@cejel/cejel 0.1.2 → 0.1.4

package/dist/{chunk-MBYVOPJR.js → chunk-SQNTNX5U.js}

@@ -29,7 +29,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// ../witan/src/external-findings.ts
+// src/witan/external-findings.ts
 var EXTERNAL_FINDINGS_DISPLAY_LIMIT = 10;
 var SEVERITY_RANK = {
   critical: 0,
@@ -82,7 +82,7 @@ function collectExternalFindings(consumedSignals) {
   });
 }
 
-// ../witan/src/html.ts
+// src/witan/html.ts
 function renderWitanHtmlReport(report) {
   const codeCriteria = criteriaByCategory(report, "code_trust");
   const processCriteria = criteriaByCategory(report, "process_trust");
@@ -106,7 +106,7 @@ function renderWitanHtmlReport(report) {
     <header class="hero">
       <div class="brand">
         <span class="brand-mark" aria-hidden="true">C</span>
-        <span class="brand-name">Cejel / Alfred</span>
+        <span class="brand-name">Cejel</span>
       </div>
       <div class="hero-grid">
         <section>
@@ -403,7 +403,7 @@ a:hover { text-decoration: underline; text-underline-offset: 2px; }
 }
 `;
 
-// ../witan/src/badge.ts
+// src/witan/badge.ts
 var VERDICT_COLOR = {
   Verified: "brightgreen",
   Conditional: "yellow",
@@ -470,15 +470,10 @@ function escapeXml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 
-// ../witan/src/claim-reality.ts
-import { existsSync, readFileSync, readdirSync, statSync } from "fs";
-import { join } from "path";
-
-// ../witan/src/leaderboard.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync2 } from "fs";
-import { join as join6 } from "path";
+// src/witan/attestation.ts
+import { createHash } from "crypto";
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
 __export(external_exports, {
   BRAND: () => BRAND,
@@ -590,7 +585,7 @@ __export(external_exports, {
   void: () => voidType
 });
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
   util2.assertEqual = (_) => {
@@ -724,7 +719,7 @@ var getParsedType = (data) => {
   }
 };
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/ZodError.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode = util.arrayToEnum([
   "invalid_type",
   "invalid_literal",
@@ -842,7 +837,7 @@ ZodError.create = (issues) => {
   return error;
 };
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/locales/en.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -945,7 +940,7 @@ var errorMap = (issue, _ctx) => {
 };
 var en_default = errorMap;
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/errors.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/errors.js
 var overrideErrorMap = en_default;
 function setErrorMap(map) {
   overrideErrorMap = map;
@@ -954,7 +949,7 @@ function getErrorMap() {
   return overrideErrorMap;
 }
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
   const { data, path, errorMaps, issueData } = params;
   const fullPath = [...path, ...issueData.path || []];
@@ -1064,14 +1059,14 @@ var isDirty = (x) => x.status === "dirty";
 var isValid = (x) => x.status === "valid";
 var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
   errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
   errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
 })(errorUtil || (errorUtil = {}));
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -4519,849 +4514,7 @@ var coerce = {
 };
 var NEVER = INVALID;
 
-// ../shared/src/types/attestation.ts
-var attestationOutcomeSchema = external_exports.enum([
-  "ATTESTED_READY",
-  "ATTESTED_WITH_GAPS",
-  "NOT_READY",
-  "REVOKED"
-]);
-var attestationKindSchema = external_exports.enum(["OPERATOR_READINESS", "EXTERNAL_ASSESSOR_REFERENCE"]);
-var attestationEvidenceRefKindSchema = external_exports.enum([
-  "runbook_path",
-  "github_run_url",
-  "vercel_deployment_id",
-  "neon_query_evidence",
-  "report_hash",
-  "external_assessor_ref"
-]);
-var attestationEvidenceRefSchema = external_exports.object({
-  kind: attestationEvidenceRefKindSchema,
-  /** Redacted reference string (path, URL, ID, or hash). Max 512 chars. */
-  ref: external_exports.string().min(1).max(512),
-  /** Optional one-line redacted description. */
-  note: external_exports.string().max(280).optional()
-});
-var createAttestationInputSchema = external_exports.object({
-  studioId: external_exports.string().uuid(),
-  complianceProfileId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid().nullable().optional(),
-  framework: external_exports.string().min(1).max(120),
-  kind: attestationKindSchema,
-  outcome: attestationOutcomeSchema,
-  /** Redacted operator statement; no payloads. */
-  statement: external_exports.string().min(1).max(4e3),
-  evidenceRefs: external_exports.array(attestationEvidenceRefSchema).min(1),
-  supersedesAttestationId: external_exports.string().uuid().nullable().optional(),
-  metadata: external_exports.record(external_exports.unknown()).default({})
-});
-
-// ../shared/src/types/standup-provisioning.ts
-var ScaffoldFileSchema = external_exports.object({
-  path: external_exports.string().min(1),
-  contents: external_exports.string()
-}).strict();
-var ScaffoldManifestSchema = external_exports.array(ScaffoldFileSchema).min(1);
-var RepoRefSchema = external_exports.object({
-  studioId: external_exports.string().uuid(),
-  owner: external_exports.string().min(1),
-  // GitHub org/account that owns the repo
-  name: external_exports.string().min(1),
-  fullName: external_exports.string().min(1),
-  // owner/name
-  htmlUrl: external_exports.string().url(),
-  defaultBranch: external_exports.string().min(1).default("main")
-}).strict();
-var ScopedTokenSchema = external_exports.object({
-  token: external_exports.string().min(1),
-  expiresAt: external_exports.string(),
-  // ISO-8601
-  scope: external_exports.string().min(1)
-  // human-readable, e.g. "contents:write on owner/name"
-}).strict();
-var BranchProtectionStatusSchema = external_exports.object({
-  protected: external_exports.boolean(),
-  requiresPullRequestReview: external_exports.boolean(),
-  requiredApprovingReviewCount: external_exports.number().int().nonnegative(),
-  allowsForcePushes: external_exports.boolean(),
-  allowsDeletions: external_exports.boolean()
-}).strict();
-var RenderParamsSchema = external_exports.object({
-  productName: external_exports.string().min(1),
-  slug: external_exports.string().min(1),
-  vertical: external_exports.string().min(1)
-}).strict();
-var TemplateInputFieldSchema = external_exports.object({
-  name: external_exports.string().min(1),
-  label: external_exports.string().min(1),
-  inputType: external_exports.enum(["text", "number", "date", "slug"]),
-  required: external_exports.boolean().default(true),
-  helperText: external_exports.string().min(1),
-  example: external_exports.string().min(1),
-  defaultValue: external_exports.string().optional()
-}).strict();
-var TemplateInputSchema = external_exports.object({
-  fields: external_exports.array(TemplateInputFieldSchema).min(1)
-}).strict();
-var TemplateDescriptorSchema = external_exports.object({
-  templateRef: external_exports.string().min(1),
-  vertical: external_exports.string().min(1),
-  description: external_exports.string().default(""),
-  inputSchema: TemplateInputSchema.optional()
-}).strict();
-var StandupDryRunPlanSchema = external_exports.object({
-  planOnly: external_exports.literal(true),
-  planOnlyMessage: external_exports.string().min(1),
-  product: external_exports.object({
-    studioId: external_exports.string().min(1),
-    productId: external_exports.string().min(1),
-    name: external_exports.string().min(1),
-    slug: external_exports.string().min(1),
-    vertical: external_exports.string().min(1)
-  }).strict(),
-  targetRepo: external_exports.object({
-    owner: external_exports.string().min(1),
-    name: external_exports.string().min(1),
-    fullName: external_exports.string().min(1),
-    defaultBranch: external_exports.string().min(1),
-    plannedState: external_exports.literal("would_create"),
-    exists: external_exports.literal(false)
-  }).strict(),
-  template: TemplateDescriptorSchema,
-  scaffold: external_exports.object({
-    label: external_exports.literal("scaffold (template output)"),
-    files: ScaffoldManifestSchema
-  }).strict(),
-  buildAgentSeed: external_exports.object({
-    label: external_exports.literal("build-agent instructions (not yet run)"),
-    instructions: external_exports.array(external_exports.string().min(1)).min(1),
-    product: external_exports.object({
-      name: external_exports.string().min(1),
-      slug: external_exports.string().min(1),
-      vertical: external_exports.string().min(1)
-    }).strict(),
-    repoFullName: external_exports.string().min(1)
-  }).strict(),
-  safetyEnvelope: external_exports.object({
-    estimatedCostUsd: external_exports.number().finite().nonnegative(),
-    costCapUsd: external_exports.number().finite().nonnegative(),
-    networkPolicy: external_exports.object({
-      mode: external_exports.literal("restricted"),
-      allowedHosts: external_exports.array(external_exports.string().min(1)).min(1)
-    }).strict(),
-    scopedToken: external_exports.object({
-      tokenMinted: external_exports.literal(false),
-      scope: external_exports.string().min(1),
-      ttlSeconds: external_exports.number().int().positive()
-    }).strict()
-  }).strict()
-}).strict();
-var ConstructionWorkflowArtifactKindSchema = external_exports.enum([
-  "profile",
-  "milestone_schedule",
-  "risk_register",
-  "submittal_register",
-  "long_lead_log",
-  "rfi_log",
-  "responsibility_matrix"
-]);
-var IsoDateSchema = external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/);
-var ConstructionWorkflowTemplateDescriptorSchema = external_exports.object({
-  templateRef: external_exports.string().min(1),
-  workflowKind: external_exports.literal("construction_project"),
-  templateKind: external_exports.literal("workflow_documents"),
-  name: external_exports.string().min(1),
-  description: external_exports.string().default(""),
-  artifacts: external_exports.array(ConstructionWorkflowArtifactKindSchema).min(1),
-  inputSchema: TemplateInputSchema
-}).strict();
-var ConstructionProjectSeedSchema = external_exports.object({
-  projectName: external_exports.string().min(1).max(120),
-  areaSqFt: external_exports.number().int().positive(),
-  projectType: external_exports.string().min(1).max(120),
-  buildingName: external_exports.string().min(1).max(160),
-  ntpDate: IsoDateSchema,
-  scheduleTargetDate: IsoDateSchema
-}).strict();
-var ConstructionMilestoneSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  name: external_exports.string().min(1),
-  targetDate: IsoDateSchema,
-  status: external_exports.enum(["planned", "at_risk", "slipped", "complete"])
-}).strict();
-var ConstructionSubmittalSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  item: external_exports.string().min(1),
-  division: external_exports.string().min(1),
-  needByDate: IsoDateSchema,
-  status: external_exports.enum(["not_started", "open", "in_review", "approved", "done"])
-}).strict();
-var ConstructionRfiSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  subject: external_exports.string().min(1),
-  to: external_exports.string().min(1),
-  status: external_exports.enum(["draft", "open", "answered", "closed"]),
-  openedDate: IsoDateSchema
-}).strict();
-var ConstructionRiskSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  risk: external_exports.string().min(1),
-  rating: external_exports.enum(["low", "medium", "high"]),
-  mitigation: external_exports.string().min(1),
-  confidence: external_exports.number().min(0).max(1)
-}).strict();
-var ConstructionLongLeadItemSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  item: external_exports.string().min(1),
-  needByDate: IsoDateSchema,
-  status: external_exports.enum(["tracking", "ordered", "received", "done"]),
-  assumption: external_exports.string().min(1)
-}).strict();
-var ConstructionResponsibilitySchema = external_exports.object({
-  id: external_exports.string().min(1),
-  role: external_exports.string().min(1),
-  owner: external_exports.string().min(1),
-  responsibility: external_exports.string().min(1)
-}).strict();
-var ConstructionMarkdownArtifactSchema = external_exports.object({
-  kind: ConstructionWorkflowArtifactKindSchema,
-  path: external_exports.string().min(1),
-  markdown: external_exports.string().min(1)
-}).strict();
-var ConstructionWorkflowArtifactSetSchema = external_exports.object({
-  projectName: external_exports.string().min(1),
-  generatedAt: external_exports.string().datetime(),
-  assumptions: external_exports.array(external_exports.string().min(1)).default([]),
-  needsPmData: external_exports.array(external_exports.string().min(1)).default([]),
-  markdownArtifacts: external_exports.array(ConstructionMarkdownArtifactSchema).min(1),
-  structured: external_exports.object({
-    milestones: external_exports.array(ConstructionMilestoneSchema),
-    submittals: external_exports.array(ConstructionSubmittalSchema),
-    rfis: external_exports.array(ConstructionRfiSchema),
-    risks: external_exports.array(ConstructionRiskSchema),
-    longLeadItems: external_exports.array(ConstructionLongLeadItemSchema),
-    responsibilities: external_exports.array(ConstructionResponsibilitySchema)
-  }).strict()
-}).strict();
-var ConstructionWorkflowDryRunPlanSchema = external_exports.object({
-  planOnly: external_exports.literal(true),
-  planOnlyMessage: external_exports.string().min(1),
-  product: external_exports.object({
-    studioId: external_exports.string().min(1),
-    productId: external_exports.string().min(1),
-    name: external_exports.string().min(1),
-    vertical: external_exports.string().min(1)
-  }).strict(),
-  template: ConstructionWorkflowTemplateDescriptorSchema,
-  seed: ConstructionProjectSeedSchema,
-  safetyEnvelope: external_exports.object({
-    executor: external_exports.literal("benign_workflow_populator"),
-    sandboxUsed: external_exports.literal(false),
-    scopedTokenMinted: external_exports.literal(false),
-    externalWritesAllowed: external_exports.literal(false),
-    workspaceWriteMode: external_exports.literal("markdown_only")
-  }).strict()
-}).strict();
-
-// ../shared/src/types/construction-log-excel.ts
-var CONSTRUCTION_LOG_EXCEL_SCHEMA_VERSION = "construction-log-excel-v1";
-var ConstructionLogExcelSheetKeySchema = external_exports.enum([
-  "submittals",
-  "rfis",
-  "riskRegister",
-  "longLead",
-  "responsibilityMatrix",
-  "milestones"
-]);
-var ConstructionLogExcelColumnSchema = external_exports.object({
-  key: external_exports.string().min(1),
-  header: external_exports.string().min(1),
-  required: external_exports.boolean(),
-  description: external_exports.string().min(1)
-}).strict().describe("Canonical column definition for Alfred construction log Excel round-trips.");
-var ConstructionLogExcelSheetSchema = external_exports.object({
-  key: ConstructionLogExcelSheetKeySchema,
-  sheetName: external_exports.string().min(1),
-  description: external_exports.string().min(1),
-  columns: external_exports.array(ConstructionLogExcelColumnSchema).min(1)
-}).strict().describe("Canonical worksheet definition for Alfred construction log Excel round-trips.");
-var ConstructionLogExcelWorkbookSchema = external_exports.object({
-  schemaVersion: external_exports.literal(CONSTRUCTION_LOG_EXCEL_SCHEMA_VERSION),
-  sheets: external_exports.record(ConstructionLogExcelSheetKeySchema, ConstructionLogExcelSheetSchema)
-}).strict().describe(
-  "Canonical Alfred construction log Excel workbook schema shared by native output generation and export-upload ingestion."
-);
-var CONSTRUCTION_LOG_EXCEL_SHEETS = {
-  submittals: {
-    key: "submittals",
-    sheetName: "Submittals",
-    description: "Submittal register rows generated by Alfred or edited by the PM.",
-    columns: [
-      column("id", "ID", true, "Stable submittal identifier, for example SUB-001."),
-      column("item", "Item", true, "Submittal item or package name."),
-      column("division", "Division", true, "Spec division or trade grouping."),
-      column("needByDate", "Need By Date", true, "Date needed in YYYY-MM-DD format."),
-      column("status", "Status", true, "One of not_started, open, in_review, approved, or done."),
-      commonColumn("assumptionsNotes")
-    ]
-  },
-  rfis: {
-    key: "rfis",
-    sheetName: "RFIs",
-    description: "RFI log rows generated by Alfred or edited by the PM.",
-    columns: [
-      column("id", "ID", true, "Stable RFI identifier, for example RFI-001."),
-      column("subject", "Subject", true, "RFI subject."),
-      column("to", "To", true, "Responsible recipient or ball-in-court party."),
-      column("status", "Status", true, "One of draft, open, answered, or closed."),
-      column("openedDate", "Opened Date", true, "Date opened in YYYY-MM-DD format."),
-      commonColumn("assumptionsNotes")
-    ]
-  },
-  riskRegister: {
-    key: "riskRegister",
-    sheetName: "Risk Register",
-    description: "Risk register rows generated by Alfred or edited by the PM.",
-    columns: [
-      column("id", "ID", true, "Stable risk identifier, for example RISK-001."),
-      column("risk", "Risk", true, "Risk statement."),
-      column("rating", "Rating", true, "One of low, medium, or high."),
-      column("mitigation", "Mitigation", true, "Mitigation plan."),
-      column("confidence", "Confidence", true, "Confidence score from 0 to 1."),
-      commonColumn("assumptionsNotes")
-    ]
-  },
-  longLead: {
-    key: "longLead",
-    sheetName: "Long-Lead",
-    description: "Long-lead procurement rows generated by Alfred or edited by the PM.",
-    columns: [
-      column("id", "ID", true, "Stable long-lead identifier, for example LL-001."),
-      column("item", "Item", true, "Long-lead item name."),
-      column("needByDate", "Need By Date", true, "Date needed in YYYY-MM-DD format."),
-      column("status", "Status", true, "One of tracking, ordered, received, or done."),
-      column("assumption", "Assumption", true, "Procurement assumption behind this row."),
-      commonColumn("assumptionsNotes")
-    ]
-  },
-  responsibilityMatrix: {
-    key: "responsibilityMatrix",
-    sheetName: "Responsibility Matrix",
-    description: "Responsibility matrix rows generated by Alfred or edited by the PM.",
-    columns: [
-      column("id", "ID", true, "Stable responsibility identifier, for example RESP-001."),
-      column("role", "Role", true, "Role or party."),
-      column("owner", "Owner", true, "Named owner, or Needs PM input when unknown."),
-      column("responsibility", "Responsibility", true, "Responsibility statement."),
-      commonColumn("assumptionsNotes")
-    ]
-  },
-  milestones: {
-    key: "milestones",
-    sheetName: "Milestones",
-    description: "Milestone schedule rows used to generate the MS Project XML schedule.",
-    columns: [
-      column("id", "ID", true, "Stable milestone identifier, for example MS-001."),
-      column("name", "Name", true, "Milestone or task name."),
-      column("targetDate", "Target Date", true, "Target date in YYYY-MM-DD format."),
-      column("status", "Status", true, "One of planned, at_risk, slipped, or complete."),
-      column("predecessorId", "Predecessor ID", false, "Optional predecessor milestone ID."),
-      commonColumn("assumptionsNotes")
-    ]
-  }
-};
-var CONSTRUCTION_LOG_EXCEL_WORKBOOK_SCHEMA = ConstructionLogExcelWorkbookSchema.parse({
-  schemaVersion: CONSTRUCTION_LOG_EXCEL_SCHEMA_VERSION,
-  sheets: CONSTRUCTION_LOG_EXCEL_SHEETS
-});
-function column(key, header, required, description) {
-  return { key, header, required, description };
-}
-function commonColumn(key) {
-  return column(
-    key,
-    "Assumptions / Notes",
-    false,
-    "Show-your-work note, including generated assumptions and PM-input gaps."
-  );
-}
-
-// ../shared/src/types/dev-task-dispatch.ts
-var CodingAgentExecutorSchema = external_exports.enum(["claude-code", "codex"]);
-var DevTaskDispatchRequestSchema = external_exports.object({
-  studioId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid(),
-  repo: RepoRefSchema,
-  task: external_exports.string().min(1).max(2e4),
-  executor: CodingAgentExecutorSchema
-}).strict();
-var DevTaskDispatchDryRunPlanSchema = external_exports.object({
-  planOnly: external_exports.literal(true),
-  planOnlyMessage: external_exports.string().min(1),
-  targetRepo: RepoRefSchema,
-  task: external_exports.string().min(1),
-  executor: CodingAgentExecutorSchema,
-  branchName: external_exports.string().min(1),
-  safetyEnvelope: external_exports.object({
-    estimatedCostUsd: external_exports.number().finite().nonnegative(),
-    costCapUsd: external_exports.number().finite().nonnegative(),
-    timeoutMs: external_exports.number().int().positive(),
-    scopedToken: external_exports.object({
-      tokenMinted: external_exports.literal(false),
-      scope: external_exports.string().min(1),
-      ttlSeconds: external_exports.number().int().positive()
-    }).strict(),
-    prOnly: external_exports.object({
-      opensPullRequest: external_exports.literal(true),
-      mergesPullRequest: external_exports.literal(false),
-      pushesMain: external_exports.literal(false),
-      deploys: external_exports.literal(false)
-    }).strict()
-  }).strict()
-}).strict();
-var CodingAgentRunInputSchema = external_exports.object({
-  executor: CodingAgentExecutorSchema,
-  repo: RepoRefSchema,
-  task: external_exports.string().min(1),
-  scopedToken: ScopedTokenSchema,
-  branchName: external_exports.string().min(1),
-  costCapUsd: external_exports.number().finite().nonnegative(),
-  timeoutMs: external_exports.number().int().positive()
-}).strict();
-var CodingAgentRunResultSchema = external_exports.discriminatedUnion("status", [
-  external_exports.object({
-    status: external_exports.literal("succeeded"),
-    prUrl: external_exports.string().url(),
-    summary: external_exports.string().min(1),
-    costUsd: external_exports.number().finite().nonnegative(),
-    /**
-     * The exact commit sha the PR branch was pushed at when it opened —
-     * captured server-side (see server-dispatch-backend.ts) right after a
-     * successful run, before the workspace is torn down. Lets the Maeve
-     * in-flight-fix detector (maeve-in-flight-pr-fix-lesson.ts) key off the
-     * real PR-open head instead of falling back to timestamp matching.
-     */
-    openedHeadSha: external_exports.string().min(1).optional()
-  }).strict(),
-  external_exports.object({
-    status: external_exports.literal("failed"),
-    summary: external_exports.string().min(1),
-    reason: external_exports.string().min(1),
-    costUsd: external_exports.number().finite().nonnegative().optional()
-  }).strict()
-]);
-var DevTaskOutcomeSchema = external_exports.enum(["ci_passed", "pr_merged", "ci_failed"]);
-var SecurityFindingClassSchema = external_exports.enum(["authz", "csrf", "injection", "secrets", "ssrf"]);
-var RecordDevTaskOutcomeInputSchema = external_exports.object({
-  product: external_exports.string().min(1).max(120),
-  repo: external_exports.string().min(1).max(240),
-  prUrl: external_exports.string().url(),
-  outcome: DevTaskOutcomeSchema,
-  task: external_exports.string().min(1).max(2e4).optional(),
-  executor: CodingAgentExecutorSchema.optional(),
-  occurredAt: external_exports.string().datetime().optional(),
-  maeveLessonStatement: external_exports.string().min(1).max(1e3).optional(),
-  maeveLessonTags: external_exports.array(external_exports.string().min(1).max(120)).optional(),
-  /** Security metadata — enriches the Maeve lesson with class/pattern, never raw vulnerable detail. */
-  findingClass: SecurityFindingClassSchema.optional(),
-  ruleId: external_exports.string().min(1).max(120).optional(),
-  signalSource: external_exports.string().min(1).max(240).optional()
-}).strict();
-
-// ../shared/src/schemas/standup-plan.ts
-var StandupRequestSchema = external_exports.object({
-  productName: external_exports.string().min(1).max(80),
-  slug: external_exports.string().min(1).optional(),
-  vertical: external_exports.string().min(1).max(80),
-  repoTarget: external_exports.string().min(1).default("barg-labs"),
-  repoName: external_exports.string().min(1).optional(),
-  templateRef: external_exports.string().min(1).optional(),
-  scopeNotes: external_exports.string().max(2e3).optional()
-}).strict();
-var StandupPlanSchema = external_exports.object({
-  productName: external_exports.string().min(1).max(80),
-  slug: external_exports.string().regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/),
-  vertical: external_exports.string().min(1).max(80),
-  templateRef: external_exports.string().min(1),
-  repoTarget: external_exports.string().min(1),
-  repoName: external_exports.string().regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/),
-  fileManifest: external_exports.array(external_exports.string().min(1)).min(1),
-  credentialScope: external_exports.string().min(1),
-  estimatedCostUsd: external_exports.number().nonnegative(),
-  steps: external_exports.array(external_exports.string().min(1)).min(1),
-  dryRun: external_exports.literal(true)
-}).strict();
-
-// ../shared/src/types/coordinator-prompt.ts
-var CoordinatorPromptContextBlockSchema = external_exports.object({
-  title: external_exports.string().min(1).max(120),
-  body: external_exports.string().min(1).max(6e3),
-  source: external_exports.string().max(500).optional()
-});
-var CoordinatorPromptInputPayloadSchema = external_exports.object({
-  objective: external_exports.string().min(1).max(4e3),
-  productId: external_exports.string().min(1),
-  context: external_exports.array(CoordinatorPromptContextBlockSchema).min(1).max(20),
-  escalationHints: external_exports.array(external_exports.string().min(1).max(500)).max(10).optional()
-});
-var CoordinatorPromptTokensUsedSchema = external_exports.object({
-  input: external_exports.number().int().nonnegative(),
-  output: external_exports.number().int().nonnegative(),
-  total: external_exports.number().int().nonnegative(),
-  costCents: external_exports.number().nonnegative()
-});
-var CoordinatorPromptSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().min(1),
-  productId: external_exports.string().min(1),
-  draftedAt: external_exports.coerce.date(),
-  inputPayload: CoordinatorPromptInputPayloadSchema,
-  markdown: external_exports.string().min(1),
-  metadata: external_exports.object({
-    tokensUsed: CoordinatorPromptTokensUsedSchema.optional(),
-    model: external_exports.string().optional(),
-    templateVersion: external_exports.string().optional()
-  }).catchall(external_exports.unknown()).optional()
-});
-var CreateCoordinatorPromptInputSchema = external_exports.object({
-  productId: external_exports.string().min(1),
-  inputPayload: CoordinatorPromptInputPayloadSchema,
-  markdown: external_exports.string().min(1),
-  metadata: external_exports.record(external_exports.unknown()).optional(),
-  draftedAt: external_exports.coerce.date().optional()
-});
-var ListCoordinatorPromptsInputSchema = external_exports.object({
-  productId: external_exports.string().min(1).optional(),
-  since: external_exports.coerce.date().optional()
-});
-
-// ../shared/src/schemas/inbox-triage.ts
-var InboxTriageClassificationSchema = external_exports.enum([
-  "needs_reply",
-  "fyi",
-  "waiting",
-  "escalate"
-]);
-var InboxTriageLegacyUrgencySchema = external_exports.enum(["needs_reply", "fyi", "noise", "escalation"]);
-var InboxTriageThreadSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  subject: external_exports.string().min(1),
-  from: external_exports.string(),
-  to: external_exports.string(),
-  snippet: external_exports.string(),
-  labels: external_exports.array(external_exports.string()),
-  unread: external_exports.boolean(),
-  needsReply: external_exports.boolean(),
-  updatedAt: external_exports.string().min(1),
-  url: external_exports.string().min(1),
-  messageCount: external_exports.number().int().nonnegative()
-});
-var InboxTriageResultSchema = external_exports.object({
-  threadId: external_exports.string().min(1),
-  classification: InboxTriageClassificationSchema,
-  confidence: external_exports.number().min(0).max(1),
-  reason: external_exports.string(),
-  labelName: external_exports.string(),
-  applied: external_exports.boolean(),
-  error: external_exports.string().optional()
-});
-var TriageInboxUsageSchema = external_exports.object({
-  input_tokens: external_exports.number().int().nonnegative(),
-  output_tokens: external_exports.number().int().nonnegative(),
-  cached_tokens: external_exports.number().int().nonnegative().optional(),
-  cost_cents: external_exports.number().nonnegative()
-});
-var TriageInboxResultSchema = external_exports.object({
-  productId: external_exports.string().min(1),
-  results: external_exports.array(InboxTriageResultSchema),
-  usage: TriageInboxUsageSchema.optional()
-});
-
-// ../shared/src/schemas/inference-usage.ts
-var InferenceUsageSurfaceSchema = external_exports.string().min(1).max(80).regex(/^[a-z][a-z0-9_-]*$/);
-var RecordInferenceUsageInputSchema = external_exports.object({
-  product: external_exports.string().min(1).optional(),
-  surface: InferenceUsageSurfaceSchema,
-  model: external_exports.string().min(1).max(120),
-  inputTokens: external_exports.number().int().nonnegative(),
-  outputTokens: external_exports.number().int().nonnegative(),
-  cachedTokens: external_exports.number().int().nonnegative().default(0),
-  costCents: external_exports.number().nonnegative(),
-  timestamp: external_exports.coerce.date().optional()
-});
-var InferenceUsageBreakdownQuerySchema = external_exports.object({
-  from: external_exports.coerce.date(),
-  to: external_exports.coerce.date()
-});
-var InferenceUsageGroupSchema = external_exports.object({
-  calls: external_exports.number().int().nonnegative(),
-  costCents: external_exports.number().nonnegative(),
-  inputTokens: external_exports.number().int().nonnegative(),
-  outputTokens: external_exports.number().int().nonnegative(),
-  cachedTokens: external_exports.number().int().nonnegative()
-});
-var InferenceUsageBreakdownSchema = external_exports.object({
-  from: external_exports.string().datetime(),
-  to: external_exports.string().datetime(),
-  totals: InferenceUsageGroupSchema,
-  bySurface: external_exports.array(InferenceUsageGroupSchema.extend({ surface: InferenceUsageSurfaceSchema })),
-  byModel: external_exports.array(InferenceUsageGroupSchema.extend({ model: external_exports.string().min(1) }))
-});
-
-// ../shared/src/schemas/product-health.ts
-var DEFAULT_PRODUCT_HEALTH_INTERVAL_SECONDS = 24 * 60 * 60;
-var ISO_DATE_STRING = external_exports.string().datetime({ offset: true }).describe("ISO-8601 timestamp with timezone offset.");
-var ProductHealthStatusSchema = external_exports.enum(["healthy", "degraded", "halted"]);
-var ProductHealthDetailsSchema = external_exports.record(external_exports.unknown()).superRefine((details, ctx) => {
-  const credentialPath = findCredentialLikePath(details);
-  if (!credentialPath) return;
-  ctx.addIssue({
-    code: external_exports.ZodIssueCode.custom,
-    message: `Product health details must not contain credentials (${credentialPath}).`
-  });
-});
-var ProductHealthReportInputSchema = external_exports.object({
-  productId: external_exports.string().min(1).max(120),
-  status: ProductHealthStatusSchema,
-  lastActivityAt: ISO_DATE_STRING,
-  summary: external_exports.string().min(1).max(1e3),
-  details: ProductHealthDetailsSchema.optional(),
-  reportedAt: ISO_DATE_STRING,
-  expectedIntervalSeconds: external_exports.number().int().positive().optional()
-});
-var StoredProductHealthReportSchema = ProductHealthReportInputSchema.extend({
-  expectedIntervalSeconds: external_exports.number().int().positive()
-});
-var ProductLivenessStateSchema = external_exports.enum([
-  "healthy",
-  "degraded",
-  "halted",
-  "stale",
-  "unknown"
-]);
-var ProductLivenessSnapshotEntrySchema = external_exports.object({
-  productId: external_exports.string().min(1),
-  state: ProductLivenessStateSchema,
-  flagged: external_exports.boolean(),
-  status: ProductHealthStatusSchema.optional(),
-  lastActivityAt: ISO_DATE_STRING.optional(),
-  reportedAt: ISO_DATE_STRING.optional(),
-  expectedIntervalSeconds: external_exports.number().int().positive(),
-  ageSeconds: external_exports.number().int().nonnegative().nullable(),
-  summary: external_exports.string()
-});
-function findCredentialLikePath(value, path = []) {
-  if (!value || typeof value !== "object") return null;
-  if (Array.isArray(value)) {
-    for (const [index, item] of value.entries()) {
-      const match = findCredentialLikePath(item, [...path, String(index)]);
-      if (match) return match;
-    }
-    return null;
-  }
-  for (const [key, nested] of Object.entries(value)) {
-    const nextPath = [...path, key];
-    if (/(?:secret|token|password|credential|api[-_]?key|private[-_]?key)/i.test(key)) {
-      return nextPath.join(".");
-    }
-    const match = findCredentialLikePath(nested, nextPath);
-    if (match) return match;
-  }
-  return null;
-}
-
-// ../shared/src/schemas/interaction-trace.ts
-var InteractionTraceVerificationSignalSchema = external_exports.enum([
-  "no_signal",
-  "human_accepted_output",
-  "human_rejected_output",
-  "ci_pr_succeeded",
-  "ci_pr_failed",
-  "brief_accepted",
-  "brief_rejected",
-  "standup_completed",
-  "standup_failed"
-]);
-var InteractionTraceVerificationSchema = external_exports.object({
-  success: external_exports.boolean(),
-  signal: InteractionTraceVerificationSignalSchema,
-  confidence: external_exports.number().min(0).max(1),
-  reason: external_exports.string().min(1).max(1e3)
-});
-var InteractionTraceActorSchema = external_exports.object({
-  type: external_exports.enum(["human", "agent", "system"]),
-  id: external_exports.string().min(1).max(200),
-  name: external_exports.string().min(1).max(200).optional()
-});
-var RecordInteractionTraceInputSchema = external_exports.object({
-  product: external_exports.string().min(1).max(120),
-  intent: external_exports.string().min(1).max(500),
-  actionSummary: external_exports.string().min(1).max(4e3),
-  outcomeSummary: external_exports.string().min(1).max(4e3),
-  model: external_exports.string().min(1).max(200).nullable().optional(),
-  actor: InteractionTraceActorSchema,
-  occurredAt: external_exports.string().datetime().optional(),
-  verification: InteractionTraceVerificationSchema.optional(),
-  metadata: external_exports.record(external_exports.unknown()).optional()
-});
-var StoredInteractionTraceSchema = RecordInteractionTraceInputSchema.extend({
-  id: external_exports.string().uuid(),
-  occurredAt: external_exports.string().datetime(),
-  createdAt: external_exports.string().datetime(),
-  verification: InteractionTraceVerificationSchema
-});
-var InteractionTraceQualityScoreSchema = external_exports.number().min(0).max(1);
-var RetrieveRelevantTracesQuerySchema = external_exports.object({
-  product: external_exports.string().min(1).max(120),
-  intent: external_exports.string().min(1).max(500),
-  limit: external_exports.number().int().positive().max(10).optional()
-});
-var RetrievedInteractionTraceSchema = StoredInteractionTraceSchema.extend({
-  score: external_exports.number().min(0).max(1),
-  qualityScore: InteractionTraceQualityScoreSchema
-});
-
-// ../shared/src/schemas/maeve-lesson.ts
-var MaeveLessonStatusSchema = external_exports.enum(["candidate", "verified", "retired"]);
-var MaeveLessonEvidenceSchema = external_exports.object({
-  source: external_exports.enum(["interaction_trace", "artifact"]),
-  traceId: external_exports.string().uuid().optional(),
-  artifact: external_exports.string().min(1).max(1e3).optional(),
-  summary: external_exports.string().min(1).max(1e3),
-  hash: external_exports.string().regex(/^sha256:[a-f0-9]{64}$/)
-});
-var MaeveLessonSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  product: external_exports.string().min(1).max(120),
-  statement: external_exports.string().min(1).max(1e3),
-  scope: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  tags: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  evidence: external_exports.array(MaeveLessonEvidenceSchema),
-  status: MaeveLessonStatusSchema,
-  createdAt: external_exports.string().datetime(),
-  lastSeenAt: external_exports.string().datetime()
-});
-var CreateMaeveLessonInputSchema = external_exports.object({
-  product: external_exports.string().min(1).max(120),
-  statement: external_exports.string().min(1).max(1e3),
-  scope: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  tags: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  evidence: external_exports.array(MaeveLessonEvidenceSchema).default([]),
-  status: MaeveLessonStatusSchema.default("candidate"),
-  lastSeenAt: external_exports.string().datetime().optional()
-});
-var PromoteMaeveLessonInputSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  status: MaeveLessonStatusSchema,
-  appendEvidence: external_exports.array(MaeveLessonEvidenceSchema).optional()
-});
-var RecallMaeveLessonsQuerySchema = external_exports.object({
-  product: external_exports.string().min(1).max(120).optional(),
-  taskType: external_exports.string().min(1).max(120).optional(),
-  tags: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  limit: external_exports.number().int().positive().max(10).default(5),
-  /**
-   * Free-text query for semantic (pgvector cosine) recall. When set and an
-   * EmbeddingProvider is configured, recallMaeveLessons embeds this text and
-   * retrieves by cosine similarity, with exact-tag matches as a boost.
-   * Falls back to exact-class matching when the provider is NoOp.
-   */
-  semanticQuery: external_exports.string().min(1).max(500).optional()
-});
-var MaeveLessonSeedAnchorSchema = external_exports.object({
-  commit: external_exports.string().regex(/^[0-9a-f]{40}$/i, "commit must be a full 40-character git SHA"),
-  pr: external_exports.number().int().positive().nullable(),
-  summary: external_exports.string().min(1).max(1e3)
-});
-var MaeveLessonSeedSchema = external_exports.object({
-  statement: external_exports.string().min(1).max(1e3),
-  scope: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  tags: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  anchors: external_exports.array(MaeveLessonSeedAnchorSchema).min(1),
-  lastSeenAt: external_exports.string().datetime()
-});
-var ReviewFindingSeveritySchema = external_exports.enum(["critical", "high", "medium", "low"]);
-var ReviewFindingLessonInputSchema = external_exports.object({
-  studioId: external_exports.string().min(1),
-  findingStudioId: external_exports.string().min(1),
-  product: external_exports.string().min(1).max(120),
-  repository: external_exports.string().min(1).max(240),
-  pullRequestNumber: external_exports.number().int().positive(),
-  findingText: external_exports.string().min(1).max(4e3),
-  severity: ReviewFindingSeveritySchema,
-  reviewer: external_exports.string().min(1).max(120),
-  remediatingCommitSha: external_exports.string().min(4).max(64),
-  /** The durable, reusable rule distilled from the finding — NOT the finding text verbatim. */
-  lessonStatement: external_exports.string().min(1).max(1e3),
-  scope: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  tags: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  occurredAt: external_exports.string().datetime()
-});
-
-// ../shared/src/schemas/operator-trace.ts
-var TRACE_ACTORS = [
-  "human",
-  "cowork",
-  "claude-code",
-  "codex",
-  "goal-runner",
-  "ci"
-];
-var TraceActorSchema = external_exports.enum(TRACE_ACTORS);
-var TRACE_SOURCES = [
-  "shell",
-  "cowork",
-  "claude-code",
-  "codex",
-  "goal-runner",
-  "github"
-];
-var TraceSourceSchema = external_exports.enum(TRACE_SOURCES);
-var TraceProvenanceSchema = external_exports.object({
-  source: TraceSourceSchema,
-  /** Absolute path of the source file/dir, or the gh query for CI events. */
-  path: external_exports.string().min(1).max(1e3),
-  /** Line number, session id, or PR number locating the row inside the source. */
-  locator: external_exports.string().min(1).max(200).optional()
-});
-var TraceRecordSchema = external_exports.object({
-  t: external_exports.string().datetime(),
-  actor: TraceActorSchema,
-  action: external_exports.string().min(1).max(2e3),
-  target: external_exports.string().max(1e3).default(""),
-  outcome: external_exports.string().max(2e3).default(""),
-  product: external_exports.string().min(1).max(120).optional(),
-  provenance: TraceProvenanceSchema
-});
-var ShellRedactionSchema = external_exports.enum(["none", "secret", "unclassified"]);
-var ShellTraceEntrySchema = external_exports.object({
-  ts: external_exports.string().datetime(),
-  cwd: external_exports.string().min(1).max(1e3),
-  command: external_exports.string().min(1).max(4e3),
-  exitCode: external_exports.number().int(),
-  shellSessionId: external_exports.string().min(1).max(200),
-  redaction: ShellRedactionSchema
-});
-var TraceSourceReportSchema = external_exports.discriminatedUnion("status", [
-  external_exports.object({
-    status: external_exports.literal("ok"),
-    source: TraceSourceSchema,
-    recordCount: external_exports.number().int().nonnegative(),
-    /** Files/entries present but skipped (unparseable, filtered) — named, not silent. */
-    skipped: external_exports.array(external_exports.string().min(1).max(500)).default([])
-  }),
-  external_exports.object({
-    status: external_exports.literal("dark"),
-    source: TraceSourceSchema,
-    reason: external_exports.string().min(1).max(500)
-  })
-]);
-var OperatorTimelineSchema = external_exports.object({
-  records: external_exports.array(TraceRecordSchema),
-  sources: external_exports.array(TraceSourceReportSchema)
-});
-
-// ../shared/src/schemas/witan.ts
+// src/witan/schemas.ts
 var WITAN_RUBRIC_VERSION_V1 = "witan-rubric-v1-2026-06-24";
 var WITAN_RUBRIC_VERSION_V2 = "witan-rubric-v2-2026-07-12";
 var WITAN_RUBRIC_VERSION_V3 = "witan-rubric-v3-2026-07-13";
@@ -5391,11 +4544,9 @@ var WITAN_TRADING_RUBRIC_V0_CRITERION_IDS = [
   "audit-completeness",
   "claim-reality"
 ];
-var WITAN_QUANT_INTEGRITY_RUBRIC_V0_CRITERION_IDS = ["quant-integrity"];
 var WitanCriterionIdSchema = external_exports.enum([
   ...WITAN_CRITERION_IDS,
-  ...WITAN_TRADING_RUBRIC_V0_CRITERION_IDS,
-  ...WITAN_QUANT_INTEGRITY_RUBRIC_V0_CRITERION_IDS
+  ...WITAN_TRADING_RUBRIC_V0_CRITERION_IDS
 ]);
 var WitanTradingCriterionIdSchema = external_exports.enum(WITAN_TRADING_RUBRIC_V0_CRITERION_IDS);
 var WitanCriterionCategorySchema = external_exports.enum([
@@ -5423,8 +4574,6 @@ var WitanEvidenceKindSchema = external_exports.enum([
   "commit",
   "coverage",
   "dependency_report",
-  "dispatch_log",
-  "maeve_trace",
   "prod_check",
   "pull_request",
   "repository",
@@ -5446,7 +4595,10 @@ var WitanEvidencePointerSchema = external_exports.object({
   label: external_exports.string().min(1).max(180),
   url: external_exports.string().url().optional(),
   path: external_exports.string().min(1).max(700).optional(),
-  line: external_exports.number().int().positive().optional(),
+  // Explicit null means the finding is file-scoped and no real match position was measured —
+  // never a fabricated line (e.g. `1`) standing in for a position the detector never found
+  // (goal_cejel_a2_one_notion_of_production_code_2026-07-13).
+  line: external_exports.number().int().positive().nullable().optional(),
   contentHash: external_exports.string().min(8).max(160).optional(),
   capturedAt: external_exports.string().datetime({ offset: true }).optional()
 }).strict().refine((value) => Boolean(value.url ?? value.path ?? value.contentHash), {
@@ -5558,981 +4710,124 @@ var WitanReportSchema = external_exports.object({
   archetype: WitanRepoArchetypeSchema.optional(),
   insufficientSourceReason: external_exports.string().min(1).max(2e3).optional()
 }).strict();
-
-// ../shared/src/schemas/work-item.ts
-var WorkItemTypeSchema = external_exports.enum(["feature", "bug"]);
-var WorkItemPrioritySchema = external_exports.enum(["low", "normal", "high", "urgent"]);
-var WorkItemStatusSchema = external_exports.enum([
-  "submitted",
-  "scoped",
-  "dispatched",
-  "pr_open",
-  "done",
-  "declined"
-]);
-var CreateWorkItemInputSchema = external_exports.object({
-  productId: external_exports.string().uuid(),
-  type: WorkItemTypeSchema,
-  title: external_exports.string().min(3).max(180),
-  description: external_exports.string().min(8).max(2e4),
-  acceptanceCriteria: external_exports.string().max(2e4).optional(),
-  priority: WorkItemPrioritySchema.default("normal")
-}).strict();
-var ScopeWorkItemInputSchema = external_exports.object({
-  scopedTask: external_exports.string().min(8).max(2e4).optional()
-}).strict();
-var ListWorkItemsQuerySchema = external_exports.object({
-  productId: external_exports.string().uuid().optional(),
-  status: WorkItemStatusSchema.optional()
-}).strict();
-var DispatchWorkItemInputSchema = external_exports.object({
-  executor: external_exports.enum(["claude-code", "codex"]).default("codex"),
-  mode: external_exports.enum(["dry-run", "execute"]).default("dry-run")
-}).strict();
-
-// ../shared/src/schemas/goal-frontmatter.ts
-var GoalStreamKindSchema = external_exports.enum(["code", "process"]);
-var GoalPrioritySchema = external_exports.enum(["p0", "p1", "p2"]);
-var GoalFrontmatterExtrasSchema = external_exports.object({
-  stream: external_exports.string().min(1).nullable().default(null),
-  order: external_exports.number().int().nullable().default(null),
-  dependsOn: external_exports.array(external_exports.string().min(1)).default([]),
-  priority: GoalPrioritySchema.nullable().default(null),
-  kind: GoalStreamKindSchema.default("code")
-});
-
-// ../shared/src/schemas/stream.ts
-var StreamSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  name: external_exports.string().min(1).max(120),
-  tag: external_exports.string().max(60).nullable(),
-  kind: GoalStreamKindSchema,
-  orderIndex: external_exports.number().int(),
-  createdAt: external_exports.coerce.date(),
-  updatedAt: external_exports.coerce.date()
-});
-var StreamItemSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  streamId: external_exports.string().uuid(),
-  orderIndex: external_exports.number().int(),
-  title: external_exports.string().min(1).max(200),
-  /** docs/orchestration/goal_*.md filename (no extension) for code items; null for process items. */
-  goalName: external_exports.string().min(1).nullable(),
-  refLabel: external_exports.string().max(60).nullable(),
-  /** Free-form governed-run prompt text (mirrors the prototype's per-item `run` string). Null = no run control shown. */
-  runPrompt: external_exports.string().min(1).nullable(),
-  createdAt: external_exports.coerce.date(),
-  updatedAt: external_exports.coerce.date()
-});
-var StreamItemDisplayStatusSchema = external_exports.enum([
-  "done",
-  "in-review",
-  "running",
-  "queued",
-  "blocked",
-  "local-unknown"
-]);
-
-// ../shared/src/schemas/runner-dispatch.ts
-var RUNNER_DISPATCH_MODES = ["dry-run", "execute"];
-var RunnerDispatchModeSchema = external_exports.enum(RUNNER_DISPATCH_MODES);
-var RUNNER_DISPATCH_STATUSES = ["queued", "claimed", "running", "done", "failed"];
-var RunnerDispatchStatusSchema = external_exports.enum(RUNNER_DISPATCH_STATUSES);
-var GOAL_CARD_PATTERN = /^docs\/orchestration\/[A-Za-z0-9_./-]+\.md$/;
-function isAllowedGoalCardPath(goalCard) {
-  if (!GOAL_CARD_PATTERN.test(goalCard)) return false;
-  return goalCard.split("/").every((segment) => segment !== "." && segment !== "..");
-}
-var GoalCardPathSchema = external_exports.string().min(1).max(300).refine(isAllowedGoalCardPath, { message: "goal_card_invalid" });
-var RunnerDispatchRequestSchema = external_exports.object({
-  goalCard: GoalCardPathSchema,
-  stream: external_exports.string().min(1).max(120).optional(),
-  mode: RunnerDispatchModeSchema
-});
-
-// ../shared/src/schemas/witan-metrics-manifest.ts
-var WITAN_METRICS_MANIFEST_SCHEMA_VERSION = "witan-metrics-manifest-v0";
-var WitanMetricsManifestReturnsFrequencySchema = external_exports.enum([
-  "daily",
-  "weekly",
-  "monthly",
-  "annual"
-]);
-var WitanMetricsManifestFoldSchema = external_exports.object({
-  foldId: external_exports.string().min(1).max(80),
-  inSampleSharpe: external_exports.number().optional(),
-  outOfSampleSharpe: external_exports.number().optional()
-}).strict();
-var WitanMetricsManifestCscvTrialSchema = external_exports.object({
-  trialId: external_exports.string().min(1).max(80),
-  blockReturns: external_exports.array(external_exports.number()).min(2)
-}).strict();
-var WitanMetricsManifestCscvSchema = external_exports.object({
-  // Must be even (split into IS/OOS halves) — enforced by the grader, not the schema.
-  blocks: external_exports.number().int().min(4).max(16),
-  trials: external_exports.array(WitanMetricsManifestCscvTrialSchema).min(2).max(200)
-}).strict();
-var WitanMetricsManifestCostModelSchema = external_exports.object({
-  feeBps: external_exports.number().min(0).optional(),
-  slippageBps: external_exports.number().min(0).optional(),
-  borrowBps: external_exports.number().min(0).optional(),
-  notes: external_exports.string().min(1).max(300).optional()
-}).strict();
-var WitanMetricsManifestParameterPointSchema = external_exports.object({
-  // Human-readable label for this point (e.g. "72" or "72 bars") — evidence/display only.
-  paramLabel: external_exports.string().min(1).max(80),
-  // The point's position on its swept axis, used to find its nearest neighbors by distance.
-  paramValue: external_exports.number(),
-  outOfSampleSharpe: external_exports.number()
-}).strict();
-var WitanMetricsManifestParameterSweepSchema = external_exports.object({
-  // Name of the swept parameter (e.g. "lookback_bars") — evidence/display only.
-  paramName: external_exports.string().min(1).max(80),
-  points: external_exports.array(WitanMetricsManifestParameterPointSchema).min(3).max(500)
-}).strict();
-var WitanMetricsManifestLabelSourceSchema = external_exports.enum([
-  "real_forward_returns",
-  "synthetic",
-  "unknown"
-]);
-var WitanMetricsManifestSchema = external_exports.object({
-  schemaVersion: external_exports.literal(WITAN_METRICS_MANIFEST_SCHEMA_VERSION),
-  strategyName: external_exports.string().min(1).max(200).optional(),
-  // The headline reported Sharpe ratio the target repo is claiming.
-  reportedSharpe: external_exports.number(),
-  // How many trials/backtests were run in the search that produced reportedSharpe (the
-  // "1-of-42" count) — required so the grader can correct for selection bias.
-  trialCount: external_exports.number().int().positive(),
-  // Track-record length in return observations (e.g. 252 for a year of daily returns) —
-  // the `n` in the Probabilistic/Deflated Sharpe Ratio formula.
-  trackRecordObservations: external_exports.number().int().positive(),
-  returnsFrequency: WitanMetricsManifestReturnsFrequencySchema.default("daily"),
-  // Skew/kurtosis of the returns distribution; default to the normal-distribution values
-  // (0 skew, kurtosis 3) when the repo does not report them.
-  skewness: external_exports.number().default(0),
-  kurtosis: external_exports.number().min(0).default(3),
-  // Whether reportedSharpe is net of trading costs (fees/slippage/borrow/roll).
-  netOfCosts: external_exports.boolean(),
-  costModel: WitanMetricsManifestCostModelSchema.optional(),
-  // Per-fold in-sample vs out-of-sample breakdown, when the repo reports one.
-  folds: external_exports.array(WitanMetricsManifestFoldSchema).default([]),
-  // Per-trial, per-block performance matrix for the CSCV/PBO computation, when available.
-  cscv: WitanMetricsManifestCscvSchema.optional(),
-  // Parameter-sweep breakdown for the run-tier (L3b) parameter-neighborhood robustness
-  // grader, when the run swept a parameter (e.g. a lookback window) and recorded OOS
-  // performance at each swept value.
-  parameterSweep: WitanMetricsManifestParameterSweepSchema.optional(),
-  // Provenance of the labels behind reportedSharpe (labelling-integrity, L1+artifact tier).
-  labelSource: WitanMetricsManifestLabelSourceSchema.optional()
-}).strict();
-
-// ../shared/src/schemas/witan-strategy-adapter.ts
-var WITAN_STRATEGY_ADAPTER_CONFIG_SCHEMA_VERSION = "witan-strategy-adapter-v0";
-var WitanStrategyAdapterConfigSchema = external_exports.object({
-  schemaVersion: external_exports.literal(WITAN_STRATEGY_ADAPTER_CONFIG_SCHEMA_VERSION),
-  // Argv for the strategy entrypoint, e.g. ["python3", "strategy.py"] or ["node", "run.mjs"].
-  // Command-argv (not a language enum) is what keeps the adapter language-agnostic — most
-  // real targets are Python, but the contract does not assume it.
-  command: external_exports.array(external_exports.string().min(1).max(300)).min(1).max(20),
-  // Relative path (within the target repo) to the data the strategy should backtest against.
-  dataPath: external_exports.string().min(1).max(500).optional(),
-  // Backtest window, as the target repo defines its own date strings (ISO-8601 recommended).
-  // Optional — a strategy may declare its own default window instead.
-  windowStart: external_exports.string().min(1).max(40).optional(),
-  windowEnd: external_exports.string().min(1).max(40).optional(),
-  // Relative path (within the sandboxed workspace) the entrypoint must write its raw result
-  // to — see WitanStrategyRunResultSchema below.
-  outputPath: external_exports.string().min(1).max(300).default("witan-run-result.json"),
-  timeoutMs: external_exports.number().int().positive().max(30 * 60 * 1e3).default(2 * 60 * 1e3),
-  // Explicit opt-in egress allowlist. Empty by default — no network from the sandboxed run
-  // unless the target repo explicitly whitelists hosts here.
-  allowedHosts: external_exports.array(external_exports.string().min(1).max(255)).max(20).default([])
-}).strict();
-var WitanStrategyRunResultSchema = WitanMetricsManifestSchema.omit({
-  schemaVersion: true
-});
-
-// ../shared/src/types/tactical-action.ts
-var TacticalActionTypeSchema = external_exports.enum([
-  "merge_pr_auto_merge_safe",
-  "deploy_staging",
-  "acknowledge_canary_alert",
-  "update_status_md",
-  "provision_product",
-  "dispatch_dev_task"
-]);
-var TacticalActionStatusSchema = external_exports.enum(["executed", "blocked", "dry_run"]);
-var TacticalActionPolicySchema = external_exports.object({
-  studioId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid(),
-  actionType: TacticalActionTypeSchema,
-  allowed: external_exports.boolean(),
-  dryRun: external_exports.boolean(),
-  promotedAt: external_exports.coerce.date().nullable(),
-  forceEnableReason: external_exports.string().nullable()
-});
-var BaseActionSchema = external_exports.object({
-  actionType: TacticalActionTypeSchema,
-  productId: external_exports.string().uuid(),
-  coordinatorSessionId: external_exports.string().uuid().nullable().optional(),
-  customerFacingProduction: external_exports.boolean().default(false)
-});
-var MergePrTacticalActionSchema = BaseActionSchema.extend({
-  actionType: external_exports.literal("merge_pr_auto_merge_safe"),
-  repository: external_exports.string().min(1),
-  pullRequestNumber: external_exports.number().int().positive(),
-  labels: external_exports.array(external_exports.string()),
-  ciStatus: external_exports.enum(["green", "red", "unknown"]),
-  humanApprovals: external_exports.number().int().nonnegative(),
-  coworkClaudeApprovedStatus: external_exports.enum(["green", "red", "unknown"]),
-  // The PR head SHA captured at the SAME live precondition snapshot that
-  // verified the label/CI/approvals/cowork-claude-approved gates. Threaded
-  // through to the GitHub merge call as the conditional `sha` parameter so a
-  // commit that lands between the snapshot and the merge (a fast follow-up
-  // push, or a re-triggered CI run resetting status) can never be
-  // squash-merged unverified — GitHub rejects the merge with 409 instead.
-  headSha: external_exports.string().min(1)
-});
-var DeployStagingTacticalActionSchema = BaseActionSchema.extend({
-  actionType: external_exports.literal("deploy_staging"),
-  environment: external_exports.literal("staging"),
-  mainStatus: external_exports.enum(["green", "red", "unknown"]),
-  stagingStatus: external_exports.enum(["green", "red", "unknown"])
-});
-var AcknowledgeCanaryAlertTacticalActionSchema = BaseActionSchema.extend({
-  actionType: external_exports.literal("acknowledge_canary_alert"),
-  alertId: external_exports.string().min(1),
-  fingerprint: external_exports.string().min(1),
-  knownFalsePositiveFingerprints: external_exports.array(external_exports.string()).default([])
-});
-var UpdateStatusMdTacticalActionSchema = BaseActionSchema.extend({
-  actionType: external_exports.literal("update_status_md"),
-  source: external_exports.literal("daily_brief_synthesis"),
-  statusMarkdown: external_exports.string().min(1).max(2e4)
-});
-var ProvisionProductTacticalActionSchema = BaseActionSchema.extend({
-  actionType: external_exports.literal("provision_product"),
-  productName: external_exports.string().min(1).max(80),
-  vertical: external_exports.string().min(1).max(80),
-  repoTarget: external_exports.string().min(1),
-  templateRef: external_exports.string().min(1),
-  scopeNotes: external_exports.string().max(2e3).optional()
-});
-var DispatchDevTaskTacticalActionSchema = BaseActionSchema.extend({
-  actionType: external_exports.literal("dispatch_dev_task"),
-  repo: RepoRefSchema,
-  task: external_exports.string().min(1).max(2e4),
-  executor: CodingAgentExecutorSchema
-});
-var TacticalActionSchema = external_exports.discriminatedUnion("actionType", [
-  MergePrTacticalActionSchema,
-  DeployStagingTacticalActionSchema,
-  AcknowledgeCanaryAlertTacticalActionSchema,
-  UpdateStatusMdTacticalActionSchema,
-  ProvisionProductTacticalActionSchema,
-  DispatchDevTaskTacticalActionSchema
-]);
-var TacticalActionContextSchema = external_exports.object({
-  studioId: external_exports.string().uuid(),
-  actorUserId: external_exports.string().uuid().nullable().optional(),
-  requestedAt: external_exports.coerce.date().optional()
-});
-var TacticalActionPermitResultSchema = external_exports.discriminatedUnion("status", [
-  external_exports.object({
-    status: external_exports.literal("executed"),
-    auditLogId: external_exports.string().uuid(),
-    reason: external_exports.literal("permit_allowed")
-  }),
+var WITAN_ATTESTATION_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
+var WITAN_ATTESTATION_PREDICATE_TYPE = "https://cejel.dev/attestations/scan/v1";
+var WitanAttestationOutcomeSchema = external_exports.discriminatedUnion("status", [
   external_exports.object({
-    status: external_exports.literal("blocked"),
-    auditLogId: external_exports.string().uuid().optional(),
-    reason: external_exports.string().min(1)
-  }),
+    status: external_exports.literal("scored"),
+    overallScore: external_exports.number().min(0).max(4),
+    codeTrustScore: external_exports.number().min(0).max(4),
+    processTrustScore: external_exports.number().min(0).max(4)
+  }).strict(),
   external_exports.object({
-    status: external_exports.literal("dry_run"),
-    auditLogId: external_exports.string().uuid(),
-    reason: external_exports.literal("dry_run_mode"),
-    wouldHaveDone: external_exports.record(external_exports.unknown())
-  })
-]);
-var TacticalActionLogEntrySchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid(),
-  product: external_exports.string().nullable().optional(),
-  coordinatorSessionId: external_exports.string().uuid().nullable(),
-  actionType: TacticalActionTypeSchema.or(external_exports.string()),
-  context: external_exports.record(external_exports.unknown()),
-  permitResult: external_exports.record(external_exports.unknown()),
-  status: TacticalActionStatusSchema,
-  outcome: external_exports.string().nullable(),
-  wouldHaveDone: external_exports.record(external_exports.unknown()).nullable(),
-  attemptedAt: external_exports.string(),
-  executedAt: external_exports.string().nullable()
-});
-
-// ../shared/src/schemas/index.ts
-var StudioSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  name: external_exports.string().min(1).max(100),
-  billingStatus: external_exports.enum(["trial", "active", "past_due", "cancelled"]),
-  planTier: external_exports.enum(["trial", "solo", "studio", "studio_plus", "self_hosted", "enterprise"]),
-  onPrem: external_exports.boolean().default(false),
-  createdAt: external_exports.coerce.date()
-});
-var HumanSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  email: external_exports.string().email(),
-  name: external_exports.string().min(1).max(120),
-  oauthProviders: external_exports.array(external_exports.enum(["google", "microsoft", "apple"])).default([]),
-  role: external_exports.enum(["owner", "member", "advisor", "per_product"]),
-  timezone: external_exports.string(),
-  briefTime: external_exports.string().regex(/^\d{2}:\d{2}$/),
-  createdAt: external_exports.coerce.date()
-});
-var ProductSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  name: external_exports.string().min(1).max(80),
-  slug: external_exports.string().regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/),
-  status: external_exports.enum(["active", "snoozed", "wound_down", "deleted"]),
-  description: external_exports.string().max(280).optional(),
-  repoUrl: external_exports.string().url().optional(),
-  calendarTag: external_exports.string().optional(),
-  emailLabelPrefix: external_exports.string().optional(),
-  colorHex: external_exports.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
-  scheduleBriefTime: external_exports.string().regex(/^\d{2}:\d{2}$/).optional(),
-  briefTemplateId: external_exports.string().uuid().optional(),
-  regulated: external_exports.boolean().default(false),
-  createdAt: external_exports.coerce.date(),
-  lastTouchedAt: external_exports.coerce.date()
-});
-var AgentSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid(),
-  agentType: external_exports.enum(["codex", "claude-code", "cowork", "cursor", "cline", "aider", "other"]),
-  sessionId: external_exports.string().optional(),
-  status: external_exports.enum(["active", "idle", "registered", "archived"]),
-  registeredAt: external_exports.coerce.date(),
-  lastActiveAt: external_exports.coerce.date().optional(),
-  totalCostCentsLifetime: external_exports.number().int().nonnegative().default(0)
-});
-var AgentRunSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  agentId: external_exports.string().uuid(),
-  coordinatorSessionId: external_exports.string().uuid().nullable().optional(),
-  startedAt: external_exports.coerce.date(),
-  completedAt: external_exports.coerce.date().optional(),
-  actionType: external_exports.string(),
-  toolName: external_exports.string().optional(),
-  toolInputSummary: external_exports.string().optional(),
-  toolOutputSummary: external_exports.string().optional(),
-  tokensUsedInput: external_exports.number().int().nonnegative().default(0),
-  tokensUsedOutput: external_exports.number().int().nonnegative().default(0),
-  costCents: external_exports.number().int().nonnegative().default(0),
-  durationMs: external_exports.number().int().nonnegative().default(0),
-  resultStatus: external_exports.enum(["success", "failure", "partial", "timeout"]).optional(),
-  resultSummary: external_exports.string().optional(),
-  filesTouched: external_exports.array(external_exports.string()).default([])
-});
-var CoordinatorStatusSchema = external_exports.enum([
-  "draft",
-  "spawned",
-  "in_progress",
-  "reporting",
-  "closed"
+    status: external_exports.literal("abstained"),
+    reason: external_exports.string().min(1).max(2e3)
+  }).strict()
 ]);
-var CoordinatorEscalationPolicySchema = external_exports.object({
-  stuck_after_hours: external_exports.number().int().positive(),
-  method: external_exports.literal("flag_for_human"),
-  urgency: external_exports.enum(["low", "medium", "high", "critical"]).optional()
-});
-var CoordinatorSessionSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid(),
-  promptId: external_exports.string().uuid().nullable(),
-  objective: external_exports.string(),
-  status: CoordinatorStatusSchema,
-  spawnedAt: external_exports.coerce.date().nullable(),
-  closedAt: external_exports.coerce.date().nullable(),
-  escalationPolicy: CoordinatorEscalationPolicySchema.nullable(),
-  outcomeSummary: external_exports.string().nullable(),
-  createdAt: external_exports.coerce.date()
-});
-var AgentActivityWindowSchema = external_exports.enum(["24h", "7d", "30d"]);
-var AgentCostBucketSchema = external_exports.object({
-  key: external_exports.string(),
-  name: external_exports.string(),
-  runCount: external_exports.number().int().nonnegative(),
-  costUsd: external_exports.number().nonnegative()
-});
-var AgentCostRollupSchema = external_exports.object({
-  window: AgentActivityWindowSchema,
-  studioTotalUsd: external_exports.number().nonnegative(),
-  runCount: external_exports.number().int().nonnegative(),
-  byAgent: external_exports.array(AgentCostBucketSchema),
-  byProduct: external_exports.array(AgentCostBucketSchema)
-});
-var AgentConflictRecordSchema = external_exports.object({
-  file: external_exports.string(),
-  agents: external_exports.array(external_exports.string()).min(2),
-  references: external_exports.array(
+var WitanAttestationStatementSchema = external_exports.object({
+  _type: external_exports.literal(WITAN_ATTESTATION_STATEMENT_TYPE),
+  subject: external_exports.array(
     external_exports.object({
-      runId: external_exports.string(),
-      agent: external_exports.string(),
-      product: external_exports.string().nullable(),
-      startedAt: external_exports.string(),
-      sessionRef: external_exports.string().nullable(),
-      prUrl: external_exports.string().nullable()
-    })
-  )
-});
-var AgentLeaderboardEntrySchema = external_exports.object({
-  agent: external_exports.string(),
-  product: external_exports.string().nullable(),
-  runCount: external_exports.number().int().nonnegative(),
-  completedRuns: external_exports.number().int().nonnegative(),
-  failedRuns: external_exports.number().int().nonnegative(),
-  costUsd: external_exports.number().nonnegative(),
-  filesTouched: external_exports.number().int().nonnegative(),
-  conflicts: external_exports.number().int().nonnegative(),
-  state: external_exports.enum(["productive", "idle", "duplicating"]),
-  lastActiveAt: external_exports.string().nullable()
-});
-var ModelCostEstimateInputSchema = external_exports.object({
-  model: external_exports.string().optional(),
-  inputTokens: external_exports.number().int().nonnegative().default(0),
-  outputTokens: external_exports.number().int().nonnegative().default(0)
-});
-var ModelCostEstimateSchema = external_exports.object({
-  costUsd: external_exports.number().nonnegative(),
-  method: external_exports.enum(["estimated_from_model_rate", "unknown_model_rate"]),
-  rateModel: external_exports.enum(["claude-haiku", "claude-sonnet", "claude-opus", "unknown"])
-});
-var IntegrationSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid().nullable(),
-  kind: external_exports.string(),
-  oauthTokenEncrypted: external_exports.string().optional(),
-  refreshTokenEncrypted: external_exports.string().optional(),
-  status: external_exports.enum(["active", "broken", "revoked"]),
-  lastSyncAt: external_exports.coerce.date().optional(),
-  errorCount: external_exports.number().int().nonnegative().default(0)
-});
-var EmailAccountSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  provider: external_exports.enum(["gmail", "m365", "imap"]),
-  oauthTokenEncrypted: external_exports.string().optional(),
-  defaultLabelPrefix: external_exports.string().optional(),
-  triageCadenceMins: external_exports.number().int().positive().default(240)
-});
-var RoutineSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  productId: external_exports.string().uuid().nullable(),
-  name: external_exports.string(),
-  cronExpression: external_exports.string(),
-  promptTemplate: external_exports.string(),
-  model: external_exports.enum(["sonnet", "opus", "haiku"]).default("sonnet"),
-  lastRunAt: external_exports.coerce.date().optional(),
-  nextRunAt: external_exports.coerce.date().optional(),
-  enabled: external_exports.boolean().default(true),
-  retryCount: external_exports.number().int().nonnegative().default(0)
-});
-var RoutineRunSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  routineId: external_exports.string().uuid(),
-  startedAt: external_exports.coerce.date(),
-  completedAt: external_exports.coerce.date().optional(),
-  status: external_exports.enum(["success", "failed", "retried"]),
-  outputBriefId: external_exports.string().uuid().optional(),
-  errorMessage: external_exports.string().optional(),
-  inferenceCostCents: external_exports.number().int().nonnegative().default(0)
-});
-var BriefSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  generatedAt: external_exports.coerce.date(),
-  type: external_exports.enum(["daily", "weekly", "on_demand"]),
-  html: external_exports.string().optional(),
-  markdown: external_exports.string(),
-  sourceLinks: external_exports.array(external_exports.object({ label: external_exports.string(), url: external_exports.string() })).default([]),
-  shared: external_exports.boolean().default(false),
-  shareToken: external_exports.string().optional(),
-  shareExpiresAt: external_exports.coerce.date().optional(),
-  inferenceCostCents: external_exports.number().int().nonnegative().default(0)
-});
-var MemoryEntrySchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  productId: external_exports.string().uuid(),
-  kind: external_exports.enum(["decision", "fact", "customer", "status", "pattern", "thread"]),
-  content: external_exports.string(),
-  // embedding stored separately in pgvector; not modelled in API layer
-  createdAt: external_exports.coerce.date(),
-  lastReferencedAt: external_exports.coerce.date().optional(),
-  referenceCount: external_exports.number().int().nonnegative().default(0),
-  pinned: external_exports.boolean().default(false)
-});
-var InboxClassificationSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  emailAccountId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid().nullable(),
-  messageId: external_exports.string(),
-  sender: external_exports.string(),
-  labelApplied: external_exports.string(),
-  urgency: external_exports.enum(["needs_reply", "fyi", "noise", "escalation"]),
-  confidence: external_exports.number().min(0).max(1),
-  action: external_exports.enum(["labelled", "archived", "drafted_reply"]),
-  userCorrected: external_exports.boolean().default(false),
-  correctedTo: external_exports.string().optional()
-});
-var DraftReplySchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  classificationId: external_exports.string().uuid(),
-  draftText: external_exports.string(),
-  confidence: external_exports.number().min(0).max(1),
-  sentAt: external_exports.coerce.date().optional(),
-  sentVia: external_exports.string().optional()
-});
-var AlwaysAlertRuleSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  ruleType: external_exports.enum(["sender", "subject", "domain"]),
-  value: external_exports.string(),
-  escalationMethod: external_exports.enum(["push", "slack", "email", "brief_pin"]).default("brief_pin")
-});
-var AuditEventSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  actor: external_exports.enum(["user", "agent", "system"]),
-  action: external_exports.string(),
-  integrationId: external_exports.string().uuid().optional(),
-  productId: external_exports.string().uuid().optional(),
-  timestamp: external_exports.coerce.date(),
-  metadata: external_exports.record(external_exports.unknown()).default({})
-});
-var SubscriptionSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  stripeSubscriptionId: external_exports.string().optional(),
-  tier: external_exports.enum(["trial", "solo", "studio", "studio_plus", "self_hosted", "enterprise"]),
-  seats: external_exports.number().int().positive(),
-  status: external_exports.string(),
-  currentPeriodEnd: external_exports.coerce.date(),
-  cancelAt: external_exports.coerce.date().optional()
-});
-var ProductMembershipSchema = external_exports.object({
-  humanId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid(),
-  role: external_exports.enum(["lead", "contributor", "observer"])
-});
-
-// ../witan/src/batch.ts
-import { execFileSync as execFileSync3 } from "child_process";
-import { mkdirSync as mkdirSync2, writeFileSync } from "fs";
-import { basename as basename2, join as join5 } from "path";
-
-// ../witan/src/public-scan.ts
-import { resolve as resolve2 } from "path";
-
-// ../witan/src/ingest.ts
-import { readFileSync as readFileSync5, readdirSync as readdirSync2 } from "fs";
-import { join as join2 } from "path";
+      name: external_exports.string().min(1).max(300),
+      digest: external_exports.object({
+        sha256: external_exports.string().regex(/^[a-f0-9]{64}$/)
+      }).strict()
+    }).strict()
+  ).length(1),
+  predicateType: external_exports.literal(WITAN_ATTESTATION_PREDICATE_TYPE),
+  predicate: external_exports.object({
+    tool: external_exports.object({
+      name: external_exports.literal("cejel"),
+      version: external_exports.string().min(1).max(80)
+    }).strict(),
+    generatedAt: external_exports.string().datetime({ offset: true }),
+    rubricVersion: external_exports.string().min(1).max(120),
+    repository: external_exports.object({
+      productSlug: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/),
+      url: external_exports.string().url().optional(),
+      headSha: external_exports.string().min(7).max(64).optional()
+    }).strict(),
+    report: external_exports.object({
+      artifact: external_exports.literal("report.json"),
+      sha256: external_exports.string().regex(/^[a-f0-9]{64}$/)
+    }).strict(),
+    outcome: WitanAttestationOutcomeSchema,
+    assurance: external_exports.object({
+      status: external_exports.literal("unsigned"),
+      issuer: external_exports.literal("self-generated"),
+      signingHint: external_exports.string().min(1).max(500)
+    }).strict(),
+    limitations: external_exports.array(external_exports.string().min(1).max(500)).min(1).max(8)
+  }).strict()
+}).strict();
 
-// ../witan/src/finding-limits.ts
-var RULE_ID_MAX = 200;
-var MESSAGE_MAX = 500;
-var LOCATION_MAX = 700;
-function clamp(value, max) {
-  if (value.length <= max) return value;
-  const ellipsis = "...";
-  return `${value.slice(0, Math.max(max - ellipsis.length, 0))}${ellipsis}`;
-}
-function clampFinding(finding) {
-  return {
-    ...finding,
-    ruleId: clamp(finding.ruleId, RULE_ID_MAX),
-    message: clamp(finding.message, MESSAGE_MAX),
-    ...finding.location ? { location: clamp(finding.location, LOCATION_MAX) } : {}
+// src/witan/attestation.ts
+var ATTESTATION_LIMITATIONS = [
+  "Cejel measures observable repository signals; it is not a security or compliance guarantee.",
+  "This statement is self-generated and unsigned until an external signer binds their identity to it."
+];
+function serializeWitanReport(report) {
+  return JSON.stringify(report, null, 2);
+}
+function hashWitanReport(report) {
+  return createHash("sha256").update(serializeWitanReport(report), "utf8").digest("hex");
+}
+function createWitanAttestation(report, options) {
+  const reportSha256 = hashWitanReport(report);
+  const outcome = report.insufficientSourceReason ? {
+    status: "abstained",
+    reason: report.insufficientSourceReason
+  } : {
+    status: "scored",
+    overallScore: report.overallScore,
+    codeTrustScore: report.codeTrustScore,
+    processTrustScore: report.processTrustScore
   };
+  return WitanAttestationStatementSchema.parse({
+    _type: WITAN_ATTESTATION_STATEMENT_TYPE,
+    subject: [
+      {
+        name: `${report.productSlug}/report.json`,
+        digest: { sha256: reportSha256 }
+      }
+    ],
+    predicateType: WITAN_ATTESTATION_PREDICATE_TYPE,
+    predicate: {
+      tool: { name: "cejel", version: options.toolVersion },
+      generatedAt: report.generatedAt,
+      rubricVersion: report.rubricVersion,
+      repository: {
+        productSlug: report.productSlug,
+        ...report.repo.url ? { url: report.repo.url } : {},
+        ...report.repo.headSha ? { headSha: report.repo.headSha } : {}
+      },
+      report: {
+        artifact: "report.json",
+        sha256: reportSha256
+      },
+      outcome,
+      assurance: {
+        status: "unsigned",
+        issuer: "self-generated",
+        signingHint: "Sign this in-toto statement with your existing provenance system; verify the report digest before relying on it."
+      },
+      limitations: [...ATTESTATION_LIMITATIONS]
+    }
+  });
 }
 
-// ../witan/src/generic-adapter.ts
-import { readFileSync as readFileSync2 } from "fs";
+// src/witan/repo-signals.ts
+import { execFileSync } from "child_process";
+import { createHash as createHash2 } from "crypto";
+import { readFileSync, readdirSync, realpathSync, statSync } from "fs";
+import { basename, join, relative, resolve, sep } from "path";
 
-// ../witan/src/json-safe.ts
+// src/witan/json-safe.ts
 function stripBom(text) {
   return text.charCodeAt(0) === 65279 ? text.slice(1) : text;
 }
 
-// ../witan/src/generic-adapter.ts
-var VALID_DIMENSIONS = /* @__PURE__ */ new Set([
-  "A1",
-  "A2",
-  "A3",
-  "A4",
-  "A5",
-  "B1",
-  "B2",
-  "B3",
-  "B4",
-  "B5",
-  "B6"
-]);
-var VALID_SEVERITIES = /* @__PURE__ */ new Set(["critical", "warning", "info"]);
-function isGenericSignalDocument(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
-  const doc = raw;
-  return typeof doc.tool === "string" && doc.tool.length > 0 && Array.isArray(doc.signals);
-}
-function parseGenericJson(raw) {
-  if (!isGenericSignalDocument(raw)) return [];
-  const source = raw.tool ?? "unknown";
-  const signals = [];
-  for (const signal of raw.signals ?? []) {
-    const dimension = signal.dimension;
-    if (!dimension || !VALID_DIMENSIONS.has(dimension)) continue;
-    const weight = typeof signal.weight === "number" && Number.isFinite(signal.weight) ? Math.min(Math.max(signal.weight, 0), 1) : 0.5;
-    const findings = [];
-    for (const finding of signal.findings ?? []) {
-      const severity = finding.severity;
-      if (!severity || !VALID_SEVERITIES.has(severity)) continue;
-      const ruleId = finding.ruleId ?? "unknown";
-      findings.push({
-        ruleId,
-        severity,
-        message: finding.message ?? ruleId,
-        ...finding.location ? { location: finding.location } : {}
-      });
-    }
-    if (findings.length === 0) continue;
-    signals.push({ source, dimension, weight, findings });
-  }
-  return signals;
-}
-
-// ../witan/src/sarif-adapter.ts
-import { readFileSync as readFileSync3 } from "fs";
-var DIMENSION_RULES = [
-  // A2 — injection / secrets / auth (high weight)
-  {
-    pattern: /sql[- _]?inject|cwe-89|sqli|command[- _]?inject|cwe-78|os[- _]?cmd|rce|remote[- _]?code/i,
-    dimension: "A2",
-    weight: 0.9
-  },
-  {
-    pattern: /secret|credential|api[- _]?key|password[- _]?leak|hardcoded[- _]?(token|key|secret)|cwe-259|cwe-798/i,
-    dimension: "A2",
-    weight: 0.9
-  },
-  {
-    pattern: /path[- _]?traversal|directory[- _]?traversal|cwe-22|lfi|rfi/i,
-    dimension: "A2",
-    weight: 0.8
-  },
-  {
-    pattern: /ssrf|server[- _]?side[- _]?request[- _]?forg|cwe-918/i,
-    dimension: "A2",
-    weight: 0.8
-  },
-  {
-    pattern: /xxe|xml[- _]?external[- _]?entity|cwe-611/i,
-    dimension: "A2",
-    weight: 0.8
-  },
-  {
-    pattern: /auth[- _]?bypass|broken[- _]?auth|missing[- _]?auth|cwe-287|cwe-306|cwe-863|cwe-862/i,
-    dimension: "A2",
-    weight: 0.7
-  },
-  {
-    pattern: /xss|cross[- _]?site[- _]?script|cwe-79/i,
-    dimension: "A2",
-    weight: 0.6
-  },
-  // A4 — dependency vulnerabilities
-  {
-    pattern: /cve-\d{4}-\d+|supply[- _]?chain|depend[a-z]*[- _]?vulner|outdated[- _]?depend|deprecated[- _]?package/i,
-    dimension: "A4",
-    weight: 0.8
-  },
-  {
-    pattern: /npm[- _]?audit|yarn[- _]?audit|pnpm[- _]?audit|pip[- _]?audit|cargo[- _]?audit/i,
-    dimension: "A4",
-    weight: 0.7
-  },
-  // A3 — production readiness / insecure config
-  {
-    pattern: /insecure[- _]?tls|weak[- _]?cipher|tls[- _]?version|http[- _]?strict|hsts|csp[- _]?missing|cwe-326|cwe-327/i,
-    dimension: "A3",
-    weight: 0.5
-  },
-  {
-    pattern: /error[- _]?handl|unhandled[- _]?exception|crash|uncaught|stacktrace[- _]?leak/i,
-    dimension: "A3",
-    weight: 0.4
-  },
-  {
-    pattern: /debug[- _]?mode|dev[- _]?endpoint|staging[- _]?secret/i,
-    dimension: "A3",
-    weight: 0.4
-  },
-  // A1 — test integrity (low weight; SARIF rarely surfaces this)
-  {
-    pattern: /skipped[- _]?test|hollow[- _]?test|empty[- _]?assert|no[- _]?assertion/i,
-    dimension: "A1",
-    weight: 0.2
-  }
-];
-var DEFAULT_DIMENSION = "A2";
-var DEFAULT_WEIGHT = 0.3;
-var DROP_LEVEL = /* @__PURE__ */ new Set(["none"]);
-function mapLevel(level) {
-  if (!level || DROP_LEVEL.has(level)) return null;
-  if (level === "error") return "critical";
-  if (level === "warning") return "warning";
-  return "info";
-}
-function mapRuleToDimension(ruleId, rules) {
-  for (const rule of rules) {
-    if (rule.pattern.test(ruleId)) {
-      return { dimension: rule.dimension, weight: rule.weight };
-    }
-  }
-  return { dimension: DEFAULT_DIMENSION, weight: DEFAULT_WEIGHT };
-}
-function renderLocation(result) {
-  const loc = result.locations?.[0]?.physicalLocation;
-  if (!loc) return void 0;
-  const uri = loc.artifactLocation?.uri;
-  const line = loc.region?.startLine;
-  if (!uri) return void 0;
-  return line != null ? `${uri}:${line}` : uri;
-}
-function dedupeFindings(findings) {
-  const seen = /* @__PURE__ */ new Set();
-  return findings.filter((f) => {
-    const key = `${f.ruleId}|${f.severity}|${f.location ?? ""}`;
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  });
-}
-function parseSarifJson(raw, extraDimensionRules) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
-  const dimensionRules = extraDimensionRules ? [...DIMENSION_RULES, ...extraDimensionRules] : DIMENSION_RULES;
-  const doc = raw;
-  if (!Array.isArray(doc.runs)) return [];
-  const buckets = /* @__PURE__ */ new Map();
-  for (const run of doc.runs) {
-    const driverName = run.tool?.driver?.name ?? "unknown";
-    const source = `sarif:${driverName}`;
-    const ruleDefaultLevels = /* @__PURE__ */ new Map();
-    for (const rule of run.tool?.driver?.rules ?? []) {
-      if (rule.id && rule.defaultConfiguration?.level) {
-        ruleDefaultLevels.set(rule.id, rule.defaultConfiguration.level);
-      }
-    }
-    for (const result of run.results ?? []) {
-      const ruleId = result.ruleId ?? "unknown";
-      const effectiveLevel = result.level ?? ruleDefaultLevels.get(ruleId) ?? "warning";
-      const severity = mapLevel(effectiveLevel);
-      if (!severity) continue;
-      const message = result.message?.text ?? ruleId;
-      const location = renderLocation(result);
-      const { dimension, weight } = mapRuleToDimension(ruleId, dimensionRules);
-      const bucketKey = `${source}|${dimension}`;
-      if (!buckets.has(bucketKey)) {
-        buckets.set(bucketKey, { source, dimension, weight, findings: [] });
-      }
-      buckets.get(bucketKey)?.findings.push({ ruleId, severity, message, ...location ? { location } : {} });
-    }
-  }
-  return Array.from(buckets.values()).map(({ source, dimension, weight, findings }) => ({
-    source,
-    dimension,
-    weight,
-    findings: dedupeFindings(findings)
-  }));
-}
-
-// ../witan/src/scorecard-adapter.ts
-import { readFileSync as readFileSync4 } from "fs";
-var CHECK_RULES = {
-  // B2 — PR outcome traceability
-  "Branch-Protection": { dimension: "B2", weight: 0.8 },
-  "Code-Review": { dimension: "B2", weight: 0.7 },
-  // B3 — CI and QA discipline
-  "Dangerous-Workflow": { dimension: "B3", weight: 0.9 },
-  "Token-Permissions": { dimension: "B3", weight: 0.8 },
-  "CI-Tests": { dimension: "B3", weight: 0.7 },
-  Maintained: { dimension: "B3", weight: 0.3 },
-  // B4 — audit trail / release integrity
-  "Signed-Releases": { dimension: "B4", weight: 0.7 },
-  Packaging: { dimension: "B4", weight: 0.4 },
-  "Security-Policy": { dimension: "B4", weight: 0.4 },
-  // A4 — dependency hygiene
-  Vulnerabilities: { dimension: "A4", weight: 0.9 },
-  "Pinned-Dependencies": { dimension: "A4", weight: 0.8 },
-  "Dependency-Update-Tool": { dimension: "A4", weight: 0.6 },
-  // A2 — data-layer / static analysis
-  SAST: { dimension: "A2", weight: 0.7 },
-  "Binary-Artifacts": { dimension: "A2", weight: 0.6 },
-  // A1 — test integrity
-  Fuzzing: { dimension: "A1", weight: 0.3 }
-};
-function mapScoreToSeverity(score) {
-  if (score == null || Number.isNaN(score)) return null;
-  if (score < 0) return null;
-  if (score >= 10) return null;
-  if (score <= 3) return "critical";
-  if (score <= 6) return "warning";
-  return "info";
-}
-function dedupeFindings2(findings) {
-  const seen = /* @__PURE__ */ new Set();
-  return findings.filter((f) => {
-    const key = `${f.ruleId}|${f.severity}|${f.location ?? ""}`;
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  });
-}
-function parseScorecardJson(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
-  const doc = raw;
-  if (!Array.isArray(doc.checks)) return [];
-  const buckets = /* @__PURE__ */ new Map();
-  for (const check of doc.checks) {
-    const name = check.name;
-    if (!name) continue;
-    const rule = CHECK_RULES[name];
-    if (!rule) continue;
-    const severity = mapScoreToSeverity(check.score);
-    if (!severity) continue;
-    const scoreText = typeof check.score === "number" ? `${check.score}/10` : "n/a";
-    const message = `${name} (Scorecard ${scoreText}): ${check.reason ?? "weakness detected"}`.slice(0, 500);
-    const location = check.documentation?.url;
-    const bucket = buckets.get(rule.dimension) ?? { weight: 0, findings: [] };
-    bucket.weight = Math.max(bucket.weight, rule.weight);
-    bucket.findings.push({
-      ruleId: `scorecard:${name}`,
-      severity,
-      message,
-      ...location ? { location } : {}
-    });
-    buckets.set(rule.dimension, bucket);
-  }
-  return Array.from(buckets.entries()).map(([dimension, { weight, findings }]) => ({
-    source: "scorecard",
-    dimension,
-    weight,
-    findings: dedupeFindings2(findings)
-  }));
-}
-
-// ../witan/src/ingest.ts
-function looksLikeSarif(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
-  return Array.isArray(raw.runs);
-}
-function looksLikeScorecard(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
-  return Array.isArray(raw.checks);
-}
-function countRawEntries(raw) {
-  const obj = raw;
-  if (Array.isArray(obj.runs)) {
-    return obj.runs.reduce((sum, run) => {
-      const results = run.results;
-      return sum + (Array.isArray(results) ? results.length : 0);
-    }, 0);
-  }
-  if (Array.isArray(obj.checks)) return obj.checks.length;
-  if (Array.isArray(obj.signals)) {
-    return obj.signals.reduce((sum, signal) => {
-      const findings = signal.findings;
-      return sum + (Array.isArray(findings) ? findings.length : 0);
-    }, 0);
-  }
-  return 0;
-}
-function rawToolName(raw) {
-  const obj = raw;
-  if (Array.isArray(obj.runs)) {
-    const firstRun = obj.runs[0];
-    return firstRun?.tool?.driver?.name ?? "unknown";
-  }
-  if (typeof obj.tool === "string" && obj.tool.length > 0) return obj.tool;
-  return "scorecard";
-}
-function parseIngestFile(filePath) {
-  let raw;
-  try {
-    raw = JSON.parse(stripBom(readFileSync5(filePath, "utf8")));
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`Cejel: could not parse ingest file as JSON: ${filePath} (${message})`);
-  }
-  let signals;
-  if (looksLikeSarif(raw)) signals = parseSarifJson(raw);
-  else if (looksLikeScorecard(raw)) signals = parseScorecardJson(raw);
-  else if (isGenericSignalDocument(raw)) signals = parseGenericJson(raw);
-  if (!signals) {
-    throw new Error(
-      `Cejel: unrecognized ingest file format: ${filePath} \u2014 expected SARIF (a "runs" array), OpenSSF Scorecard JSON (a "checks" array), or the generic Cejel external-signal shape (a "tool" string + "signals" array). See the cejel README "Aggregate your scanners".`
-    );
-  }
-  const rawCount = countRawEntries(raw);
-  const mappedCount = signals.reduce((sum, signal) => sum + signal.findings.length, 0);
-  if (rawCount > 0 && mappedCount === 0) {
-    process.stderr.write(
-      `Cejel: ${rawCount} findings from ${rawToolName(raw)} (${filePath}), 0 mapped to trust criteria
-`
-    );
-  }
-  return signals.map((signal) => ({
-    ...signal,
-    findings: signal.findings.map(clampFinding)
-  }));
-}
-function expandIngestPattern(pattern) {
-  if (!pattern.includes("*")) return [pattern];
-  const lastSlash = pattern.lastIndexOf("/");
-  const dir = lastSlash === -1 ? "." : pattern.slice(0, lastSlash);
-  const filePattern = lastSlash === -1 ? pattern : pattern.slice(lastSlash + 1);
-  const regexSource = filePattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-  const regex = new RegExp(`^${regexSource}$`);
-  let entries;
-  try {
-    entries = readdirSync2(dir);
-  } catch {
-    return [];
-  }
-  return entries.filter((name) => regex.test(name)).sort().map((name) => join2(dir, name));
-}
-function discoverIngestInputs(repoPath) {
-  const inputsDir = join2(repoPath, ".cejel", "inputs");
-  let entries;
-  try {
-    entries = readdirSync2(inputsDir);
-  } catch {
-    return [];
-  }
-  return entries.filter((name) => /\.(sarif|json)$/i.test(name)).sort().map((name) => join2(inputsDir, name));
-}
-
-// ../witan/src/repo-signals.ts
-import { execFileSync } from "child_process";
-import { createHash } from "crypto";
-import { readFileSync as readFileSync6, readdirSync as readdirSync3, realpathSync, statSync as statSync2 } from "fs";
-import { basename, join as join3, relative, resolve, sep } from "path";
+// src/witan/repo-signals.ts
 function buildWitanInputFromRepo(options) {
   assertRepoPathExists(options.repoPath);
   const generatedAt = options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
@@ -6600,6 +4895,7 @@ var BUNDLED_BINARY_EXTENSION_PATTERN = /\.(vsix|zip|tgz|whl|exe|dmg|pkg|msi|jar|
 var DOCS_OR_MEDIA_EXTENSION_PATTERN = /\.(md|mdx|rst|png|jpe?g|gif|svg|webp|ico|pdf)$/i;
 var KNOWN_NON_SOURCE_EXTENSION_PATTERN = /\.(json|jsonc|json5|ya?ml|toml|txt|lock|xml|csv|tsv|ini|cfg|conf|properties|env|sum|mod|graphql|gql|proto|editorconfig|gitignore|gitattributes|npmrc|nvmrc|dockerignore|log|txt\.license)$/i;
 var INGEST_POINTER = "To assess a closed/bundled tool, ingest its scanner output via --ingest <sarif|scorecard>.";
+var SOURCE_DOMINANCE_RATIO_THRESHOLD = 0.2;
 function classifyRepoArchetype(repoFiles) {
   const totalFileCount = repoFiles.length;
   const sourceFileCount = repoFiles.filter((file) => SOURCE_EXTENSION_PATTERN.test(file)).length;
@@ -6611,57 +4907,83 @@ function classifyRepoArchetype(repoFiles) {
       insufficientSourceReason: "Repository has no tracked files \u2014 there is nothing to certify."
     };
   }
-  if (sourceFileCount > 0) {
+  const unrecognisedSourceFiles = collectUnrecognisedSourceFiles(repoFiles);
+  if (sourceFileCount === 0) {
+    const binaryFiles = repoFiles.filter((file) => BUNDLED_BINARY_EXTENSION_PATTERN.test(file));
+    if (binaryFiles.length > 0) {
+      const sample = binaryFiles[0];
+      return {
+        archetype: "binary_only",
+        sourceFileCount,
+        totalFileCount,
+        insufficientSourceReason: `${sourceFileCount} source file(s) found among ${totalFileCount} tracked file(s); repo appears to be a binary/bundled-distribution tree (e.g. ${sample ? basename(sample) : "a packaged artifact"}) \u2014 cejel rates source, not binaries. ${INGEST_POINTER}`
+      };
+    }
+    const docsFiles = repoFiles.filter((file) => DOCS_OR_MEDIA_EXTENSION_PATTERN.test(file));
+    if (docsFiles.length > 0 && docsFiles.length === totalFileCount) {
+      return {
+        archetype: "docs_only",
+        sourceFileCount,
+        totalFileCount,
+        insufficientSourceReason: `${sourceFileCount} source file(s) found among ${totalFileCount} tracked file(s); repo appears to be a docs/distribution tree (README/markdown/media), not a source tree \u2014 cejel rates source, not docs. ${INGEST_POINTER}`
+      };
+    }
+    if (unrecognisedSourceFiles.length > 0) {
+      return unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognisedSourceFiles);
+    }
+    return { archetype: "source", sourceFileCount, totalFileCount };
+  }
+  if (unrecognisedSourceFiles.length === 0) {
     return {
       archetype: isLikelyMonorepo(repoFiles) ? "monorepo" : "source",
       sourceFileCount,
       totalFileCount
     };
   }
-  const binaryFiles = repoFiles.filter((file) => BUNDLED_BINARY_EXTENSION_PATTERN.test(file));
-  if (binaryFiles.length > 0) {
-    const sample = binaryFiles[0];
+  const dominanceRatio = sourceFileCount / (sourceFileCount + unrecognisedSourceFiles.length);
+  if (dominanceRatio >= SOURCE_DOMINANCE_RATIO_THRESHOLD) {
     return {
-      archetype: "binary_only",
-      sourceFileCount,
-      totalFileCount,
-      insufficientSourceReason: `${sourceFileCount} source file(s) found among ${totalFileCount} tracked file(s); repo appears to be a binary/bundled-distribution tree (e.g. ${sample ? basename(sample) : "a packaged artifact"}) \u2014 cejel rates source, not binaries. ${INGEST_POINTER}`
-    };
-  }
-  const docsFiles = repoFiles.filter((file) => DOCS_OR_MEDIA_EXTENSION_PATTERN.test(file));
-  if (docsFiles.length > 0 && docsFiles.length === totalFileCount) {
-    return {
-      archetype: "docs_only",
-      sourceFileCount,
-      totalFileCount,
-      insufficientSourceReason: `${sourceFileCount} source file(s) found among ${totalFileCount} tracked file(s); repo appears to be a docs/distribution tree (README/markdown/media), not a source tree \u2014 cejel rates source, not docs. ${INGEST_POINTER}`
-    };
-  }
-  const unrecognisedExtensions = collectUnrecognisedSourceExtensions(repoFiles);
-  if (unrecognisedExtensions.length > 0) {
-    const sample = unrecognisedExtensions.slice(0, 6).join(", ");
-    return {
-      archetype: "unrecognised_ecosystem",
+      archetype: isLikelyMonorepo(repoFiles) ? "monorepo" : "source",
       sourceFileCount,
-      totalFileCount,
-      insufficientSourceReason: `Cejel does not yet read this repository's source language(s) (${sample}) \u2014 0 of ${totalFileCount} tracked file(s) matched a recognised source extension. Cejel abstains from a verdict rather than score a language it cannot parse; the Criterion Profile and Measured coverage below show exactly which dimensions were and were not measured. ${INGEST_POINTER}`
+      totalFileCount
     };
   }
-  return { archetype: "source", sourceFileCount, totalFileCount };
+  return unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognisedSourceFiles);
 }
-function collectUnrecognisedSourceExtensions(repoFiles) {
-  const found = /* @__PURE__ */ new Set();
-  for (const file of repoFiles) {
+function collectUnrecognisedSourceFiles(repoFiles) {
+  return repoFiles.filter((file) => {
     const base = basename(file);
-    const match = /\.([a-zA-Z0-9_]+)$/.exec(base);
+    if (!/\.([a-zA-Z0-9_]+)$/.test(base)) return false;
+    if (KNOWN_NON_SOURCE_EXTENSION_PATTERN.test(base)) return false;
+    if (DOCS_OR_MEDIA_EXTENSION_PATTERN.test(base)) return false;
+    if (BUNDLED_BINARY_EXTENSION_PATTERN.test(base)) return false;
+    if (SOURCE_EXTENSION_PATTERN.test(base)) return false;
+    return true;
+  });
+}
+function extensionsByFileCountDescending(files) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const match = /\.([a-zA-Z0-9_]+)$/.exec(basename(file));
     const ext = match?.[1];
     if (!ext) continue;
-    if (KNOWN_NON_SOURCE_EXTENSION_PATTERN.test(base)) continue;
-    if (DOCS_OR_MEDIA_EXTENSION_PATTERN.test(base)) continue;
-    if (BUNDLED_BINARY_EXTENSION_PATTERN.test(base)) continue;
-    found.add(`.${ext.toLowerCase()}`);
+    const key = `.${ext.toLowerCase()}`;
+    counts.set(key, (counts.get(key) ?? 0) + 1);
   }
-  return [...found].sort();
+  return [...counts.entries()].sort(([extA, countA], [extB, countB]) => countB - countA || extA.localeCompare(extB)).map(([ext]) => ext);
+}
+function unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognisedSourceFiles) {
+  const sample = extensionsByFileCountDescending(unrecognisedSourceFiles).slice(0, 6).join(", ");
+  const candidateCount = sourceFileCount + unrecognisedSourceFiles.length;
+  const dominancePct = candidateCount > 0 ? (sourceFileCount / candidateCount * 100).toFixed(1) : "0.0";
+  const thresholdPct = (SOURCE_DOMINANCE_RATIO_THRESHOLD * 100).toFixed(0);
+  const measuredClause = sourceFileCount > 0 ? `${sourceFileCount} of ${candidateCount} source-shaped file(s) (${dominancePct}%) are in a language Cejel reads \u2014 below the ${thresholdPct}% dominance threshold a score would need to be meaningful (${totalFileCount} tracked files in total; manifests, lockfiles, docs, media and bundled binaries are excluded from both sides of the ratio)` : `0 of ${totalFileCount} tracked file(s) matched a recognised source extension`;
+  return {
+    archetype: "unrecognised_ecosystem",
+    sourceFileCount,
+    totalFileCount,
+    insufficientSourceReason: `Cejel does not yet read this repository's dominant source language(s) (${sample}) \u2014 ${measuredClause}. Cejel abstains from a verdict rather than score a repository whose recognised source is incidental rather than dominant; the Criterion Profile and Measured coverage below show exactly which dimensions were and were not measured. ${INGEST_POINTER}`
+  };
 }
 function isLikelyMonorepo(repoFiles) {
   const packageRoots = new Set(
@@ -6672,7 +4994,7 @@ function isLikelyMonorepo(repoFiles) {
 function assertRepoPathExists(repoPath) {
   let stats;
   try {
-    stats = statSync2(repoPath);
+    stats = statSync(repoPath);
   } catch {
     throw new Error(`Cejel: path not found: ${repoPath}`);
   }
@@ -6740,7 +5062,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles) {
   const runnerFiles = repoFiles.filter(isTestRunnerConfig).slice(0, 6);
   const coverageFiles = repoFiles.filter(isCoverageConfig).slice(0, 4);
   const packageJson = findRootPackageJson(repoFiles);
-  const packageScripts = packageJson ? readPackageScripts(join3(repoPath, packageJson)) : /* @__PURE__ */ new Map();
+  const packageScripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
   const coveragePercent = readCoveragePercent(repoPath, coverageFiles);
   const ciWorkflows = repoFiles.filter(isCiWorkflow);
   const ciTestWorkflow = ciWorkflows.find(
@@ -7106,7 +5428,8 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
   const findings = [];
   let hasSurface = false;
   let insecureFound = false;
-  const timingSafeFile = implFiles.find(
+  const productionImplFiles = implFiles.filter(isProductionSourcePath);
+  const timingSafeFile = productionImplFiles.find(
     (file) => fileContains(repoPath, file, TIMING_SAFE_COMPARE_PATTERN)
   );
   if (timingSafeFile) {
@@ -7120,7 +5443,7 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
       )
     );
   }
-  const canonicalSignFile = implFiles.find(
+  const canonicalSignFile = productionImplFiles.find(
     (file) => fileContains(repoPath, file, CANONICAL_SERIALIZE_PATTERN) && fileContains(repoPath, file, SIGN_OR_HMAC_CALL_PATTERN)
   );
   if (canonicalSignFile) {
@@ -7134,20 +5457,31 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
       )
     );
   }
-  const insecureCompareFile = implFiles.find(
-    (file) => fileContains(repoPath, file, INSECURE_SECRET_COMPARE_PATTERN)
-  );
+  let insecureCompareFile = null;
+  let insecureCompareLine = null;
+  for (const file of implFiles) {
+    const line = findInsecureSecretCompareLine(repoPath, file);
+    if (line != null) {
+      insecureCompareFile = file;
+      insecureCompareLine = line;
+      break;
+    }
+  }
   if (insecureCompareFile) {
-    hasSurface = true;
-    insecureFound = true;
+    const isTestPath = isTestOrFixturePath(insecureCompareFile);
+    if (!isTestPath) {
+      hasSurface = true;
+      insecureFound = true;
+    }
     findings.push({
-      severity: "warning",
-      summary: "A secret/HMAC/signature value appears compared with a plain equality operator instead of a constant-time comparison \u2014 potential timing side-channel.",
-      evidence: evidenceForRelative(
+      severity: isTestPath ? "info" : "warning",
+      summary: isTestPath ? `A secret/HMAC/signature comparison via plain equality appears in a test/fixture file (${insecureCompareFile}) \u2014 likely a test assertion, not a production timing leak; verify.` : "A secret/HMAC/signature value appears compared with a plain equality operator instead of a constant-time comparison \u2014 potential timing side-channel.",
+      evidence: evidenceForRelativeAtLine(
         repoPath,
         insecureCompareFile,
         "artifact",
-        "Non-constant-time secret comparison"
+        "Non-constant-time secret comparison",
+        insecureCompareLine
       )
     });
   }
@@ -7155,16 +5489,25 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
     (file) => fileContains(repoPath, file, UNSORTED_JSON_SIGN_PATTERN) && !fileContains(repoPath, file, CANONICAL_SERIALIZE_PATTERN)
   );
   if (unsortedSignFile) {
-    hasSurface = true;
-    insecureFound = true;
+    const isTestPath = isTestOrFixturePath(unsortedSignFile);
+    if (!isTestPath) {
+      hasSurface = true;
+      insecureFound = true;
+    }
+    const unsortedSignLine = findFirstMatchingLine(
+      repoPath,
+      unsortedSignFile,
+      UNSORTED_JSON_SIGN_PATTERN
+    );
     findings.push({
-      severity: "warning",
-      summary: "A signature/HMAC appears computed directly over JSON.stringify output with no canonical key ordering in the same file \u2014 signatures may not verify across equivalent payloads.",
-      evidence: evidenceForRelative(
+      severity: isTestPath ? "info" : "warning",
+      summary: isTestPath ? `Signing over unsorted JSON serialization appears in a test/fixture file (${unsortedSignFile}) \u2014 likely a test assertion, not a production signing gap; verify.` : "A signature/HMAC appears computed directly over JSON.stringify output with no canonical key ordering in the same file \u2014 signatures may not verify across equivalent payloads.",
+      evidence: evidenceForRelativeAtLine(
         repoPath,
         unsortedSignFile,
         "artifact",
-        "Signing over unsorted JSON serialization"
+        "Signing over unsorted JSON serialization",
+        unsortedSignLine
       )
     });
   }
@@ -7180,7 +5523,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles) {
   const evidence = [];
   const findings = [];
   const packageJson = findRootPackageJson(repoFiles);
-  const scripts = packageJson ? readPackageScripts(join3(repoPath, packageJson)) : /* @__PURE__ */ new Map();
+  const scripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
   const workflows = repoFiles.filter(isCiWorkflow);
   const workflow = workflows[0];
   const deployConfigs = repoFiles.filter(isDeployConfig);
@@ -7614,7 +5957,7 @@ function collectB2PrTraceEvidence(repoPath, repoFiles) {
 function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
   const evidence = [];
   const packageJson = findRootPackageJson(repoFiles);
-  const scripts = packageJson ? readPackageScripts(join3(repoPath, packageJson)) : /* @__PURE__ */ new Map();
+  const scripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
   const workflows = repoFiles.filter(isCiWorkflow);
   const workflow = workflows[0];
   const rootWorkflows = mono ? mono.sharedFiles.filter(isCiWorkflow) : [];
@@ -7880,11 +6223,20 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles) {
 var CPP_TEST_FRAMEWORK_PATTERN = /<gtest\/gtest\.h>|<catch2\/|<doctest\/|<boost\/test\/|"gtest\/gtest\.h"|"catch2\//;
 var CPP_TEST_MACRO_PATTERN = /\bTEST\s*\(|\bTEST_F\s*\(|\bTEST_CASE\s*\(|\bSECTION\s*\(|\bCATCH_|BOOST_AUTO_TEST_CASE\b|BOOST_FIXTURE_TEST_CASE\b/;
 var CPP_CONTENT_SCAN_LIMIT = 150;
-var TEST_OR_FIXTURE_DIR_PATTERN = /(^|\/)(__tests__|__mocks__|__fixtures__|tests|test|fixtures|testdata|e2e|cypress)(\/|$)/i;
-var TEST_OR_FIXTURE_FILE_PATTERN = /\.(test|spec|stories)\.[^/]+$/i;
+var NON_PRODUCTION_DIR_PATTERN = /(^|\/)(__tests__|__mocks__|__fixtures__|tests?|fixtures?|testdata|e2e|cypress|examples?|samples?|demos?)(\/|$)/i;
+var NON_PRODUCTION_FILE_SUFFIX_PATTERN = /\.(test|spec|stories)\.[^/]+$/i;
 function isTestOrFixturePath(path) {
-  return TEST_OR_FIXTURE_DIR_PATTERN.test(path) || TEST_OR_FIXTURE_FILE_PATTERN.test(path);
+  return NON_PRODUCTION_DIR_PATTERN.test(path) || NON_PRODUCTION_FILE_SUFFIX_PATTERN.test(path);
+}
+function isProductionSourcePath(path) {
+  return !isTestOrFixturePath(path);
 }
+function isTestFile(file) {
+  return /(^|\/)(__tests__|test|tests|spec)\/.*\.(?:[cm]?[jt]sx?|py|go|rs|java|rb|cpp|cc|cxx)$/.test(
+    file
+  ) || /\.(test|spec)\.[cm]?[jt]sx?$/.test(file) || /(^|\/)test_.*\.py$/.test(file) || /_test\.go$/.test(file) || /(^|\/)test_.*\.(cpp|cc|cxx)$/.test(file) || /_(test|tests)\.(cpp|cc|cxx)$/.test(file) || /Tests?\.(java|kt)$/.test(file) || /(_test|_spec)\.(rs|rb|php|swift|kt)$/.test(file);
+}
+var NAME_SHAPED_TEST_FILE_PATTERN = /\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)__tests__\/|(^|\/)test_[^/]*\.py$|(^|\/)tests?\.py$|_test\.go$|(^|\/)test_[^/]*\.(cpp|cc|cxx)$|_(test|tests)\.(cpp|cc|cxx)$|Tests?\.(java|kt)$|(_test|_spec)\.(rs|rb|php|swift|kt)$/;
 var TEST_RUNNER_PATTERN = /\b(vitest|jest|mocha|ava|tap|pytest|go test|cargo test|rspec|phpunit|gradle test|mvn test)\b/i;
 var CI_TEST_COMMAND_PATTERN = /\b(pytest|go\s+test|cargo\s+test|mvn\s+test|gradle\s+test|ctest|make\s+test|jest|vitest|mocha|rspec|phpunit|pnpm\s+test|npm\s+test|yarn\s+test|node\s+--test|node:test)\b/i;
 var CI_LINT_COMMAND_PATTERN = /\b(eslint|pylint|flake8|black|ruff)\b/i;
@@ -7917,7 +6269,28 @@ var HEAVY_TEST_DEPENDENCY_NAME_PATTERN = /^(?:jest|mocha|ava|tape|jasmine|karma)
 var TIMING_SAFE_COMPARE_PATTERN = /\btiming[-_]?safe[-_]?(?:equal|compare)\b|crypto\.timingSafeEqual\s*\(/i;
 var CANONICAL_SERIALIZE_PATTERN = /\bcanonicalize\s*\(|\bcanonicalJson\b|\bstableStringify\s*\(|json-stable-stringify|safe-stable-stringify|\bsortKeys\s*\(/i;
 var SIGN_OR_HMAC_CALL_PATTERN = /\bcreateHmac\s*\(|\bcreateSign\s*\(|\.sign\s*\(/;
-var INSECURE_SECRET_COMPARE_PATTERN = /\b\w*(?:hmac|signature|\bmac|digest)\w*\s*(?:===|!==)\s*(?!['"`]|undefined\b|null\b)\w/i;
+var INSECURE_SECRET_COMPARE_LINE_PATTERN = /\b\w*(?:hmac|signature|\bmac|digest)\w*\s*(===|!==)\s*(?!['"`]|undefined\b|null\b)([\w.]+(?:\s*[-+]\s*\d+)?)/i;
+var NUMERIC_SHAPED_OPERAND_PATTERN = /^-?\d+$|\.(?:length|len|size|count)\b|(?:length|index|idx|offset|count|size|len)$/i;
+function lineHasInsecureSecretCompare(line) {
+  const match = INSECURE_SECRET_COMPARE_LINE_PATTERN.exec(line);
+  const operand = match?.[2];
+  if (!operand) return false;
+  return !NUMERIC_SHAPED_OPERAND_PATTERN.test(operand.trim());
+}
+function findInsecureSecretCompareLine(repoPath, file) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return null;
+  const lines = readFileSync(fullPath, "utf8").split("\n");
+  const index = lines.findIndex((line) => lineHasInsecureSecretCompare(line));
+  return index === -1 ? null : index + 1;
+}
+function findFirstMatchingLine(repoPath, file, pattern) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return null;
+  const lines = readFileSync(fullPath, "utf8").split("\n");
+  const index = lines.findIndex((line) => pattern.test(line));
+  return index === -1 ? null : index + 1;
+}
 var UNSORTED_JSON_SIGN_PATTERN = /\.update\s*\(\s*JSON\.stringify\s*\(|\.sign\s*\([^)]*JSON\.stringify\s*\(/;
 var KILL_SWITCH_NAME_FRAGMENT = "kill[_-]?switch|emergency[_-]?stop|circuit[_-]?breaker|safety[_-]?(?:toggle|gate|switch)|governance[_-]?(?:toggle|gate)";
 var KILL_SWITCH_NAME_PATTERN = new RegExp(`\\b(?:${KILL_SWITCH_NAME_FRAGMENT})\\b`, "i");
@@ -8029,13 +6402,13 @@ function listGitTrackedFiles(repoPath) {
 function visitRepoDir(repoPath, dirPath, files) {
   let entries;
   try {
-    entries = readdirSync3(dirPath, { withFileTypes: true });
+    entries = readdirSync(dirPath, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
     if (shouldSkipDir(entry.name)) continue;
-    const fullPath = join3(dirPath, entry.name);
+    const fullPath = join(dirPath, entry.name);
     if (entry.isDirectory()) {
       visitRepoDir(repoPath, fullPath, files);
       continue;
@@ -8043,7 +6416,7 @@ function visitRepoDir(repoPath, dirPath, files) {
     if (!entry.isFile()) continue;
     let size;
     try {
-      size = statSync2(fullPath).size;
+      size = statSync(fullPath).size;
     } catch {
       continue;
     }
@@ -8068,20 +6441,15 @@ function shouldSkipDir(name) {
     "target"
   ].includes(name);
 }
-function isHardExcludedPath(path) {
-  return HARD_EXCLUDED_PATH_PATTERN.test(path);
-}
-function isTestFile(file) {
-  return /(^|\/)(__tests__|test|tests|spec)\/.*\.(?:[cm]?[jt]sx?|py|go|rs|java|rb|cpp|cc|cxx)$/.test(
-    file
-  ) || /\.(test|spec)\.[cm]?[jt]sx?$/.test(file) || /(^|\/)test_.*\.py$/.test(file) || /_test\.go$/.test(file) || /(^|\/)test_.*\.(cpp|cc|cxx)$/.test(file) || /_(test|tests)\.(cpp|cc|cxx)$/.test(file) || /Tests?\.(java|kt)$/.test(file) || /(_test|_spec)\.(rs|rb|php|swift|kt)$/.test(file);
-}
+function isHardExcludedPath(path) {
+  return HARD_EXCLUDED_PATH_PATTERN.test(path);
+}
 function collectContentBasedCppTestFiles(repoPath, repoFiles) {
   const candidates = repoFiles.filter((file) => /\.(cpp|cc|cxx)$/.test(file) && !isTestFile(file)).slice(0, CPP_CONTENT_SCAN_LIMIT);
   return candidates.filter((file) => {
-    const fullPath = join3(repoPath, file);
+    const fullPath = join(repoPath, file);
     if (!isRegularFile(fullPath)) return false;
-    const contents = readFileSync6(fullPath, "utf8");
+    const contents = readFileSync(fullPath, "utf8");
     return CPP_TEST_FRAMEWORK_PATTERN.test(contents) || CPP_TEST_MACRO_PATTERN.test(contents);
   });
 }
@@ -8095,14 +6463,13 @@ var JS_TEST_ASSERTION_PATTERN = /(expect\(|assert\.|should\.|toEqual\(|toBe\(|as
 var CPP_TEST_ASSERTION_PATTERN = /\bEXPECT_|ASSERT_EQ\b|ASSERT_TRUE\b|ASSERT_FALSE\b|\bREQUIRE\s*\(|\bCHECK\s*\(|\bTEST\s*\(|\bTEST_F\s*\(|\bTEST_CASE\s*\(|\bSECTION\s*\(/;
 var MULTI_ECOSYSTEM_TEST_ASSERTION_PATTERN = /\.assert[A-Z_]\w*\s*\(|\bassert[A-Z]\w*\s*\(|\bpytest\.raises\b|\bself\.fail\s*\(|\bt\.(?:Error|Errorf|Fatal|Fatalf|Fail|FailNow)\b|\brequire\.[A-Z]\w*\s*\(|\b(?:debug_)?assert(?:_eq|_ne)?!\s*\(|\bassert_\w+\b|\$this->assert\w+\s*\(/;
 var SUITE_LEVEL_SKIP_PATTERN = /\b(?:describe|suite|context)\.skip\s*\(/;
-var NAME_SHAPED_TEST_FILE_PATTERN = /\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)__tests__\/|(^|\/)test_[^/]*\.py$|(^|\/)tests?\.py$|_test\.go$|(^|\/)test_[^/]*\.(cpp|cc|cxx)$|_(test|tests)\.(cpp|cc|cxx)$|Tests?\.(java|kt)$|(_test|_spec)\.(rs|rb|php|swift|kt)$/;
 function measureNonHollowTestShare(repoPath, files) {
   let nonHollowCount = 0;
   let ratedCount = 0;
   for (const file of files) {
-    const fullPath = join3(repoPath, file);
+    const fullPath = join(repoPath, file);
     if (!isRegularFile(fullPath)) continue;
-    const contents = readFileSync6(fullPath, "utf8");
+    const contents = readFileSync(fullPath, "utf8");
     const nonHollow = (JS_TEST_ASSERTION_PATTERN.test(contents) || CPP_TEST_ASSERTION_PATTERN.test(contents) || MULTI_ECOSYSTEM_TEST_ASSERTION_PATTERN.test(contents)) && !SUITE_LEVEL_SKIP_PATTERN.test(contents);
     if (nonHollow) {
       nonHollowCount += 1;
@@ -8121,17 +6488,17 @@ function countPatternMatches(repoPath, files, pattern) {
   const matcher = new RegExp(pattern.source, flags);
   let count = 0;
   for (const file of files) {
-    const fullPath = join3(repoPath, file);
+    const fullPath = join(repoPath, file);
     if (!isRegularFile(fullPath)) continue;
-    count += [...readFileSync6(fullPath, "utf8").matchAll(matcher)].length;
+    count += [...readFileSync(fullPath, "utf8").matchAll(matcher)].length;
   }
   return count;
 }
 function readCoveragePercent(repoPath, files) {
   for (const file of files) {
-    const fullPath = join3(repoPath, file);
+    const fullPath = join(repoPath, file);
     if (!isRegularFile(fullPath)) continue;
-    const contents = readFileSync6(fullPath, "utf8");
+    const contents = readFileSync(fullPath, "utf8");
     const summaryPercent = parseCoverageSummaryPercent(contents);
     if (summaryPercent !== null) return summaryPercent;
     const thresholdPercent = parseCoverageThresholdPercent(contents);
@@ -8175,7 +6542,7 @@ function pickPrimaryDependencyManifest(repoPath, manifests) {
 function readDependencySpecs(repoPath, manifests) {
   const specs = [];
   for (const manifest of manifests) {
-    const fullPath = join3(repoPath, manifest);
+    const fullPath = join(repoPath, manifest);
     if (!isRegularFile(fullPath)) continue;
     if (manifest.endsWith("package.json")) {
       specs.push(...readPackageJsonDependencySpecs(fullPath));
@@ -8221,7 +6588,7 @@ function readDependencySpecs(repoPath, manifests) {
 }
 function readGoModDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync6(path, "utf8");
+  const contents = readFileSync(path, "utf8");
   const blockPattern = /require\s*\(([^)]+)\)/gs;
   const singlePattern = /^require\s+(\S+)\s+(\S+)/gm;
   for (const blockMatch of contents.matchAll(blockPattern)) {
@@ -8242,7 +6609,7 @@ function readGoModDependencySpecs(path) {
 }
 function readCargoTomlDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync6(path, "utf8");
+  const contents = readFileSync(path, "utf8");
   const depSectionPattern = /^\[(?:dependencies|dev-dependencies|build-dependencies)\]([\s\S]*?)(?=^\[|(?![\s\S]))/gm;
   for (const sectionMatch of contents.matchAll(depSectionPattern)) {
     const section = sectionMatch[1] ?? "";
@@ -8264,7 +6631,7 @@ function readCargoTomlDependencySpecs(path) {
 }
 function readPyprojectDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync6(path, "utf8");
+  const contents = readFileSync(path, "utf8");
   const poetrySectionPattern = /^\[tool\.poetry\.dependencies\]([\s\S]*?)(?=^\[|(?![\s\S]))/gm;
   for (const sectionMatch of contents.matchAll(poetrySectionPattern)) {
     const section = sectionMatch[1] ?? "";
@@ -8298,7 +6665,7 @@ function readPyprojectDependencySpecs(path) {
 }
 function readPipfileDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync6(path, "utf8");
+  const contents = readFileSync(path, "utf8");
   const sectionPattern = /^\[(?:packages|dev-packages)\]([\s\S]*?)(?=^\[|$(?![\s\S]))/gm;
   for (const sectionMatch of contents.matchAll(sectionPattern)) {
     for (const line of (sectionMatch[1] ?? "").split("\n")) {
@@ -8311,7 +6678,7 @@ function readPipfileDependencySpecs(path) {
   return specs;
 }
 function readVcpkgJsonDependencySpecs(path) {
-  const parsed = parseJsonObject(readFileSync6(path, "utf8"));
+  const parsed = parseJsonObject(readFileSync(path, "utf8"));
   if (!parsed) return [];
   const rawDeps = Array.isArray(parsed.dependencies) ? parsed.dependencies : [];
   const specs = [];
@@ -8327,7 +6694,7 @@ function readVcpkgJsonDependencySpecs(path) {
 }
 function readConanfileTxtDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync6(path, "utf8");
+  const contents = readFileSync(path, "utf8");
   const requiresMatch = /^\[requires\]([\s\S]*?)(?=^\[|$(?![\s\S]))/m.exec(contents);
   if (!requiresMatch) return specs;
   for (const line of (requiresMatch[1] ?? "").split("\n")) {
@@ -8340,7 +6707,7 @@ function readConanfileTxtDependencySpecs(path) {
 }
 function readConanfilePyDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync6(path, "utf8");
+  const contents = readFileSync(path, "utf8");
   for (const match of contents.matchAll(/self\.requires\s*\(\s*["']([\w.\-]+)\/([\w.\-]+)["']/g)) {
     specs.push({ name: match[1] ?? "", version: match[2] ?? "" });
   }
@@ -8354,7 +6721,7 @@ function readConanfilePyDependencySpecs(path) {
 }
 function readCMakeDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync6(path, "utf8");
+  const contents = readFileSync(path, "utf8");
   for (const match of contents.matchAll(/find_package\s*\(\s*([\w]+)(?:\s+([\d.]+))?/gi)) {
     const name = match[1];
     if (!name) continue;
@@ -8369,7 +6736,7 @@ function readCMakeDependencySpecs(path) {
   return specs;
 }
 function readPackageJsonDependencySpecs(packageJsonPath) {
-  const parsed = parseJsonObject(readFileSync6(packageJsonPath, "utf8"));
+  const parsed = parseJsonObject(readFileSync(packageJsonPath, "utf8"));
   if (!parsed) return [];
   const optionalPeerNames = /* @__PURE__ */ new Set();
   const peerDependenciesMeta = parsed.peerDependenciesMeta;
@@ -8396,7 +6763,7 @@ function readPackageJsonDependencySpecs(packageJsonPath) {
   return specs;
 }
 function readRequirementsDependencySpecs(path) {
-  return readFileSync6(path, "utf8").split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).map((line) => {
+  return readFileSync(path, "utf8").split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).map((line) => {
     const [name = line, version = ""] = line.split(/[<>=~!]=?/, 2);
     return { name: name.trim(), version: line.includes("==") ? version.trim() : line };
   });
@@ -8412,9 +6779,9 @@ function isPinnedDependencyVersion(version) {
   return /^\d+\.\d+(?:\.\d+)?(?:[-+][0-9A-Za-z.-]+)?$/.test(trimmed);
 }
 function workflowTargetsDefaultBranch(repoPath, file) {
-  const fullPath = join3(repoPath, file);
+  const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return false;
-  const contents = readFileSync6(fullPath, "utf8").toLowerCase();
+  const contents = readFileSync(fullPath, "utf8").toLowerCase();
   return /\bpull_request\b/.test(contents) || /\bbranches:\s*\[[^\]]*\b(main|master)\b[^\]]*\]/.test(contents) || /\bbranches:\s*\n\s*-\s*(main|master)\b/.test(contents);
 }
 function isPrMergeCommit(commit) {
@@ -8450,7 +6817,6 @@ function isExplicitDeployTarget(file) {
   return /^(vercel|netlify|fly|render|railway)\.(json|toml|ya?ml)$/.test(file) || /^docker-compose\.ya?ml$/.test(file) || /^Procfile$/.test(file) || /^app\.ya?ml$/.test(file) || /^serverless\.ya?ml$/.test(file) || /^(k8s|kubernetes|manifests?)\/.+\.ya?ml$/i.test(file) || /^(charts?|helm)\/.+\.ya?ml$/i.test(file);
 }
 var MAIN_ENTRYPOINT_FILE_PATTERN = /(^|\/)(main|server|app|wsgi|asgi|index|entry|start|run)\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs)$/i;
-var EXAMPLE_OR_TEST_DIR_PATTERN = /(?:^|\/)(examples?|samples?|demos?|tests?|__tests__|spec|fixtures?)(?:\/|$)/i;
 var SERVER_ENTRYPOINT_PATTERN = /\bapp\.listen\s*\(|\bserver\.listen\s*\(\s*(?:PORT|port|\d+)|http\.ListenAndServe\s*\(|http\.ListenAndServeTLS\s*\(|axum::Server(?:::|\.)|actix_web::HttpServer(?:::|\.)|uvicorn\.run\s*\(/;
 var CI_DEPLOY_JOB_PATTERN = /(?:^\s{2,4}deploy\s*:|\b(?:fly|heroku|vercel|netlify|railway|render)\s+deploy\b|kubectl\s+apply\b|helm\s+(?:install|upgrade|deploy)\b|docker\s+push\b)/im;
 function isDeployableService(repoPath, repoFiles) {
@@ -8467,9 +6833,7 @@ function detectServerEntrypoint(repoPath, repoFiles) {
   return findServerEntrypointFile(repoPath, repoFiles) !== null;
 }
 function findServerEntrypointFile(repoPath, repoFiles) {
-  const candidates = repoFiles.filter(
-    (file) => MAIN_ENTRYPOINT_FILE_PATTERN.test(file) && !EXAMPLE_OR_TEST_DIR_PATTERN.test(file)
-  ).slice(0, 30);
+  const candidates = repoFiles.filter((file) => MAIN_ENTRYPOINT_FILE_PATTERN.test(file) && isProductionSourcePath(file)).slice(0, 30);
   return candidates.find((file) => fileContains(repoPath, file, SERVER_ENTRYPOINT_PATTERN)) ?? null;
 }
 function isHealthCheckSignalFile(repoPath, file) {
@@ -8481,391 +6845,785 @@ function isHealthCheckSignalFile(repoPath, file) {
   if (/(^|\/)(health|healthcheck|readiness|liveness|ready)\.[cm]?[jt]sx?$/.test(file)) {
     return fileContains(repoPath, file, /health|ready|readiness|liveness/i);
   }
-  if (/(^|\/)(health|healthcheck|readiness|liveness|ready)\.py$/.test(file)) {
-    return fileContains(repoPath, file, /health|ready|readiness|liveness/i);
+  if (/(^|\/)(health|healthcheck|readiness|liveness|ready)\.py$/.test(file)) {
+    return fileContains(repoPath, file, /health|ready|readiness|liveness/i);
+  }
+  return false;
+}
+function isDependencyManifest(file) {
+  return /(^|\/)(package\.json|pyproject\.toml|requirements(?:[^/]*)?\.txt|go\.mod|Cargo\.toml|pom\.xml|build\.gradle|vcpkg\.json|Pipfile|CMakeLists\.txt|conanfile\.txt|conanfile\.py)$/.test(
+    file
+  );
+}
+function isLockfile(file) {
+  return /(^|\/)(pnpm-lock\.yaml|package-lock\.json|yarn\.lock|uv\.lock|poetry\.lock|go\.sum|Cargo\.lock|Pipfile\.lock|composer\.lock|conan\.lock|vcpkg\.lock\.json)$/.test(
+    file
+  );
+}
+function isDependencyUpdateConfig(file) {
+  return /(^|\/)(renovate\.json|renovate\.json5|\.renovaterc\.json|dependabot\.ya?ml)$/.test(file) || /^\.github\/dependabot\.ya?ml$/.test(file);
+}
+function packageJsonHasAuditScript(repoPath, manifest) {
+  if (!manifest.endsWith("package.json")) return false;
+  const scripts = readPackageScripts(join(repoPath, manifest));
+  return [...scripts.values()].some(
+    (script) => /\b(audit|npm audit|pnpm audit|yarn audit)\b/i.test(script)
+  );
+}
+function packageJsonHasHeavyTestDependency(repoPath, manifest) {
+  const fullPath = join(repoPath, manifest);
+  if (!isRegularFile(fullPath)) return false;
+  const parsed = parseJsonObject(readFileSync(fullPath, "utf8"));
+  if (!parsed) return false;
+  const names = [
+    ...Object.keys(isRecord(parsed.dependencies) ? parsed.dependencies : {}),
+    ...Object.keys(isRecord(parsed.devDependencies) ? parsed.devDependencies : {})
+  ];
+  return names.some((name) => HEAVY_TEST_DEPENDENCY_NAME_PATTERN.test(name));
+}
+function isImplementationFile(file) {
+  return /(^|\/)(src|app|lib|packages|cmd|include|source|Sources)\//.test(file) && /\.(ts|tsx|js|jsx|py|go|rs|java|rb|cpp|cc|cxx|c|h|hpp|kt|swift|php)$/.test(file);
+}
+function isAuditFile(file) {
+  return (
+    // goal_cejel_calibration_fix_with_strict_gate_2026-07-06: mature OSS repos document the
+    // same audit-trail practice under different filenames/extensions than Alfred's own
+    // conventions (Flask ships CHANGES.rst, not CHANGELOG.md) — recognize the common OSS
+    // release-notes/security-policy/provenance equivalents so real audit-trail artifacts are
+    // credited instead of silently missing the pattern.
+    /(^|\/)(CHANGELOG|CHANGES|HISTORY|NEWS|RELEASE_NOTES|RELEASES|SECURITY|AUDIT|STATUS)\.(md|rst|txt)$/i.test(
+      file
+    ) || /(^|\/)docs\/.*(audit|runbook|incident|changelog|security).*\.(md|rst)$/i.test(file) || // Provenance/signed-release tooling config is itself audit-trail evidence (a repo that
+    // wires SLSA/cosign attestation or CITATION.cff is documenting release provenance).
+    /(^|\/)CITATION\.cff$/i.test(file)
+  );
+}
+function isSecurityPolicyOnlyAuditFile(file) {
+  return /(^|\/)SECURITY\.(md|rst|txt)$/i.test(file) || /(^|\/)docs\/.*security.*\.(md|rst)$/i.test(file);
+}
+function isFreshnessRatableAuditFile(file) {
+  return isAuditFile(file) && !isSecurityPolicyOnlyAuditFile(file);
+}
+function isIgnoredScanFile(file) {
+  return /(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|README\.md|CHANGELOG\.md)$/.test(file) || isEnvTemplatePath(file);
+}
+function findRootPackageJson(repoFiles) {
+  return repoFiles.includes("package.json") ? "package.json" : null;
+}
+function isRegularFile(path) {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function fileContains(repoPath, file, pattern) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return false;
+  return pattern.test(readFileSync(fullPath, "utf8"));
+}
+function fileContainsCommittedSecret(repoPath, file) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return false;
+  return containsRealSecret(readFileSync(fullPath, "utf8"));
+}
+function containsRealSecret(contents) {
+  SECRET_ASSIGNMENT_PATTERN.lastIndex = 0;
+  for (const match of contents.matchAll(SECRET_ASSIGNMENT_PATTERN)) {
+    const rawValue = match[1];
+    if (!rawValue) continue;
+    const value = rawValue.replace(/[,;)]$/, "");
+    if (isPlaceholderSecretValue(value)) continue;
+    if (looksLikeSecretValue(value)) return true;
+  }
+  return false;
+}
+function collectHistorySecretEvidence(repoPath) {
+  const historyEntries = readCredentialHistoryEntries(repoPath);
+  let scannedFiles = 0;
+  let envPathEvidence = null;
+  for (const entry of historyEntries) {
+    if (scannedFiles >= HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT) {
+      return { evidence: null, envPathEvidence, truncated: true };
+    }
+    scannedFiles += 1;
+    const contents = readGitBlob(repoPath, entry.commit, entry.path);
+    if (!contents) continue;
+    if (containsRealSecret(contents)) {
+      return {
+        evidence: {
+          kind: "secret_scan",
+          label: "Committed secret in recent git history",
+          path: entry.path,
+          contentHash: entry.commit
+        },
+        envPathEvidence,
+        truncated: false
+      };
+    }
+    if (!envPathEvidence && isEnvHistoryPath(entry.path)) {
+      envPathEvidence = {
+        kind: "secret_scan",
+        label: ".env file (not a template) tracked in git history; no confirmed secret value found",
+        path: entry.path,
+        contentHash: entry.commit
+      };
+    }
+  }
+  return { evidence: null, envPathEvidence, truncated: false };
+}
+function readCredentialHistoryEntries(repoPath) {
+  const entries = [];
+  const seen = /* @__PURE__ */ new Set();
+  const appendEntry = (entry) => {
+    const key = `${entry.commit}:${entry.path}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    entries.push(entry);
+  };
+  try {
+    const commits = execFileSync("git", ["rev-list", "--all"], {
+      cwd: repoPath,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const output = execFileSync(
+      "git",
+      [
+        "diff-tree",
+        "--stdin",
+        "--root",
+        "--name-only",
+        "-r",
+        "--diff-filter=AM",
+        "--pretty=format:commit:%H"
+      ],
+      {
+        cwd: repoPath,
+        encoding: "utf8",
+        input: commits,
+        stdio: ["pipe", "pipe", "ignore"]
+      }
+    );
+    let currentCommit = null;
+    for (const line of output.split("\n")) {
+      if (line.startsWith("commit:")) {
+        currentCommit = line.slice("commit:".length);
+        continue;
+      }
+      const path = line.trim();
+      if (!currentCommit || !path) continue;
+      if (!isCredentialHistoryPath(path)) continue;
+      appendEntry({ commit: currentCommit, path });
+    }
+  } catch {
+  }
+  for (const entry of readDeletedCredentialHistoryEntries(repoPath)) {
+    appendEntry(entry);
+  }
+  return entries;
+}
+function readDeletedCredentialHistoryEntries(repoPath) {
+  const deletedPaths = readDeletedCredentialHistoryPaths(repoPath);
+  const entries = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const path of deletedPaths) {
+    for (const commit of readHistoryCommitsForPath(repoPath, path)) {
+      const key = `${commit}:${path}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      entries.push({ commit, path });
+    }
+  }
+  return entries;
+}
+function readDeletedCredentialHistoryPaths(repoPath) {
+  try {
+    const output = execFileSync(
+      "git",
+      ["log", "--all", "--diff-filter=D", "--name-status", "--format=commit:%H"],
+      {
+        cwd: repoPath,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"]
+      }
+    );
+    const paths = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const line of output.split("\n")) {
+      if (!line.startsWith("D	")) continue;
+      const path = line.slice(2).trim();
+      if (!path || seen.has(path)) continue;
+      if (!isCredentialHistoryPath(path)) continue;
+      seen.add(path);
+      paths.push(path);
+    }
+    return paths;
+  } catch {
+    return [];
+  }
+}
+function readHistoryCommitsForPath(repoPath, path) {
+  try {
+    const output = execFileSync(
+      "git",
+      ["log", "--all", "--diff-filter=AM", "--format=%H", "--", path],
+      {
+        cwd: repoPath,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"]
+      }
+    );
+    return output.split("\n").map((line) => line.trim()).filter((line) => /^[0-9a-f]{40}$/i.test(line));
+  } catch {
+    return [];
+  }
+}
+function isCredentialHistoryPath(path) {
+  if (isHardExcludedPath(path)) return false;
+  const lowerPath = path.toLowerCase();
+  const basename3 = lowerPath.split("/").at(-1) ?? lowerPath;
+  if (/\.env(?:\.|$)/.test(basename3)) {
+    return true;
+  }
+  return lowerPath.includes("secret") || lowerPath.includes("credential") || basename3.endsWith(".pem") || basename3.endsWith(".key") || basename3 === "id_rsa" || basename3.endsWith(".p12") || basename3.endsWith(".pfx");
+}
+function isEnvHistoryPath(path) {
+  if (isEnvTemplatePath(path)) return false;
+  const basename3 = path.toLowerCase().split("/").at(-1) ?? path.toLowerCase();
+  return /\.env(?:\.|$)/.test(basename3);
+}
+function readGitBlob(repoPath, commit, path) {
+  try {
+    return execFileSync("git", ["show", `${commit}:${path}`], {
+      cwd: repoPath,
+      encoding: "utf8",
+      maxBuffer: 512e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+  } catch {
+    return null;
+  }
+}
+var ALL_CAPS_SNAKE_PLACEHOLDER_PATTERN = /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/;
+function isPlaceholderSecretValue(value) {
+  const normalized = value.trim().toLowerCase();
+  return PLACEHOLDER_SECRET_PATTERN.test(normalized) || normalized.includes("your-") || normalized.includes("example") || ALL_CAPS_SNAKE_PLACEHOLDER_PATTERN.test(value.trim()) || isSyntheticFixtureSecretValue(normalized) || isFillerRunSecretValue(normalized);
+}
+function isFillerRunSecretValue(value) {
+  const candidates = [value];
+  const sepIdx = Math.max(value.lastIndexOf("_"), value.lastIndexOf("-"));
+  if (sepIdx > 0 && sepIdx < value.length - 1) {
+    candidates.push(value.slice(sepIdx + 1));
+  }
+  for (const body of candidates) {
+    if (body.length < 8) continue;
+    const counts = /* @__PURE__ */ new Map();
+    for (const ch of body) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+    const distinct = counts.size;
+    const maxRun = Math.max(...counts.values());
+    if (distinct <= 2 && maxRun / body.length >= 0.8) return true;
   }
   return false;
 }
-function isDependencyManifest(file) {
-  return /(^|\/)(package\.json|pyproject\.toml|requirements(?:[^/]*)?\.txt|go\.mod|Cargo\.toml|pom\.xml|build\.gradle|vcpkg\.json|Pipfile|CMakeLists\.txt|conanfile\.txt|conanfile\.py)$/.test(
-    file
-  );
-}
-function isLockfile(file) {
-  return /(^|\/)(pnpm-lock\.yaml|package-lock\.json|yarn\.lock|uv\.lock|poetry\.lock|go\.sum|Cargo\.lock|Pipfile\.lock|composer\.lock|conan\.lock|vcpkg\.lock\.json)$/.test(
-    file
-  );
-}
-function isDependencyUpdateConfig(file) {
-  return /(^|\/)(renovate\.json|renovate\.json5|\.renovaterc\.json|dependabot\.ya?ml)$/.test(file) || /^\.github\/dependabot\.ya?ml$/.test(file);
+function isSyntheticFixtureSecretValue(value) {
+  return value.includes("abcdefghijklmnopqrstuvwxyz") || value.includes("0123456789abcdefghijklmnopqrstuvwxyz") || value.includes("abcdefghijklmnopqrstuvwxyz0123456789") || value.includes("abcdefghijklmnopqrst");
 }
-function packageJsonHasAuditScript(repoPath, manifest) {
+function hasSuspiciousDependencies(repoPath, manifest) {
   if (!manifest.endsWith("package.json")) return false;
-  const scripts = readPackageScripts(join3(repoPath, manifest));
-  return [...scripts.values()].some(
-    (script) => /\b(audit|npm audit|pnpm audit|yarn audit)\b/i.test(script)
-  );
-}
-function packageJsonHasHeavyTestDependency(repoPath, manifest) {
-  const fullPath = join3(repoPath, manifest);
+  const fullPath = join(repoPath, manifest);
   if (!isRegularFile(fullPath)) return false;
-  const parsed = parseJsonObject(readFileSync6(fullPath, "utf8"));
+  const parsed = parseJsonObject(readFileSync(fullPath, "utf8"));
   if (!parsed) return false;
-  const names = [
-    ...Object.keys(isRecord(parsed.dependencies) ? parsed.dependencies : {}),
-    ...Object.keys(isRecord(parsed.devDependencies) ? parsed.devDependencies : {})
-  ];
-  return names.some((name) => HEAVY_TEST_DEPENDENCY_NAME_PATTERN.test(name));
+  const dependencies = isRecord(parsed.dependencies) ? parsed.dependencies : {};
+  const devDependencies = isRecord(parsed.devDependencies) ? parsed.devDependencies : {};
+  const names = [...Object.keys(dependencies), ...Object.keys(devDependencies)];
+  return names.some(
+    (name) => /^(todo|fake|placeholder|example)-|does-not-exist| hallucinated/i.test(name)
+  );
 }
-function isImplementationFile(file) {
-  return /(^|\/)(src|app|lib|packages|cmd|include|source|Sources)\//.test(file) && /\.(ts|tsx|js|jsx|py|go|rs|java|rb|cpp|cc|cxx|c|h|hpp|kt|swift|php)$/.test(file);
+function readRecentCommits(repoPath) {
+  try {
+    const output = execFileSync("git", ["log", "--max-count=12", "--format=%H%x00%s"], {
+      cwd: repoPath,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    if (!output) return [];
+    return output.split("\n").map((line) => {
+      const [sha = "", subject = ""] = line.split("\0");
+      return { sha, subject };
+    }).filter((commit) => commit.sha.length >= 7);
+  } catch {
+    return [];
+  }
 }
-function isAuditFile(file) {
-  return (
-    // goal_cejel_calibration_fix_with_strict_gate_2026-07-06: mature OSS repos document the
-    // same audit-trail practice under different filenames/extensions than Alfred's own
-    // conventions (Flask ships CHANGES.rst, not CHANGELOG.md) — recognize the common OSS
-    // release-notes/security-policy/provenance equivalents so real audit-trail artifacts are
-    // credited instead of silently missing the pattern.
-    /(^|\/)(CHANGELOG|CHANGES|HISTORY|NEWS|RELEASE_NOTES|RELEASES|SECURITY|AUDIT|STATUS)\.(md|rst|txt)$/i.test(
-      file
-    ) || /(^|\/)docs\/.*(audit|runbook|incident|changelog|security).*\.(md|rst)$/i.test(file) || // Provenance/signed-release tooling config is itself audit-trail evidence (a repo that
-    // wires SLSA/cosign attestation or CITATION.cff is documenting release provenance).
-    /(^|\/)CITATION\.cff$/i.test(file)
+function readPackageScripts(packageJsonPath) {
+  if (!isRegularFile(packageJsonPath)) return /* @__PURE__ */ new Map();
+  const parsed = parseJsonObject(readFileSync(packageJsonPath, "utf8"));
+  const scripts = parsed?.scripts;
+  if (!isRecord(scripts)) return /* @__PURE__ */ new Map();
+  return new Map(
+    Object.entries(scripts).filter(
+      (entry) => typeof entry[1] === "string"
+    )
   );
 }
-function isSecurityPolicyOnlyAuditFile(file) {
-  return /(^|\/)SECURITY\.(md|rst|txt)$/i.test(file) || /(^|\/)docs\/.*security.*\.(md|rst)$/i.test(file);
+function evidenceForRelative(repoPath, path, kind, label) {
+  const fullPath = join(repoPath, path);
+  const contents = isRegularFile(fullPath) ? readFileSync(fullPath, "utf8") : "";
+  return {
+    kind,
+    label,
+    path,
+    ...contents ? {
+      line: firstMeaningfulLine(contents),
+      contentHash: createHash2("sha256").update(contents).digest("hex")
+    } : {}
+  };
 }
-function isFreshnessRatableAuditFile(file) {
-  return isAuditFile(file) && !isSecurityPolicyOnlyAuditFile(file);
+function evidenceForRelativeAtLine(repoPath, path, kind, label, line) {
+  const fullPath = join(repoPath, path);
+  const contents = isRegularFile(fullPath) ? readFileSync(fullPath, "utf8") : "";
+  return {
+    kind,
+    label,
+    path,
+    line,
+    ...contents ? { contentHash: createHash2("sha256").update(contents).digest("hex") } : {}
+  };
 }
-function isIgnoredScanFile(file) {
-  return /(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|README\.md|CHANGELOG\.md)$/.test(file) || isEnvTemplatePath(file);
+function metric(name, label, value, max, weight, unit, description, kind) {
+  return {
+    name,
+    label,
+    value: Math.max(0, value),
+    max,
+    ...kind ? { kind } : {},
+    weight,
+    unit,
+    description
+  };
 }
-function findRootPackageJson(repoFiles) {
-  return repoFiles.includes("package.json") ? "package.json" : null;
+function firstMeaningfulLine(contents) {
+  const lines = contents.split("\n");
+  const index = lines.findIndex((line) => line.trim().length > 0);
+  return index === -1 ? 1 : index + 1;
 }
-function isRegularFile(path) {
+function readGitHead(repoPath) {
+  try {
+    return execFileSync("git", ["rev-parse", "HEAD"], {
+      cwd: repoPath,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function hasEnvPathInGitHistory(repoPath) {
   try {
-    return statSync2(path).isFile();
+    const output = execFileSync(
+      "git",
+      ["log", "--all", "--diff-filter=AM", "--name-only", "--format="],
+      {
+        cwd: repoPath,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        maxBuffer: 512e3
+      }
+    ).trim();
+    if (!output) return false;
+    return output.split("\n").some((p) => /(?:^|\/)\.env(?:\.|$)/i.test(p.trim()));
   } catch {
     return false;
   }
 }
-function fileContains(repoPath, file, pattern) {
-  const fullPath = join3(repoPath, file);
-  if (!isRegularFile(fullPath)) return false;
-  return pattern.test(readFileSync6(fullPath, "utf8"));
+
+// src/witan/public-scan.ts
+import { resolve as resolve2 } from "path";
+
+// src/witan/ingest.ts
+import { readFileSync as readFileSync5, readdirSync as readdirSync2 } from "fs";
+import { join as join2 } from "path";
+
+// src/witan/finding-limits.ts
+var RULE_ID_MAX = 200;
+var MESSAGE_MAX = 500;
+var LOCATION_MAX = 700;
+function clamp(value, max) {
+  if (value.length <= max) return value;
+  const ellipsis = "...";
+  return `${value.slice(0, Math.max(max - ellipsis.length, 0))}${ellipsis}`;
 }
-function fileContainsCommittedSecret(repoPath, file) {
-  const fullPath = join3(repoPath, file);
-  if (!isRegularFile(fullPath)) return false;
-  return containsRealSecret(readFileSync6(fullPath, "utf8"));
+function clampFinding(finding) {
+  return {
+    ...finding,
+    ruleId: clamp(finding.ruleId, RULE_ID_MAX),
+    message: clamp(finding.message, MESSAGE_MAX),
+    ...finding.location ? { location: clamp(finding.location, LOCATION_MAX) } : {}
+  };
 }
-function containsRealSecret(contents) {
-  SECRET_ASSIGNMENT_PATTERN.lastIndex = 0;
-  for (const match of contents.matchAll(SECRET_ASSIGNMENT_PATTERN)) {
-    const rawValue = match[1];
-    if (!rawValue) continue;
-    const value = rawValue.replace(/[,;)]$/, "");
-    if (isPlaceholderSecretValue(value)) continue;
-    if (looksLikeSecretValue(value)) return true;
+
+// src/witan/generic-adapter.ts
+import { readFileSync as readFileSync2 } from "fs";
+var VALID_DIMENSIONS = /* @__PURE__ */ new Set([
+  "A1",
+  "A2",
+  "A3",
+  "A4",
+  "A5",
+  "B1",
+  "B2",
+  "B3",
+  "B4",
+  "B5",
+  "B6"
+]);
+var VALID_SEVERITIES = /* @__PURE__ */ new Set(["critical", "warning", "info"]);
+function isGenericSignalDocument(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
+  const doc = raw;
+  return typeof doc.tool === "string" && doc.tool.length > 0 && Array.isArray(doc.signals);
+}
+function parseGenericJson(raw) {
+  if (!isGenericSignalDocument(raw)) return [];
+  const source = raw.tool ?? "unknown";
+  const signals = [];
+  for (const signal of raw.signals ?? []) {
+    const dimension = signal.dimension;
+    if (!dimension || !VALID_DIMENSIONS.has(dimension)) continue;
+    const weight = typeof signal.weight === "number" && Number.isFinite(signal.weight) ? Math.min(Math.max(signal.weight, 0), 1) : 0.5;
+    const findings = [];
+    for (const finding of signal.findings ?? []) {
+      const severity = finding.severity;
+      if (!severity || !VALID_SEVERITIES.has(severity)) continue;
+      const ruleId = finding.ruleId ?? "unknown";
+      findings.push({
+        ruleId,
+        severity,
+        message: finding.message ?? ruleId,
+        ...finding.location ? { location: finding.location } : {}
+      });
+    }
+    if (findings.length === 0) continue;
+    signals.push({ source, dimension, weight, findings });
+  }
+  return signals;
+}
+
+// src/witan/sarif-adapter.ts
+import { readFileSync as readFileSync3 } from "fs";
+var DIMENSION_RULES = [
+  // A2 — injection / secrets / auth (high weight)
+  {
+    pattern: /sql[- _]?inject|cwe-89|sqli|command[- _]?inject|cwe-78|os[- _]?cmd|rce|remote[- _]?code/i,
+    dimension: "A2",
+    weight: 0.9
+  },
+  {
+    pattern: /secret|credential|api[- _]?key|password[- _]?leak|hardcoded[- _]?(token|key|secret)|cwe-259|cwe-798/i,
+    dimension: "A2",
+    weight: 0.9
+  },
+  {
+    pattern: /path[- _]?traversal|directory[- _]?traversal|cwe-22|lfi|rfi/i,
+    dimension: "A2",
+    weight: 0.8
+  },
+  {
+    pattern: /ssrf|server[- _]?side[- _]?request[- _]?forg|cwe-918/i,
+    dimension: "A2",
+    weight: 0.8
+  },
+  {
+    pattern: /xxe|xml[- _]?external[- _]?entity|cwe-611/i,
+    dimension: "A2",
+    weight: 0.8
+  },
+  {
+    pattern: /auth[- _]?bypass|broken[- _]?auth|missing[- _]?auth|cwe-287|cwe-306|cwe-863|cwe-862/i,
+    dimension: "A2",
+    weight: 0.7
+  },
+  {
+    pattern: /xss|cross[- _]?site[- _]?script|cwe-79/i,
+    dimension: "A2",
+    weight: 0.6
+  },
+  // A4 — dependency vulnerabilities
+  {
+    pattern: /cve-\d{4}-\d+|supply[- _]?chain|depend[a-z]*[- _]?vulner|outdated[- _]?depend|deprecated[- _]?package/i,
+    dimension: "A4",
+    weight: 0.8
+  },
+  {
+    pattern: /npm[- _]?audit|yarn[- _]?audit|pnpm[- _]?audit|pip[- _]?audit|cargo[- _]?audit/i,
+    dimension: "A4",
+    weight: 0.7
+  },
+  // A3 — production readiness / insecure config
+  {
+    pattern: /insecure[- _]?tls|weak[- _]?cipher|tls[- _]?version|http[- _]?strict|hsts|csp[- _]?missing|cwe-326|cwe-327/i,
+    dimension: "A3",
+    weight: 0.5
+  },
+  {
+    pattern: /error[- _]?handl|unhandled[- _]?exception|crash|uncaught|stacktrace[- _]?leak/i,
+    dimension: "A3",
+    weight: 0.4
+  },
+  {
+    pattern: /debug[- _]?mode|dev[- _]?endpoint|staging[- _]?secret/i,
+    dimension: "A3",
+    weight: 0.4
+  },
+  // A1 — test integrity (low weight; SARIF rarely surfaces this)
+  {
+    pattern: /skipped[- _]?test|hollow[- _]?test|empty[- _]?assert|no[- _]?assertion/i,
+    dimension: "A1",
+    weight: 0.2
   }
-  return false;
+];
+var DEFAULT_DIMENSION = "A2";
+var DEFAULT_WEIGHT = 0.3;
+var DROP_LEVEL = /* @__PURE__ */ new Set(["none"]);
+function mapLevel(level) {
+  if (!level || DROP_LEVEL.has(level)) return null;
+  if (level === "error") return "critical";
+  if (level === "warning") return "warning";
+  return "info";
 }
-function collectHistorySecretEvidence(repoPath) {
-  const historyEntries = readCredentialHistoryEntries(repoPath);
-  let scannedFiles = 0;
-  let envPathEvidence = null;
-  for (const entry of historyEntries) {
-    if (scannedFiles >= HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT) {
-      return { evidence: null, envPathEvidence, truncated: true };
-    }
-    scannedFiles += 1;
-    const contents = readGitBlob(repoPath, entry.commit, entry.path);
-    if (!contents) continue;
-    if (containsRealSecret(contents)) {
-      return {
-        evidence: {
-          kind: "secret_scan",
-          label: "Committed secret in recent git history",
-          path: entry.path,
-          contentHash: entry.commit
-        },
-        envPathEvidence,
-        truncated: false
-      };
-    }
-    if (!envPathEvidence && isEnvHistoryPath(entry.path)) {
-      envPathEvidence = {
-        kind: "secret_scan",
-        label: ".env file (not a template) tracked in git history; no confirmed secret value found",
-        path: entry.path,
-        contentHash: entry.commit
-      };
+function mapRuleToDimension(ruleId, rules) {
+  for (const rule of rules) {
+    if (rule.pattern.test(ruleId)) {
+      return { dimension: rule.dimension, weight: rule.weight };
     }
   }
-  return { evidence: null, envPathEvidence, truncated: false };
+  return { dimension: DEFAULT_DIMENSION, weight: DEFAULT_WEIGHT };
 }
-function readCredentialHistoryEntries(repoPath) {
-  const entries = [];
+function renderLocation(result) {
+  const loc = result.locations?.[0]?.physicalLocation;
+  if (!loc) return void 0;
+  const uri = loc.artifactLocation?.uri;
+  const line = loc.region?.startLine;
+  if (!uri) return void 0;
+  return line != null ? `${uri}:${line}` : uri;
+}
+function dedupeFindings(findings) {
   const seen = /* @__PURE__ */ new Set();
-  const appendEntry = (entry) => {
-    const key = `${entry.commit}:${entry.path}`;
-    if (seen.has(key)) return;
+  return findings.filter((f) => {
+    const key = `${f.ruleId}|${f.severity}|${f.location ?? ""}`;
+    if (seen.has(key)) return false;
     seen.add(key);
-    entries.push(entry);
-  };
-  try {
-    const commits = execFileSync("git", ["rev-list", "--all"], {
-      cwd: repoPath,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-    const output = execFileSync(
-      "git",
-      [
-        "diff-tree",
-        "--stdin",
-        "--root",
-        "--name-only",
-        "-r",
-        "--diff-filter=AM",
-        "--pretty=format:commit:%H"
-      ],
-      {
-        cwd: repoPath,
-        encoding: "utf8",
-        input: commits,
-        stdio: ["pipe", "pipe", "ignore"]
-      }
-    );
-    let currentCommit = null;
-    for (const line of output.split("\n")) {
-      if (line.startsWith("commit:")) {
-        currentCommit = line.slice("commit:".length);
-        continue;
-      }
-      const path = line.trim();
-      if (!currentCommit || !path) continue;
-      if (!isCredentialHistoryPath(path)) continue;
-      appendEntry({ commit: currentCommit, path });
-    }
-  } catch {
-  }
-  for (const entry of readDeletedCredentialHistoryEntries(repoPath)) {
-    appendEntry(entry);
-  }
-  return entries;
+    return true;
+  });
 }
-function readDeletedCredentialHistoryEntries(repoPath) {
-  const deletedPaths = readDeletedCredentialHistoryPaths(repoPath);
-  const entries = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const path of deletedPaths) {
-    for (const commit of readHistoryCommitsForPath(repoPath, path)) {
-      const key = `${commit}:${path}`;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      entries.push({ commit, path });
+function parseSarifJson(raw, extraDimensionRules) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
+  const dimensionRules = extraDimensionRules ? [...DIMENSION_RULES, ...extraDimensionRules] : DIMENSION_RULES;
+  const doc = raw;
+  if (!Array.isArray(doc.runs)) return [];
+  const buckets = /* @__PURE__ */ new Map();
+  for (const run of doc.runs) {
+    const driverName = run.tool?.driver?.name ?? "unknown";
+    const source = `sarif:${driverName}`;
+    const ruleDefaultLevels = /* @__PURE__ */ new Map();
+    for (const rule of run.tool?.driver?.rules ?? []) {
+      if (rule.id && rule.defaultConfiguration?.level) {
+        ruleDefaultLevels.set(rule.id, rule.defaultConfiguration.level);
+      }
     }
-  }
-  return entries;
-}
-function readDeletedCredentialHistoryPaths(repoPath) {
-  try {
-    const output = execFileSync(
-      "git",
-      ["log", "--all", "--diff-filter=D", "--name-status", "--format=commit:%H"],
-      {
-        cwd: repoPath,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"]
+    for (const result of run.results ?? []) {
+      const ruleId = result.ruleId ?? "unknown";
+      const effectiveLevel = result.level ?? ruleDefaultLevels.get(ruleId) ?? "warning";
+      const severity = mapLevel(effectiveLevel);
+      if (!severity) continue;
+      const message = result.message?.text ?? ruleId;
+      const location = renderLocation(result);
+      const { dimension, weight } = mapRuleToDimension(ruleId, dimensionRules);
+      const bucketKey = `${source}|${dimension}`;
+      if (!buckets.has(bucketKey)) {
+        buckets.set(bucketKey, { source, dimension, weight, findings: [] });
       }
-    );
-    const paths = [];
-    const seen = /* @__PURE__ */ new Set();
-    for (const line of output.split("\n")) {
-      if (!line.startsWith("D	")) continue;
-      const path = line.slice(2).trim();
-      if (!path || seen.has(path)) continue;
-      if (!isCredentialHistoryPath(path)) continue;
-      seen.add(path);
-      paths.push(path);
+      buckets.get(bucketKey)?.findings.push({ ruleId, severity, message, ...location ? { location } : {} });
     }
-    return paths;
-  } catch {
-    return [];
   }
+  return Array.from(buckets.values()).map(({ source, dimension, weight, findings }) => ({
+    source,
+    dimension,
+    weight,
+    findings: dedupeFindings(findings)
+  }));
 }
-function readHistoryCommitsForPath(repoPath, path) {
-  try {
-    const output = execFileSync(
-      "git",
-      ["log", "--all", "--diff-filter=AM", "--format=%H", "--", path],
-      {
-        cwd: repoPath,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"]
-      }
-    );
-    return output.split("\n").map((line) => line.trim()).filter((line) => /^[0-9a-f]{40}$/i.test(line));
-  } catch {
-    return [];
-  }
+
+// src/witan/scorecard-adapter.ts
+import { readFileSync as readFileSync4 } from "fs";
+var CHECK_RULES = {
+  // B2 — PR outcome traceability
+  "Branch-Protection": { dimension: "B2", weight: 0.8 },
+  "Code-Review": { dimension: "B2", weight: 0.7 },
+  // B3 — CI and QA discipline
+  "Dangerous-Workflow": { dimension: "B3", weight: 0.9 },
+  "Token-Permissions": { dimension: "B3", weight: 0.8 },
+  "CI-Tests": { dimension: "B3", weight: 0.7 },
+  Maintained: { dimension: "B3", weight: 0.3 },
+  // B4 — audit trail / release integrity
+  "Signed-Releases": { dimension: "B4", weight: 0.7 },
+  Packaging: { dimension: "B4", weight: 0.4 },
+  "Security-Policy": { dimension: "B4", weight: 0.4 },
+  // A4 — dependency hygiene
+  Vulnerabilities: { dimension: "A4", weight: 0.9 },
+  "Pinned-Dependencies": { dimension: "A4", weight: 0.8 },
+  "Dependency-Update-Tool": { dimension: "A4", weight: 0.6 },
+  // A2 — data-layer / static analysis
+  SAST: { dimension: "A2", weight: 0.7 },
+  "Binary-Artifacts": { dimension: "A2", weight: 0.6 },
+  // A1 — test integrity
+  Fuzzing: { dimension: "A1", weight: 0.3 }
+};
+function mapScoreToSeverity(score) {
+  if (score == null || Number.isNaN(score)) return null;
+  if (score < 0) return null;
+  if (score >= 10) return null;
+  if (score <= 3) return "critical";
+  if (score <= 6) return "warning";
+  return "info";
 }
-function isCredentialHistoryPath(path) {
-  if (isHardExcludedPath(path)) return false;
-  const lowerPath = path.toLowerCase();
-  const basename4 = lowerPath.split("/").at(-1) ?? lowerPath;
-  if (/\.env(?:\.|$)/.test(basename4)) {
+function dedupeFindings2(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  return findings.filter((f) => {
+    const key = `${f.ruleId}|${f.severity}|${f.location ?? ""}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
     return true;
-  }
-  return lowerPath.includes("secret") || lowerPath.includes("credential") || basename4.endsWith(".pem") || basename4.endsWith(".key") || basename4 === "id_rsa" || basename4.endsWith(".p12") || basename4.endsWith(".pfx");
-}
-function isEnvHistoryPath(path) {
-  if (isEnvTemplatePath(path)) return false;
-  const basename4 = path.toLowerCase().split("/").at(-1) ?? path.toLowerCase();
-  return /\.env(?:\.|$)/.test(basename4);
+  });
 }
-function readGitBlob(repoPath, commit, path) {
-  try {
-    return execFileSync("git", ["show", `${commit}:${path}`], {
-      cwd: repoPath,
-      encoding: "utf8",
-      maxBuffer: 512e3,
-      stdio: ["ignore", "pipe", "ignore"]
+function parseScorecardJson(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
+  const doc = raw;
+  if (!Array.isArray(doc.checks)) return [];
+  const buckets = /* @__PURE__ */ new Map();
+  for (const check of doc.checks) {
+    const name = check.name;
+    if (!name) continue;
+    const rule = CHECK_RULES[name];
+    if (!rule) continue;
+    const severity = mapScoreToSeverity(check.score);
+    if (!severity) continue;
+    const scoreText = typeof check.score === "number" ? `${check.score}/10` : "n/a";
+    const message = `${name} (Scorecard ${scoreText}): ${check.reason ?? "weakness detected"}`.slice(0, 500);
+    const location = check.documentation?.url;
+    const bucket = buckets.get(rule.dimension) ?? { weight: 0, findings: [] };
+    bucket.weight = Math.max(bucket.weight, rule.weight);
+    bucket.findings.push({
+      ruleId: `scorecard:${name}`,
+      severity,
+      message,
+      ...location ? { location } : {}
     });
-  } catch {
-    return null;
+    buckets.set(rule.dimension, bucket);
   }
+  return Array.from(buckets.entries()).map(([dimension, { weight, findings }]) => ({
+    source: "scorecard",
+    dimension,
+    weight,
+    findings: dedupeFindings2(findings)
+  }));
 }
-var ALL_CAPS_SNAKE_PLACEHOLDER_PATTERN = /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/;
-function isPlaceholderSecretValue(value) {
-  const normalized = value.trim().toLowerCase();
-  return PLACEHOLDER_SECRET_PATTERN.test(normalized) || normalized.includes("your-") || normalized.includes("example") || ALL_CAPS_SNAKE_PLACEHOLDER_PATTERN.test(value.trim()) || isSyntheticFixtureSecretValue(normalized) || isFillerRunSecretValue(normalized);
+
+// src/witan/ingest.ts
+function looksLikeSarif(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
+  return Array.isArray(raw.runs);
 }
-function isFillerRunSecretValue(value) {
-  const candidates = [value];
-  const sepIdx = Math.max(value.lastIndexOf("_"), value.lastIndexOf("-"));
-  if (sepIdx > 0 && sepIdx < value.length - 1) {
-    candidates.push(value.slice(sepIdx + 1));
+function looksLikeScorecard(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
+  return Array.isArray(raw.checks);
+}
+function countRawEntries(raw) {
+  const obj = raw;
+  if (Array.isArray(obj.runs)) {
+    return obj.runs.reduce((sum, run) => {
+      const results = run.results;
+      return sum + (Array.isArray(results) ? results.length : 0);
+    }, 0);
   }
-  for (const body of candidates) {
-    if (body.length < 8) continue;
-    const counts = /* @__PURE__ */ new Map();
-    for (const ch of body) counts.set(ch, (counts.get(ch) ?? 0) + 1);
-    const distinct = counts.size;
-    const maxRun = Math.max(...counts.values());
-    if (distinct <= 2 && maxRun / body.length >= 0.8) return true;
+  if (Array.isArray(obj.checks)) return obj.checks.length;
+  if (Array.isArray(obj.signals)) {
+    return obj.signals.reduce((sum, signal) => {
+      const findings = signal.findings;
+      return sum + (Array.isArray(findings) ? findings.length : 0);
+    }, 0);
   }
-  return false;
-}
-function isSyntheticFixtureSecretValue(value) {
-  return value.includes("abcdefghijklmnopqrstuvwxyz") || value.includes("0123456789abcdefghijklmnopqrstuvwxyz") || value.includes("abcdefghijklmnopqrstuvwxyz0123456789") || value.includes("abcdefghijklmnopqrst");
+  return 0;
 }
-function hasSuspiciousDependencies(repoPath, manifest) {
-  if (!manifest.endsWith("package.json")) return false;
-  const fullPath = join3(repoPath, manifest);
-  if (!isRegularFile(fullPath)) return false;
-  const parsed = parseJsonObject(readFileSync6(fullPath, "utf8"));
-  if (!parsed) return false;
-  const dependencies = isRecord(parsed.dependencies) ? parsed.dependencies : {};
-  const devDependencies = isRecord(parsed.devDependencies) ? parsed.devDependencies : {};
-  const names = [...Object.keys(dependencies), ...Object.keys(devDependencies)];
-  return names.some(
-    (name) => /^(todo|fake|placeholder|example)-|does-not-exist| hallucinated/i.test(name)
-  );
+function rawToolName(raw) {
+  const obj = raw;
+  if (Array.isArray(obj.runs)) {
+    const firstRun = obj.runs[0];
+    return firstRun?.tool?.driver?.name ?? "unknown";
+  }
+  if (typeof obj.tool === "string" && obj.tool.length > 0) return obj.tool;
+  return "scorecard";
 }
-function readRecentCommits(repoPath) {
+function parseIngestFile(filePath) {
+  let raw;
   try {
-    const output = execFileSync("git", ["log", "--max-count=12", "--format=%H%x00%s"], {
-      cwd: repoPath,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-    if (!output) return [];
-    return output.split("\n").map((line) => {
-      const [sha = "", subject = ""] = line.split("\0");
-      return { sha, subject };
-    }).filter((commit) => commit.sha.length >= 7);
-  } catch {
-    return [];
+    raw = JSON.parse(stripBom(readFileSync5(filePath, "utf8")));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Cejel: could not parse ingest file as JSON: ${filePath} (${message})`);
   }
+  let signals;
+  if (looksLikeSarif(raw)) signals = parseSarifJson(raw);
+  else if (looksLikeScorecard(raw)) signals = parseScorecardJson(raw);
+  else if (isGenericSignalDocument(raw)) signals = parseGenericJson(raw);
+  if (!signals) {
+    throw new Error(
+      `Cejel: unrecognized ingest file format: ${filePath} \u2014 expected SARIF (a "runs" array), OpenSSF Scorecard JSON (a "checks" array), or the generic Cejel external-signal shape (a "tool" string + "signals" array). See the cejel README "Aggregate your scanners".`
+    );
+  }
+  const rawCount = countRawEntries(raw);
+  const mappedCount = signals.reduce((sum, signal) => sum + signal.findings.length, 0);
+  if (rawCount > 0 && mappedCount === 0) {
+    process.stderr.write(
+      `Cejel: ${rawCount} findings from ${rawToolName(raw)} (${filePath}), 0 mapped to trust criteria
+`
+    );
+  }
+  return signals.map((signal) => ({
+    ...signal,
+    findings: signal.findings.map(clampFinding)
+  }));
 }
-function readPackageScripts(packageJsonPath) {
-  if (!isRegularFile(packageJsonPath)) return /* @__PURE__ */ new Map();
-  const parsed = parseJsonObject(readFileSync6(packageJsonPath, "utf8"));
-  const scripts = parsed?.scripts;
-  if (!isRecord(scripts)) return /* @__PURE__ */ new Map();
-  return new Map(
-    Object.entries(scripts).filter(
-      (entry) => typeof entry[1] === "string"
-    )
-  );
-}
-function evidenceForRelative(repoPath, path, kind, label) {
-  const fullPath = join3(repoPath, path);
-  const contents = isRegularFile(fullPath) ? readFileSync6(fullPath, "utf8") : "";
-  return {
-    kind,
-    label,
-    path,
-    ...contents ? {
-      line: firstMeaningfulLine(contents),
-      contentHash: createHash("sha256").update(contents).digest("hex")
-    } : {}
-  };
-}
-function metric(name, label, value, max, weight, unit, description, kind) {
-  return {
-    name,
-    label,
-    value: Math.max(0, value),
-    max,
-    ...kind ? { kind } : {},
-    weight,
-    unit,
-    description
-  };
-}
-function firstMeaningfulLine(contents) {
-  const lines = contents.split("\n");
-  const index = lines.findIndex((line) => line.trim().length > 0);
-  return index === -1 ? 1 : index + 1;
-}
-function readGitHead(repoPath) {
+function expandIngestPattern(pattern) {
+  if (!pattern.includes("*")) return [pattern];
+  const lastSlash = pattern.lastIndexOf("/");
+  const dir = lastSlash === -1 ? "." : pattern.slice(0, lastSlash);
+  const filePattern = lastSlash === -1 ? pattern : pattern.slice(lastSlash + 1);
+  const regexSource = filePattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  const regex = new RegExp(`^${regexSource}$`);
+  let entries;
   try {
-    return execFileSync("git", ["rev-parse", "HEAD"], {
-      cwd: repoPath,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
+    entries = readdirSync2(dir);
   } catch {
-    return null;
+    return [];
   }
+  return entries.filter((name) => regex.test(name)).sort().map((name) => join2(dir, name));
 }
-function hasEnvPathInGitHistory(repoPath) {
+function discoverIngestInputs(repoPath) {
+  const inputsDir = join2(repoPath, ".cejel", "inputs");
+  let entries;
   try {
-    const output = execFileSync(
-      "git",
-      ["log", "--all", "--diff-filter=AM", "--name-only", "--format="],
-      {
-        cwd: repoPath,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-        maxBuffer: 512e3
-      }
-    ).trim();
-    if (!output) return false;
-    return output.split("\n").some((p) => /(?:^|\/)\.env(?:\.|$)/i.test(p.trim()));
+    entries = readdirSync2(inputsDir);
   } catch {
-    return false;
+    return [];
   }
+  return entries.filter((name) => /\.(sarif|json)$/i.test(name)).sort().map((name) => join2(inputsDir, name));
 }
 
-// ../witan/src/rubric.ts
+// src/witan/rubric.ts
 var WITAN_RUBRIC = [
   {
     id: "A1",
@@ -8924,7 +7682,7 @@ var WITAN_RUBRIC = [
   }
 ];
 
-// ../witan/src/scoring.ts
+// src/witan/scoring.ts
 var MAX_SIGNAL_ADJUSTMENT = 0.8;
 function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
   const parsedInput = WitanReportInputSchema.parse(input);
@@ -9232,7 +7990,7 @@ function roundScore(score) {
   return Math.round(score * 10) / 10;
 }
 
-// ../witan/src/public-scan.ts
+// src/witan/public-scan.ts
 function scoreRepoWithPublicCejel(options) {
   const input = buildWitanInputFromRepo({
     productSlug: options.productSlug,
@@ -9268,85 +8026,15 @@ function resolvePublicIngestSignals(options) {
   return files.flatMap((file) => parseIngestFile(file));
 }
 
-// ../witan/src/repo-clone.ts
-import { execFileSync as execFileSync2 } from "child_process";
-import { mkdirSync, rmSync } from "fs";
-import { tmpdir } from "os";
-import { join as join4 } from "path";
-
-// ../witan/src/cejel-package-name.ts
-import { readFileSync as readFileSync7 } from "fs";
-import { fileURLToPath } from "url";
-
-// ../witan/src/leaderboard.ts
-var RESERVED_CORPUS_SLUGS = ["biome", "tsconfig", "package"];
-var LeaderboardCorpusEntrySchema = external_exports.object({
-  // Also the evidence-report slug (reports/<name>.{json,md,svg}) — min length 3
-  // to satisfy the WitanReport productSlug pattern.
-  name: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/).refine((value) => !RESERVED_CORPUS_SLUGS.includes(value), {
-    message: "Corpus entry name collides with a tool config filename (reports/<name>.json would be discovered by that tool) \u2014 pick a different slug, e.g. biomejs."
-  }),
-  category: external_exports.string().min(1).max(80),
-  expectedArchetype: external_exports.string().min(1).max(40),
-  license: external_exports.string().min(1).max(80),
-  /**
-   * Repository visibility — the redaction policy's first-class input
-   * (goal_cejel_redaction_policy_is_verifiability_2026-07-12): a path is
-   * published exactly when the reader can check it (public), and withheld
-   * entirely when they can't (private). FAIL CLOSED: absent or unrecognized
-   * resolves to 'private' via `.catch` rather than throwing or defaulting
-   * open, so a corpus entry can never accidentally publish paths by omission.
-   */
-  visibility: external_exports.enum(["public", "private"]).catch("private"),
-  url: external_exports.string().url().optional(),
-  /**
-   * Immutable source snapshot for URL entries. A rubric rescore always uses
-   * the same commits; changing one is a separate corpus update.
-   */
-  commit: external_exports.string().regex(/^[0-9a-f]{40}$/).optional(),
-  self: external_exports.literal(true).optional(),
-  /**
-   * A directory inside THIS repository (relative to its root), for internal
-   * entries that are a sub-package rather than the whole repo (e.g. the public
-   * cejel CLI at packages/witan-cli). Scored locally like "self".
-   */
-  path: external_exports.string().min(1).max(200).regex(/^[A-Za-z0-9._/-]+$/).refine((value) => !value.startsWith("/") && !value.split("/").includes(".."), {
-    message: 'Corpus entry "path" must be relative and must not traverse upward.'
-  }).optional()
-}).strict().refine((entry) => (entry.url ? 1 : 0) + (entry.self ? 1 : 0) + (entry.path ? 1 : 0) === 1, {
-  message: 'Corpus entry must have exactly one of "url", "self", or "path".'
-}).refine((entry) => entry.url ? entry.commit !== void 0 : entry.commit === void 0, {
-  message: 'Every URL corpus entry must declare exactly one immutable 40-character "commit".'
-});
-var LeaderboardCorpusSchema = external_exports.object({
-  comment: external_exports.string().min(1),
-  entries: external_exports.array(LeaderboardCorpusEntrySchema).min(1)
-}).strict().refine(
-  (corpus) => new Set(corpus.entries.map((entry) => entry.name)).size === corpus.entries.length,
-  { message: "Corpus entry names must be unique." }
-);
-
-// ../witan/src/quant-integrity.ts
-import { readFileSync as readFileSync10 } from "fs";
-import { join as join8 } from "path";
-
-// ../witan/src/quant-metrics-grading.ts
-import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync9 } from "fs";
-import { join as join7 } from "path";
-
-// ../witan/src/quant-run-tier-grading.ts
-import { createHash as createHash3 } from "crypto";
-
 // src/product-identity.ts
-import { existsSync as existsSync3, readFileSync as readFileSync11 } from "fs";
-import { basename as basename3, join as join9 } from "path";
+import { existsSync, readFileSync as readFileSync6 } from "fs";
+import { basename as basename2, join as join3 } from "path";
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/;
 var FALLBACK_SLUG = "repo";
 var FALLBACK_DISPLAY_NAME = "Repository";
 function deriveProductIdentity(repoPath) {
-  const packageJsonPath = join9(repoPath, "package.json");
-  const raw = readPackageName(packageJsonPath) ?? basename3(repoPath);
+  const packageJsonPath = join3(repoPath, "package.json");
+  const raw = readPackageName(packageJsonPath) ?? basename2(repoPath);
   const displayName = raw.trim().length > 0 ? raw.trim() : FALLBACK_DISPLAY_NAME;
   return {
     productSlug: slugify(raw),
@@ -9354,9 +8042,9 @@ function deriveProductIdentity(repoPath) {
   };
 }
 function readPackageName(packageJsonPath) {
-  if (!existsSync3(packageJsonPath)) return void 0;
+  if (!existsSync(packageJsonPath)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync11(packageJsonPath, "utf8"));
+    const parsed = JSON.parse(readFileSync6(packageJsonPath, "utf8"));
     if (typeof parsed === "object" && parsed !== null && "name" in parsed) {
       const name = parsed.name;
       if (typeof name === "string" && name.trim().length > 0) return name;
@@ -9432,13 +8120,15 @@ export {
   __commonJS,
   __export,
   __toESM,
-  formatExternalSourceLine,
-  renderWitanHtmlReport,
-  renderWitanBadgeEndpoint,
-  renderWitanBadgeSvg,
   ZodOptional,
   ZodFirstPartyTypeKind,
   objectType,
   external_exports,
+  formatExternalSourceLine,
+  renderWitanHtmlReport,
+  renderWitanBadgeEndpoint,
+  renderWitanBadgeSvg,
+  serializeWitanReport,
+  createWitanAttestation,
   runCejelScan
 };