepherd the fleet)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "New-Item -ItemType Directory -Force -Path $root"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/windows-runner-smoke.yml",
          "locator": "jobs.validate.steps[5] (Verify symbolic links)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "New-Item -ItemType Directory -Force -Path $temp"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_windows.steps[3] (Point temp at a short-alias-free directory)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "New-Item -ItemType Directory -Force -Path release/$stage"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.build-windows.steps[9] (Package)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "New-Item -ItemType Directory -Path $consumer"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.build-windows.steps[11] (Clean-install Windows SDK from packaged payload)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "New-Item -ItemType SymbolicLink -Path $link -Target $target"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/windows-runner-smoke.yml",
          "locator": "jobs.validate.steps[5] (Verify symbolic links)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "SECONDS + RESOLVE_TIMEOUT_SECONDS ))"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/update-ecs-runner-qwen.yml",
          "locator": "jobs.resolve.steps[0] (Resolve version)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "api \"repos/${REPO}/commits/${HEAD_SHA}/check-runs?check_name=Managed%20Agent%20gate&per_page=100\" --jq '.check_runs[]"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/managed-agent-gate.yml",
          "locator": "jobs.scope.steps[5] (Choose the tier)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "asset.sha256 !== checksum) throw new Error(`Manifest asset verification failed for ${architecture}.`)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sync-live-host-to-oss.yml",
          "locator": "jobs.sync.steps[4] (Verify release assets)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "asset.sha256 !== checksum) throw new Error(`Mirrored asset verification failed for ${architecture}.`)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sync-live-host-to-oss.yml",
          "locator": "jobs.sync.steps[8] (Verify versioned assets on Aliyun OSS)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "audit corepack pnpm audit --prod --audit-level high"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/security-checks.yml",
          "locator": "jobs.dependency-cve.steps[2] (Audit production dependencies)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "audit npm audit --omit=dev --audit-level=high --workspaces=false"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/security-checks.yml",
          "locator": "jobs.dependency-cve.steps[2] (Audit production dependencies)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash ../../.github/scripts/verify-managed-agent-embedding.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.mysql-integration.steps[14] (Verify ordinary and enabled embedding hosts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash .github/scripts/check-disk-floor.sh ${GITHUB_WORKSPACE} ${RUNNER_TEMP:-/tmp}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_build.steps[12] (Disk floor gate (self-hosted))"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[13] (Disk floor gate (self-hosted))"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[19] (Disk floor gate (self-hosted))"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.web_shell_e2e_smoke.steps[10] (Disk floor gate (self-hosted))"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.integration_no_ak.steps[9] (Disk floor gate (self-hosted))"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.integration_cli.steps[8] (Disk floor gate (self-hosted))"
        },
        {
          "path": ".github/workflows/e2e.yml",
          "locator": "jobs.build.steps[7] (Disk floor gate (self-hosted))"
        },
        {
          "path": ".github/workflows/e2e.yml",
          "locator": "jobs.e2e-test-linux.steps[9] (Disk floor gate (self-hosted))"
        },
        {
          "path": ".github/workflows/release-managed-agent-reference.yml",
          "locator": "jobs.build.steps[9] (Check pool disk floor)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.prepare.steps[7] (Disk floor gate (self-hosted))"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.quality_static.steps[5] (Disk floor gate (self-hosted))"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.quality_build.steps[5] (Disk floor gate (self-hosted))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash .github/scripts/e2e-build-pack.sh ${RUNNER_TEMP}/e2e-build.tar.gz"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/e2e.yml",
          "locator": "jobs.build.steps[11] (Pack build outputs)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash .github/scripts/e2e-build-unpack.sh ${RUNNER_TEMP}/e2e-build/e2e-build.tar.gz"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/e2e.yml",
          "locator": "jobs.e2e-test-linux.steps[15] (Unpack build artifact)"
        },
        {
          "path": ".github/workflows/e2e.yml",
          "locator": "jobs.e2e-test-macos.steps[9] (Unpack build artifact)"
        },
        {
          "path": ".github/workflows/e2e.yml",
          "locator": "jobs.e2e-interactive-opentui.steps[10] (Unpack build artifact)"
        },
        {
          "path": ".github/workflows/e2e.yml",
          "locator": "jobs.isolated-nightly.steps[9] (Unpack build artifact)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash .github/scripts/ecs-runner/check-font-baseline.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.web_shell_e2e_smoke.steps[11] (Check host font baseline (self-hosted))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash .github/scripts/run-e2e-tests.sh $EXPR $EXPR"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/e2e.yml",
          "locator": "jobs.e2e-test-linux.steps[18] (Run E2E tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "checkout may fail on leftover read-only files\""
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/assign-issue-owner.yml",
          "locator": "jobs.assign.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/assign-pr-owner.yml",
          "locator": "jobs.assign.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/auto-minimize-spam.yml",
          "locator": "jobs.minimize.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.classify_pr.steps[2] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_build.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[1] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.web_shell_e2e_smoke.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.integration_no_ak.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.integration_cli.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/e2e.yml",
          "locator": "jobs.build.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/e2e.yml",
          "locator": "jobs.e2e-test-linux.steps[2] (Restore workspace ownership)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "checkout may fail on leftover root-owned files\""
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/assign-issue-owner.yml",
          "locator": "jobs.assign.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/assign-pr-owner.yml",
          "locator": "jobs.assign.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/auto-minimize-spam.yml",
          "locator": "jobs.minimize.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.classify_pr.steps[2] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_build.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[1] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.web_shell_e2e_smoke.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.integration_no_ak.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.integration_cli.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/e2e.yml",
          "locator": "jobs.build.steps[0] (Restore workspace ownership)"
        },
        {
          "path": ".github/workflows/e2e.yml",
          "locator": "jobs.e2e-test-linux.steps[2] (Restore workspace ownership)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cmp dist/desktop/desktop-latest.json $RUNNER_TEMP/desktop-latest.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sync-desktop-to-oss.yml",
          "locator": "jobs.sync.steps[11] (Verify latest manifest on Aliyun OSS)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "codesign --verify --deep --strict --verbose=2 $app"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.build.steps[27] (Verify macOS signature)"
        },
        {
          "path": ".github/workflows/live-host-release.yml",
          "locator": "jobs.build.steps[9] (Verify signing and notarization)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "codesign --verify --strict $file"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.build.steps[22] (Sign bundled vendor binaries (macOS))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "codesign --verify --strict --verbose=2 release/QwenCuaDriver.app"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.build-macos.steps[12] (Codesign + notarize + staple QwenCuaDriver.app (App Store Connect API key))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "codesign --verify --strict --verbose=2 release/universal/cua-cursor-theme"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.build-macos.steps[10] (Codesign universal binary (hardened runtime))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "codesign --verify --strict --verbose=2 release/universal/libcua_driver_sdk.dylib"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.build-macos.steps[10] (Codesign universal binary (hardened runtime))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "codesign --verify --strict --verbose=2 release/universal/qwen-cua-driver"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.build-macos.steps[10] (Codesign universal binary (hardened runtime))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "const checksum = createHash(sha256).update(readFileSync(file)).digest(hex)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sync-live-host-to-oss.yml",
          "locator": "jobs.sync.steps[4] (Verify release assets)"
        },
        {
          "path": ".github/workflows/sync-live-host-to-oss.yml",
          "locator": "jobs.sync.steps[8] (Verify versioned assets on Aliyun OSS)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "const linters = getLinters()"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[20] (Provision linters for real-binary tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env DEV=true npm run bundle"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[34] (Check serve fast-path bundle closure)"
        },
        {
          "path": "package.json",
          "locator": "scripts.check:serve-fast-path-bundle"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.quality_build.steps[7] (Check Serve Fast Path Bundle)"
        },
        {
          "path": "Makefile",
          "locator": "target preflight (line 42)"
        },
        {
          "path": "package.json",
          "locator": "scripts.preflight"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:chrome-extension:release"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env NODE_OPTIONS=--max-old-space-size=3072 npm run test --workspaces --if-present"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.verify-sdk-package.steps[7] (Test SDK and native loader)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test"
        },
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.verify-browser-package.steps[3] (Test and pack existing browser SDK)"
        },
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.verify-node-repl-package.steps[8] (Test standalone Node REPL package)"
        },
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.build.steps[20] (Run desktop tests)"
        },
        {
          "path": ".github/workflows/live-host-release.yml",
          "locator": "jobs.build.steps[4] (Test Live Host)"
        },
        {
          "path": ".github/workflows/live-host.yml",
          "locator": "jobs.test.steps[4] (Test Live Host)"
        },
        {
          "path": "Makefile",
          "locator": "target test (line 33)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env NODE_OPTIONS=--max-old-space-size=3072 npm run test:ci --workspaces --if-present --"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_windows.steps[12] (Run tests and generate reports)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:ci:workspaces"
        },
        {
          "path": ".github/workflows/release-chrome-extension.yml",
          "locator": "jobs.build.steps[5] (Run Tests)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:ci"
        },
        {
          "path": ".github/workflows/release-sdk.yml",
          "locator": "jobs.build-sdk.steps[16] (Run Tests)"
        },
        {
          "path": ".github/workflows/release-sdk.yml",
          "locator": "jobs.release-sdk.steps[16] (Run Tests)"
        },
        {
          "path": ".github/workflows/release-vscode-companion.yml",
          "locator": "jobs.prepare.steps[7] (Run Tests)"
        },
        {
          "path": ".github/workflows/windows-runner-smoke.yml",
          "locator": "jobs.validate.steps[10] (Run tests and generate reports)"
        },
        {
          "path": "Makefile",
          "locator": "target preflight (line 42)"
        },
        {
          "path": "package.json",
          "locator": "scripts.preflight"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env NODE_OPTIONS=--max-old-space-size=3072 npm run test:ci --workspaces --if-present -- --coverage.enabled=false"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.build.steps[21] (Run desktop release tests)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:release"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:release:workspaces"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:chrome-extension:release"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env QWEN_E2E_RENDERER=ink QWEN_E2E_RUNTIME=bun QWEN_SANDBOX=false vitest run --root ./integration-tests interactive"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.test:integration:interactive:bun-ink:sandbox:none"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env QWEN_E2E_RENDERER=ink VERBOSE=true KEEP_OUTPUT=true QWEN_SANDBOX=false vitest run --root ./integration-tests --exclude **/interactive/cron-interactive.test.ts --exclude **/channel-plugin.test.ts --exclude **/chat-transcript-document.test.ts --shard=$EXPR"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/e2e.yml",
          "locator": "jobs.e2e-test-macos.steps[10] (Run E2E tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env QWEN_E2E_RENDERER=opentui QWEN_SANDBOX=false vitest run --root ./integration-tests interactive"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.test:integration:interactive:opentui:sandbox:none"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env QWEN_E2E_RENDERER=opentui QWEN_SANDBOX=false vitest run --root ./integration-tests interactive --exclude **/interactive/cron-interactive.test.ts --exclude **/channel-plugin.test.ts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/e2e.yml",
          "locator": "jobs.e2e-interactive-opentui.steps[11] (Run interactive E2E tests (OpenTUI))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env QWEN_SANDBOX=docker npm run build:sandbox"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.test:integration:all"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:integration:sandbox:docker"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:integration:sdk:sandbox:docker"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:integration:cli:sandbox:docker"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:integration:interactive:sandbox:docker"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env QWEN_SANDBOX=false vitest run --root ./integration-tests"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.test:integration:all"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:integration:sandbox:none"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env QWEN_SANDBOX=false vitest run --root ./integration-tests $EXPR"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/e2e.yml",
          "locator": "jobs.isolated-nightly.steps[10] (Run ${{ matrix.label }} tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env QWEN_SANDBOX=false vitest run --root ./integration-tests --config ./vitest.hosted.config.ts"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_macos_shards.steps[5] (Hosted portable process smoke)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:integration:hosted:sandbox:none"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_windows.steps[13] (Hosted process suite)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env QWEN_SANDBOX=false vitest run --root ./integration-tests --poolOptions.forks.maxForks 2 ./fake-openai-server.test.ts ./test-helper.test.ts ./chat-transcript-contract.test.ts ./skill-hooks-invocation-parity.test.ts ./skill-hooks-resume.test.ts ./qwen-live-m4-acp-call.test.ts ./qwen-live-m4-acp-permission.test.ts ./qwen-live-m4-acp-steering.test.ts ./qwen-live-m4-acp-multibackend.test.ts ./qwen-live-m1-call.test.ts ./qwen-live-m2-inject.test.ts ./qwen-live-m2-permission.test.ts ./qwen-live-m2-steering.test.ts ./cli/_prompt-latency-policy.test.ts ./cli/agent-loop-parity.test.ts ./cli/acp-agent-loop-parity.test.ts ./cli/hosted-harness-process.test.ts ./cli/daemon-invocation-context.test.ts ./cli/headless-workflow-skill.test.ts ./cli/workflow-ancestor-discovery.test.ts ./cli/daemon-workflow-ancestor-trust.test.ts ./cli/workflow-intent.test.ts ./cli/workflow-mode.test.ts ./cli/acp-workflow-mode.test.ts ./cli/daemon-workflow-intent.test.ts ./cli/daemon-workflow-mode.test.ts ./cli/list_directory.test.ts ./cli/tool-hook-context.test.ts ./cli/tool-hook-updated-input.test.ts ./cli/qwen-serve-routes.test.ts ./cli/qwen-serve-session-cd.test.ts ./cli/qwen-serve-streaming.test.ts ./cli/qwen-serve-standalone-concurrency.test.ts ./helpers/hosted-sse-observer.test.ts ./interactive/workflow-completion.test.ts ./interactive/workflow-intent.test.ts ./interactive/workflow-mode.test.ts ./interactive/mods-tool-middleware.test.ts ./interactive/statusline-parity.test.ts ./interactive/tui-editor-parity.test.ts ./interactive/tui-input-ownership.test.ts ./interactive/ink-agent-loop-parity.test.ts ./sdk-typescript/abort-and-lifecycle.test.ts ./sdk-typescript/permission-control.test.ts ./sdk-typescript/sdk-mcp-server.test.ts ./sdk-typescript/subagents.test.ts ./sdk-typescript/system-control.test.ts ./sdk-typescript/tool-control.test.ts ./sdk-typescript/workflow-intent.test.ts ./sdk-typescript/workflow-mode.test.ts"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.integration_no_ak.steps[12] (Run required no-AK integration gate)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:integration:no-ak:sandbox:none"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env QWEN_SANDBOX=false vitest run --root ./integration-tests --poolOptions.forks.maxForks 2 sdk-typescript"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-sdk.yml",
          "locator": "jobs.build-sdk.steps[17] (Run SDK Integration Tests)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:integration:sdk:sandbox:none"
        },
        {
          "path": ".github/workflows/release-sdk.yml",
          "locator": "jobs.release-sdk.steps[17] (Run SDK Integration Tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env QWEN_SANDBOX=false vitest run --root ./integration-tests cli"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.integration_cli.steps[11] (Run CLI Integration Tests)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:integration:cli:sandbox:none"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.integration_none.steps[7] (Run CLI Integration Tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env QWEN_SANDBOX=false vitest run --root ./integration-tests interactive"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.integration_none.steps[8] (Run Interactive Integration Tests)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:integration:interactive:sandbox:none"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env QWEN_SANDBOX=podman vitest run --root ./integration-tests"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.test:integration:all"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:integration:sandbox:podman"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env VERBOSE=true KEEP_OUTPUT=true npm run test:integration:sandbox:none"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/e2e.yml",
          "locator": "jobs.web-shell-browser-regression.steps[7] (Run web-shell browser regression)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env VERBOSE=true KEEP_OUTPUT=true vitest run --config ./vitest.terminal-bench.config.ts --root ./integration-tests"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.test:terminal-bench"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env VERBOSE=true KEEP_OUTPUT=true vitest run --config ./vitest.terminal-bench.config.ts --root ./integration-tests -t oracle"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.test:terminal-bench:oracle"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cross-env VERBOSE=true KEEP_OUTPUT=true vitest run --config ./vitest.terminal-bench.config.ts --root ./integration-tests -t qwen"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.test:terminal-bench:qwen"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "daemon E2E will run against the runner's Node.\""
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.daemon-e2e.steps[5] (Use pre-installed Node.js (self-hosted))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "do hosttests=$(pgrep -fc [v]itest 2>/dev/null"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[21] (Run tests and generate reports)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_macos_shards.steps[6] (Run tests and generate reports)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_windows.steps[12] (Run tests and generate reports)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "docs_only"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.classify_pr.steps[6] (Classify CI profile from trusted base)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_build.steps[5] (Use trusted CI profile)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[5] (Use trusted CI profile)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[6] (Use trusted CI profile)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.integration_no_ak.steps[5] (Use trusted CI profile)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "done <<< ${TEST_MARKERS}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/main-ci-failure-issue.yml",
          "locator": "jobs.file_issue.steps[0] (Create or comment on the workflow issue)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "du -h ${RUNNER_TEMP}/unit-test-tree.tgz"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_build.steps[20] (Archive the built tree)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "for secret in ${GH_TOKEN:-} ${GITHUB_TOKEN:-} ${BOT_GITHUB_TOKEN:-} ${OPENAI_API_KEY:-} ${OPENAI_BASE_URL:-}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/qwen-issue-followup-bot.yml",
          "locator": "jobs.follow-up-issues.steps[0] (Prepare issue follow-up runtime)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "for test_marker in ${markers[@]}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/main-ci-failure-issue.yml",
          "locator": "jobs.file_issue.steps[0] (Create or comment on the workflow issue)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "for test_marker in ${missing[@]}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/main-ci-failure-issue.yml",
          "locator": "jobs.file_issue.steps[0] (Create or comment on the workflow issue)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "hdiutil verify $dmg"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/live-host-release.yml",
          "locator": "jobs.build.steps[9] (Verify signing and notarization)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "import { getLinters, getLinterTempDir } from ./scripts/lint.js"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[20] (Provision linters for real-binary tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "log --pretty=format:'%s' \"${PREVIOUS_TAG}..${RELEASE_TAG}\""
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/finalize-release.yml",
          "locator": "jobs.finalize.steps[9] (Comment released-in version on merged PRs)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --input-type=module --eval '"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.publish-sdk.steps[3] (Clean-install against the published GitHub Release)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node --input-type=module -e '"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[20] (Provision linters for real-binary tests)"
        },
        {
          "path": ".github/workflows/live-host-release.yml",
          "locator": "jobs.build.steps[8] (Verify release assets)"
        },
        {
          "path": ".github/workflows/sync-live-host-to-oss.yml",
          "locator": "jobs.sync.steps[4] (Verify release assets)"
        },
        {
          "path": ".github/workflows/sync-live-host-to-oss.yml",
          "locator": "jobs.sync.steps[8] (Verify versioned assets on Aliyun OSS)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node .github/scripts/check-ci-budget.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[8] (Check PR-stage CI budget)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node .github/scripts/check-lint-gate-freshness.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[9] (Check lint gate freshness)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node .github/scripts/check-test-growth.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[12] (Report test growth)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node .github/scripts/ci-flaky-rerun.mjs scan --repo $EXPR --workdir ${WORKDIR} --stale-minutes ${STALE_MINUTES} --active-days ${ACTIVE_DAYS} --max-candidates ${MAX_CANDIDATES_PER_RUN} --trusted-marker-login $EXPR > ${WORKDIR}/scan.out"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/qwen-ci-flaky-rerun.yml",
          "locator": "jobs.classify.steps[3] (Scan stale PR failures)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node .github/scripts/pr-safety-precheck.mjs --pr $RUNNER_TEMP/pr-precheck.json --diff $RUNNER_TEMP/pr-precheck.diff --trusted-author $EXPR --comment $RUNNER_TEMP/pr-precheck-comment.md"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/qwen-pr-safety-precheck.yml",
          "locator": "jobs.precheck.steps[3] (Assess PR safety)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node packages/browser-use/scripts/verify-package.mjs --output-dir ${RUNNER_TEMP}/browser-use-package"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.verify-browser-package.steps[3] (Test and pack existing browser SDK)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node packages/cua-driver/scripts/verify-cua-sdk-package.mjs --browser-tarball ${RUNNER_TEMP}/browser-use-package/qwen-code-browser-use-$EXPR.tgz --native-dir ${QWEN_CUA_SDK_NATIVE_DIR} --release-dir $EXPR --output-dir ${RUNNER_TEMP}/cua-sdk-package"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.verify-sdk-package.steps[8] (Pack, publish-dry-run, and clean-install one SDK tarball)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node packages/node-repl/scripts/verify-package.mjs --sdk-tarball ${RUNNER_TEMP}/cua-sdk-package/qwen-code-cua-sdk-$EXPR.tgz --browser-tarball ${RUNNER_TEMP}/browser-use-package/qwen-code-browser-use-$EXPR.tgz --output-dir ${RUNNER_TEMP}/node-repl-package"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.verify-node-repl-package.steps[9] (Pack, publish-dry-run, and clean-install Node REPL tarball)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/audit-runtime-critical.js"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[23] (Audit critical runtime dependencies)"
        },
        {
          "path": "package.json",
          "locator": "scripts.audit:runtime:critical"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-contract-open-prs.js"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java-contract-open-prs.yml",
          "locator": "jobs.recheck.steps[3] (Re-check open pull requests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-contract-version.js ${BASE_DOCUMENT} ${DOCUMENT}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[11] (Check the API contract version advances)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-core-subpath-exports.mjs"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[35] (Check core subpath exports resolve)"
        },
        {
          "path": "package.json",
          "locator": "scripts.check:core-subpath-exports"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-desktop-isolation.js"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[25] (Check desktop workspace isolation)"
        },
        {
          "path": "package.json",
          "locator": "scripts.check:desktop-isolation"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-failsafe-reports.js event-transport packages/managed-agent-server"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.event-transport-broker.steps[11] (Verify the EventTransport broker gates)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-failsafe-reports.js event-transport-multi-node packages/managed-agent-server"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.event-transport-multi-node.steps[16] (Verify the EventTransport multi-node gates)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-failsafe-reports.js hosted packages/managed-agent-server"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-harness-mysql.steps[9] (Check that every Hosted integration test class ran)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-failsafe-reports.js hosted-gates packages/managed-agent-server"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-harness-mysql.steps[14] (Check that every Hosted admission gate class ran)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-failsafe-reports.js non-hosted packages/managed-agent-server"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.mysql-integration.steps[13] (Check that every non-Hosted integration test class ran)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-failsafe-reports.js o4-mysql packages/managed-agent-server"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-harness-mysql.steps[15] (Verify O4 filesystem process and capacity gates)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-flyway-migrations.js packages/managed-agent-server packages/sdk-java/qwencode"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[10] (Check Flyway migration versions are unique)"
        },
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.flyway-migrations.steps[4] (Check Flyway migration versions are unique)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-flyway-open-prs.js packages/managed-agent-server packages/sdk-java/qwencode"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java-flyway-open-prs.yml",
          "locator": "jobs.recheck.steps[3] (Re-check open pull requests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-lockfile.js"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[24] (Check lockfile)"
        },
        {
          "path": "package.json",
          "locator": "scripts.check:lockfile"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-serve-fast-path-bundle.js"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[34] (Check serve fast-path bundle closure)"
        },
        {
          "path": "package.json",
          "locator": "scripts.check:serve-fast-path-bundle"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.quality_build.steps[7] (Check Serve Fast Path Bundle)"
        },
        {
          "path": "Makefile",
          "locator": "target preflight (line 42)"
        },
        {
          "path": "package.json",
          "locator": "scripts.preflight"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/check-tui-dep-direction.mjs"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[26] (Check TUI dependency direction)"
        },
        {
          "path": "package.json",
          "locator": "scripts.check:tui-dep-direction"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/clean-package-build-artifacts.js"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[34] (Check serve fast-path bundle closure)"
        },
        {
          "path": "package.json",
          "locator": "scripts.check:serve-fast-path-bundle"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.quality_build.steps[7] (Check Serve Fast Path Bundle)"
        },
        {
          "path": "Makefile",
          "locator": "target preflight (line 42)"
        },
        {
          "path": "package.json",
          "locator": "scripts.preflight"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/generate-managed-agent-configuration-reference.mjs --check"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-managed-agent-reference.yml",
          "locator": "jobs.build.steps[14] (Check the configuration reference)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/link-public-docs.mjs"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "docs-site/package.json",
          "locator": "scripts.link"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/lint.js"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.lint:all"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/lint.js --actionlint"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[22] (GitHub CI helper checks)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[29] (Run actionlint)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/lint.js --eslint"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[28] (Run ESLint)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/lint.js --prettier"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[32] (Run Prettier)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/lint.js --sensitive-keywords"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[33] (Run sensitive keyword linter)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/lint.js --setup"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[22] (GitHub CI helper checks)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[27] (Install linters)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/lint.js --shellcheck"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[30] (Run shellcheck)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/lint.js --yamllint"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[22] (GitHub CI helper checks)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.lint_and_static.steps[31] (Run yamllint)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/prepare-runtime.js --refresh-checksums"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.build.steps[23] (Refresh bundled runtime checksums after signing (macOS))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/run-macos-ci-group.js $MACOS_TEST_GROUP $MACOS_TEST_SHARD"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_macos_shards.steps[6] (Run tests and generate reports)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/test-release.js"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.desktop_shell.steps[7] (Run desktop release tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/test-standalone-runtimes.mjs"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.test:standalone:runtimes"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/test-standalone-runtimes.mjs --ci"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_windows.steps[12] (Run tests and generate reports)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:scripts"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:standalone:runtimes:ci"
        },
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.build.steps[21] (Run desktop release tests)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:release"
        },
        {
          "path": ".github/workflows/release-chrome-extension.yml",
          "locator": "jobs.build.steps[5] (Run Tests)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:ci"
        },
        {
          "path": ".github/workflows/release-sdk.yml",
          "locator": "jobs.build-sdk.steps[16] (Run Tests)"
        },
        {
          "path": ".github/workflows/release-sdk.yml",
          "locator": "jobs.release-sdk.steps[16] (Run Tests)"
        },
        {
          "path": ".github/workflows/release-vscode-companion.yml",
          "locator": "jobs.prepare.steps[7] (Run Tests)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.quality_scripts.steps[9] (Run Script Tests)"
        },
        {
          "path": ".github/workflows/windows-runner-smoke.yml",
          "locator": "jobs.validate.steps[10] (Run tests and generate reports)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node scripts/verify-installation-release.js"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sync-release-to-oss.yml",
          "locator": "jobs.sync.steps[6] (Verify Downloaded Release Assets)"
        },
        {
          "path": "package.json",
          "locator": "scripts.verify:installation-release"
        },
        {
          "path": ".github/workflows/sync-release-to-oss.yml",
          "locator": "jobs.sync.steps[11] (Verify Aliyun OSS Release Assets)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "noop_probe_failed ${pr} the response carries no pullRequest node, head or close-event count, or its test merge has no tree or no base parent"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/qwen-fleet-shepherd.yml",
          "locator": "jobs.shepherd.steps[0] (Shepherd the fleet)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "omitting --provenance\""
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/live-host-release.yml",
          "locator": "jobs.publish.steps[8] (Publish @qwen-code/qwen-live)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "ossutil cp ${RUNNER_TEMP}/qwen-code-latest-version oss://${ALIYUN_OSS_BUCKET}/releases/qwen-code/latest/VERSION -c ${RUNNER_TEMP}/.ossutilconfig -f --acl public-read"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sync-release-to-oss.yml",
          "locator": "jobs.sync.steps[14] (Publish Aliyun OSS Latest VERSION)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "precheck will fail closed.\" >&2"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/qwen-pr-safety-precheck.yml",
          "locator": "jobs.precheck.steps[2] (Collect PR precheck input)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/tests/sandbox-stdio.test.py packages/core/vendor/landlock-run/$EXPR-linux/qwen-landlock-run"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/verify-landlock-helper.yml",
          "locator": "jobs.verify.steps[4] (Verify standard streams inside a closed-network sandbox)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/tests/stdio-relay.test.py packages/core/vendor/landlock-run/$EXPR-linux/qwen-landlock-run"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/verify-landlock-helper.yml",
          "locator": "jobs.verify.steps[3] (Verify real stdin consumption and FIFO shutdown)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "r.numPassedTests !== r.numTotalTests) { console.error('::error::' + r.numPassedTests + ' of ' + r.numTotalTests + ' Hosted cases passed"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_windows.steps[13] (Hosted process suite)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "real-tmux capture tests will be skipped and the zip-packaging suite will throw on CI.'"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[19] (Install tmux and zip tooling)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "real-tmux capture tests will be skipped.'"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test.steps[19] (Install tmux and zip tooling)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "reject_if_arg_contains_secret $@"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/qwen-issue-followup-bot.yml",
          "locator": "jobs.follow-up-issues.steps[0] (Prepare issue follow-up runtime)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "release view sdk-typescript-${PREVIOUS_RELEASE_TAG} --json body -q .body 2>/dev/null"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-sdk.yml",
          "locator": "jobs.release-sdk.steps[29] (Create GitHub Release and Tag)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "retrying in ${RESOLVE_INTERVAL_SECONDS}s.\""
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/dsw-swe-verified-release.yml",
          "locator": "jobs.benchmark.steps[2] (Wait for the release on npm)"
        },
        {
          "path": ".github/workflows/update-ecs-runner-qwen.yml",
          "locator": "jobs.resolve.steps[0] (Resolve version)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sdk-typescript ${RELEASE_TAG}      --body Automated release PR for sdk-typescript ${RELEASE_TAG}.)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-sdk.yml",
          "locator": "jobs.release-sdk.steps[30] (Create PR to merge release branch into main)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security create-keychain -p $KEYCHAIN_PASSWORD build.keychain"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.build-macos.steps[9] (Import signing certificate + discover identity)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security create-keychain -p $keychain_password $keychain"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.build.steps[15] (Import macOS certificate)"
        },
        {
          "path": ".github/workflows/live-host-release.yml",
          "locator": "jobs.build.steps[5] (Import macOS certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security default-keychain -s build.keychain"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.build-macos.steps[9] (Import signing certificate + discover identity)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security find-identity -v -p codesigning build.keychain"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.build-macos.steps[9] (Import signing certificate + discover identity)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security import $certificate -P $certificate_password -A -t cert -f pkcs12 -k $keychain"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.build.steps[15] (Import macOS certificate)"
        },
        {
          "path": ".github/workflows/live-host-release.yml",
          "locator": "jobs.build.steps[5] (Import macOS certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security import certificate.p12 -k build.keychain -P $MAC_CSC_KEY_PASSWORD -T /usr/bin/codesign > /dev/null 2>&1"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.build-macos.steps[9] (Import signing certificate + discover identity)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security list-keychains -d user -s $keychain login.keychain-db"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.build.steps[15] (Import macOS certificate)"
        },
        {
          "path": ".github/workflows/live-host-release.yml",
          "locator": "jobs.build.steps[5] (Import macOS certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $KEYCHAIN_PASSWORD build.keychain > /dev/null"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.build-macos.steps[9] (Import signing certificate + discover identity)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $keychain_password $keychain"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.build.steps[15] (Import macOS certificate)"
        },
        {
          "path": ".github/workflows/live-host-release.yml",
          "locator": "jobs.build.steps[5] (Import macOS certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security set-keychain-settings -lut 21600 $keychain"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.build.steps[15] (Import macOS certificate)"
        },
        {
          "path": ".github/workflows/live-host-release.yml",
          "locator": "jobs.build.steps[5] (Import macOS certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security set-keychain-settings -t 3600 -l build.keychain"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.build-macos.steps[9] (Import signing certificate + discover identity)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security unlock-keychain -p $KEYCHAIN_PASSWORD build.keychain"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.build-macos.steps[9] (Import signing certificate + discover identity)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security unlock-keychain -p $keychain_password $keychain"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.build.steps[15] (Import macOS certificate)"
        },
        {
          "path": ".github/workflows/live-host-release.yml",
          "locator": "jobs.build.steps[5] (Import macOS certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "see the Checks tab"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/qwen-triage-finalize.yml",
          "locator": "jobs.finalize.steps[0] (Finalize CI evidence and deferred approval)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sha256sum --check -"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-managed-runtime.yml",
          "locator": "jobs.release.steps[5] (Repair the 0.26.5 release inputs)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sha256sum --check --status"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/verify-maven-repo.yml",
          "locator": "jobs.save.steps[1] (Install Java toolchain)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sha256sum --check --strict"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/verify-landlock-helper.yml",
          "locator": "jobs.verify.steps[1] (Install pinned Zig compiler)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sha256sum --check SHA256SUMS"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-managed-agent-reference.yml",
          "locator": "jobs.build.steps[16] (Verify and boot the exact archive)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sha256sum --check SHA256SUMS.txt"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-managed-agent-reference.yml",
          "locator": "jobs.build.steps[16] (Verify and boot the exact archive)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sha256sum --check checksums.txt)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.release.steps[4] (Refuse to replace an existing release)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sha512sum --check --status"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-managed-agent-reference.yml",
          "locator": "jobs.build.steps[6] (Set up Maven (self-hosted))"
        },
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.test.steps[8] (Set up Maven (self-hosted))"
        },
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.mysql-integration.steps[6] (Set up Maven (self-hosted))"
        },
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.event-transport-broker.steps[6] (Set up Maven (self-hosted))"
        },
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.event-transport-multi-node.steps[6] (Set up Maven (self-hosted))"
        },
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.daemon-e2e.steps[9] (Set up Maven (self-hosted))"
        },
        {
          "path": ".github/workflows/verify-maven-repo.yml",
          "locator": "jobs.save.steps[1] (Install Java toolchain)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "skipped checks omitted"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/qwen-triage-finalize.yml",
          "locator": "jobs.finalize.steps[0] (Finalize CI evidence and deferred approval)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "skipping tests.'"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/repo-hygiene.yml",
          "locator": "jobs.fix.steps[17] (Independent verification)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sort > $EXISTING/actual-checksums.txt"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/cd-cua-driver.yml",
          "locator": "jobs.release.steps[4] (Refuse to replace an existing release)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "spctl --assess --type execute --verbose=2 $app"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/desktop-release.yml",
          "locator": "jobs.build.steps[27] (Verify macOS signature)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "table_rows /tmp/checks.json /tmp/runs.json > /tmp/rows.tsv"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/qwen-triage-finalize.yml",
          "locator": "jobs.finalize.steps[0] (Finalize CI evidence and deferred approval)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-java-daemon-sdk-e2e.ts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-sdk-java.yml",
          "locator": "jobs.release.steps[9] (Run Java daemon E2E)"
        },
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.daemon-e2e.steps[13] (Run Java daemon E2E)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-agent-server"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --big-output"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[11] (Run long-answer persistence E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-big-output"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[10] (Run continuation owner failover E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-continuation-failover"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --freeze"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[15] (Run frozen former-owner fencing E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-continuation-frozen-owner-failover"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[14] (Run Harness-restart continuation failover E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-continuation-failover"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only --g3-verify allow"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[16] (Run Harness-restart approval Allow recovery E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-approval-allow"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only --g3-verify allow --g3-fault admission-reply-lost"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[27] (Run Turn admission reply-loss E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-approval-admission-reply-lost"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only --g3-verify allow --g3-fault after-decision"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[20] (Run approval post-decision crash E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-approval-after-decision"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only --g3-verify allow --g3-fault after-earlier-tools"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[25] (Run after-earlier-tools crash E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-approval-after-earlier-tools"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only --g3-verify allow --g3-fault after-prepare"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[21] (Run approval partial-prepare crash E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-approval-after-prepare"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only --g3-verify allow --g3-fault after-result"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[22] (Run approval result-commit crash E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-approval-after-result"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only --g3-verify allow --g3-fault cleanup-failed"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[31] (Run refused cleanup release E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-approval-cleanup-failed"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only --g3-verify allow --g3-fault decision-reply-lost"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[26] (Run approval decision reply-loss E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-approval-decision-reply-lost"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only --g3-verify allow --g3-fault finished-before-commit"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[23] (Run finished-before-commit crash E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-approval-finished-before-commit"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only --g3-verify allow --g3-fault load-reply-lost"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[28] (Run takeover load reply-loss E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-approval-load-reply-lost"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only --g3-verify allow --g3-fault sibling-approval"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[24] (Run sibling-approval crash E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-approval-sibling-approval"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only --g3-verify allow --g3-fault terminal-reply-lost"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[29] (Run committed terminal reply-loss E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-approval-terminal-reply-lost"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only --g3-verify allow --g3-fault terminal-write-failed"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[30] (Run missing terminal write E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-approval-terminal-write-failed"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only --g3-verify cancel"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[18] (Run Harness-restart approval Cancel recovery E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-approval-cancel"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only --g3-verify continuation"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[32] (Run Harness-restart continuation closeout E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-continuation-closeout"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only --g3-verify deny"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[17] (Run Harness-restart approval Deny recovery E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-approval-deny"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --continuation-failover --harness-only --g3-verify expiry"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[19] (Run Harness-restart approval expiry recovery E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-approval-expiry"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --inflight-failover"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[9] (Run in-flight owner failover E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-inflight-failover"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --inflight-failover --harness-only"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[13] (Run Harness-restart in-flight failover E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-inflight-failover"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --model-round-failover --frozen-control-plane"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[34] (Run frozen former control-plane fencing E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-frozen-control-plane-failover"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --model-round-failover --harness-only"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[33] (Run Harness-restart model-round failover E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-model-round-failover"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --session-failover"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[8] (Run session owner failover E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-session-failover"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/run-managed-agent-server-e2e.ts --session-failover --harness-only"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-java.yml",
          "locator": "jobs.hosted-failover-e2e.steps[12] (Run Harness-restart session failover E2E)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:e2e:managed-harness-restart-failover"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "type == \"array\")' \"${WORKDIR}/findings.json\" > /dev/null"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/repo-hygiene.yml",
          "locator": "jobs.fix.steps[4] (Validate findings)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "type == array) and (.reportOnly"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/repo-hygiene.yml",
          "locator": "jobs.fix.steps[4] (Validate findings)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "update_status $PR approved"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/qwen-triage-finalize.yml",
          "locator": "jobs.finalize.steps[0] (Finalize CI evidence and deferred approval)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "view \"${specifier}\" version --registry \"${registry}\" 2>\"${err_log}\""
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/dsw-swe-verified-release.yml",
          "locator": "jobs.benchmark.steps[2] (Wait for the release on npm)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "view \"${specifier}\" version 2>\"${err_log}\""
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/update-ecs-runner-qwen.yml",
          "locator": "jobs.resolve.steps[0] (Resolve version)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "web-shell-security"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/live-host.yml",
          "locator": "jobs.test.steps[6] (Package unsigned Live Host app)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}
