{
  "repository": "sst/opencode",
  "ref": "ffe6fed58334d921f64a86a8d86128bff5a4b566",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "miri",
      "method": "formal",
      "commands": [
        "cargo miri setup",
        "cargo miri test --locked --manifest-path tests/ghostty-effects/Cargo.toml",
        "cargo miri test --locked --manifest-path tests/transport-retained/Cargo.toml"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.miri.steps[2]"
        },
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.miri.steps[3] (Check Stacked Borrows)"
        },
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.miri.steps[4] (Check Tree Borrows)"
        }
      ],
      "upstream": "https://github.com/rust-lang/miri",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "clippy",
      "method": "static_analysis",
      "commands": [
        "cargo clippy --locked --all-targets --all-features -- -D warnings",
        "cargo clippy --all-targets --all-features -- -D warnings"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.test.steps[5]"
        },
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.windows.steps[9] (Check Clippy)"
        },
        {
          "path": ".github/workflows/release-process-daemon.yml",
          "locator": "jobs.checks.steps[6]"
        }
      ],
      "upstream": "https://github.com/rust-lang/rust-clippy",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "eslint",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "sdks/vscode/eslint.config.mjs",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/eslint/eslint",
      "docs": "https://eslint.org/docs/latest/use/command-line-interface#exit-codes",
      "exit_codes": {
        "0": "no errors",
        "1": "linting errors found",
        "2": "configuration problem or internal error"
      },
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": "tsc",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "package.json",
          "locator": "dependencies: typescript"
        }
      ],
      "upstream": "https://github.com/microsoft/TypeScript",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": true
    },
    {
      "tool": "cargo-test",
      "method": "testing",
      "commands": [
        "cargo test --locked",
        "cargo test --locked --lib --test service --test runtime --test ownership --test pipe --test rows --test ghostty-effects",
        "cargo test --locked --all-targets --all-features",
        "cargo test --locked --lib --all-features -- --test-threads=1 --nocapture",
        "cargo test --locked --test runtime -- --test-threads=1 --nocapture"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.test.steps[6] (Test Linux)"
        },
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.test.steps[7] (Test macOS)"
        },
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.windows.steps[11] (Run tests)"
        },
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.windows.steps[13] (Diagnose failed library tests)"
        },
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.windows.steps[14] (Diagnose failed runtime tests)"
        },
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.windows.steps[15] (Diagnose failed daemon tests)"
        },
        {
          "path": ".github/workflows/release-process-daemon.yml",
          "locator": "jobs.build.steps[6] (Test service)"
        },
        {
          "path": ".github/workflows/release-process-daemon.yml",
          "locator": "jobs.build.steps[7] (Test CLI integration)"
        }
      ],
      "upstream": "https://github.com/rust-lang/cargo",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "ci-matrix",
      "method": "testing",
      "commands": [
        "test (os: 2)",
        "windows (include: 2)",
        "e2e-suite (suite: 4)",
        "build (include: 6)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.test.strategy.matrix"
        },
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.windows.strategy.matrix"
        },
        {
          "path": ".github/workflows/check-test.yml",
          "locator": "jobs.e2e-suite.strategy.matrix"
        },
        {
          "path": ".github/workflows/release-process-daemon.yml",
          "locator": "jobs.build.strategy.matrix"
        }
      ],
      "upstream": "https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "playwright",
      "method": "testing",
      "commands": [
        "playwright test --config e2e/service-worker/playwright.config.ts"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-test.yml",
          "locator": "jobs.e2e-suite.steps[8] (Verify service worker precaching and upgrades)"
        },
        {
          "path": "packages/app/e2e/reproduction/timeline-suspense/playwright.config.ts",
          "locator": "config file"
        },
        {
          "path": "packages/app/e2e/service-worker/playwright.config.ts",
          "locator": "config file"
        },
        {
          "path": "packages/app/e2e/stability/playwright.config.ts",
          "locator": "config file"
        },
        {
          "path": "packages/app/playwright.config.ts",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/microsoft/playwright",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "rustfmt",
      "method": "formatting",
      "commands": [
        "cargo fmt --check"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.test.steps[4]"
        },
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.windows.steps[8] (Check formatting)"
        },
        {
          "path": ".github/workflows/release-process-daemon.yml",
          "locator": "jobs.checks.steps[5]"
        }
      ],
      "upstream": "https://github.com/rust-lang/rustfmt",
      "docs": null,
      "exit_codes": {},
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "prettier",
      "method": "formatting",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "package.json",
          "locator": "devDependencies: prettier"
        }
      ],
      "upstream": "https://github.com/prettier/prettier",
      "docs": "https://prettier.io/docs/cli#exit-codes",
      "exit_codes": {
        "0": "everything formatted",
        "1": "something was not formatted (--check)",
        "2": "prettier error"
      },
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Basic tests do not establish exhaustive lifecycle coverage or Windows interactive CLI parity."
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.windows.steps[17] (Document current coverage)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Daemon tests cover private atomic registration, ownership/handoff, stale registration/locking, partial requests, blocked subscribers, and live ConPTY operations over real named pipes."
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.windows.steps[17] (Document current coverage)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "New-Item -ItemType Directory -Force $directory"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-process-daemon.yml",
          "locator": "jobs.windows.steps[12] (Run standalone library tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "New-Item -ItemType Directory -Force dist/$name"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-process-daemon.yml",
          "locator": "jobs.build-windows.steps[8] (Package)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Start-Sleep -Milliseconds 50"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-process-daemon.yml",
          "locator": "jobs.build-windows.steps[7] (Smoke test)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Update localized docs to match the latest English docs changes."
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/bot-docs-locale.yml",
          "locator": "jobs.sync-locales.steps[5] (Sync locale docs with OpenCode)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "ast-grep scan -c script/ast-grep/effect-simplifications/sgconfig.yml --off=unused-suppression packages"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-test.yml",
          "locator": "jobs.unit.steps[4] (Check Effect simplifications)"
        },
        {
          "path": "package.json",
          "locator": "scripts.lint:effect-simplifications"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "ast-grep scan -c script/ast-grep/gui-plugins/sgconfig.yml"
      ],
      "triggers": [
        "pre_commit",
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check.yml",
          "locator": "jobs.check.steps[2] (Lint)"
        },
        {
          "path": "package.json",
          "locator": "scripts.lint"
        },
        {
          "path": ".husky/pre-push",
          "locator": "line 20"
        },
        {
          "path": "package.json",
          "locator": "scripts.check"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "ast-grep scan -c script/ast-grep/sgconfig.yml packages/util/src packages/core/src packages/server/src packages/protocol/src packages/cli/src"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.lint:effect-patterns"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "ast-grep test -c script/ast-grep/effect-simplifications/sgconfig.yml"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-test.yml",
          "locator": "jobs.unit.steps[3] (Test Effect simplification rules)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test:effect-simplification-rules"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "ast-grep test -c script/ast-grep/sgconfig.yml"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.test:lint-rules"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun -e '"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".husky/pre-push",
          "locator": "line 5"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun run check:generated"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-test.yml",
          "locator": "jobs.unit.steps[9] (Check generated client)"
        },
        {
          "path": ".github/workflows/check-test.yml",
          "locator": "jobs.unit.steps[10] (Check generated OpenAPI document)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun script/lint-changed.ts"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check.yml",
          "locator": "jobs.check.steps[4] (Lint changed files)"
        },
        {
          "path": "package.json",
          "locator": "scripts.lint:changed"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun script/profile-typecheck-packages.ts"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.typecheck:profile:packages"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun script/profile-typecheck.ts"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.typecheck:profile"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun script/sdk-docs.ts"
      ],
      "triggers": [
        "pre_commit",
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check.yml",
          "locator": "jobs.check.steps[2] (Lint)"
        },
        {
          "path": "package.json",
          "locator": "scripts.lint"
        },
        {
          "path": ".husky/pre-push",
          "locator": "line 20"
        },
        {
          "path": "package.json",
          "locator": "scripts.check"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun turbo test --affected --concurrency=3"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-test.yml",
          "locator": "jobs.unit.steps[6] (Run unit tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun turbo test --concurrency=3"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-test.yml",
          "locator": "jobs.unit.steps[6] (Run unit tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun turbo typecheck --concurrency=3"
      ],
      "triggers": [
        "pre_commit",
        "local"
      ],
      "evidence": [
        {
          "path": ".husky/pre-push",
          "locator": "line 20"
        },
        {
          "path": "package.json",
          "locator": "scripts.check"
        },
        {
          "path": "package.json",
          "locator": "scripts.typecheck"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun turbo typecheck:tsc --concurrency=3"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check.yml",
          "locator": "jobs.check.steps[3] (Typecheck (TypeScript 7.1))"
        },
        {
          "path": "package.json",
          "locator": "scripts.typecheck:tsc"
        },
        {
          "path": ".github/workflows/deploy-changelog.yml",
          "locator": "jobs.deploy.steps[2] (Typecheck)"
        },
        {
          "path": ".github/workflows/deploy-files.yml",
          "locator": "jobs.deploy.steps[2] (Typecheck)"
        },
        {
          "path": ".github/workflows/deploy-update.yml",
          "locator": "jobs.deploy.steps[2] (Typecheck)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun turbo verify:package --affected --filter=@opencode/sdk"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-test.yml",
          "locator": "jobs.unit.steps[8] (Verify packed workerd SDK)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun turbo verify:package --filter=@opencode/sdk"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-test.yml",
          "locator": "jobs.unit.steps[8] (Verify packed workerd SDK)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "const expectedBunVersion = pkg.packageManager?.split(@)[1]"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".husky/pre-push",
          "locator": "line 8"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "const expectedBunVersionRange = `^${expectedBunVersion}`"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".husky/pre-push",
          "locator": "line 12"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "const pkg = await Bun.file(package.json).json()"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".husky/pre-push",
          "locator": "line 7"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "import { semver } from bun"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".husky/pre-push",
          "locator": "line 6"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "metadata --no-deps --format-version 1"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-process-daemon.yml",
          "locator": "jobs.checks.steps[4] (Validate tag)"
        },
        {
          "path": ".github/workflows/release-process-daemon.yml",
          "locator": "jobs.build.steps[10] (Smoke test)"
        },
        {
          "path": ".github/workflows/release-process-daemon.yml",
          "locator": "jobs.build.steps[11] (Package)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "nothing to check\""
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-bot-scope.yml",
          "locator": "jobs.bot-scope.steps[0] (Check branch)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "oxlint"
      ],
      "triggers": [
        "pre_commit",
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check.yml",
          "locator": "jobs.check.steps[2] (Lint)"
        },
        {
          "path": "package.json",
          "locator": "scripts.lint"
        },
        {
          "path": ".husky/pre-push",
          "locator": "line 20"
        },
        {
          "path": "package.json",
          "locator": "scripts.check"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security create-keychain -p $keychain_password build.keychain"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-dry-run.yml",
          "locator": "jobs.sign-macos.steps[2] (Import certificate)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.sign-macos.steps[2] (Import certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security delete-keychain build.keychain"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-dry-run.yml",
          "locator": "jobs.sign-macos.steps[6] (Delete keychain)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.sign-macos.steps[6] (Delete keychain)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security import $cert -k build.keychain -P  -T /usr/bin/codesign -T /usr/bin/security -T /usr/bin/productsign"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-dry-run.yml",
          "locator": "jobs.sign-macos.steps[2] (Import certificate)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.sign-macos.steps[2] (Import certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security list-keychains -d user -s build.keychain $(security list-keychains -d user"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-dry-run.yml",
          "locator": "jobs.sign-macos.steps[2] (Import certificate)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.sign-macos.steps[2] (Import certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $keychain_password build.keychain > /dev/null"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-dry-run.yml",
          "locator": "jobs.sign-macos.steps[2] (Import certificate)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.sign-macos.steps[2] (Import certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security set-keychain-settings -lut 21600 build.keychain"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-dry-run.yml",
          "locator": "jobs.sign-macos.steps[2] (Import certificate)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.sign-macos.steps[2] (Import certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security unlock-keychain -p $keychain_password build.keychain"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-dry-run.yml",
          "locator": "jobs.sign-macos.steps[2] (Import certificate)"
        },
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.sign-macos.steps[2] (Import certificate)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "throw new Error(`This script requires bun@${expectedBunVersionRange}, but you are using bun@${process.versions.bun}`)"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".husky/pre-push",
          "locator": "line 14"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "throw new Error(packageManager field not found in root package.json)"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".husky/pre-push",
          "locator": "line 10"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "while (!(Test-Path (Join-Path $runtime smoke/service.json))) {"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release-process-daemon.yml",
          "locator": "jobs.build-windows.steps[7] (Smoke test)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}