@cejel/cejel 0.1.1 → 0.1.3

package/dist/{chunk-H5T65GGS.js → chunk-QQVCIG4N.js}

@@ -29,7 +29,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// src/witan/external-findings.ts
+// ../witan/src/external-findings.ts
 var EXTERNAL_FINDINGS_DISPLAY_LIMIT = 10;
 var SEVERITY_RANK = {
   critical: 0,
@@ -82,7 +82,7 @@ function collectExternalFindings(consumedSignals) {
   });
 }
 
-// src/witan/html.ts
+// ../witan/src/html.ts
 function renderWitanHtmlReport(report) {
   const codeCriteria = criteriaByCategory(report, "code_trust");
   const processCriteria = criteriaByCategory(report, "process_trust");
@@ -403,7 +403,7 @@ a:hover { text-decoration: underline; text-underline-offset: 2px; }
 }
 `;
 
-// src/witan/badge.ts
+// ../witan/src/badge.ts
 var VERDICT_COLOR = {
   Verified: "brightgreen",
   Conditional: "yellow",
@@ -470,7 +470,15 @@ function escapeXml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 
-// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
+// ../witan/src/claim-reality.ts
+import { existsSync, readFileSync, readdirSync, statSync } from "fs";
+import { join } from "path";
+
+// ../witan/src/leaderboard.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync2 } from "fs";
+import { join as join6 } from "path";
+
+// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
 __export(external_exports, {
   BRAND: () => BRAND,
@@ -582,7 +590,7 @@ __export(external_exports, {
   void: () => voidType
 });
 
-// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
+// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
   util2.assertEqual = (_) => {
@@ -716,7 +724,7 @@ var getParsedType = (data) => {
   }
 };
 
-// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/ZodError.js
+// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode = util.arrayToEnum([
   "invalid_type",
   "invalid_literal",
@@ -834,7 +842,7 @@ ZodError.create = (issues) => {
   return error;
 };
 
-// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/locales/en.js
+// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -937,7 +945,7 @@ var errorMap = (issue, _ctx) => {
 };
 var en_default = errorMap;
 
-// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/errors.js
+// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/errors.js
 var overrideErrorMap = en_default;
 function setErrorMap(map) {
   overrideErrorMap = map;
@@ -946,7 +954,7 @@ function getErrorMap() {
   return overrideErrorMap;
 }
 
-// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
+// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
   const { data, path, errorMaps, issueData } = params;
   const fullPath = [...path, ...issueData.path || []];
@@ -1056,14 +1064,14 @@ var isDirty = (x) => x.status === "dirty";
 var isValid = (x) => x.status === "valid";
 var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
 
-// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
+// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
   errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
   errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
 })(errorUtil || (errorUtil = {}));
 
-// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
+// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -4511,10 +4519,853 @@ var coerce = {
 };
 var NEVER = INVALID;
 
-// src/witan/schemas.ts
+// ../shared/src/types/attestation.ts
+var attestationOutcomeSchema = external_exports.enum([
+  "ATTESTED_READY",
+  "ATTESTED_WITH_GAPS",
+  "NOT_READY",
+  "REVOKED"
+]);
+var attestationKindSchema = external_exports.enum(["OPERATOR_READINESS", "EXTERNAL_ASSESSOR_REFERENCE"]);
+var attestationEvidenceRefKindSchema = external_exports.enum([
+  "runbook_path",
+  "github_run_url",
+  "vercel_deployment_id",
+  "neon_query_evidence",
+  "report_hash",
+  "external_assessor_ref"
+]);
+var attestationEvidenceRefSchema = external_exports.object({
+  kind: attestationEvidenceRefKindSchema,
+  /** Redacted reference string (path, URL, ID, or hash). Max 512 chars. */
+  ref: external_exports.string().min(1).max(512),
+  /** Optional one-line redacted description. */
+  note: external_exports.string().max(280).optional()
+});
+var createAttestationInputSchema = external_exports.object({
+  studioId: external_exports.string().uuid(),
+  complianceProfileId: external_exports.string().uuid(),
+  productId: external_exports.string().uuid().nullable().optional(),
+  framework: external_exports.string().min(1).max(120),
+  kind: attestationKindSchema,
+  outcome: attestationOutcomeSchema,
+  /** Redacted operator statement; no payloads. */
+  statement: external_exports.string().min(1).max(4e3),
+  evidenceRefs: external_exports.array(attestationEvidenceRefSchema).min(1),
+  supersedesAttestationId: external_exports.string().uuid().nullable().optional(),
+  metadata: external_exports.record(external_exports.unknown()).default({})
+});
+
+// ../shared/src/types/standup-provisioning.ts
+var ScaffoldFileSchema = external_exports.object({
+  path: external_exports.string().min(1),
+  contents: external_exports.string()
+}).strict();
+var ScaffoldManifestSchema = external_exports.array(ScaffoldFileSchema).min(1);
+var RepoRefSchema = external_exports.object({
+  studioId: external_exports.string().uuid(),
+  owner: external_exports.string().min(1),
+  // GitHub org/account that owns the repo
+  name: external_exports.string().min(1),
+  fullName: external_exports.string().min(1),
+  // owner/name
+  htmlUrl: external_exports.string().url(),
+  defaultBranch: external_exports.string().min(1).default("main")
+}).strict();
+var ScopedTokenSchema = external_exports.object({
+  token: external_exports.string().min(1),
+  expiresAt: external_exports.string(),
+  // ISO-8601
+  scope: external_exports.string().min(1)
+  // human-readable, e.g. "contents:write on owner/name"
+}).strict();
+var BranchProtectionStatusSchema = external_exports.object({
+  protected: external_exports.boolean(),
+  requiresPullRequestReview: external_exports.boolean(),
+  requiredApprovingReviewCount: external_exports.number().int().nonnegative(),
+  allowsForcePushes: external_exports.boolean(),
+  allowsDeletions: external_exports.boolean()
+}).strict();
+var RenderParamsSchema = external_exports.object({
+  productName: external_exports.string().min(1),
+  slug: external_exports.string().min(1),
+  vertical: external_exports.string().min(1)
+}).strict();
+var TemplateInputFieldSchema = external_exports.object({
+  name: external_exports.string().min(1),
+  label: external_exports.string().min(1),
+  inputType: external_exports.enum(["text", "number", "date", "slug"]),
+  required: external_exports.boolean().default(true),
+  helperText: external_exports.string().min(1),
+  example: external_exports.string().min(1),
+  defaultValue: external_exports.string().optional()
+}).strict();
+var TemplateInputSchema = external_exports.object({
+  fields: external_exports.array(TemplateInputFieldSchema).min(1)
+}).strict();
+var TemplateDescriptorSchema = external_exports.object({
+  templateRef: external_exports.string().min(1),
+  vertical: external_exports.string().min(1),
+  description: external_exports.string().default(""),
+  inputSchema: TemplateInputSchema.optional()
+}).strict();
+var StandupDryRunPlanSchema = external_exports.object({
+  planOnly: external_exports.literal(true),
+  planOnlyMessage: external_exports.string().min(1),
+  product: external_exports.object({
+    studioId: external_exports.string().min(1),
+    productId: external_exports.string().min(1),
+    name: external_exports.string().min(1),
+    slug: external_exports.string().min(1),
+    vertical: external_exports.string().min(1)
+  }).strict(),
+  targetRepo: external_exports.object({
+    owner: external_exports.string().min(1),
+    name: external_exports.string().min(1),
+    fullName: external_exports.string().min(1),
+    defaultBranch: external_exports.string().min(1),
+    plannedState: external_exports.literal("would_create"),
+    exists: external_exports.literal(false)
+  }).strict(),
+  template: TemplateDescriptorSchema,
+  scaffold: external_exports.object({
+    label: external_exports.literal("scaffold (template output)"),
+    files: ScaffoldManifestSchema
+  }).strict(),
+  buildAgentSeed: external_exports.object({
+    label: external_exports.literal("build-agent instructions (not yet run)"),
+    instructions: external_exports.array(external_exports.string().min(1)).min(1),
+    product: external_exports.object({
+      name: external_exports.string().min(1),
+      slug: external_exports.string().min(1),
+      vertical: external_exports.string().min(1)
+    }).strict(),
+    repoFullName: external_exports.string().min(1)
+  }).strict(),
+  safetyEnvelope: external_exports.object({
+    estimatedCostUsd: external_exports.number().finite().nonnegative(),
+    costCapUsd: external_exports.number().finite().nonnegative(),
+    networkPolicy: external_exports.object({
+      mode: external_exports.literal("restricted"),
+      allowedHosts: external_exports.array(external_exports.string().min(1)).min(1)
+    }).strict(),
+    scopedToken: external_exports.object({
+      tokenMinted: external_exports.literal(false),
+      scope: external_exports.string().min(1),
+      ttlSeconds: external_exports.number().int().positive()
+    }).strict()
+  }).strict()
+}).strict();
+var ConstructionWorkflowArtifactKindSchema = external_exports.enum([
+  "profile",
+  "milestone_schedule",
+  "risk_register",
+  "submittal_register",
+  "long_lead_log",
+  "rfi_log",
+  "responsibility_matrix"
+]);
+var IsoDateSchema = external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/);
+var ConstructionWorkflowTemplateDescriptorSchema = external_exports.object({
+  templateRef: external_exports.string().min(1),
+  workflowKind: external_exports.literal("construction_project"),
+  templateKind: external_exports.literal("workflow_documents"),
+  name: external_exports.string().min(1),
+  description: external_exports.string().default(""),
+  artifacts: external_exports.array(ConstructionWorkflowArtifactKindSchema).min(1),
+  inputSchema: TemplateInputSchema
+}).strict();
+var ConstructionProjectSeedSchema = external_exports.object({
+  projectName: external_exports.string().min(1).max(120),
+  areaSqFt: external_exports.number().int().positive(),
+  projectType: external_exports.string().min(1).max(120),
+  buildingName: external_exports.string().min(1).max(160),
+  ntpDate: IsoDateSchema,
+  scheduleTargetDate: IsoDateSchema
+}).strict();
+var ConstructionMilestoneSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  name: external_exports.string().min(1),
+  targetDate: IsoDateSchema,
+  status: external_exports.enum(["planned", "at_risk", "slipped", "complete"])
+}).strict();
+var ConstructionSubmittalSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  item: external_exports.string().min(1),
+  division: external_exports.string().min(1),
+  needByDate: IsoDateSchema,
+  status: external_exports.enum(["not_started", "open", "in_review", "approved", "done"])
+}).strict();
+var ConstructionRfiSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  subject: external_exports.string().min(1),
+  to: external_exports.string().min(1),
+  status: external_exports.enum(["draft", "open", "answered", "closed"]),
+  openedDate: IsoDateSchema
+}).strict();
+var ConstructionRiskSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  risk: external_exports.string().min(1),
+  rating: external_exports.enum(["low", "medium", "high"]),
+  mitigation: external_exports.string().min(1),
+  confidence: external_exports.number().min(0).max(1)
+}).strict();
+var ConstructionLongLeadItemSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  item: external_exports.string().min(1),
+  needByDate: IsoDateSchema,
+  status: external_exports.enum(["tracking", "ordered", "received", "done"]),
+  assumption: external_exports.string().min(1)
+}).strict();
+var ConstructionResponsibilitySchema = external_exports.object({
+  id: external_exports.string().min(1),
+  role: external_exports.string().min(1),
+  owner: external_exports.string().min(1),
+  responsibility: external_exports.string().min(1)
+}).strict();
+var ConstructionMarkdownArtifactSchema = external_exports.object({
+  kind: ConstructionWorkflowArtifactKindSchema,
+  path: external_exports.string().min(1),
+  markdown: external_exports.string().min(1)
+}).strict();
+var ConstructionWorkflowArtifactSetSchema = external_exports.object({
+  projectName: external_exports.string().min(1),
+  generatedAt: external_exports.string().datetime(),
+  assumptions: external_exports.array(external_exports.string().min(1)).default([]),
+  needsPmData: external_exports.array(external_exports.string().min(1)).default([]),
+  markdownArtifacts: external_exports.array(ConstructionMarkdownArtifactSchema).min(1),
+  structured: external_exports.object({
+    milestones: external_exports.array(ConstructionMilestoneSchema),
+    submittals: external_exports.array(ConstructionSubmittalSchema),
+    rfis: external_exports.array(ConstructionRfiSchema),
+    risks: external_exports.array(ConstructionRiskSchema),
+    longLeadItems: external_exports.array(ConstructionLongLeadItemSchema),
+    responsibilities: external_exports.array(ConstructionResponsibilitySchema)
+  }).strict()
+}).strict();
+var ConstructionWorkflowDryRunPlanSchema = external_exports.object({
+  planOnly: external_exports.literal(true),
+  planOnlyMessage: external_exports.string().min(1),
+  product: external_exports.object({
+    studioId: external_exports.string().min(1),
+    productId: external_exports.string().min(1),
+    name: external_exports.string().min(1),
+    vertical: external_exports.string().min(1)
+  }).strict(),
+  template: ConstructionWorkflowTemplateDescriptorSchema,
+  seed: ConstructionProjectSeedSchema,
+  safetyEnvelope: external_exports.object({
+    executor: external_exports.literal("benign_workflow_populator"),
+    sandboxUsed: external_exports.literal(false),
+    scopedTokenMinted: external_exports.literal(false),
+    externalWritesAllowed: external_exports.literal(false),
+    workspaceWriteMode: external_exports.literal("markdown_only")
+  }).strict()
+}).strict();
+
+// ../shared/src/types/construction-log-excel.ts
+var CONSTRUCTION_LOG_EXCEL_SCHEMA_VERSION = "construction-log-excel-v1";
+var ConstructionLogExcelSheetKeySchema = external_exports.enum([
+  "submittals",
+  "rfis",
+  "riskRegister",
+  "longLead",
+  "responsibilityMatrix",
+  "milestones"
+]);
+var ConstructionLogExcelColumnSchema = external_exports.object({
+  key: external_exports.string().min(1),
+  header: external_exports.string().min(1),
+  required: external_exports.boolean(),
+  description: external_exports.string().min(1)
+}).strict().describe("Canonical column definition for Alfred construction log Excel round-trips.");
+var ConstructionLogExcelSheetSchema = external_exports.object({
+  key: ConstructionLogExcelSheetKeySchema,
+  sheetName: external_exports.string().min(1),
+  description: external_exports.string().min(1),
+  columns: external_exports.array(ConstructionLogExcelColumnSchema).min(1)
+}).strict().describe("Canonical worksheet definition for Alfred construction log Excel round-trips.");
+var ConstructionLogExcelWorkbookSchema = external_exports.object({
+  schemaVersion: external_exports.literal(CONSTRUCTION_LOG_EXCEL_SCHEMA_VERSION),
+  sheets: external_exports.record(ConstructionLogExcelSheetKeySchema, ConstructionLogExcelSheetSchema)
+}).strict().describe(
+  "Canonical Alfred construction log Excel workbook schema shared by native output generation and export-upload ingestion."
+);
+var CONSTRUCTION_LOG_EXCEL_SHEETS = {
+  submittals: {
+    key: "submittals",
+    sheetName: "Submittals",
+    description: "Submittal register rows generated by Alfred or edited by the PM.",
+    columns: [
+      column("id", "ID", true, "Stable submittal identifier, for example SUB-001."),
+      column("item", "Item", true, "Submittal item or package name."),
+      column("division", "Division", true, "Spec division or trade grouping."),
+      column("needByDate", "Need By Date", true, "Date needed in YYYY-MM-DD format."),
+      column("status", "Status", true, "One of not_started, open, in_review, approved, or done."),
+      commonColumn("assumptionsNotes")
+    ]
+  },
+  rfis: {
+    key: "rfis",
+    sheetName: "RFIs",
+    description: "RFI log rows generated by Alfred or edited by the PM.",
+    columns: [
+      column("id", "ID", true, "Stable RFI identifier, for example RFI-001."),
+      column("subject", "Subject", true, "RFI subject."),
+      column("to", "To", true, "Responsible recipient or ball-in-court party."),
+      column("status", "Status", true, "One of draft, open, answered, or closed."),
+      column("openedDate", "Opened Date", true, "Date opened in YYYY-MM-DD format."),
+      commonColumn("assumptionsNotes")
+    ]
+  },
+  riskRegister: {
+    key: "riskRegister",
+    sheetName: "Risk Register",
+    description: "Risk register rows generated by Alfred or edited by the PM.",
+    columns: [
+      column("id", "ID", true, "Stable risk identifier, for example RISK-001."),
+      column("risk", "Risk", true, "Risk statement."),
+      column("rating", "Rating", true, "One of low, medium, or high."),
+      column("mitigation", "Mitigation", true, "Mitigation plan."),
+      column("confidence", "Confidence", true, "Confidence score from 0 to 1."),
+      commonColumn("assumptionsNotes")
+    ]
+  },
+  longLead: {
+    key: "longLead",
+    sheetName: "Long-Lead",
+    description: "Long-lead procurement rows generated by Alfred or edited by the PM.",
+    columns: [
+      column("id", "ID", true, "Stable long-lead identifier, for example LL-001."),
+      column("item", "Item", true, "Long-lead item name."),
+      column("needByDate", "Need By Date", true, "Date needed in YYYY-MM-DD format."),
+      column("status", "Status", true, "One of tracking, ordered, received, or done."),
+      column("assumption", "Assumption", true, "Procurement assumption behind this row."),
+      commonColumn("assumptionsNotes")
+    ]
+  },
+  responsibilityMatrix: {
+    key: "responsibilityMatrix",
+    sheetName: "Responsibility Matrix",
+    description: "Responsibility matrix rows generated by Alfred or edited by the PM.",
+    columns: [
+      column("id", "ID", true, "Stable responsibility identifier, for example RESP-001."),
+      column("role", "Role", true, "Role or party."),
+      column("owner", "Owner", true, "Named owner, or Needs PM input when unknown."),
+      column("responsibility", "Responsibility", true, "Responsibility statement."),
+      commonColumn("assumptionsNotes")
+    ]
+  },
+  milestones: {
+    key: "milestones",
+    sheetName: "Milestones",
+    description: "Milestone schedule rows used to generate the MS Project XML schedule.",
+    columns: [
+      column("id", "ID", true, "Stable milestone identifier, for example MS-001."),
+      column("name", "Name", true, "Milestone or task name."),
+      column("targetDate", "Target Date", true, "Target date in YYYY-MM-DD format."),
+      column("status", "Status", true, "One of planned, at_risk, slipped, or complete."),
+      column("predecessorId", "Predecessor ID", false, "Optional predecessor milestone ID."),
+      commonColumn("assumptionsNotes")
+    ]
+  }
+};
+var CONSTRUCTION_LOG_EXCEL_WORKBOOK_SCHEMA = ConstructionLogExcelWorkbookSchema.parse({
+  schemaVersion: CONSTRUCTION_LOG_EXCEL_SCHEMA_VERSION,
+  sheets: CONSTRUCTION_LOG_EXCEL_SHEETS
+});
+function column(key, header, required, description) {
+  return { key, header, required, description };
+}
+function commonColumn(key) {
+  return column(
+    key,
+    "Assumptions / Notes",
+    false,
+    "Show-your-work note, including generated assumptions and PM-input gaps."
+  );
+}
+
+// ../shared/src/types/dev-task-dispatch.ts
+var CodingAgentExecutorSchema = external_exports.enum(["claude-code", "codex"]);
+var DevTaskDispatchRequestSchema = external_exports.object({
+  studioId: external_exports.string().uuid(),
+  productId: external_exports.string().uuid(),
+  repo: RepoRefSchema,
+  task: external_exports.string().min(1).max(2e4),
+  executor: CodingAgentExecutorSchema
+}).strict();
+var DevTaskDispatchDryRunPlanSchema = external_exports.object({
+  planOnly: external_exports.literal(true),
+  planOnlyMessage: external_exports.string().min(1),
+  targetRepo: RepoRefSchema,
+  task: external_exports.string().min(1),
+  executor: CodingAgentExecutorSchema,
+  branchName: external_exports.string().min(1),
+  safetyEnvelope: external_exports.object({
+    estimatedCostUsd: external_exports.number().finite().nonnegative(),
+    costCapUsd: external_exports.number().finite().nonnegative(),
+    timeoutMs: external_exports.number().int().positive(),
+    scopedToken: external_exports.object({
+      tokenMinted: external_exports.literal(false),
+      scope: external_exports.string().min(1),
+      ttlSeconds: external_exports.number().int().positive()
+    }).strict(),
+    prOnly: external_exports.object({
+      opensPullRequest: external_exports.literal(true),
+      mergesPullRequest: external_exports.literal(false),
+      pushesMain: external_exports.literal(false),
+      deploys: external_exports.literal(false)
+    }).strict()
+  }).strict()
+}).strict();
+var CodingAgentRunInputSchema = external_exports.object({
+  executor: CodingAgentExecutorSchema,
+  repo: RepoRefSchema,
+  task: external_exports.string().min(1),
+  scopedToken: ScopedTokenSchema,
+  branchName: external_exports.string().min(1),
+  costCapUsd: external_exports.number().finite().nonnegative(),
+  timeoutMs: external_exports.number().int().positive()
+}).strict();
+var CodingAgentRunResultSchema = external_exports.discriminatedUnion("status", [
+  external_exports.object({
+    status: external_exports.literal("succeeded"),
+    prUrl: external_exports.string().url(),
+    summary: external_exports.string().min(1),
+    costUsd: external_exports.number().finite().nonnegative(),
+    /**
+     * The exact commit sha the PR branch was pushed at when it opened —
+     * captured server-side (see server-dispatch-backend.ts) right after a
+     * successful run, before the workspace is torn down. Lets the Maeve
+     * in-flight-fix detector (maeve-in-flight-pr-fix-lesson.ts) key off the
+     * real PR-open head instead of falling back to timestamp matching.
+     */
+    openedHeadSha: external_exports.string().min(1).optional()
+  }).strict(),
+  external_exports.object({
+    status: external_exports.literal("failed"),
+    summary: external_exports.string().min(1),
+    reason: external_exports.string().min(1),
+    costUsd: external_exports.number().finite().nonnegative().optional()
+  }).strict()
+]);
+var DevTaskOutcomeSchema = external_exports.enum(["ci_passed", "pr_merged", "ci_failed"]);
+var SecurityFindingClassSchema = external_exports.enum(["authz", "csrf", "injection", "secrets", "ssrf"]);
+var RecordDevTaskOutcomeInputSchema = external_exports.object({
+  product: external_exports.string().min(1).max(120),
+  repo: external_exports.string().min(1).max(240),
+  prUrl: external_exports.string().url(),
+  outcome: DevTaskOutcomeSchema,
+  task: external_exports.string().min(1).max(2e4).optional(),
+  executor: CodingAgentExecutorSchema.optional(),
+  occurredAt: external_exports.string().datetime().optional(),
+  maeveLessonStatement: external_exports.string().min(1).max(1e3).optional(),
+  maeveLessonTags: external_exports.array(external_exports.string().min(1).max(120)).optional(),
+  /** Security metadata — enriches the Maeve lesson with class/pattern, never raw vulnerable detail. */
+  findingClass: SecurityFindingClassSchema.optional(),
+  ruleId: external_exports.string().min(1).max(120).optional(),
+  signalSource: external_exports.string().min(1).max(240).optional()
+}).strict();
+
+// ../shared/src/schemas/standup-plan.ts
+var StandupRequestSchema = external_exports.object({
+  productName: external_exports.string().min(1).max(80),
+  slug: external_exports.string().min(1).optional(),
+  vertical: external_exports.string().min(1).max(80),
+  repoTarget: external_exports.string().min(1).default("barg-labs"),
+  repoName: external_exports.string().min(1).optional(),
+  templateRef: external_exports.string().min(1).optional(),
+  scopeNotes: external_exports.string().max(2e3).optional()
+}).strict();
+var StandupPlanSchema = external_exports.object({
+  productName: external_exports.string().min(1).max(80),
+  slug: external_exports.string().regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/),
+  vertical: external_exports.string().min(1).max(80),
+  templateRef: external_exports.string().min(1),
+  repoTarget: external_exports.string().min(1),
+  repoName: external_exports.string().regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/),
+  fileManifest: external_exports.array(external_exports.string().min(1)).min(1),
+  credentialScope: external_exports.string().min(1),
+  estimatedCostUsd: external_exports.number().nonnegative(),
+  steps: external_exports.array(external_exports.string().min(1)).min(1),
+  dryRun: external_exports.literal(true)
+}).strict();
+
+// ../shared/src/types/coordinator-prompt.ts
+var CoordinatorPromptContextBlockSchema = external_exports.object({
+  title: external_exports.string().min(1).max(120),
+  body: external_exports.string().min(1).max(6e3),
+  source: external_exports.string().max(500).optional()
+});
+var CoordinatorPromptInputPayloadSchema = external_exports.object({
+  objective: external_exports.string().min(1).max(4e3),
+  productId: external_exports.string().min(1),
+  context: external_exports.array(CoordinatorPromptContextBlockSchema).min(1).max(20),
+  escalationHints: external_exports.array(external_exports.string().min(1).max(500)).max(10).optional()
+});
+var CoordinatorPromptTokensUsedSchema = external_exports.object({
+  input: external_exports.number().int().nonnegative(),
+  output: external_exports.number().int().nonnegative(),
+  total: external_exports.number().int().nonnegative(),
+  costCents: external_exports.number().nonnegative()
+});
+var CoordinatorPromptSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  studioId: external_exports.string().min(1),
+  productId: external_exports.string().min(1),
+  draftedAt: external_exports.coerce.date(),
+  inputPayload: CoordinatorPromptInputPayloadSchema,
+  markdown: external_exports.string().min(1),
+  metadata: external_exports.object({
+    tokensUsed: CoordinatorPromptTokensUsedSchema.optional(),
+    model: external_exports.string().optional(),
+    templateVersion: external_exports.string().optional()
+  }).catchall(external_exports.unknown()).optional()
+});
+var CreateCoordinatorPromptInputSchema = external_exports.object({
+  productId: external_exports.string().min(1),
+  inputPayload: CoordinatorPromptInputPayloadSchema,
+  markdown: external_exports.string().min(1),
+  metadata: external_exports.record(external_exports.unknown()).optional(),
+  draftedAt: external_exports.coerce.date().optional()
+});
+var ListCoordinatorPromptsInputSchema = external_exports.object({
+  productId: external_exports.string().min(1).optional(),
+  since: external_exports.coerce.date().optional()
+});
+
+// ../shared/src/schemas/inbox-triage.ts
+var InboxTriageClassificationSchema = external_exports.enum([
+  "needs_reply",
+  "fyi",
+  "waiting",
+  "escalate"
+]);
+var InboxTriageLegacyUrgencySchema = external_exports.enum(["needs_reply", "fyi", "noise", "escalation"]);
+var InboxTriageThreadSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  subject: external_exports.string().min(1),
+  from: external_exports.string(),
+  to: external_exports.string(),
+  snippet: external_exports.string(),
+  labels: external_exports.array(external_exports.string()),
+  unread: external_exports.boolean(),
+  needsReply: external_exports.boolean(),
+  updatedAt: external_exports.string().min(1),
+  url: external_exports.string().min(1),
+  messageCount: external_exports.number().int().nonnegative()
+});
+var InboxTriageResultSchema = external_exports.object({
+  threadId: external_exports.string().min(1),
+  classification: InboxTriageClassificationSchema,
+  confidence: external_exports.number().min(0).max(1),
+  reason: external_exports.string(),
+  labelName: external_exports.string(),
+  applied: external_exports.boolean(),
+  error: external_exports.string().optional()
+});
+var TriageInboxUsageSchema = external_exports.object({
+  input_tokens: external_exports.number().int().nonnegative(),
+  output_tokens: external_exports.number().int().nonnegative(),
+  cached_tokens: external_exports.number().int().nonnegative().optional(),
+  cost_cents: external_exports.number().nonnegative()
+});
+var TriageInboxResultSchema = external_exports.object({
+  productId: external_exports.string().min(1),
+  results: external_exports.array(InboxTriageResultSchema),
+  usage: TriageInboxUsageSchema.optional()
+});
+
+// ../shared/src/schemas/inference-usage.ts
+var InferenceUsageSurfaceSchema = external_exports.string().min(1).max(80).regex(/^[a-z][a-z0-9_-]*$/);
+var RecordInferenceUsageInputSchema = external_exports.object({
+  product: external_exports.string().min(1).optional(),
+  surface: InferenceUsageSurfaceSchema,
+  model: external_exports.string().min(1).max(120),
+  inputTokens: external_exports.number().int().nonnegative(),
+  outputTokens: external_exports.number().int().nonnegative(),
+  cachedTokens: external_exports.number().int().nonnegative().default(0),
+  costCents: external_exports.number().nonnegative(),
+  timestamp: external_exports.coerce.date().optional()
+});
+var InferenceUsageBreakdownQuerySchema = external_exports.object({
+  from: external_exports.coerce.date(),
+  to: external_exports.coerce.date()
+});
+var InferenceUsageGroupSchema = external_exports.object({
+  calls: external_exports.number().int().nonnegative(),
+  costCents: external_exports.number().nonnegative(),
+  inputTokens: external_exports.number().int().nonnegative(),
+  outputTokens: external_exports.number().int().nonnegative(),
+  cachedTokens: external_exports.number().int().nonnegative()
+});
+var InferenceUsageBreakdownSchema = external_exports.object({
+  from: external_exports.string().datetime(),
+  to: external_exports.string().datetime(),
+  totals: InferenceUsageGroupSchema,
+  bySurface: external_exports.array(InferenceUsageGroupSchema.extend({ surface: InferenceUsageSurfaceSchema })),
+  byModel: external_exports.array(InferenceUsageGroupSchema.extend({ model: external_exports.string().min(1) }))
+});
+
+// ../shared/src/schemas/product-health.ts
+var DEFAULT_PRODUCT_HEALTH_INTERVAL_SECONDS = 24 * 60 * 60;
+var ISO_DATE_STRING = external_exports.string().datetime({ offset: true }).describe("ISO-8601 timestamp with timezone offset.");
+var ProductHealthStatusSchema = external_exports.enum(["healthy", "degraded", "halted"]);
+var ProductHealthDetailsSchema = external_exports.record(external_exports.unknown()).superRefine((details, ctx) => {
+  const credentialPath = findCredentialLikePath(details);
+  if (!credentialPath) return;
+  ctx.addIssue({
+    code: external_exports.ZodIssueCode.custom,
+    message: `Product health details must not contain credentials (${credentialPath}).`
+  });
+});
+var ProductHealthReportInputSchema = external_exports.object({
+  productId: external_exports.string().min(1).max(120),
+  status: ProductHealthStatusSchema,
+  lastActivityAt: ISO_DATE_STRING,
+  summary: external_exports.string().min(1).max(1e3),
+  details: ProductHealthDetailsSchema.optional(),
+  reportedAt: ISO_DATE_STRING,
+  expectedIntervalSeconds: external_exports.number().int().positive().optional()
+});
+var StoredProductHealthReportSchema = ProductHealthReportInputSchema.extend({
+  expectedIntervalSeconds: external_exports.number().int().positive()
+});
+var ProductLivenessStateSchema = external_exports.enum([
+  "healthy",
+  "degraded",
+  "halted",
+  "stale",
+  "unknown"
+]);
+var ProductLivenessSnapshotEntrySchema = external_exports.object({
+  productId: external_exports.string().min(1),
+  state: ProductLivenessStateSchema,
+  flagged: external_exports.boolean(),
+  status: ProductHealthStatusSchema.optional(),
+  lastActivityAt: ISO_DATE_STRING.optional(),
+  reportedAt: ISO_DATE_STRING.optional(),
+  expectedIntervalSeconds: external_exports.number().int().positive(),
+  ageSeconds: external_exports.number().int().nonnegative().nullable(),
+  summary: external_exports.string()
+});
+function findCredentialLikePath(value, path = []) {
+  if (!value || typeof value !== "object") return null;
+  if (Array.isArray(value)) {
+    for (const [index, item] of value.entries()) {
+      const match = findCredentialLikePath(item, [...path, String(index)]);
+      if (match) return match;
+    }
+    return null;
+  }
+  for (const [key, nested] of Object.entries(value)) {
+    const nextPath = [...path, key];
+    if (/(?:secret|token|password|credential|api[-_]?key|private[-_]?key)/i.test(key)) {
+      return nextPath.join(".");
+    }
+    const match = findCredentialLikePath(nested, nextPath);
+    if (match) return match;
+  }
+  return null;
+}
+
+// ../shared/src/schemas/interaction-trace.ts
+var InteractionTraceVerificationSignalSchema = external_exports.enum([
+  "no_signal",
+  "human_accepted_output",
+  "human_rejected_output",
+  "ci_pr_succeeded",
+  "ci_pr_failed",
+  "brief_accepted",
+  "brief_rejected",
+  "standup_completed",
+  "standup_failed"
+]);
+var InteractionTraceVerificationSchema = external_exports.object({
+  success: external_exports.boolean(),
+  signal: InteractionTraceVerificationSignalSchema,
+  confidence: external_exports.number().min(0).max(1),
+  reason: external_exports.string().min(1).max(1e3)
+});
+var InteractionTraceActorSchema = external_exports.object({
+  type: external_exports.enum(["human", "agent", "system"]),
+  id: external_exports.string().min(1).max(200),
+  name: external_exports.string().min(1).max(200).optional()
+});
+var RecordInteractionTraceInputSchema = external_exports.object({
+  product: external_exports.string().min(1).max(120),
+  intent: external_exports.string().min(1).max(500),
+  actionSummary: external_exports.string().min(1).max(4e3),
+  outcomeSummary: external_exports.string().min(1).max(4e3),
+  model: external_exports.string().min(1).max(200).nullable().optional(),
+  actor: InteractionTraceActorSchema,
+  occurredAt: external_exports.string().datetime().optional(),
+  verification: InteractionTraceVerificationSchema.optional(),
+  metadata: external_exports.record(external_exports.unknown()).optional()
+});
+var StoredInteractionTraceSchema = RecordInteractionTraceInputSchema.extend({
+  id: external_exports.string().uuid(),
+  occurredAt: external_exports.string().datetime(),
+  createdAt: external_exports.string().datetime(),
+  verification: InteractionTraceVerificationSchema
+});
+var InteractionTraceQualityScoreSchema = external_exports.number().min(0).max(1);
+var RetrieveRelevantTracesQuerySchema = external_exports.object({
+  product: external_exports.string().min(1).max(120),
+  intent: external_exports.string().min(1).max(500),
+  limit: external_exports.number().int().positive().max(10).optional()
+});
+var RetrievedInteractionTraceSchema = StoredInteractionTraceSchema.extend({
+  score: external_exports.number().min(0).max(1),
+  qualityScore: InteractionTraceQualityScoreSchema
+});
+
+// ../shared/src/schemas/maeve-lesson.ts
+var MaeveLessonStatusSchema = external_exports.enum(["candidate", "verified", "retired"]);
+var MaeveLessonEvidenceSchema = external_exports.object({
+  source: external_exports.enum(["interaction_trace", "artifact"]),
+  traceId: external_exports.string().uuid().optional(),
+  artifact: external_exports.string().min(1).max(1e3).optional(),
+  summary: external_exports.string().min(1).max(1e3),
+  hash: external_exports.string().regex(/^sha256:[a-f0-9]{64}$/)
+});
+var MaeveLessonSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  product: external_exports.string().min(1).max(120),
+  statement: external_exports.string().min(1).max(1e3),
+  scope: external_exports.array(external_exports.string().min(1).max(120)).default([]),
+  tags: external_exports.array(external_exports.string().min(1).max(120)).default([]),
+  evidence: external_exports.array(MaeveLessonEvidenceSchema),
+  status: MaeveLessonStatusSchema,
+  createdAt: external_exports.string().datetime(),
+  lastSeenAt: external_exports.string().datetime()
+});
+var CreateMaeveLessonInputSchema = external_exports.object({
+  product: external_exports.string().min(1).max(120),
+  statement: external_exports.string().min(1).max(1e3),
+  scope: external_exports.array(external_exports.string().min(1).max(120)).default([]),
+  tags: external_exports.array(external_exports.string().min(1).max(120)).default([]),
+  evidence: external_exports.array(MaeveLessonEvidenceSchema).default([]),
+  status: MaeveLessonStatusSchema.default("candidate"),
+  lastSeenAt: external_exports.string().datetime().optional()
+});
+var PromoteMaeveLessonInputSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  status: MaeveLessonStatusSchema,
+  appendEvidence: external_exports.array(MaeveLessonEvidenceSchema).optional()
+});
+var RecallMaeveLessonsQuerySchema = external_exports.object({
+  product: external_exports.string().min(1).max(120).optional(),
+  taskType: external_exports.string().min(1).max(120).optional(),
+  tags: external_exports.array(external_exports.string().min(1).max(120)).default([]),
+  limit: external_exports.number().int().positive().max(10).default(5),
+  /**
+   * Free-text query for semantic (pgvector cosine) recall. When set and an
+   * EmbeddingProvider is configured, recallMaeveLessons embeds this text and
+   * retrieves by cosine similarity, with exact-tag matches as a boost.
+   * Falls back to exact-class matching when the provider is NoOp.
+   */
+  semanticQuery: external_exports.string().min(1).max(500).optional()
+});
+var MaeveLessonSeedAnchorSchema = external_exports.object({
+  commit: external_exports.string().regex(/^[0-9a-f]{40}$/i, "commit must be a full 40-character git SHA"),
+  pr: external_exports.number().int().positive().nullable(),
+  summary: external_exports.string().min(1).max(1e3)
+});
+var MaeveLessonSeedSchema = external_exports.object({
+  statement: external_exports.string().min(1).max(1e3),
+  scope: external_exports.array(external_exports.string().min(1).max(120)).default([]),
+  tags: external_exports.array(external_exports.string().min(1).max(120)).default([]),
+  anchors: external_exports.array(MaeveLessonSeedAnchorSchema).min(1),
+  lastSeenAt: external_exports.string().datetime()
+});
+var ReviewFindingSeveritySchema = external_exports.enum(["critical", "high", "medium", "low"]);
+var ReviewFindingLessonInputSchema = external_exports.object({
+  studioId: external_exports.string().min(1),
+  findingStudioId: external_exports.string().min(1),
+  product: external_exports.string().min(1).max(120),
+  repository: external_exports.string().min(1).max(240),
+  pullRequestNumber: external_exports.number().int().positive(),
+  findingText: external_exports.string().min(1).max(4e3),
+  severity: ReviewFindingSeveritySchema,
+  reviewer: external_exports.string().min(1).max(120),
+  remediatingCommitSha: external_exports.string().min(4).max(64),
+  /** The durable, reusable rule distilled from the finding — NOT the finding text verbatim. */
+  lessonStatement: external_exports.string().min(1).max(1e3),
+  scope: external_exports.array(external_exports.string().min(1).max(120)).default([]),
+  tags: external_exports.array(external_exports.string().min(1).max(120)).default([]),
+  occurredAt: external_exports.string().datetime()
+});
+
+// ../shared/src/schemas/operator-trace.ts
+var TRACE_ACTORS = [
+  "human",
+  "cowork",
+  "claude-code",
+  "codex",
+  "goal-runner",
+  "ci"
+];
+var TraceActorSchema = external_exports.enum(TRACE_ACTORS);
+var TRACE_SOURCES = [
+  "shell",
+  "cowork",
+  "claude-code",
+  "codex",
+  "goal-runner",
+  "github"
+];
+var TraceSourceSchema = external_exports.enum(TRACE_SOURCES);
+var TraceProvenanceSchema = external_exports.object({
+  source: TraceSourceSchema,
+  /** Absolute path of the source file/dir, or the gh query for CI events. */
+  path: external_exports.string().min(1).max(1e3),
+  /** Line number, session id, or PR number locating the row inside the source. */
+  locator: external_exports.string().min(1).max(200).optional()
+});
+var TraceRecordSchema = external_exports.object({
+  t: external_exports.string().datetime(),
+  actor: TraceActorSchema,
+  action: external_exports.string().min(1).max(2e3),
+  target: external_exports.string().max(1e3).default(""),
+  outcome: external_exports.string().max(2e3).default(""),
+  product: external_exports.string().min(1).max(120).optional(),
+  provenance: TraceProvenanceSchema
+});
+var ShellRedactionSchema = external_exports.enum(["none", "secret", "unclassified"]);
+var ShellTraceEntrySchema = external_exports.object({
+  ts: external_exports.string().datetime(),
+  cwd: external_exports.string().min(1).max(1e3),
+  command: external_exports.string().min(1).max(4e3),
+  exitCode: external_exports.number().int(),
+  shellSessionId: external_exports.string().min(1).max(200),
+  redaction: ShellRedactionSchema
+});
+var TraceSourceReportSchema = external_exports.discriminatedUnion("status", [
+  external_exports.object({
+    status: external_exports.literal("ok"),
+    source: TraceSourceSchema,
+    recordCount: external_exports.number().int().nonnegative(),
+    /** Files/entries present but skipped (unparseable, filtered) — named, not silent. */
+    skipped: external_exports.array(external_exports.string().min(1).max(500)).default([])
+  }),
+  external_exports.object({
+    status: external_exports.literal("dark"),
+    source: TraceSourceSchema,
+    reason: external_exports.string().min(1).max(500)
+  })
+]);
+var OperatorTimelineSchema = external_exports.object({
+  records: external_exports.array(TraceRecordSchema),
+  sources: external_exports.array(TraceSourceReportSchema)
+});
+
+// ../shared/src/schemas/witan.ts
 var WITAN_RUBRIC_VERSION_V1 = "witan-rubric-v1-2026-06-24";
 var WITAN_RUBRIC_VERSION_V2 = "witan-rubric-v2-2026-07-12";
-var WITAN_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V2;
+var WITAN_RUBRIC_VERSION_V3 = "witan-rubric-v3-2026-07-13";
+var WITAN_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V3;
 var WITAN_TRADING_RUBRIC_VERSION_V0 = "witan-trading-rubric-v0-2026-07-01";
 var WITAN_CRITERION_IDS = [
   "A1",
@@ -4540,9 +5391,11 @@ var WITAN_TRADING_RUBRIC_V0_CRITERION_IDS = [
   "audit-completeness",
   "claim-reality"
 ];
+var WITAN_QUANT_INTEGRITY_RUBRIC_V0_CRITERION_IDS = ["quant-integrity"];
 var WitanCriterionIdSchema = external_exports.enum([
   ...WITAN_CRITERION_IDS,
-  ...WITAN_TRADING_RUBRIC_V0_CRITERION_IDS
+  ...WITAN_TRADING_RUBRIC_V0_CRITERION_IDS,
+  ...WITAN_QUANT_INTEGRITY_RUBRIC_V0_CRITERION_IDS
 ]);
 var WitanTradingCriterionIdSchema = external_exports.enum(WITAN_TRADING_RUBRIC_V0_CRITERION_IDS);
 var WitanCriterionCategorySchema = external_exports.enum([
@@ -4584,6 +5437,7 @@ var WITAN_REPO_ARCHETYPES = [
   "monorepo",
   "docs_only",
   "binary_only",
+  "unrecognised_ecosystem",
   "empty"
 ];
 var WitanRepoArchetypeSchema = external_exports.enum(WITAN_REPO_ARCHETYPES);
@@ -4592,7 +5446,10 @@ var WitanEvidencePointerSchema = external_exports.object({
   label: external_exports.string().min(1).max(180),
   url: external_exports.string().url().optional(),
   path: external_exports.string().min(1).max(700).optional(),
-  line: external_exports.number().int().positive().optional(),
+  // Explicit null means the finding is file-scoped and no real match position was measured —
+  // never a fabricated line (e.g. `1`) standing in for a position the detector never found
+  // (goal_cejel_a2_one_notion_of_production_code_2026-07-13).
+  line: external_exports.number().int().positive().nullable().optional(),
   contentHash: external_exports.string().min(8).max(160).optional(),
   capturedAt: external_exports.string().datetime({ offset: true }).optional()
 }).strict().refine((value) => Boolean(value.url ?? value.path ?? value.contentHash), {
@@ -4697,91 +5554,1144 @@ var WitanReportSchema = external_exports.object({
   categoryScores: external_exports.record(external_exports.string(), external_exports.number().min(0).max(4)).optional(),
   // Repo-archetype metadata (see WitanRepoArchetypeSchema above). Both fields are omitted for
   // callers that don't classify an archetype (e.g. the trading rubric). insufficientSourceReason
-  // is present only for the non-source archetypes ('docs_only' | 'binary_only' | 'empty') — its
-  // presence is what presentation layers (badge/terminal/verdict) key off to show an explicit
-  // insufficient-source verdict instead of a confident numeric score.
+  // is present only for the non-source archetypes ('docs_only' | 'binary_only' |
+  // 'unrecognised_ecosystem' | 'empty') — its presence is what presentation layers
+  // (badge/terminal/verdict) key off to show an explicit insufficient-source verdict instead of
+  // a confident numeric score.
   archetype: WitanRepoArchetypeSchema.optional(),
   insufficientSourceReason: external_exports.string().min(1).max(2e3).optional()
 }).strict();
 
-// src/witan/repo-signals.ts
-import { execFileSync } from "child_process";
-import { createHash } from "crypto";
-import { readFileSync, readdirSync, realpathSync, statSync } from "fs";
-import { basename, join, relative, resolve, sep } from "path";
+// ../shared/src/schemas/work-item.ts
+var WorkItemTypeSchema = external_exports.enum(["feature", "bug"]);
+var WorkItemPrioritySchema = external_exports.enum(["low", "normal", "high", "urgent"]);
+var WorkItemStatusSchema = external_exports.enum([
+  "submitted",
+  "scoped",
+  "dispatched",
+  "pr_open",
+  "done",
+  "declined"
+]);
+var CreateWorkItemInputSchema = external_exports.object({
+  productId: external_exports.string().uuid(),
+  type: WorkItemTypeSchema,
+  title: external_exports.string().min(3).max(180),
+  description: external_exports.string().min(8).max(2e4),
+  acceptanceCriteria: external_exports.string().max(2e4).optional(),
+  priority: WorkItemPrioritySchema.default("normal")
+}).strict();
+var ScopeWorkItemInputSchema = external_exports.object({
+  scopedTask: external_exports.string().min(8).max(2e4).optional()
+}).strict();
+var ListWorkItemsQuerySchema = external_exports.object({
+  productId: external_exports.string().uuid().optional(),
+  status: WorkItemStatusSchema.optional()
+}).strict();
+var DispatchWorkItemInputSchema = external_exports.object({
+  executor: external_exports.enum(["claude-code", "codex"]).default("codex"),
+  mode: external_exports.enum(["dry-run", "execute"]).default("dry-run")
+}).strict();
 
-// src/witan/json-safe.ts
-function stripBom(text) {
-  return text.charCodeAt(0) === 65279 ? text.slice(1) : text;
-}
+// ../shared/src/schemas/goal-frontmatter.ts
+var GoalStreamKindSchema = external_exports.enum(["code", "process"]);
+var GoalPrioritySchema = external_exports.enum(["p0", "p1", "p2"]);
+var GoalFrontmatterExtrasSchema = external_exports.object({
+  stream: external_exports.string().min(1).nullable().default(null),
+  order: external_exports.number().int().nullable().default(null),
+  dependsOn: external_exports.array(external_exports.string().min(1)).default([]),
+  priority: GoalPrioritySchema.nullable().default(null),
+  kind: GoalStreamKindSchema.default("code")
+});
 
-// src/witan/repo-signals.ts
-function buildWitanInputFromRepo(options) {
-  assertRepoPathExists(options.repoPath);
-  const generatedAt = options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
-  const headSha = readGitHead(options.repoPath);
-  const repoFiles = listRepoFiles(options.repoPath);
-  const archetype = classifyRepoArchetype(repoFiles);
+// ../shared/src/schemas/stream.ts
+var StreamSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  studioId: external_exports.string().uuid(),
+  name: external_exports.string().min(1).max(120),
+  tag: external_exports.string().max(60).nullable(),
+  kind: GoalStreamKindSchema,
+  orderIndex: external_exports.number().int(),
+  createdAt: external_exports.coerce.date(),
+  updatedAt: external_exports.coerce.date()
+});
+var StreamItemSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  studioId: external_exports.string().uuid(),
+  streamId: external_exports.string().uuid(),
+  orderIndex: external_exports.number().int(),
+  title: external_exports.string().min(1).max(200),
+  /** docs/orchestration/goal_*.md filename (no extension) for code items; null for process items. */
+  goalName: external_exports.string().min(1).nullable(),
+  refLabel: external_exports.string().max(60).nullable(),
+  /** Free-form governed-run prompt text (mirrors the prototype's per-item `run` string). Null = no run control shown. */
+  runPrompt: external_exports.string().min(1).nullable(),
+  createdAt: external_exports.coerce.date(),
+  updatedAt: external_exports.coerce.date()
+});
+var StreamItemDisplayStatusSchema = external_exports.enum([
+  "done",
+  "in-review",
+  "running",
+  "queued",
+  "blocked",
+  "local-unknown"
+]);
+
+// ../shared/src/schemas/runner-dispatch.ts
+var RUNNER_DISPATCH_MODES = ["dry-run", "execute"];
+var RunnerDispatchModeSchema = external_exports.enum(RUNNER_DISPATCH_MODES);
+var RUNNER_DISPATCH_STATUSES = ["queued", "claimed", "running", "done", "failed"];
+var RunnerDispatchStatusSchema = external_exports.enum(RUNNER_DISPATCH_STATUSES);
+var GOAL_CARD_PATTERN = /^docs\/orchestration\/[A-Za-z0-9_./-]+\.md$/;
+function isAllowedGoalCardPath(goalCard) {
+  if (!GOAL_CARD_PATTERN.test(goalCard)) return false;
+  return goalCard.split("/").every((segment) => segment !== "." && segment !== "..");
+}
+var GoalCardPathSchema = external_exports.string().min(1).max(300).refine(isAllowedGoalCardPath, { message: "goal_card_invalid" });
+var RunnerDispatchRequestSchema = external_exports.object({
+  goalCard: GoalCardPathSchema,
+  stream: external_exports.string().min(1).max(120).optional(),
+  mode: RunnerDispatchModeSchema
+});
+
+// ../shared/src/schemas/witan-metrics-manifest.ts
+var WITAN_METRICS_MANIFEST_SCHEMA_VERSION = "witan-metrics-manifest-v0";
+var WitanMetricsManifestReturnsFrequencySchema = external_exports.enum([
+  "daily",
+  "weekly",
+  "monthly",
+  "annual"
+]);
+var WitanMetricsManifestFoldSchema = external_exports.object({
+  foldId: external_exports.string().min(1).max(80),
+  inSampleSharpe: external_exports.number().optional(),
+  outOfSampleSharpe: external_exports.number().optional()
+}).strict();
+var WitanMetricsManifestCscvTrialSchema = external_exports.object({
+  trialId: external_exports.string().min(1).max(80),
+  blockReturns: external_exports.array(external_exports.number()).min(2)
+}).strict();
+var WitanMetricsManifestCscvSchema = external_exports.object({
+  // Must be even (split into IS/OOS halves) — enforced by the grader, not the schema.
+  blocks: external_exports.number().int().min(4).max(16),
+  trials: external_exports.array(WitanMetricsManifestCscvTrialSchema).min(2).max(200)
+}).strict();
+var WitanMetricsManifestCostModelSchema = external_exports.object({
+  feeBps: external_exports.number().min(0).optional(),
+  slippageBps: external_exports.number().min(0).optional(),
+  borrowBps: external_exports.number().min(0).optional(),
+  notes: external_exports.string().min(1).max(300).optional()
+}).strict();
+var WitanMetricsManifestParameterPointSchema = external_exports.object({
+  // Human-readable label for this point (e.g. "72" or "72 bars") — evidence/display only.
+  paramLabel: external_exports.string().min(1).max(80),
+  // The point's position on its swept axis, used to find its nearest neighbors by distance.
+  paramValue: external_exports.number(),
+  outOfSampleSharpe: external_exports.number()
+}).strict();
+var WitanMetricsManifestParameterSweepSchema = external_exports.object({
+  // Name of the swept parameter (e.g. "lookback_bars") — evidence/display only.
+  paramName: external_exports.string().min(1).max(80),
+  points: external_exports.array(WitanMetricsManifestParameterPointSchema).min(3).max(500)
+}).strict();
+var WitanMetricsManifestLabelSourceSchema = external_exports.enum([
+  "real_forward_returns",
+  "synthetic",
+  "unknown"
+]);
+var WitanMetricsManifestSchema = external_exports.object({
+  schemaVersion: external_exports.literal(WITAN_METRICS_MANIFEST_SCHEMA_VERSION),
+  strategyName: external_exports.string().min(1).max(200).optional(),
+  // The headline reported Sharpe ratio the target repo is claiming.
+  reportedSharpe: external_exports.number(),
+  // How many trials/backtests were run in the search that produced reportedSharpe (the
+  // "1-of-42" count) — required so the grader can correct for selection bias.
+  trialCount: external_exports.number().int().positive(),
+  // Track-record length in return observations (e.g. 252 for a year of daily returns) —
+  // the `n` in the Probabilistic/Deflated Sharpe Ratio formula.
+  trackRecordObservations: external_exports.number().int().positive(),
+  returnsFrequency: WitanMetricsManifestReturnsFrequencySchema.default("daily"),
+  // Skew/kurtosis of the returns distribution; default to the normal-distribution values
+  // (0 skew, kurtosis 3) when the repo does not report them.
+  skewness: external_exports.number().default(0),
+  kurtosis: external_exports.number().min(0).default(3),
+  // Whether reportedSharpe is net of trading costs (fees/slippage/borrow/roll).
+  netOfCosts: external_exports.boolean(),
+  costModel: WitanMetricsManifestCostModelSchema.optional(),
+  // Per-fold in-sample vs out-of-sample breakdown, when the repo reports one.
+  folds: external_exports.array(WitanMetricsManifestFoldSchema).default([]),
+  // Per-trial, per-block performance matrix for the CSCV/PBO computation, when available.
+  cscv: WitanMetricsManifestCscvSchema.optional(),
+  // Parameter-sweep breakdown for the run-tier (L3b) parameter-neighborhood robustness
+  // grader, when the run swept a parameter (e.g. a lookback window) and recorded OOS
+  // performance at each swept value.
+  parameterSweep: WitanMetricsManifestParameterSweepSchema.optional(),
+  // Provenance of the labels behind reportedSharpe (labelling-integrity, L1+artifact tier).
+  labelSource: WitanMetricsManifestLabelSourceSchema.optional()
+}).strict();
+
+// ../shared/src/schemas/witan-strategy-adapter.ts
+var WITAN_STRATEGY_ADAPTER_CONFIG_SCHEMA_VERSION = "witan-strategy-adapter-v0";
+var WitanStrategyAdapterConfigSchema = external_exports.object({
+  schemaVersion: external_exports.literal(WITAN_STRATEGY_ADAPTER_CONFIG_SCHEMA_VERSION),
+  // Argv for the strategy entrypoint, e.g. ["python3", "strategy.py"] or ["node", "run.mjs"].
+  // Command-argv (not a language enum) is what keeps the adapter language-agnostic — most
+  // real targets are Python, but the contract does not assume it.
+  command: external_exports.array(external_exports.string().min(1).max(300)).min(1).max(20),
+  // Relative path (within the target repo) to the data the strategy should backtest against.
+  dataPath: external_exports.string().min(1).max(500).optional(),
+  // Backtest window, as the target repo defines its own date strings (ISO-8601 recommended).
+  // Optional — a strategy may declare its own default window instead.
+  windowStart: external_exports.string().min(1).max(40).optional(),
+  windowEnd: external_exports.string().min(1).max(40).optional(),
+  // Relative path (within the sandboxed workspace) the entrypoint must write its raw result
+  // to — see WitanStrategyRunResultSchema below.
+  outputPath: external_exports.string().min(1).max(300).default("witan-run-result.json"),
+  timeoutMs: external_exports.number().int().positive().max(30 * 60 * 1e3).default(2 * 60 * 1e3),
+  // Explicit opt-in egress allowlist. Empty by default — no network from the sandboxed run
+  // unless the target repo explicitly whitelists hosts here.
+  allowedHosts: external_exports.array(external_exports.string().min(1).max(255)).max(20).default([])
+}).strict();
+var WitanStrategyRunResultSchema = WitanMetricsManifestSchema.omit({
+  schemaVersion: true
+});
+
+// ../shared/src/types/tactical-action.ts
+var TacticalActionTypeSchema = external_exports.enum([
+  "merge_pr_auto_merge_safe",
+  "deploy_staging",
+  "acknowledge_canary_alert",
+  "update_status_md",
+  "provision_product",
+  "dispatch_dev_task"
+]);
+var TacticalActionStatusSchema = external_exports.enum(["executed", "blocked", "dry_run"]);
+var TacticalActionPolicySchema = external_exports.object({
+  studioId: external_exports.string().uuid(),
+  productId: external_exports.string().uuid(),
+  actionType: TacticalActionTypeSchema,
+  allowed: external_exports.boolean(),
+  dryRun: external_exports.boolean(),
+  promotedAt: external_exports.coerce.date().nullable(),
+  forceEnableReason: external_exports.string().nullable()
+});
+var BaseActionSchema = external_exports.object({
+  actionType: TacticalActionTypeSchema,
+  productId: external_exports.string().uuid(),
+  coordinatorSessionId: external_exports.string().uuid().nullable().optional(),
+  customerFacingProduction: external_exports.boolean().default(false)
+});
+var MergePrTacticalActionSchema = BaseActionSchema.extend({
+  actionType: external_exports.literal("merge_pr_auto_merge_safe"),
+  repository: external_exports.string().min(1),
+  pullRequestNumber: external_exports.number().int().positive(),
+  labels: external_exports.array(external_exports.string()),
+  ciStatus: external_exports.enum(["green", "red", "unknown"]),
+  humanApprovals: external_exports.number().int().nonnegative(),
+  coworkClaudeApprovedStatus: external_exports.enum(["green", "red", "unknown"]),
+  // The PR head SHA captured at the SAME live precondition snapshot that
+  // verified the label/CI/approvals/cowork-claude-approved gates. Threaded
+  // through to the GitHub merge call as the conditional `sha` parameter so a
+  // commit that lands between the snapshot and the merge (a fast follow-up
+  // push, or a re-triggered CI run resetting status) can never be
+  // squash-merged unverified — GitHub rejects the merge with 409 instead.
+  headSha: external_exports.string().min(1)
+});
+var DeployStagingTacticalActionSchema = BaseActionSchema.extend({
+  actionType: external_exports.literal("deploy_staging"),
+  environment: external_exports.literal("staging"),
+  mainStatus: external_exports.enum(["green", "red", "unknown"]),
+  stagingStatus: external_exports.enum(["green", "red", "unknown"])
+});
+var AcknowledgeCanaryAlertTacticalActionSchema = BaseActionSchema.extend({
+  actionType: external_exports.literal("acknowledge_canary_alert"),
+  alertId: external_exports.string().min(1),
+  fingerprint: external_exports.string().min(1),
+  knownFalsePositiveFingerprints: external_exports.array(external_exports.string()).default([])
+});
+var UpdateStatusMdTacticalActionSchema = BaseActionSchema.extend({
+  actionType: external_exports.literal("update_status_md"),
+  source: external_exports.literal("daily_brief_synthesis"),
+  statusMarkdown: external_exports.string().min(1).max(2e4)
+});
+var ProvisionProductTacticalActionSchema = BaseActionSchema.extend({
+  actionType: external_exports.literal("provision_product"),
+  productName: external_exports.string().min(1).max(80),
+  vertical: external_exports.string().min(1).max(80),
+  repoTarget: external_exports.string().min(1),
+  templateRef: external_exports.string().min(1),
+  scopeNotes: external_exports.string().max(2e3).optional()
+});
+var DispatchDevTaskTacticalActionSchema = BaseActionSchema.extend({
+  actionType: external_exports.literal("dispatch_dev_task"),
+  repo: RepoRefSchema,
+  task: external_exports.string().min(1).max(2e4),
+  executor: CodingAgentExecutorSchema
+});
+var TacticalActionSchema = external_exports.discriminatedUnion("actionType", [
+  MergePrTacticalActionSchema,
+  DeployStagingTacticalActionSchema,
+  AcknowledgeCanaryAlertTacticalActionSchema,
+  UpdateStatusMdTacticalActionSchema,
+  ProvisionProductTacticalActionSchema,
+  DispatchDevTaskTacticalActionSchema
+]);
+var TacticalActionContextSchema = external_exports.object({
+  studioId: external_exports.string().uuid(),
+  actorUserId: external_exports.string().uuid().nullable().optional(),
+  requestedAt: external_exports.coerce.date().optional()
+});
+var TacticalActionPermitResultSchema = external_exports.discriminatedUnion("status", [
+  external_exports.object({
+    status: external_exports.literal("executed"),
+    auditLogId: external_exports.string().uuid(),
+    reason: external_exports.literal("permit_allowed")
+  }),
+  external_exports.object({
+    status: external_exports.literal("blocked"),
+    auditLogId: external_exports.string().uuid().optional(),
+    reason: external_exports.string().min(1)
+  }),
+  external_exports.object({
+    status: external_exports.literal("dry_run"),
+    auditLogId: external_exports.string().uuid(),
+    reason: external_exports.literal("dry_run_mode"),
+    wouldHaveDone: external_exports.record(external_exports.unknown())
+  })
+]);
+var TacticalActionLogEntrySchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  studioId: external_exports.string().uuid(),
+  productId: external_exports.string().uuid(),
+  product: external_exports.string().nullable().optional(),
+  coordinatorSessionId: external_exports.string().uuid().nullable(),
+  actionType: TacticalActionTypeSchema.or(external_exports.string()),
+  context: external_exports.record(external_exports.unknown()),
+  permitResult: external_exports.record(external_exports.unknown()),
+  status: TacticalActionStatusSchema,
+  outcome: external_exports.string().nullable(),
+  wouldHaveDone: external_exports.record(external_exports.unknown()).nullable(),
+  attemptedAt: external_exports.string(),
+  executedAt: external_exports.string().nullable()
+});
+
+// ../shared/src/schemas/index.ts
+var StudioSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  name: external_exports.string().min(1).max(100),
+  billingStatus: external_exports.enum(["trial", "active", "past_due", "cancelled"]),
+  planTier: external_exports.enum(["trial", "solo", "studio", "studio_plus", "self_hosted", "enterprise"]),
+  onPrem: external_exports.boolean().default(false),
+  createdAt: external_exports.coerce.date()
+});
+var HumanSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  studioId: external_exports.string().uuid(),
+  email: external_exports.string().email(),
+  name: external_exports.string().min(1).max(120),
+  oauthProviders: external_exports.array(external_exports.enum(["google", "microsoft", "apple"])).default([]),
+  role: external_exports.enum(["owner", "member", "advisor", "per_product"]),
+  timezone: external_exports.string(),
+  briefTime: external_exports.string().regex(/^\d{2}:\d{2}$/),
+  createdAt: external_exports.coerce.date()
+});
+var ProductSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  studioId: external_exports.string().uuid(),
+  name: external_exports.string().min(1).max(80),
+  slug: external_exports.string().regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/),
+  status: external_exports.enum(["active", "snoozed", "wound_down", "deleted"]),
+  description: external_exports.string().max(280).optional(),
+  repoUrl: external_exports.string().url().optional(),
+  calendarTag: external_exports.string().optional(),
+  emailLabelPrefix: external_exports.string().optional(),
+  colorHex: external_exports.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
+  scheduleBriefTime: external_exports.string().regex(/^\d{2}:\d{2}$/).optional(),
+  briefTemplateId: external_exports.string().uuid().optional(),
+  regulated: external_exports.boolean().default(false),
+  createdAt: external_exports.coerce.date(),
+  lastTouchedAt: external_exports.coerce.date()
+});
+var AgentSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  studioId: external_exports.string().uuid(),
+  productId: external_exports.string().uuid(),
+  agentType: external_exports.enum(["codex", "claude-code", "cowork", "cursor", "cline", "aider", "other"]),
+  sessionId: external_exports.string().optional(),
+  status: external_exports.enum(["active", "idle", "registered", "archived"]),
+  registeredAt: external_exports.coerce.date(),
+  lastActiveAt: external_exports.coerce.date().optional(),
+  totalCostCentsLifetime: external_exports.number().int().nonnegative().default(0)
+});
+var AgentRunSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  agentId: external_exports.string().uuid(),
+  coordinatorSessionId: external_exports.string().uuid().nullable().optional(),
+  startedAt: external_exports.coerce.date(),
+  completedAt: external_exports.coerce.date().optional(),
+  actionType: external_exports.string(),
+  toolName: external_exports.string().optional(),
+  toolInputSummary: external_exports.string().optional(),
+  toolOutputSummary: external_exports.string().optional(),
+  tokensUsedInput: external_exports.number().int().nonnegative().default(0),
+  tokensUsedOutput: external_exports.number().int().nonnegative().default(0),
+  costCents: external_exports.number().int().nonnegative().default(0),
+  durationMs: external_exports.number().int().nonnegative().default(0),
+  resultStatus: external_exports.enum(["success", "failure", "partial", "timeout"]).optional(),
+  resultSummary: external_exports.string().optional(),
+  filesTouched: external_exports.array(external_exports.string()).default([])
+});
+var CoordinatorStatusSchema = external_exports.enum([
+  "draft",
+  "spawned",
+  "in_progress",
+  "reporting",
+  "closed"
+]);
+var CoordinatorEscalationPolicySchema = external_exports.object({
+  stuck_after_hours: external_exports.number().int().positive(),
+  method: external_exports.literal("flag_for_human"),
+  urgency: external_exports.enum(["low", "medium", "high", "critical"]).optional()
+});
+var CoordinatorSessionSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  studioId: external_exports.string().uuid(),
+  productId: external_exports.string().uuid(),
+  promptId: external_exports.string().uuid().nullable(),
+  objective: external_exports.string(),
+  status: CoordinatorStatusSchema,
+  spawnedAt: external_exports.coerce.date().nullable(),
+  closedAt: external_exports.coerce.date().nullable(),
+  escalationPolicy: CoordinatorEscalationPolicySchema.nullable(),
+  outcomeSummary: external_exports.string().nullable(),
+  createdAt: external_exports.coerce.date()
+});
+var AgentActivityWindowSchema = external_exports.enum(["24h", "7d", "30d"]);
+var AgentCostBucketSchema = external_exports.object({
+  key: external_exports.string(),
+  name: external_exports.string(),
+  runCount: external_exports.number().int().nonnegative(),
+  costUsd: external_exports.number().nonnegative()
+});
+var AgentCostRollupSchema = external_exports.object({
+  window: AgentActivityWindowSchema,
+  studioTotalUsd: external_exports.number().nonnegative(),
+  runCount: external_exports.number().int().nonnegative(),
+  byAgent: external_exports.array(AgentCostBucketSchema),
+  byProduct: external_exports.array(AgentCostBucketSchema)
+});
+var AgentConflictRecordSchema = external_exports.object({
+  file: external_exports.string(),
+  agents: external_exports.array(external_exports.string()).min(2),
+  references: external_exports.array(
+    external_exports.object({
+      runId: external_exports.string(),
+      agent: external_exports.string(),
+      product: external_exports.string().nullable(),
+      startedAt: external_exports.string(),
+      sessionRef: external_exports.string().nullable(),
+      prUrl: external_exports.string().nullable()
+    })
+  )
+});
+var AgentLeaderboardEntrySchema = external_exports.object({
+  agent: external_exports.string(),
+  product: external_exports.string().nullable(),
+  runCount: external_exports.number().int().nonnegative(),
+  completedRuns: external_exports.number().int().nonnegative(),
+  failedRuns: external_exports.number().int().nonnegative(),
+  costUsd: external_exports.number().nonnegative(),
+  filesTouched: external_exports.number().int().nonnegative(),
+  conflicts: external_exports.number().int().nonnegative(),
+  state: external_exports.enum(["productive", "idle", "duplicating"]),
+  lastActiveAt: external_exports.string().nullable()
+});
+var ModelCostEstimateInputSchema = external_exports.object({
+  model: external_exports.string().optional(),
+  inputTokens: external_exports.number().int().nonnegative().default(0),
+  outputTokens: external_exports.number().int().nonnegative().default(0)
+});
+var ModelCostEstimateSchema = external_exports.object({
+  costUsd: external_exports.number().nonnegative(),
+  method: external_exports.enum(["estimated_from_model_rate", "unknown_model_rate"]),
+  rateModel: external_exports.enum(["claude-haiku", "claude-sonnet", "claude-opus", "unknown"])
+});
+var IntegrationSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  studioId: external_exports.string().uuid(),
+  productId: external_exports.string().uuid().nullable(),
+  kind: external_exports.string(),
+  oauthTokenEncrypted: external_exports.string().optional(),
+  refreshTokenEncrypted: external_exports.string().optional(),
+  status: external_exports.enum(["active", "broken", "revoked"]),
+  lastSyncAt: external_exports.coerce.date().optional(),
+  errorCount: external_exports.number().int().nonnegative().default(0)
+});
+var EmailAccountSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  studioId: external_exports.string().uuid(),
+  provider: external_exports.enum(["gmail", "m365", "imap"]),
+  oauthTokenEncrypted: external_exports.string().optional(),
+  defaultLabelPrefix: external_exports.string().optional(),
+  triageCadenceMins: external_exports.number().int().positive().default(240)
+});
+var RoutineSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  productId: external_exports.string().uuid().nullable(),
+  name: external_exports.string(),
+  cronExpression: external_exports.string(),
+  promptTemplate: external_exports.string(),
+  model: external_exports.enum(["sonnet", "opus", "haiku"]).default("sonnet"),
+  lastRunAt: external_exports.coerce.date().optional(),
+  nextRunAt: external_exports.coerce.date().optional(),
+  enabled: external_exports.boolean().default(true),
+  retryCount: external_exports.number().int().nonnegative().default(0)
+});
+var RoutineRunSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  routineId: external_exports.string().uuid(),
+  startedAt: external_exports.coerce.date(),
+  completedAt: external_exports.coerce.date().optional(),
+  status: external_exports.enum(["success", "failed", "retried"]),
+  outputBriefId: external_exports.string().uuid().optional(),
+  errorMessage: external_exports.string().optional(),
+  inferenceCostCents: external_exports.number().int().nonnegative().default(0)
+});
+var BriefSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  studioId: external_exports.string().uuid(),
+  generatedAt: external_exports.coerce.date(),
+  type: external_exports.enum(["daily", "weekly", "on_demand"]),
+  html: external_exports.string().optional(),
+  markdown: external_exports.string(),
+  sourceLinks: external_exports.array(external_exports.object({ label: external_exports.string(), url: external_exports.string() })).default([]),
+  shared: external_exports.boolean().default(false),
+  shareToken: external_exports.string().optional(),
+  shareExpiresAt: external_exports.coerce.date().optional(),
+  inferenceCostCents: external_exports.number().int().nonnegative().default(0)
+});
+var MemoryEntrySchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  productId: external_exports.string().uuid(),
+  kind: external_exports.enum(["decision", "fact", "customer", "status", "pattern", "thread"]),
+  content: external_exports.string(),
+  // embedding stored separately in pgvector; not modelled in API layer
+  createdAt: external_exports.coerce.date(),
+  lastReferencedAt: external_exports.coerce.date().optional(),
+  referenceCount: external_exports.number().int().nonnegative().default(0),
+  pinned: external_exports.boolean().default(false)
+});
+var InboxClassificationSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  emailAccountId: external_exports.string().uuid(),
+  productId: external_exports.string().uuid().nullable(),
+  messageId: external_exports.string(),
+  sender: external_exports.string(),
+  labelApplied: external_exports.string(),
+  urgency: external_exports.enum(["needs_reply", "fyi", "noise", "escalation"]),
+  confidence: external_exports.number().min(0).max(1),
+  action: external_exports.enum(["labelled", "archived", "drafted_reply"]),
+  userCorrected: external_exports.boolean().default(false),
+  correctedTo: external_exports.string().optional()
+});
+var DraftReplySchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  classificationId: external_exports.string().uuid(),
+  draftText: external_exports.string(),
+  confidence: external_exports.number().min(0).max(1),
+  sentAt: external_exports.coerce.date().optional(),
+  sentVia: external_exports.string().optional()
+});
+var AlwaysAlertRuleSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  studioId: external_exports.string().uuid(),
+  ruleType: external_exports.enum(["sender", "subject", "domain"]),
+  value: external_exports.string(),
+  escalationMethod: external_exports.enum(["push", "slack", "email", "brief_pin"]).default("brief_pin")
+});
+var AuditEventSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  studioId: external_exports.string().uuid(),
+  actor: external_exports.enum(["user", "agent", "system"]),
+  action: external_exports.string(),
+  integrationId: external_exports.string().uuid().optional(),
+  productId: external_exports.string().uuid().optional(),
+  timestamp: external_exports.coerce.date(),
+  metadata: external_exports.record(external_exports.unknown()).default({})
+});
+var SubscriptionSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  studioId: external_exports.string().uuid(),
+  stripeSubscriptionId: external_exports.string().optional(),
+  tier: external_exports.enum(["trial", "solo", "studio", "studio_plus", "self_hosted", "enterprise"]),
+  seats: external_exports.number().int().positive(),
+  status: external_exports.string(),
+  currentPeriodEnd: external_exports.coerce.date(),
+  cancelAt: external_exports.coerce.date().optional()
+});
+var ProductMembershipSchema = external_exports.object({
+  humanId: external_exports.string().uuid(),
+  productId: external_exports.string().uuid(),
+  role: external_exports.enum(["lead", "contributor", "observer"])
+});
+
+// ../witan/src/batch.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { mkdirSync as mkdirSync2, writeFileSync } from "fs";
+import { basename as basename2, join as join5 } from "path";
+
+// ../witan/src/public-scan.ts
+import { resolve as resolve2 } from "path";
+
+// ../witan/src/ingest.ts
+import { readFileSync as readFileSync5, readdirSync as readdirSync2 } from "fs";
+import { join as join2 } from "path";
+
+// ../witan/src/finding-limits.ts
+var RULE_ID_MAX = 200;
+var MESSAGE_MAX = 500;
+var LOCATION_MAX = 700;
+function clamp(value, max) {
+  if (value.length <= max) return value;
+  const ellipsis = "...";
+  return `${value.slice(0, Math.max(max - ellipsis.length, 0))}${ellipsis}`;
+}
+function clampFinding(finding) {
   return {
-    productSlug: options.productSlug,
-    productDisplayName: options.productDisplayName,
-    repo: {
-      path: options.repoPath,
-      ...headSha ? { headSha } : {}
-    },
-    generatedAt,
-    ...options.rubricVersion ? { rubricVersion: options.rubricVersion } : {},
-    archetype: archetype.archetype,
-    ...archetype.insufficientSourceReason ? { insufficientSourceReason: archetype.insufficientSourceReason } : {},
-    signals: [
-      ...collectRepoSignals(options.repoPath, generatedAt, repoFiles),
-      ...(options.domainCollectors ?? []).map((collect) => collect(options.repoPath, repoFiles)),
-      ...options.additionalSignals ?? []
-    ]
+    ...finding,
+    ruleId: clamp(finding.ruleId, RULE_ID_MAX),
+    message: clamp(finding.message, MESSAGE_MAX),
+    ...finding.location ? { location: clamp(finding.location, LOCATION_MAX) } : {}
   };
 }
-var SOURCE_EXTENSION_PATTERN = /\.(ts|tsx|mts|cts|js|jsx|mjs|cjs|py|go|rs|java|kt|kts|rb|php|swift|cpp|cc|cxx|c|h|hpp|cs|scala|dart|ex|exs)$/i;
-var BUNDLED_BINARY_EXTENSION_PATTERN = /\.(vsix|zip|tgz|whl|exe|dmg|pkg|msi|jar|war|apk|ipa|dll|dylib)$/i;
-var DOCS_OR_MEDIA_EXTENSION_PATTERN = /\.(md|mdx|rst|png|jpe?g|gif|svg|webp|ico|pdf)$/i;
-var INGEST_POINTER = "To assess a closed/bundled tool, ingest its scanner output via --ingest <sarif|scorecard>.";
-function classifyRepoArchetype(repoFiles) {
-  const totalFileCount = repoFiles.length;
-  const sourceFileCount = repoFiles.filter((file) => SOURCE_EXTENSION_PATTERN.test(file)).length;
-  if (totalFileCount === 0) {
-    return {
-      archetype: "empty",
-      sourceFileCount: 0,
-      totalFileCount: 0,
-      insufficientSourceReason: "Repository has no tracked files \u2014 there is nothing to certify."
-    };
-  }
-  if (sourceFileCount > 0) {
-    return {
-      archetype: isLikelyMonorepo(repoFiles) ? "monorepo" : "source",
-      sourceFileCount,
-      totalFileCount
-    };
-  }
-  const binaryFiles = repoFiles.filter((file) => BUNDLED_BINARY_EXTENSION_PATTERN.test(file));
-  if (binaryFiles.length > 0) {
-    const sample = binaryFiles[0];
-    return {
-      archetype: "binary_only",
-      sourceFileCount,
-      totalFileCount,
-      insufficientSourceReason: `${sourceFileCount} source file(s) found among ${totalFileCount} tracked file(s); repo appears to be a binary/bundled-distribution tree (e.g. ${sample ? basename(sample) : "a packaged artifact"}) \u2014 cejel rates source, not binaries. ${INGEST_POINTER}`
+
+// ../witan/src/generic-adapter.ts
+import { readFileSync as readFileSync2 } from "fs";
+
+// ../witan/src/json-safe.ts
+function stripBom(text) {
+  return text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+}
+
+// ../witan/src/generic-adapter.ts
+var VALID_DIMENSIONS = /* @__PURE__ */ new Set([
+  "A1",
+  "A2",
+  "A3",
+  "A4",
+  "A5",
+  "B1",
+  "B2",
+  "B3",
+  "B4",
+  "B5",
+  "B6"
+]);
+var VALID_SEVERITIES = /* @__PURE__ */ new Set(["critical", "warning", "info"]);
+function isGenericSignalDocument(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
+  const doc = raw;
+  return typeof doc.tool === "string" && doc.tool.length > 0 && Array.isArray(doc.signals);
+}
+function parseGenericJson(raw) {
+  if (!isGenericSignalDocument(raw)) return [];
+  const source = raw.tool ?? "unknown";
+  const signals = [];
+  for (const signal of raw.signals ?? []) {
+    const dimension = signal.dimension;
+    if (!dimension || !VALID_DIMENSIONS.has(dimension)) continue;
+    const weight = typeof signal.weight === "number" && Number.isFinite(signal.weight) ? Math.min(Math.max(signal.weight, 0), 1) : 0.5;
+    const findings = [];
+    for (const finding of signal.findings ?? []) {
+      const severity = finding.severity;
+      if (!severity || !VALID_SEVERITIES.has(severity)) continue;
+      const ruleId = finding.ruleId ?? "unknown";
+      findings.push({
+        ruleId,
+        severity,
+        message: finding.message ?? ruleId,
+        ...finding.location ? { location: finding.location } : {}
+      });
+    }
+    if (findings.length === 0) continue;
+    signals.push({ source, dimension, weight, findings });
+  }
+  return signals;
+}
+
+// ../witan/src/sarif-adapter.ts
+import { readFileSync as readFileSync3 } from "fs";
+var DIMENSION_RULES = [
+  // A2 — injection / secrets / auth (high weight)
+  {
+    pattern: /sql[- _]?inject|cwe-89|sqli|command[- _]?inject|cwe-78|os[- _]?cmd|rce|remote[- _]?code/i,
+    dimension: "A2",
+    weight: 0.9
+  },
+  {
+    pattern: /secret|credential|api[- _]?key|password[- _]?leak|hardcoded[- _]?(token|key|secret)|cwe-259|cwe-798/i,
+    dimension: "A2",
+    weight: 0.9
+  },
+  {
+    pattern: /path[- _]?traversal|directory[- _]?traversal|cwe-22|lfi|rfi/i,
+    dimension: "A2",
+    weight: 0.8
+  },
+  {
+    pattern: /ssrf|server[- _]?side[- _]?request[- _]?forg|cwe-918/i,
+    dimension: "A2",
+    weight: 0.8
+  },
+  {
+    pattern: /xxe|xml[- _]?external[- _]?entity|cwe-611/i,
+    dimension: "A2",
+    weight: 0.8
+  },
+  {
+    pattern: /auth[- _]?bypass|broken[- _]?auth|missing[- _]?auth|cwe-287|cwe-306|cwe-863|cwe-862/i,
+    dimension: "A2",
+    weight: 0.7
+  },
+  {
+    pattern: /xss|cross[- _]?site[- _]?script|cwe-79/i,
+    dimension: "A2",
+    weight: 0.6
+  },
+  // A4 — dependency vulnerabilities
+  {
+    pattern: /cve-\d{4}-\d+|supply[- _]?chain|depend[a-z]*[- _]?vulner|outdated[- _]?depend|deprecated[- _]?package/i,
+    dimension: "A4",
+    weight: 0.8
+  },
+  {
+    pattern: /npm[- _]?audit|yarn[- _]?audit|pnpm[- _]?audit|pip[- _]?audit|cargo[- _]?audit/i,
+    dimension: "A4",
+    weight: 0.7
+  },
+  // A3 — production readiness / insecure config
+  {
+    pattern: /insecure[- _]?tls|weak[- _]?cipher|tls[- _]?version|http[- _]?strict|hsts|csp[- _]?missing|cwe-326|cwe-327/i,
+    dimension: "A3",
+    weight: 0.5
+  },
+  {
+    pattern: /error[- _]?handl|unhandled[- _]?exception|crash|uncaught|stacktrace[- _]?leak/i,
+    dimension: "A3",
+    weight: 0.4
+  },
+  {
+    pattern: /debug[- _]?mode|dev[- _]?endpoint|staging[- _]?secret/i,
+    dimension: "A3",
+    weight: 0.4
+  },
+  // A1 — test integrity (low weight; SARIF rarely surfaces this)
+  {
+    pattern: /skipped[- _]?test|hollow[- _]?test|empty[- _]?assert|no[- _]?assertion/i,
+    dimension: "A1",
+    weight: 0.2
+  }
+];
+var DEFAULT_DIMENSION = "A2";
+var DEFAULT_WEIGHT = 0.3;
+var DROP_LEVEL = /* @__PURE__ */ new Set(["none"]);
+function mapLevel(level) {
+  if (!level || DROP_LEVEL.has(level)) return null;
+  if (level === "error") return "critical";
+  if (level === "warning") return "warning";
+  return "info";
+}
+function mapRuleToDimension(ruleId, rules) {
+  for (const rule of rules) {
+    if (rule.pattern.test(ruleId)) {
+      return { dimension: rule.dimension, weight: rule.weight };
+    }
+  }
+  return { dimension: DEFAULT_DIMENSION, weight: DEFAULT_WEIGHT };
+}
+function renderLocation(result) {
+  const loc = result.locations?.[0]?.physicalLocation;
+  if (!loc) return void 0;
+  const uri = loc.artifactLocation?.uri;
+  const line = loc.region?.startLine;
+  if (!uri) return void 0;
+  return line != null ? `${uri}:${line}` : uri;
+}
+function dedupeFindings(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  return findings.filter((f) => {
+    const key = `${f.ruleId}|${f.severity}|${f.location ?? ""}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function parseSarifJson(raw, extraDimensionRules) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
+  const dimensionRules = extraDimensionRules ? [...DIMENSION_RULES, ...extraDimensionRules] : DIMENSION_RULES;
+  const doc = raw;
+  if (!Array.isArray(doc.runs)) return [];
+  const buckets = /* @__PURE__ */ new Map();
+  for (const run of doc.runs) {
+    const driverName = run.tool?.driver?.name ?? "unknown";
+    const source = `sarif:${driverName}`;
+    const ruleDefaultLevels = /* @__PURE__ */ new Map();
+    for (const rule of run.tool?.driver?.rules ?? []) {
+      if (rule.id && rule.defaultConfiguration?.level) {
+        ruleDefaultLevels.set(rule.id, rule.defaultConfiguration.level);
+      }
+    }
+    for (const result of run.results ?? []) {
+      const ruleId = result.ruleId ?? "unknown";
+      const effectiveLevel = result.level ?? ruleDefaultLevels.get(ruleId) ?? "warning";
+      const severity = mapLevel(effectiveLevel);
+      if (!severity) continue;
+      const message = result.message?.text ?? ruleId;
+      const location = renderLocation(result);
+      const { dimension, weight } = mapRuleToDimension(ruleId, dimensionRules);
+      const bucketKey = `${source}|${dimension}`;
+      if (!buckets.has(bucketKey)) {
+        buckets.set(bucketKey, { source, dimension, weight, findings: [] });
+      }
+      buckets.get(bucketKey)?.findings.push({ ruleId, severity, message, ...location ? { location } : {} });
+    }
+  }
+  return Array.from(buckets.values()).map(({ source, dimension, weight, findings }) => ({
+    source,
+    dimension,
+    weight,
+    findings: dedupeFindings(findings)
+  }));
+}
+
+// ../witan/src/scorecard-adapter.ts
+import { readFileSync as readFileSync4 } from "fs";
+var CHECK_RULES = {
+  // B2 — PR outcome traceability
+  "Branch-Protection": { dimension: "B2", weight: 0.8 },
+  "Code-Review": { dimension: "B2", weight: 0.7 },
+  // B3 — CI and QA discipline
+  "Dangerous-Workflow": { dimension: "B3", weight: 0.9 },
+  "Token-Permissions": { dimension: "B3", weight: 0.8 },
+  "CI-Tests": { dimension: "B3", weight: 0.7 },
+  Maintained: { dimension: "B3", weight: 0.3 },
+  // B4 — audit trail / release integrity
+  "Signed-Releases": { dimension: "B4", weight: 0.7 },
+  Packaging: { dimension: "B4", weight: 0.4 },
+  "Security-Policy": { dimension: "B4", weight: 0.4 },
+  // A4 — dependency hygiene
+  Vulnerabilities: { dimension: "A4", weight: 0.9 },
+  "Pinned-Dependencies": { dimension: "A4", weight: 0.8 },
+  "Dependency-Update-Tool": { dimension: "A4", weight: 0.6 },
+  // A2 — data-layer / static analysis
+  SAST: { dimension: "A2", weight: 0.7 },
+  "Binary-Artifacts": { dimension: "A2", weight: 0.6 },
+  // A1 — test integrity
+  Fuzzing: { dimension: "A1", weight: 0.3 }
+};
+function mapScoreToSeverity(score) {
+  if (score == null || Number.isNaN(score)) return null;
+  if (score < 0) return null;
+  if (score >= 10) return null;
+  if (score <= 3) return "critical";
+  if (score <= 6) return "warning";
+  return "info";
+}
+function dedupeFindings2(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  return findings.filter((f) => {
+    const key = `${f.ruleId}|${f.severity}|${f.location ?? ""}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function parseScorecardJson(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
+  const doc = raw;
+  if (!Array.isArray(doc.checks)) return [];
+  const buckets = /* @__PURE__ */ new Map();
+  for (const check of doc.checks) {
+    const name = check.name;
+    if (!name) continue;
+    const rule = CHECK_RULES[name];
+    if (!rule) continue;
+    const severity = mapScoreToSeverity(check.score);
+    if (!severity) continue;
+    const scoreText = typeof check.score === "number" ? `${check.score}/10` : "n/a";
+    const message = `${name} (Scorecard ${scoreText}): ${check.reason ?? "weakness detected"}`.slice(0, 500);
+    const location = check.documentation?.url;
+    const bucket = buckets.get(rule.dimension) ?? { weight: 0, findings: [] };
+    bucket.weight = Math.max(bucket.weight, rule.weight);
+    bucket.findings.push({
+      ruleId: `scorecard:${name}`,
+      severity,
+      message,
+      ...location ? { location } : {}
+    });
+    buckets.set(rule.dimension, bucket);
+  }
+  return Array.from(buckets.entries()).map(([dimension, { weight, findings }]) => ({
+    source: "scorecard",
+    dimension,
+    weight,
+    findings: dedupeFindings2(findings)
+  }));
+}
+
+// ../witan/src/ingest.ts
+function looksLikeSarif(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
+  return Array.isArray(raw.runs);
+}
+function looksLikeScorecard(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
+  return Array.isArray(raw.checks);
+}
+function countRawEntries(raw) {
+  const obj = raw;
+  if (Array.isArray(obj.runs)) {
+    return obj.runs.reduce((sum, run) => {
+      const results = run.results;
+      return sum + (Array.isArray(results) ? results.length : 0);
+    }, 0);
+  }
+  if (Array.isArray(obj.checks)) return obj.checks.length;
+  if (Array.isArray(obj.signals)) {
+    return obj.signals.reduce((sum, signal) => {
+      const findings = signal.findings;
+      return sum + (Array.isArray(findings) ? findings.length : 0);
+    }, 0);
+  }
+  return 0;
+}
+function rawToolName(raw) {
+  const obj = raw;
+  if (Array.isArray(obj.runs)) {
+    const firstRun = obj.runs[0];
+    return firstRun?.tool?.driver?.name ?? "unknown";
+  }
+  if (typeof obj.tool === "string" && obj.tool.length > 0) return obj.tool;
+  return "scorecard";
+}
+function parseIngestFile(filePath) {
+  let raw;
+  try {
+    raw = JSON.parse(stripBom(readFileSync5(filePath, "utf8")));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Cejel: could not parse ingest file as JSON: ${filePath} (${message})`);
+  }
+  let signals;
+  if (looksLikeSarif(raw)) signals = parseSarifJson(raw);
+  else if (looksLikeScorecard(raw)) signals = parseScorecardJson(raw);
+  else if (isGenericSignalDocument(raw)) signals = parseGenericJson(raw);
+  if (!signals) {
+    throw new Error(
+      `Cejel: unrecognized ingest file format: ${filePath} \u2014 expected SARIF (a "runs" array), OpenSSF Scorecard JSON (a "checks" array), or the generic Cejel external-signal shape (a "tool" string + "signals" array). See the cejel README "Aggregate your scanners".`
+    );
+  }
+  const rawCount = countRawEntries(raw);
+  const mappedCount = signals.reduce((sum, signal) => sum + signal.findings.length, 0);
+  if (rawCount > 0 && mappedCount === 0) {
+    process.stderr.write(
+      `Cejel: ${rawCount} findings from ${rawToolName(raw)} (${filePath}), 0 mapped to trust criteria
+`
+    );
+  }
+  return signals.map((signal) => ({
+    ...signal,
+    findings: signal.findings.map(clampFinding)
+  }));
+}
+function expandIngestPattern(pattern) {
+  if (!pattern.includes("*")) return [pattern];
+  const lastSlash = pattern.lastIndexOf("/");
+  const dir = lastSlash === -1 ? "." : pattern.slice(0, lastSlash);
+  const filePattern = lastSlash === -1 ? pattern : pattern.slice(lastSlash + 1);
+  const regexSource = filePattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  const regex = new RegExp(`^${regexSource}$`);
+  let entries;
+  try {
+    entries = readdirSync2(dir);
+  } catch {
+    return [];
+  }
+  return entries.filter((name) => regex.test(name)).sort().map((name) => join2(dir, name));
+}
+function discoverIngestInputs(repoPath) {
+  const inputsDir = join2(repoPath, ".cejel", "inputs");
+  let entries;
+  try {
+    entries = readdirSync2(inputsDir);
+  } catch {
+    return [];
+  }
+  return entries.filter((name) => /\.(sarif|json)$/i.test(name)).sort().map((name) => join2(inputsDir, name));
+}
+
+// ../witan/src/repo-signals.ts
+import { execFileSync } from "child_process";
+import { createHash } from "crypto";
+import { readFileSync as readFileSync6, readdirSync as readdirSync3, realpathSync, statSync as statSync2 } from "fs";
+import { basename, join as join3, relative, resolve, sep } from "path";
+function buildWitanInputFromRepo(options) {
+  assertRepoPathExists(options.repoPath);
+  const generatedAt = options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const headSha = readGitHead(options.repoPath);
+  const repoFiles = listRepoFiles(options.repoPath);
+  const archetype = classifyRepoArchetype(repoFiles);
+  return {
+    productSlug: options.productSlug,
+    productDisplayName: options.productDisplayName,
+    repo: {
+      path: options.repoPath,
+      ...headSha ? { headSha } : {}
+    },
+    generatedAt,
+    ...options.rubricVersion ? { rubricVersion: options.rubricVersion } : {},
+    archetype: archetype.archetype,
+    ...archetype.insufficientSourceReason ? { insufficientSourceReason: archetype.insufficientSourceReason } : {},
+    signals: [
+      ...collectRepoSignals(options.repoPath, generatedAt, repoFiles),
+      ...(options.domainCollectors ?? []).map((collect) => collect(options.repoPath, repoFiles)),
+      ...options.additionalSignals ?? []
+    ]
+  };
+}
+var SOURCE_LANGUAGES = [
+  {
+    name: "JS/TS",
+    tier: "deep",
+    extensions: ["ts", "tsx", "mts", "cts", "js", "jsx", "mjs", "cjs"]
+  },
+  { name: "Python", tier: "deep", extensions: ["py"] },
+  { name: "Go", tier: "partial", extensions: ["go"] },
+  { name: "Rust", tier: "partial", extensions: ["rs"] },
+  { name: "Java", tier: "partial", extensions: ["java"] },
+  { name: "Ruby", tier: "partial", extensions: ["rb"] },
+  { name: "PHP", tier: "partial", extensions: ["php"] },
+  { name: "C#", tier: "partial", extensions: ["cs"] },
+  { name: "C/C++", tier: "partial", extensions: ["cpp", "cc", "cxx", "c", "h", "hpp"] },
+  { name: "Swift", tier: "partial", extensions: ["swift"] },
+  { name: "Kotlin", tier: "partial", extensions: ["kt", "kts"] },
+  { name: "Dart", tier: "partial", extensions: ["dart"] },
+  { name: "Elixir", tier: "partial", extensions: ["ex", "exs"] },
+  { name: "Scala", tier: "partial", extensions: ["scala"] },
+  { name: "shell", tier: "unmodelled", extensions: ["sh", "bash", "zsh"] },
+  { name: "R", tier: "unmodelled", extensions: ["r"] },
+  { name: "Lua", tier: "unmodelled", extensions: ["lua"] },
+  { name: "Julia", tier: "unmodelled", extensions: ["jl"] },
+  { name: "Haskell", tier: "unmodelled", extensions: ["hs"] },
+  { name: "Terraform", tier: "unmodelled", extensions: ["tf", "tfvars"] },
+  { name: "SQL", tier: "unmodelled", extensions: ["sql"] },
+  { name: "Perl", tier: "unmodelled", extensions: ["pl", "pm"] },
+  { name: "OCaml", tier: "unmodelled", extensions: ["ml", "mli"] },
+  { name: "Clojure", tier: "unmodelled", extensions: ["clj", "cljs", "cljc"] },
+  { name: "Erlang", tier: "unmodelled", extensions: ["erl", "hrl"] },
+  { name: "Nim", tier: "unmodelled", extensions: ["nim"] },
+  { name: "Zig", tier: "unmodelled", extensions: ["zig"] },
+  { name: "F#", tier: "unmodelled", extensions: ["fs", "fsx"] },
+  { name: "Groovy", tier: "unmodelled", extensions: ["groovy", "gvy"] }
+];
+var SOURCE_EXTENSION_PATTERN = new RegExp(
+  `\\.(${SOURCE_LANGUAGES.flatMap((language) => language.extensions).join("|")})$`,
+  "i"
+);
+var BUNDLED_BINARY_EXTENSION_PATTERN = /\.(vsix|zip|tgz|whl|exe|dmg|pkg|msi|jar|war|apk|ipa|dll|dylib)$/i;
+var DOCS_OR_MEDIA_EXTENSION_PATTERN = /\.(md|mdx|rst|png|jpe?g|gif|svg|webp|ico|pdf)$/i;
+var KNOWN_NON_SOURCE_EXTENSION_PATTERN = /\.(json|jsonc|json5|ya?ml|toml|txt|lock|xml|csv|tsv|ini|cfg|conf|properties|env|sum|mod|graphql|gql|proto|editorconfig|gitignore|gitattributes|npmrc|nvmrc|dockerignore|log|txt\.license)$/i;
+var INGEST_POINTER = "To assess a closed/bundled tool, ingest its scanner output via --ingest <sarif|scorecard>.";
+var SOURCE_DOMINANCE_RATIO_THRESHOLD = 0.2;
+function classifyRepoArchetype(repoFiles) {
+  const totalFileCount = repoFiles.length;
+  const sourceFileCount = repoFiles.filter((file) => SOURCE_EXTENSION_PATTERN.test(file)).length;
+  if (totalFileCount === 0) {
+    return {
+      archetype: "empty",
+      sourceFileCount: 0,
+      totalFileCount: 0,
+      insufficientSourceReason: "Repository has no tracked files \u2014 there is nothing to certify."
     };
   }
-  const docsFiles = repoFiles.filter((file) => DOCS_OR_MEDIA_EXTENSION_PATTERN.test(file));
-  if (docsFiles.length > 0 && docsFiles.length === totalFileCount) {
+  const unrecognisedSourceFiles = collectUnrecognisedSourceFiles(repoFiles);
+  if (sourceFileCount === 0) {
+    const binaryFiles = repoFiles.filter((file) => BUNDLED_BINARY_EXTENSION_PATTERN.test(file));
+    if (binaryFiles.length > 0) {
+      const sample = binaryFiles[0];
+      return {
+        archetype: "binary_only",
+        sourceFileCount,
+        totalFileCount,
+        insufficientSourceReason: `${sourceFileCount} source file(s) found among ${totalFileCount} tracked file(s); repo appears to be a binary/bundled-distribution tree (e.g. ${sample ? basename(sample) : "a packaged artifact"}) \u2014 cejel rates source, not binaries. ${INGEST_POINTER}`
+      };
+    }
+    const docsFiles = repoFiles.filter((file) => DOCS_OR_MEDIA_EXTENSION_PATTERN.test(file));
+    if (docsFiles.length > 0 && docsFiles.length === totalFileCount) {
+      return {
+        archetype: "docs_only",
+        sourceFileCount,
+        totalFileCount,
+        insufficientSourceReason: `${sourceFileCount} source file(s) found among ${totalFileCount} tracked file(s); repo appears to be a docs/distribution tree (README/markdown/media), not a source tree \u2014 cejel rates source, not docs. ${INGEST_POINTER}`
+      };
+    }
+    if (unrecognisedSourceFiles.length > 0) {
+      return unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognisedSourceFiles);
+    }
+    return { archetype: "source", sourceFileCount, totalFileCount };
+  }
+  if (unrecognisedSourceFiles.length === 0) {
     return {
-      archetype: "docs_only",
+      archetype: isLikelyMonorepo(repoFiles) ? "monorepo" : "source",
       sourceFileCount,
-      totalFileCount,
-      insufficientSourceReason: `${sourceFileCount} source file(s) found among ${totalFileCount} tracked file(s); repo appears to be a docs/distribution tree (README/markdown/media), not a source tree \u2014 cejel rates source, not docs. ${INGEST_POINTER}`
+      totalFileCount
     };
   }
-  return { archetype: "source", sourceFileCount, totalFileCount };
+  const dominanceRatio = sourceFileCount / (sourceFileCount + unrecognisedSourceFiles.length);
+  if (dominanceRatio >= SOURCE_DOMINANCE_RATIO_THRESHOLD) {
+    return {
+      archetype: isLikelyMonorepo(repoFiles) ? "monorepo" : "source",
+      sourceFileCount,
+      totalFileCount
+    };
+  }
+  return unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognisedSourceFiles);
+}
+function collectUnrecognisedSourceFiles(repoFiles) {
+  return repoFiles.filter((file) => {
+    const base = basename(file);
+    if (!/\.([a-zA-Z0-9_]+)$/.test(base)) return false;
+    if (KNOWN_NON_SOURCE_EXTENSION_PATTERN.test(base)) return false;
+    if (DOCS_OR_MEDIA_EXTENSION_PATTERN.test(base)) return false;
+    if (BUNDLED_BINARY_EXTENSION_PATTERN.test(base)) return false;
+    if (SOURCE_EXTENSION_PATTERN.test(base)) return false;
+    return true;
+  });
+}
+function extensionsByFileCountDescending(files) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const match = /\.([a-zA-Z0-9_]+)$/.exec(basename(file));
+    const ext = match?.[1];
+    if (!ext) continue;
+    const key = `.${ext.toLowerCase()}`;
+    counts.set(key, (counts.get(key) ?? 0) + 1);
+  }
+  return [...counts.entries()].sort(([extA, countA], [extB, countB]) => countB - countA || extA.localeCompare(extB)).map(([ext]) => ext);
+}
+function unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognisedSourceFiles) {
+  const sample = extensionsByFileCountDescending(unrecognisedSourceFiles).slice(0, 6).join(", ");
+  const candidateCount = sourceFileCount + unrecognisedSourceFiles.length;
+  const dominancePct = candidateCount > 0 ? (sourceFileCount / candidateCount * 100).toFixed(1) : "0.0";
+  const thresholdPct = (SOURCE_DOMINANCE_RATIO_THRESHOLD * 100).toFixed(0);
+  const measuredClause = sourceFileCount > 0 ? `${sourceFileCount} of ${candidateCount} source-shaped file(s) (${dominancePct}%) are in a language Cejel reads \u2014 below the ${thresholdPct}% dominance threshold a score would need to be meaningful (${totalFileCount} tracked files in total; manifests, lockfiles, docs, media and bundled binaries are excluded from both sides of the ratio)` : `0 of ${totalFileCount} tracked file(s) matched a recognised source extension`;
+  return {
+    archetype: "unrecognised_ecosystem",
+    sourceFileCount,
+    totalFileCount,
+    insufficientSourceReason: `Cejel does not yet read this repository's dominant source language(s) (${sample}) \u2014 ${measuredClause}. Cejel abstains from a verdict rather than score a repository whose recognised source is incidental rather than dominant; the Criterion Profile and Measured coverage below show exactly which dimensions were and were not measured. ${INGEST_POINTER}`
+  };
 }
 function isLikelyMonorepo(repoFiles) {
   const packageRoots = new Set(
@@ -4792,7 +6702,7 @@ function isLikelyMonorepo(repoFiles) {
 function assertRepoPathExists(repoPath) {
   let stats;
   try {
-    stats = statSync(repoPath);
+    stats = statSync2(repoPath);
   } catch {
     throw new Error(`Cejel: path not found: ${repoPath}`);
   }
@@ -4820,14 +6730,14 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles) {
   const a5Signal = collectA5ClaimRealityEvidence(repoPath, repoFiles);
   const b1Signal = buildNotApplicableSignal(
     "B1",
-    "Dispatch-trace process signal is not evaluated for external repos."
+    "Repository scans do not evaluate the dispatch-trace process dimension."
   );
   const b2Signal = collectB2PrTraceEvidence(repoPath, repoFiles);
   const b3Signal = collectB3CiDisciplineEvidence(repoPath, repoFiles, mono);
   const b4Signal = collectB4AuditEvidence(repoPath, repoFiles, generatedAt);
   const b5Signal = buildNotApplicableSignal(
     "B5",
-    "Learning-trace process signal is not evaluated for external repos."
+    "Repository scans do not evaluate the learning-trace process dimension."
   );
   const b6Signal = collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles);
   for (const signal of [
@@ -4860,7 +6770,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles) {
   const runnerFiles = repoFiles.filter(isTestRunnerConfig).slice(0, 6);
   const coverageFiles = repoFiles.filter(isCoverageConfig).slice(0, 4);
   const packageJson = findRootPackageJson(repoFiles);
-  const packageScripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
+  const packageScripts = packageJson ? readPackageScripts(join3(repoPath, packageJson)) : /* @__PURE__ */ new Map();
   const coveragePercent = readCoveragePercent(repoPath, coverageFiles);
   const ciWorkflows = repoFiles.filter(isCiWorkflow);
   const ciTestWorkflow = ciWorkflows.find(
@@ -5014,8 +6924,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles) {
   };
 }
 function collectA2IsolationEvidence(repoPath, repoFiles) {
-  const alfredEvidence = [];
-  const evidence = [...alfredEvidence];
+  const evidence = [];
   const findings = [];
   const gitignore = repoFiles.find((file) => basename(file) === ".gitignore");
   const envExamples = repoFiles.filter((file) => isEnvTemplatePath(file));
@@ -5031,47 +6940,43 @@ function collectA2IsolationEvidence(repoPath, repoFiles) {
     repoPath,
     repoFiles.filter(isImplementationFile).slice(0, 60)
   );
-  if (alfredEvidence.length === 0) {
-    const implFiles = repoFiles.filter(isImplementationFile);
-    const gitignoreHasEnvRule = gitignore != null && fileContains(repoPath, gitignore, /^\.env(\*|\b)|\.env\./m);
-    const committedEnvFilePath = repoFiles.find(
-      (f) => /(?:^|\/)\.env(?:\.|$)/i.test(f) && !isEnvTemplatePath(f)
+  const implFiles = repoFiles.filter(isImplementationFile);
+  const gitignoreHasEnvRule = gitignore != null && fileContains(repoPath, gitignore, /^\.env(\*|\b)|\.env\./m);
+  const committedEnvFilePath = repoFiles.find(
+    (f) => /(?:^|\/)\.env(?:\.|$)/i.test(f) && !isEnvTemplatePath(f)
+  );
+  const hasEnvInHistory = committedEnvFilePath === void 0 && hasEnvPathInGitHistory(repoPath);
+  const dbLayerImportFile = migrationFiles.length === 0 ? implFiles.slice(0, 30).find((f) => fileContains(repoPath, f, DB_CLIENT_PATTERN)) : void 0;
+  const hasDataLayer = migrationFiles.length > 0 || dbLayerImportFile !== void 0;
+  const hasSecretsSurface = envExamples.length > 0 || committedEnvFilePath !== void 0 || gitignoreHasEnvRule || hasEnvInHistory;
+  if (!hasDataLayer && !hasSecretsSurface && !hasConfirmedSecretFinding && !cryptoHygiene.hasSurface) {
+    return buildNotApplicableSignal(
+      "A2",
+      "No data layer (DB/ORM/migrations) or ratable secrets surface detected \u2014 A2 not applicable to this repo archetype. A ratable surface requires .env* files, .gitignore .env rule, committed/history .env path, or detected signing/HMAC/secret-comparison code; bare env reads (process.env / os.environ / std::env::) do not qualify."
     );
-    const hasEnvInHistory = committedEnvFilePath === void 0 && hasEnvPathInGitHistory(repoPath);
-    const dbLayerImportFile = migrationFiles.length === 0 ? implFiles.slice(0, 30).find((f) => fileContains(repoPath, f, DB_CLIENT_PATTERN)) : void 0;
-    const hasDataLayer = migrationFiles.length > 0 || dbLayerImportFile !== void 0;
-    const hasSecretsSurface = envExamples.length > 0 || committedEnvFilePath !== void 0 || gitignoreHasEnvRule || hasEnvInHistory;
-    if (!hasDataLayer && !hasSecretsSurface && !hasConfirmedSecretFinding && !cryptoHygiene.hasSurface) {
-      return buildNotApplicableSignal(
-        "A2",
-        "No data layer (DB/ORM/migrations) or ratable secrets surface detected \u2014 A2 not applicable to this repo archetype. A ratable surface requires .env* files, .gitignore .env rule, committed/history .env path, or detected signing/HMAC/secret-comparison code; bare env reads (process.env / os.environ / std::env::) do not qualify."
-      );
-    }
-    if (committedEnvFilePath) {
-      evidence.push(
-        evidenceForRelative(
-          repoPath,
-          committedEnvFilePath,
-          "secret_scan",
-          "Committed .env file in repository tree"
-        )
-      );
-    } else if (hasEnvInHistory) {
-      evidence.push({
-        kind: "secret_scan",
-        label: ".env path detected in git history",
-        path: ".git",
-        contentHash: readGitHead(repoPath) ?? "env-history-scan"
-      });
-    } else if (migrationFiles[0] != null) {
-      evidence.push(
-        evidenceForRelative(repoPath, migrationFiles[0], "artifact", "Data layer migration")
-      );
-    } else if (dbLayerImportFile != null) {
-      evidence.push(
-        evidenceForRelative(repoPath, dbLayerImportFile, "artifact", "DB client import")
-      );
-    }
+  }
+  if (committedEnvFilePath) {
+    evidence.push(
+      evidenceForRelative(
+        repoPath,
+        committedEnvFilePath,
+        "secret_scan",
+        "Committed .env file in repository tree"
+      )
+    );
+  } else if (hasEnvInHistory) {
+    evidence.push({
+      kind: "secret_scan",
+      label: ".env path detected in git history",
+      path: ".git",
+      contentHash: readGitHead(repoPath) ?? "env-history-scan"
+    });
+  } else if (migrationFiles[0] != null) {
+    evidence.push(
+      evidenceForRelative(repoPath, migrationFiles[0], "artifact", "Data layer migration")
+    );
+  } else if (dbLayerImportFile != null) {
+    evidence.push(evidenceForRelative(repoPath, dbLayerImportFile, "artifact", "DB client import"));
   }
   const rlsMigration = migrationFiles.find((file) => fileContains(repoPath, file, RLS_PATTERN));
   const tenantScopedFile = migrationFiles.find(
@@ -5231,7 +7136,8 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
   const findings = [];
   let hasSurface = false;
   let insecureFound = false;
-  const timingSafeFile = implFiles.find(
+  const productionImplFiles = implFiles.filter(isProductionSourcePath);
+  const timingSafeFile = productionImplFiles.find(
     (file) => fileContains(repoPath, file, TIMING_SAFE_COMPARE_PATTERN)
   );
   if (timingSafeFile) {
@@ -5245,7 +7151,7 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
       )
     );
   }
-  const canonicalSignFile = implFiles.find(
+  const canonicalSignFile = productionImplFiles.find(
     (file) => fileContains(repoPath, file, CANONICAL_SERIALIZE_PATTERN) && fileContains(repoPath, file, SIGN_OR_HMAC_CALL_PATTERN)
   );
   if (canonicalSignFile) {
@@ -5259,20 +7165,31 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
       )
     );
   }
-  const insecureCompareFile = implFiles.find(
-    (file) => fileContains(repoPath, file, INSECURE_SECRET_COMPARE_PATTERN)
-  );
+  let insecureCompareFile = null;
+  let insecureCompareLine = null;
+  for (const file of implFiles) {
+    const line = findInsecureSecretCompareLine(repoPath, file);
+    if (line != null) {
+      insecureCompareFile = file;
+      insecureCompareLine = line;
+      break;
+    }
+  }
   if (insecureCompareFile) {
-    hasSurface = true;
-    insecureFound = true;
+    const isTestPath = isTestOrFixturePath(insecureCompareFile);
+    if (!isTestPath) {
+      hasSurface = true;
+      insecureFound = true;
+    }
     findings.push({
-      severity: "warning",
-      summary: "A secret/HMAC/signature value appears compared with a plain equality operator instead of a constant-time comparison \u2014 potential timing side-channel.",
-      evidence: evidenceForRelative(
+      severity: isTestPath ? "info" : "warning",
+      summary: isTestPath ? `A secret/HMAC/signature comparison via plain equality appears in a test/fixture file (${insecureCompareFile}) \u2014 likely a test assertion, not a production timing leak; verify.` : "A secret/HMAC/signature value appears compared with a plain equality operator instead of a constant-time comparison \u2014 potential timing side-channel.",
+      evidence: evidenceForRelativeAtLine(
         repoPath,
         insecureCompareFile,
         "artifact",
-        "Non-constant-time secret comparison"
+        "Non-constant-time secret comparison",
+        insecureCompareLine
       )
     });
   }
@@ -5280,16 +7197,25 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
     (file) => fileContains(repoPath, file, UNSORTED_JSON_SIGN_PATTERN) && !fileContains(repoPath, file, CANONICAL_SERIALIZE_PATTERN)
   );
   if (unsortedSignFile) {
-    hasSurface = true;
-    insecureFound = true;
+    const isTestPath = isTestOrFixturePath(unsortedSignFile);
+    if (!isTestPath) {
+      hasSurface = true;
+      insecureFound = true;
+    }
+    const unsortedSignLine = findFirstMatchingLine(
+      repoPath,
+      unsortedSignFile,
+      UNSORTED_JSON_SIGN_PATTERN
+    );
     findings.push({
-      severity: "warning",
-      summary: "A signature/HMAC appears computed directly over JSON.stringify output with no canonical key ordering in the same file \u2014 signatures may not verify across equivalent payloads.",
-      evidence: evidenceForRelative(
+      severity: isTestPath ? "info" : "warning",
+      summary: isTestPath ? `Signing over unsorted JSON serialization appears in a test/fixture file (${unsortedSignFile}) \u2014 likely a test assertion, not a production signing gap; verify.` : "A signature/HMAC appears computed directly over JSON.stringify output with no canonical key ordering in the same file \u2014 signatures may not verify across equivalent payloads.",
+      evidence: evidenceForRelativeAtLine(
         repoPath,
         unsortedSignFile,
         "artifact",
-        "Signing over unsorted JSON serialization"
+        "Signing over unsorted JSON serialization",
+        unsortedSignLine
       )
     });
   }
@@ -5305,7 +7231,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles) {
   const evidence = [];
   const findings = [];
   const packageJson = findRootPackageJson(repoFiles);
-  const scripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
+  const scripts = packageJson ? readPackageScripts(join3(repoPath, packageJson)) : /* @__PURE__ */ new Map();
   const workflows = repoFiles.filter(isCiWorkflow);
   const workflow = workflows[0];
   const deployConfigs = repoFiles.filter(isDeployConfig);
@@ -5579,45 +7505,6 @@ function hasDeclaredVersionConstraint(dependency) {
   return /^v?\d/.test(trimmed);
 }
 function collectA5ClaimRealityEvidence(repoPath, repoFiles) {
-  const alfredEvidence = [];
-  if (alfredEvidence.length > 0) {
-    const claimStats = readClaimRealityStats(repoPath);
-    return {
-      criterionId: "A5",
-      positiveEvidence: alfredEvidence,
-      findings: [],
-      metrics: [
-        metric(
-          "claim_match_rate",
-          "Claim match rate",
-          claimStats?.matchRate ?? 0,
-          1,
-          0.6,
-          "ratio",
-          "Measures supported and partially supported claims in the structured reconciliation artifact."
-        ),
-        metric(
-          "claim_registry_depth",
-          "Claim registry depth",
-          claimStats?.claimCount ?? 0,
-          Math.max(claimStats?.claimCount ?? 0, 8),
-          0.25,
-          "claims",
-          "Credits the number of concrete claims reconciled without giving unlimited credit for one artifact."
-        ),
-        metric(
-          "reconciliation_artifact_depth",
-          "Reconciliation artifact depth",
-          alfredEvidence.length,
-          3,
-          0.15,
-          "artifacts",
-          "Credits implementation, Markdown, and structured reconciliation artifacts."
-        )
-      ],
-      notes: "A5 is evidenced by deterministic claim-vs-reality implementation and report artifacts, not a model-opinion verdict."
-    };
-  }
   const claimDoc = repoFiles.find((file) => /(^|\/)(README|readme)\.md$/.test(file)) ?? repoFiles.find((file) => /(^|\/)docs\/.*\.(md|mdx)$/.test(file));
   if (!claimDoc) {
     return buildNotApplicableSignal(
@@ -5778,7 +7665,7 @@ function collectB2PrTraceEvidence(repoPath, repoFiles) {
 function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
   const evidence = [];
   const packageJson = findRootPackageJson(repoFiles);
-  const scripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
+  const scripts = packageJson ? readPackageScripts(join3(repoPath, packageJson)) : /* @__PURE__ */ new Map();
   const workflows = repoFiles.filter(isCiWorkflow);
   const workflow = workflows[0];
   const rootWorkflows = mono ? mono.sharedFiles.filter(isCiWorkflow) : [];
@@ -6044,11 +7931,20 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles) {
 var CPP_TEST_FRAMEWORK_PATTERN = /<gtest\/gtest\.h>|<catch2\/|<doctest\/|<boost\/test\/|"gtest\/gtest\.h"|"catch2\//;
 var CPP_TEST_MACRO_PATTERN = /\bTEST\s*\(|\bTEST_F\s*\(|\bTEST_CASE\s*\(|\bSECTION\s*\(|\bCATCH_|BOOST_AUTO_TEST_CASE\b|BOOST_FIXTURE_TEST_CASE\b/;
 var CPP_CONTENT_SCAN_LIMIT = 150;
-var TEST_OR_FIXTURE_DIR_PATTERN = /(^|\/)(__tests__|__mocks__|__fixtures__|tests|test|fixtures|testdata|e2e|cypress)(\/|$)/i;
-var TEST_OR_FIXTURE_FILE_PATTERN = /\.(test|spec|stories)\.[^/]+$/i;
+var NON_PRODUCTION_DIR_PATTERN = /(^|\/)(__tests__|__mocks__|__fixtures__|tests?|fixtures?|testdata|e2e|cypress|examples?|samples?|demos?)(\/|$)/i;
+var NON_PRODUCTION_FILE_SUFFIX_PATTERN = /\.(test|spec|stories)\.[^/]+$/i;
 function isTestOrFixturePath(path) {
-  return TEST_OR_FIXTURE_DIR_PATTERN.test(path) || TEST_OR_FIXTURE_FILE_PATTERN.test(path);
+  return NON_PRODUCTION_DIR_PATTERN.test(path) || NON_PRODUCTION_FILE_SUFFIX_PATTERN.test(path);
+}
+function isProductionSourcePath(path) {
+  return !isTestOrFixturePath(path);
+}
+function isTestFile(file) {
+  return /(^|\/)(__tests__|test|tests|spec)\/.*\.(?:[cm]?[jt]sx?|py|go|rs|java|rb|cpp|cc|cxx)$/.test(
+    file
+  ) || /\.(test|spec)\.[cm]?[jt]sx?$/.test(file) || /(^|\/)test_.*\.py$/.test(file) || /_test\.go$/.test(file) || /(^|\/)test_.*\.(cpp|cc|cxx)$/.test(file) || /_(test|tests)\.(cpp|cc|cxx)$/.test(file) || /Tests?\.(java|kt)$/.test(file) || /(_test|_spec)\.(rs|rb|php|swift|kt)$/.test(file);
 }
+var NAME_SHAPED_TEST_FILE_PATTERN = /\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)__tests__\/|(^|\/)test_[^/]*\.py$|(^|\/)tests?\.py$|_test\.go$|(^|\/)test_[^/]*\.(cpp|cc|cxx)$|_(test|tests)\.(cpp|cc|cxx)$|Tests?\.(java|kt)$|(_test|_spec)\.(rs|rb|php|swift|kt)$/;
 var TEST_RUNNER_PATTERN = /\b(vitest|jest|mocha|ava|tap|pytest|go test|cargo test|rspec|phpunit|gradle test|mvn test)\b/i;
 var CI_TEST_COMMAND_PATTERN = /\b(pytest|go\s+test|cargo\s+test|mvn\s+test|gradle\s+test|ctest|make\s+test|jest|vitest|mocha|rspec|phpunit|pnpm\s+test|npm\s+test|yarn\s+test|node\s+--test|node:test)\b/i;
 var CI_LINT_COMMAND_PATTERN = /\b(eslint|pylint|flake8|black|ruff)\b/i;
@@ -6081,7 +7977,28 @@ var HEAVY_TEST_DEPENDENCY_NAME_PATTERN = /^(?:jest|mocha|ava|tape|jasmine|karma)
 var TIMING_SAFE_COMPARE_PATTERN = /\btiming[-_]?safe[-_]?(?:equal|compare)\b|crypto\.timingSafeEqual\s*\(/i;
 var CANONICAL_SERIALIZE_PATTERN = /\bcanonicalize\s*\(|\bcanonicalJson\b|\bstableStringify\s*\(|json-stable-stringify|safe-stable-stringify|\bsortKeys\s*\(/i;
 var SIGN_OR_HMAC_CALL_PATTERN = /\bcreateHmac\s*\(|\bcreateSign\s*\(|\.sign\s*\(/;
-var INSECURE_SECRET_COMPARE_PATTERN = /\b\w*(?:hmac|signature|\bmac|digest)\w*\s*(?:===|!==)\s*(?!['"`]|undefined\b|null\b)\w/i;
+var INSECURE_SECRET_COMPARE_LINE_PATTERN = /\b\w*(?:hmac|signature|\bmac|digest)\w*\s*(===|!==)\s*(?!['"`]|undefined\b|null\b)([\w.]+(?:\s*[-+]\s*\d+)?)/i;
+var NUMERIC_SHAPED_OPERAND_PATTERN = /^-?\d+$|\.(?:length|len|size|count)\b|(?:length|index|idx|offset|count|size|len)$/i;
+function lineHasInsecureSecretCompare(line) {
+  const match = INSECURE_SECRET_COMPARE_LINE_PATTERN.exec(line);
+  const operand = match?.[2];
+  if (!operand) return false;
+  return !NUMERIC_SHAPED_OPERAND_PATTERN.test(operand.trim());
+}
+function findInsecureSecretCompareLine(repoPath, file) {
+  const fullPath = join3(repoPath, file);
+  if (!isRegularFile(fullPath)) return null;
+  const lines = readFileSync6(fullPath, "utf8").split("\n");
+  const index = lines.findIndex((line) => lineHasInsecureSecretCompare(line));
+  return index === -1 ? null : index + 1;
+}
+function findFirstMatchingLine(repoPath, file, pattern) {
+  const fullPath = join3(repoPath, file);
+  if (!isRegularFile(fullPath)) return null;
+  const lines = readFileSync6(fullPath, "utf8").split("\n");
+  const index = lines.findIndex((line) => pattern.test(line));
+  return index === -1 ? null : index + 1;
+}
 var UNSORTED_JSON_SIGN_PATTERN = /\.update\s*\(\s*JSON\.stringify\s*\(|\.sign\s*\([^)]*JSON\.stringify\s*\(/;
 var KILL_SWITCH_NAME_FRAGMENT = "kill[_-]?switch|emergency[_-]?stop|circuit[_-]?breaker|safety[_-]?(?:toggle|gate|switch)|governance[_-]?(?:toggle|gate)";
 var KILL_SWITCH_NAME_PATTERN = new RegExp(`\\b(?:${KILL_SWITCH_NAME_FRAGMENT})\\b`, "i");
@@ -6193,13 +8110,13 @@ function listGitTrackedFiles(repoPath) {
 function visitRepoDir(repoPath, dirPath, files) {
   let entries;
   try {
-    entries = readdirSync(dirPath, { withFileTypes: true });
+    entries = readdirSync3(dirPath, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
     if (shouldSkipDir(entry.name)) continue;
-    const fullPath = join(dirPath, entry.name);
+    const fullPath = join3(dirPath, entry.name);
     if (entry.isDirectory()) {
       visitRepoDir(repoPath, fullPath, files);
       continue;
@@ -6207,7 +8124,7 @@ function visitRepoDir(repoPath, dirPath, files) {
     if (!entry.isFile()) continue;
     let size;
     try {
-      size = statSync(fullPath).size;
+      size = statSync2(fullPath).size;
     } catch {
       continue;
     }
@@ -6235,17 +8152,12 @@ function shouldSkipDir(name) {
 function isHardExcludedPath(path) {
   return HARD_EXCLUDED_PATH_PATTERN.test(path);
 }
-function isTestFile(file) {
-  return /(^|\/)(__tests__|test|tests|spec)\/.*\.(?:[cm]?[jt]sx?|py|go|rs|java|rb|cpp|cc|cxx)$/.test(
-    file
-  ) || /\.(test|spec)\.[cm]?[jt]sx?$/.test(file) || /(^|\/)test_.*\.py$/.test(file) || /_test\.go$/.test(file) || /(^|\/)test_.*\.(cpp|cc|cxx)$/.test(file) || /_(test|tests)\.(cpp|cc|cxx)$/.test(file) || /Tests?\.(java|kt)$/.test(file) || /(_test|_spec)\.(rs|rb|php|swift|kt)$/.test(file);
-}
 function collectContentBasedCppTestFiles(repoPath, repoFiles) {
   const candidates = repoFiles.filter((file) => /\.(cpp|cc|cxx)$/.test(file) && !isTestFile(file)).slice(0, CPP_CONTENT_SCAN_LIMIT);
   return candidates.filter((file) => {
-    const fullPath = join(repoPath, file);
+    const fullPath = join3(repoPath, file);
     if (!isRegularFile(fullPath)) return false;
-    const contents = readFileSync(fullPath, "utf8");
+    const contents = readFileSync6(fullPath, "utf8");
     return CPP_TEST_FRAMEWORK_PATTERN.test(contents) || CPP_TEST_MACRO_PATTERN.test(contents);
   });
 }
@@ -6259,14 +8171,13 @@ var JS_TEST_ASSERTION_PATTERN = /(expect\(|assert\.|should\.|toEqual\(|toBe\(|as
 var CPP_TEST_ASSERTION_PATTERN = /\bEXPECT_|ASSERT_EQ\b|ASSERT_TRUE\b|ASSERT_FALSE\b|\bREQUIRE\s*\(|\bCHECK\s*\(|\bTEST\s*\(|\bTEST_F\s*\(|\bTEST_CASE\s*\(|\bSECTION\s*\(/;
 var MULTI_ECOSYSTEM_TEST_ASSERTION_PATTERN = /\.assert[A-Z_]\w*\s*\(|\bassert[A-Z]\w*\s*\(|\bpytest\.raises\b|\bself\.fail\s*\(|\bt\.(?:Error|Errorf|Fatal|Fatalf|Fail|FailNow)\b|\brequire\.[A-Z]\w*\s*\(|\b(?:debug_)?assert(?:_eq|_ne)?!\s*\(|\bassert_\w+\b|\$this->assert\w+\s*\(/;
 var SUITE_LEVEL_SKIP_PATTERN = /\b(?:describe|suite|context)\.skip\s*\(/;
-var NAME_SHAPED_TEST_FILE_PATTERN = /\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)__tests__\/|(^|\/)test_[^/]*\.py$|(^|\/)tests?\.py$|_test\.go$|(^|\/)test_[^/]*\.(cpp|cc|cxx)$|_(test|tests)\.(cpp|cc|cxx)$|Tests?\.(java|kt)$|(_test|_spec)\.(rs|rb|php|swift|kt)$/;
 function measureNonHollowTestShare(repoPath, files) {
   let nonHollowCount = 0;
   let ratedCount = 0;
   for (const file of files) {
-    const fullPath = join(repoPath, file);
+    const fullPath = join3(repoPath, file);
     if (!isRegularFile(fullPath)) continue;
-    const contents = readFileSync(fullPath, "utf8");
+    const contents = readFileSync6(fullPath, "utf8");
     const nonHollow = (JS_TEST_ASSERTION_PATTERN.test(contents) || CPP_TEST_ASSERTION_PATTERN.test(contents) || MULTI_ECOSYSTEM_TEST_ASSERTION_PATTERN.test(contents)) && !SUITE_LEVEL_SKIP_PATTERN.test(contents);
     if (nonHollow) {
       nonHollowCount += 1;
@@ -6285,17 +8196,17 @@ function countPatternMatches(repoPath, files, pattern) {
   const matcher = new RegExp(pattern.source, flags);
   let count = 0;
   for (const file of files) {
-    const fullPath = join(repoPath, file);
+    const fullPath = join3(repoPath, file);
     if (!isRegularFile(fullPath)) continue;
-    count += [...readFileSync(fullPath, "utf8").matchAll(matcher)].length;
+    count += [...readFileSync6(fullPath, "utf8").matchAll(matcher)].length;
   }
   return count;
 }
 function readCoveragePercent(repoPath, files) {
   for (const file of files) {
-    const fullPath = join(repoPath, file);
+    const fullPath = join3(repoPath, file);
     if (!isRegularFile(fullPath)) continue;
-    const contents = readFileSync(fullPath, "utf8");
+    const contents = readFileSync6(fullPath, "utf8");
     const summaryPercent = parseCoverageSummaryPercent(contents);
     if (summaryPercent !== null) return summaryPercent;
     const thresholdPercent = parseCoverageThresholdPercent(contents);
@@ -6339,7 +8250,7 @@ function pickPrimaryDependencyManifest(repoPath, manifests) {
 function readDependencySpecs(repoPath, manifests) {
   const specs = [];
   for (const manifest of manifests) {
-    const fullPath = join(repoPath, manifest);
+    const fullPath = join3(repoPath, manifest);
     if (!isRegularFile(fullPath)) continue;
     if (manifest.endsWith("package.json")) {
       specs.push(...readPackageJsonDependencySpecs(fullPath));
@@ -6385,7 +8296,7 @@ function readDependencySpecs(repoPath, manifests) {
 }
 function readGoModDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync(path, "utf8");
+  const contents = readFileSync6(path, "utf8");
   const blockPattern = /require\s*\(([^)]+)\)/gs;
   const singlePattern = /^require\s+(\S+)\s+(\S+)/gm;
   for (const blockMatch of contents.matchAll(blockPattern)) {
@@ -6406,7 +8317,7 @@ function readGoModDependencySpecs(path) {
 }
 function readCargoTomlDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync(path, "utf8");
+  const contents = readFileSync6(path, "utf8");
   const depSectionPattern = /^\[(?:dependencies|dev-dependencies|build-dependencies)\]([\s\S]*?)(?=^\[|(?![\s\S]))/gm;
   for (const sectionMatch of contents.matchAll(depSectionPattern)) {
     const section = sectionMatch[1] ?? "";
@@ -6428,7 +8339,7 @@ function readCargoTomlDependencySpecs(path) {
 }
 function readPyprojectDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync(path, "utf8");
+  const contents = readFileSync6(path, "utf8");
   const poetrySectionPattern = /^\[tool\.poetry\.dependencies\]([\s\S]*?)(?=^\[|(?![\s\S]))/gm;
   for (const sectionMatch of contents.matchAll(poetrySectionPattern)) {
     const section = sectionMatch[1] ?? "";
@@ -6462,7 +8373,7 @@ function readPyprojectDependencySpecs(path) {
 }
 function readPipfileDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync(path, "utf8");
+  const contents = readFileSync6(path, "utf8");
   const sectionPattern = /^\[(?:packages|dev-packages)\]([\s\S]*?)(?=^\[|$(?![\s\S]))/gm;
   for (const sectionMatch of contents.matchAll(sectionPattern)) {
     for (const line of (sectionMatch[1] ?? "").split("\n")) {
@@ -6475,7 +8386,7 @@ function readPipfileDependencySpecs(path) {
   return specs;
 }
 function readVcpkgJsonDependencySpecs(path) {
-  const parsed = parseJsonObject(readFileSync(path, "utf8"));
+  const parsed = parseJsonObject(readFileSync6(path, "utf8"));
   if (!parsed) return [];
   const rawDeps = Array.isArray(parsed.dependencies) ? parsed.dependencies : [];
   const specs = [];
@@ -6491,7 +8402,7 @@ function readVcpkgJsonDependencySpecs(path) {
 }
 function readConanfileTxtDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync(path, "utf8");
+  const contents = readFileSync6(path, "utf8");
   const requiresMatch = /^\[requires\]([\s\S]*?)(?=^\[|$(?![\s\S]))/m.exec(contents);
   if (!requiresMatch) return specs;
   for (const line of (requiresMatch[1] ?? "").split("\n")) {
@@ -6504,7 +8415,7 @@ function readConanfileTxtDependencySpecs(path) {
 }
 function readConanfilePyDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync(path, "utf8");
+  const contents = readFileSync6(path, "utf8");
   for (const match of contents.matchAll(/self\.requires\s*\(\s*["']([\w.\-]+)\/([\w.\-]+)["']/g)) {
     specs.push({ name: match[1] ?? "", version: match[2] ?? "" });
   }
@@ -6518,7 +8429,7 @@ function readConanfilePyDependencySpecs(path) {
 }
 function readCMakeDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync(path, "utf8");
+  const contents = readFileSync6(path, "utf8");
   for (const match of contents.matchAll(/find_package\s*\(\s*([\w]+)(?:\s+([\d.]+))?/gi)) {
     const name = match[1];
     if (!name) continue;
@@ -6533,7 +8444,7 @@ function readCMakeDependencySpecs(path) {
   return specs;
 }
 function readPackageJsonDependencySpecs(packageJsonPath) {
-  const parsed = parseJsonObject(readFileSync(packageJsonPath, "utf8"));
+  const parsed = parseJsonObject(readFileSync6(packageJsonPath, "utf8"));
   if (!parsed) return [];
   const optionalPeerNames = /* @__PURE__ */ new Set();
   const peerDependenciesMeta = parsed.peerDependenciesMeta;
@@ -6560,7 +8471,7 @@ function readPackageJsonDependencySpecs(packageJsonPath) {
   return specs;
 }
 function readRequirementsDependencySpecs(path) {
-  return readFileSync(path, "utf8").split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).map((line) => {
+  return readFileSync6(path, "utf8").split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).map((line) => {
     const [name = line, version = ""] = line.split(/[<>=~!]=?/, 2);
     return { name: name.trim(), version: line.includes("==") ? version.trim() : line };
   });
@@ -6575,33 +8486,10 @@ function isPinnedDependencyVersion(version) {
   if (trimmed === "find") return false;
   return /^\d+\.\d+(?:\.\d+)?(?:[-+][0-9A-Za-z.-]+)?$/.test(trimmed);
 }
-function readClaimRealityStats(repoPath) {
-  const path = join(repoPath, "docs/witan/claim_reality_reconciliation.json");
-  if (!isRegularFile(path)) return null;
-  const parsed = parseJsonObject(readFileSync(path, "utf8"));
-  const claims = Array.isArray(parsed?.claims) ? parsed.claims : [];
-  if (claims.length === 0) return null;
-  const totalScore = claims.reduce((sum, claim) => {
-    if (!isRecord(claim) || typeof claim.status !== "string") return sum;
-    return sum + scoreClaimRealityStatus(claim.status);
-  }, 0);
-  return {
-    claimCount: claims.length,
-    matchRate: Math.round(totalScore / claims.length * 1e3) / 1e3
-  };
-}
-function scoreClaimRealityStatus(status) {
-  const normalized = status.toLowerCase();
-  if (/supported|verified|matched|true/.test(normalized) && !/unsupported/.test(normalized)) {
-    return 1;
-  }
-  if (/partial|mixed|needs[-_ ]?evidence/.test(normalized)) return 0.5;
-  return 0;
-}
 function workflowTargetsDefaultBranch(repoPath, file) {
-  const fullPath = join(repoPath, file);
+  const fullPath = join3(repoPath, file);
   if (!isRegularFile(fullPath)) return false;
-  const contents = readFileSync(fullPath, "utf8").toLowerCase();
+  const contents = readFileSync6(fullPath, "utf8").toLowerCase();
   return /\bpull_request\b/.test(contents) || /\bbranches:\s*\[[^\]]*\b(main|master)\b[^\]]*\]/.test(contents) || /\bbranches:\s*\n\s*-\s*(main|master)\b/.test(contents);
 }
 function isPrMergeCommit(commit) {
@@ -6637,7 +8525,6 @@ function isExplicitDeployTarget(file) {
   return /^(vercel|netlify|fly|render|railway)\.(json|toml|ya?ml)$/.test(file) || /^docker-compose\.ya?ml$/.test(file) || /^Procfile$/.test(file) || /^app\.ya?ml$/.test(file) || /^serverless\.ya?ml$/.test(file) || /^(k8s|kubernetes|manifests?)\/.+\.ya?ml$/i.test(file) || /^(charts?|helm)\/.+\.ya?ml$/i.test(file);
 }
 var MAIN_ENTRYPOINT_FILE_PATTERN = /(^|\/)(main|server|app|wsgi|asgi|index|entry|start|run)\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs)$/i;
-var EXAMPLE_OR_TEST_DIR_PATTERN = /(?:^|\/)(examples?|samples?|demos?|tests?|__tests__|spec|fixtures?)(?:\/|$)/i;
 var SERVER_ENTRYPOINT_PATTERN = /\bapp\.listen\s*\(|\bserver\.listen\s*\(\s*(?:PORT|port|\d+)|http\.ListenAndServe\s*\(|http\.ListenAndServeTLS\s*\(|axum::Server(?:::|\.)|actix_web::HttpServer(?:::|\.)|uvicorn\.run\s*\(/;
 var CI_DEPLOY_JOB_PATTERN = /(?:^\s{2,4}deploy\s*:|\b(?:fly|heroku|vercel|netlify|railway|render)\s+deploy\b|kubectl\s+apply\b|helm\s+(?:install|upgrade|deploy)\b|docker\s+push\b)/im;
 function isDeployableService(repoPath, repoFiles) {
@@ -6654,9 +8541,7 @@ function detectServerEntrypoint(repoPath, repoFiles) {
   return findServerEntrypointFile(repoPath, repoFiles) !== null;
 }
 function findServerEntrypointFile(repoPath, repoFiles) {
-  const candidates = repoFiles.filter(
-    (file) => MAIN_ENTRYPOINT_FILE_PATTERN.test(file) && !EXAMPLE_OR_TEST_DIR_PATTERN.test(file)
-  ).slice(0, 30);
+  const candidates = repoFiles.filter((file) => MAIN_ENTRYPOINT_FILE_PATTERN.test(file) && isProductionSourcePath(file)).slice(0, 30);
   return candidates.find((file) => fileContains(repoPath, file, SERVER_ENTRYPOINT_PATTERN)) ?? null;
 }
 function isHealthCheckSignalFile(repoPath, file) {
@@ -6688,15 +8573,15 @@ function isDependencyUpdateConfig(file) {
 }
 function packageJsonHasAuditScript(repoPath, manifest) {
   if (!manifest.endsWith("package.json")) return false;
-  const scripts = readPackageScripts(join(repoPath, manifest));
+  const scripts = readPackageScripts(join3(repoPath, manifest));
   return [...scripts.values()].some(
     (script) => /\b(audit|npm audit|pnpm audit|yarn audit)\b/i.test(script)
   );
 }
 function packageJsonHasHeavyTestDependency(repoPath, manifest) {
-  const fullPath = join(repoPath, manifest);
+  const fullPath = join3(repoPath, manifest);
   if (!isRegularFile(fullPath)) return false;
-  const parsed = parseJsonObject(readFileSync(fullPath, "utf8"));
+  const parsed = parseJsonObject(readFileSync6(fullPath, "utf8"));
   if (!parsed) return false;
   const names = [
     ...Object.keys(isRecord(parsed.dependencies) ? parsed.dependencies : {}),
@@ -6735,20 +8620,20 @@ function findRootPackageJson(repoFiles) {
 }
 function isRegularFile(path) {
   try {
-    return statSync(path).isFile();
+    return statSync2(path).isFile();
   } catch {
     return false;
   }
 }
 function fileContains(repoPath, file, pattern) {
-  const fullPath = join(repoPath, file);
+  const fullPath = join3(repoPath, file);
   if (!isRegularFile(fullPath)) return false;
-  return pattern.test(readFileSync(fullPath, "utf8"));
+  return pattern.test(readFileSync6(fullPath, "utf8"));
 }
 function fileContainsCommittedSecret(repoPath, file) {
-  const fullPath = join(repoPath, file);
+  const fullPath = join3(repoPath, file);
   if (!isRegularFile(fullPath)) return false;
-  return containsRealSecret(readFileSync(fullPath, "utf8"));
+  return containsRealSecret(readFileSync6(fullPath, "utf8"));
 }
 function containsRealSecret(contents) {
   SECRET_ASSIGNMENT_PATTERN.lastIndex = 0;
@@ -6802,1015 +8687,749 @@ function readCredentialHistoryEntries(repoPath) {
     const key = `${entry.commit}:${entry.path}`;
     if (seen.has(key)) return;
     seen.add(key);
-    entries.push(entry);
-  };
-  try {
-    const commits = execFileSync("git", ["rev-list", "--all"], {
-      cwd: repoPath,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-    const output = execFileSync(
-      "git",
-      [
-        "diff-tree",
-        "--stdin",
-        "--root",
-        "--name-only",
-        "-r",
-        "--diff-filter=AM",
-        "--pretty=format:commit:%H"
-      ],
-      {
-        cwd: repoPath,
-        encoding: "utf8",
-        input: commits,
-        stdio: ["pipe", "pipe", "ignore"]
-      }
-    );
-    let currentCommit = null;
-    for (const line of output.split("\n")) {
-      if (line.startsWith("commit:")) {
-        currentCommit = line.slice("commit:".length);
-        continue;
-      }
-      const path = line.trim();
-      if (!currentCommit || !path) continue;
-      if (!isCredentialHistoryPath(path)) continue;
-      appendEntry({ commit: currentCommit, path });
-    }
-  } catch {
-  }
-  for (const entry of readDeletedCredentialHistoryEntries(repoPath)) {
-    appendEntry(entry);
-  }
-  return entries;
-}
-function readDeletedCredentialHistoryEntries(repoPath) {
-  const deletedPaths = readDeletedCredentialHistoryPaths(repoPath);
-  const entries = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const path of deletedPaths) {
-    for (const commit of readHistoryCommitsForPath(repoPath, path)) {
-      const key = `${commit}:${path}`;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      entries.push({ commit, path });
-    }
-  }
-  return entries;
-}
-function readDeletedCredentialHistoryPaths(repoPath) {
-  try {
-    const output = execFileSync(
-      "git",
-      ["log", "--all", "--diff-filter=D", "--name-status", "--format=commit:%H"],
-      {
-        cwd: repoPath,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"]
-      }
-    );
-    const paths = [];
-    const seen = /* @__PURE__ */ new Set();
-    for (const line of output.split("\n")) {
-      if (!line.startsWith("D	")) continue;
-      const path = line.slice(2).trim();
-      if (!path || seen.has(path)) continue;
-      if (!isCredentialHistoryPath(path)) continue;
-      seen.add(path);
-      paths.push(path);
-    }
-    return paths;
-  } catch {
-    return [];
-  }
-}
-function readHistoryCommitsForPath(repoPath, path) {
-  try {
-    const output = execFileSync(
-      "git",
-      ["log", "--all", "--diff-filter=AM", "--format=%H", "--", path],
-      {
-        cwd: repoPath,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"]
-      }
-    );
-    return output.split("\n").map((line) => line.trim()).filter((line) => /^[0-9a-f]{40}$/i.test(line));
-  } catch {
-    return [];
-  }
-}
-function isCredentialHistoryPath(path) {
-  if (isHardExcludedPath(path)) return false;
-  const lowerPath = path.toLowerCase();
-  const basename3 = lowerPath.split("/").at(-1) ?? lowerPath;
-  if (/\.env(?:\.|$)/.test(basename3)) {
-    return true;
-  }
-  return lowerPath.includes("secret") || lowerPath.includes("credential") || basename3.endsWith(".pem") || basename3.endsWith(".key") || basename3 === "id_rsa" || basename3.endsWith(".p12") || basename3.endsWith(".pfx");
-}
-function isEnvHistoryPath(path) {
-  if (isEnvTemplatePath(path)) return false;
-  const basename3 = path.toLowerCase().split("/").at(-1) ?? path.toLowerCase();
-  return /\.env(?:\.|$)/.test(basename3);
-}
-function readGitBlob(repoPath, commit, path) {
-  try {
-    return execFileSync("git", ["show", `${commit}:${path}`], {
-      cwd: repoPath,
-      encoding: "utf8",
-      maxBuffer: 512e3,
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-  } catch {
-    return null;
-  }
-}
-var ALL_CAPS_SNAKE_PLACEHOLDER_PATTERN = /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/;
-function isPlaceholderSecretValue(value) {
-  const normalized = value.trim().toLowerCase();
-  return PLACEHOLDER_SECRET_PATTERN.test(normalized) || normalized.includes("your-") || normalized.includes("example") || ALL_CAPS_SNAKE_PLACEHOLDER_PATTERN.test(value.trim()) || isSyntheticFixtureSecretValue(normalized) || isFillerRunSecretValue(normalized);
-}
-function isFillerRunSecretValue(value) {
-  const candidates = [value];
-  const sepIdx = Math.max(value.lastIndexOf("_"), value.lastIndexOf("-"));
-  if (sepIdx > 0 && sepIdx < value.length - 1) {
-    candidates.push(value.slice(sepIdx + 1));
-  }
-  for (const body of candidates) {
-    if (body.length < 8) continue;
-    const counts = /* @__PURE__ */ new Map();
-    for (const ch of body) counts.set(ch, (counts.get(ch) ?? 0) + 1);
-    const distinct = counts.size;
-    const maxRun = Math.max(...counts.values());
-    if (distinct <= 2 && maxRun / body.length >= 0.8) return true;
-  }
-  return false;
-}
-function isSyntheticFixtureSecretValue(value) {
-  return value.includes("abcdefghijklmnopqrstuvwxyz") || value.includes("0123456789abcdefghijklmnopqrstuvwxyz") || value.includes("abcdefghijklmnopqrstuvwxyz0123456789") || value.includes("abcdefghijklmnopqrst");
-}
-function hasSuspiciousDependencies(repoPath, manifest) {
-  if (!manifest.endsWith("package.json")) return false;
-  const fullPath = join(repoPath, manifest);
-  if (!isRegularFile(fullPath)) return false;
-  const parsed = parseJsonObject(readFileSync(fullPath, "utf8"));
-  if (!parsed) return false;
-  const dependencies = isRecord(parsed.dependencies) ? parsed.dependencies : {};
-  const devDependencies = isRecord(parsed.devDependencies) ? parsed.devDependencies : {};
-  const names = [...Object.keys(dependencies), ...Object.keys(devDependencies)];
-  return names.some(
-    (name) => /^(todo|fake|placeholder|example)-|does-not-exist| hallucinated/i.test(name)
-  );
-}
-function readRecentCommits(repoPath) {
-  try {
-    const output = execFileSync("git", ["log", "--max-count=12", "--format=%H%x00%s"], {
-      cwd: repoPath,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-    if (!output) return [];
-    return output.split("\n").map((line) => {
-      const [sha = "", subject = ""] = line.split("\0");
-      return { sha, subject };
-    }).filter((commit) => commit.sha.length >= 7);
-  } catch {
-    return [];
-  }
-}
-function readPackageScripts(packageJsonPath) {
-  if (!isRegularFile(packageJsonPath)) return /* @__PURE__ */ new Map();
-  const parsed = parseJsonObject(readFileSync(packageJsonPath, "utf8"));
-  const scripts = parsed?.scripts;
-  if (!isRecord(scripts)) return /* @__PURE__ */ new Map();
-  return new Map(
-    Object.entries(scripts).filter(
-      (entry) => typeof entry[1] === "string"
-    )
-  );
-}
-function evidenceForRelative(repoPath, path, kind, label) {
-  const fullPath = join(repoPath, path);
-  const contents = isRegularFile(fullPath) ? readFileSync(fullPath, "utf8") : "";
-  return {
-    kind,
-    label,
-    path,
-    ...contents ? {
-      line: firstMeaningfulLine(contents),
-      contentHash: createHash("sha256").update(contents).digest("hex")
-    } : {}
-  };
-}
-function metric(name, label, value, max, weight, unit, description, kind) {
-  return {
-    name,
-    label,
-    value: Math.max(0, value),
-    max,
-    ...kind ? { kind } : {},
-    weight,
-    unit,
-    description
-  };
-}
-function firstMeaningfulLine(contents) {
-  const lines = contents.split("\n");
-  const index = lines.findIndex((line) => line.trim().length > 0);
-  return index === -1 ? 1 : index + 1;
-}
-function readGitHead(repoPath) {
+    entries.push(entry);
+  };
   try {
-    return execFileSync("git", ["rev-parse", "HEAD"], {
+    const commits = execFileSync("git", ["rev-list", "--all"], {
       cwd: repoPath,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-  } catch {
-    return null;
-  }
-}
-function hasEnvPathInGitHistory(repoPath) {
-  try {
+    });
     const output = execFileSync(
       "git",
-      ["log", "--all", "--diff-filter=AM", "--name-only", "--format="],
+      [
+        "diff-tree",
+        "--stdin",
+        "--root",
+        "--name-only",
+        "-r",
+        "--diff-filter=AM",
+        "--pretty=format:commit:%H"
+      ],
       {
         cwd: repoPath,
         encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-        maxBuffer: 512e3
+        input: commits,
+        stdio: ["pipe", "pipe", "ignore"]
       }
-    ).trim();
-    if (!output) return false;
-    return output.split("\n").some((p) => /(?:^|\/)\.env(?:\.|$)/i.test(p.trim()));
+    );
+    let currentCommit = null;
+    for (const line of output.split("\n")) {
+      if (line.startsWith("commit:")) {
+        currentCommit = line.slice("commit:".length);
+        continue;
+      }
+      const path = line.trim();
+      if (!currentCommit || !path) continue;
+      if (!isCredentialHistoryPath(path)) continue;
+      appendEntry({ commit: currentCommit, path });
+    }
   } catch {
-    return false;
   }
-}
-
-// src/witan/rubric.ts
-var WITAN_RUBRIC = [
-  {
-    id: "A1",
-    title: "Test integrity and regression signal",
-    category: "code_trust"
-  },
-  {
-    id: "A2",
-    title: "Data-layer isolation and secrets posture",
-    category: "code_trust"
-  },
-  {
-    id: "A3",
-    title: "Production readiness",
-    category: "code_trust"
-  },
-  {
-    id: "A4",
-    title: "Dependency hygiene",
-    category: "code_trust"
-  },
-  {
-    id: "A5",
-    title: "Claim-vs-reality reconciliation",
-    category: "code_trust"
-  },
-  {
-    id: "B1",
-    title: "Dispatch trace completeness",
-    category: "process_trust"
-  },
-  {
-    id: "B2",
-    title: "PR outcome traceability",
-    category: "process_trust"
-  },
-  {
-    id: "B3",
-    title: "CI and QA discipline",
-    category: "process_trust"
-  },
-  {
-    id: "B4",
-    title: "Audit trail and report-up completeness",
-    category: "process_trust"
-  },
-  {
-    id: "B5",
-    title: "Verified learning trace",
-    category: "process_trust"
-  },
-  {
-    id: "B6",
-    title: "Privileged-operation human gating",
-    category: "process_trust"
+  for (const entry of readDeletedCredentialHistoryEntries(repoPath)) {
+    appendEntry(entry);
   }
-];
-
-// src/witan/scoring.ts
-var MAX_SIGNAL_ADJUSTMENT = 0.8;
-function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
-  const parsedInput = WitanReportInputSchema.parse(input);
-  const signalsByCriterion = mergeSignalsByCriterion(parsedInput.signals);
-  const hasInputSignals = inputSignals != null && inputSignals.length > 0;
-  const inputSignalsByDimension = /* @__PURE__ */ new Map();
-  if (hasInputSignals && inputSignals) {
-    for (const signal of inputSignals) {
-      const bucket = inputSignalsByDimension.get(signal.dimension) ?? [];
-      bucket.push(signal);
-      inputSignalsByDimension.set(signal.dimension, bucket);
+  return entries;
+}
+function readDeletedCredentialHistoryEntries(repoPath) {
+  const deletedPaths = readDeletedCredentialHistoryPaths(repoPath);
+  const entries = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const path of deletedPaths) {
+    for (const commit of readHistoryCommitsForPath(repoPath, path)) {
+      const key = `${commit}:${path}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      entries.push({ commit, path });
     }
   }
-  const consumedSignals = [];
-  const criteria = rubric.map((rubricCriterion) => {
-    const id = rubricCriterion.id;
-    const signal = signalsByCriterion.get(id);
-    const scored = scoreCriterion(signal, parsedInput.rubricVersion);
-    const dimensionSignals = inputSignalsByDimension.get(id);
-    if (!dimensionSignals || dimensionSignals.length === 0) {
-      return {
-        id,
-        title: rubricCriterion.title,
-        category: rubricCriterion.category,
-        score: scored.score,
-        status: scored.status,
-        evidence: scored.evidence,
-        findings: scored.findings,
-        metrics: scored.metrics,
-        ...signal?.notes ? { notes: signal.notes } : {}
-      };
-    }
-    const { adjustedScore, adjustment, summaries } = applySignalAdjustment(
-      scored.score,
-      id,
-      dimensionSignals
+  return entries;
+}
+function readDeletedCredentialHistoryPaths(repoPath) {
+  try {
+    const output = execFileSync(
+      "git",
+      ["log", "--all", "--diff-filter=D", "--name-status", "--format=commit:%H"],
+      {
+        cwd: repoPath,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"]
+      }
     );
-    consumedSignals.push(...summaries);
-    const finalScore = adjustment === 0 ? scored.score : adjustedScore;
-    const finalStatus = adjustment === 0 ? scored.status : statusForScore(finalScore);
-    return {
-      id,
-      title: rubricCriterion.title,
-      category: rubricCriterion.category,
-      score: finalScore,
-      ...adjustment !== 0 ? { nativeScore: scored.score } : {},
-      status: finalStatus,
-      evidence: scored.evidence,
-      findings: scored.findings,
-      metrics: scored.metrics,
-      ...signal?.notes ? { notes: signal.notes } : {}
-    };
-  });
-  const categoryOrder = [];
-  for (const rubricCriterion of rubric) {
-    if (!categoryOrder.includes(rubricCriterion.category)) {
-      categoryOrder.push(rubricCriterion.category);
+    const paths = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const line of output.split("\n")) {
+      if (!line.startsWith("D	")) continue;
+      const path = line.slice(2).trim();
+      if (!path || seen.has(path)) continue;
+      if (!isCredentialHistoryPath(path)) continue;
+      seen.add(path);
+      paths.push(path);
     }
+    return paths;
+  } catch {
+    return [];
   }
-  const categoryScoreMap = {};
-  for (const category of categoryOrder) {
-    categoryScoreMap[category] = averageScore(
-      criteria.filter((criterion) => criterion.category === category)
-    );
-  }
-  const firstCategory = categoryOrder[0];
-  const secondCategory = categoryOrder[1] ?? firstCategory;
-  const codeTrustScore = categoryScoreMap.code_trust ?? (firstCategory ? categoryScoreMap[firstCategory] : void 0) ?? 0;
-  const processTrustScore = categoryScoreMap.process_trust ?? (secondCategory ? categoryScoreMap[secondCategory] : void 0) ?? 0;
-  const overallScore = roundScore(
-    categoryOrder.reduce((sum, category) => sum + (categoryScoreMap[category] ?? 0), 0) / Math.max(categoryOrder.length, 1)
-  );
-  return WitanReportSchema.parse({
-    productSlug: parsedInput.productSlug,
-    productDisplayName: parsedInput.productDisplayName,
-    repo: parsedInput.repo,
-    generatedAt: parsedInput.generatedAt,
-    rubricVersion: parsedInput.rubricVersion,
-    codeTrustScore,
-    processTrustScore,
-    overallScore,
-    criteria,
-    ...consumedSignals.length > 0 ? { consumedSignals } : {},
-    // Only surface the full per-category map for rubrics with more than two buckets —
-    // the default two-category rubric is fully represented by codeTrustScore/processTrustScore.
-    ...categoryOrder.length > 2 ? { categoryScores: categoryScoreMap } : {},
-    // Pass through repo-archetype metadata verbatim — createWitanReport does not compute or
-    // alter it (see classifyRepoArchetype in repo-signals.ts); per-criterion scoring above is
-    // unaffected by archetype, only presentation layers (badge/terminal/verdict) key off it.
-    ...parsedInput.archetype ? { archetype: parsedInput.archetype } : {},
-    ...parsedInput.insufficientSourceReason ? { insufficientSourceReason: parsedInput.insufficientSourceReason } : {}
-  });
 }
-function applySignalAdjustment(nativeScore, dimension, signals) {
-  const summaries = [];
-  let totalRawAdj = 0;
-  for (const signal of signals) {
-    const criticalCount = signal.findings.filter((f) => f.severity === "critical").length;
-    const warningCount = signal.findings.filter((f) => f.severity === "warning").length;
-    const infoCount = signal.findings.filter((f) => f.severity === "info").length;
-    const severityScore = Math.min(
-      criticalCount * 0.2 + warningCount * 0.1 + infoCount * 0.02,
-      1
-    );
-    const signalAdj = signal.weight * severityScore * MAX_SIGNAL_ADJUSTMENT;
-    totalRawAdj += signalAdj;
-    summaries.push({
-      source: signal.source,
-      dimension,
-      findingCount: signal.findings.length,
-      severityBreakdown: { critical: criticalCount, warning: warningCount, info: infoCount },
-      nativeScore,
-      scoreAdjustment: -roundScore(Math.min(signalAdj, MAX_SIGNAL_ADJUSTMENT)),
-      adjustedScore: roundScore(
-        Math.max(0, nativeScore - Math.min(signalAdj, MAX_SIGNAL_ADJUSTMENT))
-      ),
-      findings: [...signal.findings]
-    });
+function readHistoryCommitsForPath(repoPath, path) {
+  try {
+    const output = execFileSync(
+      "git",
+      ["log", "--all", "--diff-filter=AM", "--format=%H", "--", path],
+      {
+        cwd: repoPath,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"]
+      }
+    );
+    return output.split("\n").map((line) => line.trim()).filter((line) => /^[0-9a-f]{40}$/i.test(line));
+  } catch {
+    return [];
   }
-  const totalAdj = Math.min(totalRawAdj, MAX_SIGNAL_ADJUSTMENT);
-  const adjustedScore = roundScore(Math.max(0, nativeScore - totalAdj));
-  for (const summary of summaries) {
-    summary.adjustedScore = adjustedScore;
-    summary.scoreAdjustment = -roundScore(totalAdj);
+}
+function isCredentialHistoryPath(path) {
+  if (isHardExcludedPath(path)) return false;
+  const lowerPath = path.toLowerCase();
+  const basename4 = lowerPath.split("/").at(-1) ?? lowerPath;
+  if (/\.env(?:\.|$)/.test(basename4)) {
+    return true;
   }
-  return { adjustedScore, adjustment: roundScore(totalAdj), summaries };
+  return lowerPath.includes("secret") || lowerPath.includes("credential") || basename4.endsWith(".pem") || basename4.endsWith(".key") || basename4 === "id_rsa" || basename4.endsWith(".p12") || basename4.endsWith(".pfx");
 }
-function statusForScore(score) {
-  if (score >= 3.5) return "verified";
-  if (score >= 2.5) return "info";
-  if (score >= 1.5) return "warning";
-  if (score > 0) return "critical";
-  return "critical";
+function isEnvHistoryPath(path) {
+  if (isEnvTemplatePath(path)) return false;
+  const basename4 = path.toLowerCase().split("/").at(-1) ?? path.toLowerCase();
+  return /\.env(?:\.|$)/.test(basename4);
 }
-function mergeSignalsByCriterion(signals) {
-  const merged = /* @__PURE__ */ new Map();
-  for (const signal of signals) {
-    const existing = merged.get(signal.criterionId);
-    if (!existing) {
-      merged.set(signal.criterionId, signal);
-      continue;
-    }
-    merged.set(signal.criterionId, {
-      criterionId: signal.criterionId,
-      positiveEvidence: [...existing.positiveEvidence, ...signal.positiveEvidence],
-      findings: [...existing.findings, ...signal.findings],
-      metrics: [...existing.metrics ?? [], ...signal.metrics ?? []],
-      notes: signal.notes ?? existing.notes,
-      // N/A wins on merge: if either signal is N/A, the criterion is N/A.
-      ...existing.notApplicable === true || signal.notApplicable === true ? { notApplicable: true } : {}
+function readGitBlob(repoPath, commit, path) {
+  try {
+    return execFileSync("git", ["show", `${commit}:${path}`], {
+      cwd: repoPath,
+      encoding: "utf8",
+      maxBuffer: 512e3,
+      stdio: ["ignore", "pipe", "ignore"]
     });
+  } catch {
+    return null;
   }
-  return merged;
-}
-function usesMetricScoring(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
 }
-function unmeasuredStatus(rubricVersion) {
-  return rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0 ? "unverified" : "insufficient_data";
+var ALL_CAPS_SNAKE_PLACEHOLDER_PATTERN = /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/;
+function isPlaceholderSecretValue(value) {
+  const normalized = value.trim().toLowerCase();
+  return PLACEHOLDER_SECRET_PATTERN.test(normalized) || normalized.includes("your-") || normalized.includes("example") || ALL_CAPS_SNAKE_PLACEHOLDER_PATTERN.test(value.trim()) || isSyntheticFixtureSecretValue(normalized) || isFillerRunSecretValue(normalized);
 }
-function scoreCriterion(signal, rubricVersion) {
-  if (!signal) {
-    return {
-      score: 0,
-      status: unmeasuredStatus(rubricVersion),
-      evidence: [],
-      findings: [],
-      metrics: []
-    };
-  }
-  if (signal.notApplicable === true) {
-    return {
-      score: 0,
-      status: "not_applicable",
-      evidence: [],
-      findings: [],
-      metrics: []
-    };
-  }
-  const evidence = signal.positiveEvidence;
-  const findings = signal.findings;
-  const metrics = signal.metrics ?? [];
-  const evidenceCount = evidence.length + findings.length;
-  if (evidenceCount === 0) {
-    if (!usesMetricScoring(rubricVersion) || metrics.length === 0) {
-      return {
-        score: 0,
-        status: unmeasuredStatus(rubricVersion),
-        evidence,
-        findings,
-        metrics
-      };
-    }
-  }
-  if (usesMetricScoring(rubricVersion)) {
-    const measuredMetrics = metrics.length > 0 ? metrics : fallbackMetricsForEvidence(evidence, findings);
-    const score = capScoreForFindings(scoreMetrics(measuredMetrics), findings);
-    const status = statusForScoreAndFindings(score, findings);
-    return {
-      score,
-      status,
-      evidence,
-      findings: ensureFindingsExplainStatus(signal.criterionId, score, status, findings, evidence),
-      metrics: measuredMetrics
-    };
-  }
-  if (findings.some((finding) => finding.severity === "critical")) {
-    return {
-      score: 1,
-      status: "critical",
-      evidence,
-      findings,
-      metrics
-    };
-  }
-  if (findings.some((finding) => finding.severity === "warning")) {
-    return {
-      score: 2,
-      status: "warning",
-      evidence,
-      findings,
-      metrics
-    };
+function isFillerRunSecretValue(value) {
+  const candidates = [value];
+  const sepIdx = Math.max(value.lastIndexOf("_"), value.lastIndexOf("-"));
+  if (sepIdx > 0 && sepIdx < value.length - 1) {
+    candidates.push(value.slice(sepIdx + 1));
   }
-  if (findings.some((finding) => finding.severity === "info")) {
-    return {
-      score: 3,
-      status: "info",
-      evidence,
-      findings,
-      metrics
-    };
+  for (const body of candidates) {
+    if (body.length < 8) continue;
+    const counts = /* @__PURE__ */ new Map();
+    for (const ch of body) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+    const distinct = counts.size;
+    const maxRun = Math.max(...counts.values());
+    if (distinct <= 2 && maxRun / body.length >= 0.8) return true;
   }
-  return {
-    score: 4,
-    status: "verified",
-    evidence,
-    findings,
-    metrics
-  };
+  return false;
 }
-function fallbackMetricsForEvidence(evidence, findings) {
-  return [
-    {
-      name: "evidence_depth",
-      label: "Evidence depth",
-      value: Math.min(evidence.length + findings.length + 1, 4),
-      max: 4,
-      weight: 1,
-      unit: "signals",
-      description: "Conservative v1 fallback for externally supplied evidence that has not provided criterion-specific depth metrics."
-    }
-  ];
+function isSyntheticFixtureSecretValue(value) {
+  return value.includes("abcdefghijklmnopqrstuvwxyz") || value.includes("0123456789abcdefghijklmnopqrstuvwxyz") || value.includes("abcdefghijklmnopqrstuvwxyz0123456789") || value.includes("abcdefghijklmnopqrst");
 }
-function scoreMetrics(metrics) {
-  let weightedTotal = 0;
-  let totalWeight = 0;
-  for (const metric2 of metrics) {
-    const normalized = metric2.max ? Math.min(metric2.value / metric2.max, 1) : Math.min(metric2.value, 1);
-    weightedTotal += normalized * metric2.weight;
-    totalWeight += metric2.weight;
+function hasSuspiciousDependencies(repoPath, manifest) {
+  if (!manifest.endsWith("package.json")) return false;
+  const fullPath = join3(repoPath, manifest);
+  if (!isRegularFile(fullPath)) return false;
+  const parsed = parseJsonObject(readFileSync6(fullPath, "utf8"));
+  if (!parsed) return false;
+  const dependencies = isRecord(parsed.dependencies) ? parsed.dependencies : {};
+  const devDependencies = isRecord(parsed.devDependencies) ? parsed.devDependencies : {};
+  const names = [...Object.keys(dependencies), ...Object.keys(devDependencies)];
+  return names.some(
+    (name) => /^(todo|fake|placeholder|example)-|does-not-exist| hallucinated/i.test(name)
+  );
+}
+function readRecentCommits(repoPath) {
+  try {
+    const output = execFileSync("git", ["log", "--max-count=12", "--format=%H%x00%s"], {
+      cwd: repoPath,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    if (!output) return [];
+    return output.split("\n").map((line) => {
+      const [sha = "", subject = ""] = line.split("\0");
+      return { sha, subject };
+    }).filter((commit) => commit.sha.length >= 7);
+  } catch {
+    return [];
   }
-  if (totalWeight === 0) return 0;
-  return roundScore(weightedTotal / totalWeight * 4);
 }
-function capScoreForFindings(score, findings) {
-  if (findings.some((finding) => finding.severity === "critical")) return 1.4;
-  if (findings.some((finding) => finding.severity === "warning")) return Math.min(score, 2.4);
-  if (findings.some((finding) => finding.severity === "info")) return Math.min(score, 3.4);
-  return score;
+function readPackageScripts(packageJsonPath) {
+  if (!isRegularFile(packageJsonPath)) return /* @__PURE__ */ new Map();
+  const parsed = parseJsonObject(readFileSync6(packageJsonPath, "utf8"));
+  const scripts = parsed?.scripts;
+  if (!isRecord(scripts)) return /* @__PURE__ */ new Map();
+  return new Map(
+    Object.entries(scripts).filter(
+      (entry) => typeof entry[1] === "string"
+    )
+  );
 }
-function statusForScoreAndFindings(score, findings) {
-  if (findings.some((finding) => finding.severity === "critical")) return "critical";
-  if (findings.some((finding) => finding.severity === "warning")) return "warning";
-  if (score >= 3.5 && findings.length === 0) return "verified";
-  if (score >= 2.5) return "info";
-  if (score >= 1.5) return "warning";
-  return "critical";
+function evidenceForRelative(repoPath, path, kind, label) {
+  const fullPath = join3(repoPath, path);
+  const contents = isRegularFile(fullPath) ? readFileSync6(fullPath, "utf8") : "";
+  return {
+    kind,
+    label,
+    path,
+    ...contents ? {
+      line: firstMeaningfulLine(contents),
+      contentHash: createHash("sha256").update(contents).digest("hex")
+    } : {}
+  };
 }
-function ensureFindingsExplainStatus(criterionId, score, status, findings, evidence) {
-  if (findings.length > 0) return [...findings];
-  if (status !== "critical" && status !== "warning") return [...findings];
-  const anchor = evidence[0] ?? {
-    kind: "repository",
-    label: `${criterionId} metric-derived score`,
-    path: "."
+function evidenceForRelativeAtLine(repoPath, path, kind, label, line) {
+  const fullPath = join3(repoPath, path);
+  const contents = isRegularFile(fullPath) ? readFileSync6(fullPath, "utf8") : "";
+  return {
+    kind,
+    label,
+    path,
+    line,
+    ...contents ? { contentHash: createHash("sha256").update(contents).digest("hex") } : {}
+  };
+}
+function metric(name, label, value, max, weight, unit, description, kind) {
+  return {
+    name,
+    label,
+    value: Math.max(0, value),
+    max,
+    ...kind ? { kind } : {},
+    weight,
+    unit,
+    description
   };
-  return [
-    {
-      severity: status,
-      summary: `${criterionId} metric-derived score is ${score.toFixed(1)}/4.0, in the ${status} band \u2014 no single finding drove this; it reflects the combined metric weighting below.`,
-      evidence: anchor
-    }
-  ];
 }
-function averageScore(criteria) {
-  const applicable = criteria.filter(
-    (criterion) => criterion.status !== "not_applicable" && criterion.status !== "insufficient_data"
-  );
-  if (applicable.length === 0) return 0;
-  const total = applicable.reduce((sum, criterion) => sum + criterion.score, 0);
-  return roundScore(total / applicable.length);
+function firstMeaningfulLine(contents) {
+  const lines = contents.split("\n");
+  const index = lines.findIndex((line) => line.trim().length > 0);
+  return index === -1 ? 1 : index + 1;
 }
-function roundScore(score) {
-  return Math.round(score * 10) / 10;
+function readGitHead(repoPath) {
+  try {
+    return execFileSync("git", ["rev-parse", "HEAD"], {
+      cwd: repoPath,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function hasEnvPathInGitHistory(repoPath) {
+  try {
+    const output = execFileSync(
+      "git",
+      ["log", "--all", "--diff-filter=AM", "--name-only", "--format="],
+      {
+        cwd: repoPath,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        maxBuffer: 512e3
+      }
+    ).trim();
+    if (!output) return false;
+    return output.split("\n").some((p) => /(?:^|\/)\.env(?:\.|$)/i.test(p.trim()));
+  } catch {
+    return false;
+  }
 }
 
-// src/witan/sarif-adapter.ts
-import { readFileSync as readFileSync2 } from "fs";
-var DIMENSION_RULES = [
-  // A2 — injection / secrets / auth (high weight)
-  {
-    pattern: /sql[- _]?inject|cwe-89|sqli|command[- _]?inject|cwe-78|os[- _]?cmd|rce|remote[- _]?code/i,
-    dimension: "A2",
-    weight: 0.9
-  },
-  {
-    pattern: /secret|credential|api[- _]?key|password[- _]?leak|hardcoded[- _]?(token|key|secret)|cwe-259|cwe-798/i,
-    dimension: "A2",
-    weight: 0.9
-  },
+// ../witan/src/rubric.ts
+var WITAN_RUBRIC = [
   {
-    pattern: /path[- _]?traversal|directory[- _]?traversal|cwe-22|lfi|rfi/i,
-    dimension: "A2",
-    weight: 0.8
+    id: "A1",
+    title: "Test integrity and regression signal",
+    category: "code_trust"
   },
   {
-    pattern: /ssrf|server[- _]?side[- _]?request[- _]?forg|cwe-918/i,
-    dimension: "A2",
-    weight: 0.8
+    id: "A2",
+    title: "Data-layer isolation and secrets posture",
+    category: "code_trust"
   },
   {
-    pattern: /xxe|xml[- _]?external[- _]?entity|cwe-611/i,
-    dimension: "A2",
-    weight: 0.8
+    id: "A3",
+    title: "Production readiness",
+    category: "code_trust"
   },
   {
-    pattern: /auth[- _]?bypass|broken[- _]?auth|missing[- _]?auth|cwe-287|cwe-306|cwe-863|cwe-862/i,
-    dimension: "A2",
-    weight: 0.7
+    id: "A4",
+    title: "Dependency hygiene",
+    category: "code_trust"
   },
   {
-    pattern: /xss|cross[- _]?site[- _]?script|cwe-79/i,
-    dimension: "A2",
-    weight: 0.6
+    id: "A5",
+    title: "Claim-vs-reality reconciliation",
+    category: "code_trust"
   },
-  // A4 — dependency vulnerabilities
   {
-    pattern: /cve-\d{4}-\d+|supply[- _]?chain|depend[a-z]*[- _]?vulner|outdated[- _]?depend|deprecated[- _]?package/i,
-    dimension: "A4",
-    weight: 0.8
+    id: "B1",
+    title: "Dispatch trace completeness",
+    category: "process_trust"
   },
   {
-    pattern: /npm[- _]?audit|yarn[- _]?audit|pnpm[- _]?audit|pip[- _]?audit|cargo[- _]?audit/i,
-    dimension: "A4",
-    weight: 0.7
+    id: "B2",
+    title: "PR outcome traceability",
+    category: "process_trust"
   },
-  // A3 — production readiness / insecure config
   {
-    pattern: /insecure[- _]?tls|weak[- _]?cipher|tls[- _]?version|http[- _]?strict|hsts|csp[- _]?missing|cwe-326|cwe-327/i,
-    dimension: "A3",
-    weight: 0.5
+    id: "B3",
+    title: "CI and QA discipline",
+    category: "process_trust"
   },
   {
-    pattern: /error[- _]?handl|unhandled[- _]?exception|crash|uncaught|stacktrace[- _]?leak/i,
-    dimension: "A3",
-    weight: 0.4
+    id: "B4",
+    title: "Audit trail and report-up completeness",
+    category: "process_trust"
   },
   {
-    pattern: /debug[- _]?mode|dev[- _]?endpoint|staging[- _]?secret/i,
-    dimension: "A3",
-    weight: 0.4
+    id: "B5",
+    title: "Verified learning trace",
+    category: "process_trust"
   },
-  // A1 — test integrity (low weight; SARIF rarely surfaces this)
   {
-    pattern: /skipped[- _]?test|hollow[- _]?test|empty[- _]?assert|no[- _]?assertion/i,
-    dimension: "A1",
-    weight: 0.2
+    id: "B6",
+    title: "Privileged-operation human gating",
+    category: "process_trust"
   }
 ];
-var DEFAULT_DIMENSION = "A2";
-var DEFAULT_WEIGHT = 0.3;
-var DROP_LEVEL = /* @__PURE__ */ new Set(["none"]);
-function mapLevel(level) {
-  if (!level || DROP_LEVEL.has(level)) return null;
-  if (level === "error") return "critical";
-  if (level === "warning") return "warning";
-  return "info";
-}
-function mapRuleToDimension(ruleId, rules) {
-  for (const rule of rules) {
-    if (rule.pattern.test(ruleId)) {
-      return { dimension: rule.dimension, weight: rule.weight };
+
+// ../witan/src/scoring.ts
+var MAX_SIGNAL_ADJUSTMENT = 0.8;
+function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
+  const parsedInput = WitanReportInputSchema.parse(input);
+  const signalsByCriterion = mergeSignalsByCriterion(parsedInput.signals);
+  const hasInputSignals = inputSignals != null && inputSignals.length > 0;
+  const inputSignalsByDimension = /* @__PURE__ */ new Map();
+  if (hasInputSignals && inputSignals) {
+    for (const signal of inputSignals) {
+      const bucket = inputSignalsByDimension.get(signal.dimension) ?? [];
+      bucket.push(signal);
+      inputSignalsByDimension.set(signal.dimension, bucket);
+    }
+  }
+  const consumedSignals = [];
+  const criteria = rubric.map((rubricCriterion) => {
+    const id = rubricCriterion.id;
+    const signal = signalsByCriterion.get(id);
+    const scored = scoreCriterion(signal, parsedInput.rubricVersion);
+    const dimensionSignals = inputSignalsByDimension.get(id);
+    if (!dimensionSignals || dimensionSignals.length === 0) {
+      return {
+        id,
+        title: rubricCriterion.title,
+        category: rubricCriterion.category,
+        score: scored.score,
+        status: scored.status,
+        evidence: scored.evidence,
+        findings: scored.findings,
+        metrics: scored.metrics,
+        ...signal?.notes ? { notes: signal.notes } : {}
+      };
+    }
+    const { adjustedScore, adjustment, summaries } = applySignalAdjustment(
+      scored.score,
+      id,
+      dimensionSignals
+    );
+    consumedSignals.push(...summaries);
+    const finalScore = adjustment === 0 ? scored.score : adjustedScore;
+    const finalStatus = adjustment === 0 ? scored.status : statusForScore(finalScore);
+    return {
+      id,
+      title: rubricCriterion.title,
+      category: rubricCriterion.category,
+      score: finalScore,
+      ...adjustment !== 0 ? { nativeScore: scored.score } : {},
+      status: finalStatus,
+      evidence: scored.evidence,
+      findings: scored.findings,
+      metrics: scored.metrics,
+      ...signal?.notes ? { notes: signal.notes } : {}
+    };
+  });
+  const categoryOrder = [];
+  for (const rubricCriterion of rubric) {
+    if (!categoryOrder.includes(rubricCriterion.category)) {
+      categoryOrder.push(rubricCriterion.category);
     }
   }
-  return { dimension: DEFAULT_DIMENSION, weight: DEFAULT_WEIGHT };
-}
-function renderLocation(result) {
-  const loc = result.locations?.[0]?.physicalLocation;
-  if (!loc) return void 0;
-  const uri = loc.artifactLocation?.uri;
-  const line = loc.region?.startLine;
-  if (!uri) return void 0;
-  return line != null ? `${uri}:${line}` : uri;
+  const categoryScoreMap = {};
+  for (const category of categoryOrder) {
+    categoryScoreMap[category] = averageScore(
+      criteria.filter((criterion) => criterion.category === category)
+    );
+  }
+  const firstCategory = categoryOrder[0];
+  const secondCategory = categoryOrder[1] ?? firstCategory;
+  const codeTrustScore = categoryScoreMap.code_trust ?? (firstCategory ? categoryScoreMap[firstCategory] : void 0) ?? 0;
+  const processTrustScore = categoryScoreMap.process_trust ?? (secondCategory ? categoryScoreMap[secondCategory] : void 0) ?? 0;
+  const overallScore = roundScore(
+    categoryOrder.reduce((sum, category) => sum + (categoryScoreMap[category] ?? 0), 0) / Math.max(categoryOrder.length, 1)
+  );
+  return WitanReportSchema.parse({
+    productSlug: parsedInput.productSlug,
+    productDisplayName: parsedInput.productDisplayName,
+    repo: parsedInput.repo,
+    generatedAt: parsedInput.generatedAt,
+    rubricVersion: parsedInput.rubricVersion,
+    codeTrustScore,
+    processTrustScore,
+    overallScore,
+    criteria,
+    ...consumedSignals.length > 0 ? { consumedSignals } : {},
+    // Only surface the full per-category map for rubrics with more than two buckets —
+    // the default two-category rubric is fully represented by codeTrustScore/processTrustScore.
+    ...categoryOrder.length > 2 ? { categoryScores: categoryScoreMap } : {},
+    // Pass through repo-archetype metadata verbatim — createWitanReport does not compute or
+    // alter it (see classifyRepoArchetype in repo-signals.ts); per-criterion scoring above is
+    // unaffected by archetype, only presentation layers (badge/terminal/verdict) key off it.
+    ...parsedInput.archetype ? { archetype: parsedInput.archetype } : {},
+    ...parsedInput.insufficientSourceReason ? { insufficientSourceReason: parsedInput.insufficientSourceReason } : {}
+  });
+}
+function applySignalAdjustment(nativeScore, dimension, signals) {
+  const summaries = [];
+  let totalRawAdj = 0;
+  for (const signal of signals) {
+    const criticalCount = signal.findings.filter((f) => f.severity === "critical").length;
+    const warningCount = signal.findings.filter((f) => f.severity === "warning").length;
+    const infoCount = signal.findings.filter((f) => f.severity === "info").length;
+    const severityScore = Math.min(
+      criticalCount * 0.2 + warningCount * 0.1 + infoCount * 0.02,
+      1
+    );
+    const signalAdj = signal.weight * severityScore * MAX_SIGNAL_ADJUSTMENT;
+    totalRawAdj += signalAdj;
+    summaries.push({
+      source: signal.source,
+      dimension,
+      findingCount: signal.findings.length,
+      severityBreakdown: { critical: criticalCount, warning: warningCount, info: infoCount },
+      nativeScore,
+      scoreAdjustment: -roundScore(Math.min(signalAdj, MAX_SIGNAL_ADJUSTMENT)),
+      adjustedScore: roundScore(
+        Math.max(0, nativeScore - Math.min(signalAdj, MAX_SIGNAL_ADJUSTMENT))
+      ),
+      findings: [...signal.findings]
+    });
+  }
+  const totalAdj = Math.min(totalRawAdj, MAX_SIGNAL_ADJUSTMENT);
+  const adjustedScore = roundScore(Math.max(0, nativeScore - totalAdj));
+  for (const summary of summaries) {
+    summary.adjustedScore = adjustedScore;
+    summary.scoreAdjustment = -roundScore(totalAdj);
+  }
+  return { adjustedScore, adjustment: roundScore(totalAdj), summaries };
 }
-function dedupeFindings(findings) {
-  const seen = /* @__PURE__ */ new Set();
-  return findings.filter((f) => {
-    const key = `${f.ruleId}|${f.severity}|${f.location ?? ""}`;
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  });
+function statusForScore(score) {
+  if (score >= 3.5) return "verified";
+  if (score >= 2.5) return "info";
+  if (score >= 1.5) return "warning";
+  if (score > 0) return "critical";
+  return "critical";
 }
-function parseSarifJson(raw, extraDimensionRules) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
-  const dimensionRules = extraDimensionRules ? [...DIMENSION_RULES, ...extraDimensionRules] : DIMENSION_RULES;
-  const doc = raw;
-  if (!Array.isArray(doc.runs)) return [];
-  const buckets = /* @__PURE__ */ new Map();
-  for (const run of doc.runs) {
-    const driverName = run.tool?.driver?.name ?? "unknown";
-    const source = `sarif:${driverName}`;
-    const ruleDefaultLevels = /* @__PURE__ */ new Map();
-    for (const rule of run.tool?.driver?.rules ?? []) {
-      if (rule.id && rule.defaultConfiguration?.level) {
-        ruleDefaultLevels.set(rule.id, rule.defaultConfiguration.level);
-      }
-    }
-    for (const result of run.results ?? []) {
-      const ruleId = result.ruleId ?? "unknown";
-      const effectiveLevel = result.level ?? ruleDefaultLevels.get(ruleId) ?? "warning";
-      const severity = mapLevel(effectiveLevel);
-      if (!severity) continue;
-      const message = result.message?.text ?? ruleId;
-      const location = renderLocation(result);
-      const { dimension, weight } = mapRuleToDimension(ruleId, dimensionRules);
-      const bucketKey = `${source}|${dimension}`;
-      if (!buckets.has(bucketKey)) {
-        buckets.set(bucketKey, { source, dimension, weight, findings: [] });
-      }
-      buckets.get(bucketKey)?.findings.push({ ruleId, severity, message, ...location ? { location } : {} });
+function mergeSignalsByCriterion(signals) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const signal of signals) {
+    const existing = merged.get(signal.criterionId);
+    if (!existing) {
+      merged.set(signal.criterionId, signal);
+      continue;
     }
+    merged.set(signal.criterionId, {
+      criterionId: signal.criterionId,
+      positiveEvidence: [...existing.positiveEvidence, ...signal.positiveEvidence],
+      findings: [...existing.findings, ...signal.findings],
+      metrics: [...existing.metrics ?? [], ...signal.metrics ?? []],
+      notes: signal.notes ?? existing.notes,
+      // N/A wins on merge: if either signal is N/A, the criterion is N/A.
+      ...existing.notApplicable === true || signal.notApplicable === true ? { notApplicable: true } : {}
+    });
   }
-  return Array.from(buckets.values()).map(({ source, dimension, weight, findings }) => ({
-    source,
-    dimension,
-    weight,
-    findings: dedupeFindings(findings)
-  }));
+  return merged;
 }
-
-// src/witan/scorecard-adapter.ts
-import { readFileSync as readFileSync3 } from "fs";
-var CHECK_RULES = {
-  // B2 — PR outcome traceability
-  "Branch-Protection": { dimension: "B2", weight: 0.8 },
-  "Code-Review": { dimension: "B2", weight: 0.7 },
-  // B3 — CI and QA discipline
-  "Dangerous-Workflow": { dimension: "B3", weight: 0.9 },
-  "Token-Permissions": { dimension: "B3", weight: 0.8 },
-  "CI-Tests": { dimension: "B3", weight: 0.7 },
-  Maintained: { dimension: "B3", weight: 0.3 },
-  // B4 — audit trail / release integrity
-  "Signed-Releases": { dimension: "B4", weight: 0.7 },
-  Packaging: { dimension: "B4", weight: 0.4 },
-  "Security-Policy": { dimension: "B4", weight: 0.4 },
-  // A4 — dependency hygiene
-  Vulnerabilities: { dimension: "A4", weight: 0.9 },
-  "Pinned-Dependencies": { dimension: "A4", weight: 0.8 },
-  "Dependency-Update-Tool": { dimension: "A4", weight: 0.6 },
-  // A2 — data-layer / static analysis
-  SAST: { dimension: "A2", weight: 0.7 },
-  "Binary-Artifacts": { dimension: "A2", weight: 0.6 },
-  // A1 — test integrity
-  Fuzzing: { dimension: "A1", weight: 0.3 }
-};
-function mapScoreToSeverity(score) {
-  if (score == null || Number.isNaN(score)) return null;
-  if (score < 0) return null;
-  if (score >= 10) return null;
-  if (score <= 3) return "critical";
-  if (score <= 6) return "warning";
-  return "info";
+function usesMetricScoring(rubricVersion) {
+  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
 }
-function dedupeFindings2(findings) {
-  const seen = /* @__PURE__ */ new Set();
-  return findings.filter((f) => {
-    const key = `${f.ruleId}|${f.severity}|${f.location ?? ""}`;
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  });
+function unmeasuredStatus(rubricVersion) {
+  return rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0 ? "unverified" : "insufficient_data";
 }
-function parseScorecardJson(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
-  const doc = raw;
-  if (!Array.isArray(doc.checks)) return [];
-  const buckets = /* @__PURE__ */ new Map();
-  for (const check of doc.checks) {
-    const name = check.name;
-    if (!name) continue;
-    const rule = CHECK_RULES[name];
-    if (!rule) continue;
-    const severity = mapScoreToSeverity(check.score);
-    if (!severity) continue;
-    const scoreText = typeof check.score === "number" ? `${check.score}/10` : "n/a";
-    const message = `${name} (Scorecard ${scoreText}): ${check.reason ?? "weakness detected"}`.slice(0, 500);
-    const location = check.documentation?.url;
-    const bucket = buckets.get(rule.dimension) ?? { weight: 0, findings: [] };
-    bucket.weight = Math.max(bucket.weight, rule.weight);
-    bucket.findings.push({
-      ruleId: `scorecard:${name}`,
-      severity,
-      message,
-      ...location ? { location } : {}
-    });
-    buckets.set(rule.dimension, bucket);
+function scoreCriterion(signal, rubricVersion) {
+  if (!signal) {
+    return {
+      score: 0,
+      status: unmeasuredStatus(rubricVersion),
+      evidence: [],
+      findings: [],
+      metrics: []
+    };
   }
-  return Array.from(buckets.entries()).map(([dimension, { weight, findings }]) => ({
-    source: "scorecard",
-    dimension,
-    weight,
-    findings: dedupeFindings2(findings)
-  }));
-}
-
-// src/witan/generic-adapter.ts
-import { readFileSync as readFileSync4 } from "fs";
-var VALID_DIMENSIONS = /* @__PURE__ */ new Set([
-  "A1",
-  "A2",
-  "A3",
-  "A4",
-  "A5",
-  "B1",
-  "B2",
-  "B3",
-  "B4",
-  "B5",
-  "B6"
-]);
-var VALID_SEVERITIES = /* @__PURE__ */ new Set(["critical", "warning", "info"]);
-function isGenericSignalDocument(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
-  const doc = raw;
-  return typeof doc.tool === "string" && doc.tool.length > 0 && Array.isArray(doc.signals);
+  if (signal.notApplicable === true) {
+    return {
+      score: 0,
+      status: "not_applicable",
+      evidence: [],
+      findings: [],
+      metrics: []
+    };
+  }
+  const evidence = signal.positiveEvidence;
+  const findings = signal.findings;
+  const metrics = signal.metrics ?? [];
+  const evidenceCount = evidence.length + findings.length;
+  if (evidenceCount === 0) {
+    if (!usesMetricScoring(rubricVersion) || metrics.length === 0) {
+      return {
+        score: 0,
+        status: unmeasuredStatus(rubricVersion),
+        evidence,
+        findings,
+        metrics
+      };
+    }
+  }
+  if (usesMetricScoring(rubricVersion)) {
+    const measuredMetrics = metrics.length > 0 ? metrics : fallbackMetricsForEvidence(evidence, findings);
+    const score = capScoreForFindings(scoreMetrics(measuredMetrics), findings);
+    const status = statusForScoreAndFindings(score, findings);
+    return {
+      score,
+      status,
+      evidence,
+      findings: ensureFindingsExplainStatus(signal.criterionId, score, status, findings, evidence),
+      metrics: measuredMetrics
+    };
+  }
+  if (findings.some((finding) => finding.severity === "critical")) {
+    return {
+      score: 1,
+      status: "critical",
+      evidence,
+      findings,
+      metrics
+    };
+  }
+  if (findings.some((finding) => finding.severity === "warning")) {
+    return {
+      score: 2,
+      status: "warning",
+      evidence,
+      findings,
+      metrics
+    };
+  }
+  if (findings.some((finding) => finding.severity === "info")) {
+    return {
+      score: 3,
+      status: "info",
+      evidence,
+      findings,
+      metrics
+    };
+  }
+  return {
+    score: 4,
+    status: "verified",
+    evidence,
+    findings,
+    metrics
+  };
 }
-function parseGenericJson(raw) {
-  if (!isGenericSignalDocument(raw)) return [];
-  const source = raw.tool ?? "unknown";
-  const signals = [];
-  for (const signal of raw.signals ?? []) {
-    const dimension = signal.dimension;
-    if (!dimension || !VALID_DIMENSIONS.has(dimension)) continue;
-    const weight = typeof signal.weight === "number" && Number.isFinite(signal.weight) ? Math.min(Math.max(signal.weight, 0), 1) : 0.5;
-    const findings = [];
-    for (const finding of signal.findings ?? []) {
-      const severity = finding.severity;
-      if (!severity || !VALID_SEVERITIES.has(severity)) continue;
-      const ruleId = finding.ruleId ?? "unknown";
-      findings.push({
-        ruleId,
-        severity,
-        message: finding.message ?? ruleId,
-        ...finding.location ? { location: finding.location } : {}
-      });
+function fallbackMetricsForEvidence(evidence, findings) {
+  return [
+    {
+      name: "evidence_depth",
+      label: "Evidence depth",
+      value: Math.min(evidence.length + findings.length + 1, 4),
+      max: 4,
+      weight: 1,
+      unit: "signals",
+      description: "Conservative v1 fallback for externally supplied evidence that has not provided criterion-specific depth metrics."
     }
-    if (findings.length === 0) continue;
-    signals.push({ source, dimension, weight, findings });
-  }
-  return signals;
+  ];
 }
-
-// src/witan/ingest.ts
-import { readFileSync as readFileSync5, readdirSync as readdirSync2 } from "fs";
-import { join as join2 } from "path";
-
-// src/witan/finding-limits.ts
-var RULE_ID_MAX = 200;
-var MESSAGE_MAX = 500;
-var LOCATION_MAX = 700;
-function clamp(value, max) {
-  if (value.length <= max) return value;
-  const ellipsis = "...";
-  return `${value.slice(0, Math.max(max - ellipsis.length, 0))}${ellipsis}`;
+function scoreMetrics(metrics) {
+  let weightedTotal = 0;
+  let totalWeight = 0;
+  for (const metric2 of metrics) {
+    const normalized = metric2.max ? Math.min(metric2.value / metric2.max, 1) : Math.min(metric2.value, 1);
+    weightedTotal += normalized * metric2.weight;
+    totalWeight += metric2.weight;
+  }
+  if (totalWeight === 0) return 0;
+  return roundScore(weightedTotal / totalWeight * 4);
 }
-function clampFinding(finding) {
-  return {
-    ...finding,
-    ruleId: clamp(finding.ruleId, RULE_ID_MAX),
-    message: clamp(finding.message, MESSAGE_MAX),
-    ...finding.location ? { location: clamp(finding.location, LOCATION_MAX) } : {}
-  };
+function capScoreForFindings(score, findings) {
+  if (findings.some((finding) => finding.severity === "critical")) return 1.4;
+  if (findings.some((finding) => finding.severity === "warning")) return Math.min(score, 2.4);
+  if (findings.some((finding) => finding.severity === "info")) return Math.min(score, 3.4);
+  return score;
 }
-
-// src/witan/ingest.ts
-function looksLikeSarif(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
-  return Array.isArray(raw.runs);
+function statusForScoreAndFindings(score, findings) {
+  if (findings.some((finding) => finding.severity === "critical")) return "critical";
+  if (findings.some((finding) => finding.severity === "warning")) return "warning";
+  if (score >= 3.5 && findings.length === 0) return "verified";
+  if (score >= 2.5) return "info";
+  if (score >= 1.5) return "warning";
+  return "critical";
 }
-function looksLikeScorecard(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
-  return Array.isArray(raw.checks);
+function ensureFindingsExplainStatus(criterionId, score, status, findings, evidence) {
+  if (findings.length > 0) return [...findings];
+  if (status !== "critical" && status !== "warning") return [...findings];
+  const anchor = evidence[0] ?? {
+    kind: "repository",
+    label: `${criterionId} metric-derived score`,
+    path: "."
+  };
+  return [
+    {
+      severity: status,
+      summary: `${criterionId} metric-derived score is ${score.toFixed(1)}/4.0, in the ${status} band \u2014 no single finding drove this; it reflects the combined metric weighting below.`,
+      evidence: anchor
+    }
+  ];
 }
-function countRawEntries(raw) {
-  const obj = raw;
-  if (Array.isArray(obj.runs)) {
-    return obj.runs.reduce((sum, run) => {
-      const results = run.results;
-      return sum + (Array.isArray(results) ? results.length : 0);
-    }, 0);
-  }
-  if (Array.isArray(obj.checks)) return obj.checks.length;
-  if (Array.isArray(obj.signals)) {
-    return obj.signals.reduce((sum, signal) => {
-      const findings = signal.findings;
-      return sum + (Array.isArray(findings) ? findings.length : 0);
-    }, 0);
-  }
-  return 0;
+function averageScore(criteria) {
+  const applicable = criteria.filter(
+    (criterion) => criterion.status !== "not_applicable" && criterion.status !== "insufficient_data"
+  );
+  if (applicable.length === 0) return 0;
+  const total = applicable.reduce((sum, criterion) => sum + criterion.score, 0);
+  return roundScore(total / applicable.length);
 }
-function rawToolName(raw) {
-  const obj = raw;
-  if (Array.isArray(obj.runs)) {
-    const firstRun = obj.runs[0];
-    return firstRun?.tool?.driver?.name ?? "unknown";
-  }
-  if (typeof obj.tool === "string" && obj.tool.length > 0) return obj.tool;
-  return "scorecard";
+function roundScore(score) {
+  return Math.round(score * 10) / 10;
 }
-function parseIngestFile(filePath) {
-  let raw;
-  try {
-    raw = JSON.parse(stripBom(readFileSync5(filePath, "utf8")));
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`Cejel: could not parse ingest file as JSON: ${filePath} (${message})`);
-  }
-  let signals;
-  if (looksLikeSarif(raw)) signals = parseSarifJson(raw);
-  else if (looksLikeScorecard(raw)) signals = parseScorecardJson(raw);
-  else if (isGenericSignalDocument(raw)) signals = parseGenericJson(raw);
-  if (!signals) {
-    throw new Error(
-      `Cejel: unrecognized ingest file format: ${filePath} \u2014 expected SARIF (a "runs" array), OpenSSF Scorecard JSON (a "checks" array), or the generic Cejel external-signal shape (a "tool" string + "signals" array). See the cejel README "Aggregate your scanners".`
-    );
-  }
-  const rawCount = countRawEntries(raw);
-  const mappedCount = signals.reduce((sum, signal) => sum + signal.findings.length, 0);
-  if (rawCount > 0 && mappedCount === 0) {
-    process.stderr.write(
-      `Cejel: ${rawCount} findings from ${rawToolName(raw)} (${filePath}), 0 mapped to trust criteria
-`
-    );
-  }
-  return signals.map((signal) => ({
-    ...signal,
-    findings: signal.findings.map(clampFinding)
-  }));
+
+// ../witan/src/public-scan.ts
+function scoreRepoWithPublicCejel(options) {
+  const input = buildWitanInputFromRepo({
+    productSlug: options.productSlug,
+    productDisplayName: options.productDisplayName,
+    repoPath: options.repoPath,
+    ...options.generatedAt ? { generatedAt: options.generatedAt } : {}
+  });
+  const inputSignals = resolvePublicIngestSignals(options);
+  return createWitanReport(input, inputSignals.length > 0 ? inputSignals : void 0);
 }
-function expandIngestPattern(pattern) {
-  if (!pattern.includes("*")) return [pattern];
-  const lastSlash = pattern.lastIndexOf("/");
-  const dir = lastSlash === -1 ? "." : pattern.slice(0, lastSlash);
-  const filePattern = lastSlash === -1 ? pattern : pattern.slice(lastSlash + 1);
-  const regexSource = filePattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-  const regex = new RegExp(`^${regexSource}$`);
-  let entries;
-  try {
-    entries = readdirSync2(dir);
-  } catch {
-    return [];
+function resolvePublicIngestSignals(options) {
+  const seen = /* @__PURE__ */ new Set();
+  const files = [];
+  for (const pattern of options.ingestPatterns ?? []) {
+    const matches = expandIngestPattern(pattern);
+    if (matches.length === 0 && options.warnOnEmptyIngestMatch) {
+      process.stderr.write(`Cejel: --ingest pattern matched no files: ${pattern}
+`);
+    }
+    for (const match of matches) {
+      const resolved = resolve2(match);
+      if (seen.has(resolved)) continue;
+      seen.add(resolved);
+      files.push(match);
+    }
   }
-  return entries.filter((name) => regex.test(name)).sort().map((name) => join2(dir, name));
-}
-function discoverIngestInputs(repoPath) {
-  const inputsDir = join2(repoPath, ".cejel", "inputs");
-  let entries;
-  try {
-    entries = readdirSync2(inputsDir);
-  } catch {
-    return [];
+  for (const discovered of discoverIngestInputs(options.repoPath)) {
+    const resolved = resolve2(discovered);
+    if (seen.has(resolved)) continue;
+    seen.add(resolved);
+    files.push(discovered);
   }
-  return entries.filter((name) => /\.(sarif|json)$/i.test(name)).sort().map((name) => join2(inputsDir, name));
+  return files.flatMap((file) => parseIngestFile(file));
 }
 
-// src/scan.ts
-import { resolve as resolve2 } from "path";
+// ../witan/src/repo-clone.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { mkdirSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { join as join4 } from "path";
+
+// ../witan/src/cejel-package-name.ts
+import { readFileSync as readFileSync7 } from "fs";
+import { fileURLToPath } from "url";
+
+// ../witan/src/leaderboard.ts
+var RESERVED_CORPUS_SLUGS = ["biome", "tsconfig", "package"];
+var LeaderboardCorpusEntrySchema = external_exports.object({
+  // Also the evidence-report slug (reports/<name>.{json,md,svg}) — min length 3
+  // to satisfy the WitanReport productSlug pattern.
+  name: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/).refine((value) => !RESERVED_CORPUS_SLUGS.includes(value), {
+    message: "Corpus entry name collides with a tool config filename (reports/<name>.json would be discovered by that tool) \u2014 pick a different slug, e.g. biomejs."
+  }),
+  category: external_exports.string().min(1).max(80),
+  expectedArchetype: external_exports.string().min(1).max(40),
+  license: external_exports.string().min(1).max(80),
+  /**
+   * Repository visibility — the redaction policy's first-class input
+   * (goal_cejel_redaction_policy_is_verifiability_2026-07-12): a path is
+   * published exactly when the reader can check it (public), and withheld
+   * entirely when they can't (private). FAIL CLOSED: absent or unrecognized
+   * resolves to 'private' via `.catch` rather than throwing or defaulting
+   * open, so a corpus entry can never accidentally publish paths by omission.
+   */
+  visibility: external_exports.enum(["public", "private"]).catch("private"),
+  url: external_exports.string().url().optional(),
+  /**
+   * Immutable source snapshot for URL entries. A rubric rescore always uses
+   * the same commits; changing one is a separate corpus update.
+   */
+  commit: external_exports.string().regex(/^[0-9a-f]{40}$/).optional(),
+  self: external_exports.literal(true).optional(),
+  /**
+   * A directory inside THIS repository (relative to its root), for internal
+   * entries that are a sub-package rather than the whole repo (e.g. the public
+   * cejel CLI at packages/witan-cli). Scored locally like "self".
+   */
+  path: external_exports.string().min(1).max(200).regex(/^[A-Za-z0-9._/-]+$/).refine((value) => !value.startsWith("/") && !value.split("/").includes(".."), {
+    message: 'Corpus entry "path" must be relative and must not traverse upward.'
+  }).optional()
+}).strict().refine((entry) => (entry.url ? 1 : 0) + (entry.self ? 1 : 0) + (entry.path ? 1 : 0) === 1, {
+  message: 'Corpus entry must have exactly one of "url", "self", or "path".'
+}).refine((entry) => entry.url ? entry.commit !== void 0 : entry.commit === void 0, {
+  message: 'Every URL corpus entry must declare exactly one immutable 40-character "commit".'
+});
+var LeaderboardCorpusSchema = external_exports.object({
+  comment: external_exports.string().min(1),
+  entries: external_exports.array(LeaderboardCorpusEntrySchema).min(1)
+}).strict().refine(
+  (corpus) => new Set(corpus.entries.map((entry) => entry.name)).size === corpus.entries.length,
+  { message: "Corpus entry names must be unique." }
+);
+
+// ../witan/src/quant-integrity.ts
+import { readFileSync as readFileSync10 } from "fs";
+import { join as join8 } from "path";
+
+// ../witan/src/quant-metrics-grading.ts
+import { createHash as createHash2 } from "crypto";
+import { readFileSync as readFileSync9 } from "fs";
+import { join as join7 } from "path";
+
+// ../witan/src/quant-run-tier-grading.ts
+import { createHash as createHash3 } from "crypto";
 
 // src/product-identity.ts
-import { existsSync, readFileSync as readFileSync6 } from "fs";
-import { basename as basename2, join as join3 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync11 } from "fs";
+import { basename as basename3, join as join9 } from "path";
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/;
 var FALLBACK_SLUG = "repo";
 var FALLBACK_DISPLAY_NAME = "Repository";
 function deriveProductIdentity(repoPath) {
-  const packageJsonPath = join3(repoPath, "package.json");
-  const raw = readPackageName(packageJsonPath) ?? basename2(repoPath);
+  const packageJsonPath = join9(repoPath, "package.json");
+  const raw = readPackageName(packageJsonPath) ?? basename3(repoPath);
   const displayName = raw.trim().length > 0 ? raw.trim() : FALLBACK_DISPLAY_NAME;
   return {
     productSlug: slugify(raw),
@@ -7818,9 +9437,9 @@ function deriveProductIdentity(repoPath) {
   };
 }
 function readPackageName(packageJsonPath) {
-  if (!existsSync(packageJsonPath)) return void 0;
+  if (!existsSync3(packageJsonPath)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync6(packageJsonPath, "utf8"));
+    const parsed = JSON.parse(readFileSync11(packageJsonPath, "utf8"));
     if (typeof parsed === "object" && parsed !== null && "name" in parsed) {
       const name = parsed.name;
       if (typeof name === "string" && name.trim().length > 0) return name;
@@ -7881,52 +9500,28 @@ function buildWitanCliSummary(report) {
 // src/scan.ts
 function runCejelScan(options) {
   const identity = deriveProductIdentity(options.repoPath);
-  const input = buildWitanInputFromRepo({
+  const report = scoreRepoWithPublicCejel({
     productSlug: identity.productSlug,
     productDisplayName: identity.productDisplayName,
-    repoPath: options.repoPath
+    repoPath: options.repoPath,
+    ingestPatterns: options.ingestPatterns,
+    warnOnEmptyIngestMatch: options.warnOnEmptyIngestMatch
   });
-  const inputSignals = resolveIngestSignals(options);
-  const report = createWitanReport(input, inputSignals.length > 0 ? inputSignals : void 0);
   const summary = buildWitanCliSummary(report);
   return { report, summary };
 }
-function resolveIngestSignals(options) {
-  const seen = /* @__PURE__ */ new Set();
-  const files = [];
-  for (const pattern of options.ingestPatterns ?? []) {
-    const matches = expandIngestPattern(pattern);
-    if (matches.length === 0 && options.warnOnEmptyIngestMatch) {
-      process.stderr.write(`Cejel: --ingest pattern matched no files: ${pattern}
-`);
-    }
-    for (const match of matches) {
-      const resolved = resolve2(match);
-      if (seen.has(resolved)) continue;
-      seen.add(resolved);
-      files.push(match);
-    }
-  }
-  for (const discovered of discoverIngestInputs(options.repoPath)) {
-    const resolved = resolve2(discovered);
-    if (seen.has(resolved)) continue;
-    seen.add(resolved);
-    files.push(discovered);
-  }
-  return files.flatMap((file) => parseIngestFile(file));
-}
 
 export {
   __commonJS,
   __export,
   __toESM,
-  ZodOptional,
-  ZodFirstPartyTypeKind,
-  objectType,
-  external_exports,
   formatExternalSourceLine,
   renderWitanHtmlReport,
   renderWitanBadgeEndpoint,
   renderWitanBadgeSvg,
+  ZodOptional,
+  ZodFirstPartyTypeKind,
+  objectType,
+  external_exports,
   runCejelScan
 };