{
  "schema": "elenchos.enforcement-coverage.v1",
  "kind": "STATIC_READING_NOT_RUNTIME_PROOF",
  "workflow": ".github/workflows/canary-target.yml",
  "dialect": "github",
  "workflow_sha256": "676baebd3819da4e5ec964621700d18bd2b98aebc30695f79042152dcad5680b",
  "policy_sha256": "97c9c77f9673c9f1ad7a70363120a5eb24ba31f2f646cde89c130736f40bf9b3",
  "supported_scope": "Explicit policy plus literal inline failure-mask reading. GitHub Actions continue-on-error is the owned experiment; Azure DevOps and GitLab are static syntax readers only.",
  "unsupported_scope": "Arbitrary scanner recall, SARIF ingestion, external actions, nested scripts, rulesets, branch protection and actual permission to merge are not checked.",
  "behavior_catalogue": {
    "schema": "elenchos.control-behaviors.v1",
    "status": "MATCHED_STATIC_REGRESSIONS",
    "evidence_level": "SOURCE_READER_ONLY_NOT_RUNTIME_PROOF",
    "cases": [
      {
        "id": "source_mask",
        "subject": "Owned synthetic marker gate in GitHub Actions",
        "severity": "high",
        "promise": "A planted synthetic marker must fail the gate; clean input must remain valid.",
        "probe": "as_is",
        "classification": "deliberate_behavior",
        "counterexample": "The owned canary step deliberately masks a real nonzero scanner exit with continue-on-error.",
        "expected": "not-enforced",
        "observed": "not-enforced",
        "outcome": "MATCHED_STATIC",
        "scanner_result": "UNKNOWN_NOT_RUN",
        "execution_blocking": "UNKNOWN_NOT_TESTED",
        "merge_protection": "UNKNOWN_RULESETS_NOT_QUERIED",
        "reproduction": "python -m pytest -q tests/unit/test_behavior_catalogue.py -k source_mask",
        "probe_sha256": "2db79b2acf59ab5aa9a1ece74d455cfc6c75ec9e28ceba6c878cb88b1a070ab8"
      },
      {
        "id": "unmasked_gate",
        "subject": "Owned synthetic marker gate in GitHub Actions",
        "severity": "high",
        "promise": "A planted synthetic marker must fail the gate; clean input must remain valid.",
        "probe": "remove_failure_mask",
        "classification": "positive_control",
        "counterexample": "Removing only the failure mask changes the static verdict while keeping the scanner command.",
        "expected": "configured-blocking",
        "observed": "configured-blocking",
        "outcome": "MATCHED_STATIC",
        "scanner_result": "UNKNOWN_NOT_RUN",
        "execution_blocking": "UNKNOWN_NOT_TESTED",
        "merge_protection": "UNKNOWN_RULESETS_NOT_QUERIED",
        "reproduction": "python -m pytest -q tests/unit/test_behavior_catalogue.py -k unmasked_gate",
        "probe_sha256": "30732d37c725f1d3aa4516663b53ff68c44da528cbb5295b5bb136f129084180"
      },
      {
        "id": "absent_gate",
        "subject": "Owned synthetic marker gate in GitHub Actions",
        "severity": "high",
        "promise": "A planted synthetic marker must fail the gate; clean input must remain valid.",
        "probe": "remove_control",
        "classification": "product_defect",
        "counterexample": "Removing the declared scan step must not make a missing control look healthy.",
        "expected": "unknown",
        "observed": "unknown",
        "outcome": "MATCHED_STATIC",
        "scanner_result": "UNKNOWN_NOT_RUN",
        "execution_blocking": "UNKNOWN_NOT_TESTED",
        "merge_protection": "UNKNOWN_RULESETS_NOT_QUERIED",
        "reproduction": "python -m pytest -q tests/unit/test_behavior_catalogue.py -k absent_gate",
        "probe_sha256": "0e8e3c9ed3af440cbfb16b4a1b5fc871b37fd1f6157d6a79d5c60d855193336f"
      },
      {
        "id": "conditional_gate",
        "subject": "Owned synthetic marker gate in GitHub Actions",
        "severity": "high",
        "promise": "A planted synthetic marker must fail the gate; clean input must remain valid.",
        "probe": "event_condition",
        "classification": "host_gap",
        "counterexample": "A dispatch-only condition leaves push-event coverage unproven by this source reader.",
        "expected": "unknown",
        "observed": "unknown",
        "outcome": "MATCHED_STATIC",
        "scanner_result": "UNKNOWN_NOT_RUN",
        "execution_blocking": "UNKNOWN_NOT_TESTED",
        "merge_protection": "UNKNOWN_RULESETS_NOT_QUERIED",
        "reproduction": "python -m pytest -q tests/unit/test_behavior_catalogue.py -k conditional_gate",
        "probe_sha256": "629c24d06e06c89462562a39c52e395cf8bdb639ebe0bac2a53c0b60c3ebc277"
      },
      {
        "id": "reporting_only",
        "subject": "Owned synthetic marker gate in GitHub Actions",
        "severity": "high",
        "promise": "A planted synthetic marker must fail the gate; clean input must remain valid.",
        "probe": "declare_reporting",
        "classification": "deliberate_behavior",
        "counterexample": "An explicit reporting-only policy is intentional and cannot be labelled a defeated blocking gate.",
        "expected": "reporting-only",
        "observed": "reporting-only",
        "outcome": "MATCHED_STATIC",
        "scanner_result": "UNKNOWN_NOT_RUN",
        "execution_blocking": "UNKNOWN_NOT_TESTED",
        "merge_protection": "UNKNOWN_RULESETS_NOT_QUERIED",
        "reproduction": "python -m pytest -q tests/unit/test_behavior_catalogue.py -k reporting_only",
        "probe_sha256": "8603647320263a20f0dac31531d9a81df1d79d71a1c4e1b429da3d444ad3da4a"
      }
    ]
  },
  "controls": [
    {
      "job": "build",
      "step": "Run security scan",
      "location": ".github/workflows/canary-target.yml:36",
      "expected_behavior": "blocking",
      "expectation_source": "Owned demonstration: a synthetic marker in canary/ must fail the gate.",
      "scanner_result": "UNKNOWN_NOT_RUN",
      "static_failure_configuration": "not-enforced",
      "execution_blocking": "UNKNOWN_NOT_TESTED",
      "merge_protection": "UNKNOWN_RULESETS_NOT_QUERIED",
      "reason": "continue-on-error: true, so failure is allowed without blocking the enclosing pipeline"
    },
    {
      "job": "build",
      "step": "Checkout",
      "location": ".github/workflows/canary-target.yml:29",
      "expected_behavior": "unknown",
      "expectation_source": null,
      "scanner_result": "UNKNOWN_NOT_RUN",
      "static_failure_configuration": "unknown",
      "execution_blocking": "UNKNOWN_NOT_TESTED",
      "merge_protection": "UNKNOWN_RULESETS_NOT_QUERIED",
      "reason": "No explicit policy expectation for this named control."
    },
    {
      "job": "build",
      "step": "Build",
      "location": ".github/workflows/canary-target.yml:45",
      "expected_behavior": "unknown",
      "expectation_source": null,
      "scanner_result": "UNKNOWN_NOT_RUN",
      "static_failure_configuration": "unknown",
      "execution_blocking": "UNKNOWN_NOT_TESTED",
      "merge_protection": "UNKNOWN_RULESETS_NOT_QUERIED",
      "reason": "No explicit policy expectation for this named control."
    }
  ]
}