{
  "version": "repository-evidence@2",
  "collector": "scripts/cra-benchmark.mjs",
  "collector_sha256": "2810899a96f21d8cfc3a3a3281726dca5c948625ae94684aa1aa8042a76064eb",
  "labels": {
    "manifest": "Dependency manifest detected",
    "lockfile": "Lockfile detected",
    "sbom": "Repository SBOM document detected",
    "cyclonedx": "CycloneDX JSON detected",
    "spdx": "SPDX JSON detected",
    "security_md": "SECURITY.md detected",
    "reporting_contact": "Reporting-contact text signal",
    "disclosure_process": "Disclosure-process text signal",
    "security_updates": "Security-update text signal",
    "support_eol": "Support / EOL text signal",
    "release_process": "Release-process text signal",
    "ci_build": "CI / build configuration detected",
    "architecture": "Architecture / design document detected",
    "security_testing": "Security-testing tool or text signal",
    "release_lineage": "Published release reference observable"
  },
  "path_rules": {
    "manifest": "/(^|\\/)(package\\.json|pyproject\\.toml|requirements[^/]*\\.txt|Pipfile|pom\\.xml|build\\.gradle(?:\\.kts)?|go\\.mod|Cargo\\.toml|[^/]+\\.(?:csproj|fsproj|vbproj)|Directory\\.Packages\\.props|packages\\.config)$/i",
    "lockfile": "/(^|\\/)(package-lock\\.json|npm-shrinkwrap\\.json|yarn\\.lock|pnpm-lock\\.yaml|bun\\.lockb?|poetry\\.lock|uv\\.lock|pdm\\.lock|Pipfile\\.lock|gradle\\.lockfile|[^/]+\\.lockfile|Cargo\\.lock|packages\\.lock\\.json)$/i",
    "security_md": "/(^|\\/)security\\.md$/i",
    "ci_build": "/(^|\\/)(\\.github\\/workflows\\/[^/]+\\.ya?ml|\\.gitlab-ci\\.yml|\\.circleci\\/config\\.yml|azure-pipelines\\.ya?ml|Jenkinsfile|\\.travis\\.yml)$/i",
    "architecture": "/(^|\\/)(architecture|design|architectural[-_]overview)(\\.md|\\.rst|\\.adoc|\\.txt)$/i"
  },
  "text_rules": {
    "reporting_contact": "/(?:report(?:ing)?[^\\n.]{0,100}(?:vulnerabilit|security)[^\\n.]{0,160}(?:@|https:\\/\\/|advisories)|(?:vulnerabilit|security)[^\\n.]{0,100}(?:report|contact)[^\\n.]{0,160}(?:@|https:\\/\\/|advisories))/i",
    "disclosure_process": "/(?:coordinated|responsible)\\s+(?:vulnerability\\s+)?disclosure|(?:disclosure|vulnerability)\\s+(?:policy|process)|(?:security|vulnerability)[^\\n.]{0,80}(?:triage|acknowledge|embargo)/i",
    "security_updates": "/security\\s+(?:updates?|patches?|fixes)[^\\n.]{0,120}(?:releas|distribut|publish|upgrad|install|backport)|(?:releas|distribut|publish|backport)[^\\n.]{0,120}security\\s+(?:updates?|patches?|fixes)/i",
    "support_eol": "/end[- ]of[- ]life|supported\\s+versions|support\\s+(?:policy|period|window)|long[- ]term\\s+support/i",
    "release_process": "/(?:release|releasing)\\s+(?:process|workflow|procedure|checklist)|(?:how to|steps to)\\s+(?:cut|publish|create)\\s+a\\s+release/i",
    "security_testing": "/\\b(?:codeql|semgrep|gosec|bandit|cargo[- ]audit|cargo[- ]deny|oss[- ]fuzz|libfuzzer|snyk|trivy)\\b|security[- ](?:scan|test)|dependency[- ]review/i"
  },
  "limits": {
    "text_documents": 30,
    "sbom_candidates": 20,
    "document_bytes": 256000
  },
  "scope": "Default-branch pinned tree; selected documents; no release assets or external documents",
  "interpretation": "Automated observable signals, never legal compliance or validated policies",
  "purpose_exclusions": [
    "rust-lang/rustlings",
    "halfrost/LeetCode-Go",
    "krahets/hello-algo",
    "datawhalechina/hello-agents",
    "Zie619/n8n-workflows",
    "bannedbook/fanqiang"
  ],
  "excluded_path_segments": [
    "test",
    "tests",
    "testdata",
    "fixture",
    "fixtures",
    "sample",
    "samples",
    "example",
    "examples",
    "vendor",
    "vendored",
    "third_party",
    "third-party",
    "thirdparty",
    "node_modules",
    ".git"
  ],
  "revision_note": "Pre-publication review correction: isolate text and SBOM fetch failures, retain fixed coverage columns on tree failures, and record actual scan completion. Full recollection on unchanged frozen sample; no v1 results published."
}