{
  "schema": "sks.runtime-required-scripts.v1",
  "root_mode": "manifest_ssot",
  "scripts": [
    {
      "path": "dist/scripts/canonical-test-runner.js",
      "category": "installed_runtime",
      "reason": "the packaged test, test:all, and test:release scripts dispatch the canonical test runner"
    },
    {
      "path": "dist/scripts/codex-config-load-probe.js",
      "category": "installed_repair",
      "reason": "installed doctor and repair paths probe whether Codex can load the managed project config"
    },
    {
      "path": "dist/scripts/desktop-bridge-unification-check.js",
      "category": "installed_runtime",
      "reason": "the installed public release gate DAG hermetically verifies Desktop Bridge credential coexistence, migration idempotency, rollback isolation, retired CLI routing, and no-fallback policy"
    },
    {
      "path": "dist/scripts/desktop-bridge-transport-check.js",
      "category": "installed_runtime",
      "reason": "the installed public release gate DAG verifies the packaged localhost Desktop bridge transports and redaction"
    },
    {
      "path": "dist/scripts/desktop-bridge-latency-check.js",
      "category": "installed_runtime",
      "reason": "the installed public release gate DAG enforces localhost-only Desktop bridge HTTP and SSE latency budgets"
    },
    {
      "path": "dist/scripts/desktop-bridge-capabilities-check.js",
      "category": "installed_runtime",
      "reason": "the installed public release gate DAG verifies capability evidence state boundaries in the packaged runtime"
    },
    {
      "path": "dist/scripts/desktop-bridge-real-evidence-check.js",
      "category": "installed_runtime",
      "reason": "the installed full release proof fails closed unless trusted real Codex Desktop evidence covers native features, lifecycle recovery, and the remote other-Mac runtime"
    },
    {
      "path": "dist/scripts/release-physical-gates-check.js",
      "category": "installed_package_verification",
      "reason": "the installed full release proof validates macOS-captured, source-bound physical receipts including both Desktop Bridge providers, OAuth preservation, native UI, WebSocket, and production deep artifacts"
    },
    {
      "path": "dist/scripts/lib/ensure-dist-fresh.js",
      "category": "installed_repair",
      "reason": "postinstall and update self-verification dynamically restore the installed package build stamp"
    },
    {
      "path": "dist/scripts/release-pack-receipt.js",
      "category": "installed_package_verification",
      "reason": "packaged release verification creates, inspects, and compares immutable tarball receipts"
    }
  ],
  "reference_source_policies": [
    {
      "source": "package.json#scripts",
      "classification": "checkout_ci",
      "reason": "npm development and release scripts execute from a source checkout and are not installed runtime entrypoints"
    },
    {
      "source": "release-gates.v2.json",
      "classification": "installed_runtime",
      "reason": "public check, gates, and release commands dispatch the packaged release gate DAG"
    },
    {
      "source": "infra-harness-gates.json",
      "classification": "checkout_ci",
      "reason": "infrastructure harness gates are checkout-only verification"
    },
    {
      "source": ".github/workflows/**",
      "classification": "checkout_ci",
      "reason": "GitHub Actions runs against the release checkout and staged tarball, not from an installed customer package"
    },
    {
      "source": "scripts/build-clean-atomic.mjs",
      "classification": "checkout_ci",
      "reason": "the atomic clean-build driver runs only from a source checkout and invokes staged build helpers before package creation"
    },
    {
      "source": "src/core/build/build-once-runner.ts",
      "classification": "checkout_ci",
      "reason": "the build-once runner validates source-checkout build scripts"
    },
    {
      "source": "dist/core/build/build-once-runner.js",
      "classification": "checkout_ci",
      "reason": "the built build-once runner remains a checkout release helper"
    },
    {
      "source": "src/core/commands/check-command.ts",
      "classification": "installed_runtime",
      "reason": "the public check command directly dispatches proof-bank and release scripts"
    },
    {
      "source": "dist/core/commands/check-command.js",
      "classification": "installed_runtime",
      "reason": "the built public check command directly dispatches proof-bank and release scripts"
    },
    {
      "source": "src/core/commands/gates-command.ts",
      "classification": "installed_runtime",
      "reason": "the public gates command dispatches the packaged release DAG"
    },
    {
      "source": "dist/core/commands/gates-command.js",
      "classification": "installed_runtime",
      "reason": "the built public gates command dispatches the packaged release DAG"
    },
    {
      "source": "src/core/commands/release-command.ts",
      "classification": "installed_runtime",
      "reason": "the public release command directly dispatches the packaged release DAG"
    },
    {
      "source": "dist/core/commands/release-command.js",
      "classification": "installed_runtime",
      "reason": "the built public release command directly dispatches the packaged release DAG"
    },
    {
      "source": "src/core/dfix/verification-selector.ts",
      "classification": "installed_runtime",
      "reason": "the public DFix route selects these verification scripts when DFix source changes"
    },
    {
      "source": "dist/core/dfix/verification-selector.js",
      "classification": "installed_runtime",
      "reason": "the built public DFix route selects these verification scripts when DFix source changes"
    },
    {
      "source": "src/core/doctor/codex-current-core-probe-doctor.ts",
      "classification": "installed_runtime",
      "reason": "installed Doctor exposes the strict real-probe command and must not point at a missing script"
    },
    {
      "source": "dist/core/doctor/codex-current-core-probe-doctor.js",
      "classification": "installed_runtime",
      "reason": "built installed Doctor exposes the strict real-probe command"
    },
    {
      "source": "src/core/feature-fixtures.ts",
      "classification": "test_fixture",
      "reason": "feature fixture commands are repository selftest fixtures"
    },
    {
      "source": "dist/core/feature-fixtures.js",
      "classification": "test_fixture",
      "reason": "built feature fixture commands are repository selftest fixtures"
    },
    {
      "source": "src/core/loops/loop-worker-runtime.ts",
      "classification": "installed_runtime",
      "reason": "the public loop runtime launches the worker child as its execution entrypoint"
    },
    {
      "source": "dist/core/loops/loop-worker-runtime.js",
      "classification": "installed_runtime",
      "reason": "the built public loop runtime launches the worker child as its execution entrypoint"
    },
    {
      "source": "src/core/align/align-route.ts",
      "classification": "installed_runtime",
      "reason": "the public Align route requires the packaged skill-surface audit as one of its exact verification receipts"
    },
    {
      "source": "dist/core/align/align-route.js",
      "classification": "installed_runtime",
      "reason": "the built public Align route requires the packaged skill-surface audit as one of its exact verification receipts"
    },
    {
      "source": "src/core/release/release-stamp-proof.ts",
      "classification": "installed_runtime",
      "reason": "installed release verification exposes the release check-stamp entrypoint"
    },
    {
      "source": "dist/core/release/release-stamp-proof.js",
      "classification": "installed_runtime",
      "reason": "built installed release verification exposes the release check-stamp entrypoint"
    },
    {
      "source": "src/core/release/stage-publish.ts",
      "classification": "checkout_ci",
      "reason": "staged publish drives the repository workflow and the maintainer-local tarball verifier from a source checkout, never from an installed package"
    },
    {
      "source": "dist/core/release/stage-publish.js",
      "classification": "checkout_ci",
      "reason": "the built staged publish driver remains a checkout-only release helper gated on this repository origin"
    }
  ],
  "dynamic_reference_policies": [
    {
      "source": "dist/core/build/build-once-runner.js",
      "reason": "derives script paths only from package.json scripts, which are explicitly classified as checkout-only"
    },
    {
      "source": "dist/core/release/runtime-script-pack-closure.js",
      "reason": "formats the verified package allowlist and does not dispatch a runtime script"
    },
    {
      "source": "dist/scripts/release-gate-script-parity-check.js",
      "reason": "derives checkout-only script paths from release-gates.v2.json"
    },
    {
      "source": "dist/scripts/release-real-check.js",
      "reason": "release task dispatch is checkout-only and literal call sites are independently scanned"
    }
  ]
}