{"slug": "reading-static-verification-evidence-three-exit-codes-three-review-decisions", "title": "Reading static verification evidence: three exit codes, three review decisions", "summary": "Kevin Kissi, founder and CEO of Zof, published a demonstration of Zof CLI 0.1.2 showing that its static verification command returns distinct exit codes for different outcomes: 0 for a clean addition function, 1 for a file containing eval, and 2 for a missing file. Kissi argues that a passing static check only proves the invocation completed without reporting a finding, not that tests ran or that a change is safe, and that reviewers should treat each exit code as a different decision signal. The examples are synthetic and were reproduced on macOS with Node 24.19.0 and Python 3.12.14 from a fresh npm install.", "body_md": "A passing command is useful evidence only when its meaning is clear. A static checker can complete successfully without running a test, observing production behavior, or proving that a software change is safe. Treating those outcomes as equivalent makes a release decision depend on work that never happened.\n\nThree tiny TypeScript examples make the distinction concrete: a simple addition function, a function containing `eval`, and a requested file that does not exist. Captured runs of Zof CLI 0.1.2 returned exit codes 0, 1, and 2 respectively. Each outcome calls for a different response from a reviewer.\n\n*Disclosure: This article was drafted with AI assistance using captured command output and public documentation. Its examples are synthetic; they do not describe a customer incident or personal production experience.*\n\n*Affiliation: Kevin Kissi is the founder and CEO of Zof.*\n\nThe original demonstration ran on macOS with Node 24.19.0 and Python 3.12.14, using an existing CLI installation whose compiled distribution files matched the public package. A separate fresh install of 0.1.2 from the official npm registry then reproduced the commands below in a disposable project. All three exits matched; the JSON evidence matched except for generated identifiers and timestamps. These runs establish the examples’ behavior on that environment, not universal compatibility.\n\nUse Node 22 or 24 and Python 3.10 or newer on Linux or macOS. The published instructions document these prerequisites. Installation is a separate step that downloads dependencies; `--ignore-scripts` disables package lifecycle scripts, while subsequent `--no-install` invocations decline installing a missing CLI. See the [public CLI documentation](https://github.com/Zof-AI/zof-dev-cli).\n\n```\nmkdir zof-static-demo\ncd zof-static-demo\nnode --version\npython3 --version\nnpm init -y\nnpm install --ignore-scripts --no-audit --no-fund --save-exact @zof-ai/cli@0.1.2\nnpx --no-install zof --help\n\nmkdir -p fixtures/clean fixtures/unsafe\ncat > fixtures/clean/math.ts <<'TS'\nexport function add(a: number, b: number): number {\n  return a + b\n}\nTS\n\ncat > fixtures/unsafe/math.ts <<'TS'\nexport function evaluate(input: string): unknown {\n  return eval(input)\n}\nTS\n```\n\nThe second file is input to static analysis. Do not run its function. These verification commands inspect source; they do not execute the application or its tests.\n\nCapture stdout, stderr, and the process exit code separately. The conditional preserves expected nonzero results even in a shell configured to stop on errors:\n\n```\nrun_case() {\n  case_name=$1\n  case_root=$2\n  case_file=$3\n  if npx --no-install zof verify --root \"$case_root\" \\\n      --changed \"$case_file\" --json \\\n      >\"$case_name.stdout.json\" 2>\"$case_name.stderr.txt\"; then\n    case_exit=0\n  else\n    case_exit=$?\n  fi\n  printf '%s exit=%s\\n' \"$case_name\" \"$case_exit\"\n}\n\nrun_case clean fixtures/clean math.ts\nrun_case unsafe fixtures/unsafe math.ts\nrun_case missing-file fixtures/clean missing.ts\n```\n\nThe captured exits were:\n\n```\nclean exit=0\nunsafe exit=1\nmissing-file exit=2\n```\n\nFor the addition function, the evidence reports `execution.status: completed` and `execution.result: pass`. Findings, tests, and artifacts are empty arrays. The tool identifies itself as `zof-cli` version `0.1.2`, with evidence type `static-analysis`.\n\nThat supports a narrow conclusion: this invocation completed without reporting a finding. It supplies no test result. An empty `tests` array cannot establish that arithmetic edge cases, integration behavior, or deployment configuration were checked.\n\nThe impact object also reports `confidence: high` and `complete: true`. Those fields must be read alongside its limitations. Because the invocation supplies an explicit file list, `EXPLICIT_FILES` says line changes and changed symbols are unavailable. The source repository and commit are both null in this synthetic example. Neither a reassuring confidence label nor an empty findings list fills those gaps.\n\nFor the `eval` example, execution completes with result `fail`. The captured finding identifies the review location precisely:\n\n```\n{\n  \"id\": \"dynamic-evaluation\",\n  \"severity\": \"high\",\n  \"message\": \"Dynamic code evaluation requires review; do not evaluate untrusted input.\",\n  \"path\": \"math.ts\",\n  \"line\": 2\n}\n```\n\nThe impact result changes too: confidence is low, completeness is false, and `DYNAMIC_EXECUTION` records an analysis limitation. This matters beyond the exit code. The checker has identified a construct it cannot fully analyze, so a reviewer should investigate the input's origin and whether dynamic evaluation is necessary.\n\nThe finding does not demonstrate an exploit or establish that every input is hostile. It provides a specific reason to inspect the code. Replacing dynamic evaluation with explicit operations may be appropriate, but that decision depends on the intended behavior. Any resulting tests should be recorded as separate evidence; none ran here.\n\nRequesting `missing.ts` produces exit 2. Stdout is empty, even though the command requested JSON. Stderr contains:\n\n```\nZOF_INPUT_ERROR: check command, workspace, bounded relative paths and configuration; use zof help. No input details were logged.\n```\n\nA consumer that treats empty output as an empty findings list would turn an input error into false reassurance. Check the exit code before parsing evidence. The documented meanings distinguish successful completion, a configured failure, and invalid or incomplete execution. In this example, the last category requires fixing the requested path and rerunning the check.\n\nEnvironment failures deserve the same attention. An earlier preserved attempt selected an unsuitable Python runtime and failed closed. Correcting the runtime path enabled the recorded runs. Reproducibility includes prerequisites and unsuccessful execution, not just the final green result.\n\nFor a real change, retain the command, tool version, inspected files, both output streams, and process exit. Check whether repository and commit attribution are present. Read findings and limitations before interpreting confidence or completeness. Then identify the additional evidence the change requires, such as behavior tests or integration checks.\n\nThe three cases establish a useful boundary: the clean example completed its static check; the dynamic example produced a concrete review finding; the missing-file example produced no successful verification result. A human release review can use those facts without silently expanding their scope. The decision should explain what was checked, what remains uncertain, and which additional checks support shipping the change.", "url": "https://wpnews.pro/news/reading-static-verification-evidence-three-exit-codes-three-review-decisions", "canonical_source": "https://dev.to/kevin_kissi_c8b5bb62a1f34/reading-static-verification-evidence-three-exit-codes-three-review-decisions-5ep1", "published_at": "2026-10-21 21:00:07+00:00", "updated_at": "2026-10-21 21:11:23.602974+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools"], "entities": ["Zof", "Kevin Kissi", "Zof CLI", "npm", "Node.js", "Python"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/reading-static-verification-evidence-three-exit-codes-three-review-decisions", "markdown": "https://wpnews.pro/news/reading-static-verification-evidence-three-exit-codes-three-review-decisions.md", "text": "https://wpnews.pro/news/reading-static-verification-evidence-three-exit-codes-three-review-decisions.txt", "jsonld": "https://wpnews.pro/news/reading-static-verification-evidence-three-exit-codes-three-review-decisions.jsonld"}}