traceforge-toolkit 0.1.0__py3-none-any.whl

traceforge/classify/data/shell_rules.yaml

@@ -0,0 +1,1192 @@
+# Shell command classification rules and binary metadata.
+# Rules are evaluated in order — first match wins.
+
+shell_rules:
+  - id: pip-pip3-install
+    binaries: [pip, pip3]
+    subcmds: [install]
+    activity: setup
+    role: orchestrator.package_manager
+    effect: mutating
+
+  - id: npm-pnpm-yarn-add-ci-install
+    binaries: [npm, pnpm, yarn]
+    subcmds: [add, ci, install]
+    activity: setup
+    role: orchestrator.package_manager
+    effect: mutating
+
+  - id: cargo-add
+    binaries: [cargo]
+    subcmds: [add]
+    activity: setup
+    role: orchestrator.package_manager
+    effect: mutating
+
+  - id: apt-apt-get-brew-install
+    binaries: [apt, apt-get, brew]
+    subcmds: [install]
+    activity: setup
+    role: orchestrator.package_manager
+    effect: mutating
+
+  - id: uv-add-pip-sync
+    binaries: [uv]
+    subcmds: [add, pip, sync]
+    activity: setup
+    role: orchestrator.package_manager
+    effect: mutating
+
+  - id: poetry-add-install
+    binaries: [poetry]
+    subcmds: [add, install]
+    activity: setup
+    role: orchestrator.package_manager
+    effect: mutating
+
+  - id: choco-scoop-winget-install
+    binaries: [choco, scoop, winget]
+    subcmds: [install]
+    activity: setup
+    role: orchestrator.package_manager
+    effect: mutating
+
+  # Package removal — destructive
+  - id: pip-pip3-uninstall-destructive
+    binaries: [pip, pip3]
+    subcmds: [uninstall]
+    activity: implementation
+    role: orchestrator.package_manager
+    effect: destructive
+    action: remove.delete
+
+  - id: npm-pnpm-yarn-uninstall-remove-destructive
+    binaries: [npm, pnpm, yarn]
+    subcmds: [uninstall, remove]
+    activity: implementation
+    role: orchestrator.package_manager
+    effect: destructive
+    action: remove.delete
+
+  - id: apt-apt-get-remove-purge-destructive
+    binaries: [apt, apt-get]
+    subcmds: [remove, purge, autoremove]
+    activity: implementation
+    role: orchestrator.package_manager
+    effect: destructive
+    action: remove.delete
+
+  - id: brew-uninstall-destructive
+    binaries: [brew]
+    subcmds: [uninstall, remove]
+    activity: implementation
+    role: orchestrator.package_manager
+    effect: destructive
+    action: remove.delete
+
+  - id: cargo-remove-destructive
+    binaries: [cargo]
+    subcmds: [remove]
+    activity: implementation
+    role: orchestrator.package_manager
+    effect: destructive
+    action: remove.delete
+
+  - id: bats-jest-mocha-nox-pest-phpunit-playwright-pytest-rspec-tox-vitest-test-runner
+    binaries: [bats, jest, mocha, nox, pest, phpunit, playwright, pytest, rspec, tox, vitest]
+    activity: verification
+    role: validator.test_runner
+    effect: read_only
+
+  - id: cargo-dart-dotnet-go-gradle-make-mvn-npm-pnpm-swift-yarn-test-tests
+    binaries: [cargo, dart, dotnet, go, gradle, make, mvn, npm, pnpm, swift, yarn]
+    subcmds: [test, tests]
+    activity: verification
+    role: validator.test_runner
+    effect: read_only
+
+  - id: flake8-mypy-pylint-pyright-linter
+    binaries: [flake8, mypy, pylint, pyright]
+    activity: verification
+    role: validator.linter
+    effect: read_only
+
+  - id: tsc-type-checker
+    binaries: [tsc]
+    activity: verification
+    role: validator.type_checker
+    effect: read_only
+
+  - id: ruff-check-reject-fix
+    binaries: [ruff]
+    subcmds: [check]
+    flags_reject: ["--fix"]
+    activity: verification
+    role: validator.linter
+    effect: read_only
+
+  - id: ruff-format-require-check
+    binaries: [ruff]
+    subcmds: [format]
+    flags_require: ["--check"]
+    activity: verification
+    role: transformer.formatter
+    effect: read_only
+
+  - id: eslint-reject-fix
+    binaries: [eslint]
+    flags_reject: ["--fix"]
+    activity: verification
+    role: validator.linter
+    effect: read_only
+
+  - id: clippy-rubocop-reject-fix
+    binaries: [clippy, rubocop]
+    flags_reject: ["--fix"]
+    activity: verification
+    role: validator.linter
+    effect: read_only
+
+  - id: golangci-lint-run
+    binaries: [golangci-lint]
+    subcmds: [run]
+    activity: verification
+    role: validator.linter
+    effect: read_only
+
+  - id: black-prettier-require-check
+    binaries: [black, prettier]
+    flags_require: ["--check"]
+    activity: verification
+    role: transformer.formatter
+    effect: read_only
+
+  - id: cargo-clippy
+    binaries: [cargo]
+    subcmds: [clippy]
+    activity: verification
+    role: validator.linter
+    effect: read_only
+
+  - id: cargo-dotnet-go-make-build
+    binaries: [cargo, dotnet, go, make]
+    subcmds: [build]
+    activity: verification
+    role: validator.build_checker
+    effect: mutating
+
+  - id: webpack-bundler
+    binaries: [webpack]
+    activity: verification
+    role: transformer.bundler
+    effect: mutating
+
+  - id: vite-build
+    binaries: [vite]
+    subcmds: [build]
+    activity: verification
+    role: transformer.bundler
+    effect: mutating
+
+  - id: npm-pnpm-yarn-run
+    binaries: [npm, pnpm, yarn]
+    subcmds: [run]
+    activity: verification
+    role: orchestrator.task_runner
+
+  - id: git-cherry-pick-commit-merge-push-rebase-reset-stash-tag
+    binaries: [git]
+    subcmds: [cherry-pick, commit, merge, push, rebase, reset, stash, tag]
+    activity: delivery
+    role: persistence.version_control
+    effect: mutating
+
+  - id: git-checkout-switch-mutating
+    binaries: [git]
+    subcmds: [checkout, switch]
+    activity: implementation
+    role: persistence.version_control
+    effect: mutating
+
+  - id: git-clean-destructive
+    binaries: [git]
+    subcmds: [clean]
+    activity: implementation
+    role: persistence.version_control
+    effect: destructive
+    action: remove.clean
+
+  - id: git-branch-delete-destructive
+    binaries: [git]
+    subcmds: [branch]
+    flags_require: ["-D"]
+    activity: implementation
+    role: persistence.version_control
+    effect: destructive
+    action: remove.delete
+
+  - id: git-branch-delete-lowercase-destructive
+    binaries: [git]
+    subcmds: [branch]
+    flags_require: ["-d"]
+    activity: implementation
+    role: persistence.version_control
+    effect: destructive
+    action: remove.delete
+
+  - id: git-branch-move-mutating
+    binaries: [git]
+    subcmds: [branch]
+    flags_require: ["-m"]
+    activity: implementation
+    role: persistence.version_control
+    effect: mutating
+    action: modify.rename
+
+  - id: git-branch-move-force-mutating
+    binaries: [git]
+    subcmds: [branch]
+    flags_require: ["-M"]
+    activity: implementation
+    role: persistence.version_control
+    effect: mutating
+    action: modify.rename
+
+  - id: git-pull-mutating
+    binaries: [git]
+    subcmds: [pull]
+    activity: implementation
+    role: persistence.version_control
+    effect: mutating
+    action: modify.merge
+
+  - id: git-clone-mutating
+    binaries: [git]
+    subcmds: [clone]
+    activity: setup
+    role: persistence.version_control
+    effect: mutating
+    action: persist.write
+
+  - id: git-restore-mutating
+    binaries: [git]
+    subcmds: [restore]
+    activity: implementation
+    role: persistence.version_control
+    effect: mutating
+    action: modify.overwrite
+
+  - id: git-blame-branch-diff-log-show-status
+    binaries: [git]
+    subcmds: [blame, branch, diff, log, show, status]
+    activity: investigation
+    role: persistence.version_control
+    effect: read_only
+
+  - id: build-module-invoke-build-invoke-pester-invoke-scriptanalyzer-test-connection-test-netconnection-test-path-test-runner
+    binaries: [build-module, invoke-build, invoke-pester, invoke-scriptanalyzer, test-connection, test-netconnection, test-path]
+    activity: verification
+    role: validator.test_runner
+    effect: read_only
+
+  - id: install-module-install-package-install-psresource-register-psrepository-update-module-package-manager
+    binaries: [install-module, install-package, install-psresource, register-psrepository, update-module]
+    activity: setup
+    role: orchestrator.package_manager
+    effect: mutating
+
+  - id: format-list-format-table-get-childitem-get-command-get-content-get-help-get-item-get-itemproperty-get-module-get-process-get-service-get-variable-measure-object-out-string-select-object-select-string-sort-object-where-object-file-browser
+    binaries: [format-list, format-table, get-childitem, get-command, get-content, get-help, get-item, get-itemproperty, get-module, get-process, get-service, get-variable, measure-object, out-string, select-object, select-string, sort-object, where-object]
+    activity: investigation
+    role: retriever.file_browser
+    effect: read_only
+
+  - id: find-delete-destructive
+    binaries: [find]
+    flags_require: ["-delete"]
+    activity: implementation
+    role: executor.script_runner
+    effect: destructive
+    action: remove.delete
+
+  - id: dir-find-findstr-set-tree-type-where-file-browser
+    binaries: [dir, find, findstr, set, tree, type, where]
+    activity: investigation
+    role: retriever.file_browser
+    effect: read_only
+
+  - id: docker-podman-build
+    binaries: [docker, podman]
+    subcmds: [build]
+    activity: verification
+    role: executor.container_runtime
+    effect: mutating
+    scope: artifact.container_image
+    action: validate.build_check
+
+  - id: docker-podman-push
+    binaries: [docker, podman]
+    subcmds: [push]
+    activity: implementation
+    role: executor.container_runtime
+    effect: mutating
+    scope: artifact.container_image
+    action: deliver.push
+
+  - id: docker-podman-pull
+    binaries: [docker, podman]
+    subcmds: [pull]
+    activity: setup
+    role: executor.container_runtime
+    effect: mutating
+    scope: artifact.container_image
+    action: persist.install
+
+  - id: docker-podman-exec-restart-run-start-stop
+    binaries: [docker, podman]
+    subcmds: [exec, restart, run, start, stop]
+    activity: implementation
+    role: executor.container_runtime
+    effect: mutating
+    scope: state.process
+    action: execute.run_service
+
+  - id: docker-podman-images-inspect-logs-ps-stats
+    binaries: [docker, podman]
+    subcmds: [images, inspect, logs, ps, stats]
+    activity: investigation
+    role: executor.container_runtime
+    effect: read_only
+    scope: state.process
+    action: retrieve.browse
+
+  - id: docker-podman-prune-rm-rmi
+    binaries: [docker, podman]
+    subcmds: [prune, rm, rmi]
+    activity: implementation
+    role: executor.container_runtime
+    effect: destructive
+    scope: artifact.container_image
+    action: remove.delete
+
+  - id: docker-podman-system
+    binaries: [docker, podman]
+    subcmds: [system]
+    activity: investigation
+    role: executor.container_runtime
+    scope: state.process
+    action: retrieve.browse
+
+  - id: docker-compose-restart-start-up
+    binaries: [docker-compose]
+    subcmds: [restart, start, up]
+    activity: implementation
+    role: executor.container_runtime
+    effect: mutating
+    scope: state.service
+    action: execute.run_service
+
+  - id: docker-compose-down-rm-stop
+    binaries: [docker-compose]
+    subcmds: [down, rm, stop]
+    activity: implementation
+    role: executor.container_runtime
+    effect: destructive
+    scope: state.service
+    action: remove.teardown
+
+  - id: docker-compose-build
+    binaries: [docker-compose]
+    subcmds: [build]
+    activity: verification
+    role: executor.container_runtime
+    effect: mutating
+    scope: artifact.container_image
+    action: validate.build_check
+
+  - id: docker-compose-logs-ps
+    binaries: [docker-compose]
+    subcmds: [logs, ps]
+    activity: investigation
+    role: executor.container_runtime
+    effect: read_only
+    scope: state.service
+    action: retrieve.browse
+
+  - id: kubectl-apply-create-patch-replace
+    binaries: [kubectl]
+    subcmds: [apply, create, patch, replace]
+    activity: implementation
+    role: executor.container_runtime
+    effect: mutating
+    scope: state.deployment
+    action: deliver.deploy
+
+  - id: kubectl-describe-events-get-logs-top
+    binaries: [kubectl]
+    subcmds: [describe, events, get, logs, top]
+    activity: investigation
+    role: executor.container_runtime
+    effect: read_only
+    scope: state.deployment
+    action: retrieve.browse
+
+  - id: kubectl-delete
+    binaries: [kubectl]
+    subcmds: [delete]
+    activity: implementation
+    role: executor.container_runtime
+    effect: destructive
+    scope: state.deployment
+    action: remove.delete
+
+  - id: kubectl-exec-port-forward-run
+    binaries: [kubectl]
+    subcmds: [exec, port-forward, run]
+    activity: implementation
+    role: executor.container_runtime
+    effect: mutating
+    scope: state.process
+    action: execute.run_script
+
+  - id: terraform-tofu-plan-validate
+    binaries: [terraform, tofu]
+    subcmds: [plan, validate]
+    activity: verification
+    role: orchestrator.task_runner
+    effect: read_only
+    scope: configuration.infrastructure
+    action: validate.build_check
+
+  - id: terraform-tofu-apply
+    binaries: [terraform, tofu]
+    subcmds: [apply]
+    activity: implementation
+    role: orchestrator.task_runner
+    effect: mutating
+    scope: configuration.infrastructure
+    action: deliver.deploy
+
+  - id: terraform-tofu-destroy
+    binaries: [terraform, tofu]
+    subcmds: [destroy]
+    activity: implementation
+    role: orchestrator.task_runner
+    effect: destructive
+    scope: configuration.infrastructure
+    action: remove.teardown
+
+  - id: terraform-tofu-init
+    binaries: [terraform, tofu]
+    subcmds: [init]
+    activity: setup
+    role: orchestrator.task_runner
+    effect: mutating
+    scope: configuration.infrastructure
+    action: configure.setup
+
+  - id: terraform-tofu-output-show-state
+    binaries: [terraform, tofu]
+    subcmds: [output, show, state]
+    activity: investigation
+    role: orchestrator.task_runner
+    effect: read_only
+    scope: configuration.infrastructure
+    action: retrieve.browse
+
+  - id: helm-install-upgrade
+    binaries: [helm]
+    subcmds: [install, upgrade]
+    activity: implementation
+    role: orchestrator.package_manager
+    effect: mutating
+    scope: state.deployment
+    action: deliver.deploy
+
+  - id: helm-lint-template
+    binaries: [helm]
+    subcmds: [lint, template]
+    activity: verification
+    role: orchestrator.task_runner
+    effect: read_only
+    scope: state.deployment
+    action: validate.build_check
+
+  - id: helm-delete-uninstall
+    binaries: [helm]
+    subcmds: [delete, uninstall]
+    activity: implementation
+    role: orchestrator.package_manager
+    effect: destructive
+    scope: state.deployment
+    action: remove.teardown
+
+  - id: helm-get-list-status
+    binaries: [helm]
+    subcmds: [get, list, status]
+    activity: investigation
+    role: orchestrator.task_runner
+    effect: read_only
+    scope: state.deployment
+    action: retrieve.browse
+
+  - id: pulumi-preview
+    binaries: [pulumi]
+    subcmds: [preview]
+    activity: verification
+    role: orchestrator.task_runner
+    effect: read_only
+    scope: configuration.infrastructure
+    action: validate.build_check
+
+  - id: pulumi-up
+    binaries: [pulumi]
+    subcmds: [up]
+    activity: implementation
+    role: orchestrator.task_runner
+    effect: mutating
+    scope: configuration.infrastructure
+    action: deliver.deploy
+
+  - id: pulumi-destroy
+    binaries: [pulumi]
+    subcmds: [destroy]
+    activity: implementation
+    role: orchestrator.task_runner
+    effect: destructive
+    scope: configuration.infrastructure
+    action: remove.teardown
+
+  - id: curl-require-X
+    binaries: [curl]
+    flags_require: ["-X"]
+    activity: implementation
+    role: retriever.api_client
+    effect: mutating
+    action: execute.run_script
+
+  - id: curl-require-request
+    binaries: [curl]
+    flags_require: ["--request"]
+    activity: implementation
+    role: retriever.api_client
+    effect: mutating
+    action: execute.run_script
+
+  - id: curl-require-d
+    binaries: [curl]
+    flags_require: ["-d"]
+    activity: implementation
+    role: retriever.api_client
+    effect: mutating
+    action: execute.run_script
+
+  - id: curl-require-data
+    binaries: [curl]
+    flags_require: ["--data"]
+    activity: implementation
+    role: retriever.api_client
+    effect: mutating
+    action: execute.run_script
+
+  - id: curl-require-F
+    binaries: [curl]
+    flags_require: ["-F"]
+    activity: implementation
+    role: retriever.api_client
+    effect: mutating
+    action: execute.run_script
+
+  - id: curl-require-form
+    binaries: [curl]
+    flags_require: ["--form"]
+    activity: implementation
+    role: retriever.api_client
+    effect: mutating
+    action: execute.run_script
+
+  - id: curl-require-T
+    binaries: [curl]
+    flags_require: ["-T"]
+    activity: implementation
+    role: retriever.api_client
+    effect: mutating
+    action: execute.run_script
+
+  - id: curl-require-upload-file
+    binaries: [curl]
+    flags_require: ["--upload-file"]
+    activity: implementation
+    role: retriever.api_client
+    effect: mutating
+    action: execute.run_script
+
+  - id: curl-require-o-output
+    binaries: [curl]
+    flags_require: ["-o"]
+    activity: implementation
+    role: retriever.api_client
+    effect: mutating
+    action: persist.write
+
+  - id: curl-require-O-output
+    binaries: [curl]
+    flags_require: ["-O"]
+    activity: implementation
+    role: retriever.api_client
+    effect: mutating
+    action: persist.write
+
+  - id: curl-require-output
+    binaries: [curl]
+    flags_require: ["--output"]
+    activity: implementation
+    role: retriever.api_client
+    effect: mutating
+    action: persist.write
+
+  - id: curl-api-client
+    binaries: [curl]
+    activity: investigation
+    role: retriever.api_client
+    effect: read_only
+    action: retrieve.read
+
+  - id: wget-api-client
+    binaries: [wget]
+    activity: implementation
+    role: retriever.api_client
+    effect: mutating
+    action: persist.write
+
+  - id: sed-require-i
+    binaries: [sed]
+    flags_require: ["-i"]
+    activity: implementation
+    role: modifier.file_editor
+    effect: mutating
+    action: modify.edit
+
+  - id: sed-search-index
+    binaries: [sed]
+    activity: investigation
+    role: retriever.search_index
+    effect: read_only
+    action: retrieve.search
+
+  - id: perl-require-i
+    binaries: [perl]
+    flags_require: ["-i"]
+    activity: implementation
+    role: modifier.file_editor
+    effect: mutating
+    action: modify.edit
+
+  - id: awk-gawk-jq-perl-yq-search-index
+    binaries: [awk, gawk, jq, perl, yq]
+    activity: investigation
+    role: retriever.search_index
+    effect: read_only
+    action: retrieve.search
+
+  - id: copy-cp-file-editor
+    binaries: [copy, cp]
+    activity: implementation
+    role: modifier.file_editor
+    effect: mutating
+    action: persist.write
+
+  - id: move-mv-rename-file-editor
+    binaries: [move, mv, rename]
+    activity: implementation
+    role: modifier.file_editor
+    effect: mutating
+    action: modify.edit
+
+  - id: mkdir-file-editor
+    binaries: [mkdir]
+    activity: setup
+    role: modifier.file_editor
+    effect: mutating
+    action: configure.setup
+
+  - id: del-erase-rd-rm-rmdir-script-runner
+    binaries: [del, erase, rd, rm, rmdir]
+    activity: implementation
+    role: executor.script_runner
+    effect: destructive
+    action: remove.delete
+
+  - id: chgrp-chmod-chown-icacls-script-runner
+    binaries: [chgrp, chmod, chown, icacls]
+    activity: setup
+    role: executor.script_runner
+    effect: mutating
+    scope: configuration.environment
+    action: configure.setup
+
+  - id: touch-file-editor
+    binaries: [touch]
+    activity: implementation
+    role: modifier.file_editor
+    effect: mutating
+    action: persist.write
+
+  - id: ln-file-editor
+    binaries: [ln]
+    activity: implementation
+    role: modifier.file_editor
+    effect: mutating
+    action: persist.write
+
+  - id: bat-cat-head-hexdump-less-more-tail-xxd-file-browser
+    binaries: [bat, cat, head, hexdump, less, more, tail, xxd]
+    activity: investigation
+    role: retriever.file_browser
+    effect: read_only
+    action: retrieve.read
+
+  - id: exa-eza-ll-ls-lsd-file-browser
+    binaries: [exa, eza, ll, ls, lsd]
+    activity: investigation
+    role: retriever.file_browser
+    effect: read_only
+    action: retrieve.browse
+
+  - id: tee-mutating
+    binaries: [tee]
+    activity: implementation
+    role: modifier.file_editor
+    effect: mutating
+    action: persist.write
+
+  - id: sort-output-mutating
+    binaries: [sort]
+    flags_require: ["-o"]
+    activity: implementation
+    role: modifier.file_editor
+    effect: mutating
+    action: persist.write
+
+  - id: comm-cut-diff-paste-sort-tr-uniq-wc-xargs-search-index
+    binaries: [comm, cut, diff, paste, sort, tr, uniq, wc, xargs]
+    activity: investigation
+    role: retriever.search_index
+    effect: read_only
+    action: retrieve.read
+
+  - id: ag-egrep-fgrep-grep-rg-ripgrep-search-index
+    binaries: [ag, egrep, fgrep, grep, rg, ripgrep]
+    activity: investigation
+    role: retriever.search_index
+    effect: read_only
+    action: retrieve.search
+
+  - id: fd-fdfind-file-browser
+    binaries: [fd, fdfind]
+    activity: investigation
+    role: retriever.file_browser
+    effect: read_only
+    action: retrieve.browse
+
+  - id: date-df-du-env-free-hostname-printenv-pwd-uname-uptime-whereis-which-whoami-script-runner
+    binaries: [date, df, du, env, free, hostname, printenv, pwd, uname, uptime, whereis, which, whoami]
+    activity: investigation
+    role: executor.script_runner
+    effect: read_only
+    action: retrieve.read
+
+  - id: conda-create-install-update
+    binaries: [conda]
+    subcmds: [create, install, update]
+    activity: setup
+    role: orchestrator.package_manager
+    effect: mutating
+    scope: configuration.environment
+    action: persist.install
+
+  - id: conda-activate-deactivate
+    binaries: [conda]
+    subcmds: [activate, deactivate]
+    activity: setup
+    role: orchestrator.package_manager
+    effect: read_only
+    scope: configuration.environment
+    action: configure.setup
+
+  - id: conda-info-list-search
+    binaries: [conda]
+    subcmds: [info, list, search]
+    activity: investigation
+    role: orchestrator.package_manager
+    effect: read_only
+    scope: configuration.environment
+    action: retrieve.browse
+
+  - id: venv-virtualenv-package-manager
+    binaries: [venv, virtualenv]
+    activity: setup
+    role: orchestrator.package_manager
+    effect: mutating
+    scope: configuration.environment
+    action: configure.setup
+
+  - id: asdf-fnm-mise-nvm-pyenv-rbenv-rtx-package-manager
+    binaries: [asdf, fnm, mise, nvm, pyenv, rbenv, rtx]
+    activity: setup
+    role: orchestrator.package_manager
+    effect: mutating
+    scope: configuration.environment
+    action: configure.setup
+
+  - id: bandit-safety-semgrep-snyk-trivy-security-scanner
+    binaries: [bandit, safety, semgrep, snyk, trivy]
+    activity: verification
+    role: validator.security_scanner
+    effect: read_only
+    action: validate.security_scan
+
+  - id: npm-pnpm-yarn-audit
+    binaries: [npm, pnpm, yarn]
+    subcmds: [audit]
+    activity: verification
+    role: validator.security_scanner
+    effect: read_only
+    action: validate.security_scan
+
+  - id: cargo-audit
+    binaries: [cargo]
+    subcmds: [audit]
+    activity: verification
+    role: validator.security_scanner
+    effect: read_only
+    action: validate.security_scan
+
+  - id: cmake-build-checker
+    binaries: [cmake]
+    activity: setup
+    role: validator.build_checker
+    effect: mutating
+    action: configure.setup
+
+  - id: bazel-ninja-build
+    binaries: [bazel, ninja]
+    subcmds: [build]
+    activity: verification
+    role: validator.build_checker
+    effect: mutating
+    action: validate.build_check
+
+  - id: bazel-test
+    binaries: [bazel]
+    subcmds: [test]
+    activity: verification
+    role: validator.test_runner
+    effect: read_only
+    action: validate.test
+
+  - id: gh-issue-pr-release
+    binaries: [gh]
+    subcmds: [issue, pr, release]
+    activity: delivery
+    role: persistence.version_control
+    effect: mutating
+    scope: artifact.repository
+
+  - id: gh-api-browse-gist-repo
+    binaries: [gh]
+    subcmds: [api, browse, gist, repo]
+    activity: investigation
+    role: retriever.api_client
+    effect: read_only
+    scope: artifact.repository
+
+  # ═══════════════════════════════════════════════════════════════════════════
+  # AWS CLI — subcommand-level classification
+  # ═══════════════════════════════════════════════════════════════════════════
+  # Effect is determined by verb_prefix_effects in effect_overrides.yaml.
+  # These rules match service-level subcmds for activity/scope routing.
+
+  - id: aws-s3-storage
+    binaries: [aws]
+    subcmds: [s3, s3api, glacier]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+    action: persist.write
+
+  - id: aws-iam-sts-identity
+    binaries: [aws]
+    subcmds: [iam, sts, sso, sso-admin, organizations, identitystore]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: aws-compute
+    binaries: [aws]
+    subcmds: [ec2, ecs, eks, lambda, lightsail, batch, autoscaling]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: aws-database
+    binaries: [aws]
+    subcmds: [rds, dynamodb, elasticache, redshift, docdb, neptune, dax]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: aws-analytics-ml
+    binaries: [aws]
+    subcmds: [athena, glue, emr, kinesis, firehose, sagemaker, bedrock, comprehend, rekognition, textract]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: aws-networking
+    binaries: [aws]
+    subcmds: [elb, elbv2, route53, cloudfront, apigateway, apigatewayv2, vpc-lattice]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: aws-deploy-cicd
+    binaries: [aws]
+    subcmds: [cloudformation, codebuild, codedeploy, codepipeline, codeartifact, ecr, stepfunctions]
+    activity: implementation
+    role: orchestrator.task_runner
+    scope: configuration.infrastructure
+
+  - id: aws-messaging
+    binaries: [aws]
+    subcmds: [sqs, sns, events, eventbridge, ses, sesv2]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: aws-security
+    binaries: [aws]
+    subcmds: [kms, secretsmanager, acm, waf, wafv2, guardduty, inspector2, securityhub]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: aws-observability
+    binaries: [aws]
+    subcmds: [logs, cloudwatch, cloudtrail, xray, ce]
+    activity: investigation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: aws-config-ssm
+    binaries: [aws]
+    subcmds: [ssm, config, configservice, appconfig]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  # ═══════════════════════════════════════════════════════════════════════════
+  # Azure CLI (az) — subcommand-level classification
+  # ═══════════════════════════════════════════════════════════════════════════
+
+  - id: az-login-account
+    binaries: [az]
+    subcmds: [login, logout, account, configure, version, feedback, find, interactive, rest, self-test, upgrade]
+    activity: setup
+    role: retriever.api_client
+    effect: read_only
+    scope: configuration.infrastructure
+    action: configure.setup
+
+  - id: az-compute
+    binaries: [az]
+    subcmds: [vm, vmss, sig, disk, snapshot, image, ppg, capacity]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: az-containers
+    binaries: [az]
+    subcmds: [aks, acr, container, containerapp]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: az-networking
+    binaries: [az]
+    subcmds: [network, cdn, frontdoor, dns, private-dns, traffic-manager]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: az-storage-data
+    binaries: [az]
+    subcmds: [storage, dls]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: az-databases
+    binaries: [az]
+    subcmds: [sql, cosmosdb, mysql, postgres, redis, mariadb]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: az-identity-security
+    binaries: [az]
+    subcmds: [ad, role, keyvault, identity]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: az-web-serverless
+    binaries: [az]
+    subcmds: [webapp, functionapp, staticwebapp, logicapp, apim, spring]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: az-devops-deploy
+    binaries: [az]
+    subcmds: [deployment, group, resource, tag, lock, policy, blueprint, managedapp]
+    activity: implementation
+    role: orchestrator.task_runner
+    scope: configuration.infrastructure
+
+  - id: az-messaging
+    binaries: [az]
+    subcmds: [servicebus, eventhubs, eventgrid, relay, notification-hub, signalr]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: az-monitoring
+    binaries: [az]
+    subcmds: [monitor, advisor, alerts]
+    activity: investigation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  # ═══════════════════════════════════════════════════════════════════════════
+  # Google Cloud CLI (gcloud) — subcommand-level classification
+  # ═══════════════════════════════════════════════════════════════════════════
+
+  - id: gcloud-auth-config
+    binaries: [gcloud]
+    subcmds: [auth, config, init, components, topic, version, info]
+    activity: setup
+    role: retriever.api_client
+    effect: read_only
+    scope: configuration.infrastructure
+    action: configure.setup
+
+  - id: gcloud-compute
+    binaries: [gcloud]
+    subcmds: [compute]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: gcloud-container
+    binaries: [gcloud]
+    subcmds: [container, artifacts]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: gcloud-serverless
+    binaries: [gcloud]
+    subcmds: [run, functions, app, scheduler, tasks, workflows, eventarc]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: gcloud-data
+    binaries: [gcloud]
+    subcmds: [sql, spanner, firestore, bigtable, datastore, memcache, storage, dataflow, dataproc]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: gcloud-networking
+    binaries: [gcloud]
+    subcmds: [dns, domains]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: gcloud-iam-security
+    binaries: [gcloud]
+    subcmds: [iam, projects, organizations, secrets, kms, access-context-manager]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: gcloud-messaging
+    binaries: [gcloud]
+    subcmds: [pubsub]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: gcloud-devops
+    binaries: [gcloud]
+    subcmds: [builds, deploy, source]
+    activity: implementation
+    role: orchestrator.task_runner
+    scope: configuration.infrastructure
+
+  - id: gcloud-monitoring
+    binaries: [gcloud]
+    subcmds: [logging, monitoring, trace]
+    activity: investigation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  # --- gsutil (legacy GCS CLI) ---
+  - id: gsutil-read-only
+    binaries: [gsutil]
+    subcmds: [ls, cat, stat, du, hash, ver, acl, cors, defacl, iam, label, lifecycle, logging, notification, requesterpays, retention, versioning, web, signurl]
+    activity: investigation
+    role: retriever.api_client
+    effect: read_only
+    scope: configuration.infrastructure
+    action: retrieve.browse
+
+  - id: gsutil-mutating
+    binaries: [gsutil]
+    subcmds: [cp, mv, mb, rsync, rewrite, compose, setmeta]
+    activity: implementation
+    role: retriever.api_client
+    effect: mutating
+    scope: configuration.infrastructure
+    action: persist.write
+
+  - id: gsutil-destructive
+    binaries: [gsutil]
+    subcmds: [rm, rb]
+    activity: implementation
+    role: retriever.api_client
+    effect: destructive
+    scope: configuration.infrastructure
+    action: remove.delete
+
+  # ═══════════════════════════════════════════════════════════════════════════
+  # Cloud CLI fallback — catches unrecognized subcommands
+  # ═══════════════════════════════════════════════════════════════════════════
+  - id: aws-az-gcloud-fallback
+    binaries: [aws, az, gcloud]
+    activity: implementation
+    role: retriever.api_client
+    scope: configuration.infrastructure
+
+  - id: twine-upload
+    binaries: [twine]
+    subcmds: [upload]
+    activity: implementation
+    role: orchestrator.task_runner
+    effect: mutating
+    scope: artifact.package
+    action: deliver.publish
+