{
  "activation_arguments": [
    "--oss-only",
    "--config=adapters/semgrep/native/v0.9.2/java"
  ],
  "activation_identity": "1.181.0 over the pinned snapshot vendored from https://github.com/semgrep/semgrep-rules into adapters/semgrep/native/v0.9.2/java",
  "adapter": "semgrep",
  "case_id": "dfb-taint-java-native-source-sink-positive",
  "evidence_kind": "retained-capability-decision",
  "model_profile": "tool-native",
  "modeling_category": "S",
  "modeling_category_label": "declared sources and sinks",
  "partition_source": "docs/native-profile.md#partition-summary",
  "reason": "tool-native activation of dfb-template-native-source-sink (category S — declared sources and sinks) is unsupported for 1.181.0 over Java by the activation partition (docs/native-profile.md#partition-summary, as amended): no shipped platform-source model: `System.getenv` occurs in no rule of the snapshot — nor anywhere in the upstream `java/` tree at the pinned commit — the two rules whose sink is the template's command API bind no source, the one taint-mode rule reaching `Runtime.exec` sources from `HttpServletRequest`, and the pinned engine over every fixture with the snapshot emits zero findings (Amendments A7/A27, reports/raw/amendment-a27-semgrep-jsjava-native/)",
  "stage": "preregistered-native-activation-partition",
  "state": "unsupported",
  "template_id": "dfb-template-native-source-sink",
  "witnessed_tool_identity": "1.181.0"
}