.code-polishy.json

{
  "$schema": "schema/code-polishy.schema.json",
  "version": 4,
  "project": {
    "kind": "tooling",
    "capabilities": ["cli"]
  },
  "scope": {
    "data": [
      "internal/spdx/data/exceptions.json",
      "internal/spdx/data/licenses.json"
    ],
    "generated": ["internal/engine/testdata/**", "schema/sarif*.json"],
    "pythonContracts": [
      {
        "project": "internal/pythonfacts/pyproject.toml",
        "kind": "entry-point",
        "target": "reachability:resolve_reachability",
        "reason": "The Go-owned Vulture adapter program imports this resolver from the embedded Python support modules."
      },
      {
        "project": "internal/pythonfacts/pyproject.toml",
        "kind": "entry-point",
        "target": "type_resolver:typed_dict_fields",
        "reason": "The Go-owned Vulture adapter program imports this resolver from the embedded Python support modules."
      }
    ],
    "entryPoints": [
      "tools/javascript/bundle-manifest.mjs",
      "tools/javascript/runner.mjs",
      "providers/javascript/run.mjs",
      "providers/javascript/build.mjs"
    ]
  },
  "quality": {
    "allowComments": false,
    "lineBudget": { "production": 100000 }
  },
  "documentation": {
    "design": [
      {
        "path": "docs/design/repository-cleanup.md",
        "sourcePaths": [
          "cmd/code-polishy/cleanup_meta.go",
          "cmd/code-polishy/cleanup_meta_test.go",
          "internal/engine/cleanup.go",
          "internal/engine/cleanup_reports.go",
          "internal/engine/cleanup_test.go",
          "internal/testartifact/cleanup.go",
          "internal/testartifact/cleanup_test.go"
        ]
      },
      {
        "path": "docs/design/artifact-identity.md",
        "sourcePaths": [
          "internal/artifactsecurity/archive.go",
          "internal/artifactsecurity/archive_test.go",
          "internal/artifactsecurity/artifactsecurity_test.go",
          "internal/artifactsecurity/run.go"
        ]
      },
      {
        "path": "docs/design/trivy-scanner-assessments.md",
        "module": "artifactsecurity"
      },
      {
        "path": "docs/design/optional-rust-tools.md",
        "sourcePaths": [
          "internal/release/rust_bundle.go",
          "internal/release/rust_bundle_test.go",
          "internal/release/rust_bundle_install.go",
          "internal/release/installed.go",
          "internal/release/publication.go",
          "internal/rustfacts/execution.go",
          "cmd/code-polishy/install_rust_meta.go"
        ]
      },
      {
        "path": "docs/design/javascript-lint-results.md",
        "sourcePaths": [
          "internal/javascript/lint.go",
          "internal/javascript/javascript.go",
          "tools/javascript/lint-pages.mjs",
          "tools/javascript/runner.mjs",
          "tools/javascript/policy.mjs"
        ]
      },
      {
        "path": "docs/design/dependency-assessments.md",
        "sourcePaths": [
          "internal/release/capability_upgrade_storage.go",
          "internal/release/capability_upgrade_windows_test.go",
          "internal/policy/supplychain_config.go",
          "internal/policy/vulnerability_assessment_test.go",
          "internal/policy/vulnerability.go",
          "internal/policy/release_age.go",
          "internal/supplychain/osv_severity.go",
          "internal/supplychain/osv_severity_test.go"
        ]
      },
      {
        "path": "docs/design/security-evidence.md",
        "sourcePaths": [
          "internal/engine/security_scans.go",
          "internal/engine/security_scan_storage.go",
          "internal/engine/security_refresh.go",
          "internal/engine/security_scans_test.go",
          "internal/engine/security_inventory_test.go",
          "internal/engine/report_storage.go",
          "internal/policy/security_evidence.go",
          "internal/supplychain/security_inputs.go",
          "internal/supplychain/osv_inputs.go",
          "internal/supplychain/osv_snapshot_test.go",
          "internal/supplychain/online.go",
          "cmd/code-polishy/security_report_test.go"
        ]
      },
      {
        "path": "docs/design/cargo-facts.md",
        "module": "rustfacts"
      },
      {
        "path": "docs/design/rust-tests.md",
        "sourcePaths": [
          "internal/policy/rust_tests.go",
          "internal/policy/rust_tests_test.go",
          "internal/rustfacts/tests.go",
          "internal/rustfacts/test_workspace.go",
          "internal/testing/rust_preflight.go",
          "internal/testing/rust_workspace_test.go",
          "internal/engine/rust_workspace_test.go",
          "internal/testing/rust.go",
          "internal/testing/rust_test.go",
          "internal/testing/rust_output.go",
          "internal/testing/rust_doctest_test.go",
          "internal/engine/test_receipts.go",
          "internal/engine/test_receipt_runner.go",
          "internal/engine/test_execution_view.go",
          "internal/engine/rust_tests_test.go",
          "internal/behaviorreview/proof.go",
          "internal/behaviorreview/rust_proof_test.go",
          "internal/testartifact/execution.go",
          "internal/testartifact/nextest.go",
          "internal/testartifact/nextest_config.go",
          "internal/testartifact/nextest_test.go",
          "internal/testartifact/rustdoc.go",
          "internal/testartifact/rustdoc_output.go",
          "internal/testartifact/rustdoc_test.go",
          "internal/testartifact/xml.go"
        ]
      },
      {
        "path": "docs/design/rust-architecture.md",
        "sourcePaths": [
          "internal/architecture/rust.go",
          "internal/architecture/rust_evidence.go",
          "internal/architecture/rust_test.go",
          "internal/architecture/architecture.go"
        ]
      },
      {
        "path": "docs/design/rust-inputs.md",
        "sourcePaths": [
          "internal/policy/data.go",
          "internal/policy/rust_inputs_test.go",
          "internal/policy/rust_quality_test.go",
          "internal/policy/cargo_release_age_test.go",
          "internal/policy/cargo_vulnerability_test.go",
          "internal/repository/cargo_manifest.go",
          "internal/repository/cargo_patches.go",
          "internal/repository/cargo_manifest_test.go",
          "internal/repository/cargo_dependencies.go",
          "internal/repository/cargo_dependencies_test.go",
          "internal/repository/cargo_git.go",
          "internal/repository/cargo_git_test.go",
          "internal/repository/cargo_lock.go",
          "internal/repository/cargo_lock_test.go",
          "internal/repository/rust_tools.go",
          "internal/repository/rust_tools_test.go",
          "internal/repository/rust_inputs_test.go",
          "internal/quality/cargo_manifest.go",
          "internal/quality/cargo_manifest_test.go",
          "internal/quality/cargo.go",
          "internal/quality/cargo_test.go",
          "internal/quality/rust_format.go",
          "internal/quality/rust_format_test.go",
          "internal/quality/rust_source.go",
          "internal/quality/rust_source_test.go",
          "internal/quality/comments.go",
          "internal/quality/wgsl_test.go",
          "internal/supplychain/cargo.go",
          "internal/supplychain/cargo_patches.go",
          "internal/supplychain/cargo_patches_test.go",
          "internal/supplychain/cargo_test.go",
          "internal/supplychain/cargo_lock.go",
          "internal/supplychain/cargo_lock_test.go",
          "internal/supplychain/cargo_archive.go",
          "internal/supplychain/cargo_archive_test.go",
          "internal/supplychain/cargo_licenses.go",
          "internal/supplychain/cargo_licenses_test.go",
          "internal/supplychain/cargo_licenses_runtime_test.go",
          "internal/supplychain/cargo_resolution.go",
          "internal/supplychain/cargo_resolution_test.go",
          "internal/supplychain/cargo_release_age.go",
          "internal/supplychain/cargo_release_age_test.go",
          "internal/supplychain/cargo_registry.go",
          "internal/supplychain/cargo_registry_test.go",
          "internal/supplychain/osv_cargo.go",
          "internal/supplychain/osv_cargo_test.go",
          "internal/supplychain/osv_cargo_runtime_test.go",
          "internal/supplychain/osv_informational.go",
          "internal/supplychain/osv_informational_test.go",
          "internal/supplychain/release_age.go",
          "internal/supplychain/online_profile.go",
          "internal/supplychain/supplychain.go",
          "internal/engine/cargo_supplychain_test.go",
          "tools/install-rust.sh",
          "tools/install-rust.ps1",
          "tools/install-policy-tools.sh",
          "tools/install-policy-tools.ps1",
          "scripts/test-rust-runtime.sh"
        ]
      },
      {
        "path": "docs/design/provider-scope.md",
        "sourcePaths": [
          "internal/repository/providers.go",
          "internal/repository/generated_javascript.go",
          "internal/quality/javascript.go",
          "internal/quality/quality.go",
          "internal/architecture/providers.go"
        ]
      },
      {
        "path": "docs/design/test-ownership.md",
        "sourcePaths": [
          "internal/policy/test_ownership.go",
          "internal/engine/test_plan_test.go",
          "internal/policy/model.go",
          "internal/testing/ownership.go",
          "internal/testing/ownership_diagnostics.go",
          "internal/testing/testing.go"
        ]
      },
      {
        "path": "docs/design/workflow-facts.md",
        "module": "workflow"
      },
      {
        "path": "docs/design/ci-gate-ownership.md",
        "sourcePaths": [
          "internal/engine/final_gate_owner.go",
          "internal/supplychain/gitlab.go",
          "internal/javascript/gitlab.go",
          "tools/javascript/gitlab.mjs"
        ]
      },
      {
        "path": "docs/design/node-admission.md",
        "sourcePaths": [
          "internal/supplychain/lockfiles.go",
          "internal/supplychain/npm_lock.go",
          "internal/supplychain/node_governance.go",
          "internal/supplychain/node_runtime.go",
          "internal/supplychain/node_peers.go",
          "internal/supplychain/release_artifacts.go",
          "internal/javascript/peers.go",
          "tools/javascript/packages.mjs"
        ]
      },
      {
        "path": "docs/design/javascript-import-assets.md",
        "sourcePaths": [
          "tools/javascript/imports.mjs",
          "internal/architecture/javascript_graph.go"
        ]
      },
      {
        "path": "docs/design/git-evidence-policy.md",
        "sourcePaths": [
          "internal/policy/git_evidence.go",
          "internal/supplychain/git_evidence.go",
          "internal/supplychain/git_evidence_validation.go",
          "internal/supplychain/git_evidence_state.go",
          "internal/supplychain/cargo_git_evidence_test.go",
          "internal/supplychain/cargo_git_state_test.go",
          "internal/engine/supplychain_evidence_test.go",
          "internal/supplychain/osv_uv.go"
        ]
      },
      {
        "path": "docs/design/agent-guidance.md",
        "module": "agents"
      },
      {
        "path": "docs/design/bootstrap-wrapper.md",
        "sourcePaths": [
          "templates/code-polishyw",
          "templates/code-polishyw.ps1",
          "internal/agents/agents.go",
          "internal/agents/wrappers.go",
          "internal/policy/control_inputs.go",
          "internal/release/indexed_release.go",
          "internal/release/bundle_install.go",
          "internal/release/upgrade_bootstrap.go",
          "internal/release/release.go",
          "internal/release/upgrade_plan.go",
          "cmd/code-polishy/lock_meta.go",
          "cmd/code-polishy/upgrade_meta.go",
          "internal/repository/control_inputs_test.go",
          "cmd/code-polishy-launcher/main.go",
          "cmd/code-polishy/release_manifest_meta.go",
          "scripts/install.sh",
          "scripts/install.ps1"
        ]
      },
      {
        "path": "docs/design/python-contract-evidence.md",
        "sourcePaths": [
          "internal/policy/python_runtime_loaders.go",
          "internal/pythonfacts/type_resolver.py",
          "internal/pythonfacts/types.go",
          "internal/pythonfacts/reachability.py",
          "internal/architecture/python_imports.go",
          "internal/architecture/python_external_plugins.go",
          "internal/architecture/python_computed_imports.go",
          "internal/architecture/python_graph.go",
          "internal/architecture/python_ruff_graph.go",
          "internal/architecture/python_source_graph.go",
          "internal/architecture/sourcegraph/facts.go",
          "internal/architecture/python.go",
          "internal/pythonfacts/framework_contracts.py",
          "internal/pythonfacts/astroid_contracts.py",
          "internal/pythonfacts/repository_contracts.py",
          "internal/policy/python_contracts.go",
          "internal/quality/vulture_contracts.go",
          "internal/pythonfacts/connection_flow.py",
          "internal/quality/vulture.go",
          "internal/quality/vulture_response.go",
          "internal/repository/python_plugins.go",
          "internal/repository/python_distribution_sources.go",
          "internal/repository/python_distribution_origin.go",
          "internal/repository/python_reachability.go",
          "internal/repository/python_reachability_contract.go",
          "internal/repository/python_reachability_state.go",
          "internal/pythonfacts/contract_definitions.go",
          "internal/pythonfacts/contract_definitions.py",
          "internal/pythonfacts/external_contracts.py",
          "internal/pythonfacts/reachability_validation.go",
          "internal/engine/python_reachability_state.go"
        ]
      },
      {
        "path": "docs/design/design-context.md",
        "sourcePaths": [
          "internal/repository/design_context.go",
          "internal/repository/selection.go",
          "internal/engine/design_context.go",
          "internal/engine/task_start.go",
          "internal/engine/task_start_actions.go",
          "cmd/code-polishy/design_context.go",
          "cmd/code-polishy/task_start_output.go"
        ]
      },
      {
        "path": "docs/design/behavior-review-intent.md",
        "sourcePaths": [
          "internal/behaviorreview/intent.go",
          "internal/behaviorreview/cleanup.go",
          "internal/behaviorreview/types.go",
          "internal/engine/behavior_review.go",
          "cmd/code-polishy/behavior_review.go",
          "cmd/code-polishy/behavior_review_output.go",
          "cmd/code-polishy/task_start.go"
        ]
      },
      {
        "path": "docs/design/installed-release-verification.md",
        "sourcePaths": [
          "internal/release/manifest_writer.go",
          "internal/release/launcher_manifest.go",
          "internal/release/sbom.go",
          "internal/release/rust_sbom.go",
          "internal/release/rust_sbom_test.go",
          "scripts/build-release.ps1",
          "scripts/build-oci-image.sh",
          "scripts/test-installed-release.sh",
          "scripts/test-installed-release-contract.sh",
          "scripts/test-installed-release-architecture.sh",
          "scripts/test-installed-release-rust.sh",
          "scripts/verify-installed-artifact-security.sh"
        ]
      },
      {
        "path": "docs/design/historical-review-policy.md",
        "sourcePaths": [
          "internal/policy/review_snapshot.go",
          "internal/engine/behavior_review_decision.go",
          "internal/engine/merge_gate.go",
          "internal/supplychain/review.go",
          "internal/supplychain/review_inventory.go",
          "internal/supplychain/cargo_review.go",
          "internal/supplychain/cargo_review_lock.go",
          "internal/supplychain/cargo_review_test.go"
        ]
      },
      {
        "path": "docs/design/execution-observability.md",
        "sourcePaths": [
          "internal/policy/glob.go",
          "internal/repository/path_facts.go",
          "internal/repository/python_project.go",
          "internal/repository/repository.go",
          "internal/repository/control_inputs.go",
          "internal/repository/contained_file.go",
          "internal/repository/contained_directory_test.go",
          "internal/repository/test_ownership.go",
          "internal/engine/engine.go",
          "internal/engine/supplychain_evidence.go",
          "internal/engine/dependency_review_test.go",
          "internal/engine/execution_telemetry.go",
          "internal/engine/report_model.go",
          "internal/engine/report_types.go",
          "internal/engine/format.go",
          "internal/engine/gate_command_runner.go",
          "internal/engine/gate_stream_test.go",
          "internal/engine/gate_run.go",
          "internal/engine/test_evidence.go",
          "internal/gaterun/run.go",
          "internal/gaterun/types.go",
          "internal/gaterun/validation.go",
          "internal/policy/load.go",
          "internal/runner/runner.go",
          "internal/supplychain/osv.go",
          "cmd/code-polishy/main.go",
          "cmd/code-polishy/report.go"
        ]
      },
      {
        "path": "docs/design/repository-trends.md",
        "sourcePaths": [
          "internal/repository/trends.go",
          "internal/repository/trends_history.go",
          "internal/repository/trends_lines.go",
          "internal/repository/worktrees.go",
          "internal/gaterun/history.go",
          "internal/engine/repository_trends.go",
          "cmd/code-polishy/trends.go"
        ]
      },
      {
        "path": "docs/design/repository-size-analysis.md",
        "sourcePaths": [
          "internal/repository/size.go",
          "internal/engine/repository_size.go",
          "cmd/code-polishy/help.go",
          "cmd/code-polishy/output.go"
        ]
      },
      {
        "path": "docs/design/line-budget.md",
        "sourcePaths": [
          "internal/repository/source_lines.go",
          "internal/quality/line_budget.go",
          "internal/engine/line_budget.go"
        ]
      },
      {
        "path": "docs/design/reliability-reminder.md",
        "sourcePaths": [
          "internal/policy/reliability_reminder.go",
          "internal/engine/reliability_reminder.go",
          "cmd/code-polishy/reliability_reminder_output.go"
        ]
      },
      {
        "path": "docs/design/analysis-providers.md",
        "module": "pack"
      },
      {
        "path": "docs/design/javascript-provider.md",
        "module": "javascript-provider"
      },
      {
        "path": "docs/design/javascript-glob-inputs.md",
        "sourcePaths": [
          "tools/javascript/glob-inputs.mjs",
          "tools/javascript/deadcode.mjs",
          "providers/javascript/adapter.mjs",
          "providers/javascript/build.mjs",
          "providers/javascript/provider.test.mjs",
          "scripts/test-javascript-runner.sh"
        ]
      }
    ]
  },
  "verification": {
    "finalGateOwner": "ci",
    "mergeGate": {
      "recommendedModules": [
        "policy",
        "spdx",
        "pythonfacts",
        "repository",
        "runner",
        "gaterun",
        "finalstate",
        "durablefile",
        "strictjson",
        "behaviorreview",
        "documentation",
        "agents",
        "release",
        "javascript",
        "quality",
        "architecture",
        "testing",
        "supplychain",
        "workflow",
        "artifactsecurity",
        "policymodule",
        "pack",
        "portability",
        "engine",
        "cli",
        "launcher",
        "tooling",
        "javascript-provider"
      ]
    }
  },
  "modules": [
    {
      "name": "spdx",
      "paths": ["internal/spdx/**"],
      "dependsOn": ["strictjson"]
    },
    {
      "name": "pythonfacts",
      "paths": ["internal/pythonfacts/**"],
      "dependsOn": ["strictjson"]
    },
    {
      "name": "policy",
      "paths": ["internal/policy/**", "schema/**"],
      "dependsOn": ["spdx", "strictjson"]
    },
    {
      "name": "repository",
      "paths": ["internal/repository/**"],
      "dependsOn": ["policy", "pythonfacts"]
    },
    {
      "name": "rustfacts",
      "paths": ["internal/rustfacts/**"],
      "dependsOn": [
        "policy",
        "pythonfacts",
        "repository",
        "runner",
        "release",
        "strictjson"
      ]
    },
    {
      "name": "runner",
      "paths": ["internal/runner/**"],
      "dependsOn": ["policy"]
    },
    {
      "name": "gaterun",
      "paths": ["internal/gaterun/**"],
      "dependsOn": ["architecture", "policy", "testreceipt", "strictjson"]
    },
    {
      "name": "testartifact",
      "paths": ["internal/testartifact/**"],
      "dependsOn": ["policy", "durablefile", "strictjson"]
    },
    {
      "name": "testreceipt",
      "paths": ["internal/testreceipt/**"],
      "dependsOn": ["policy", "testartifact", "durablefile", "strictjson"]
    },
    {
      "name": "finalstate",
      "paths": ["internal/finalstate/**"]
    },
    {
      "name": "durablefile",
      "paths": ["internal/durablefile/**"]
    },
    {
      "name": "strictjson",
      "paths": ["internal/strictjson/**"]
    },
    {
      "name": "behaviorreview",
      "paths": ["internal/behaviorreview/**"],
      "dependsOn": [
        "architecture",
        "finalstate",
        "gaterun",
        "policy",
        "repository",
        "runner",
        "testing",
        "strictjson"
      ]
    },
    {
      "name": "documentation",
      "paths": ["internal/documentation/**"],
      "dependsOn": ["strictjson"]
    },
    {
      "name": "agents",
      "paths": [
        "AGENTS.md",
        "code-polishyw",
        "code-polishyw.ps1",
        "internal/agents/**",
        "templates/AGENTS.md",
        "templates/code-polishyw",
        "templates/code-polishyw.ps1"
      ]
    },
    {
      "name": "release",
      "paths": ["internal/release/**"],
      "dependsOn": ["policy", "pythonfacts", "durablefile", "strictjson"]
    },
    {
      "name": "javascript",
      "paths": ["internal/javascript/**"],
      "dependsOn": ["release", "runner", "strictjson"]
    },
    {
      "name": "quality",
      "paths": ["internal/quality/**"],
      "dependsOn": [
        "javascript",
        "pack",
        "policy",
        "pythonfacts",
        "repository",
        "runner",
        "rustfacts",
        "strictjson"
      ]
    },
    {
      "name": "architecture",
      "paths": ["internal/architecture/**"],
      "dependsOn": [
        "javascript",
        "policy",
        "pythonfacts",
        "rustfacts",
        "repository",
        "runner",
        "pack"
      ]
    },
    {
      "name": "testing",
      "paths": ["internal/testing/**"],
      "dependsOn": [
        "policy",
        "repository",
        "runner",
        "rustfacts",
        "testartifact"
      ]
    },
    {
      "name": "supplychain",
      "paths": ["internal/supplychain/**"],
      "dependsOn": [
        "javascript",
        "policy",
        "repository",
        "runner",
        "rustfacts",
        "spdx",
        "workflow",
        "strictjson"
      ]
    },
    {
      "name": "workflow",
      "paths": ["internal/workflow/**"]
    },
    {
      "name": "artifactsecurity",
      "paths": ["internal/artifactsecurity/**"],
      "dependsOn": ["policy", "repository", "runner", "strictjson"]
    },
    {
      "name": "policymodule",
      "paths": ["internal/policymodule/**"],
      "dependsOn": ["policy", "repository", "runner"]
    },
    {
      "name": "pack",
      "paths": ["internal/pack/**"],
      "dependsOn": ["policy", "repository", "runner", "release", "strictjson"]
    },
    {
      "name": "portability",
      "paths": ["internal/portability/**"],
      "dependsOn": ["policy", "repository"]
    },
    {
      "name": "engine",
      "paths": ["internal/engine/**"],
      "dependsOn": [
        "agents",
        "architecture",
        "artifactsecurity",
        "behaviorreview",
        "finalstate",
        "gaterun",
        "pack",
        "policy",
        "spdx",
        "pythonfacts",
        "policymodule",
        "portability",
        "quality",
        "release",
        "repository",
        "runner",
        "supplychain",
        "workflow",
        "testartifact",
        "testreceipt",
        "testing",
        "durablefile",
        "strictjson"
      ]
    },
    {
      "name": "cli",
      "paths": ["cmd/code-polishy/**"],
      "dependsOn": [
        "agents",
        "documentation",
        "engine",
        "finalstate",
        "pack",
        "policy",
        "release",
        "runner",
        "testing",
        "testreceipt"
      ]
    },
    {
      "name": "launcher",
      "paths": ["cmd/code-polishy-launcher/**"],
      "dependsOn": ["release", "runner"]
    },
    {
      "name": "tooling",
      "paths": [
        "bin/**",
        "release/**",
        "scripts/**",
        "skills/**",
        "templates/architecture-review.md",
        "templates/behavior-review.md",
        "templates/policy-exception.md",
        "tools/**"
      ]
    },
    {
      "name": "javascript-provider",
      "paths": ["providers/javascript/**"],
      "dependsOn": ["tooling"]
    }
  ],
  "checks": [
    {
      "name": "go-build",
      "provides": ["build"],
      "argv": ["./scripts/build.sh"],
      "modules": [
        "policy",
        "spdx",
        "pythonfacts",
        "rustfacts",
        "repository",
        "runner",
        "gaterun",
        "testartifact",
        "testreceipt",
        "finalstate",
        "durablefile",
        "strictjson",
        "behaviorreview",
        "documentation",
        "agents",
        "release",
        "javascript",
        "quality",
        "architecture",
        "testing",
        "supplychain",
        "workflow",
        "artifactsecurity",
        "pack",
        "policymodule",
        "portability",
        "engine",
        "cli",
        "launcher",
        "tooling"
      ],
      "runOn": ["build"]
    },
    {
      "name": "javascript-bundle-lock",
      "provides": ["lock-sync"],
      "argv": ["./scripts/check-javascript-bundle.sh"],
      "runOn": ["supply-chain"]
    },
    {
      "name": "python-facts-lock",
      "provides": ["lock-sync"],
      "argv": ["./scripts/check-python-facts-lock.sh"],
      "modules": ["pythonfacts"],
      "runOn": ["supply-chain"]
    },
    {
      "name": "javascript-provider-build",
      "provides": ["build"],
      "argv": ["./scripts/build-javascript-provider.sh"],
      "modules": ["javascript-provider"],
      "runOn": ["build"]
    }
  ],
  "tests": {
    "requiredKinds": ["unit", "contract"],
    "requiredSupplementalKinds": ["mutation"],
    "suites": [
      {
        "name": "spdx-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["spdx"],
        "argv": ["go", "test", "-count=1", "./internal/spdx/..."],
        "paths": ["internal/spdx/**/*_test.go"]
      },
      {
        "name": "pythonfacts-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["pythonfacts"],
        "argv": ["go", "test", "-count=1", "./internal/pythonfacts/..."],
        "paths": ["internal/pythonfacts/**/*_test.go"]
      },
      {
        "name": "policy-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["policy"],
        "argv": ["go", "test", "-count=1", "./internal/policy/..."],
        "paths": ["internal/policy/**/*_test.go"]
      },
      {
        "name": "repository-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["repository"],
        "argv": ["go", "test", "-count=1", "./internal/repository/..."],
        "paths": ["internal/repository/**/*_test.go"]
      },
      {
        "name": "rustfacts-unit",
        "kind": "unit",
        "scope": "module",
        "cost": "quick",
        "modules": ["rustfacts"],
        "environment": ["SDKROOT", "DEVELOPER_DIR"],
        "argv": ["go", "test", "-count=1", "./internal/rustfacts/..."],
        "paths": ["internal/rustfacts/**/*_test.go"]
      },
      {
        "name": "runner-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["runner"],
        "argv": ["go", "test", "-count=1", "./internal/runner/..."],
        "paths": ["internal/runner/**/*_test.go"]
      },
      {
        "name": "gaterun-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["gaterun"],
        "argv": ["go", "test", "-count=1", "./internal/gaterun/..."],
        "paths": ["internal/gaterun/**/*_test.go"]
      },
      {
        "name": "testartifact-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["testartifact"],
        "argv": ["go", "test", "-count=1", "./internal/testartifact/..."],
        "paths": ["internal/testartifact/**/*_test.go"]
      },
      {
        "name": "testreceipt-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["testreceipt"],
        "argv": ["go", "test", "-count=1", "./internal/testreceipt/..."],
        "paths": ["internal/testreceipt/**/*_test.go"]
      },
      {
        "name": "finalstate-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["finalstate"],
        "argv": ["go", "test", "-count=1", "./internal/finalstate/..."],
        "paths": ["internal/finalstate/**/*_test.go"]
      },
      {
        "name": "durablefile-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["durablefile"],
        "argv": ["go", "test", "-count=1", "./internal/durablefile/..."],
        "paths": ["internal/durablefile/**/*_test.go"]
      },
      {
        "name": "strictjson-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["strictjson"],
        "argv": ["go", "test", "-count=1", "./internal/strictjson/..."],
        "paths": ["internal/strictjson/**/*_test.go"]
      },
      {
        "name": "behaviorreview-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["behaviorreview"],
        "environment": ["SDKROOT", "DEVELOPER_DIR"],
        "argv": ["go", "test", "-count=1", "./internal/behaviorreview/..."],
        "paths": ["internal/behaviorreview/**/*_test.go"]
      },
      {
        "name": "documentation-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["documentation"],
        "argv": ["go", "test", "-count=1", "./internal/documentation/..."],
        "paths": ["internal/documentation/**/*_test.go"]
      },
      {
        "name": "agents-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["agents"],
        "argv": ["go", "test", "-count=1", "./internal/agents/..."],
        "paths": ["internal/agents/**/*_test.go"]
      },
      {
        "name": "release-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["release"],
        "argv": ["go", "test", "-count=1", "./internal/release/..."],
        "paths": ["internal/release/**/*_test.go"]
      },
      {
        "name": "javascript-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["javascript"],
        "argv": ["go", "test", "-count=1", "./internal/javascript/..."],
        "paths": ["internal/javascript/**/*_test.go"]
      },
      {
        "name": "quality-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["quality"],
        "environment": ["SDKROOT", "DEVELOPER_DIR"],
        "argv": ["go", "test", "-count=1", "./internal/quality/..."],
        "paths": ["internal/quality/**/*_test.go"]
      },
      {
        "name": "architecture-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["architecture"],
        "argv": ["go", "test", "-count=1", "./internal/architecture/..."],
        "paths": ["internal/architecture/**/*_test.go"]
      },
      {
        "name": "testing-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["testing"],
        "environment": ["SDKROOT", "DEVELOPER_DIR"],
        "argv": ["go", "test", "-count=1", "./internal/testing/..."],
        "paths": ["internal/testing/**/*_test.go"]
      },
      {
        "name": "supplychain-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["supplychain"],
        "argv": ["go", "test", "-count=1", "./internal/supplychain/..."],
        "paths": ["internal/supplychain/**/*_test.go"]
      },
      {
        "name": "workflow-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["workflow"],
        "argv": ["go", "test", "-count=1", "./internal/workflow/..."],
        "paths": ["internal/workflow/**/*_test.go"]
      },
      {
        "name": "artifactsecurity-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["artifactsecurity"],
        "argv": ["go", "test", "-count=1", "./internal/artifactsecurity/..."],
        "paths": ["internal/artifactsecurity/**/*_test.go"]
      },
      {
        "name": "pack-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["pack"],
        "argv": ["go", "test", "-count=1", "./internal/pack/..."],
        "paths": ["internal/pack/**/*_test.go"]
      },
      {
        "name": "policymodule-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["policymodule"],
        "argv": ["go", "test", "-count=1", "./internal/policymodule/..."],
        "paths": ["internal/policymodule/**/*_test.go"]
      },
      {
        "name": "portability-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["portability"],
        "argv": ["go", "test", "-count=1", "./internal/portability/..."],
        "paths": ["internal/portability/**/*_test.go"]
      },
      {
        "name": "engine-unit",
        "kind": "unit",
        "scope": "module",
        "modules": ["engine"],
        "environment": ["SDKROOT", "DEVELOPER_DIR"],
        "argv": ["go", "test", "-count=1", "./internal/engine/..."],
        "paths": ["internal/engine/**/*_test.go"]
      },
      {
        "name": "cli-contract",
        "kind": "contract",
        "scope": "module",
        "modules": ["cli"],
        "argv": ["go", "test", "-count=1", "./cmd/code-polishy/..."],
        "paths": ["cmd/code-polishy/**/*_test.go"]
      },
      {
        "name": "launcher-contract",
        "kind": "contract",
        "scope": "module",
        "modules": ["launcher"],
        "argv": ["go", "test", "-count=1", "./cmd/code-polishy-launcher/..."],
        "paths": ["cmd/code-polishy-launcher/**/*_test.go"]
      },
      {
        "name": "mutation-wrapper-contract",
        "kind": "contract",
        "scope": "module",
        "modules": ["tooling"],
        "argv": ["./scripts/test-mutation-wrapper.sh"],
        "paths": ["scripts/test-mutation-wrapper.sh"]
      },
      {
        "name": "install-contract",
        "kind": "contract",
        "scope": "module",
        "cost": "quick",
        "paths": [
          "scripts/*install.sh",
          "scripts/build-*",
          "scripts/release-version.sh",
          "cmd/code-polishy-launcher/**",
          "internal/release/**",
          "release/**",
          "templates/**",
          "tools/*-version.txt",
          "tools/install-p*",
          "tools/javascript**",
          "tools/packaging_wheel_checksums.txt",
          "scripts/test-install.sh"
        ],
        "argv": ["./scripts/test-install.sh"],
        "runOn": ["focused", "recommended", "full"],
        "modules": ["tooling"]
      },
      {
        "name": "release-preflight-contract",
        "kind": "contract",
        "scope": "module",
        "cost": "quick",
        "paths": [
          "CHANGELOG.md",
          "VERSION",
          "scripts/prepare-release-tag.sh",
          "scripts/release-preflight.sh",
          "scripts/release-changelog.sh",
          "scripts/release-version.sh",
          "scripts/test-release-preflight.sh"
        ],
        "argv": ["./scripts/test-release-preflight.sh"],
        "runOn": ["focused", "recommended", "full"],
        "modules": ["tooling"]
      },
      {
        "name": "rust-runtime-contract",
        "kind": "contract",
        "scope": "module",
        "cost": "quick",
        "paths": [
          "scripts/test-rust-runtime.sh",
          "tools/install-rust.*",
          "tools/rust-version.txt",
          "tools/rust_checksums.txt",
          "tools/verify-sha256.sh"
        ],
        "argv": ["./scripts/test-rust-runtime.sh"],
        "runOn": ["focused", "recommended", "full"],
        "modules": ["tooling"]
      },
      {
        "name": "javascript-runtime-contract",
        "kind": "contract",
        "scope": "module",
        "cost": "quick",
        "paths": [
          "scripts/test-javascript-runtime.sh",
          "tools/*javascript*",
          "tools/node-version.txt",
          "tools/pnpm-version.txt",
          "tools/verify-sha256.sh"
        ],
        "argv": ["./scripts/test-javascript-runtime.sh"],
        "runOn": ["focused", "recommended", "full"],
        "modules": ["tooling"]
      },
      {
        "name": "javascript-bundle-contract",
        "kind": "contract",
        "scope": "module",
        "cost": "quick",
        "paths": [
          "scripts/*javascript-bundle.sh",
          "tools/*javascript*",
          "tools/javascript/**",
          "tools/node-version.txt",
          "tools/pnpm-version.txt",
          "scripts/test-javascript-bundle.sh"
        ],
        "argv": ["./scripts/test-javascript-bundle.sh"],
        "runOn": ["focused", "recommended", "full"],
        "modules": ["tooling"]
      },
      {
        "name": "javascript-runner-contract",
        "kind": "contract",
        "scope": "module",
        "cost": "quick",
        "paths": [
          "internal/javascript/**",
          "scripts/*javascript-runner*.sh",
          "tools/javascript**",
          "tools/node-version.txt",
          "tools/pnpm-version.txt",
          "scripts/test-javascript-runner.sh"
        ],
        "argv": ["./scripts/test-javascript-runner.sh"],
        "runOn": ["focused", "recommended", "full"],
        "modules": ["tooling"]
      },
      {
        "name": "javascript-project-contract",
        "kind": "contract",
        "scope": "module",
        "cost": "quick",
        "paths": [
          "internal/javascript/**",
          "scripts/javascript-runner-test-env.sh",
          "scripts/test-javascript-project.sh",
          "tools/javascript/**",
          "tools/javascript-env.sh",
          "tools/node-version.txt",
          "tools/pnpm-version.txt"
        ],
        "argv": ["./scripts/test-javascript-project.sh"],
        "runOn": ["focused", "recommended", "full"],
        "modules": ["tooling"]
      },
      {
        "name": "repository-full",
        "kind": "contract",
        "scope": "repository",
        "argv": [
          "go",
          "test",
          "-count=1",
          "./cmd/code-polishy/...",
          "-run",
          "^(TestInstalledReleaseCanVerifyAReleaseTreeWithoutATargetLock|TestInstalledReleaseGovernsOnlyTheRepositoryThatLocksIt)$"
        ]
      },
      {
        "name": "policy-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["policy"],
        "argv": ["./scripts/go-mutation.sh", "./internal/policy"],
        "timeoutSeconds": 3600
      },
      {
        "name": "spdx-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["spdx"],
        "argv": ["./scripts/go-mutation.sh", "./internal/spdx"],
        "timeoutSeconds": 3600
      },
      {
        "name": "pythonfacts-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["pythonfacts"],
        "argv": ["./scripts/go-mutation.sh", "./internal/pythonfacts"],
        "timeoutSeconds": 3600
      },
      {
        "name": "repository-core-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["repository"],
        "argv": [
          "./scripts/go-mutation.sh",
          "--fast-tests",
          "^Test(Command|Dynamic|Module|Candidate|Impact|Configured|Language|Custom|Shell|Declared|Virtual|Every|Go|Tool|All|Explicit|Changed|Staged|Select|Merge|ReadRegular|Deletion|Rename|Policy|Conditional|Classify|Resolve|Nested|Design)",
          "./internal/repository",
          "--exclude-files",
          "(^|/)(boundary|committed_source|contained_file|content_digest|revision|context_documents|design_context|handoffs|generation[^/]*|generated_javascript|go_modules|python[^/]*)[.]go$"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "repository-git-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["repository"],
        "argv": [
          "./scripts/go-mutation.sh",
          "--fast-tests",
          "^Test(ChangeBoundary|Protected|CleanHead|CandidateState|ResolveAncestor|IsAncestor|Ancestry|Git|Patch|Detached|RemoveWorktree|ReadRegularFileAt|ContentDigest)",
          "./internal/repository",
          "--exclude-files",
          "(^|/)(repository[^/]*|selection|source_scope|impact|command_discovery|control_inputs|documentation_selection|test_ownership|context_documents|design_context|handoffs|generation[^/]*|generated_javascript|go_modules|python[^/]*)[.]go$"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "repository-context-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["repository"],
        "argv": [
          "./scripts/go-mutation.sh",
          "--fast-tests",
          "^Test(Operational|ContextDocuments|Generation|GeneratedJavaScript|InspectGoModules|Design|NestedGo)",
          "./internal/repository",
          "--exclude-files",
          "(^|/)(repository[^/]*|selection|source_scope|impact|command_discovery|control_inputs|documentation_selection|test_ownership|boundary|committed_source|contained_file|content_digest|revision|python[^/]*)[.]go$"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "repository-python-project-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["repository"],
        "argv": [
          "./scripts/go-mutation.sh",
          "--fast-tests",
          "^Test(ParsePythonProject|ReadPythonProject|PythonProject|PythonModule|PythonTool)",
          "./internal/repository",
          "--exclude-files",
          "(^|/)([^p/][^/]*|python_(object_imports|distribution[^/]*|entry_points|git[^/]*|lock|plugins|reachability[^/]*|requirement|ruff|toml))[.]go$"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "repository-python-dependencies-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["repository"],
        "argv": [
          "./scripts/go-mutation.sh",
          "--fast-tests",
          "^Test(ParsePythonRequirement|ParsePythonUVLock|PythonGit|PythonProjectInventoryRetains)",
          "./internal/repository",
          "--exclude-files",
          "(^|/)([^p/][^/]*|python|python_(object_imports|build|distribution[^/]*|entry_points|module|plugins|project|reachability[^/]*|ruff|tool))[.]go$"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "repository-python-runtime-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["repository"],
        "argv": [
          "./scripts/go-mutation.sh",
          "--fast-tests",
          "^Test(PythonPlugin|ParsePythonProject|PythonProjectDynamic|PythonRuff)",
          "./internal/repository",
          "--exclude-files",
          "(^|/)([^p/][^/]*|python|python_(build|distribution[^/]*|git[^/]*|lock|module|project|reachability[^/]*|requirement|toml|tool))[.]go$"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "repository-python-reachability-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["repository"],
        "argv": [
          "./scripts/go-mutation.sh",
          "--fast-tests",
          "^Test(PythonDistribution|PythonReachability)",
          "./internal/repository",
          "--exclude-files",
          "(^|/)([^p/][^/]*|python|python_(object_imports|build|entry_points|git[^/]*|lock|module|plugins|project|requirement|ruff|toml|tool))[.]go$"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "runner-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["runner"],
        "argv": ["./scripts/go-mutation.sh", "./internal/runner"],
        "timeoutSeconds": 3600
      },
      {
        "name": "gaterun-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["gaterun"],
        "argv": ["./scripts/go-mutation.sh", "./internal/gaterun"],
        "timeoutSeconds": 3600
      },
      {
        "name": "behaviorreview-artifacts-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["behaviorreview"],
        "argv": [
          "./scripts/go-mutation.sh",
          "./internal/behaviorreview",
          "--exclude-files",
          "(^|/)(intent|proof|requirements|review|review_material|selection)[.]go$"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "behaviorreview-intent-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["behaviorreview"],
        "argv": [
          "./scripts/go-mutation.sh",
          "./internal/behaviorreview",
          "--exclude-files",
          "(^|/)(artifact.*|checkpoint|common|final_state|proof|review|types)[.]go$"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "behaviorreview-proof-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["behaviorreview"],
        "argv": [
          "./scripts/go-mutation.sh",
          "./internal/behaviorreview",
          "--exclude-files",
          "(^|/)(artifact.*|checkpoint|common|final_state|intent|requirements|review_material|selection|types)[.]go$"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "documentation-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["documentation"],
        "argv": ["./scripts/go-mutation.sh", "./internal/documentation"],
        "timeoutSeconds": 3600
      },
      {
        "name": "agents-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["agents"],
        "argv": ["./scripts/go-mutation.sh", "./internal/agents"],
        "timeoutSeconds": 3600
      },
      {
        "name": "release-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["release"],
        "argv": ["./scripts/go-mutation.sh", "./internal/release"],
        "timeoutSeconds": 3600
      },
      {
        "name": "javascript-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["javascript"],
        "argv": ["./scripts/go-mutation.sh", "./internal/javascript"],
        "timeoutSeconds": 3600
      },
      {
        "name": "quality-comments-core-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["quality"],
        "argv": [
          "./scripts/go-mutation.sh",
          "--fast-tests",
          "^Test(SourceComment|AllowComments|GoDirective|ShellSource|PythonDocstrings|PowerShellInterpolated)",
          "./internal/quality",
          "--conditionals-boundary=false",
          "--exclude-files",
          "(^|/)(comments_(python|shell.*|web)|data|generated_commands|javascript|markdown.*|python.*|quality|vulture.*)[.]go$"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "quality-comments-python-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["quality"],
        "argv": [
          "./scripts/go-mutation.sh",
          "--fast-tests",
          "^Test(SourceComment|AllowComments|GoDirective|ShellSource|PythonDocstrings|PowerShellInterpolated)",
          "./internal/quality",
          "--conditionals-boundary=false",
          "--exclude-files",
          "(^|/)(comments|comments_(shell.*|web)|data|generated_commands|javascript|markdown.*|python.*|quality|vulture.*)[.]go$"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "quality-comments-shell-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["quality"],
        "argv": [
          "./scripts/go-mutation.sh",
          "--fast-tests",
          "^Test(SourceComment|AllowComments|GoDirective|ShellSource|PythonDocstrings|PowerShellInterpolated)",
          "./internal/quality",
          "--conditionals-boundary=false",
          "--timeout-coefficient",
          "10",
          "--exclude-files",
          "(^|/)(comments|comments_(python|web)|data|generated_commands|javascript|markdown.*|python.*|quality|vulture.*)[.]go$"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "quality-comments-web-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["quality"],
        "argv": [
          "./scripts/go-mutation.sh",
          "--fast-tests",
          "^Test(SourceComment|AllowComments|GoDirective|ShellSource|PythonDocstrings|PowerShellInterpolated)",
          "./internal/quality",
          "--conditionals-boundary=false",
          "--exclude-files",
          "(^|/)(comments|comments_(python|shell.*)|data|generated_commands|javascript|markdown.*|python.*|quality|vulture.*)[.]go$"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "quality-analysis-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["quality"],
        "argv": [
          "./scripts/go-mutation.sh",
          "--fast-tests",
          "^Test(Data|Check|ConfiguredStyle|Unbounded|Python|JavaScript)",
          "./internal/quality",
          "--conditionals-boundary=false",
          "--exclude-files",
          "(^|/)(comments.*|markdown.*|vulture.*)[.]go$"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "quality-vulture-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["quality"],
        "argv": [
          "./scripts/go-mutation.sh",
          "--fast-tests",
          "^TestPython(Vulture|Reachability)",
          "./internal/quality",
          "--conditionals-boundary=false",
          "--exclude-files",
          "(^|/)(comments.*|data|generated_commands|javascript|markdown.*|python.*|quality)[.]go$"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "quality-markdown-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["quality"],
        "argv": [
          "./scripts/go-mutation.sh",
          "--fast-tests",
          "^Test(Documentation|Markdown|FormatWrites)",
          "./internal/quality",
          "--conditionals-boundary=false",
          "--exclude-files",
          "(^|/)(comments.*|data|generated_commands|javascript|python.*|quality|vulture.*)[.]go$"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "architecture-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["architecture"],
        "argv": ["./scripts/go-mutation.sh", "./internal/architecture"],
        "timeoutSeconds": 3600
      },
      {
        "name": "testing-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["testing"],
        "argv": [
          "./scripts/go-mutation.sh",
          "./internal/testing",
          "--timeout-coefficient",
          "8"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "supplychain-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["supplychain"],
        "argv": ["./scripts/go-mutation.sh", "./internal/supplychain"],
        "timeoutSeconds": 3600
      },
      {
        "name": "artifactsecurity-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["artifactsecurity"],
        "argv": ["./scripts/go-mutation.sh", "./internal/artifactsecurity"],
        "timeoutSeconds": 3600
      },
      {
        "name": "policymodule-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["policymodule"],
        "argv": ["./scripts/go-mutation.sh", "./internal/policymodule"],
        "timeoutSeconds": 3600
      },
      {
        "name": "portability-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["portability"],
        "argv": [
          "./scripts/go-mutation.sh",
          "./internal/portability",
          "--timeout-coefficient",
          "7"
        ],
        "timeoutSeconds": 3600
      },
      {
        "name": "engine-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["engine"],
        "argv": ["./scripts/go-mutation.sh", "./internal/engine"],
        "timeoutSeconds": 3600
      },
      {
        "name": "cli-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["cli"],
        "argv": ["./scripts/go-mutation.sh", "./cmd/code-polishy"],
        "timeoutSeconds": 3600
      },
      {
        "name": "launcher-mutation",
        "kind": "mutation",
        "scope": "module",
        "modules": ["launcher"],
        "argv": ["./scripts/go-mutation.sh", "./cmd/code-polishy-launcher"],
        "timeoutSeconds": 3600
      },
      {
        "name": "installed-release-contract",
        "kind": "contract",
        "scope": "module",
        "modules": ["tooling"],
        "environment": ["SDKROOT", "DEVELOPER_DIR"],
        "paths": [
          "scripts/test-installed-release.sh",
          "scripts/test-installed-release-contract.sh",
          "scripts/test-installed-release-rust.sh",
          "cmd/code-polishy/**",
          "internal/pack/**",
          "tools/fixtures/language-pack/**"
        ],
        "argv": ["./scripts/test-installed-release-contract.sh"]
      },
      {
        "name": "oci-image-contract",
        "kind": "contract",
        "scope": "module",
        "cost": "quick",
        "modules": ["tooling"],
        "paths": [
          "release/oci.Containerfile.template",
          "scripts/build-oci-image.sh",
          "scripts/test-build-oci-image.sh",
          "internal/release/**"
        ],
        "argv": ["./scripts/test-build-oci-image.sh"],
        "runOn": ["focused", "recommended", "full"]
      },
      {
        "name": "javascript-provider-boundary",
        "kind": "contract",
        "scope": "module",
        "cost": "quick",
        "modules": ["javascript-provider"],
        "argv": ["./scripts/test-javascript-provider.sh"],
        "paths": [
          "providers/javascript/**",
          "tools/javascript/policy.mjs",
          "scripts/test-javascript-provider.sh"
        ],
        "runOn": ["focused", "recommended", "full"]
      }
    ],
    "paths": [
      "scripts/test-mutation-wrapper.sh",
      "scripts/test-install.sh",
      "scripts/test-release-preflight.sh",
      "scripts/test-rust-runtime.sh",
      "scripts/test-javascript-runtime.sh",
      "scripts/test-javascript-bundle.sh",
      "scripts/test-javascript-runner.sh",
      "scripts/test-javascript-project.sh",
      "scripts/test-installed-release.sh",
      "scripts/test-installed-release-contract.sh",
      "scripts/test-installed-release-rust.sh",
      "scripts/test-build-oci-image.sh",
      "scripts/test-javascript-provider.sh"
    ],
    "ownership": [
      {
        "paths": ["internal/spdx/**/*_test.go"],
        "module": "spdx",
        "focusedSuite": "spdx-unit"
      },
      {
        "paths": ["internal/pythonfacts/**/*_test.go"],
        "module": "pythonfacts",
        "focusedSuite": "pythonfacts-unit"
      },
      {
        "paths": ["internal/policy/**/*_test.go"],
        "module": "policy",
        "focusedSuite": "policy-unit"
      },
      {
        "paths": ["internal/repository/**/*_test.go"],
        "module": "repository",
        "focusedSuite": "repository-unit"
      },
      {
        "paths": ["internal/rustfacts/**/*_test.go"],
        "module": "rustfacts",
        "focusedSuite": "rustfacts-unit"
      },
      {
        "paths": ["internal/runner/**/*_test.go"],
        "module": "runner",
        "focusedSuite": "runner-unit"
      },
      {
        "paths": ["internal/gaterun/**/*_test.go"],
        "module": "gaterun",
        "focusedSuite": "gaterun-unit"
      },
      {
        "paths": ["internal/testartifact/**/*_test.go"],
        "module": "testartifact",
        "focusedSuite": "testartifact-unit"
      },
      {
        "paths": ["internal/testreceipt/**/*_test.go"],
        "module": "testreceipt",
        "focusedSuite": "testreceipt-unit"
      },
      {
        "paths": ["internal/finalstate/**/*_test.go"],
        "module": "finalstate",
        "focusedSuite": "finalstate-unit"
      },
      {
        "paths": ["internal/durablefile/**/*_test.go"],
        "module": "durablefile",
        "focusedSuite": "durablefile-unit"
      },
      {
        "paths": ["internal/strictjson/**/*_test.go"],
        "module": "strictjson",
        "focusedSuite": "strictjson-unit"
      },
      {
        "paths": ["internal/behaviorreview/**/*_test.go"],
        "module": "behaviorreview",
        "focusedSuite": "behaviorreview-unit"
      },
      {
        "paths": ["internal/documentation/**/*_test.go"],
        "module": "documentation",
        "focusedSuite": "documentation-unit"
      },
      {
        "paths": ["internal/agents/**/*_test.go"],
        "module": "agents",
        "focusedSuite": "agents-unit"
      },
      {
        "paths": ["internal/release/**/*_test.go"],
        "module": "release",
        "focusedSuite": "release-unit"
      },
      {
        "paths": ["internal/javascript/**/*_test.go"],
        "module": "javascript",
        "focusedSuite": "javascript-unit"
      },
      {
        "paths": ["internal/quality/**/*_test.go"],
        "module": "quality",
        "focusedSuite": "quality-unit"
      },
      {
        "paths": ["internal/architecture/**/*_test.go"],
        "module": "architecture",
        "focusedSuite": "architecture-unit"
      },
      {
        "paths": ["internal/testing/**/*_test.go"],
        "module": "testing",
        "focusedSuite": "testing-unit"
      },
      {
        "paths": ["internal/supplychain/**/*_test.go"],
        "module": "supplychain",
        "focusedSuite": "supplychain-unit"
      },
      {
        "paths": ["internal/workflow/**/*_test.go"],
        "module": "workflow",
        "focusedSuite": "workflow-unit"
      },
      {
        "paths": ["internal/artifactsecurity/**/*_test.go"],
        "module": "artifactsecurity",
        "focusedSuite": "artifactsecurity-unit"
      },
      {
        "paths": ["internal/pack/**/*_test.go"],
        "module": "pack",
        "focusedSuite": "pack-unit"
      },
      {
        "paths": ["internal/policymodule/**/*_test.go"],
        "module": "policymodule",
        "focusedSuite": "policymodule-unit"
      },
      {
        "paths": ["internal/portability/**/*_test.go"],
        "module": "portability",
        "focusedSuite": "portability-unit"
      },
      {
        "paths": ["internal/engine/**/*_test.go"],
        "module": "engine",
        "focusedSuite": "engine-unit"
      },
      {
        "paths": ["cmd/code-polishy/**/*_test.go"],
        "module": "cli",
        "focusedSuite": "cli-contract"
      },
      {
        "paths": ["cmd/code-polishy-launcher/**/*_test.go"],
        "module": "launcher",
        "focusedSuite": "launcher-contract"
      },
      {
        "paths": ["scripts/test-mutation-wrapper.sh"],
        "module": "tooling",
        "focusedSuite": "mutation-wrapper-contract"
      },
      {
        "paths": ["scripts/test-install.sh"],
        "module": "tooling",
        "focusedSuite": "install-contract"
      },
      {
        "paths": ["scripts/test-release-preflight.sh"],
        "module": "tooling",
        "focusedSuite": "release-preflight-contract"
      },
      {
        "paths": ["scripts/test-rust-runtime.sh"],
        "module": "tooling",
        "focusedSuite": "rust-runtime-contract"
      },
      {
        "paths": ["scripts/test-javascript-runtime.sh"],
        "module": "tooling",
        "focusedSuite": "javascript-runtime-contract"
      },
      {
        "paths": ["scripts/test-javascript-bundle.sh"],
        "module": "tooling",
        "focusedSuite": "javascript-bundle-contract"
      },
      {
        "paths": ["scripts/test-javascript-runner.sh"],
        "module": "tooling",
        "focusedSuite": "javascript-runner-contract"
      },
      {
        "paths": ["scripts/test-javascript-project.sh"],
        "module": "tooling",
        "focusedSuite": "javascript-project-contract"
      },
      {
        "paths": [
          "scripts/test-installed-release.sh",
          "scripts/test-installed-release-contract.sh",
          "scripts/test-installed-release-rust.sh"
        ],
        "module": "tooling",
        "focusedSuite": "installed-release-contract"
      },
      {
        "paths": ["scripts/test-build-oci-image.sh"],
        "module": "tooling",
        "focusedSuite": "oci-image-contract"
      },
      {
        "paths": [
          "providers/javascript/provider.test.mjs",
          "scripts/test-javascript-provider.sh"
        ],
        "module": "javascript-provider",
        "focusedSuite": "javascript-provider-boundary"
      }
    ]
  },
  "supplyChain": {
    "releaseArtifacts": [
      {
        "name": "cargo-nextest",
        "versionFile": "tools/cargo-nextest-version.txt",
        "source": "github-release",
        "locator": "nextest-rs/nextest",
        "tagPrefix": "cargo-nextest-"
      },
      {
        "name": "astroid",
        "versionFile": "tools/astroid-version.txt",
        "source": "pypi",
        "locator": "astroid"
      },
      {
        "name": "go",
        "versionFile": "scripts/go_version.txt",
        "source": "go-toolchain"
      },
      {
        "name": "govulncheck",
        "versionFile": "tools/govulncheck-version.txt",
        "source": "go-module",
        "locator": "golang.org/x/vuln"
      },
      {
        "name": "gremlins",
        "versionFile": "tools/gremlins-version.txt",
        "source": "github-release",
        "locator": "go-gremlins/gremlins"
      },
      {
        "name": "node",
        "versionFile": "tools/node-version.txt",
        "source": "node-runtime"
      },
      {
        "name": "osv-scanner",
        "versionFile": "tools/osv-scanner-version.txt",
        "source": "github-release",
        "locator": "google/osv-scanner"
      },
      {
        "name": "python",
        "versionFile": "tools/python-version.txt",
        "source": "python-build-standalone"
      },
      {
        "name": "ruff",
        "versionFile": "tools/ruff-version.txt",
        "source": "github-release",
        "locator": "astral-sh/ruff"
      },
      {
        "name": "shellcheck",
        "versionFile": "tools/shellcheck-version.txt",
        "source": "github-release",
        "locator": "koalaman/shellcheck",
        "tagPrefix": "v"
      },
      {
        "name": "rust",
        "versionFile": "tools/rust-version.txt",
        "source": "github-release",
        "locator": "rust-lang/rust"
      },
      {
        "name": "staticcheck",
        "versionFile": "tools/staticcheck-version.txt",
        "source": "go-module",
        "locator": "honnef.co/go/tools"
      },
      {
        "name": "deadcode",
        "versionFile": "tools/deadcode-version.txt",
        "source": "go-module",
        "locator": "golang.org/x/tools"
      },
      {
        "name": "ty",
        "versionFile": "tools/ty-version.txt",
        "source": "github-release",
        "locator": "astral-sh/ty"
      },
      {
        "name": "vulture",
        "versionFile": "tools/vulture-version.txt",
        "source": "pypi",
        "locator": "vulture"
      },
      {
        "name": "packaging",
        "versionFile": "tools/packaging-version.txt",
        "source": "pypi",
        "locator": "packaging"
      },
      {
        "name": "trivy",
        "versionFile": "tools/trivy-version.txt",
        "source": "github-release",
        "locator": "aquasecurity/trivy",
        "tagPrefix": "v"
      }
    ],
    "releaseAgeAssessments": [
      {
        "id": "trivy-0-76-1-x509-security-fix",
        "ecosystem": "artifact",
        "package": "trivy",
        "version": "0.76.1",
        "scope": "tools/trivy-version.txt",
        "category": "security-fix",
        "evidence": "https://github.com/riteofstring/code-polishy/blob/main/docs/design/trivy-scanner-assessments.md",
        "reason": "CVE-2026-111943 affects the scanner's HTTPS database download: compromised certificate intermediates can authenticate forged advisory data. No aged official scanner release contains the fix. Trivy 0.76.1 supplies the upstream Go 1.27.3 correction and updated CA bundle; retaining the vulnerable downloader or disabling fresh advisory checks is riskier than the reviewed official update before its ordinary admission on 2026-11-20.",
        "owner": "Codex",
        "reviewed": "2026-10-23",
        "expires": "2026-11-20"
      },
      {
        "id": "go-1-26-10-x509-security-fix",
        "ecosystem": "artifact",
        "package": "go",
        "version": "1.26.10",
        "scope": "scripts/go_version.txt",
        "category": "security-fix",
        "evidence": "https://github.com/riteofstring/code-polishy/blob/main/docs/security/dependency-assessments.md",
        "reason": "GO-2026-6809 permits known compromised intermediates during TLS verification on hosts whose trust stores still accept them. An intercepting peer can forge release-age metadata used for dependency admission. No aged fix exists, and requiring trust-store repair on every supported host cannot enforce this boundary; the narrow official x509 patch is safer than waiting through 2026-11-18.",
        "owner": "Codex",
        "reviewed": "2026-10-21",
        "expires": "2026-11-18"
      }
    ],
    "vulnerabilityAssessments": [
      {
        "id": "provider-fast-uri-host-canonicalization-unreachable",
        "ecosystem": "pnpm",
        "advisory": "GHSA-wjr9-j795-jxcr",
        "package": "fast-uri",
        "affectedVersion": "3.1.8",
        "scope": "providers/javascript/pnpm-lock.yaml",
        "severity": "moderate",
        "status": "not-affected",
        "basis": "unreachable",
        "reason": "The only resolved fast-uri caller is Ajv 8 through Astro's YAML language service. The provider constructs only TypeScript and Astro services; it never loads the full language-server plugin or YAML service.",
        "impact": "Repository-controlled authorities cannot reach fast-uri host canonicalization or a host-based authorization decision through the provider.",
        "evidence": "https://github.com/riteofstring/code-polishy/blob/main/docs/security/dependency-assessments.md",
        "owner": "Codex",
        "reviewed": "2026-10-23",
        "expires": "2026-11-19"
      },
      {
        "id": "provider-fast-uri-suffix-scheme-unreachable",
        "ecosystem": "pnpm",
        "advisory": "GHSA-333x-w4r6-6crp",
        "package": "fast-uri",
        "affectedVersion": "3.1.8",
        "scope": "providers/javascript/pnpm-lock.yaml",
        "severity": "low",
        "status": "not-affected",
        "basis": "unreachable",
        "reason": "The provider's selected TypeScript and Astro services exclude the YAML service that alone brings Ajv 8 and fast-uri into its dependency graph. No provider path invokes fast-uri with reference: suffix.",
        "impact": "Repository input cannot reach suffix serialization and become an executable URI through the provider.",
        "evidence": "https://github.com/riteofstring/code-polishy/blob/main/docs/security/dependency-assessments.md",
        "owner": "Codex",
        "reviewed": "2026-10-23",
        "expires": "2026-11-19"
      },
      {
        "id": "provider-fast-uri-encoded-scheme-unreachable",
        "ecosystem": "pnpm",
        "advisory": "GHSA-w74x-v6f9-j3xg",
        "package": "fast-uri",
        "affectedVersion": "3.1.8",
        "scope": "providers/javascript/pnpm-lock.yaml",
        "severity": "moderate",
        "status": "not-affected",
        "basis": "unreachable",
        "reason": "The provider never loads Astro's full language-server plugin or its YAML service, the only dependency path through Ajv 8 to fast-uri. Selected services use vscode-uri and do not decode or normalize schemes through fast-uri.",
        "impact": "Repository-controlled percent-encoded schemes cannot become executable URLs or authorization keys through fast-uri in this provider.",
        "evidence": "https://github.com/riteofstring/code-polishy/blob/main/docs/security/dependency-assessments.md",
        "owner": "Codex",
        "reviewed": "2026-10-23",
        "expires": "2026-11-19"
      },
      {
        "id": "provider-fast-uri-relative-path-unreachable",
        "ecosystem": "pnpm",
        "advisory": "GHSA-xhq7-xmqj-769h",
        "package": "fast-uri",
        "affectedVersion": "3.1.8",
        "scope": "providers/javascript/pnpm-lock.yaml",
        "severity": "low",
        "status": "not-affected",
        "basis": "unreachable",
        "reason": "The provider's checker excludes Astro's YAML service and its Ajv 8 URI resolver. The enabled TypeScript and Astro services do not send relative references to fast-uri normalization or equality APIs.",
        "impact": "Repository-controlled relative references cannot reach fast-uri and be conflated into resource, cache, or authorization identities through the provider.",
        "evidence": "https://github.com/riteofstring/code-polishy/blob/main/docs/security/dependency-assessments.md",
        "owner": "Codex",
        "reviewed": "2026-10-23",
        "expires": "2026-11-19"
      },
      {
        "id": "tooling-zod-configuration-unreachable",
        "ecosystem": "pnpm",
        "advisory": "GHSA-mrhx-c7xc-m3w5",
        "package": "zod",
        "affectedVersion": "3.25.76",
        "scope": "tools/javascript/pnpm-lock.yaml",
        "severity": "high",
        "status": "not-affected",
        "basis": "unreachable",
        "reason": "Knip validates an explicit policy-generated configuration containing validated path strings and fixed plugin flags. Target Knip configuration is never loaded, and native dead-code requests select at most 4096 paths.",
        "impact": "Repository-controlled arrays of invalid elements cannot reach Zod's issue-accumulating array validator through the sealed native analyzer.",
        "evidence": "https://github.com/riteofstring/code-polishy/blob/main/docs/security/dependency-assessments.md",
        "owner": "Codex",
        "reviewed": "2026-10-23",
        "expires": "2026-11-06"
      },
      {
        "id": "provider-zod-configuration-unreachable",
        "ecosystem": "pnpm",
        "advisory": "GHSA-mrhx-c7xc-m3w5",
        "package": "zod",
        "affectedVersion": "3.25.76",
        "scope": "providers/javascript/pnpm-lock.yaml",
        "severity": "high",
        "status": "not-affected",
        "basis": "unreachable",
        "reason": "The provider replaces Knip configuration initialization with its generated path-string arrays, fixed plugin flags and trusted Astro compiler. Repository Knip configuration and package.json knip fields never supply the Zod input.",
        "impact": "Repository-controlled arrays of invalid elements cannot reach Zod's issue-accumulating array validator through the provider's configuration boundary.",
        "evidence": "https://github.com/riteofstring/code-polishy/blob/main/docs/security/dependency-assessments.md",
        "owner": "Codex",
        "reviewed": "2026-10-23",
        "expires": "2026-11-06"
      },
      {
        "id": "provider-source-map-unreachable",
        "ecosystem": "pnpm",
        "advisory": "GHSA-68fv-2mgg-jv7q",
        "package": "source-map-js",
        "affectedVersion": "1.2.1",
        "scope": "providers/javascript/pnpm-lock.yaml",
        "severity": "high",
        "status": "not-affected",
        "basis": "unreachable",
        "reason": "The only resolved caller is PostCSS through eslint-plugin-astro. Policy never enables its no-unused-css-selector rule, and target or inline configuration cannot enable it.",
        "impact": "Repository source maps cannot reach SourceNode.fromStringWithSourceMap through the disabled CSS processing path.",
        "evidence": "https://github.com/riteofstring/code-polishy/blob/main/docs/security/dependency-assessments.md",
        "owner": "Codex",
        "reviewed": "2026-10-08",
        "expires": "2026-10-30"
      }
    ]
  }
}