{
  "schema": "sks.runtime-required-scripts.v1",
  "root_mode": "manifest_ssot",
  "scripts": [
    {
      "path": "dist/scripts/canonical-test-runner.js",
      "category": "installed_runtime",
      "reason": "the packaged test, test:all, and test:release scripts dispatch the canonical test runner"
    },
    {
      "path": "dist/scripts/codex-config-load-probe.js",
      "category": "installed_repair",
      "reason": "installed doctor and repair paths probe whether Codex can load the managed project config"
    },
    {
      "path": "dist/scripts/desktop-bridge-unification-check.js",
      "category": "installed_runtime",
      "reason": "the packaged hermetically verifies Desktop Bridge credential coexistence, migration idempotency, rollback isolation, retired CLI routing, and no-fallback policy; run it directly with node when verifying an installed package"
    },
    {
      "path": "dist/scripts/desktop-bridge-transport-check.js",
      "category": "installed_runtime",
      "reason": "the packaged verifies the packaged localhost Desktop bridge transports and redaction; run it directly with node when verifying an installed package"
    },
    {
      "path": "dist/scripts/desktop-bridge-latency-check.js",
      "category": "installed_runtime",
      "reason": "the packaged enforces localhost-only Desktop bridge HTTP and SSE latency budgets; run it directly with node when verifying an installed package"
    },
    {
      "path": "dist/scripts/desktop-bridge-capabilities-check.js",
      "category": "installed_runtime",
      "reason": "the packaged verifies capability evidence state boundaries in the packaged runtime; run it directly with node when verifying an installed package"
    },
    {
      "path": "dist/scripts/desktop-bridge-real-evidence-check.js",
      "category": "installed_runtime",
      "reason": "the packaged release proof fails closed unless trusted real Codex Desktop evidence covers native features, lifecycle recovery, and the remote other-Mac runtime; run it directly with node when verifying an installed package"
    },
    {
      "path": "dist/scripts/release-physical-gates-check.js",
      "category": "installed_package_verification",
      "reason": "the installed full release proof validates macOS-captured, source-bound physical receipts including both Desktop Bridge providers, OAuth preservation, native UI, WebSocket, and production deep artifacts"
    },
    {
      "path": "dist/scripts/lib/ensure-dist-fresh.js",
      "category": "installed_repair",
      "reason": "postinstall and update self-verification dynamically restore the installed package build stamp"
    },
    {
      "path": "dist/scripts/release-pack-receipt.js",
      "category": "installed_package_verification",
      "reason": "packaged release verification creates, inspects, and compares immutable tarball receipts"
    },
    {
      "path": "dist/scripts/release-version-truth-check.js",
      "category": "installed_package_verification",
      "reason": "the published package re-verifies that its version metadata matches the release it claims to be"
    },
    {
      "path": "dist/scripts/check-publish-tag.js",
      "category": "installed_package_verification",
      "reason": "the published package re-verifies that its publish tag is latest and matches the version"
    },
    {
      "path": "dist/scripts/publish-preflight.js",
      "category": "installed_package_verification",
      "reason": "publish preflight ships with the lifecycle verifier that runs it against the packed tarball"
    },
    {
      "path": "dist/scripts/prepublish-release-check-or-fast.js",
      "category": "installed_package_verification",
      "reason": "npm prepack and prepublishOnly invoke the shipped lifecycle verifier before packaging or publication"
    },
    {
      "path": "dist/scripts/prepublish-fast-check.js",
      "category": "installed_package_verification",
      "reason": "the shipped lifecycle verifier runs the lightweight current-release-stamp eligibility check"
    }
  ],
  "reference_source_policies": [
    {
      "source": "package.json#scripts",
      "classification": "checkout_ci",
      "reason": "npm development and release scripts execute from a source checkout and are not installed runtime entrypoints"
    },
    {
      "source": "release-gates.v2.json",
      "classification": "checkout_ci",
      "reason": "the release gate DAG is run by maintainers from a source checkout (npm run maintainer -- gates|check|release); it is not an installed runtime entrypoint"
    },
    {
      "source": ".github/workflows/**",
      "classification": "checkout_ci",
      "reason": "GitHub Actions runs against the release checkout and staged tarball, not from an installed customer package"
    },
    {
      "source": "scripts/build-clean-atomic.mjs",
      "classification": "checkout_ci",
      "reason": "the atomic clean-build driver runs only from a source checkout and invokes staged build helpers before package creation"
    },
    {
      "source": "src/core/build/build-once-runner.ts",
      "classification": "checkout_ci",
      "reason": "the build-once runner validates source-checkout build scripts"
    },
    {
      "source": "dist/core/build/build-once-runner.js",
      "classification": "checkout_ci",
      "reason": "the built build-once runner remains a checkout release helper"
    },
    {
      "source": "src/core/commands/check-command.ts",
      "classification": "checkout_ci",
      "reason": "maintainer commands run from a source checkout through npm run maintainer and are not installed runtime entrypoints"
    },
    {
      "source": "dist/core/commands/check-command.js",
      "classification": "checkout_ci",
      "reason": "maintainer commands run from a source checkout through npm run maintainer and are not installed runtime entrypoints"
    },
    {
      "source": "src/core/commands/gates-command.ts",
      "classification": "checkout_ci",
      "reason": "maintainer commands run from a source checkout through npm run maintainer and are not installed runtime entrypoints"
    },
    {
      "source": "dist/core/commands/gates-command.js",
      "classification": "checkout_ci",
      "reason": "maintainer commands run from a source checkout through npm run maintainer and are not installed runtime entrypoints"
    },
    {
      "source": "src/core/commands/release-command.ts",
      "classification": "checkout_ci",
      "reason": "maintainer commands run from a source checkout through npm run maintainer and are not installed runtime entrypoints"
    },
    {
      "source": "dist/core/commands/release-command.js",
      "classification": "checkout_ci",
      "reason": "maintainer commands run from a source checkout through npm run maintainer and are not installed runtime entrypoints"
    },
    {
      "source": "src/core/dfix/verification-selector.ts",
      "classification": "installed_runtime",
      "reason": "the public DFix route selects these verification scripts when DFix source changes"
    },
    {
      "source": "dist/core/dfix/verification-selector.js",
      "classification": "installed_runtime",
      "reason": "the built public DFix route selects these verification scripts when DFix source changes"
    },
    {
      "source": "src/core/feature-fixtures.ts",
      "classification": "test_fixture",
      "reason": "feature fixture commands are repository selftest fixtures"
    },
    {
      "source": "dist/core/feature-fixtures.js",
      "classification": "test_fixture",
      "reason": "built feature fixture commands are repository selftest fixtures"
    },
    {
      "source": "src/core/align/align-route.ts",
      "classification": "installed_runtime",
      "reason": "the public Align route requires the packaged skill-surface audit as one of its exact verification receipts"
    },
    {
      "source": "dist/core/align/align-route.js",
      "classification": "installed_runtime",
      "reason": "the built public Align route requires the packaged skill-surface audit as one of its exact verification receipts"
    },
    {
      "source": "src/core/release/release-stamp-proof.ts",
      "classification": "installed_runtime",
      "reason": "installed release verification exposes the release check-stamp entrypoint"
    },
    {
      "source": "dist/core/release/release-stamp-proof.js",
      "classification": "installed_runtime",
      "reason": "built installed release verification exposes the release check-stamp entrypoint"
    },
    {
      "source": "src/core/release/stage-publish.ts",
      "classification": "checkout_ci",
      "reason": "staged publish drives the repository workflow and the maintainer-local tarball verifier from a source checkout, never from an installed package"
    },
    {
      "source": "dist/core/release/stage-publish.js",
      "classification": "checkout_ci",
      "reason": "the built staged publish driver remains a checkout-only release helper gated on this repository origin"
    },
    {
      "source": "src/scripts/maintainer-cli.ts",
      "classification": "checkout_ci",
      "reason": "maintainer commands run from a source checkout through npm run maintainer and are not installed runtime entrypoints"
    },
    {
      "source": "dist/scripts/maintainer-cli.js",
      "classification": "checkout_ci",
      "reason": "maintainer commands run from a source checkout through npm run maintainer and are not installed runtime entrypoints"
    },
    {
      "source": "src/core/commands/bench-command.ts",
      "classification": "checkout_ci",
      "reason": "maintainer commands run from a source checkout through npm run maintainer and are not installed runtime entrypoints"
    },
    {
      "source": "dist/core/commands/bench-command.js",
      "classification": "checkout_ci",
      "reason": "maintainer commands run from a source checkout through npm run maintainer and are not installed runtime entrypoints"
    }
  ],
  "dynamic_reference_policies": [
    {
      "source": "dist/core/build/build-once-runner.js",
      "reason": "derives script paths only from package.json scripts, which are explicitly classified as checkout-only"
    },
    {
      "source": "dist/core/release/runtime-script-pack-closure.js",
      "reason": "formats the verified package allowlist and does not dispatch a runtime script"
    },
    {
      "source": "dist/scripts/release-gate-script-parity-check.js",
      "reason": "derives checkout-only script paths from release-gates.v2.json"
    },
    {
      "source": "dist/scripts/release-real-check.js",
      "reason": "release task dispatch is checkout-only and literal call sites are independently scanned"
    }
  ]
}