@blamejs/exceptd-skills 0.19.34 → 0.19.35

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.19.35 — 2026-08-25
+
+A scan that could not read something no longer reports that it found nothing there. The evidence collectors treated an unreadable file the same as an absent one: a credential store over the size cap, a workflow file without read permission, a lockfile that failed to parse all produced the output of a clean scan. A credential store that exists but went unread now reports its indicator as inconclusive rather than a miss, and its artifact as uncaptured with the reason attached. An unparseable Google Cloud credentials file reports the same way, since a parse that failed says nothing about what the file holds. A file read successfully but empty stays a completed scan, because the collector did read it and there was nothing in it — the two cases were previously indistinguishable, and both read as clean.
+
+The same failure closed in the pipeline collector, where it ran deeper. A workflow file too large or unreadable was skipped in silence, and every indicator it would have flipped stayed at miss. Read, parse and directory-walk failures now travel to the operator as warnings — but a warning changes no verdict on its own, so the gap reaches the indicators too: where the workflow or trust-policy inventory is incomplete, the indicators drawn from it report inconclusive rather than a clean miss, the inventory is marked uncaptured, and the readability precondition no longer attests a file the collector could not open. A repository whose one vulnerable workflow was the file that could not be read was previously reported clean.
+
+Release workflows that resolve dependencies at build time are detected for pip, pnpm and Bundler alongside npm and cargo, so a Python or Ruby publisher no longer reads as clean. Each install command is judged on its own flags: a hash-pinned install no longer vouches for an unpinned one elsewhere in the same file, and commands chained on one line or split across lines with a trailing backslash are read as the commands they are. The requirement file is recognised whether it is attached to the short option or separated from it, and an install is not reported when the file it names is itself hash-pinned, since one hashed requirement puts pip into hash-checking mode for all of them. A bare `pnpm install` is no longer reported, because pnpm enforces the frozen lockfile whenever CI is set; only an explicit opt-out is. Bundler's job-wide frozen setting suppresses the finding only when it is switched on — `bundle config set frozen false` named the setting and disabled it, and was read as though it enabled it. A requirement file is resolved against the job's working directory as well as the repository root, so a hash-pinned file in a subdirectory is no longer reported as unpinned; where copies resolve in several directories, every one of them has to be pinned. Findings point at the line their command starts on.
+
+Capping an upstream-catalog refresh now bounds every source. The RFC index, ATLAS and ICS-ATT&CK commands accepted the cap and discarded it, so a run asked to import a bounded batch imported the whole upstream index — and the RFC index is an order of magnitude larger than any other source the refresh reads. The cap bounds new additions only; context fields on rows already curated are still completed. The ICS-ATT&CK refresh also stops importing a cross-listed enterprise technique it cannot assign an ICS tactic to. Those rows arrived with an empty tactic and were counted as missing context by the next audit, so the import spent the gap budget on itself; they are skipped now, and the run reports how many and which.
+
+A mistyped flag on the upstream freshness probe is refused with a non-zero exit instead of being ignored. A misspelled air-gap flag previously left the check running as though nothing had been passed, so a run believed to be offline reached the network.
+
+Diagnostics no longer disappear when output is piped. The catalog validator's enum-mismatch and entry-count-drift messages and the skill linter's help and unknown-argument text were written to a stream the process could exit before draining, which a terminal hid and a CI log collector did not.
+
+A malformed analyze result no longer aborts the closing phase. The evidence bundle, notification deadlines, exception language and downstream chaining are still produced, and the shape problem is reported alongside them naming the part of the result that was wrong. That holds for a single unusable entry among good ones as well as for a malformed result overall: the unusable entries are dropped and counted, the rest still reach the advisory. Catalog scoring validation likewise reports a null or non-object entry and continues through the rest of the catalog rather than stopping at the first one, and asking for the documented gaps behind an attack pattern without supplying a gap catalog returns the same answer an empty one gives instead of raising.
+
+The manifest snapshot gate reports where it used to crash or wave through. A baseline written before a surface field existed ended the run with a stack trace on precisely the case the gate exists to report; it is now recorded as an additive change. A corrupt value where a list belongs stops the gate with the skill and field named, rather than reporting that skill's entire surface as newly added and passing.
+
 ## 0.19.34 — 2026-08-23
 
 Comment volume across the shipped JavaScript falls from 16,627 lines to 5,585, against 36,875 lines of code that are byte-for-byte unchanged. What went is the reasoning that produced a line rather than the constraint on it: pull-request references, version histories, "this used to", and module docblocks that toured a file's exports above the exports themselves. What stayed is what the code cannot say for itself — units and nullability on an exported function, the specification clause an emitter satisfies, the trap whose deletion invites a specific dangerous edit, and the cross-file coupling no grep will surface.

package/bin/exceptd.js

@@ -544,11 +544,7 @@ function main() {
     // Strip only `--prefetch` (the alias). `--no-network` must reach prefetch.js:
     // dropping it leaves prefetch fetching, so a cold cache hits every upstream.
     effectiveCmd = "prefetch";
-    const wantedNoNetwork = rest.includes("--no-network");
     effectiveRest = rest.filter(a => a !== "--prefetch");
-    if (wantedNoNetwork && !effectiveRest.includes("--no-network")) {
-      // Unreachable while the filter above spares --no-network.
-    }
   } else if (cmd === "refresh" && rest.includes("--indexes-only")) {
     effectiveCmd = "build-indexes";
     effectiveRest = rest.filter(a => a !== "--indexes-only");
@@ -6937,7 +6933,6 @@ function cmdAiRun(runner, args, runOpts, pretty) {
     if (!handled) {
       // stdin closed with no evidence event. Before erroring, try the raw text as a
       // bare submission — `echo '{...}' | ai-run secrets` pipes the body unwrapped.
-      const raw = (process.stdin._consumed || "") || buf;
       const allText = process.stdin._allText;
       if (allText && allText.trim()) {
         try {

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-23T11:56:28.977Z",
+  "generated_at": "2026-08-25T14:19:57.183Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "592a1040e06e609cfc5fa7b690343735f4ad2f52ed3607c526b9ec057f9373eb",
+    "manifest.json": "ec8d77f3c80b458eeb5901346be0e0f8fde9903da2de9ed85740372beddb8261",
     "README.md": "bc575c178c21e3d07f1491710e24b26cad3a3cee012c43641b6ea7e83468e64e",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
     "data/attack-techniques.json": "2179122ff8347bc691f245d5fd2601ca81fd1d6f790feae44abca86d3c08f865",

package/lib/collectors/ai-api.js

@@ -13,16 +13,40 @@ const os = require("node:os");
 
 const COLLECTOR_ID = "ai-api";
 
-function readSafe(full, max = 256 * 1024) {
+// One definition, named at every call site. Written as a literal in both the
+// default and the callers, the two drift apart the moment the cap is raised,
+// and the only symptom is a credential store that quietly stops being scanned
+// at the old size.
+const SCAN_CAP_BYTES = 256 * 1024;
+
+// `skip` routes a non-read onto the collector_errors channel:
+// { errors, artifact_id, label }. A null return is indistinguishable between
+// "over the cap" and "unreadable", and both mean the file went unscanned — a
+// clean verdict over an unscanned credential store is the failure mode, so the
+// reason travels with the submission. `label` is home-relative: the absolute
+// path is operator-identifying and collector_meta already carries `home`.
+function readSafe(full, max = SCAN_CAP_BYTES, skip = null) {
+  const note = (kind, reason) => {
+    if (!skip || !Array.isArray(skip.errors)) return;
+    const entry = { kind, reason: `${skip.label || path.basename(full)}: ${reason}` };
+    if (skip.artifact_id) entry.artifact_id = skip.artifact_id;
+    skip.errors.push(entry);
+  };
   let fd;
   try {
     fd = fs.openSync(full, "r");
     const s = fs.fstatSync(fd);
-    if (s.size > max) return null;
+    if (s.size > max) {
+      note("file_too_large_skipped", `${s.size} bytes exceeds ${max}-byte scan limit; not scanned`);
+      return null;
+    }
     // readFileSync(fd) loops to EOF; a single readSync can return short on a
     // network or FUSE fd. Reading the open fd keeps fstat-then-read TOCTOU-free.
     return fs.readFileSync(fd, "utf8");
-  } catch { return null; }
+  } catch (e) {
+    note("read_failed", e.message);
+    return null;
+  }
   finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* non-fatal */ } } }
 }
 
@@ -30,6 +54,27 @@ function fileExists(full) {
   try { return fs.statSync(full).isFile(); } catch { return false; }
 }
 
+// A credential store is one of three things, and only "absent" is a negative
+// finding. Truthiness collapses the other two: an empty file reads as "" and is
+// a completed scan, not a skipped one, while readSafe signals a skip with null.
+// The distinction is null-vs-string, and it drives the artifact's captured flag
+// and the indicator's verdict together so the two cannot disagree.
+const ABSENT = "absent";
+const UNREAD = "unread";
+const READ = "read";
+function storeState(exists, content) {
+  if (!exists) return ABSENT;
+  return content === null ? UNREAD : READ;
+}
+
+// A store that was never read cannot answer the question its indicator asks.
+// `miss` there is a clean bill of health over an unscanned file; a hit stands
+// on its own evidence and is unaffected by a sibling going unread.
+function verdict(found, undetermined) {
+  if (found) return "hit";
+  return undetermined ? "inconclusive" : "miss";
+}
+
 // Cleartext key exports: `export VAR=value`, `VAR=value`, fish `set -gx VAR value`.
 const AI_KEY_PATTERNS = [
   { id: "openai",       re: /(?:^|\n)\s*(?:export\s+|set\s+-gx\s+)?OPENAI_API_KEY\s*[= ]\s*['"]?sk-[A-Za-z0-9_-]{20,}/m },
@@ -129,7 +174,12 @@ function parseGcloudAdc(content) {
       privateKey: typeof j?.private_key === "string" ? j.private_key : "",
       clientEmail: typeof j?.client_email === "string" ? j.client_email : "",
     };
-  } catch { return { hasServiceAccount: false }; }
+  } catch (e) {
+    // Unparseable ADC is NOT evidence the file holds no service account; the
+    // parse failure travels so `gcp-service-account-json: miss` is not read as
+    // a clean bill of health.
+    return { hasServiceAccount: false, parse_error: e.message };
+  }
 }
 
 function parseKubeStaticToken(content) {
@@ -170,7 +220,17 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     for (const e of fs.readdirSync(fishConfD)) {
       if (e.endsWith(".fish")) shellRcs.push(path.join(fishConfD, e));
     }
-  } catch { /* fish not present */ }
+  } catch (e) {
+    // No fish conf.d is the normal case. A permission or I/O failure on one that
+    // IS there means those fragments went unscanned for key exports.
+    if (e.code !== "ENOENT") {
+      errors.push({
+        artifact_id: "shell-rc-files",
+        kind: "readdir_failed",
+        reason: `.config/fish/conf.d: ${e.message} — fragments not scanned`,
+      });
+    }
+  }
 
   const dotfileKeys = [
     ".openai", ".anthropic",
@@ -180,13 +240,24 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     path.join(".config", "azure-openai"),
   ].map(rel => path.join(home, rel));
 
-  const allKeyCarriers = [...shellRcs, ...dotfileKeys];
+  // Two artifacts share one scan loop. The carrier's own artifact_id travels
+  // with it so a skipped `~/.anthropic` is reported against dotfile-api-keys
+  // rather than pointing the operator at the shell-rc row.
+  const allKeyCarriers = [
+    ...shellRcs.map(p => ({ path: p, artifact_id: "shell-rc-files" })),
+    ...dotfileKeys.map(p => ({ path: p, artifact_id: "dotfile-api-keys" })),
+  ];
   const cleartextHitsByFile = {};
+  const cleartextUnread = [];
   let cleartextFp = null;
-  for (const p of allKeyCarriers) {
+  for (const { path: p, artifact_id } of allKeyCarriers) {
     if (!fileExists(p)) continue;
-    const c = readSafe(p);
-    if (c == null) continue;
+    const c = readSafe(p, SCAN_CAP_BYTES, {
+      errors, artifact_id, label: path.relative(home, p),
+    });
+    // Present but unread: the file could still hold a key, so it is a gap in
+    // the scan rather than a carrier with nothing in it.
+    if (c === null) { cleartextUnread.push(path.relative(home, p)); continue; }
     const hits = scanShellRc(c);
     if (hits.length > 0) {
       cleartextHitsByFile[path.relative(home, p)] = hits;
@@ -200,24 +271,64 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   const cleartextAnyHit = Object.keys(cleartextHitsByFile).length > 0;
 
   const awsCredsPath = path.join(home, ".aws", "credentials");
-  const awsCredsContent = fileExists(awsCredsPath) ? readSafe(awsCredsPath) : null;
+  const awsCredsExists = fileExists(awsCredsPath);
+  const awsCredsContent = awsCredsExists
+    ? readSafe(awsCredsPath, SCAN_CAP_BYTES, {
+      errors, artifact_id: "aws-credentials", label: path.relative(home, awsCredsPath),
+    })
+    : null;
   const awsParsed = parseAwsCredentials(awsCredsContent);
   const longLivedAws = awsParsed.staticProfiles.length > 0;
 
   const gcloudAdcPath = path.join(home, ".config", "gcloud", "application_default_credentials.json");
-  const gcloudContent = fileExists(gcloudAdcPath) ? readSafe(gcloudAdcPath) : null;
+  const gcloudAdcExists = fileExists(gcloudAdcPath);
+  const gcloudContent = gcloudAdcExists
+    ? readSafe(gcloudAdcPath, SCAN_CAP_BYTES, {
+      errors, artifact_id: "gcp-credentials", label: path.relative(home, gcloudAdcPath),
+    })
+    : null;
   const gcloudParsed = parseGcloudAdc(gcloudContent);
+  if (gcloudParsed.parse_error) {
+    errors.push({
+      artifact_id: "gcp-credentials",
+      kind: "parse_failed",
+      reason: `${path.relative(home, gcloudAdcPath)}: ${gcloudParsed.parse_error} — service-account presence undetermined, not absent`,
+    });
+  }
 
   const kubeCfgPath = (env && env.KUBECONFIG) || path.join(home, ".kube", "config");
-  const kubeContent = fileExists(kubeCfgPath) ? readSafe(kubeCfgPath) : null;
+  // KUBECONFIG can point outside $HOME, where a home-relative label degrades to
+  // a `..` chain; the basename is enough to name the file that went unread.
+  // The separator is required: a bare prefix test also matches a SIBLING whose
+  // name merely starts with $HOME ("/home/rob" vs "/home/robert-backup"), which
+  // produces exactly the `../…` chain this branch exists to avoid — and leaks
+  // another account's directory name into the warning.
+  const kubeInHome = kubeCfgPath === home || kubeCfgPath.startsWith(home + path.sep);
+  const kubeLabel = kubeInHome ? path.relative(home, kubeCfgPath) : path.basename(kubeCfgPath);
+  const kubeCfgExists = fileExists(kubeCfgPath);
+  const kubeContent = kubeCfgExists
+    ? readSafe(kubeCfgPath, SCAN_CAP_BYTES, {
+      errors, artifact_id: "kube-config", label: kubeLabel,
+    })
+    : null;
   const kubeParsed = parseKubeStaticToken(kubeContent);
   const kubeStaticToken = kubeParsed.found;
 
+  const awsState = storeState(awsCredsExists, awsCredsContent);
+  const gcloudState = storeState(gcloudAdcExists, gcloudContent);
+  const kubeState = storeState(kubeCfgExists, kubeContent);
+
   const signal_overrides = {
-    "cleartext-api-key-in-dotfile": cleartextAnyHit ? "hit" : "miss",
-    "long-lived-aws-keys": longLivedAws ? "hit" : "miss",
-    "gcp-service-account-json": gcloudParsed.hasServiceAccount ? "hit" : "miss",
-    "kubeconfig-with-static-token": kubeStaticToken ? "hit" : "miss",
+    "cleartext-api-key-in-dotfile": verdict(cleartextAnyHit, cleartextUnread.length > 0),
+    "long-lived-aws-keys": verdict(longLivedAws, awsState === UNREAD),
+    // Unread and unparseable are the same answer here: nothing in the file was
+    // validated, so its service-account presence is undetermined rather than
+    // absent. JSON.parse never runs on an unread store, so the state carries it.
+    "gcp-service-account-json": verdict(
+      gcloudParsed.hasServiceAccount,
+      gcloudState === UNREAD || Boolean(gcloudParsed.parse_error),
+    ),
+    "kubeconfig-with-static-token": verdict(kubeStaticToken, kubeState === UNREAD),
   };
 
   // Per-indicator __fp_checks attestation. Path checks hold because every store
@@ -271,15 +382,32 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
       value: dotfileKeys.filter(p => fileExists(p)).map(p => path.relative(home, p)).join(", ") || "no AI vendor dotfile carriers found at the canonical paths",
       captured: true,
     },
-    "aws-credentials": awsCredsContent
+    // A null content is two different worlds: the store is not there, or it IS
+    // there and went unread (over the scan cap, permissions, I/O). Only the
+    // first is an absence. The second is captured:false with the reason on
+    // collector_errors — asserting "absent" over a credential file that exists
+    // is the same clean-verdict-over-an-unscanned-store failure the error
+    // channel was added to close.
+    "aws-credentials": awsState === READ
       ? { value: `${awsParsed.staticProfiles.length} long-lived profile(s): ${awsParsed.staticProfiles.join(", ") || "none"}`, captured: true }
-      : { value: "~/.aws/credentials absent", captured: true },
-    "gcp-credentials": gcloudContent
+      : awsState === UNREAD
+        ? { value: "~/.aws/credentials present but unread — profile inventory undetermined, not absent", captured: false, reason: "read skipped or failed; see collector_errors for the reason" }
+        : { value: "~/.aws/credentials absent", captured: true },
+    // Read-but-unparseable is a fourth outcome, distinct from read, unread and
+    // absent: the bytes arrived and nothing in them was validated. Reporting
+    // captured:true there states service_account=false about a file never parsed.
+    "gcp-credentials": gcloudState === READ && !gcloudParsed.parse_error
       ? { value: `application_default_credentials.json present; service_account=${gcloudParsed.hasServiceAccount}`, captured: true }
-      : { value: "no gcloud ADC at the canonical path", captured: true, reason: "credentials.db / legacy_credentials/*/adc.json inspection deferred (no stdlib SQLite reader)" },
-    "kube-config": kubeContent
+      : gcloudState === READ
+        ? { value: "application_default_credentials.json present but unparseable — service-account presence undetermined, not absent", captured: false, reason: "JSON parse failed; see collector_errors for the reason" }
+        : gcloudState === UNREAD
+          ? { value: "application_default_credentials.json present but unread — service-account presence undetermined, not absent", captured: false, reason: "read skipped or failed; see collector_errors for the reason" }
+          : { value: "no gcloud ADC at the canonical path", captured: true, reason: "credentials.db / legacy_credentials/*/adc.json inspection deferred (no stdlib SQLite reader)" },
+    "kube-config": kubeState === READ
       ? { value: `kubeconfig present; static_token=${kubeStaticToken}`, captured: true }
-      : { value: "no kubeconfig at the canonical path", captured: true },
+      : kubeState === UNREAD
+        ? { value: "kubeconfig present but unread — static-token presence undetermined, not absent", captured: false, reason: "read skipped or failed; see collector_errors for the reason" }
+        : { value: "no kubeconfig at the canonical path", captured: true },
     "ai-sdk-inventory": {
       value: "skipped — npm/pip global listing deferred to operator/AI evidence",
       captured: false,

package/lib/collectors/cicd-pipeline-compromise.js

@@ -17,40 +17,57 @@ const OIDC_WALK_EXCLUDES = codeExcludeSet();
 
 const COLLECTOR_ID = "cicd-pipeline-compromise";
 
+// Returns { text } when the file was read, otherwise { skipped, reason }: a file
+// that is never scanned reads as a "miss" on every indicator it would have
+// flipped, so the caller has to record the skip rather than drop it.
 function readSafe(p, max = 512 * 1024) {
   let fd;
   try {
     fd = fs.openSync(p, "r");
     const s = fs.fstatSync(fd);
-    if (s.size > max) return null;
+    if (s.size > max) return { skipped: "file_too_large", reason: `${s.size} bytes exceeds the ${max}-byte scan limit; not scanned` };
     // readFileSync(fd) loops read() to EOF; a single readSync can return short on
     // a network or FUSE fd. Reading the open fd keeps fstat-then-read TOCTOU-free.
-    return fs.readFileSync(fd, "utf8");
-  } catch { return null; }
+    return { text: fs.readFileSync(fd, "utf8") };
+  } catch (e) { return { skipped: "read_error", reason: (e && e.message) || String(e) }; }
   finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* non-fatal */ } } }
 }
 
-function walkWorkflows(root) {
+function skipEntry(artifact_id, rel, r) {
+  return {
+    artifact_id,
+    kind: r.skipped === "file_too_large" ? "file_too_large_skipped" : "read_failed",
+    reason: `${rel}: ${r.reason}`,
+  };
+}
+
+function walkWorkflows(root, errors = []) {
   const out = [];
   const wfDir = path.join(root, ".github", "workflows");
   if (fs.existsSync(wfDir)) {
     let entries;
     try { entries = fs.readdirSync(wfDir, { withFileTypes: true }); }
-    catch { entries = []; }
+    catch (e) {
+      entries = [];
+      errors.push({ artifact_id: "workflow-yaml-inventory", kind: "readdir_failed", reason: `.github/workflows: ${e.message}` });
+    }
     for (const e of entries) {
       if (!e.isFile()) continue;
       if (!/\.(ya?ml)$/i.test(e.name)) continue;
       const full = path.join(wfDir, e.name);
-      const content = readSafe(full);
-      if (content != null) out.push({ full, rel: path.relative(root, full).replace(/\\/g, "/"), content });
+      const rel = path.relative(root, full).replace(/\\/g, "/");
+      const r = readSafe(full);
+      if (r.text != null) out.push({ full, rel, content: r.text });
+      else errors.push(skipEntry("workflow-yaml-inventory", rel, r));
     }
   }
   // Also recognise the most common single-file CI YAMLs at repo root.
   for (const top of [".gitlab-ci.yml", ".circleci/config.yml"]) {
     const full = path.join(root, top);
     if (fs.existsSync(full)) {
-      const content = readSafe(full);
-      if (content != null) out.push({ full, rel: top, content });
+      const r = readSafe(full);
+      if (r.text != null) out.push({ full, rel: top, content: r.text });
+      else errors.push(skipEntry("workflow-yaml-inventory", top, r));
     }
   }
   return out;
@@ -184,7 +201,7 @@ function scanWorkflow(content, rel) {
   return hits;
 }
 
-function scanOidcPolicies(root) {
+function scanOidcPolicies(root, errors = []) {
   // Walks the infra dirs to depth 4 for *.json naming
   // token.actions.githubusercontent.com with a wildcarded sub-claim.
   const rootDirs = ["infra", "terraform", "policies", ".aws", ".github"].map(d => path.join(root, d));
@@ -193,7 +210,14 @@ function scanOidcPolicies(root) {
     if (depth > 4 || finds.length > 5) return;
     let entries;
     try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
-    catch { return; }
+    catch (e) {
+      errors.push({
+        artifact_id: "oidc-trust-policy-inventory",
+        kind: "readdir_failed",
+        reason: `${path.relative(root, dir).replace(/\\/g, "/")}: ${e.message}`,
+      });
+      return;
+    }
     for (const e of entries) {
       if (OIDC_WALK_EXCLUDES.has(e.name)) continue;
       const full = path.join(dir, e.name);
@@ -204,15 +228,17 @@ function scanOidcPolicies(root) {
         continue;
       }
       if (!e.isFile() || !/\.json$/i.test(e.name)) continue;
-      const text = readSafe(full);
-      if (!text) continue;
+      const rel = path.relative(root, full).replace(/\\/g, "/");
+      const r = readSafe(full);
+      if (r.text == null) { errors.push(skipEntry("oidc-trust-policy-inventory", rel, r)); continue; }
+      const text = r.text;
       // Each pattern is bound to the leading `"` of the JSON key, so a lookalike
       // issuer like `"eviltoken.actions…"` cannot match.
       const subWildcard =
         /"token\.actions\.githubusercontent\.com:sub"\s*:\s*"\*"/.test(text) ||
         /"token\.actions\.githubusercontent\.com:sub"\s*:\s*"repo:\*[^"]*"/.test(text) ||
         /"token\.actions\.githubusercontent\.com:sub"\s*:\s*"repo:[^"]*\/\*:[^"]*"/.test(text);
-      if (subWildcard) finds.push({ file: path.relative(root, full).replace(/\\/g, "/"), snippet: "OIDC sub-claim wildcarded across repos or branches" });
+      if (subWildcard) finds.push({ file: rel, snippet: "OIDC sub-claim wildcarded across repos or branches" });
     }
   }
   for (const rd of rootDirs) if (fs.existsSync(rd)) walk(rd, 0);
@@ -245,7 +271,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     };
   }
 
-  const workflows = walkWorkflows(root);
+  const workflows = walkWorkflows(root, errors);
   const aggregateHits = {
     "workflow-injection-sink": [],
     "pull-request-target-with-pr-checkout": [],
@@ -257,14 +283,25 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     for (const [k, v] of Object.entries(h)) aggregateHits[k].push(...v);
   }
 
-  const oidcWildcards = scanOidcPolicies(root);
+  const oidcWildcards = scanOidcPolicies(root, errors);
+
+  // A workflow this collector could not read may hold the very thing each
+  // indicator looks for, so `miss` over an incomplete inventory is a clean
+  // verdict on evidence that was never examined. collector_errors are advisory
+  // and change no verdict on their own; the gap has to reach the signal. A hit
+  // stands on what WAS read and is unaffected.
+  const workflowScanIncomplete = errors.some(
+    (e) => e.artifact_id === "workflow-yaml-inventory");
+  const oidcScanIncomplete = errors.some(
+    (e) => e.artifact_id === "oidc-trust-policy-inventory");
+  const verdict = (found, incomplete) => (found ? "hit" : incomplete ? "inconclusive" : "miss");
 
   const signal_overrides = {
-    "workflow-injection-sink": aggregateHits["workflow-injection-sink"].length > 0 ? "hit" : "miss",
-    "pull-request-target-with-pr-checkout": aggregateHits["pull-request-target-with-pr-checkout"].length > 0 ? "hit" : "miss",
-    "actions-floating-tag-pin": aggregateHits["actions-floating-tag-pin"].length > 0 ? "hit" : "miss",
-    "secret-exposed-to-fork-pr": aggregateHits["secret-exposed-to-fork-pr"].length > 0 ? "hit" : "miss",
-    "wildcarded-oidc-sub-claim": oidcWildcards.length > 0 ? "hit" : "miss",
+    "workflow-injection-sink": verdict(aggregateHits["workflow-injection-sink"].length > 0, workflowScanIncomplete),
+    "pull-request-target-with-pr-checkout": verdict(aggregateHits["pull-request-target-with-pr-checkout"].length > 0, workflowScanIncomplete),
+    "actions-floating-tag-pin": verdict(aggregateHits["actions-floating-tag-pin"].length > 0, workflowScanIncomplete),
+    "secret-exposed-to-fork-pr": verdict(aggregateHits["secret-exposed-to-fork-pr"].length > 0, workflowScanIncomplete),
+    "wildcarded-oidc-sub-claim": verdict(oidcWildcards.length > 0, oidcScanIncomplete),
   };
 
   // File locations for every indicator flipped to "hit", so a SARIF result points
@@ -280,14 +317,20 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
 
   const artifacts = {
     "workflow-yaml-inventory": {
-      value: workflows.length ? workflows.map(w => w.rel).join(", ") : "no workflow files found at cwd",
-      captured: true,
+      value: workflowScanIncomplete
+        ? `${workflows.length} workflow(s) read, at least one skipped — inventory incomplete, see collector_errors`
+        : workflows.length ? workflows.map(w => w.rel).join(", ") : "no workflow files found at cwd",
+      captured: !workflowScanIncomplete,
+      ...(workflowScanIncomplete ? { reason: "one or more workflow files or the workflow directory could not be read" } : {}),
     },
     "oidc-trust-policy-inventory": {
-      value: oidcWildcards.length
-        ? `${oidcWildcards.length} wildcarded sub-claim(s): ${oidcWildcards.map(f => f.file).join(", ")}`
-        : "no wildcarded OIDC sub-claim found in infra / terraform / policies",
-      captured: true,
+      value: oidcScanIncomplete
+        ? `${oidcWildcards.length} wildcarded sub-claim(s) found, at least one policy file skipped — inventory incomplete, see collector_errors`
+        : oidcWildcards.length
+          ? `${oidcWildcards.length} wildcarded sub-claim(s): ${oidcWildcards.map(f => f.file).join(", ")}`
+          : "no wildcarded OIDC sub-claim found in infra / terraform / policies",
+      captured: !oidcScanIncomplete,
+      ...(oidcScanIncomplete ? { reason: "one or more trust-policy files or directories could not be read" } : {}),
     },
     "actions-sha-pinning": {
       value: `${aggregateHits["actions-floating-tag-pin"].length} non-SHA third-party uses: reference(s) across ${workflows.length} workflow(s)`,
@@ -319,7 +362,9 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     // authorization scope, and the playbook gates the precondition `on_fail: halt`.
     precondition_checks: {
       "cwd-is-repo": true,
-      "ci-config-readable": true,
+      // An attestation that the CI configuration was readable, so it cannot
+      // stay true over a file this collector failed to open.
+      "ci-config-readable": !workflowScanIncomplete,
       "operator-owns-ci-fleet": args.attestOwnership === true || args["attest-ownership"] === true,
     },
     artifacts,