# Verification plan

Stack: JavaScript / TypeScript
Risk: Ordinary application behavior
Scope: Single package / service

## Assumptions
Use Node.js 22, a committed package-lock.json, and npm scripts named lint, typecheck and test. Adjust scripts for a JavaScript-only project.

## Review checklist
[ ] State expected behavior and rejection cases in the pull request.
[ ] Read changed code, callers, configuration and relevant schemas.
[ ] Add a regression test that fails for a plausible wrong implementation.
[ ] Exercise boundary values and the failure path.
[ ] Run deterministic checks and save commands, versions and results.
[ ] Review dependencies, secrets and external input handling.
[ ] Run the complete package test suite before merge.
[ ] Reproduce candidate AI-review findings before accepting them.
[ ] Document uncovered risks, an owner and a follow-up date.
[ ] Have a person approve the evidence before merging.

## Starting commands
```sh
npm ci
npm run lint
npm run typecheck
npm test
```

## GitHub Actions starting point
# STARTER ONLY: configure project scripts and dependencies before use.
# The checklist's security, integration and human-review steps are not automated here.
# Review action releases and pin approved commit SHAs in your production workflow.
name: Verification starter
on:
  pull_request:
  workflow_dispatch:
permissions:
  contents: read
jobs:
  checks:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: npm
      - run: npm ci
      - run: npm run lint
      - run: npm run typecheck
      - run: npm test

## Limits
This plan was generated locally. No code was inspected and no checks ran.
The CI job only runs the commands above; configure additional checks from the checklist.
Review untrusted code in an appropriate isolated environment. Never expose secrets to it.

References:
https://ailargescalecodeverification.sbs/guide/
https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions