rail_verdict 1.3.0 → 1.8.2

data/lib/rail_verdict/analyzers/rspec.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require "json"
+require "tmpdir"
+require "securerandom"
 
 require_relative "_shared"
 
@@ -19,13 +21,16 @@ module RailVerdict
       end
 
       def probe(repository_root, runner: ProcessRunner, timeout_seconds: 15.0)
+        effective_timeout = [timeout_seconds.to_f, 5.0].min
         command = @command_resolver.call(repository_root)
-        invocation = Shared.invocation_for(command, ["--version"])
+        clean_prefix = clean_args_prefix(command.fetch(:args_prefix))
+        clean_command = command.merge(args_prefix: clean_prefix)
+        invocation = Shared.invocation_for(clean_command, ["--version"])
         result = runner.run(
-          command.fetch(:executable),
+          clean_command.fetch(:executable),
           invocation.fetch("argv"),
           chdir: repository_root,
-          timeout_seconds: timeout_seconds
+          timeout_seconds: effective_timeout
         )
 
         return Probe.new(status: "unavailable", message: Shared.detail_for(result)) if result.status == :spawn_failed
@@ -45,66 +50,167 @@ module RailVerdict
         Probe.new(status: "malformed", message: Shared.bounded_message(error.message))
       end
 
-      def run(repository_root, runner: ProcessRunner, timeout_seconds: 30.0, probe_result: nil, configuration: nil)
+      def run(repository_root, runner: ProcessRunner, timeout_seconds: 30.0, probe_result: nil, configuration: nil, target_files: nil, test_scope: "full", fallback_reason: nil)
         command = @command_resolver.call(repository_root)
+        clean_prefix = clean_args_prefix(command.fetch(:args_prefix))
+        clean_command = command.merge(args_prefix: clean_prefix)
         probe_result ||= probe(repository_root, runner: runner, timeout_seconds: timeout_seconds)
-        version_invocation = Shared.invocation_for(command, ["--version"])
+        version_invocation = Shared.invocation_for(clean_command, ["--version"])
 
         unless probe_result.status == "succeeded"
           return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: version_invocation, status: probe_result.status, message: probe_result.message, tool_version: probe_result.version), []]
         end
 
-        invocation = Shared.invocation_for(command, ["--format", "json"])
-        # Real-world large RSpec suites can exceed 4 MiB; use bounded but larger capture.
-        max_stdout = resolve_stdout_limit(configuration, repository_root, 16 * 1024 * 1024)
-        result = runner.run(
-          command.fetch(:executable),
-          invocation.fetch("argv"),
-          chdir: repository_root,
-          timeout_seconds: timeout_seconds,
-          max_stdout_bytes: max_stdout
-        )
-        tool_version = probe_result.version
+        if target_files.is_a?(Array) && target_files.empty? && test_scope == "targeted"
+          summary = {
+            "tests_total" => 0,
+            "duration_seconds" => 0.0,
+            "failures" => 0,
+            "errors" => 0,
+            "assertions" => 0,
+            "skips" => 0,
+            "runner" => "rspec #{probe_result.version}",
+            "test_scope" => "targeted",
+            "target_files" => [],
+            "fallback_reason" => fallback_reason
+          }.compact
+          analyzer_result = AnalyzerResult.new(
+            analyzer: ANALYZER_ID,
+            tool_version: probe_result.version,
+            invocation: Shared.invocation_for(clean_command, ["--format", "json"]),
+            execution_status: "succeeded",
+            finding_ids: [],
+            evidence_summary: summary
+          )
+          return [analyzer_result, []]
+        end
 
-        return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "unavailable", message: Shared.detail_for(result), tool_version: tool_version), []] if result.status == :spawn_failed
-        return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "truncated", message: Shared.detail_for(result), tool_version: tool_version), []] if Shared.truncated?(result)
-        return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "timed_out", message: Shared.detail_for(result), tool_version: tool_version), []] if result.status == :timed_out
-        return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "signaled", message: Shared.detail_for(result), tool_version: tool_version), []] if result.status == :signaled
+        output_path = File.join(Dir.tmpdir, "railverdict-rspec-#{SecureRandom.hex(8)}.json")
+        target_list = Array(target_files).compact.reject(&:empty?)
+        public_argv = target_list.empty? ? ["--format", "json"] : target_list + ["--format", "json"]
+        public_invocation = Shared.invocation_for(clean_command, public_argv)
+        run_argv = clean_prefix.dup.concat(target_list).concat(["--format", "json", "--out", output_path])
 
-        begin
-          document = JSON.parse(result.stdout)
-        rescue JSON::ParserError => error
-          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "parse_failed", message: Shared.bounded_message(error.message), tool_version: tool_version), []]
-        end
+        max_stdout = resolve_stdout_limit(configuration, repository_root, 16 * 1024 * 1024)
+        tool_version = probe_result.version
 
         begin
-          summary, findings = normalize_document(document)
-        rescue MalformedOutput => error
-          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "malformed", message: Shared.bounded_message(error.message), tool_version: tool_version), []]
+          result = runner.run(
+            clean_command.fetch(:executable),
+            run_argv,
+            chdir: repository_root,
+            timeout_seconds: timeout_seconds,
+            max_stdout_bytes: max_stdout
+          )
+
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "unavailable", message: Shared.detail_for(result), tool_version: tool_version), []] if result.status == :spawn_failed
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "truncated", message: Shared.detail_for(result), tool_version: tool_version), []] if Shared.truncated?(result)
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "timed_out", message: Shared.detail_for(result), tool_version: tool_version), []] if result.status == :timed_out
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "signaled", message: Shared.detail_for(result), tool_version: tool_version), []] if result.status == :signaled
+
+          unless File.file?(output_path)
+            detail = Shared.detail_for(result)
+            msg = detail.strip.empty? ? "RSpec did not produce structured output" : detail
+            status = result.exit_code && result.exit_code != 0 ? "failed" : "malformed"
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: status, message: msg, tool_version: tool_version), []]
+          end
+
+          begin
+            bytes = File.binread(output_path)
+          rescue SystemCallError => error
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "malformed", message: Shared.bounded_message(error.message), tool_version: tool_version), []]
+          end
+
+          if bytes.bytesize > max_stdout
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "truncated", message: "RSpec output exceeds #{max_stdout} bytes", tool_version: tool_version), []]
+          end
+
+          text = bytes.dup.force_encoding(Encoding::UTF_8)
+          unless text.valid_encoding?
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "parse_failed", message: "RSpec output is not valid UTF-8", tool_version: tool_version), []]
+          end
+
+          begin
+            document = JSON.parse(text)
+          rescue JSON::ParserError => error
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "parse_failed", message: Shared.bounded_message(error.message), tool_version: tool_version), []]
+          end
+
+          begin
+            summary, findings = normalize_document(document, test_scope: test_scope, target_files: target_list, fallback_reason: fallback_reason)
+          rescue MalformedOutput => error
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "malformed", message: Shared.bounded_message(error.message), tool_version: tool_version), []]
+          end
+
+          # Process exit reconciliation (RH-02):
+          # 0: all examples passed, 0 failures/errors
+          # 1: failed examples present (failures > 0 or findings non-empty)
+          # Any other exit code or contradiction: fail closed
+          failures_count = summary["failures"] || 0
+          if result.exit_code == 0
+            if failures_count > 0 || !findings.empty?
+              return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "malformed", message: "RSpec exited with status 0 but reported #{failures_count} failures", tool_version: tool_version), []]
+            end
+          elsif result.exit_code == 1
+            if failures_count == 0 && findings.empty?
+              detail = Shared.detail_for(result)
+              msg = detail.strip.empty? ? "RSpec exited with status 1 but reported 0 failed examples" : detail
+              return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "failed", message: msg, tool_version: tool_version), []]
+            end
+          else
+            detail = Shared.detail_for(result)
+            msg = detail.strip.empty? ? "RSpec exited with unexpected status #{result.exit_code}" : detail
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "failed", message: msg, tool_version: tool_version), []]
+          end
+
+          analyzer_result = AnalyzerResult.new(
+            analyzer: ANALYZER_ID,
+            tool_version: tool_version,
+            invocation: public_invocation,
+            execution_status: "succeeded",
+            finding_ids: findings.map(&:id),
+            evidence_summary: summary
+          )
+          [analyzer_result, findings]
+        ensure
+          begin
+            File.unlink(output_path) if output_path && File.exist?(output_path)
+          rescue StandardError
+            nil
+          end
         end
-
-        analyzer_result = AnalyzerResult.new(
-          analyzer: ANALYZER_ID,
-          tool_version: tool_version,
-          invocation: invocation,
-          execution_status: "succeeded",
-          finding_ids: findings.map(&:id),
-          evidence_summary: summary
-        )
-        [analyzer_result, findings]
       end
 
       private
 
       def default_command(repository_root)
         if File.file?(File.join(repository_root, "Gemfile"))
-          { executable: "bundle", args_prefix: ["exec", "rspec", "--format", "json"] }
+          { executable: "bundle", args_prefix: ["exec", "rspec"] }
         else
-          { executable: "rspec", args_prefix: ["--format", "json"] }
+          { executable: "rspec", args_prefix: [] }
+        end
+      end
+
+      def clean_args_prefix(prefix)
+        cleaned = []
+        skip_next = false
+        Array(prefix).each_with_index do |arg, i|
+          if skip_next
+            skip_next = false
+            next
+          end
+          if arg == "--format" && Array(prefix)[i + 1] == "json"
+            skip_next = true
+            next
+          elsif arg == "--format=json"
+            next
+          end
+          cleaned << arg
         end
+        cleaned
       end
 
-      def normalize_document(document)
+      def normalize_document(document, test_scope: "full", target_files: nil, fallback_reason: nil)
         raise MalformedOutput, "RSpec JSON root must be an object" unless document.is_a?(Hash)
 
         summary = document["summary"]
@@ -123,6 +229,9 @@ module RailVerdict
         findings = findings.uniq { |f| f.fingerprint }.sort_by(&:sort_key)
         summary_h = build_summary(summary, version)
         summary_h["tests_total"] = examples.length
+        summary_h["test_scope"] = test_scope if test_scope
+        summary_h["target_files"] = target_files if target_files && !target_files.empty?
+        summary_h["fallback_reason"] = fallback_reason if fallback_reason
 
         [summary_h, findings]
       end
@@ -142,7 +251,7 @@ module RailVerdict
         raw_msg = (example["exception"] && example["exception"]["message"]) || example["full_description"] || example["description"] || nil
         message = Shared.normalize_finding_message(ANALYZER_ID, raw_msg.nil? || raw_msg.to_s.strip.empty? ? "rspec example failed" : raw_msg)
 
-        rule_id = "rspec/example:#{example['id'] || id_for(example, index)}"
+        rule_id = "example:#{example[id] || id_for(example, index)}"
         path = normalize_path(example["file_path"] || example["file"] || "spec/unknown_spec.rb")
         failure_line, failure_path = failure_location(example, path)
         start_line = failure_line || example["line_number"] || extract_line(example["id"])
@@ -273,14 +382,12 @@ module RailVerdict
       end
 
       def resolve_stdout_limit(configuration, repository_root, default_bytes)
-        # Prefer explicit per-analyzer config if present (future-compatible), else default.
         raw_limit = nil
         if configuration
           sel = configuration.analyzers[ANALYZER_ID] rescue nil
           raw_limit = sel && sel["output_limit_bytes"]
         end
         raw_limit ||= default_bytes
-        # Clamp to safe ceiling
         limit = Integer(raw_limit) rescue default_bytes
         limit = default_bytes if limit <= 0
         max = RailVerdict::ProcessRunner::MAX_SAFE_STDOUT_BYTES

data/lib/rail_verdict/analyzers/rubocop.rb

@@ -27,13 +27,14 @@ module RailVerdict
       end
 
       def probe(repository_root, runner: ProcessRunner, timeout_seconds: 15.0)
+        effective_timeout = [timeout_seconds.to_f, 5.0].min
         command = @command_resolver.call(repository_root)
         invocation = invocation_for(command, ["--version"])
         result = runner.run(
           command.fetch(:executable),
           invocation.fetch("argv"),
           chdir: repository_root,
-          timeout_seconds: timeout_seconds
+          timeout_seconds: effective_timeout
         )
 
         return Probe.new(status: "unavailable", message: detail_for(result)) if result.status == :spawn_failed

data/lib/rail_verdict/analyzers/simplecov.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "json"
+require "pathname"
 
 require_relative "_shared"
 
@@ -18,9 +19,9 @@ module RailVerdict
 
       def probe(repository_root, runner: nil, timeout_seconds: 5.0)
         config = load_config(repository_root)
-        coverage_path = config.fetch("coverage_path") { DEFAULT_COVERAGE_PATH }
-        full_path = File.expand_path(coverage_path, repository_root)
-        return Probe.new(status: "unavailable", message: "coverage file is absent: #{coverage_path}") unless File.file?(full_path)
+        raw_path = config.fetch("coverage_path") { DEFAULT_COVERAGE_PATH }
+        full_path = resolve_contained_coverage_path(repository_root, raw_path)
+        return Probe.new(status: "unavailable", message: "coverage file is absent: #{raw_path}") unless File.file?(full_path)
 
         text = File.binread(full_path).force_encoding(Encoding::UTF_8)
         return Probe.new(status: "parse_failed", message: "coverage file is not valid UTF-8") unless text.valid_encoding?
@@ -30,11 +31,18 @@ module RailVerdict
         case detected
         when :coverage_v1
           version = document["version"].to_s
-          return Probe.new(status: "unsupported", message: "unsupported SimpleCov version #{version}") unless version.start_with?("1")
+          v = Gem::Version.new(version) rescue nil
+          if v.nil? || !SUPPORTED_VERSION_RANGE.satisfied_by?(v)
+            return Probe.new(status: "unsupported", version: version, message: "unsupported SimpleCov version #{version}")
+          end
           Probe.new(status: "succeeded", version: version)
         when :native_simplecov
           version = extract_native_version(document)
-          # Accept any native simplecov version >=0.20 with coverage hash; version check is permissive.
+          return Probe.new(status: "unsupported", message: "native SimpleCov version could not be determined") unless version
+          v = Gem::Version.new(version) rescue nil
+          if v.nil? || !SUPPORTED_VERSION_RANGE.satisfied_by?(v)
+            return Probe.new(status: "unsupported", version: version, message: "unsupported SimpleCov version #{version}")
+          end
           Probe.new(status: "succeeded", version: version)
         when :unsupported
           Probe.new(status: "unsupported", message: "unsupported coverage document shape")
@@ -51,13 +59,18 @@ module RailVerdict
 
       def run(repository_root, runner: nil, timeout_seconds: 10.0, probe_result: nil, configuration: nil)
         config = load_config(repository_root, configuration: configuration)
-        coverage_path = config.fetch("coverage_path") { DEFAULT_COVERAGE_PATH }
+        raw_path = config.fetch("coverage_path") { DEFAULT_COVERAGE_PATH }
         freshness_window = config.fetch("freshness_window_seconds") { DEFAULT_FRESHNESS_WINDOW_SECONDS }
-        invocation = { "executable" => "simplecov", "argv" => ["read", coverage_path] }
-        full_path = File.expand_path(coverage_path, repository_root)
+        invocation = { "executable" => "simplecov", "argv" => ["read", raw_path] }
+
+        begin
+          full_path = resolve_contained_coverage_path(repository_root, raw_path)
+        rescue MalformedOutput => error
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "malformed", message: Shared.bounded_message(error.message)), []]
+        end
 
         unless File.file?(full_path)
-          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "unavailable", message: "coverage file is absent: #{coverage_path}"), []]
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "unavailable", message: "coverage file is absent: #{raw_path}"), []]
         end
 
         begin
@@ -92,24 +105,29 @@ module RailVerdict
         version = nil
         if detected == :coverage_v1
           version = document["version"].to_s
-          probe_result ||= probe(repository_root, timeout_seconds: timeout_seconds)
-          unless version.start_with?("1")
-            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "unsupported", message: "unsupported SimpleCov version #{version}", tool_version: probe_result.version || version), []]
+          v = Gem::Version.new(version) rescue nil
+          if v.nil? || !SUPPORTED_VERSION_RANGE.satisfied_by?(v)
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "unsupported", message: "unsupported SimpleCov version #{version}", tool_version: version), []]
           end
           errors = validate_coverage_schema(document)
           unless errors.empty?
-            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "malformed", message: errors.first, tool_version: probe_result.version || version), []]
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "malformed", message: errors.first, tool_version: version), []]
           end
           normalized = normalize_coverage_v1(document)
-          version = document["version"].to_s
         elsif detected == :native_simplecov
+          version = extract_native_version(document)
+          unless version
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "unsupported", message: "native SimpleCov version could not be determined", tool_version: nil), []]
+          end
+          v = Gem::Version.new(version) rescue nil
+          if v.nil? || !SUPPORTED_VERSION_RANGE.satisfied_by?(v)
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "unsupported", message: "unsupported SimpleCov version #{version}", tool_version: version), []]
+          end
           begin
             normalized = normalize_native_document(document, repository_root)
-            version = extract_native_version(document)
           rescue MalformedOutput => error
-            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "malformed", message: Shared.bounded_message(error.message), tool_version: probe_result&.version), []]
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "malformed", message: Shared.bounded_message(error.message), tool_version: version), []]
           end
-          # Validate normalized shape via same schema
           errors = validate_coverage_schema(normalized)
           unless errors.empty?
             return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "malformed", message: errors.first, tool_version: version), []]
@@ -129,7 +147,7 @@ module RailVerdict
           "percent" => executable == 0 ? 100.0 : ((covered.to_f / executable) * 100).round(2),
           "stale" => stale,
           "freshness_window_seconds" => Integer(freshness_window),
-          "coverage_path" => coverage_path.to_s[0, 512],
+          "coverage_path" => raw_path.to_s[0, 512],
           "files" => normalized["files"],
           "_coverage_document" => normalized
         }
@@ -150,47 +168,38 @@ module RailVerdict
 
       private
 
-      def detect_format(document)
-        return :malformed unless document.is_a?(Hash)
+      def resolve_contained_coverage_path(repository_root, configured_path)
+        rel_path = configured_path.to_s.strip
+        rel_path = DEFAULT_COVERAGE_PATH if rel_path.empty?
 
-        # coverage-v1 has version starting with "1" and files array
-        if document["version"].is_a?(String) && document["files"].is_a?(Array)
-          return :coverage_v1
-        end
+        root = File.realpath(repository_root) rescue File.expand_path(repository_root)
+        full_path = File.expand_path(rel_path, root)
 
-        # Native SimpleCov JSON: has "coverage" hash where values contain lines
-        if document["coverage"].is_a?(Hash) && !document["coverage"].empty?
-          sample = document["coverage"].values.first
-          # Native values are hashes with "lines" key
-          if sample.is_a?(Hash) && sample.key?("lines")
-            return :native_simplecov
-          end
+        rel = Pathname.new(full_path).relative_path_from(Pathname.new(root)).to_s rescue nil
+        if rel.nil? || rel.start_with?("..")
+          raise MalformedOutput, "configured coverage_path escapes repository root: #{configured_path}"
         end
 
-        # Native may have empty coverage hash (empty file)
-        if document.key?("coverage") && document["coverage"].is_a?(Hash) && document["meta"].is_a?(Hash)
-          return :native_simplecov
-        end
+        full_path
+      end
 
-        # Also consider empty coverage hash without meta but with groups
-        if document.key?("coverage") && document["coverage"].is_a?(Hash) && document["coverage"].empty?
-          # Could be native empty or malformed; treat as native if meta or groups present
-          return :native_simplecov if document.key?("meta") || document.key?("groups")
-          # Fallback: if no files and no version, it's unsupported rather than malformed
+      def detect_format(document)
+        return :malformed unless document.is_a?(Hash)
+
+        if document.key?("version") && document.key?("timestamp") && document.key?("files")
+          return :coverage_v1 if document["files"].is_a?(Array)
+          return :malformed if document.key?("files")
           return :unsupported
         end
 
-        # If document has no recognizable shape but is Hash with coverage key mismatched
         if document.key?("coverage") || document.key?("meta") || document.key?("groups")
           return :native_simplecov if document["coverage"].is_a?(Hash)
         end
 
-        # If it has version but not files, or files but wrong shape => unsupported/malformed via validator
         if document.key?("version") || document.key?("files") || document.key?("timestamp")
-          # Let schema validation decide malformed vs unsupported
-          # If version exists but not starting 1 => unsupported
-          if document["version"].is_a?(String) && !document["version"].start_with?("1")
-            return :unsupported
+          if document["version"].is_a?(String)
+            v = Gem::Version.new(document["version"]) rescue nil
+            return :unsupported if v.nil? || !SUPPORTED_VERSION_RANGE.satisfied_by?(v)
           end
           return :malformed if document.key?("files") || document.key?("version")
         end
@@ -206,8 +215,7 @@ module RailVerdict
         if document["version"].is_a?(String) && !document["version"].empty?
           return document["version"].to_s[0, 64]
         end
-        # Default for native without explicit version
-        "1.0"
+        nil
       end
 
       def normalize_native_document(document, repository_root)
@@ -229,7 +237,6 @@ module RailVerdict
             when NilClass
               nil
             when String
-              # SimpleCov uses "ignored" for skipped lines
               hit == "ignored" ? nil : (raise MalformedOutput, "unexpected string in coverage lines: #{hit.inspect}")
             else
               raise MalformedOutput, "coverage lines must be integers, null, or \"ignored\""
@@ -237,8 +244,6 @@ module RailVerdict
           end
 
           filename = normalize_native_path(raw_path, repository_root)
-
-          # Skip empty paths after normalization
           raise MalformedOutput, "normalized path is empty for #{raw_path}" if filename.empty?
           unless filename.match?(RailVerdict::Finding::LOCATION_PATH_PATTERN)
             raise MalformedOutput, "coverage filename is not a clean repository-relative path: #{filename.inspect}"
@@ -251,7 +256,7 @@ module RailVerdict
 
         {
           "version" => "1.0",
-          "timestamp" => document["timestamp"].is_a?(Integer) ? document["timestamp"] : Time.now.to_i,
+          "timestamp" => document["timestamp"].is_a?(Integer) ? document["timestamp"] : 0,
           "files" => files
         }
       end
@@ -259,33 +264,24 @@ module RailVerdict
       def normalize_native_path(raw_path, repository_root)
         str = raw_path.to_s.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?").scrub("?").strip
         str = str.delete("\u0000")
-        # Remove leading ./ 
-        str = str.delete_prefix("./")
-        # If absolute, make relative to repository_root if possible
-        if str.start_with?("/")
-          begin
-            root = File.realpath(repository_root)
-            abs = File.expand_path(str)
-            # Use Pathname relative if inside root
-            require "pathname"
-            rel = Pathname.new(abs).relative_path_from(Pathname.new(root)).to_s rescue nil
-            if rel && !rel.start_with?("..") && rel.match?(RailVerdict::Finding::LOCATION_PATH_PATTERN)
-              return rel
-            end
-          rescue StandardError
-            nil
-          end
-          # Fallback: strip leading slash
-          str = str.delete_prefix("/")
+        raise MalformedOutput, "coverage path is empty" if str.empty?
+
+        root = File.realpath(repository_root) rescue File.expand_path(repository_root)
+        full = File.expand_path(str, root)
+
+        rel = Pathname.new(full).relative_path_from(Pathname.new(root)).to_s rescue nil
+        if rel.nil? || rel.start_with?("..")
+          raise MalformedOutput, "coverage path is outside repository root: #{str}"
         end
-        # Normalize redundant separators and strip
-        str = str.gsub(%r{//+}, "/")
-        str = str.strip
-        str
+
+        unless rel.match?(RailVerdict::Finding::LOCATION_PATH_PATTERN)
+          raise MalformedOutput, "coverage path is not a clean repository-relative path: #{rel}"
+        end
+
+        rel
       end
 
       def normalize_coverage_v1(document)
-        # Already validated; ensure deterministic ordering by filename
         files = document["files"].map do |f|
           { "filename" => f["filename"].to_s, "coverage" => { "lines" => f.dig("coverage", "lines") } }
         end.sort_by { |f| f["filename"] }