{
  "checkedAt": "2026-11-13",
  "versions": ["2.1.322", "2.1.323"],
  "conditions": [
    {
      "id": "2.1.322-m01",
      "version": "2.1.322",
      "rule": ["Bash(npx *)"],
      "command": "npx prettier --check .",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m02",
      "version": "2.1.322",
      "rule": ["Bash(npx *)"],
      "command": "npx mytool anything",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m03",
      "version": "2.1.322",
      "rule": ["Bash(npx *)"],
      "command": "npx",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m04",
      "version": "2.1.322",
      "rule": ["Bash(devbox run *)"],
      "command": "devbox run mytool rm-like",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m05",
      "version": "2.1.322",
      "rule": ["Bash(npx prettier *)"],
      "command": "npx prettier --check .",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m06",
      "version": "2.1.322",
      "rule": ["Bash(npx prettier *)"],
      "command": "npx mytool x",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.322-m07",
      "version": "2.1.322",
      "rule": ["Bash(deploy*)"],
      "command": "deploy x",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m08",
      "version": "2.1.322",
      "rule": ["Bash(deploy*)"],
      "command": "deploy-prod",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m09",
      "version": "2.1.322",
      "rule": ["Bash(deploy*)"],
      "command": "deployx",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m10",
      "version": "2.1.322",
      "rule": ["Bash(deploy *)"],
      "command": "deploy x",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m11",
      "version": "2.1.322",
      "rule": ["Bash(deploy *)"],
      "command": "deploy",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m12",
      "version": "2.1.322",
      "rule": ["Bash(deploy *)"],
      "command": "deploy-prod",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.322-m13",
      "version": "2.1.322",
      "rule": ["Bash(deploy:*)"],
      "command": "deploy x",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m14",
      "version": "2.1.322",
      "rule": ["Bash(deploy:*)"],
      "command": "deploy-prod",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.322-m15",
      "version": "2.1.322",
      "rule": ["Bash(NODE_ENV*)"],
      "command": "NODE_ENV=test mytool",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m16",
      "version": "2.1.322",
      "rule": ["Bash(PORT=* npm run dev)"],
      "command": "PORT=3000 npm run dev",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m17",
      "version": "2.1.322",
      "rule": ["Bash(PORT=* npm run dev)"],
      "command": "PORT=1 mytool",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.322-m18",
      "version": "2.1.322",
      "rule": ["Bash(PORT=3000 npm run dev)"],
      "command": "PORT=3000 npm run dev",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m19",
      "version": "2.1.322",
      "rule": ["Bash(PORT=3000 npm run dev)"],
      "command": "PORT=4000 npm run dev",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.322-m20",
      "version": "2.1.322",
      "rule": ["Bash(mytool *)"],
      "command": "mytool a && deploy-prod",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.322-m21",
      "version": "2.1.322",
      "rule": ["Bash(mytool *)"],
      "command": "mytool a | deploy-prod",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.322-m22",
      "version": "2.1.322",
      "rule": ["Bash(mytool *)"],
      "command": "mytool a; deploy-prod",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.322-m23",
      "version": "2.1.322",
      "rule": ["Bash(mytool *)"],
      "command": "mytool a &&",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.322-m24",
      "version": "2.1.322",
      "rule": ["Bash(mytool * main)"],
      "command": "mytool merge main",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m25",
      "version": "2.1.322",
      "rule": ["Bash(mytool * main)"],
      "command": "mytool -c x diff main",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m26",
      "version": "2.1.322",
      "rule": ["Bash(git * main)"],
      "command": "git merge main",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m27",
      "version": "2.1.322",
      "rule": ["Bash(mytool *)"],
      "command": "mytool danger x",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.322-m28",
      "version": "2.1.322",
      "rule": ["Bash(mytool *)"],
      "command": "env mytool danger x",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.322-m29",
      "version": "2.1.322",
      "rule": ["Bash(mytool *)"],
      "command": "timeout 5 mytool danger x",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.322-project-untrusted",
      "version": "2.1.322",
      "rule": ["Bash(mytool *)"],
      "command": "mytool a",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.322-m31",
      "version": "2.1.322",
      "rule": ["Bash(npx prettier --check *)"],
      "command": "npx prettier --check .",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m32",
      "version": "2.1.322",
      "rule": ["Bash(npx prettier --check *)"],
      "command": "npx prettier --write .",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.322-m33",
      "version": "2.1.322",
      "rule": ["Bash(devbox run npm test)"],
      "command": "devbox run npm test",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m34",
      "version": "2.1.322",
      "rule": ["Bash(devbox run npm test)"],
      "command": "devbox run mytool",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.322-m35",
      "version": "2.1.322",
      "rule": ["Bash(ls *)"],
      "command": "ls",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m36",
      "version": "2.1.322",
      "rule": ["Bash(ls *)"],
      "command": "ls -la",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m37",
      "version": "2.1.322",
      "rule": ["Bash(ls *)"],
      "command": "lsof",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-m38",
      "version": "2.1.322",
      "rule": ["Bash(ls*)"],
      "command": "lsof",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.322-lsof-control",
      "version": "2.1.322",
      "rule": [],
      "command": "lsof",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m01",
      "version": "2.1.323",
      "rule": ["Bash(npx *)"],
      "command": "npx prettier --check .",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m02",
      "version": "2.1.323",
      "rule": ["Bash(npx *)"],
      "command": "npx mytool anything",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m03",
      "version": "2.1.323",
      "rule": ["Bash(npx *)"],
      "command": "npx",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m04",
      "version": "2.1.323",
      "rule": ["Bash(devbox run *)"],
      "command": "devbox run mytool rm-like",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m05",
      "version": "2.1.323",
      "rule": ["Bash(npx prettier *)"],
      "command": "npx prettier --check .",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m06",
      "version": "2.1.323",
      "rule": ["Bash(npx prettier *)"],
      "command": "npx mytool x",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.323-m07",
      "version": "2.1.323",
      "rule": ["Bash(deploy*)"],
      "command": "deploy x",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m08",
      "version": "2.1.323",
      "rule": ["Bash(deploy*)"],
      "command": "deploy-prod",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m09",
      "version": "2.1.323",
      "rule": ["Bash(deploy*)"],
      "command": "deployx",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m10",
      "version": "2.1.323",
      "rule": ["Bash(deploy *)"],
      "command": "deploy x",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m11",
      "version": "2.1.323",
      "rule": ["Bash(deploy *)"],
      "command": "deploy",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m12",
      "version": "2.1.323",
      "rule": ["Bash(deploy *)"],
      "command": "deploy-prod",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.323-m13",
      "version": "2.1.323",
      "rule": ["Bash(deploy:*)"],
      "command": "deploy x",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m14",
      "version": "2.1.323",
      "rule": ["Bash(deploy:*)"],
      "command": "deploy-prod",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.323-m15",
      "version": "2.1.323",
      "rule": ["Bash(NODE_ENV*)"],
      "command": "NODE_ENV=test mytool",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.323-m16",
      "version": "2.1.323",
      "rule": ["Bash(PORT=* npm run dev)"],
      "command": "PORT=3000 npm run dev",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m17",
      "version": "2.1.323",
      "rule": ["Bash(PORT=* npm run dev)"],
      "command": "PORT=1 mytool",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.323-m18",
      "version": "2.1.323",
      "rule": ["Bash(PORT=3000 npm run dev)"],
      "command": "PORT=3000 npm run dev",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m19",
      "version": "2.1.323",
      "rule": ["Bash(PORT=3000 npm run dev)"],
      "command": "PORT=4000 npm run dev",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.323-m20",
      "version": "2.1.323",
      "rule": ["Bash(mytool *)"],
      "command": "mytool a && deploy-prod",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.323-m21",
      "version": "2.1.323",
      "rule": ["Bash(mytool *)"],
      "command": "mytool a | deploy-prod",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.323-m22",
      "version": "2.1.323",
      "rule": ["Bash(mytool *)"],
      "command": "mytool a; deploy-prod",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.323-m23",
      "version": "2.1.323",
      "rule": ["Bash(mytool *)"],
      "command": "mytool a &&",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.323-m24",
      "version": "2.1.323",
      "rule": ["Bash(mytool * main)"],
      "command": "mytool merge main",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m25",
      "version": "2.1.323",
      "rule": ["Bash(mytool * main)"],
      "command": "mytool -c x diff main",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m26",
      "version": "2.1.323",
      "rule": ["Bash(git * main)"],
      "command": "git merge main",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m27",
      "version": "2.1.323",
      "rule": ["Bash(mytool *)"],
      "command": "mytool danger x",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.323-m28",
      "version": "2.1.323",
      "rule": ["Bash(mytool *)"],
      "command": "env mytool danger x",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.323-m29",
      "version": "2.1.323",
      "rule": ["Bash(mytool *)"],
      "command": "timeout 5 mytool danger x",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.323-project-untrusted",
      "version": "2.1.323",
      "rule": ["Bash(mytool *)"],
      "command": "mytool a",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.323-m31",
      "version": "2.1.323",
      "rule": ["Bash(npx prettier --check *)"],
      "command": "npx prettier --check .",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m32",
      "version": "2.1.323",
      "rule": ["Bash(npx prettier --check *)"],
      "command": "npx prettier --write .",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.323-m33",
      "version": "2.1.323",
      "rule": ["Bash(devbox run npm test)"],
      "command": "devbox run npm test",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m34",
      "version": "2.1.323",
      "rule": ["Bash(devbox run npm test)"],
      "command": "devbox run mytool",
      "result": "denied",
      "expected": "denied"
    },
    {
      "id": "2.1.323-m35",
      "version": "2.1.323",
      "rule": ["Bash(ls *)"],
      "command": "ls",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m36",
      "version": "2.1.323",
      "rule": ["Bash(ls *)"],
      "command": "ls -la",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m37",
      "version": "2.1.323",
      "rule": ["Bash(ls *)"],
      "command": "lsof",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-m38",
      "version": "2.1.323",
      "rule": ["Bash(ls*)"],
      "command": "lsof",
      "result": "executed",
      "expected": "executed"
    },
    {
      "id": "2.1.323-lsof-control",
      "version": "2.1.323",
      "rule": [],
      "command": "lsof",
      "result": "executed",
      "expected": "executed"
    }
  ],
  "limits": "Synthetic marker commands and fake local API. lsof can run via built-in read-only policy; execution does not prove rule matching. Parse-error cases are not permission denials."
}