rail_verdict 1.1.0 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 808405ac6448a462283966840c5b9074afff5cd43f0c2c3b477d9951e7dfe0a8
-  data.tar.gz: 2f3aa97c547c6db980c284ca4081bc09230d4e13f63369cced690f60d18ccddd
+  metadata.gz: 63845a29f84295397de20a23b72c7d6e0a9d6c969be35ac8081e2536b0a37cec
+  data.tar.gz: 6e778d530c6abe87db5997b9d5fe328ebd750ac1722ede75042195b5d98d92cf
 SHA512:
-  metadata.gz: a70e6b7d070e6d4990b0b7991af2332c572e0ad2c9438b0ada3afb7e095729285b5b5714c8be8be512e1c7d8907e089bec08d5e4b62524a401719d215bc2eb28
-  data.tar.gz: 6881881853b9073e8add4c6946d1bdb0da79928a57b6d27a057e9b1646dcbe9e960a9f646c9fb9f62743f5ba3c0d61f93fc2a1fa572b529e8071268f97b69f0b
+  metadata.gz: beabe5b069a803549a6af55d03f16256e5ebe7e5ab6152672a7a1fa415a75827656108c01207860251fc8936fdc3bfb6397c1f53ca53f342da5ee913051d1c2a
+  data.tar.gz: 72e637013c3a4216a90fcb466c947b6b6e97bc9035166bb8b96b76b62579c76f1253eb765d1c56ac1e39dd82197489c3535a411fece8535c6cd340bd0e741ac9

data/README.md

@@ -78,18 +78,11 @@ The Lab exercises RailVerdict across realistic operational scenarios:
 - Exercising fail-closed behavior on missing or malformed analyzer output;
 - Testing release artifact installation from clean environments.
 
-### 21 / 21 External Validation Campaign
+### External Validation Campaign
 
-The 1.0 release closeout validated **21 out of 21** external scenarios:
+The Lab independently validates the published gem as an external consumer. 1.0 closeout validated **21 / 21** scenarios; **1.2.0** certification validates **81 scenarios** (14 categories, see Lab README) including Verification Receipts and PR Intelligence. See [railverdict-lab](https://github.com/pedro-dalben/railverdict-lab) for the canonical campaign and results.
 
-| Category | Scenarios | Result |
-|---|---:|:---:|
-| **Core Verification** | 12 / 12 | PASS |
-| **Operational & CI** | 6 / 6 | PASS |
-| **Release Closeout** | 3 / 3 | PASS |
-| **Total** | **21 / 21** | **PASS** |
-
-These controlled validation scenarios represent rigorous external regression verification rather than a claim of mathematically bug-free software. During development, the Lab uncovered real defects — such as test failure scoping edge cases — which were fixed before the 1.0 release.
+These controlled validation scenarios represent rigorous external regression verification rather than a claim of mathematically bug-free software. During development, the Lab uncovered real defects — such as test failure scoping edge cases and the 1.2 dogfooding hardening — which were fixed before release.
 
 ---
 
@@ -236,11 +229,73 @@ an explicit value, including every analyzer in older configuration versions,
 continues to use 30 seconds. A timeout is incomplete evidence, never a normal
 finding: a required timeout produces `INCOMPLETE` and exit code `2`.
 
-RailVerdict 1.0.1 has no CLI timeout override; the versioned configuration is
+There is no CLI timeout override; the versioned configuration (`version: 1.5`) is
 the supported public surface. SimpleCov accepts the same setting for a uniform
 configuration contract, but reads a local coverage artifact rather than
 starting an analyzer process.
 
+### 30-Second Demonstration (real output)
+
+```console
+$ railverdict check
+
+RailVerdict Verification: PASS
+Policy: no_new_debt (complete)
+Analyzers: 5 run (5 complete)
+Findings: 0 introduced, 0 existing, 0 blocking
+Exit: 0
+```
+
+Introduce a controlled defect:
+
+```ruby
+# app/models/user.rb:42
+unused = "oops" # Lint/UselessAssignment
+```
+
+```console
+$ railverdict check
+
+RailVerdict Verification: FAIL
+Policy: no_new_debt (failed)
+Findings: 1 introduced (blocking), 0 existing
+  - [rubocop] Lint/UselessAssignment in app/models/user.rb:42 (introduced)
+Exit: 1
+```
+
+Fix it, rerun → `PASS`. See `docs/release/1.2-clean-room-rehearsal.md` for automated reproduction.
+
+### Why not just CI?
+
+CI answers **“did these jobs execute successfully?”** across fragmented outputs. RailVerdict answers **“given required evidence, repository state, baseline and policy, what is the deterministic verification decision for this change?”** — normalized findings, baseline-aware policy (`no_new_debt`), changed-scope (`--changed --base`), fail-closed `INCOMPLETE` on missing evidence, and machine contracts (JSON/SARIF/exits) plus Repository State Identity and Verification Receipts. It complements CI; the example in [GitHub Actions Integration](#github-actions-integration) runs RailVerdict inside CI.
+
+### Why not just RSpec + RuboCop?
+
+Those are the evidence. RailVerdict is the verifier:
+
+```
+RSpec says:       42 tests passed.
+RuboCop says:     3 offenses.
+SimpleCov says:   91.3% coverage.
+Git says:         these 7 lines changed.
+RailVerdict says: FAIL — this change introduced a blocking finding.
+```
+
+They produce facts; policy owns the gate. `rubocop` + `rspec` + `minitest` + `simplecov` + `bundler-audit` + `Git` are inputs; `PASS/WARN/FAIL/INCOMPLETE` is the `GateResult` (see `docs/contracts.md`).
+
+### Why this matters for AI agents
+
+An AI agent can write code, run tests, and declare itself finished — but it should not be the authority deciding whether its own work is acceptable.
+
+```
+Agent --modifies--> Repository --verify--> RailVerdict
+                                           |--> deterministic evidence
+                                           |--> GateResult
+                                           `--> Verification Receipt
+```
+
+The agent proposes; the verification system decides. Receipts let agents (and humans) prove `fresh` vs `stale` after any edit — see below. AI inside RailVerdict (`explain`/`investigate`) is advisory only and never changes `GateResult`.
+
 ---
 
 ## The Default Policy Model: No New Debt
@@ -334,6 +389,38 @@ exit code `2`.
 - **Changed-Line Coverage:** Evaluates whether newly added or modified executable lines are covered by tests;
 - **Fail-Closed Git Boundary:** If the base revision is missing or repository history is shallow, RailVerdict returns `INCOMPLETE` (exit code 2) rather than guessing or silently passing.
 
+### Verification Receipts (1.2)
+
+Verification is only meaningful for the exact state that was verified. RailVerdict 1.2 binds every guarded verification to a deterministic **Repository State Identity** (HEAD + Git index snapshot + worktree delta with content hashes + configuration/baseline/waiver digests) and issues a machine-readable **Verification Receipt**:
+
+```console
+$ railverdict check
+# => RailVerdict Verification: PASS (exit 0)
+$ railverdict receipt create > receipt.json
+# receipt_id = sha256:<64 hex>  (no created_at, no timestamps)
+
+$ railverdict receipt verify receipt.json --format json
+{"schema_version":"1.0","status":"fresh","reasons":[],"gate":"PASS"}
+```
+
+Edit anything afterwards and the same receipt reports `stale`:
+
+```console
+$ echo "# changed after verification" >> app/models/user.rb
+$ railverdict receipt verify receipt.json --format json
+{"schema_version":"1.0","status":"stale","reasons":["worktree_changed"],"gate":"PASS"}
+# exit 2 — current state is not what was verified
+
+# Same for staged, config, baseline, waiver edits:
+# head_changed | index_changed | worktree_changed | configuration_changed | baseline_changed | waivers_changed
+```
+
+If the repository mutates while analyzers run, receipt issuance fails closed with `repository_changed_during_verification`. Receipts exist for `PASS`, `FAIL`, and `INCOMPLETE`; they are deterministic integrity records — **not signed attestations** — a trusted CI remains the trust anchor when forgery is in scope. Full protocol in [docs/agent-verification.md](docs/agent-verification.md).
+
+```
+Deterministic Verification → PR Intelligence → Verification Receipt → Agent Verification Protocol
+```
+
 ---
 
 ## Supported Analyzers
@@ -348,7 +435,7 @@ All analyzers in RailVerdict are **external and owned by the target project**. R
 | **SimpleCov** | Code and changed-line coverage | `>= 1, < 2` | Ingests versioned public `coverage/coverage.json` v1 (never parses internal `.resultset.json`). |
 | **bundler-audit** | Gem dependency vulnerabilities | `>= 0.9.3, < 1` | Runs `bundle exec bundler-audit check --format json` (never runs automatic updates). Robustly extracts JSON when advisory-DB download notices precede the payload. |
 
-> **Brakeman Status:** Brakeman support is **not included** in 1.0 (on HOLD pending legal and licensing review). Third-party analyzers retain their respective upstream licenses.
+> **Brakeman Status:** Brakeman support is **not included** in 1.2.0 (on HOLD pending legal and licensing review). Third-party analyzers retain their respective upstream licenses.
 
 ---
 
@@ -434,7 +521,44 @@ See [`docs/ai.md`](docs/ai.md) and [`docs/privacy.md`](docs/privacy.md) for deta
 
 ## Coding Agents & The Repair Loop
 
-RailVerdict provides a structured verification loop for AI coding agents (such as Claude, Codex, or custom agents):
+### Agent Completion Protocol (copyable for AGENTS.md / CLAUDE.md / Codex)
+
+Before declaring any code-changing task complete:
+
+1. Run the required project tests.
+2. Run `bundle exec railverdict check` (or `check --changed --base <main>` in PRs).
+3. If `FAIL`: remediate findings and rerun until `PASS` or explicitly report the blocker.
+4. If `INCOMPLETE` (exit 2): do not claim verification succeeded — fix the evidence gap (missing analyzer, bad base, shallow history).
+5. After final `PASS`, create `bundle exec railverdict receipt create > receipt.json`.
+6. Do not modify repository state after receipt creation without reverifying — `receipt verify` must stay `fresh`.
+
+`FAIL` means remediation required. `INCOMPLETE` must never be represented as `PASS`. See `docs/agent-verification.md` for the formal contract.
+
+<details><summary>AGENTS.md snippet (paste into your repo)</summary>
+
+```markdown
+## Verification
+
+Before completing any code-changing task:
+
+bundle exec railverdict check
+
+A task may only be reported as verified when RailVerdict returns PASS (exit 0).
+
+FAIL (exit 1) means remediation is required.
+
+INCOMPLETE (exit 2) means required evidence could not be obtained and must never be represented as PASS.
+
+After the final PASS, create a verification receipt: bundle exec railverdict receipt create > receipt.json
+
+Do not modify repository state after receipt creation without reverifying (receipt verify must be fresh).
+```
+
+Validated against 1.2.0: `init`, `doctor`, `check`, `pr`, `baseline create`, `findings`, `repair`, `receipt create|verify`, `mcp serve`.
+
+</details>
+
+RailVerdict also provides a structured verification loop for AI coding agents (such as Claude, Codex, or custom agents):
 
 ```
 Agent modifies code
@@ -487,6 +611,8 @@ railverdict mcp serve
 | `verify_repair` | Reruns verification and classifies whether a repair succeeded or regressed. |
 | `explain` | Generates an advisory AI explanation for a finding. |
 | `investigate` | Investigates top blocking findings across the codebase. |
+| `get_verification_receipt` | Returns the Verification Receipt for the last `verify` without rerunning analyzers (refuses stale cache). |
+| `get_pr_intelligence` | Returns PR Intelligence derived from the last `verify`'s GateResult (no rerun). |
 
 ### MCP Security Properties
 
@@ -559,7 +685,7 @@ To maintain clear technical boundaries, RailVerdict is explicitly **NOT**:
 
 ## Project Status
 
-- **Release Version:** `1.0.1`
+- **Release Version:** `1.2.0`
 - **License:** [MIT](LICENSE) (see [NOTICE](NOTICE))
 - **Trademarks:** [TRADEMARKS.md](TRADEMARKS.md)
 - **Foundation & Legal:** [docs/foundation.md](docs/foundation.md) — preliminary screen found no obvious software/tool conflict; NOT LEGAL CLEARANCE; qualified trademark review NOT PERFORMED — NON-BLOCKING BY MAINTAINER DECISION 2026-08-19 (Pedro Dalben).
@@ -589,9 +715,32 @@ To maintain clear technical boundaries, RailVerdict is explicitly **NOT**:
 
 ---
 
+## Try RailVerdict Challenge (5 minutes)
+
+1. `bundle add rail_verdict --group development,test --require false && bundle install`
+2. `bundle exec railverdict init && bundle exec railverdict doctor`
+3. `bundle exec railverdict baseline create` (or skip for greenfield) → `bundle exec railverdict check` → first gate
+4. Introduce a controlled RuboCop offense, rerun → `FAIL`, fix → `PASS`, then `railverdict receipt create && railverdict receipt verify`
+
+Tell us where it confused (see `docs/troubleshooting.md` and `docs/launch/try-challenge.md`).
+
+## FAQ
+
+**Is RailVerdict a test framework? Does it replace RSpec/RuboCop/CI?** No — it consumes them; they are evidence, it is the verifier. Run it inside CI.
+
+**Does it upload source? Require AI? Does AI decide PASS?** No/no/no — offline by default, AI advisory only off by default (`trust: redacted`).
+
+**Legacy apps?** Yes — `no_new_debt` baseline.
+
+**INCOMPLETE vs FAIL?** `FAIL` = complete verification rejected new debt; `INCOMPLETE` = required evidence missing → no gate (exit 2), never PASS.
+
+**Baseline / waiver / receipt?** Baseline snapshots current debt; waiver is exact-fingerprint, UTC-expired exemption; receipt is an integrity record (`receipt_id = sha256:`) — **not signed**, forgeable via whole-file rewrite — trusted CI is the trust anchor. Mutating after `PASS` makes receipt `stale`.
+
+**Brakeman / Ruby / Rails?** Brakeman not in 1.2.0 (HOLD); Ruby `>=3.3`, Rails `>=8.0` bounded.
+
 ## Contributing & Issues
 
-Contributions and issue reports are welcome. Please open an issue on GitHub for:
+Contributions and issue reports are welcome. See `CONTRIBUTING.md` for “how to run tests / add regression”. Issue templates: Bug, Feature request, Compatibility report. Please open an issue on GitHub for:
 
 - Analyzer compatibility and version range feedback;
 - False positives or false negatives in evidence normalization;

data/lib/rail_verdict/analyzers/_shared.rb

@@ -12,7 +12,15 @@ module RailVerdict
       def detail_for(run_result)
         detail = run_result.detail.to_s
         stderr = run_result.stderr.to_s.lines.first.to_s.strip
-        bounded_message([detail, stderr].reject(&:empty?).join(": "))
+        combined = [detail, stderr].reject(&:empty?).join(": ")
+        if combined.empty?
+          combined = if run_result.status == :exited
+            "analyzer exited with status #{run_result.exit_code} and produced no diagnostic output"
+          else
+            "analyzer produced no diagnostic output"
+          end
+        end
+        bounded_message(combined)
       end
 
       def execution_message(run_result)
@@ -40,15 +48,57 @@ module RailVerdict
 
       def failure_result(analyzer_id:, invocation:, status:, message:, tool_version: nil)
         status = status.to_s
+        bounded = bounded_message(message.to_s)
+        bounded = "#{status}: analyzer produced no diagnostic output" if bounded.strip.empty?
+        normalized_version = normalize_tool_version(tool_version)
         AnalyzerResult.new(
           analyzer: analyzer_id,
-          tool_version: tool_version,
+          tool_version: normalized_version,
           invocation: invocation,
           execution_status: status,
           finding_ids: [],
-          failure: { "code" => status, "message" => bounded_message(message.to_s) }
+          failure: { "code" => status, "message" => bounded }
         )
       end
+
+      def normalize_tool_version(version)
+        return nil if version.nil?
+        str = version.to_s.strip
+        return nil if str.empty?
+        str.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?").scrub("?")[0, 128]
+      end
+
+      def canonical_tool_version(version)
+        normalized = normalize_tool_version(version)
+        normalized.nil? || normalized.empty? ? "unknown" : normalized
+      end
+
+      # Canonical finding message normalization — single path for all analyzers.
+      # Guarantees deterministic, bounded, valid non-empty UTF-8.
+      FALLBACK_MESSAGE_SUFFIX = "reported a finding without a message"
+
+      def normalize_finding_message(analyzer_id, raw_message)
+        raw = raw_message.to_s.dup
+        # Handle invalid UTF-8, null bytes
+        raw = raw.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "\uFFFD")
+        raw = raw.scrub("\uFFFD")
+        raw = raw.delete("\u0000")
+        # Strip ANSI escape sequences
+        raw = raw.gsub(/\e\[[0-9;]*[A-Za-z]/, "")
+        raw = raw.gsub(/\e\][^\a]*\a/, "")
+        raw = raw.gsub(/\e\(B/, "")
+        # Remove control characters except tab/newline then normalize whitespace
+        raw = raw.gsub(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/, "")
+        raw = raw.strip
+        # Collapse whitespace including tabs/newlines
+        raw = raw.gsub(/\s+/, " ").strip
+        if raw.empty?
+          "#{analyzer_id} #{FALLBACK_MESSAGE_SUFFIX}"
+        else
+          raw = raw.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "\uFFFD").scrub("\uFFFD")
+          raw.bytesize > 4096 ? raw.byteslice(0, 4096).scrub("\uFFFD").strip : raw
+        end
+      end
     end
   end
 end

data/lib/rail_verdict/analyzers/bundler_audit.rb

@@ -47,7 +47,7 @@ module RailVerdict
         Probe.new(status: "malformed", message: Shared.bounded_message(error.message))
       end
 
-      def run(repository_root, runner: ProcessRunner, timeout_seconds: 30.0, probe_result: nil)
+      def run(repository_root, runner: ProcessRunner, timeout_seconds: 30.0, probe_result: nil, configuration: nil)
         command = @command_resolver.call(repository_root)
         probe_result ||= probe(repository_root, runner: runner, timeout_seconds: timeout_seconds)
         version_invocation = Shared.invocation_for(command, ["version"])
@@ -143,9 +143,8 @@ module RailVerdict
         gem_name = "unknown" if gem_name.to_s.empty?
 
         severity = map_severity(advisory["criticality"] || advisory["severity"] || entry["criticality"] || entry["severity"])
-        message = (advisory["title"] || advisory["description"] || entry["title"] || entry["description"] || "vulnerability in #{gem_name}").to_s
-        message = message.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?")[0, 4096]
-        message = "vulnerability in #{gem_name}" if message.empty?
+        raw_msg = advisory["title"] || advisory["description"] || entry["title"] || entry["description"] || "vulnerability in #{gem_name}"
+        message = Shared.normalize_finding_message(ANALYZER_ID, raw_msg)
 
         rule_id = "bundler_audit/advisory:#{id}"
         category = "dependency"

data/lib/rail_verdict/analyzers/minitest.rb

@@ -47,7 +47,7 @@ module RailVerdict
         Probe.new(status: "malformed", message: Shared.bounded_message(error.message))
       end
 
-      def run(repository_root, runner: ProcessRunner, timeout_seconds: 30.0, probe_result: nil)
+      def run(repository_root, runner: ProcessRunner, timeout_seconds: 30.0, probe_result: nil, configuration: nil)
         probe_result ||= probe(repository_root, runner: runner, timeout_seconds: timeout_seconds)
 
         unless probe_result.status == "succeeded"
@@ -248,12 +248,8 @@ module RailVerdict
         severity = status == "errored" ? "critical" : "high"
         category = "test"
         rule_id = "minitest/test:#{class_name}##{method_name}"
-        message = (test["failure_message"] || test["method_name"]).to_s
-        message = message.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?")[0, 4096]
-        message = "test failed: #{method_name}" if message.empty?
-        unless message.is_a?(String) && message.valid_encoding? && !message.empty? && message.bytesize <= 4096
-          raise MalformedOutput, "Minitest finding message is invalid"
-        end
+        raw_msg = test["failure_message"] || test["method_name"] || "test failed: #{method_name}"
+        message = Shared.normalize_finding_message(ANALYZER_ID, raw_msg)
 
         path = normalize_path(test["file"], class_name)
         start_line = test["line"]

data/lib/rail_verdict/analyzers/rspec.rb

@@ -45,7 +45,7 @@ module RailVerdict
         Probe.new(status: "malformed", message: Shared.bounded_message(error.message))
       end
 
-      def run(repository_root, runner: ProcessRunner, timeout_seconds: 30.0, probe_result: nil)
+      def run(repository_root, runner: ProcessRunner, timeout_seconds: 30.0, probe_result: nil, configuration: nil)
         command = @command_resolver.call(repository_root)
         probe_result ||= probe(repository_root, runner: runner, timeout_seconds: timeout_seconds)
         version_invocation = Shared.invocation_for(command, ["--version"])
@@ -55,11 +55,14 @@ module RailVerdict
         end
 
         invocation = Shared.invocation_for(command, ["--format", "json"])
+        # Real-world large RSpec suites can exceed 4 MiB; use bounded but larger capture.
+        max_stdout = resolve_stdout_limit(configuration, repository_root, 16 * 1024 * 1024)
         result = runner.run(
           command.fetch(:executable),
           invocation.fetch("argv"),
           chdir: repository_root,
-          timeout_seconds: timeout_seconds
+          timeout_seconds: timeout_seconds,
+          max_stdout_bytes: max_stdout
         )
         tool_version = probe_result.version
 
@@ -136,9 +139,8 @@ module RailVerdict
           return nil
         end
 
-        message = (example["exception"] && example["exception"]["message"]) || example["full_description"] || example["description"] || "rspec example failed"
-        message = message.to_s.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?")[0, 4096]
-        message = "rspec example failed" if message.empty?
+        raw_msg = (example["exception"] && example["exception"]["message"]) || example["full_description"] || example["description"] || nil
+        message = Shared.normalize_finding_message(ANALYZER_ID, raw_msg.nil? || raw_msg.to_s.strip.empty? ? "rspec example failed" : raw_msg)
 
         rule_id = "rspec/example:#{example['id'] || id_for(example, index)}"
         path = normalize_path(example["file_path"] || example["file"] || "spec/unknown_spec.rb")
@@ -269,6 +271,21 @@ module RailVerdict
       rescue ArgumentError, TypeError
         raise MalformedOutput, "RSpec summary fields have invalid types"
       end
+
+      def resolve_stdout_limit(configuration, repository_root, default_bytes)
+        # Prefer explicit per-analyzer config if present (future-compatible), else default.
+        raw_limit = nil
+        if configuration
+          sel = configuration.analyzers[ANALYZER_ID] rescue nil
+          raw_limit = sel && sel["output_limit_bytes"]
+        end
+        raw_limit ||= default_bytes
+        # Clamp to safe ceiling
+        limit = Integer(raw_limit) rescue default_bytes
+        limit = default_bytes if limit <= 0
+        max = RailVerdict::ProcessRunner::MAX_SAFE_STDOUT_BYTES
+        [[limit, max].min, 1024].max
+      end
     end
   end
 end

data/lib/rail_verdict/analyzers/rubocop.rb

@@ -55,7 +55,7 @@ module RailVerdict
         Probe.new(status: "malformed", message: bounded_message(error.message))
       end
 
-      def run(repository_root, runner: ProcessRunner, timeout_seconds: 30.0, probe_result: nil)
+      def run(repository_root, runner: ProcessRunner, timeout_seconds: 30.0, probe_result: nil, configuration: nil)
         command = @command_resolver.call(repository_root)
         probe_result ||= probe(repository_root, runner: runner, timeout_seconds: timeout_seconds)
         version_invocation = invocation_for(command, ["--version"])
@@ -65,11 +65,13 @@ module RailVerdict
         end
 
         invocation = invocation_for(command, ["--format", "json"])
+        max_stdout = resolve_stdout_limit(configuration, 8 * 1024 * 1024)
         result = runner.run(
           command.fetch(:executable),
           invocation.fetch("argv"),
           chdir: repository_root,
-          timeout_seconds: timeout_seconds
+          timeout_seconds: timeout_seconds,
+          max_stdout_bytes: max_stdout
         )
         tool_version = probe_result.version
 
@@ -255,10 +257,8 @@ module RailVerdict
           raise MalformedOutput, "RuboCop offense line range is invalid"
         end
 
-        message = offense["message"]
-        unless message.is_a?(String) && message.valid_encoding? && !message.empty? && message.bytesize <= 4096
-          raise MalformedOutput, "RuboCop offense message is invalid"
-        end
+        raw_msg = offense["message"]
+        message = Shared.normalize_finding_message(ANALYZER_ID, raw_msg)
 
         fingerprint = Finding.fingerprint_for(
           analyzer: ANALYZER_ID,
@@ -284,6 +284,14 @@ module RailVerdict
       rescue ArgumentError => error
         raise MalformedOutput, "RuboCop offense #{file_index}:#{offense_index} is malformed: #{error.message}"
       end
+
+      def resolve_stdout_limit(configuration, default_bytes)
+        raw = configuration && configuration.analyzers["rubocop"] && configuration.analyzers["rubocop"]["output_limit_bytes"]
+        raw ||= default_bytes
+        limit = Integer(raw) rescue default_bytes
+        limit = default_bytes if limit <= 0
+        [[limit, RailVerdict::ProcessRunner::MAX_SAFE_STDOUT_BYTES].min, 1024].max
+      end
     end
   end
 end