@cejel/cejel 0.1.3 → 0.1.5

package/dist/{chunk-QQVCIG4N.js → chunk-A7NZKJ5H.js}

@@ -29,456 +29,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// ../witan/src/external-findings.ts
-var EXTERNAL_FINDINGS_DISPLAY_LIMIT = 10;
-var SEVERITY_RANK = {
-  critical: 0,
-  warning: 1,
-  info: 2
-};
-function formatExternalSourceLabel(source) {
-  return source.startsWith("sarif:") ? source.slice("sarif:".length) : source;
-}
-function summarizeExternalSources(consumedSignals) {
-  const bySource = /* @__PURE__ */ new Map();
-  for (const signal of consumedSignals) {
-    const entry = bySource.get(signal.source) ?? { findingCount: 0, dimensions: /* @__PURE__ */ new Set() };
-    entry.findingCount += signal.findingCount;
-    entry.dimensions.add(signal.dimension);
-    bySource.set(signal.source, entry);
-  }
-  return Array.from(bySource.entries()).map(([source, { findingCount, dimensions }]) => ({
-    source,
-    label: formatExternalSourceLabel(source),
-    findingCount,
-    dimensions: Array.from(dimensions).sort()
-  })).sort((a, b) => a.source.localeCompare(b.source));
-}
-function formatExternalSourceLine(summary) {
-  const noun = summary.findingCount === 1 ? "finding" : "findings";
-  return `${summary.label}: ${summary.findingCount} ${noun} ingested (folded into ${summary.dimensions.join(", ")})`;
-}
-function collectExternalFindings(consumedSignals) {
-  const findings = [];
-  for (const signal of consumedSignals) {
-    for (const finding of signal.findings) {
-      findings.push({
-        source: signal.source,
-        label: formatExternalSourceLabel(signal.source),
-        dimension: signal.dimension,
-        severity: finding.severity,
-        ruleId: finding.ruleId,
-        message: finding.message,
-        ...finding.location ? { location: finding.location } : {}
-      });
-    }
-  }
-  return findings.sort((a, b) => {
-    const bySeverity = SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity];
-    if (bySeverity !== 0) return bySeverity;
-    const bySource = a.source.localeCompare(b.source);
-    if (bySource !== 0) return bySource;
-    return a.ruleId.localeCompare(b.ruleId);
-  });
-}
-
-// ../witan/src/html.ts
-function renderWitanHtmlReport(report) {
-  const codeCriteria = criteriaByCategory(report, "code_trust");
-  const processCriteria = criteriaByCategory(report, "process_trust");
-  const verifiedEvidence = report.criteria.flatMap(
-    (criterion) => criterion.status === "verified" ? criterion.evidence.map((evidence) => renderEvidenceListItem(criterion, evidence)) : []
-  );
-  const openItems = report.criteria.flatMap(renderOpenItems);
-  const contributingSources = renderContributingSources(report.consumedSignals ?? []);
-  const externalSourceSummaries = summarizeExternalSources(report.consumedSignals ?? []);
-  const externalFindings = collectExternalFindings(report.consumedSignals ?? []);
-  return `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>Cejel Trust Certificate - ${escapeHtml(report.productDisplayName)}</title>
-  <style>${CERTIFICATE_CSS}</style>
-</head>
-<body>
-  <main class="certificate">
-    <header class="hero">
-      <div class="brand">
-        <span class="brand-mark" aria-hidden="true">C</span>
-        <span class="brand-name">Cejel / Alfred</span>
-      </div>
-      <div class="hero-grid">
-        <section>
-          <p class="eyebrow">Trust Certificate</p>
-          <h1>${escapeHtml(report.productDisplayName)}</h1>
-          <dl class="meta">
-            <div><dt>Date</dt><dd>${escapeHtml(formatDate(report.generatedAt))}</dd></div>
-            <div><dt>Run</dt><dd>${escapeHtml(renderRepo(report))}</dd></div>
-            <div><dt>Rubric</dt><dd>${escapeHtml(report.rubricVersion)}</dd></div>
-            ${contributingSources.length > 0 ? `<div><dt>Sources</dt><dd>Incorporates findings from: ${escapeHtml(contributingSources.join(", "))}<ul class="source-counts">${externalSourceSummaries.map((s) => `<li>${escapeHtml(formatExternalSourceLine(s))}</li>`).join("")}</ul></dd></div>` : ""}
-          </dl>
-        </section>
-        <aside class="score-panel" aria-label="Summary trust score">
-          <div class="score-badge">Summary</div>
-          ${report.insufficientSourceReason ? `<div class="verdict">Insufficient source</div>
-          <p class="insufficient-note">${escapeHtml(report.insufficientSourceReason)}</p>` : `<div class="score">${formatScore(report.overallScore)}</div>
-          <div class="score-unit">/ 4.0 overall</div>
-          <div class="verdict">${escapeHtml(renderVerdict(report.overallScore))}</div>
-          <div class="subscores">
-            <span>Code ${formatScore(report.codeTrustScore)}</span>
-            <span>Process ${formatScore(report.processTrustScore)}</span>
-          </div>`}
-        </aside>
-      </div>
-    </header>
-
-    <section class="trust-grid" aria-label="Rubric criteria">
-      ${renderCriterionColumn("Code trust", codeCriteria)}
-      ${renderCriterionColumn("Process trust", processCriteria)}
-    </section>
-
-    <section class="evidence-grid" aria-label="Evidence and gaps">
-      <article class="evidence-section">
-        <h2>Verified evidence</h2>
-        <ul>${verifiedEvidence.length > 0 ? verifiedEvidence.join("") : "<li>No verified evidence supplied.</li>"}</ul>
-      </article>
-      <article class="evidence-section">
-        <h2>Open / unverified</h2>
-        <ul>${openItems.length > 0 ? openItems.join("") : "<li>No open or unverified criteria supplied.</li>"}</ul>
-      </article>
-    </section>
-
-    ${externalFindings.length > 0 ? `<section class="external-findings-section" aria-label="External findings">
-      <article class="evidence-section">
-        <h2>External findings</h2>
-        <p class="external-note">Findings surfaced by ingested external scanners, attributed to the tool and the cejel criterion they were folded into \u2014 distinct from cejel's own findings above.</p>
-        <ul>${renderExternalFindingItems(externalFindings).join("")}</ul>
-      </article>
-    </section>` : ""}
-  </main>
-</body>
-</html>
-`;
-}
-function renderContributingSources(signals) {
-  return Array.from(new Set(signals.map((s) => s.source))).sort();
-}
-function renderExternalFindingItems(findings) {
-  const shown = findings.slice(0, EXTERNAL_FINDINGS_DISPLAY_LIMIT);
-  const items = shown.map(
-    (f) => `<li><strong>${escapeHtml(f.label)} \u2192 ${escapeHtml(f.dimension)}</strong><span>${escapeHtml(f.severity)}: ${escapeHtml(f.ruleId)} \u2014 ${escapeHtml(f.message)}${f.location ? ` (${escapeHtml(f.location)})` : ""}</span></li>`
-  );
-  const remaining = findings.length - shown.length;
-  if (remaining > 0) {
-    items.push(`<li><em>...and ${remaining} more \u2014 see report.json for the full list.</em></li>`);
-  }
-  return items;
-}
-function criteriaByCategory(report, category) {
-  return report.criteria.filter((criterion) => criterion.category === category);
-}
-function renderCriterionColumn(title, criteria) {
-  const applicable = criteria.filter((criterion) => criterion.status !== "not_applicable");
-  const notApplicable = criteria.filter((criterion) => criterion.status === "not_applicable");
-  return `<section class="criteria-column">
-        <h2>${escapeHtml(title)}</h2>
-        <div class="criteria-list">
-          ${applicable.map(renderCriterionCard).join("")}
-        </div>
-        ${notApplicable.length > 0 ? renderNotApplicableGroup(notApplicable) : ""}
-      </section>`;
-}
-function renderNotApplicableGroup(criteria) {
-  return `<div class="na-group">
-          <h3 class="na-heading">Not applicable to this repository</h3>
-          <ul class="na-list">
-            ${criteria.map(renderNotApplicableItem).join("")}
-          </ul>
-        </div>`;
-}
-function renderNotApplicableItem(criterion) {
-  const reason = criterion.notes ?? "Not applicable to this repository.";
-  return `<li><span class="na-id">${escapeHtml(criterion.id)}</span> ${escapeHtml(criterion.title)} \u2014 <span class="na-reason">${escapeHtml(reason)}</span></li>`;
-}
-function renderCriterionCard(criterion) {
-  const evidence = [
-    ...criterion.evidence.map(renderEvidencePointer),
-    ...criterion.findings.map((finding) => renderFindingEvidence(finding))
-  ];
-  const metrics = criterion.metrics.map(renderMetric);
-  return `<article class="criterion">
-            <div class="criterion-top">
-              <div>
-                <div class="criterion-id">${escapeHtml(criterion.id)}</div>
-                <h3>${escapeHtml(criterion.title)}</h3>
-              </div>
-              ${renderStatusChip(criterion.status)}
-            </div>
-            <div class="criterion-score">${criterion.status === "not_applicable" ? "N/A" : criterion.status === "insufficient_data" ? "No data" : formatScore(criterion.score)}</div>
-            <ul class="criterion-metrics">
-              ${metrics.length > 0 ? metrics.map((item) => `<li>${item}</li>`).join("") : "<li>No measured depth metrics supplied.</li>"}
-            </ul>
-            <ul class="criterion-evidence">
-              ${evidence.length > 0 ? evidence.map((item) => `<li>${item}</li>`).join("") : "<li>No concrete evidence supplied.</li>"}
-            </ul>
-          </article>`;
-}
-function renderMetric(metric2) {
-  const max = metric2.max ? `/${formatMetricValue(metric2.max)}` : "";
-  const unit = metric2.unit ? ` ${escapeHtml(metric2.unit)}` : "";
-  return `<strong>${escapeHtml(metric2.label)}</strong><span>${formatMetricValue(metric2.value)}${max}${unit}</span>`;
-}
-function renderStatusChip(status) {
-  return `<span class="status" data-status="${status}">${status}</span>`;
-}
-function renderEvidenceListItem(criterion, evidence) {
-  return `<li><strong>${escapeHtml(criterion.id)} - ${escapeHtml(criterion.title)}</strong><span>${renderEvidencePointer(evidence)}</span></li>`;
-}
-function renderOpenItems(criterion) {
-  const findingItems = criterion.findings.map(
-    (finding) => `<li><strong>${escapeHtml(criterion.id)} - ${escapeHtml(criterion.title)}</strong><span>${escapeHtml(finding.severity)}: ${escapeHtml(finding.summary)} (${renderEvidencePointer(finding.evidence)})</span></li>`
-  );
-  if ((criterion.status === "unverified" || criterion.status === "insufficient_data") && criterion.evidence.length === 0 && criterion.findings.length === 0) {
-    const message = criterion.status === "insufficient_data" ? "Insufficient data \u2014 no measurable signal; excluded from composite (unmeasured, not inapplicable)." : "No concrete evidence supplied.";
-    return [
-      `<li><strong>${escapeHtml(criterion.id)} - ${escapeHtml(criterion.title)}</strong><span>${escapeHtml(message)}</span></li>`
-    ];
-  }
-  if (criterion.status === "verified") return [];
-  return findingItems;
-}
-function renderFindingEvidence(finding) {
-  return `${escapeHtml(finding.severity)}: ${escapeHtml(finding.summary)} (${renderEvidencePointer(
-    finding.evidence
-  )})`;
-}
-function renderEvidencePointer(evidence) {
-  const target = evidence.url ?? renderPathEvidenceTarget(evidence);
-  const label = escapeHtml(evidence.label);
-  if (evidence.url) {
-    return `<a href="${escapeAttribute(evidence.url)}">${label}</a>`;
-  }
-  return [label, target ? `<code>${escapeHtml(target)}</code>` : void 0].filter(Boolean).join(" ");
-}
-function renderPathEvidenceTarget(evidence) {
-  const pathTarget = evidence.path ? `${evidence.path}${evidence.line ? `:${evidence.line}` : ""}` : void 0;
-  const hashTarget = evidence.contentHash ? `sha256:${evidence.contentHash.slice(0, 12)}` : void 0;
-  return [pathTarget, hashTarget].filter(Boolean).join(" \xB7 ");
-}
-function renderRepo(report) {
-  const repo = report.repo.path ?? report.repo.url ?? "unknown";
-  return report.repo.headSha ? `${repo} @ ${report.repo.headSha}` : repo;
-}
-function renderVerdict(score) {
-  if (score >= 3.5) return "Verified";
-  if (score >= 2.5) return "Conditional";
-  if (score >= 1.5) return "At risk";
-  return "Unverified";
-}
-function renderReportVerdict(report) {
-  if (report.insufficientSourceReason) return "Insufficient source";
-  return renderVerdict(report.overallScore);
-}
-function formatScore(score) {
-  return score.toFixed(1);
-}
-function formatMetricValue(value) {
-  return Number.isInteger(value) ? value.toString() : value.toFixed(2);
-}
-function formatDate(value) {
-  return value.slice(0, 10);
-}
-function escapeHtml(value) {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
-}
-function escapeAttribute(value) {
-  return escapeHtml(value);
-}
-var CERTIFICATE_CSS = `
-:root {
-  color-scheme: dark;
-  --steel: #16212a;
-  --surface: #1d2b35;
-  --surface-2: #273946;
-  --line: rgba(238, 244, 247, .13);
-  --line-strong: rgba(238, 244, 247, .22);
-  --text: #eef4f7;
-  --muted: #b7c5cc;
-  --faint: #8799a4;
-  --teal: #2fc8a6;
-  --teal-weak: rgba(47, 200, 166, .14);
-  --periwinkle: #93a6da;
-  --periwinkle-weak: rgba(147, 166, 218, .16);
-  --warn: #e7bf72;
-  --warn-weak: rgba(231, 191, 114, .16);
-  --danger: #f09a8f;
-  --danger-weak: rgba(240, 154, 143, .14);
-  --quiet: rgba(238, 244, 247, .08);
-  --serif: "Instrument Serif", Georgia, "Times New Roman", serif;
-  --sans: Inter, ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
-  --mono: "JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
-}
-* { box-sizing: border-box; }
-body {
-  margin: 0;
-  background: var(--steel);
-  color: var(--text);
-  font-family: var(--sans);
-  line-height: 1.55;
-  -webkit-font-smoothing: antialiased;
-}
-.certificate { max-width: 1120px; margin: 0 auto; padding: 44px 32px 64px; }
-.hero { border-bottom: 1px solid var(--line); padding-bottom: 38px; }
-.brand { display: flex; align-items: center; gap: 12px; margin-bottom: 44px; }
-.brand-mark {
-  display: inline-flex; align-items: center; justify-content: center;
-  width: 34px; height: 34px; border-radius: 8px;
-  background: var(--teal); color: #06231d; font-family: var(--serif); font-size: 24px;
-}
-.brand-name { font-family: var(--serif); font-size: 24px; }
-.hero-grid { display: grid; grid-template-columns: minmax(0, 1fr) 300px; gap: 36px; align-items: end; }
-.eyebrow {
-  margin: 0 0 14px; color: var(--teal); font-family: var(--mono);
-  font-size: 11px; letter-spacing: .18em; text-transform: uppercase;
-}
-h1, h2, h3, p { margin-top: 0; }
-h1 { margin-bottom: 24px; font-family: var(--serif); font-size: 64px; line-height: 1; font-weight: 400; letter-spacing: 0; }
-.meta { display: grid; gap: 10px; margin: 0; max-width: 780px; }
-.meta div { display: grid; grid-template-columns: 86px minmax(0, 1fr); gap: 16px; }
-dt { color: var(--faint); font-family: var(--mono); font-size: 11px; text-transform: uppercase; letter-spacing: .12em; }
-dd { margin: 0; color: var(--muted); overflow-wrap: anywhere; }
-.score-panel { border: 1px solid var(--line-strong); border-radius: 8px; padding: 24px; background: var(--surface); }
-.score-badge {
-  display: inline-flex; margin-bottom: 14px; border: 1px solid rgba(147, 166, 218, .38);
-  border-radius: 999px; padding: 5px 10px; color: var(--periwinkle);
-  background: var(--periwinkle-weak); font-family: var(--mono); font-size: 12px;
-}
-.score { display: inline; font-family: var(--mono); font-size: 56px; line-height: 1; color: var(--teal); }
-.score-unit { display: inline; margin-left: 6px; color: var(--faint); font-family: var(--mono); }
-.verdict { margin-top: 12px; font-family: var(--serif); font-size: 30px; color: var(--periwinkle); }
-.insufficient-note { margin-top: 10px; color: var(--muted); font-size: 13px; line-height: 1.5; }
-.subscores { display: flex; gap: 12px; flex-wrap: wrap; margin-top: 18px; color: var(--muted); font-family: var(--mono); font-size: 12px; }
-.source-counts { margin: 8px 0 0; padding-left: 18px; font-family: var(--mono); font-size: 12px; color: var(--muted); }
-.trust-grid, .evidence-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 18px; margin-top: 28px; }
-.external-findings-section { margin-top: 18px; }
-.external-note { margin: 0 0 14px; color: var(--muted); font-size: 13px; }
-.criteria-column, .evidence-section { border: 1px solid var(--line); border-radius: 8px; background: var(--surface); padding: 22px; }
-h2 { font-family: var(--serif); font-size: 30px; font-weight: 400; letter-spacing: 0; margin-bottom: 18px; }
-.criteria-list { display: grid; gap: 12px; }
-.na-group { margin-top: 16px; padding-top: 14px; border-top: 1px dashed var(--line-strong); }
-.na-heading { font-family: var(--sans); font-size: 12px; font-weight: 650; letter-spacing: .04em; text-transform: uppercase; color: var(--faint); margin: 0 0 10px; }
-.na-list { display: grid; gap: 8px; font-size: 13px; }
-.na-list li { margin: 0; color: var(--muted); }
-.na-id { color: var(--faint); font-family: var(--mono); font-size: 11px; margin-right: 6px; }
-.na-reason { color: var(--muted); }
-.criterion { border: 1px solid var(--line); border-radius: 8px; padding: 16px; background: var(--surface-2); }
-.criterion-top { display: flex; justify-content: space-between; align-items: flex-start; gap: 14px; }
-.criterion-id { color: var(--periwinkle); font-family: var(--mono); font-size: 12px; margin-bottom: 4px; }
-h3 { font-size: 15px; line-height: 1.35; font-weight: 600; margin-bottom: 0; }
-.criterion-score { margin-top: 12px; color: var(--text); font-family: var(--mono); font-size: 24px; }
-.criterion-metrics { display: grid; gap: 7px; margin-top: 10px; padding: 0; list-style: none; font-size: 12px; }
-.criterion-metrics li { display: flex; justify-content: space-between; gap: 12px; border-bottom: 1px solid rgba(238, 244, 247, .08); padding-bottom: 6px; }
-.criterion-metrics strong { color: var(--text); font-weight: 650; }
-.criterion-metrics span { white-space: nowrap; color: var(--muted); }
-.status { flex: none; border-radius: 999px; padding: 4px 9px; font-family: var(--mono); font-size: 11px; border: 1px solid var(--line-strong); }
-.status[data-status="verified"] { color: var(--teal); background: var(--teal-weak); border-color: rgba(47, 200, 166, .42); }
-.status[data-status="info"] { color: var(--periwinkle); background: var(--periwinkle-weak); border-color: rgba(147, 166, 218, .4); }
-.status[data-status="warning"] { color: var(--warn); background: var(--warn-weak); border-color: rgba(231, 191, 114, .44); }
-.status[data-status="critical"] { color: var(--danger); background: var(--danger-weak); border-color: rgba(240, 154, 143, .46); }
-.status[data-status="unverified"] { color: var(--muted); background: var(--quiet); }
-.status[data-status="insufficient_data"] { color: var(--muted); background: var(--quiet); border-style: dashed; }
-ul { margin: 0; padding-left: 18px; }
-li { margin: 8px 0; color: var(--muted); }
-.criterion-evidence { margin-top: 12px; font-size: 13px; }
-.evidence-section li strong { display: block; color: var(--text); font-size: 14px; }
-.evidence-section li span { display: block; margin-top: 2px; font-size: 13px; }
-code { color: var(--periwinkle); font-family: var(--mono); font-size: .92em; overflow-wrap: anywhere; }
-a { color: var(--teal); text-decoration: none; }
-a:hover { text-decoration: underline; text-underline-offset: 2px; }
-@media (max-width: 840px) {
-  .certificate { padding: 28px 18px 48px; }
-  .hero-grid, .trust-grid, .evidence-grid { grid-template-columns: 1fr; }
-  h1 { font-size: 46px; }
-}
-`;
-
-// ../witan/src/badge.ts
-var VERDICT_COLOR = {
-  Verified: "brightgreen",
-  Conditional: "yellow",
-  "At risk": "orange",
-  Unverified: "red",
-  "Insufficient source": "lightgrey"
-};
-var VERDICT_SVG_FILL = {
-  Verified: "#2fc86a",
-  Conditional: "#dfb92f",
-  "At risk": "#e08a3c",
-  Unverified: "#d64545",
-  "Insufficient source": "#8c8c8c"
-};
-function badgeMessage(report, verdict) {
-  if (report.insufficientSourceReason) return "unrated: no source";
-  return `${formatScore2(report.overallScore)}/4.0 ${verdict.toLowerCase()}`;
-}
-function renderWitanBadgeEndpoint(report) {
-  const verdict = renderReportVerdict(report);
-  return {
-    schemaVersion: 1,
-    label: "cejel trust",
-    message: badgeMessage(report, verdict),
-    color: VERDICT_COLOR[verdict] ?? "lightgrey"
-  };
-}
-function renderWitanBadgeSvg(report) {
-  const verdict = renderReportVerdict(report);
-  const label = "cejel trust";
-  const message = badgeMessage(report, verdict);
-  const fill = VERDICT_SVG_FILL[verdict] ?? "#8c8c8c";
-  const charWidth = 6.5;
-  const padding = 10;
-  const labelWidth = Math.round(label.length * charWidth + padding);
-  const messageWidth = Math.round(message.length * charWidth + padding);
-  const totalWidth = labelWidth + messageWidth;
-  const height = 20;
-  return `<svg xmlns="http://www.w3.org/2000/svg" width="${totalWidth}" height="${height}" role="img" aria-label="${escapeXml(label)}: ${escapeXml(message)}">
-  <title>${escapeXml(label)}: ${escapeXml(message)}</title>
-  <linearGradient id="witan-badge-smooth" x2="0" y2="100%">
-    <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
-    <stop offset="1" stop-opacity=".1"/>
-  </linearGradient>
-  <clipPath id="witan-badge-round">
-    <rect width="${totalWidth}" height="${height}" rx="3" fill="#fff"/>
-  </clipPath>
-  <g clip-path="url(#witan-badge-round)">
-    <rect width="${labelWidth}" height="${height}" fill="#555"/>
-    <rect x="${labelWidth}" width="${messageWidth}" height="${height}" fill="${fill}"/>
-    <rect width="${totalWidth}" height="${height}" fill="url(#witan-badge-smooth)"/>
-  </g>
-  <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" font-size="11">
-    <text x="${labelWidth / 2}" y="14">${escapeXml(label)}</text>
-    <text x="${labelWidth + messageWidth / 2}" y="14">${escapeXml(message)}</text>
-  </g>
-</svg>
-`;
-}
-function formatScore2(score) {
-  return score.toFixed(1);
-}
-function escapeXml(value) {
-  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-
-// ../witan/src/claim-reality.ts
-import { existsSync, readFileSync, readdirSync, statSync } from "fs";
-import { join } from "path";
-
-// ../witan/src/leaderboard.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync2 } from "fs";
-import { join as join6 } from "path";
-
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
 __export(external_exports, {
   BRAND: () => BRAND,
@@ -590,7 +141,7 @@ __export(external_exports, {
   void: () => voidType
 });
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
   util2.assertEqual = (_) => {
@@ -724,7 +275,7 @@ var getParsedType = (data) => {
   }
 };
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/ZodError.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode = util.arrayToEnum([
   "invalid_type",
   "invalid_literal",
@@ -842,7 +393,7 @@ ZodError.create = (issues) => {
   return error;
 };
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/locales/en.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -945,7 +496,7 @@ var errorMap = (issue, _ctx) => {
 };
 var en_default = errorMap;
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/errors.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/errors.js
 var overrideErrorMap = en_default;
 function setErrorMap(map) {
   overrideErrorMap = map;
@@ -954,7 +505,7 @@ function getErrorMap() {
   return overrideErrorMap;
 }
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
   const { data, path, errorMaps, issueData } = params;
   const fullPath = [...path, ...issueData.path || []];
@@ -1064,14 +615,14 @@ var isDirty = (x) => x.status === "dirty";
 var isValid = (x) => x.status === "valid";
 var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
   errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
   errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
 })(errorUtil || (errorUtil = {}));
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -4519,849 +4070,7 @@ var coerce = {
 };
 var NEVER = INVALID;
 
-// ../shared/src/types/attestation.ts
-var attestationOutcomeSchema = external_exports.enum([
-  "ATTESTED_READY",
-  "ATTESTED_WITH_GAPS",
-  "NOT_READY",
-  "REVOKED"
-]);
-var attestationKindSchema = external_exports.enum(["OPERATOR_READINESS", "EXTERNAL_ASSESSOR_REFERENCE"]);
-var attestationEvidenceRefKindSchema = external_exports.enum([
-  "runbook_path",
-  "github_run_url",
-  "vercel_deployment_id",
-  "neon_query_evidence",
-  "report_hash",
-  "external_assessor_ref"
-]);
-var attestationEvidenceRefSchema = external_exports.object({
-  kind: attestationEvidenceRefKindSchema,
-  /** Redacted reference string (path, URL, ID, or hash). Max 512 chars. */
-  ref: external_exports.string().min(1).max(512),
-  /** Optional one-line redacted description. */
-  note: external_exports.string().max(280).optional()
-});
-var createAttestationInputSchema = external_exports.object({
-  studioId: external_exports.string().uuid(),
-  complianceProfileId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid().nullable().optional(),
-  framework: external_exports.string().min(1).max(120),
-  kind: attestationKindSchema,
-  outcome: attestationOutcomeSchema,
-  /** Redacted operator statement; no payloads. */
-  statement: external_exports.string().min(1).max(4e3),
-  evidenceRefs: external_exports.array(attestationEvidenceRefSchema).min(1),
-  supersedesAttestationId: external_exports.string().uuid().nullable().optional(),
-  metadata: external_exports.record(external_exports.unknown()).default({})
-});
-
-// ../shared/src/types/standup-provisioning.ts
-var ScaffoldFileSchema = external_exports.object({
-  path: external_exports.string().min(1),
-  contents: external_exports.string()
-}).strict();
-var ScaffoldManifestSchema = external_exports.array(ScaffoldFileSchema).min(1);
-var RepoRefSchema = external_exports.object({
-  studioId: external_exports.string().uuid(),
-  owner: external_exports.string().min(1),
-  // GitHub org/account that owns the repo
-  name: external_exports.string().min(1),
-  fullName: external_exports.string().min(1),
-  // owner/name
-  htmlUrl: external_exports.string().url(),
-  defaultBranch: external_exports.string().min(1).default("main")
-}).strict();
-var ScopedTokenSchema = external_exports.object({
-  token: external_exports.string().min(1),
-  expiresAt: external_exports.string(),
-  // ISO-8601
-  scope: external_exports.string().min(1)
-  // human-readable, e.g. "contents:write on owner/name"
-}).strict();
-var BranchProtectionStatusSchema = external_exports.object({
-  protected: external_exports.boolean(),
-  requiresPullRequestReview: external_exports.boolean(),
-  requiredApprovingReviewCount: external_exports.number().int().nonnegative(),
-  allowsForcePushes: external_exports.boolean(),
-  allowsDeletions: external_exports.boolean()
-}).strict();
-var RenderParamsSchema = external_exports.object({
-  productName: external_exports.string().min(1),
-  slug: external_exports.string().min(1),
-  vertical: external_exports.string().min(1)
-}).strict();
-var TemplateInputFieldSchema = external_exports.object({
-  name: external_exports.string().min(1),
-  label: external_exports.string().min(1),
-  inputType: external_exports.enum(["text", "number", "date", "slug"]),
-  required: external_exports.boolean().default(true),
-  helperText: external_exports.string().min(1),
-  example: external_exports.string().min(1),
-  defaultValue: external_exports.string().optional()
-}).strict();
-var TemplateInputSchema = external_exports.object({
-  fields: external_exports.array(TemplateInputFieldSchema).min(1)
-}).strict();
-var TemplateDescriptorSchema = external_exports.object({
-  templateRef: external_exports.string().min(1),
-  vertical: external_exports.string().min(1),
-  description: external_exports.string().default(""),
-  inputSchema: TemplateInputSchema.optional()
-}).strict();
-var StandupDryRunPlanSchema = external_exports.object({
-  planOnly: external_exports.literal(true),
-  planOnlyMessage: external_exports.string().min(1),
-  product: external_exports.object({
-    studioId: external_exports.string().min(1),
-    productId: external_exports.string().min(1),
-    name: external_exports.string().min(1),
-    slug: external_exports.string().min(1),
-    vertical: external_exports.string().min(1)
-  }).strict(),
-  targetRepo: external_exports.object({
-    owner: external_exports.string().min(1),
-    name: external_exports.string().min(1),
-    fullName: external_exports.string().min(1),
-    defaultBranch: external_exports.string().min(1),
-    plannedState: external_exports.literal("would_create"),
-    exists: external_exports.literal(false)
-  }).strict(),
-  template: TemplateDescriptorSchema,
-  scaffold: external_exports.object({
-    label: external_exports.literal("scaffold (template output)"),
-    files: ScaffoldManifestSchema
-  }).strict(),
-  buildAgentSeed: external_exports.object({
-    label: external_exports.literal("build-agent instructions (not yet run)"),
-    instructions: external_exports.array(external_exports.string().min(1)).min(1),
-    product: external_exports.object({
-      name: external_exports.string().min(1),
-      slug: external_exports.string().min(1),
-      vertical: external_exports.string().min(1)
-    }).strict(),
-    repoFullName: external_exports.string().min(1)
-  }).strict(),
-  safetyEnvelope: external_exports.object({
-    estimatedCostUsd: external_exports.number().finite().nonnegative(),
-    costCapUsd: external_exports.number().finite().nonnegative(),
-    networkPolicy: external_exports.object({
-      mode: external_exports.literal("restricted"),
-      allowedHosts: external_exports.array(external_exports.string().min(1)).min(1)
-    }).strict(),
-    scopedToken: external_exports.object({
-      tokenMinted: external_exports.literal(false),
-      scope: external_exports.string().min(1),
-      ttlSeconds: external_exports.number().int().positive()
-    }).strict()
-  }).strict()
-}).strict();
-var ConstructionWorkflowArtifactKindSchema = external_exports.enum([
-  "profile",
-  "milestone_schedule",
-  "risk_register",
-  "submittal_register",
-  "long_lead_log",
-  "rfi_log",
-  "responsibility_matrix"
-]);
-var IsoDateSchema = external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/);
-var ConstructionWorkflowTemplateDescriptorSchema = external_exports.object({
-  templateRef: external_exports.string().min(1),
-  workflowKind: external_exports.literal("construction_project"),
-  templateKind: external_exports.literal("workflow_documents"),
-  name: external_exports.string().min(1),
-  description: external_exports.string().default(""),
-  artifacts: external_exports.array(ConstructionWorkflowArtifactKindSchema).min(1),
-  inputSchema: TemplateInputSchema
-}).strict();
-var ConstructionProjectSeedSchema = external_exports.object({
-  projectName: external_exports.string().min(1).max(120),
-  areaSqFt: external_exports.number().int().positive(),
-  projectType: external_exports.string().min(1).max(120),
-  buildingName: external_exports.string().min(1).max(160),
-  ntpDate: IsoDateSchema,
-  scheduleTargetDate: IsoDateSchema
-}).strict();
-var ConstructionMilestoneSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  name: external_exports.string().min(1),
-  targetDate: IsoDateSchema,
-  status: external_exports.enum(["planned", "at_risk", "slipped", "complete"])
-}).strict();
-var ConstructionSubmittalSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  item: external_exports.string().min(1),
-  division: external_exports.string().min(1),
-  needByDate: IsoDateSchema,
-  status: external_exports.enum(["not_started", "open", "in_review", "approved", "done"])
-}).strict();
-var ConstructionRfiSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  subject: external_exports.string().min(1),
-  to: external_exports.string().min(1),
-  status: external_exports.enum(["draft", "open", "answered", "closed"]),
-  openedDate: IsoDateSchema
-}).strict();
-var ConstructionRiskSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  risk: external_exports.string().min(1),
-  rating: external_exports.enum(["low", "medium", "high"]),
-  mitigation: external_exports.string().min(1),
-  confidence: external_exports.number().min(0).max(1)
-}).strict();
-var ConstructionLongLeadItemSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  item: external_exports.string().min(1),
-  needByDate: IsoDateSchema,
-  status: external_exports.enum(["tracking", "ordered", "received", "done"]),
-  assumption: external_exports.string().min(1)
-}).strict();
-var ConstructionResponsibilitySchema = external_exports.object({
-  id: external_exports.string().min(1),
-  role: external_exports.string().min(1),
-  owner: external_exports.string().min(1),
-  responsibility: external_exports.string().min(1)
-}).strict();
-var ConstructionMarkdownArtifactSchema = external_exports.object({
-  kind: ConstructionWorkflowArtifactKindSchema,
-  path: external_exports.string().min(1),
-  markdown: external_exports.string().min(1)
-}).strict();
-var ConstructionWorkflowArtifactSetSchema = external_exports.object({
-  projectName: external_exports.string().min(1),
-  generatedAt: external_exports.string().datetime(),
-  assumptions: external_exports.array(external_exports.string().min(1)).default([]),
-  needsPmData: external_exports.array(external_exports.string().min(1)).default([]),
-  markdownArtifacts: external_exports.array(ConstructionMarkdownArtifactSchema).min(1),
-  structured: external_exports.object({
-    milestones: external_exports.array(ConstructionMilestoneSchema),
-    submittals: external_exports.array(ConstructionSubmittalSchema),
-    rfis: external_exports.array(ConstructionRfiSchema),
-    risks: external_exports.array(ConstructionRiskSchema),
-    longLeadItems: external_exports.array(ConstructionLongLeadItemSchema),
-    responsibilities: external_exports.array(ConstructionResponsibilitySchema)
-  }).strict()
-}).strict();
-var ConstructionWorkflowDryRunPlanSchema = external_exports.object({
-  planOnly: external_exports.literal(true),
-  planOnlyMessage: external_exports.string().min(1),
-  product: external_exports.object({
-    studioId: external_exports.string().min(1),
-    productId: external_exports.string().min(1),
-    name: external_exports.string().min(1),
-    vertical: external_exports.string().min(1)
-  }).strict(),
-  template: ConstructionWorkflowTemplateDescriptorSchema,
-  seed: ConstructionProjectSeedSchema,
-  safetyEnvelope: external_exports.object({
-    executor: external_exports.literal("benign_workflow_populator"),
-    sandboxUsed: external_exports.literal(false),
-    scopedTokenMinted: external_exports.literal(false),
-    externalWritesAllowed: external_exports.literal(false),
-    workspaceWriteMode: external_exports.literal("markdown_only")
-  }).strict()
-}).strict();
-
-// ../shared/src/types/construction-log-excel.ts
-var CONSTRUCTION_LOG_EXCEL_SCHEMA_VERSION = "construction-log-excel-v1";
-var ConstructionLogExcelSheetKeySchema = external_exports.enum([
-  "submittals",
-  "rfis",
-  "riskRegister",
-  "longLead",
-  "responsibilityMatrix",
-  "milestones"
-]);
-var ConstructionLogExcelColumnSchema = external_exports.object({
-  key: external_exports.string().min(1),
-  header: external_exports.string().min(1),
-  required: external_exports.boolean(),
-  description: external_exports.string().min(1)
-}).strict().describe("Canonical column definition for Alfred construction log Excel round-trips.");
-var ConstructionLogExcelSheetSchema = external_exports.object({
-  key: ConstructionLogExcelSheetKeySchema,
-  sheetName: external_exports.string().min(1),
-  description: external_exports.string().min(1),
-  columns: external_exports.array(ConstructionLogExcelColumnSchema).min(1)
-}).strict().describe("Canonical worksheet definition for Alfred construction log Excel round-trips.");
-var ConstructionLogExcelWorkbookSchema = external_exports.object({
-  schemaVersion: external_exports.literal(CONSTRUCTION_LOG_EXCEL_SCHEMA_VERSION),
-  sheets: external_exports.record(ConstructionLogExcelSheetKeySchema, ConstructionLogExcelSheetSchema)
-}).strict().describe(
-  "Canonical Alfred construction log Excel workbook schema shared by native output generation and export-upload ingestion."
-);
-var CONSTRUCTION_LOG_EXCEL_SHEETS = {
-  submittals: {
-    key: "submittals",
-    sheetName: "Submittals",
-    description: "Submittal register rows generated by Alfred or edited by the PM.",
-    columns: [
-      column("id", "ID", true, "Stable submittal identifier, for example SUB-001."),
-      column("item", "Item", true, "Submittal item or package name."),
-      column("division", "Division", true, "Spec division or trade grouping."),
-      column("needByDate", "Need By Date", true, "Date needed in YYYY-MM-DD format."),
-      column("status", "Status", true, "One of not_started, open, in_review, approved, or done."),
-      commonColumn("assumptionsNotes")
-    ]
-  },
-  rfis: {
-    key: "rfis",
-    sheetName: "RFIs",
-    description: "RFI log rows generated by Alfred or edited by the PM.",
-    columns: [
-      column("id", "ID", true, "Stable RFI identifier, for example RFI-001."),
-      column("subject", "Subject", true, "RFI subject."),
-      column("to", "To", true, "Responsible recipient or ball-in-court party."),
-      column("status", "Status", true, "One of draft, open, answered, or closed."),
-      column("openedDate", "Opened Date", true, "Date opened in YYYY-MM-DD format."),
-      commonColumn("assumptionsNotes")
-    ]
-  },
-  riskRegister: {
-    key: "riskRegister",
-    sheetName: "Risk Register",
-    description: "Risk register rows generated by Alfred or edited by the PM.",
-    columns: [
-      column("id", "ID", true, "Stable risk identifier, for example RISK-001."),
-      column("risk", "Risk", true, "Risk statement."),
-      column("rating", "Rating", true, "One of low, medium, or high."),
-      column("mitigation", "Mitigation", true, "Mitigation plan."),
-      column("confidence", "Confidence", true, "Confidence score from 0 to 1."),
-      commonColumn("assumptionsNotes")
-    ]
-  },
-  longLead: {
-    key: "longLead",
-    sheetName: "Long-Lead",
-    description: "Long-lead procurement rows generated by Alfred or edited by the PM.",
-    columns: [
-      column("id", "ID", true, "Stable long-lead identifier, for example LL-001."),
-      column("item", "Item", true, "Long-lead item name."),
-      column("needByDate", "Need By Date", true, "Date needed in YYYY-MM-DD format."),
-      column("status", "Status", true, "One of tracking, ordered, received, or done."),
-      column("assumption", "Assumption", true, "Procurement assumption behind this row."),
-      commonColumn("assumptionsNotes")
-    ]
-  },
-  responsibilityMatrix: {
-    key: "responsibilityMatrix",
-    sheetName: "Responsibility Matrix",
-    description: "Responsibility matrix rows generated by Alfred or edited by the PM.",
-    columns: [
-      column("id", "ID", true, "Stable responsibility identifier, for example RESP-001."),
-      column("role", "Role", true, "Role or party."),
-      column("owner", "Owner", true, "Named owner, or Needs PM input when unknown."),
-      column("responsibility", "Responsibility", true, "Responsibility statement."),
-      commonColumn("assumptionsNotes")
-    ]
-  },
-  milestones: {
-    key: "milestones",
-    sheetName: "Milestones",
-    description: "Milestone schedule rows used to generate the MS Project XML schedule.",
-    columns: [
-      column("id", "ID", true, "Stable milestone identifier, for example MS-001."),
-      column("name", "Name", true, "Milestone or task name."),
-      column("targetDate", "Target Date", true, "Target date in YYYY-MM-DD format."),
-      column("status", "Status", true, "One of planned, at_risk, slipped, or complete."),
-      column("predecessorId", "Predecessor ID", false, "Optional predecessor milestone ID."),
-      commonColumn("assumptionsNotes")
-    ]
-  }
-};
-var CONSTRUCTION_LOG_EXCEL_WORKBOOK_SCHEMA = ConstructionLogExcelWorkbookSchema.parse({
-  schemaVersion: CONSTRUCTION_LOG_EXCEL_SCHEMA_VERSION,
-  sheets: CONSTRUCTION_LOG_EXCEL_SHEETS
-});
-function column(key, header, required, description) {
-  return { key, header, required, description };
-}
-function commonColumn(key) {
-  return column(
-    key,
-    "Assumptions / Notes",
-    false,
-    "Show-your-work note, including generated assumptions and PM-input gaps."
-  );
-}
-
-// ../shared/src/types/dev-task-dispatch.ts
-var CodingAgentExecutorSchema = external_exports.enum(["claude-code", "codex"]);
-var DevTaskDispatchRequestSchema = external_exports.object({
-  studioId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid(),
-  repo: RepoRefSchema,
-  task: external_exports.string().min(1).max(2e4),
-  executor: CodingAgentExecutorSchema
-}).strict();
-var DevTaskDispatchDryRunPlanSchema = external_exports.object({
-  planOnly: external_exports.literal(true),
-  planOnlyMessage: external_exports.string().min(1),
-  targetRepo: RepoRefSchema,
-  task: external_exports.string().min(1),
-  executor: CodingAgentExecutorSchema,
-  branchName: external_exports.string().min(1),
-  safetyEnvelope: external_exports.object({
-    estimatedCostUsd: external_exports.number().finite().nonnegative(),
-    costCapUsd: external_exports.number().finite().nonnegative(),
-    timeoutMs: external_exports.number().int().positive(),
-    scopedToken: external_exports.object({
-      tokenMinted: external_exports.literal(false),
-      scope: external_exports.string().min(1),
-      ttlSeconds: external_exports.number().int().positive()
-    }).strict(),
-    prOnly: external_exports.object({
-      opensPullRequest: external_exports.literal(true),
-      mergesPullRequest: external_exports.literal(false),
-      pushesMain: external_exports.literal(false),
-      deploys: external_exports.literal(false)
-    }).strict()
-  }).strict()
-}).strict();
-var CodingAgentRunInputSchema = external_exports.object({
-  executor: CodingAgentExecutorSchema,
-  repo: RepoRefSchema,
-  task: external_exports.string().min(1),
-  scopedToken: ScopedTokenSchema,
-  branchName: external_exports.string().min(1),
-  costCapUsd: external_exports.number().finite().nonnegative(),
-  timeoutMs: external_exports.number().int().positive()
-}).strict();
-var CodingAgentRunResultSchema = external_exports.discriminatedUnion("status", [
-  external_exports.object({
-    status: external_exports.literal("succeeded"),
-    prUrl: external_exports.string().url(),
-    summary: external_exports.string().min(1),
-    costUsd: external_exports.number().finite().nonnegative(),
-    /**
-     * The exact commit sha the PR branch was pushed at when it opened —
-     * captured server-side (see server-dispatch-backend.ts) right after a
-     * successful run, before the workspace is torn down. Lets the Maeve
-     * in-flight-fix detector (maeve-in-flight-pr-fix-lesson.ts) key off the
-     * real PR-open head instead of falling back to timestamp matching.
-     */
-    openedHeadSha: external_exports.string().min(1).optional()
-  }).strict(),
-  external_exports.object({
-    status: external_exports.literal("failed"),
-    summary: external_exports.string().min(1),
-    reason: external_exports.string().min(1),
-    costUsd: external_exports.number().finite().nonnegative().optional()
-  }).strict()
-]);
-var DevTaskOutcomeSchema = external_exports.enum(["ci_passed", "pr_merged", "ci_failed"]);
-var SecurityFindingClassSchema = external_exports.enum(["authz", "csrf", "injection", "secrets", "ssrf"]);
-var RecordDevTaskOutcomeInputSchema = external_exports.object({
-  product: external_exports.string().min(1).max(120),
-  repo: external_exports.string().min(1).max(240),
-  prUrl: external_exports.string().url(),
-  outcome: DevTaskOutcomeSchema,
-  task: external_exports.string().min(1).max(2e4).optional(),
-  executor: CodingAgentExecutorSchema.optional(),
-  occurredAt: external_exports.string().datetime().optional(),
-  maeveLessonStatement: external_exports.string().min(1).max(1e3).optional(),
-  maeveLessonTags: external_exports.array(external_exports.string().min(1).max(120)).optional(),
-  /** Security metadata — enriches the Maeve lesson with class/pattern, never raw vulnerable detail. */
-  findingClass: SecurityFindingClassSchema.optional(),
-  ruleId: external_exports.string().min(1).max(120).optional(),
-  signalSource: external_exports.string().min(1).max(240).optional()
-}).strict();
-
-// ../shared/src/schemas/standup-plan.ts
-var StandupRequestSchema = external_exports.object({
-  productName: external_exports.string().min(1).max(80),
-  slug: external_exports.string().min(1).optional(),
-  vertical: external_exports.string().min(1).max(80),
-  repoTarget: external_exports.string().min(1).default("barg-labs"),
-  repoName: external_exports.string().min(1).optional(),
-  templateRef: external_exports.string().min(1).optional(),
-  scopeNotes: external_exports.string().max(2e3).optional()
-}).strict();
-var StandupPlanSchema = external_exports.object({
-  productName: external_exports.string().min(1).max(80),
-  slug: external_exports.string().regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/),
-  vertical: external_exports.string().min(1).max(80),
-  templateRef: external_exports.string().min(1),
-  repoTarget: external_exports.string().min(1),
-  repoName: external_exports.string().regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/),
-  fileManifest: external_exports.array(external_exports.string().min(1)).min(1),
-  credentialScope: external_exports.string().min(1),
-  estimatedCostUsd: external_exports.number().nonnegative(),
-  steps: external_exports.array(external_exports.string().min(1)).min(1),
-  dryRun: external_exports.literal(true)
-}).strict();
-
-// ../shared/src/types/coordinator-prompt.ts
-var CoordinatorPromptContextBlockSchema = external_exports.object({
-  title: external_exports.string().min(1).max(120),
-  body: external_exports.string().min(1).max(6e3),
-  source: external_exports.string().max(500).optional()
-});
-var CoordinatorPromptInputPayloadSchema = external_exports.object({
-  objective: external_exports.string().min(1).max(4e3),
-  productId: external_exports.string().min(1),
-  context: external_exports.array(CoordinatorPromptContextBlockSchema).min(1).max(20),
-  escalationHints: external_exports.array(external_exports.string().min(1).max(500)).max(10).optional()
-});
-var CoordinatorPromptTokensUsedSchema = external_exports.object({
-  input: external_exports.number().int().nonnegative(),
-  output: external_exports.number().int().nonnegative(),
-  total: external_exports.number().int().nonnegative(),
-  costCents: external_exports.number().nonnegative()
-});
-var CoordinatorPromptSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().min(1),
-  productId: external_exports.string().min(1),
-  draftedAt: external_exports.coerce.date(),
-  inputPayload: CoordinatorPromptInputPayloadSchema,
-  markdown: external_exports.string().min(1),
-  metadata: external_exports.object({
-    tokensUsed: CoordinatorPromptTokensUsedSchema.optional(),
-    model: external_exports.string().optional(),
-    templateVersion: external_exports.string().optional()
-  }).catchall(external_exports.unknown()).optional()
-});
-var CreateCoordinatorPromptInputSchema = external_exports.object({
-  productId: external_exports.string().min(1),
-  inputPayload: CoordinatorPromptInputPayloadSchema,
-  markdown: external_exports.string().min(1),
-  metadata: external_exports.record(external_exports.unknown()).optional(),
-  draftedAt: external_exports.coerce.date().optional()
-});
-var ListCoordinatorPromptsInputSchema = external_exports.object({
-  productId: external_exports.string().min(1).optional(),
-  since: external_exports.coerce.date().optional()
-});
-
-// ../shared/src/schemas/inbox-triage.ts
-var InboxTriageClassificationSchema = external_exports.enum([
-  "needs_reply",
-  "fyi",
-  "waiting",
-  "escalate"
-]);
-var InboxTriageLegacyUrgencySchema = external_exports.enum(["needs_reply", "fyi", "noise", "escalation"]);
-var InboxTriageThreadSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  subject: external_exports.string().min(1),
-  from: external_exports.string(),
-  to: external_exports.string(),
-  snippet: external_exports.string(),
-  labels: external_exports.array(external_exports.string()),
-  unread: external_exports.boolean(),
-  needsReply: external_exports.boolean(),
-  updatedAt: external_exports.string().min(1),
-  url: external_exports.string().min(1),
-  messageCount: external_exports.number().int().nonnegative()
-});
-var InboxTriageResultSchema = external_exports.object({
-  threadId: external_exports.string().min(1),
-  classification: InboxTriageClassificationSchema,
-  confidence: external_exports.number().min(0).max(1),
-  reason: external_exports.string(),
-  labelName: external_exports.string(),
-  applied: external_exports.boolean(),
-  error: external_exports.string().optional()
-});
-var TriageInboxUsageSchema = external_exports.object({
-  input_tokens: external_exports.number().int().nonnegative(),
-  output_tokens: external_exports.number().int().nonnegative(),
-  cached_tokens: external_exports.number().int().nonnegative().optional(),
-  cost_cents: external_exports.number().nonnegative()
-});
-var TriageInboxResultSchema = external_exports.object({
-  productId: external_exports.string().min(1),
-  results: external_exports.array(InboxTriageResultSchema),
-  usage: TriageInboxUsageSchema.optional()
-});
-
-// ../shared/src/schemas/inference-usage.ts
-var InferenceUsageSurfaceSchema = external_exports.string().min(1).max(80).regex(/^[a-z][a-z0-9_-]*$/);
-var RecordInferenceUsageInputSchema = external_exports.object({
-  product: external_exports.string().min(1).optional(),
-  surface: InferenceUsageSurfaceSchema,
-  model: external_exports.string().min(1).max(120),
-  inputTokens: external_exports.number().int().nonnegative(),
-  outputTokens: external_exports.number().int().nonnegative(),
-  cachedTokens: external_exports.number().int().nonnegative().default(0),
-  costCents: external_exports.number().nonnegative(),
-  timestamp: external_exports.coerce.date().optional()
-});
-var InferenceUsageBreakdownQuerySchema = external_exports.object({
-  from: external_exports.coerce.date(),
-  to: external_exports.coerce.date()
-});
-var InferenceUsageGroupSchema = external_exports.object({
-  calls: external_exports.number().int().nonnegative(),
-  costCents: external_exports.number().nonnegative(),
-  inputTokens: external_exports.number().int().nonnegative(),
-  outputTokens: external_exports.number().int().nonnegative(),
-  cachedTokens: external_exports.number().int().nonnegative()
-});
-var InferenceUsageBreakdownSchema = external_exports.object({
-  from: external_exports.string().datetime(),
-  to: external_exports.string().datetime(),
-  totals: InferenceUsageGroupSchema,
-  bySurface: external_exports.array(InferenceUsageGroupSchema.extend({ surface: InferenceUsageSurfaceSchema })),
-  byModel: external_exports.array(InferenceUsageGroupSchema.extend({ model: external_exports.string().min(1) }))
-});
-
-// ../shared/src/schemas/product-health.ts
-var DEFAULT_PRODUCT_HEALTH_INTERVAL_SECONDS = 24 * 60 * 60;
-var ISO_DATE_STRING = external_exports.string().datetime({ offset: true }).describe("ISO-8601 timestamp with timezone offset.");
-var ProductHealthStatusSchema = external_exports.enum(["healthy", "degraded", "halted"]);
-var ProductHealthDetailsSchema = external_exports.record(external_exports.unknown()).superRefine((details, ctx) => {
-  const credentialPath = findCredentialLikePath(details);
-  if (!credentialPath) return;
-  ctx.addIssue({
-    code: external_exports.ZodIssueCode.custom,
-    message: `Product health details must not contain credentials (${credentialPath}).`
-  });
-});
-var ProductHealthReportInputSchema = external_exports.object({
-  productId: external_exports.string().min(1).max(120),
-  status: ProductHealthStatusSchema,
-  lastActivityAt: ISO_DATE_STRING,
-  summary: external_exports.string().min(1).max(1e3),
-  details: ProductHealthDetailsSchema.optional(),
-  reportedAt: ISO_DATE_STRING,
-  expectedIntervalSeconds: external_exports.number().int().positive().optional()
-});
-var StoredProductHealthReportSchema = ProductHealthReportInputSchema.extend({
-  expectedIntervalSeconds: external_exports.number().int().positive()
-});
-var ProductLivenessStateSchema = external_exports.enum([
-  "healthy",
-  "degraded",
-  "halted",
-  "stale",
-  "unknown"
-]);
-var ProductLivenessSnapshotEntrySchema = external_exports.object({
-  productId: external_exports.string().min(1),
-  state: ProductLivenessStateSchema,
-  flagged: external_exports.boolean(),
-  status: ProductHealthStatusSchema.optional(),
-  lastActivityAt: ISO_DATE_STRING.optional(),
-  reportedAt: ISO_DATE_STRING.optional(),
-  expectedIntervalSeconds: external_exports.number().int().positive(),
-  ageSeconds: external_exports.number().int().nonnegative().nullable(),
-  summary: external_exports.string()
-});
-function findCredentialLikePath(value, path = []) {
-  if (!value || typeof value !== "object") return null;
-  if (Array.isArray(value)) {
-    for (const [index, item] of value.entries()) {
-      const match = findCredentialLikePath(item, [...path, String(index)]);
-      if (match) return match;
-    }
-    return null;
-  }
-  for (const [key, nested] of Object.entries(value)) {
-    const nextPath = [...path, key];
-    if (/(?:secret|token|password|credential|api[-_]?key|private[-_]?key)/i.test(key)) {
-      return nextPath.join(".");
-    }
-    const match = findCredentialLikePath(nested, nextPath);
-    if (match) return match;
-  }
-  return null;
-}
-
-// ../shared/src/schemas/interaction-trace.ts
-var InteractionTraceVerificationSignalSchema = external_exports.enum([
-  "no_signal",
-  "human_accepted_output",
-  "human_rejected_output",
-  "ci_pr_succeeded",
-  "ci_pr_failed",
-  "brief_accepted",
-  "brief_rejected",
-  "standup_completed",
-  "standup_failed"
-]);
-var InteractionTraceVerificationSchema = external_exports.object({
-  success: external_exports.boolean(),
-  signal: InteractionTraceVerificationSignalSchema,
-  confidence: external_exports.number().min(0).max(1),
-  reason: external_exports.string().min(1).max(1e3)
-});
-var InteractionTraceActorSchema = external_exports.object({
-  type: external_exports.enum(["human", "agent", "system"]),
-  id: external_exports.string().min(1).max(200),
-  name: external_exports.string().min(1).max(200).optional()
-});
-var RecordInteractionTraceInputSchema = external_exports.object({
-  product: external_exports.string().min(1).max(120),
-  intent: external_exports.string().min(1).max(500),
-  actionSummary: external_exports.string().min(1).max(4e3),
-  outcomeSummary: external_exports.string().min(1).max(4e3),
-  model: external_exports.string().min(1).max(200).nullable().optional(),
-  actor: InteractionTraceActorSchema,
-  occurredAt: external_exports.string().datetime().optional(),
-  verification: InteractionTraceVerificationSchema.optional(),
-  metadata: external_exports.record(external_exports.unknown()).optional()
-});
-var StoredInteractionTraceSchema = RecordInteractionTraceInputSchema.extend({
-  id: external_exports.string().uuid(),
-  occurredAt: external_exports.string().datetime(),
-  createdAt: external_exports.string().datetime(),
-  verification: InteractionTraceVerificationSchema
-});
-var InteractionTraceQualityScoreSchema = external_exports.number().min(0).max(1);
-var RetrieveRelevantTracesQuerySchema = external_exports.object({
-  product: external_exports.string().min(1).max(120),
-  intent: external_exports.string().min(1).max(500),
-  limit: external_exports.number().int().positive().max(10).optional()
-});
-var RetrievedInteractionTraceSchema = StoredInteractionTraceSchema.extend({
-  score: external_exports.number().min(0).max(1),
-  qualityScore: InteractionTraceQualityScoreSchema
-});
-
-// ../shared/src/schemas/maeve-lesson.ts
-var MaeveLessonStatusSchema = external_exports.enum(["candidate", "verified", "retired"]);
-var MaeveLessonEvidenceSchema = external_exports.object({
-  source: external_exports.enum(["interaction_trace", "artifact"]),
-  traceId: external_exports.string().uuid().optional(),
-  artifact: external_exports.string().min(1).max(1e3).optional(),
-  summary: external_exports.string().min(1).max(1e3),
-  hash: external_exports.string().regex(/^sha256:[a-f0-9]{64}$/)
-});
-var MaeveLessonSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  product: external_exports.string().min(1).max(120),
-  statement: external_exports.string().min(1).max(1e3),
-  scope: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  tags: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  evidence: external_exports.array(MaeveLessonEvidenceSchema),
-  status: MaeveLessonStatusSchema,
-  createdAt: external_exports.string().datetime(),
-  lastSeenAt: external_exports.string().datetime()
-});
-var CreateMaeveLessonInputSchema = external_exports.object({
-  product: external_exports.string().min(1).max(120),
-  statement: external_exports.string().min(1).max(1e3),
-  scope: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  tags: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  evidence: external_exports.array(MaeveLessonEvidenceSchema).default([]),
-  status: MaeveLessonStatusSchema.default("candidate"),
-  lastSeenAt: external_exports.string().datetime().optional()
-});
-var PromoteMaeveLessonInputSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  status: MaeveLessonStatusSchema,
-  appendEvidence: external_exports.array(MaeveLessonEvidenceSchema).optional()
-});
-var RecallMaeveLessonsQuerySchema = external_exports.object({
-  product: external_exports.string().min(1).max(120).optional(),
-  taskType: external_exports.string().min(1).max(120).optional(),
-  tags: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  limit: external_exports.number().int().positive().max(10).default(5),
-  /**
-   * Free-text query for semantic (pgvector cosine) recall. When set and an
-   * EmbeddingProvider is configured, recallMaeveLessons embeds this text and
-   * retrieves by cosine similarity, with exact-tag matches as a boost.
-   * Falls back to exact-class matching when the provider is NoOp.
-   */
-  semanticQuery: external_exports.string().min(1).max(500).optional()
-});
-var MaeveLessonSeedAnchorSchema = external_exports.object({
-  commit: external_exports.string().regex(/^[0-9a-f]{40}$/i, "commit must be a full 40-character git SHA"),
-  pr: external_exports.number().int().positive().nullable(),
-  summary: external_exports.string().min(1).max(1e3)
-});
-var MaeveLessonSeedSchema = external_exports.object({
-  statement: external_exports.string().min(1).max(1e3),
-  scope: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  tags: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  anchors: external_exports.array(MaeveLessonSeedAnchorSchema).min(1),
-  lastSeenAt: external_exports.string().datetime()
-});
-var ReviewFindingSeveritySchema = external_exports.enum(["critical", "high", "medium", "low"]);
-var ReviewFindingLessonInputSchema = external_exports.object({
-  studioId: external_exports.string().min(1),
-  findingStudioId: external_exports.string().min(1),
-  product: external_exports.string().min(1).max(120),
-  repository: external_exports.string().min(1).max(240),
-  pullRequestNumber: external_exports.number().int().positive(),
-  findingText: external_exports.string().min(1).max(4e3),
-  severity: ReviewFindingSeveritySchema,
-  reviewer: external_exports.string().min(1).max(120),
-  remediatingCommitSha: external_exports.string().min(4).max(64),
-  /** The durable, reusable rule distilled from the finding — NOT the finding text verbatim. */
-  lessonStatement: external_exports.string().min(1).max(1e3),
-  scope: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  tags: external_exports.array(external_exports.string().min(1).max(120)).default([]),
-  occurredAt: external_exports.string().datetime()
-});
-
-// ../shared/src/schemas/operator-trace.ts
-var TRACE_ACTORS = [
-  "human",
-  "cowork",
-  "claude-code",
-  "codex",
-  "goal-runner",
-  "ci"
-];
-var TraceActorSchema = external_exports.enum(TRACE_ACTORS);
-var TRACE_SOURCES = [
-  "shell",
-  "cowork",
-  "claude-code",
-  "codex",
-  "goal-runner",
-  "github"
-];
-var TraceSourceSchema = external_exports.enum(TRACE_SOURCES);
-var TraceProvenanceSchema = external_exports.object({
-  source: TraceSourceSchema,
-  /** Absolute path of the source file/dir, or the gh query for CI events. */
-  path: external_exports.string().min(1).max(1e3),
-  /** Line number, session id, or PR number locating the row inside the source. */
-  locator: external_exports.string().min(1).max(200).optional()
-});
-var TraceRecordSchema = external_exports.object({
-  t: external_exports.string().datetime(),
-  actor: TraceActorSchema,
-  action: external_exports.string().min(1).max(2e3),
-  target: external_exports.string().max(1e3).default(""),
-  outcome: external_exports.string().max(2e3).default(""),
-  product: external_exports.string().min(1).max(120).optional(),
-  provenance: TraceProvenanceSchema
-});
-var ShellRedactionSchema = external_exports.enum(["none", "secret", "unclassified"]);
-var ShellTraceEntrySchema = external_exports.object({
-  ts: external_exports.string().datetime(),
-  cwd: external_exports.string().min(1).max(1e3),
-  command: external_exports.string().min(1).max(4e3),
-  exitCode: external_exports.number().int(),
-  shellSessionId: external_exports.string().min(1).max(200),
-  redaction: ShellRedactionSchema
-});
-var TraceSourceReportSchema = external_exports.discriminatedUnion("status", [
-  external_exports.object({
-    status: external_exports.literal("ok"),
-    source: TraceSourceSchema,
-    recordCount: external_exports.number().int().nonnegative(),
-    /** Files/entries present but skipped (unparseable, filtered) — named, not silent. */
-    skipped: external_exports.array(external_exports.string().min(1).max(500)).default([])
-  }),
-  external_exports.object({
-    status: external_exports.literal("dark"),
-    source: TraceSourceSchema,
-    reason: external_exports.string().min(1).max(500)
-  })
-]);
-var OperatorTimelineSchema = external_exports.object({
-  records: external_exports.array(TraceRecordSchema),
-  sources: external_exports.array(TraceSourceReportSchema)
-});
-
-// ../shared/src/schemas/witan.ts
+// src/witan/schemas.ts
 var WITAN_RUBRIC_VERSION_V1 = "witan-rubric-v1-2026-06-24";
 var WITAN_RUBRIC_VERSION_V2 = "witan-rubric-v2-2026-07-12";
 var WITAN_RUBRIC_VERSION_V3 = "witan-rubric-v3-2026-07-13";
@@ -5391,11 +4100,9 @@ var WITAN_TRADING_RUBRIC_V0_CRITERION_IDS = [
   "audit-completeness",
   "claim-reality"
 ];
-var WITAN_QUANT_INTEGRITY_RUBRIC_V0_CRITERION_IDS = ["quant-integrity"];
 var WitanCriterionIdSchema = external_exports.enum([
   ...WITAN_CRITERION_IDS,
-  ...WITAN_TRADING_RUBRIC_V0_CRITERION_IDS,
-  ...WITAN_QUANT_INTEGRITY_RUBRIC_V0_CRITERION_IDS
+  ...WITAN_TRADING_RUBRIC_V0_CRITERION_IDS
 ]);
 var WitanTradingCriterionIdSchema = external_exports.enum(WITAN_TRADING_RUBRIC_V0_CRITERION_IDS);
 var WitanCriterionCategorySchema = external_exports.enum([
@@ -5423,8 +4130,6 @@ var WitanEvidenceKindSchema = external_exports.enum([
   "commit",
   "coverage",
   "dependency_report",
-  "dispatch_log",
-  "maeve_trace",
   "prod_check",
   "pull_request",
   "repository",
@@ -5537,1005 +4242,640 @@ var WitanConsumedSignalSummarySchema = external_exports.object({
   // this field always carries every finding.
   findings: external_exports.array(WitanInputSignalFindingSchema).default([])
 }).strict();
-var WitanReportSchema = external_exports.object({
+var WitanScoredVerdictSchema = external_exports.enum([
+  "verified",
+  "conditional",
+  "at_risk",
+  "unverified"
+]);
+var WitanReportVerdictSchema = external_exports.union([
+  WitanScoredVerdictSchema,
+  external_exports.literal("insufficient_source")
+]);
+function witanVerdictForScore(score) {
+  if (score >= 3.5) return "verified";
+  if (score >= 2.5) return "conditional";
+  if (score >= 1.5) return "at_risk";
+  return "unverified";
+}
+var WitanReportCommonSchema = external_exports.object({
   productSlug: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/),
   productDisplayName: external_exports.string().min(1).max(120),
   repo: WitanRepoRefSchema,
   generatedAt: external_exports.string().datetime({ offset: true }),
   rubricVersion: external_exports.string().min(1).max(120),
-  codeTrustScore: external_exports.number().min(0).max(4),
-  processTrustScore: external_exports.number().min(0).max(4),
-  overallScore: external_exports.number().min(0).max(4),
   // Rubric-driven: length matches whatever rubric produced this report, not a fixed enum.
   criteria: external_exports.array(WitanCriterionScoreSchema).min(1),
   consumedSignals: external_exports.array(WitanConsumedSignalSummarySchema).optional(),
+  archetype: WitanRepoArchetypeSchema.optional()
+});
+var WitanScoredReportSchema = WitanReportCommonSchema.extend({
+  verdict: WitanScoredVerdictSchema,
+  codeTrustScore: external_exports.number().min(0).max(4),
+  processTrustScore: external_exports.number().min(0).max(4),
+  overallScore: external_exports.number().min(0).max(4),
   // Present only when the rubric has more than two criterion categories — the legacy
   // codeTrustScore/processTrustScore pair can't losslessly represent 3+ category buckets.
   categoryScores: external_exports.record(external_exports.string(), external_exports.number().min(0).max(4)).optional(),
-  // Repo-archetype metadata (see WitanRepoArchetypeSchema above). Both fields are omitted for
-  // callers that don't classify an archetype (e.g. the trading rubric). insufficientSourceReason
-  // is present only for the non-source archetypes ('docs_only' | 'binary_only' |
-  // 'unrecognised_ecosystem' | 'empty') — its presence is what presentation layers
-  // (badge/terminal/verdict) key off to show an explicit insufficient-source verdict instead of
-  // a confident numeric score.
-  archetype: WitanRepoArchetypeSchema.optional(),
-  insufficientSourceReason: external_exports.string().min(1).max(2e3).optional()
-}).strict();
-
-// ../shared/src/schemas/work-item.ts
-var WorkItemTypeSchema = external_exports.enum(["feature", "bug"]);
-var WorkItemPrioritySchema = external_exports.enum(["low", "normal", "high", "urgent"]);
-var WorkItemStatusSchema = external_exports.enum([
-  "submitted",
-  "scoped",
-  "dispatched",
-  "pr_open",
-  "done",
-  "declined"
-]);
-var CreateWorkItemInputSchema = external_exports.object({
-  productId: external_exports.string().uuid(),
-  type: WorkItemTypeSchema,
-  title: external_exports.string().min(3).max(180),
-  description: external_exports.string().min(8).max(2e4),
-  acceptanceCriteria: external_exports.string().max(2e4).optional(),
-  priority: WorkItemPrioritySchema.default("normal")
-}).strict();
-var ScopeWorkItemInputSchema = external_exports.object({
-  scopedTask: external_exports.string().min(8).max(2e4).optional()
-}).strict();
-var ListWorkItemsQuerySchema = external_exports.object({
-  productId: external_exports.string().uuid().optional(),
-  status: WorkItemStatusSchema.optional()
-}).strict();
-var DispatchWorkItemInputSchema = external_exports.object({
-  executor: external_exports.enum(["claude-code", "codex"]).default("codex"),
-  mode: external_exports.enum(["dry-run", "execute"]).default("dry-run")
-}).strict();
-
-// ../shared/src/schemas/goal-frontmatter.ts
-var GoalStreamKindSchema = external_exports.enum(["code", "process"]);
-var GoalPrioritySchema = external_exports.enum(["p0", "p1", "p2"]);
-var GoalFrontmatterExtrasSchema = external_exports.object({
-  stream: external_exports.string().min(1).nullable().default(null),
-  order: external_exports.number().int().nullable().default(null),
-  dependsOn: external_exports.array(external_exports.string().min(1)).default([]),
-  priority: GoalPrioritySchema.nullable().default(null),
-  kind: GoalStreamKindSchema.default("code")
-});
-
-// ../shared/src/schemas/stream.ts
-var StreamSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  name: external_exports.string().min(1).max(120),
-  tag: external_exports.string().max(60).nullable(),
-  kind: GoalStreamKindSchema,
-  orderIndex: external_exports.number().int(),
-  createdAt: external_exports.coerce.date(),
-  updatedAt: external_exports.coerce.date()
-});
-var StreamItemSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  streamId: external_exports.string().uuid(),
-  orderIndex: external_exports.number().int(),
-  title: external_exports.string().min(1).max(200),
-  /** docs/orchestration/goal_*.md filename (no extension) for code items; null for process items. */
-  goalName: external_exports.string().min(1).nullable(),
-  refLabel: external_exports.string().max(60).nullable(),
-  /** Free-form governed-run prompt text (mirrors the prototype's per-item `run` string). Null = no run control shown. */
-  runPrompt: external_exports.string().min(1).nullable(),
-  createdAt: external_exports.coerce.date(),
-  updatedAt: external_exports.coerce.date()
-});
-var StreamItemDisplayStatusSchema = external_exports.enum([
-  "done",
-  "in-review",
-  "running",
-  "queued",
-  "blocked",
-  "local-unknown"
-]);
-
-// ../shared/src/schemas/runner-dispatch.ts
-var RUNNER_DISPATCH_MODES = ["dry-run", "execute"];
-var RunnerDispatchModeSchema = external_exports.enum(RUNNER_DISPATCH_MODES);
-var RUNNER_DISPATCH_STATUSES = ["queued", "claimed", "running", "done", "failed"];
-var RunnerDispatchStatusSchema = external_exports.enum(RUNNER_DISPATCH_STATUSES);
-var GOAL_CARD_PATTERN = /^docs\/orchestration\/[A-Za-z0-9_./-]+\.md$/;
-function isAllowedGoalCardPath(goalCard) {
-  if (!GOAL_CARD_PATTERN.test(goalCard)) return false;
-  return goalCard.split("/").every((segment) => segment !== "." && segment !== "..");
-}
-var GoalCardPathSchema = external_exports.string().min(1).max(300).refine(isAllowedGoalCardPath, { message: "goal_card_invalid" });
-var RunnerDispatchRequestSchema = external_exports.object({
-  goalCard: GoalCardPathSchema,
-  stream: external_exports.string().min(1).max(120).optional(),
-  mode: RunnerDispatchModeSchema
-});
-
-// ../shared/src/schemas/witan-metrics-manifest.ts
-var WITAN_METRICS_MANIFEST_SCHEMA_VERSION = "witan-metrics-manifest-v0";
-var WitanMetricsManifestReturnsFrequencySchema = external_exports.enum([
-  "daily",
-  "weekly",
-  "monthly",
-  "annual"
-]);
-var WitanMetricsManifestFoldSchema = external_exports.object({
-  foldId: external_exports.string().min(1).max(80),
-  inSampleSharpe: external_exports.number().optional(),
-  outOfSampleSharpe: external_exports.number().optional()
-}).strict();
-var WitanMetricsManifestCscvTrialSchema = external_exports.object({
-  trialId: external_exports.string().min(1).max(80),
-  blockReturns: external_exports.array(external_exports.number()).min(2)
-}).strict();
-var WitanMetricsManifestCscvSchema = external_exports.object({
-  // Must be even (split into IS/OOS halves) — enforced by the grader, not the schema.
-  blocks: external_exports.number().int().min(4).max(16),
-  trials: external_exports.array(WitanMetricsManifestCscvTrialSchema).min(2).max(200)
-}).strict();
-var WitanMetricsManifestCostModelSchema = external_exports.object({
-  feeBps: external_exports.number().min(0).optional(),
-  slippageBps: external_exports.number().min(0).optional(),
-  borrowBps: external_exports.number().min(0).optional(),
-  notes: external_exports.string().min(1).max(300).optional()
-}).strict();
-var WitanMetricsManifestParameterPointSchema = external_exports.object({
-  // Human-readable label for this point (e.g. "72" or "72 bars") — evidence/display only.
-  paramLabel: external_exports.string().min(1).max(80),
-  // The point's position on its swept axis, used to find its nearest neighbors by distance.
-  paramValue: external_exports.number(),
-  outOfSampleSharpe: external_exports.number()
-}).strict();
-var WitanMetricsManifestParameterSweepSchema = external_exports.object({
-  // Name of the swept parameter (e.g. "lookback_bars") — evidence/display only.
-  paramName: external_exports.string().min(1).max(80),
-  points: external_exports.array(WitanMetricsManifestParameterPointSchema).min(3).max(500)
-}).strict();
-var WitanMetricsManifestLabelSourceSchema = external_exports.enum([
-  "real_forward_returns",
-  "synthetic",
-  "unknown"
-]);
-var WitanMetricsManifestSchema = external_exports.object({
-  schemaVersion: external_exports.literal(WITAN_METRICS_MANIFEST_SCHEMA_VERSION),
-  strategyName: external_exports.string().min(1).max(200).optional(),
-  // The headline reported Sharpe ratio the target repo is claiming.
-  reportedSharpe: external_exports.number(),
-  // How many trials/backtests were run in the search that produced reportedSharpe (the
-  // "1-of-42" count) — required so the grader can correct for selection bias.
-  trialCount: external_exports.number().int().positive(),
-  // Track-record length in return observations (e.g. 252 for a year of daily returns) —
-  // the `n` in the Probabilistic/Deflated Sharpe Ratio formula.
-  trackRecordObservations: external_exports.number().int().positive(),
-  returnsFrequency: WitanMetricsManifestReturnsFrequencySchema.default("daily"),
-  // Skew/kurtosis of the returns distribution; default to the normal-distribution values
-  // (0 skew, kurtosis 3) when the repo does not report them.
-  skewness: external_exports.number().default(0),
-  kurtosis: external_exports.number().min(0).default(3),
-  // Whether reportedSharpe is net of trading costs (fees/slippage/borrow/roll).
-  netOfCosts: external_exports.boolean(),
-  costModel: WitanMetricsManifestCostModelSchema.optional(),
-  // Per-fold in-sample vs out-of-sample breakdown, when the repo reports one.
-  folds: external_exports.array(WitanMetricsManifestFoldSchema).default([]),
-  // Per-trial, per-block performance matrix for the CSCV/PBO computation, when available.
-  cscv: WitanMetricsManifestCscvSchema.optional(),
-  // Parameter-sweep breakdown for the run-tier (L3b) parameter-neighborhood robustness
-  // grader, when the run swept a parameter (e.g. a lookback window) and recorded OOS
-  // performance at each swept value.
-  parameterSweep: WitanMetricsManifestParameterSweepSchema.optional(),
-  // Provenance of the labels behind reportedSharpe (labelling-integrity, L1+artifact tier).
-  labelSource: WitanMetricsManifestLabelSourceSchema.optional()
+  insufficientSourceReason: external_exports.never().optional()
 }).strict();
-
-// ../shared/src/schemas/witan-strategy-adapter.ts
-var WITAN_STRATEGY_ADAPTER_CONFIG_SCHEMA_VERSION = "witan-strategy-adapter-v0";
-var WitanStrategyAdapterConfigSchema = external_exports.object({
-  schemaVersion: external_exports.literal(WITAN_STRATEGY_ADAPTER_CONFIG_SCHEMA_VERSION),
-  // Argv for the strategy entrypoint, e.g. ["python3", "strategy.py"] or ["node", "run.mjs"].
-  // Command-argv (not a language enum) is what keeps the adapter language-agnostic — most
-  // real targets are Python, but the contract does not assume it.
-  command: external_exports.array(external_exports.string().min(1).max(300)).min(1).max(20),
-  // Relative path (within the target repo) to the data the strategy should backtest against.
-  dataPath: external_exports.string().min(1).max(500).optional(),
-  // Backtest window, as the target repo defines its own date strings (ISO-8601 recommended).
-  // Optional — a strategy may declare its own default window instead.
-  windowStart: external_exports.string().min(1).max(40).optional(),
-  windowEnd: external_exports.string().min(1).max(40).optional(),
-  // Relative path (within the sandboxed workspace) the entrypoint must write its raw result
-  // to — see WitanStrategyRunResultSchema below.
-  outputPath: external_exports.string().min(1).max(300).default("witan-run-result.json"),
-  timeoutMs: external_exports.number().int().positive().max(30 * 60 * 1e3).default(2 * 60 * 1e3),
-  // Explicit opt-in egress allowlist. Empty by default — no network from the sandboxed run
-  // unless the target repo explicitly whitelists hosts here.
-  allowedHosts: external_exports.array(external_exports.string().min(1).max(255)).max(20).default([])
+var WitanAbstainedReportSchema = WitanReportCommonSchema.extend({
+  verdict: external_exports.literal("insufficient_source"),
+  // Null is deliberate and explicit: omission is ambiguous, while zero is a real score.
+  codeTrustScore: external_exports.null(),
+  processTrustScore: external_exports.null(),
+  overallScore: external_exports.null(),
+  categoryScores: external_exports.never().optional(),
+  insufficientSourceReason: external_exports.string().min(1).max(2e3)
 }).strict();
-var WitanStrategyRunResultSchema = WitanMetricsManifestSchema.omit({
-  schemaVersion: true
-});
-
-// ../shared/src/types/tactical-action.ts
-var TacticalActionTypeSchema = external_exports.enum([
-  "merge_pr_auto_merge_safe",
-  "deploy_staging",
-  "acknowledge_canary_alert",
-  "update_status_md",
-  "provision_product",
-  "dispatch_dev_task"
-]);
-var TacticalActionStatusSchema = external_exports.enum(["executed", "blocked", "dry_run"]);
-var TacticalActionPolicySchema = external_exports.object({
-  studioId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid(),
-  actionType: TacticalActionTypeSchema,
-  allowed: external_exports.boolean(),
-  dryRun: external_exports.boolean(),
-  promotedAt: external_exports.coerce.date().nullable(),
-  forceEnableReason: external_exports.string().nullable()
-});
-var BaseActionSchema = external_exports.object({
-  actionType: TacticalActionTypeSchema,
-  productId: external_exports.string().uuid(),
-  coordinatorSessionId: external_exports.string().uuid().nullable().optional(),
-  customerFacingProduction: external_exports.boolean().default(false)
-});
-var MergePrTacticalActionSchema = BaseActionSchema.extend({
-  actionType: external_exports.literal("merge_pr_auto_merge_safe"),
-  repository: external_exports.string().min(1),
-  pullRequestNumber: external_exports.number().int().positive(),
-  labels: external_exports.array(external_exports.string()),
-  ciStatus: external_exports.enum(["green", "red", "unknown"]),
-  humanApprovals: external_exports.number().int().nonnegative(),
-  coworkClaudeApprovedStatus: external_exports.enum(["green", "red", "unknown"]),
-  // The PR head SHA captured at the SAME live precondition snapshot that
-  // verified the label/CI/approvals/cowork-claude-approved gates. Threaded
-  // through to the GitHub merge call as the conditional `sha` parameter so a
-  // commit that lands between the snapshot and the merge (a fast follow-up
-  // push, or a re-triggered CI run resetting status) can never be
-  // squash-merged unverified — GitHub rejects the merge with 409 instead.
-  headSha: external_exports.string().min(1)
-});
-var DeployStagingTacticalActionSchema = BaseActionSchema.extend({
-  actionType: external_exports.literal("deploy_staging"),
-  environment: external_exports.literal("staging"),
-  mainStatus: external_exports.enum(["green", "red", "unknown"]),
-  stagingStatus: external_exports.enum(["green", "red", "unknown"])
-});
-var AcknowledgeCanaryAlertTacticalActionSchema = BaseActionSchema.extend({
-  actionType: external_exports.literal("acknowledge_canary_alert"),
-  alertId: external_exports.string().min(1),
-  fingerprint: external_exports.string().min(1),
-  knownFalsePositiveFingerprints: external_exports.array(external_exports.string()).default([])
-});
-var UpdateStatusMdTacticalActionSchema = BaseActionSchema.extend({
-  actionType: external_exports.literal("update_status_md"),
-  source: external_exports.literal("daily_brief_synthesis"),
-  statusMarkdown: external_exports.string().min(1).max(2e4)
-});
-var ProvisionProductTacticalActionSchema = BaseActionSchema.extend({
-  actionType: external_exports.literal("provision_product"),
-  productName: external_exports.string().min(1).max(80),
-  vertical: external_exports.string().min(1).max(80),
-  repoTarget: external_exports.string().min(1),
-  templateRef: external_exports.string().min(1),
-  scopeNotes: external_exports.string().max(2e3).optional()
-});
-var DispatchDevTaskTacticalActionSchema = BaseActionSchema.extend({
-  actionType: external_exports.literal("dispatch_dev_task"),
-  repo: RepoRefSchema,
-  task: external_exports.string().min(1).max(2e4),
-  executor: CodingAgentExecutorSchema
-});
-var TacticalActionSchema = external_exports.discriminatedUnion("actionType", [
-  MergePrTacticalActionSchema,
-  DeployStagingTacticalActionSchema,
-  AcknowledgeCanaryAlertTacticalActionSchema,
-  UpdateStatusMdTacticalActionSchema,
-  ProvisionProductTacticalActionSchema,
-  DispatchDevTaskTacticalActionSchema
-]);
-var TacticalActionContextSchema = external_exports.object({
-  studioId: external_exports.string().uuid(),
-  actorUserId: external_exports.string().uuid().nullable().optional(),
-  requestedAt: external_exports.coerce.date().optional()
+var StrictWitanReportSchema = external_exports.union([WitanScoredReportSchema, WitanAbstainedReportSchema]).superRefine((report, context) => {
+  if (report.verdict !== "insufficient_source" && report.verdict !== witanVerdictForScore(report.overallScore)) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["verdict"],
+      message: `verdict does not match overallScore ${report.overallScore}`
+    });
+  }
 });
-var TacticalActionPermitResultSchema = external_exports.discriminatedUnion("status", [
-  external_exports.object({
-    status: external_exports.literal("executed"),
-    auditLogId: external_exports.string().uuid(),
-    reason: external_exports.literal("permit_allowed")
-  }),
+var WitanReportSchema = external_exports.preprocess((value) => {
+  if (typeof value === "object" && value !== null && !Array.isArray(value) && !("verdict" in value) && !("insufficientSourceReason" in value) && typeof value.overallScore === "number") {
+    return {
+      ...value,
+      verdict: witanVerdictForScore(value.overallScore)
+    };
+  }
+  return value;
+}, StrictWitanReportSchema);
+var WITAN_ATTESTATION_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
+var WITAN_ATTESTATION_PREDICATE_TYPE = "https://cejel.dev/attestations/scan/v1";
+var WitanAttestationOutcomeSchema = external_exports.discriminatedUnion("status", [
   external_exports.object({
-    status: external_exports.literal("blocked"),
-    auditLogId: external_exports.string().uuid().optional(),
-    reason: external_exports.string().min(1)
-  }),
+    status: external_exports.literal("scored"),
+    overallScore: external_exports.number().min(0).max(4),
+    codeTrustScore: external_exports.number().min(0).max(4),
+    processTrustScore: external_exports.number().min(0).max(4)
+  }).strict(),
   external_exports.object({
-    status: external_exports.literal("dry_run"),
-    auditLogId: external_exports.string().uuid(),
-    reason: external_exports.literal("dry_run_mode"),
-    wouldHaveDone: external_exports.record(external_exports.unknown())
-  })
-]);
-var TacticalActionLogEntrySchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid(),
-  product: external_exports.string().nullable().optional(),
-  coordinatorSessionId: external_exports.string().uuid().nullable(),
-  actionType: TacticalActionTypeSchema.or(external_exports.string()),
-  context: external_exports.record(external_exports.unknown()),
-  permitResult: external_exports.record(external_exports.unknown()),
-  status: TacticalActionStatusSchema,
-  outcome: external_exports.string().nullable(),
-  wouldHaveDone: external_exports.record(external_exports.unknown()).nullable(),
-  attemptedAt: external_exports.string(),
-  executedAt: external_exports.string().nullable()
-});
-
-// ../shared/src/schemas/index.ts
-var StudioSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  name: external_exports.string().min(1).max(100),
-  billingStatus: external_exports.enum(["trial", "active", "past_due", "cancelled"]),
-  planTier: external_exports.enum(["trial", "solo", "studio", "studio_plus", "self_hosted", "enterprise"]),
-  onPrem: external_exports.boolean().default(false),
-  createdAt: external_exports.coerce.date()
-});
-var HumanSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  email: external_exports.string().email(),
-  name: external_exports.string().min(1).max(120),
-  oauthProviders: external_exports.array(external_exports.enum(["google", "microsoft", "apple"])).default([]),
-  role: external_exports.enum(["owner", "member", "advisor", "per_product"]),
-  timezone: external_exports.string(),
-  briefTime: external_exports.string().regex(/^\d{2}:\d{2}$/),
-  createdAt: external_exports.coerce.date()
-});
-var ProductSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  name: external_exports.string().min(1).max(80),
-  slug: external_exports.string().regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/),
-  status: external_exports.enum(["active", "snoozed", "wound_down", "deleted"]),
-  description: external_exports.string().max(280).optional(),
-  repoUrl: external_exports.string().url().optional(),
-  calendarTag: external_exports.string().optional(),
-  emailLabelPrefix: external_exports.string().optional(),
-  colorHex: external_exports.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
-  scheduleBriefTime: external_exports.string().regex(/^\d{2}:\d{2}$/).optional(),
-  briefTemplateId: external_exports.string().uuid().optional(),
-  regulated: external_exports.boolean().default(false),
-  createdAt: external_exports.coerce.date(),
-  lastTouchedAt: external_exports.coerce.date()
-});
-var AgentSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid(),
-  agentType: external_exports.enum(["codex", "claude-code", "cowork", "cursor", "cline", "aider", "other"]),
-  sessionId: external_exports.string().optional(),
-  status: external_exports.enum(["active", "idle", "registered", "archived"]),
-  registeredAt: external_exports.coerce.date(),
-  lastActiveAt: external_exports.coerce.date().optional(),
-  totalCostCentsLifetime: external_exports.number().int().nonnegative().default(0)
-});
-var AgentRunSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  agentId: external_exports.string().uuid(),
-  coordinatorSessionId: external_exports.string().uuid().nullable().optional(),
-  startedAt: external_exports.coerce.date(),
-  completedAt: external_exports.coerce.date().optional(),
-  actionType: external_exports.string(),
-  toolName: external_exports.string().optional(),
-  toolInputSummary: external_exports.string().optional(),
-  toolOutputSummary: external_exports.string().optional(),
-  tokensUsedInput: external_exports.number().int().nonnegative().default(0),
-  tokensUsedOutput: external_exports.number().int().nonnegative().default(0),
-  costCents: external_exports.number().int().nonnegative().default(0),
-  durationMs: external_exports.number().int().nonnegative().default(0),
-  resultStatus: external_exports.enum(["success", "failure", "partial", "timeout"]).optional(),
-  resultSummary: external_exports.string().optional(),
-  filesTouched: external_exports.array(external_exports.string()).default([])
-});
-var CoordinatorStatusSchema = external_exports.enum([
-  "draft",
-  "spawned",
-  "in_progress",
-  "reporting",
-  "closed"
+    status: external_exports.literal("abstained"),
+    reason: external_exports.string().min(1).max(2e3)
+  }).strict()
 ]);
-var CoordinatorEscalationPolicySchema = external_exports.object({
-  stuck_after_hours: external_exports.number().int().positive(),
-  method: external_exports.literal("flag_for_human"),
-  urgency: external_exports.enum(["low", "medium", "high", "critical"]).optional()
-});
-var CoordinatorSessionSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid(),
-  promptId: external_exports.string().uuid().nullable(),
-  objective: external_exports.string(),
-  status: CoordinatorStatusSchema,
-  spawnedAt: external_exports.coerce.date().nullable(),
-  closedAt: external_exports.coerce.date().nullable(),
-  escalationPolicy: CoordinatorEscalationPolicySchema.nullable(),
-  outcomeSummary: external_exports.string().nullable(),
-  createdAt: external_exports.coerce.date()
-});
-var AgentActivityWindowSchema = external_exports.enum(["24h", "7d", "30d"]);
-var AgentCostBucketSchema = external_exports.object({
-  key: external_exports.string(),
-  name: external_exports.string(),
-  runCount: external_exports.number().int().nonnegative(),
-  costUsd: external_exports.number().nonnegative()
-});
-var AgentCostRollupSchema = external_exports.object({
-  window: AgentActivityWindowSchema,
-  studioTotalUsd: external_exports.number().nonnegative(),
-  runCount: external_exports.number().int().nonnegative(),
-  byAgent: external_exports.array(AgentCostBucketSchema),
-  byProduct: external_exports.array(AgentCostBucketSchema)
-});
-var AgentConflictRecordSchema = external_exports.object({
-  file: external_exports.string(),
-  agents: external_exports.array(external_exports.string()).min(2),
-  references: external_exports.array(
+var WitanAttestationStatementSchema = external_exports.object({
+  _type: external_exports.literal(WITAN_ATTESTATION_STATEMENT_TYPE),
+  subject: external_exports.array(
     external_exports.object({
-      runId: external_exports.string(),
-      agent: external_exports.string(),
-      product: external_exports.string().nullable(),
-      startedAt: external_exports.string(),
-      sessionRef: external_exports.string().nullable(),
-      prUrl: external_exports.string().nullable()
-    })
-  )
-});
-var AgentLeaderboardEntrySchema = external_exports.object({
-  agent: external_exports.string(),
-  product: external_exports.string().nullable(),
-  runCount: external_exports.number().int().nonnegative(),
-  completedRuns: external_exports.number().int().nonnegative(),
-  failedRuns: external_exports.number().int().nonnegative(),
-  costUsd: external_exports.number().nonnegative(),
-  filesTouched: external_exports.number().int().nonnegative(),
-  conflicts: external_exports.number().int().nonnegative(),
-  state: external_exports.enum(["productive", "idle", "duplicating"]),
-  lastActiveAt: external_exports.string().nullable()
-});
-var ModelCostEstimateInputSchema = external_exports.object({
-  model: external_exports.string().optional(),
-  inputTokens: external_exports.number().int().nonnegative().default(0),
-  outputTokens: external_exports.number().int().nonnegative().default(0)
-});
-var ModelCostEstimateSchema = external_exports.object({
-  costUsd: external_exports.number().nonnegative(),
-  method: external_exports.enum(["estimated_from_model_rate", "unknown_model_rate"]),
-  rateModel: external_exports.enum(["claude-haiku", "claude-sonnet", "claude-opus", "unknown"])
-});
-var IntegrationSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid().nullable(),
-  kind: external_exports.string(),
-  oauthTokenEncrypted: external_exports.string().optional(),
-  refreshTokenEncrypted: external_exports.string().optional(),
-  status: external_exports.enum(["active", "broken", "revoked"]),
-  lastSyncAt: external_exports.coerce.date().optional(),
-  errorCount: external_exports.number().int().nonnegative().default(0)
-});
-var EmailAccountSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  provider: external_exports.enum(["gmail", "m365", "imap"]),
-  oauthTokenEncrypted: external_exports.string().optional(),
-  defaultLabelPrefix: external_exports.string().optional(),
-  triageCadenceMins: external_exports.number().int().positive().default(240)
-});
-var RoutineSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  productId: external_exports.string().uuid().nullable(),
-  name: external_exports.string(),
-  cronExpression: external_exports.string(),
-  promptTemplate: external_exports.string(),
-  model: external_exports.enum(["sonnet", "opus", "haiku"]).default("sonnet"),
-  lastRunAt: external_exports.coerce.date().optional(),
-  nextRunAt: external_exports.coerce.date().optional(),
-  enabled: external_exports.boolean().default(true),
-  retryCount: external_exports.number().int().nonnegative().default(0)
-});
-var RoutineRunSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  routineId: external_exports.string().uuid(),
-  startedAt: external_exports.coerce.date(),
-  completedAt: external_exports.coerce.date().optional(),
-  status: external_exports.enum(["success", "failed", "retried"]),
-  outputBriefId: external_exports.string().uuid().optional(),
-  errorMessage: external_exports.string().optional(),
-  inferenceCostCents: external_exports.number().int().nonnegative().default(0)
-});
-var BriefSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  generatedAt: external_exports.coerce.date(),
-  type: external_exports.enum(["daily", "weekly", "on_demand"]),
-  html: external_exports.string().optional(),
-  markdown: external_exports.string(),
-  sourceLinks: external_exports.array(external_exports.object({ label: external_exports.string(), url: external_exports.string() })).default([]),
-  shared: external_exports.boolean().default(false),
-  shareToken: external_exports.string().optional(),
-  shareExpiresAt: external_exports.coerce.date().optional(),
-  inferenceCostCents: external_exports.number().int().nonnegative().default(0)
-});
-var MemoryEntrySchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  productId: external_exports.string().uuid(),
-  kind: external_exports.enum(["decision", "fact", "customer", "status", "pattern", "thread"]),
-  content: external_exports.string(),
-  // embedding stored separately in pgvector; not modelled in API layer
-  createdAt: external_exports.coerce.date(),
-  lastReferencedAt: external_exports.coerce.date().optional(),
-  referenceCount: external_exports.number().int().nonnegative().default(0),
-  pinned: external_exports.boolean().default(false)
-});
-var InboxClassificationSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  emailAccountId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid().nullable(),
-  messageId: external_exports.string(),
-  sender: external_exports.string(),
-  labelApplied: external_exports.string(),
-  urgency: external_exports.enum(["needs_reply", "fyi", "noise", "escalation"]),
-  confidence: external_exports.number().min(0).max(1),
-  action: external_exports.enum(["labelled", "archived", "drafted_reply"]),
-  userCorrected: external_exports.boolean().default(false),
-  correctedTo: external_exports.string().optional()
-});
-var DraftReplySchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  classificationId: external_exports.string().uuid(),
-  draftText: external_exports.string(),
-  confidence: external_exports.number().min(0).max(1),
-  sentAt: external_exports.coerce.date().optional(),
-  sentVia: external_exports.string().optional()
-});
-var AlwaysAlertRuleSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  ruleType: external_exports.enum(["sender", "subject", "domain"]),
-  value: external_exports.string(),
-  escalationMethod: external_exports.enum(["push", "slack", "email", "brief_pin"]).default("brief_pin")
-});
-var AuditEventSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  actor: external_exports.enum(["user", "agent", "system"]),
-  action: external_exports.string(),
-  integrationId: external_exports.string().uuid().optional(),
-  productId: external_exports.string().uuid().optional(),
-  timestamp: external_exports.coerce.date(),
-  metadata: external_exports.record(external_exports.unknown()).default({})
-});
-var SubscriptionSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  studioId: external_exports.string().uuid(),
-  stripeSubscriptionId: external_exports.string().optional(),
-  tier: external_exports.enum(["trial", "solo", "studio", "studio_plus", "self_hosted", "enterprise"]),
-  seats: external_exports.number().int().positive(),
-  status: external_exports.string(),
-  currentPeriodEnd: external_exports.coerce.date(),
-  cancelAt: external_exports.coerce.date().optional()
-});
-var ProductMembershipSchema = external_exports.object({
-  humanId: external_exports.string().uuid(),
-  productId: external_exports.string().uuid(),
-  role: external_exports.enum(["lead", "contributor", "observer"])
-});
-
-// ../witan/src/batch.ts
-import { execFileSync as execFileSync3 } from "child_process";
-import { mkdirSync as mkdirSync2, writeFileSync } from "fs";
-import { basename as basename2, join as join5 } from "path";
-
-// ../witan/src/public-scan.ts
-import { resolve as resolve2 } from "path";
-
-// ../witan/src/ingest.ts
-import { readFileSync as readFileSync5, readdirSync as readdirSync2 } from "fs";
-import { join as join2 } from "path";
+      name: external_exports.string().min(1).max(300),
+      digest: external_exports.object({
+        sha256: external_exports.string().regex(/^[a-f0-9]{64}$/)
+      }).strict()
+    }).strict()
+  ).length(1),
+  predicateType: external_exports.literal(WITAN_ATTESTATION_PREDICATE_TYPE),
+  predicate: external_exports.object({
+    tool: external_exports.object({
+      name: external_exports.literal("cejel"),
+      version: external_exports.string().min(1).max(80)
+    }).strict(),
+    generatedAt: external_exports.string().datetime({ offset: true }),
+    rubricVersion: external_exports.string().min(1).max(120),
+    repository: external_exports.object({
+      productSlug: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/),
+      url: external_exports.string().url().optional(),
+      headSha: external_exports.string().min(7).max(64).optional()
+    }).strict(),
+    report: external_exports.object({
+      artifact: external_exports.literal("report.json"),
+      sha256: external_exports.string().regex(/^[a-f0-9]{64}$/)
+    }).strict(),
+    outcome: WitanAttestationOutcomeSchema,
+    assurance: external_exports.object({
+      status: external_exports.literal("unsigned"),
+      issuer: external_exports.literal("self-generated"),
+      signingHint: external_exports.string().min(1).max(500)
+    }).strict(),
+    limitations: external_exports.array(external_exports.string().min(1).max(500)).min(1).max(8)
+  }).strict()
+}).strict();
 
-// ../witan/src/finding-limits.ts
-var RULE_ID_MAX = 200;
-var MESSAGE_MAX = 500;
-var LOCATION_MAX = 700;
-function clamp(value, max) {
-  if (value.length <= max) return value;
-  const ellipsis = "...";
-  return `${value.slice(0, Math.max(max - ellipsis.length, 0))}${ellipsis}`;
-}
-function clampFinding(finding) {
-  return {
-    ...finding,
-    ruleId: clamp(finding.ruleId, RULE_ID_MAX),
-    message: clamp(finding.message, MESSAGE_MAX),
-    ...finding.location ? { location: clamp(finding.location, LOCATION_MAX) } : {}
-  };
+// src/witan/external-findings.ts
+var EXTERNAL_FINDINGS_DISPLAY_LIMIT = 10;
+var SEVERITY_RANK = {
+  critical: 0,
+  warning: 1,
+  info: 2
+};
+function formatExternalSourceLabel(source) {
+  return source.startsWith("sarif:") ? source.slice("sarif:".length) : source;
 }
-
-// ../witan/src/generic-adapter.ts
-import { readFileSync as readFileSync2 } from "fs";
-
-// ../witan/src/json-safe.ts
-function stripBom(text) {
-  return text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+function summarizeExternalSources(consumedSignals) {
+  const bySource = /* @__PURE__ */ new Map();
+  for (const signal of consumedSignals) {
+    const entry = bySource.get(signal.source) ?? { findingCount: 0, dimensions: /* @__PURE__ */ new Set() };
+    entry.findingCount += signal.findingCount;
+    entry.dimensions.add(signal.dimension);
+    bySource.set(signal.source, entry);
+  }
+  return Array.from(bySource.entries()).map(([source, { findingCount, dimensions }]) => ({
+    source,
+    label: formatExternalSourceLabel(source),
+    findingCount,
+    dimensions: Array.from(dimensions).sort()
+  })).sort((a, b) => a.source.localeCompare(b.source));
 }
-
-// ../witan/src/generic-adapter.ts
-var VALID_DIMENSIONS = /* @__PURE__ */ new Set([
-  "A1",
-  "A2",
-  "A3",
-  "A4",
-  "A5",
-  "B1",
-  "B2",
-  "B3",
-  "B4",
-  "B5",
-  "B6"
-]);
-var VALID_SEVERITIES = /* @__PURE__ */ new Set(["critical", "warning", "info"]);
-function isGenericSignalDocument(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
-  const doc = raw;
-  return typeof doc.tool === "string" && doc.tool.length > 0 && Array.isArray(doc.signals);
+function formatExternalSourceLine(summary) {
+  const noun = summary.findingCount === 1 ? "finding" : "findings";
+  return `${summary.label}: ${summary.findingCount} ${noun} ingested (folded into ${summary.dimensions.join(", ")})`;
 }
-function parseGenericJson(raw) {
-  if (!isGenericSignalDocument(raw)) return [];
-  const source = raw.tool ?? "unknown";
-  const signals = [];
-  for (const signal of raw.signals ?? []) {
-    const dimension = signal.dimension;
-    if (!dimension || !VALID_DIMENSIONS.has(dimension)) continue;
-    const weight = typeof signal.weight === "number" && Number.isFinite(signal.weight) ? Math.min(Math.max(signal.weight, 0), 1) : 0.5;
-    const findings = [];
-    for (const finding of signal.findings ?? []) {
-      const severity = finding.severity;
-      if (!severity || !VALID_SEVERITIES.has(severity)) continue;
-      const ruleId = finding.ruleId ?? "unknown";
+function collectExternalFindings(consumedSignals) {
+  const findings = [];
+  for (const signal of consumedSignals) {
+    for (const finding of signal.findings) {
       findings.push({
-        ruleId,
-        severity,
-        message: finding.message ?? ruleId,
+        source: signal.source,
+        label: formatExternalSourceLabel(signal.source),
+        dimension: signal.dimension,
+        severity: finding.severity,
+        ruleId: finding.ruleId,
+        message: finding.message,
         ...finding.location ? { location: finding.location } : {}
       });
     }
-    if (findings.length === 0) continue;
-    signals.push({ source, dimension, weight, findings });
   }
-  return signals;
+  return findings.sort((a, b) => {
+    const bySeverity = SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity];
+    if (bySeverity !== 0) return bySeverity;
+    const bySource = a.source.localeCompare(b.source);
+    if (bySource !== 0) return bySource;
+    return a.ruleId.localeCompare(b.ruleId);
+  });
+}
+
+// src/witan/html.ts
+function renderWitanHtmlReport(report) {
+  const codeCriteria = criteriaByCategory(report, "code_trust");
+  const processCriteria = criteriaByCategory(report, "process_trust");
+  const verifiedEvidence = report.criteria.flatMap(
+    (criterion) => criterion.status === "verified" ? criterion.evidence.map((evidence) => renderEvidenceListItem(criterion, evidence)) : []
+  );
+  const openItems = report.criteria.flatMap(renderOpenItems);
+  const contributingSources = renderContributingSources(report.consumedSignals ?? []);
+  const externalSourceSummaries = summarizeExternalSources(report.consumedSignals ?? []);
+  const externalFindings = collectExternalFindings(report.consumedSignals ?? []);
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Cejel Trust Certificate - ${escapeHtml(report.productDisplayName)}</title>
+  <style>${CERTIFICATE_CSS}</style>
+</head>
+<body>
+  <main class="certificate">
+    <header class="hero">
+      <div class="brand">
+        <span class="brand-mark" aria-hidden="true">C</span>
+        <span class="brand-name">Cejel</span>
+      </div>
+      <div class="hero-grid">
+        <section>
+          <p class="eyebrow">Trust Certificate</p>
+          <h1>${escapeHtml(report.productDisplayName)}</h1>
+          <dl class="meta">
+            <div><dt>Date</dt><dd>${escapeHtml(formatDate(report.generatedAt))}</dd></div>
+            <div><dt>Run</dt><dd>${escapeHtml(renderRepo(report))}</dd></div>
+            <div><dt>Rubric</dt><dd>${escapeHtml(report.rubricVersion)}</dd></div>
+            ${contributingSources.length > 0 ? `<div><dt>Sources</dt><dd>Incorporates findings from: ${escapeHtml(contributingSources.join(", "))}<ul class="source-counts">${externalSourceSummaries.map((s) => `<li>${escapeHtml(formatExternalSourceLine(s))}</li>`).join("")}</ul></dd></div>` : ""}
+          </dl>
+        </section>
+        <aside class="score-panel" aria-label="Summary trust score">
+          <div class="score-badge">Summary</div>
+          ${report.verdict === "insufficient_source" ? `<div class="verdict">Insufficient source</div>
+          <p class="insufficient-note">${escapeHtml(report.insufficientSourceReason)}</p>` : `<div class="score">${formatScore(report.overallScore)}</div>
+          <div class="score-unit">/ 4.0 overall</div>
+          <div class="verdict">${escapeHtml(renderVerdict(report.overallScore))}</div>
+          <div class="subscores">
+            <span>Code ${formatScore(report.codeTrustScore)}</span>
+            <span>Process ${formatScore(report.processTrustScore)}</span>
+          </div>`}
+        </aside>
+      </div>
+    </header>
+
+    <section class="trust-grid" aria-label="Rubric criteria">
+      ${renderCriterionColumn("Code trust", codeCriteria)}
+      ${renderCriterionColumn("Process trust", processCriteria)}
+    </section>
+
+    <section class="evidence-grid" aria-label="Evidence and gaps">
+      <article class="evidence-section">
+        <h2>Verified evidence</h2>
+        <ul>${verifiedEvidence.length > 0 ? verifiedEvidence.join("") : "<li>No verified evidence supplied.</li>"}</ul>
+      </article>
+      <article class="evidence-section">
+        <h2>Open / unverified</h2>
+        <ul>${openItems.length > 0 ? openItems.join("") : "<li>No open or unverified criteria supplied.</li>"}</ul>
+      </article>
+    </section>
+
+    ${externalFindings.length > 0 ? `<section class="external-findings-section" aria-label="External findings">
+      <article class="evidence-section">
+        <h2>External findings</h2>
+        <p class="external-note">Findings surfaced by ingested external scanners, attributed to the tool and the cejel criterion they were folded into \u2014 distinct from cejel's own findings above.</p>
+        <ul>${renderExternalFindingItems(externalFindings).join("")}</ul>
+      </article>
+    </section>` : ""}
+  </main>
+</body>
+</html>
+`;
+}
+function renderContributingSources(signals) {
+  return Array.from(new Set(signals.map((s) => s.source))).sort();
+}
+function renderExternalFindingItems(findings) {
+  const shown = findings.slice(0, EXTERNAL_FINDINGS_DISPLAY_LIMIT);
+  const items = shown.map(
+    (f) => `<li><strong>${escapeHtml(f.label)} \u2192 ${escapeHtml(f.dimension)}</strong><span>${escapeHtml(f.severity)}: ${escapeHtml(f.ruleId)} \u2014 ${escapeHtml(f.message)}${f.location ? ` (${escapeHtml(f.location)})` : ""}</span></li>`
+  );
+  const remaining = findings.length - shown.length;
+  if (remaining > 0) {
+    items.push(`<li><em>...and ${remaining} more \u2014 see report.json for the full list.</em></li>`);
+  }
+  return items;
+}
+function criteriaByCategory(report, category) {
+  return report.criteria.filter((criterion) => criterion.category === category);
+}
+function renderCriterionColumn(title, criteria) {
+  const applicable = criteria.filter((criterion) => criterion.status !== "not_applicable");
+  const notApplicable = criteria.filter((criterion) => criterion.status === "not_applicable");
+  return `<section class="criteria-column">
+        <h2>${escapeHtml(title)}</h2>
+        <div class="criteria-list">
+          ${applicable.map(renderCriterionCard).join("")}
+        </div>
+        ${notApplicable.length > 0 ? renderNotApplicableGroup(notApplicable) : ""}
+      </section>`;
+}
+function renderNotApplicableGroup(criteria) {
+  return `<div class="na-group">
+          <h3 class="na-heading">Not applicable to this repository</h3>
+          <ul class="na-list">
+            ${criteria.map(renderNotApplicableItem).join("")}
+          </ul>
+        </div>`;
+}
+function renderNotApplicableItem(criterion) {
+  const reason = criterion.notes ?? "Not applicable to this repository.";
+  return `<li><span class="na-id">${escapeHtml(criterion.id)}</span> ${escapeHtml(criterion.title)} \u2014 <span class="na-reason">${escapeHtml(reason)}</span></li>`;
+}
+function renderCriterionCard(criterion) {
+  const evidence = [
+    ...criterion.evidence.map(renderEvidencePointer),
+    ...criterion.findings.map((finding) => renderFindingEvidence(finding))
+  ];
+  const metrics = criterion.metrics.map(renderMetric);
+  return `<article class="criterion">
+            <div class="criterion-top">
+              <div>
+                <div class="criterion-id">${escapeHtml(criterion.id)}</div>
+                <h3>${escapeHtml(criterion.title)}</h3>
+              </div>
+              ${renderStatusChip(criterion.status)}
+            </div>
+            <div class="criterion-score">${criterion.status === "not_applicable" ? "N/A" : criterion.status === "insufficient_data" ? "No data" : formatScore(criterion.score)}</div>
+            <ul class="criterion-metrics">
+              ${metrics.length > 0 ? metrics.map((item) => `<li>${item}</li>`).join("") : "<li>No measured depth metrics supplied.</li>"}
+            </ul>
+            <ul class="criterion-evidence">
+              ${evidence.length > 0 ? evidence.map((item) => `<li>${item}</li>`).join("") : "<li>No concrete evidence supplied.</li>"}
+            </ul>
+          </article>`;
+}
+function renderMetric(metric2) {
+  const max = metric2.max ? `/${formatMetricValue(metric2.max)}` : "";
+  const unit = metric2.unit ? ` ${escapeHtml(metric2.unit)}` : "";
+  return `<strong>${escapeHtml(metric2.label)}</strong><span>${formatMetricValue(metric2.value)}${max}${unit}</span>`;
+}
+function renderStatusChip(status) {
+  return `<span class="status" data-status="${status}">${status}</span>`;
+}
+function renderEvidenceListItem(criterion, evidence) {
+  return `<li><strong>${escapeHtml(criterion.id)} - ${escapeHtml(criterion.title)}</strong><span>${renderEvidencePointer(evidence)}</span></li>`;
+}
+function renderOpenItems(criterion) {
+  const findingItems = criterion.findings.map(
+    (finding) => `<li><strong>${escapeHtml(criterion.id)} - ${escapeHtml(criterion.title)}</strong><span>${escapeHtml(finding.severity)}: ${escapeHtml(finding.summary)} (${renderEvidencePointer(finding.evidence)})</span></li>`
+  );
+  if ((criterion.status === "unverified" || criterion.status === "insufficient_data") && criterion.evidence.length === 0 && criterion.findings.length === 0) {
+    const message = criterion.status === "insufficient_data" ? "Insufficient data \u2014 no measurable signal; excluded from composite (unmeasured, not inapplicable)." : "No concrete evidence supplied.";
+    return [
+      `<li><strong>${escapeHtml(criterion.id)} - ${escapeHtml(criterion.title)}</strong><span>${escapeHtml(message)}</span></li>`
+    ];
+  }
+  if (criterion.status === "verified") return [];
+  return findingItems;
 }
-
-// ../witan/src/sarif-adapter.ts
-import { readFileSync as readFileSync3 } from "fs";
-var DIMENSION_RULES = [
-  // A2 — injection / secrets / auth (high weight)
-  {
-    pattern: /sql[- _]?inject|cwe-89|sqli|command[- _]?inject|cwe-78|os[- _]?cmd|rce|remote[- _]?code/i,
-    dimension: "A2",
-    weight: 0.9
-  },
-  {
-    pattern: /secret|credential|api[- _]?key|password[- _]?leak|hardcoded[- _]?(token|key|secret)|cwe-259|cwe-798/i,
-    dimension: "A2",
-    weight: 0.9
-  },
-  {
-    pattern: /path[- _]?traversal|directory[- _]?traversal|cwe-22|lfi|rfi/i,
-    dimension: "A2",
-    weight: 0.8
-  },
-  {
-    pattern: /ssrf|server[- _]?side[- _]?request[- _]?forg|cwe-918/i,
-    dimension: "A2",
-    weight: 0.8
-  },
-  {
-    pattern: /xxe|xml[- _]?external[- _]?entity|cwe-611/i,
-    dimension: "A2",
-    weight: 0.8
-  },
-  {
-    pattern: /auth[- _]?bypass|broken[- _]?auth|missing[- _]?auth|cwe-287|cwe-306|cwe-863|cwe-862/i,
-    dimension: "A2",
-    weight: 0.7
-  },
-  {
-    pattern: /xss|cross[- _]?site[- _]?script|cwe-79/i,
-    dimension: "A2",
-    weight: 0.6
-  },
-  // A4 — dependency vulnerabilities
-  {
-    pattern: /cve-\d{4}-\d+|supply[- _]?chain|depend[a-z]*[- _]?vulner|outdated[- _]?depend|deprecated[- _]?package/i,
-    dimension: "A4",
-    weight: 0.8
-  },
-  {
-    pattern: /npm[- _]?audit|yarn[- _]?audit|pnpm[- _]?audit|pip[- _]?audit|cargo[- _]?audit/i,
-    dimension: "A4",
-    weight: 0.7
-  },
-  // A3 — production readiness / insecure config
-  {
-    pattern: /insecure[- _]?tls|weak[- _]?cipher|tls[- _]?version|http[- _]?strict|hsts|csp[- _]?missing|cwe-326|cwe-327/i,
-    dimension: "A3",
-    weight: 0.5
-  },
-  {
-    pattern: /error[- _]?handl|unhandled[- _]?exception|crash|uncaught|stacktrace[- _]?leak/i,
-    dimension: "A3",
-    weight: 0.4
-  },
-  {
-    pattern: /debug[- _]?mode|dev[- _]?endpoint|staging[- _]?secret/i,
-    dimension: "A3",
-    weight: 0.4
-  },
-  // A1 — test integrity (low weight; SARIF rarely surfaces this)
-  {
-    pattern: /skipped[- _]?test|hollow[- _]?test|empty[- _]?assert|no[- _]?assertion/i,
-    dimension: "A1",
-    weight: 0.2
-  }
-];
-var DEFAULT_DIMENSION = "A2";
-var DEFAULT_WEIGHT = 0.3;
-var DROP_LEVEL = /* @__PURE__ */ new Set(["none"]);
-function mapLevel(level) {
-  if (!level || DROP_LEVEL.has(level)) return null;
-  if (level === "error") return "critical";
-  if (level === "warning") return "warning";
-  return "info";
+function renderFindingEvidence(finding) {
+  return `${escapeHtml(finding.severity)}: ${escapeHtml(finding.summary)} (${renderEvidencePointer(
+    finding.evidence
+  )})`;
 }
-function mapRuleToDimension(ruleId, rules) {
-  for (const rule of rules) {
-    if (rule.pattern.test(ruleId)) {
-      return { dimension: rule.dimension, weight: rule.weight };
-    }
+function renderEvidencePointer(evidence) {
+  const target = evidence.url ?? renderPathEvidenceTarget(evidence);
+  const label = escapeHtml(evidence.label);
+  if (evidence.url) {
+    return `<a href="${escapeAttribute(evidence.url)}">${label}</a>`;
   }
-  return { dimension: DEFAULT_DIMENSION, weight: DEFAULT_WEIGHT };
+  return [label, target ? `<code>${escapeHtml(target)}</code>` : void 0].filter(Boolean).join(" ");
 }
-function renderLocation(result) {
-  const loc = result.locations?.[0]?.physicalLocation;
-  if (!loc) return void 0;
-  const uri = loc.artifactLocation?.uri;
-  const line = loc.region?.startLine;
-  if (!uri) return void 0;
-  return line != null ? `${uri}:${line}` : uri;
+function renderPathEvidenceTarget(evidence) {
+  const pathTarget = evidence.path ? `${evidence.path}${evidence.line ? `:${evidence.line}` : ""}` : void 0;
+  const hashTarget = evidence.contentHash ? `sha256:${evidence.contentHash.slice(0, 12)}` : void 0;
+  return [pathTarget, hashTarget].filter(Boolean).join(" \xB7 ");
 }
-function dedupeFindings(findings) {
-  const seen = /* @__PURE__ */ new Set();
-  return findings.filter((f) => {
-    const key = `${f.ruleId}|${f.severity}|${f.location ?? ""}`;
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  });
+function renderRepo(report) {
+  const repo = report.repo.path ?? report.repo.url ?? "unknown";
+  return report.repo.headSha ? `${repo} @ ${report.repo.headSha}` : repo;
 }
-function parseSarifJson(raw, extraDimensionRules) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
-  const dimensionRules = extraDimensionRules ? [...DIMENSION_RULES, ...extraDimensionRules] : DIMENSION_RULES;
-  const doc = raw;
-  if (!Array.isArray(doc.runs)) return [];
-  const buckets = /* @__PURE__ */ new Map();
-  for (const run of doc.runs) {
-    const driverName = run.tool?.driver?.name ?? "unknown";
-    const source = `sarif:${driverName}`;
-    const ruleDefaultLevels = /* @__PURE__ */ new Map();
-    for (const rule of run.tool?.driver?.rules ?? []) {
-      if (rule.id && rule.defaultConfiguration?.level) {
-        ruleDefaultLevels.set(rule.id, rule.defaultConfiguration.level);
-      }
-    }
-    for (const result of run.results ?? []) {
-      const ruleId = result.ruleId ?? "unknown";
-      const effectiveLevel = result.level ?? ruleDefaultLevels.get(ruleId) ?? "warning";
-      const severity = mapLevel(effectiveLevel);
-      if (!severity) continue;
-      const message = result.message?.text ?? ruleId;
-      const location = renderLocation(result);
-      const { dimension, weight } = mapRuleToDimension(ruleId, dimensionRules);
-      const bucketKey = `${source}|${dimension}`;
-      if (!buckets.has(bucketKey)) {
-        buckets.set(bucketKey, { source, dimension, weight, findings: [] });
-      }
-      buckets.get(bucketKey)?.findings.push({ ruleId, severity, message, ...location ? { location } : {} });
-    }
+function renderVerdict(score) {
+  return renderMachineVerdict(witanVerdictForScore(score));
+}
+function renderReportVerdict(report) {
+  return renderMachineVerdict(report.verdict);
+}
+function renderMachineVerdict(verdict) {
+  switch (verdict) {
+    case "verified":
+      return "Verified";
+    case "conditional":
+      return "Conditional";
+    case "at_risk":
+      return "At risk";
+    case "unverified":
+      return "Unverified";
+    case "insufficient_source":
+      return "Insufficient source";
   }
-  return Array.from(buckets.values()).map(({ source, dimension, weight, findings }) => ({
-    source,
-    dimension,
-    weight,
-    findings: dedupeFindings(findings)
-  }));
 }
-
-// ../witan/src/scorecard-adapter.ts
-import { readFileSync as readFileSync4 } from "fs";
-var CHECK_RULES = {
-  // B2 — PR outcome traceability
-  "Branch-Protection": { dimension: "B2", weight: 0.8 },
-  "Code-Review": { dimension: "B2", weight: 0.7 },
-  // B3 — CI and QA discipline
-  "Dangerous-Workflow": { dimension: "B3", weight: 0.9 },
-  "Token-Permissions": { dimension: "B3", weight: 0.8 },
-  "CI-Tests": { dimension: "B3", weight: 0.7 },
-  Maintained: { dimension: "B3", weight: 0.3 },
-  // B4 — audit trail / release integrity
-  "Signed-Releases": { dimension: "B4", weight: 0.7 },
-  Packaging: { dimension: "B4", weight: 0.4 },
-  "Security-Policy": { dimension: "B4", weight: 0.4 },
-  // A4 — dependency hygiene
-  Vulnerabilities: { dimension: "A4", weight: 0.9 },
-  "Pinned-Dependencies": { dimension: "A4", weight: 0.8 },
-  "Dependency-Update-Tool": { dimension: "A4", weight: 0.6 },
-  // A2 — data-layer / static analysis
-  SAST: { dimension: "A2", weight: 0.7 },
-  "Binary-Artifacts": { dimension: "A2", weight: 0.6 },
-  // A1 — test integrity
-  Fuzzing: { dimension: "A1", weight: 0.3 }
-};
-function mapScoreToSeverity(score) {
-  if (score == null || Number.isNaN(score)) return null;
-  if (score < 0) return null;
-  if (score >= 10) return null;
-  if (score <= 3) return "critical";
-  if (score <= 6) return "warning";
-  return "info";
+function formatScore(score) {
+  return score.toFixed(1);
+}
+function formatMetricValue(value) {
+  return Number.isInteger(value) ? value.toString() : value.toFixed(2);
+}
+function formatDate(value) {
+  return value.slice(0, 10);
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+function escapeAttribute(value) {
+  return escapeHtml(value);
+}
+var CERTIFICATE_CSS = `
+:root {
+  color-scheme: dark;
+  --steel: #16212a;
+  --surface: #1d2b35;
+  --surface-2: #273946;
+  --line: rgba(238, 244, 247, .13);
+  --line-strong: rgba(238, 244, 247, .22);
+  --text: #eef4f7;
+  --muted: #b7c5cc;
+  --faint: #8799a4;
+  --teal: #2fc8a6;
+  --teal-weak: rgba(47, 200, 166, .14);
+  --periwinkle: #93a6da;
+  --periwinkle-weak: rgba(147, 166, 218, .16);
+  --warn: #e7bf72;
+  --warn-weak: rgba(231, 191, 114, .16);
+  --danger: #f09a8f;
+  --danger-weak: rgba(240, 154, 143, .14);
+  --quiet: rgba(238, 244, 247, .08);
+  --serif: "Instrument Serif", Georgia, "Times New Roman", serif;
+  --sans: Inter, ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+  --mono: "JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+}
+* { box-sizing: border-box; }
+body {
+  margin: 0;
+  background: var(--steel);
+  color: var(--text);
+  font-family: var(--sans);
+  line-height: 1.55;
+  -webkit-font-smoothing: antialiased;
+}
+.certificate { max-width: 1120px; margin: 0 auto; padding: 44px 32px 64px; }
+.hero { border-bottom: 1px solid var(--line); padding-bottom: 38px; }
+.brand { display: flex; align-items: center; gap: 12px; margin-bottom: 44px; }
+.brand-mark {
+  display: inline-flex; align-items: center; justify-content: center;
+  width: 34px; height: 34px; border-radius: 8px;
+  background: var(--teal); color: #06231d; font-family: var(--serif); font-size: 24px;
+}
+.brand-name { font-family: var(--serif); font-size: 24px; }
+.hero-grid { display: grid; grid-template-columns: minmax(0, 1fr) 300px; gap: 36px; align-items: end; }
+.eyebrow {
+  margin: 0 0 14px; color: var(--teal); font-family: var(--mono);
+  font-size: 11px; letter-spacing: .18em; text-transform: uppercase;
 }
-function dedupeFindings2(findings) {
-  const seen = /* @__PURE__ */ new Set();
-  return findings.filter((f) => {
-    const key = `${f.ruleId}|${f.severity}|${f.location ?? ""}`;
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  });
+h1, h2, h3, p { margin-top: 0; }
+h1 { margin-bottom: 24px; font-family: var(--serif); font-size: 64px; line-height: 1; font-weight: 400; letter-spacing: 0; }
+.meta { display: grid; gap: 10px; margin: 0; max-width: 780px; }
+.meta div { display: grid; grid-template-columns: 86px minmax(0, 1fr); gap: 16px; }
+dt { color: var(--faint); font-family: var(--mono); font-size: 11px; text-transform: uppercase; letter-spacing: .12em; }
+dd { margin: 0; color: var(--muted); overflow-wrap: anywhere; }
+.score-panel { border: 1px solid var(--line-strong); border-radius: 8px; padding: 24px; background: var(--surface); }
+.score-badge {
+  display: inline-flex; margin-bottom: 14px; border: 1px solid rgba(147, 166, 218, .38);
+  border-radius: 999px; padding: 5px 10px; color: var(--periwinkle);
+  background: var(--periwinkle-weak); font-family: var(--mono); font-size: 12px;
 }
-function parseScorecardJson(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
-  const doc = raw;
-  if (!Array.isArray(doc.checks)) return [];
-  const buckets = /* @__PURE__ */ new Map();
-  for (const check of doc.checks) {
-    const name = check.name;
-    if (!name) continue;
-    const rule = CHECK_RULES[name];
-    if (!rule) continue;
-    const severity = mapScoreToSeverity(check.score);
-    if (!severity) continue;
-    const scoreText = typeof check.score === "number" ? `${check.score}/10` : "n/a";
-    const message = `${name} (Scorecard ${scoreText}): ${check.reason ?? "weakness detected"}`.slice(0, 500);
-    const location = check.documentation?.url;
-    const bucket = buckets.get(rule.dimension) ?? { weight: 0, findings: [] };
-    bucket.weight = Math.max(bucket.weight, rule.weight);
-    bucket.findings.push({
-      ruleId: `scorecard:${name}`,
-      severity,
-      message,
-      ...location ? { location } : {}
-    });
-    buckets.set(rule.dimension, bucket);
-  }
-  return Array.from(buckets.entries()).map(([dimension, { weight, findings }]) => ({
-    source: "scorecard",
-    dimension,
-    weight,
-    findings: dedupeFindings2(findings)
-  }));
+.score { display: inline; font-family: var(--mono); font-size: 56px; line-height: 1; color: var(--teal); }
+.score-unit { display: inline; margin-left: 6px; color: var(--faint); font-family: var(--mono); }
+.verdict { margin-top: 12px; font-family: var(--serif); font-size: 30px; color: var(--periwinkle); }
+.insufficient-note { margin-top: 10px; color: var(--muted); font-size: 13px; line-height: 1.5; }
+.subscores { display: flex; gap: 12px; flex-wrap: wrap; margin-top: 18px; color: var(--muted); font-family: var(--mono); font-size: 12px; }
+.source-counts { margin: 8px 0 0; padding-left: 18px; font-family: var(--mono); font-size: 12px; color: var(--muted); }
+.trust-grid, .evidence-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 18px; margin-top: 28px; }
+.external-findings-section { margin-top: 18px; }
+.external-note { margin: 0 0 14px; color: var(--muted); font-size: 13px; }
+.criteria-column, .evidence-section { border: 1px solid var(--line); border-radius: 8px; background: var(--surface); padding: 22px; }
+h2 { font-family: var(--serif); font-size: 30px; font-weight: 400; letter-spacing: 0; margin-bottom: 18px; }
+.criteria-list { display: grid; gap: 12px; }
+.na-group { margin-top: 16px; padding-top: 14px; border-top: 1px dashed var(--line-strong); }
+.na-heading { font-family: var(--sans); font-size: 12px; font-weight: 650; letter-spacing: .04em; text-transform: uppercase; color: var(--faint); margin: 0 0 10px; }
+.na-list { display: grid; gap: 8px; font-size: 13px; }
+.na-list li { margin: 0; color: var(--muted); }
+.na-id { color: var(--faint); font-family: var(--mono); font-size: 11px; margin-right: 6px; }
+.na-reason { color: var(--muted); }
+.criterion { border: 1px solid var(--line); border-radius: 8px; padding: 16px; background: var(--surface-2); }
+.criterion-top { display: flex; justify-content: space-between; align-items: flex-start; gap: 14px; }
+.criterion-id { color: var(--periwinkle); font-family: var(--mono); font-size: 12px; margin-bottom: 4px; }
+h3 { font-size: 15px; line-height: 1.35; font-weight: 600; margin-bottom: 0; }
+.criterion-score { margin-top: 12px; color: var(--text); font-family: var(--mono); font-size: 24px; }
+.criterion-metrics { display: grid; gap: 7px; margin-top: 10px; padding: 0; list-style: none; font-size: 12px; }
+.criterion-metrics li { display: flex; justify-content: space-between; gap: 12px; border-bottom: 1px solid rgba(238, 244, 247, .08); padding-bottom: 6px; }
+.criterion-metrics strong { color: var(--text); font-weight: 650; }
+.criterion-metrics span { white-space: nowrap; color: var(--muted); }
+.status { flex: none; border-radius: 999px; padding: 4px 9px; font-family: var(--mono); font-size: 11px; border: 1px solid var(--line-strong); }
+.status[data-status="verified"] { color: var(--teal); background: var(--teal-weak); border-color: rgba(47, 200, 166, .42); }
+.status[data-status="info"] { color: var(--periwinkle); background: var(--periwinkle-weak); border-color: rgba(147, 166, 218, .4); }
+.status[data-status="warning"] { color: var(--warn); background: var(--warn-weak); border-color: rgba(231, 191, 114, .44); }
+.status[data-status="critical"] { color: var(--danger); background: var(--danger-weak); border-color: rgba(240, 154, 143, .46); }
+.status[data-status="unverified"] { color: var(--muted); background: var(--quiet); }
+.status[data-status="insufficient_data"] { color: var(--muted); background: var(--quiet); border-style: dashed; }
+ul { margin: 0; padding-left: 18px; }
+li { margin: 8px 0; color: var(--muted); }
+.criterion-evidence { margin-top: 12px; font-size: 13px; }
+.evidence-section li strong { display: block; color: var(--text); font-size: 14px; }
+.evidence-section li span { display: block; margin-top: 2px; font-size: 13px; }
+code { color: var(--periwinkle); font-family: var(--mono); font-size: .92em; overflow-wrap: anywhere; }
+a { color: var(--teal); text-decoration: none; }
+a:hover { text-decoration: underline; text-underline-offset: 2px; }
+@media (max-width: 840px) {
+  .certificate { padding: 28px 18px 48px; }
+  .hero-grid, .trust-grid, .evidence-grid { grid-template-columns: 1fr; }
+  h1 { font-size: 46px; }
 }
+`;
 
-// ../witan/src/ingest.ts
-function looksLikeSarif(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
-  return Array.isArray(raw.runs);
+// src/witan/badge.ts
+var VERDICT_COLOR = {
+  Verified: "brightgreen",
+  Conditional: "yellow",
+  "At risk": "orange",
+  Unverified: "red",
+  "Insufficient source": "lightgrey"
+};
+var VERDICT_SVG_FILL = {
+  Verified: "#2fc86a",
+  Conditional: "#dfb92f",
+  "At risk": "#e08a3c",
+  Unverified: "#d64545",
+  "Insufficient source": "#8c8c8c"
+};
+function badgeMessage(report, verdict) {
+  if (report.verdict === "insufficient_source") return "unrated: no source";
+  return `${formatScore2(report.overallScore)}/4.0 ${verdict.toLowerCase()}`;
 }
-function looksLikeScorecard(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
-  return Array.isArray(raw.checks);
+function renderWitanBadgeEndpoint(report) {
+  const verdict = renderReportVerdict(report);
+  return {
+    schemaVersion: 1,
+    label: "cejel trust",
+    message: badgeMessage(report, verdict),
+    color: VERDICT_COLOR[verdict] ?? "lightgrey"
+  };
 }
-function countRawEntries(raw) {
-  const obj = raw;
-  if (Array.isArray(obj.runs)) {
-    return obj.runs.reduce((sum, run) => {
-      const results = run.results;
-      return sum + (Array.isArray(results) ? results.length : 0);
-    }, 0);
-  }
-  if (Array.isArray(obj.checks)) return obj.checks.length;
-  if (Array.isArray(obj.signals)) {
-    return obj.signals.reduce((sum, signal) => {
-      const findings = signal.findings;
-      return sum + (Array.isArray(findings) ? findings.length : 0);
-    }, 0);
-  }
-  return 0;
+function renderWitanBadgeSvg(report) {
+  const verdict = renderReportVerdict(report);
+  const label = "cejel trust";
+  const message = badgeMessage(report, verdict);
+  const fill = VERDICT_SVG_FILL[verdict] ?? "#8c8c8c";
+  const charWidth = 6.5;
+  const padding = 10;
+  const labelWidth = Math.round(label.length * charWidth + padding);
+  const messageWidth = Math.round(message.length * charWidth + padding);
+  const totalWidth = labelWidth + messageWidth;
+  const height = 20;
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="${totalWidth}" height="${height}" role="img" aria-label="${escapeXml(label)}: ${escapeXml(message)}">
+  <title>${escapeXml(label)}: ${escapeXml(message)}</title>
+  <linearGradient id="witan-badge-smooth" x2="0" y2="100%">
+    <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
+    <stop offset="1" stop-opacity=".1"/>
+  </linearGradient>
+  <clipPath id="witan-badge-round">
+    <rect width="${totalWidth}" height="${height}" rx="3" fill="#fff"/>
+  </clipPath>
+  <g clip-path="url(#witan-badge-round)">
+    <rect width="${labelWidth}" height="${height}" fill="#555"/>
+    <rect x="${labelWidth}" width="${messageWidth}" height="${height}" fill="${fill}"/>
+    <rect width="${totalWidth}" height="${height}" fill="url(#witan-badge-smooth)"/>
+  </g>
+  <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" font-size="11">
+    <text x="${labelWidth / 2}" y="14">${escapeXml(label)}</text>
+    <text x="${labelWidth + messageWidth / 2}" y="14">${escapeXml(message)}</text>
+  </g>
+</svg>
+`;
 }
-function rawToolName(raw) {
-  const obj = raw;
-  if (Array.isArray(obj.runs)) {
-    const firstRun = obj.runs[0];
-    return firstRun?.tool?.driver?.name ?? "unknown";
-  }
-  if (typeof obj.tool === "string" && obj.tool.length > 0) return obj.tool;
-  return "scorecard";
+function formatScore2(score) {
+  return score.toFixed(1);
 }
-function parseIngestFile(filePath) {
-  let raw;
-  try {
-    raw = JSON.parse(stripBom(readFileSync5(filePath, "utf8")));
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`Cejel: could not parse ingest file as JSON: ${filePath} (${message})`);
-  }
-  let signals;
-  if (looksLikeSarif(raw)) signals = parseSarifJson(raw);
-  else if (looksLikeScorecard(raw)) signals = parseScorecardJson(raw);
-  else if (isGenericSignalDocument(raw)) signals = parseGenericJson(raw);
-  if (!signals) {
-    throw new Error(
-      `Cejel: unrecognized ingest file format: ${filePath} \u2014 expected SARIF (a "runs" array), OpenSSF Scorecard JSON (a "checks" array), or the generic Cejel external-signal shape (a "tool" string + "signals" array). See the cejel README "Aggregate your scanners".`
-    );
-  }
-  const rawCount = countRawEntries(raw);
-  const mappedCount = signals.reduce((sum, signal) => sum + signal.findings.length, 0);
-  if (rawCount > 0 && mappedCount === 0) {
-    process.stderr.write(
-      `Cejel: ${rawCount} findings from ${rawToolName(raw)} (${filePath}), 0 mapped to trust criteria
-`
-    );
-  }
-  return signals.map((signal) => ({
-    ...signal,
-    findings: signal.findings.map(clampFinding)
-  }));
+function escapeXml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
-function expandIngestPattern(pattern) {
-  if (!pattern.includes("*")) return [pattern];
-  const lastSlash = pattern.lastIndexOf("/");
-  const dir = lastSlash === -1 ? "." : pattern.slice(0, lastSlash);
-  const filePattern = lastSlash === -1 ? pattern : pattern.slice(lastSlash + 1);
-  const regexSource = filePattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-  const regex = new RegExp(`^${regexSource}$`);
-  let entries;
-  try {
-    entries = readdirSync2(dir);
-  } catch {
-    return [];
-  }
-  return entries.filter((name) => regex.test(name)).sort().map((name) => join2(dir, name));
+
+// src/witan/attestation.ts
+import { createHash } from "crypto";
+var ATTESTATION_LIMITATIONS = [
+  "Cejel measures observable repository signals; it is not a security or compliance guarantee.",
+  "This statement is self-generated and unsigned until an external signer binds their identity to it."
+];
+function serializeWitanReport(report) {
+  return JSON.stringify(report, null, 2);
+}
+function hashWitanReport(report) {
+  return createHash("sha256").update(serializeWitanReport(report), "utf8").digest("hex");
+}
+function createWitanAttestation(report, options) {
+  const reportSha256 = hashWitanReport(report);
+  const outcome = report.verdict === "insufficient_source" ? {
+    status: "abstained",
+    reason: report.insufficientSourceReason
+  } : {
+    status: "scored",
+    overallScore: report.overallScore,
+    codeTrustScore: report.codeTrustScore,
+    processTrustScore: report.processTrustScore
+  };
+  return WitanAttestationStatementSchema.parse({
+    _type: WITAN_ATTESTATION_STATEMENT_TYPE,
+    subject: [
+      {
+        name: `${report.productSlug}/report.json`,
+        digest: { sha256: reportSha256 }
+      }
+    ],
+    predicateType: WITAN_ATTESTATION_PREDICATE_TYPE,
+    predicate: {
+      tool: { name: "cejel", version: options.toolVersion },
+      generatedAt: report.generatedAt,
+      rubricVersion: report.rubricVersion,
+      repository: {
+        productSlug: report.productSlug,
+        ...report.repo.url ? { url: report.repo.url } : {},
+        ...report.repo.headSha ? { headSha: report.repo.headSha } : {}
+      },
+      report: {
+        artifact: "report.json",
+        sha256: reportSha256
+      },
+      outcome,
+      assurance: {
+        status: "unsigned",
+        issuer: "self-generated",
+        signingHint: "Sign this in-toto statement with your existing provenance system; verify the report digest before relying on it."
+      },
+      limitations: [...ATTESTATION_LIMITATIONS]
+    }
+  });
 }
-function discoverIngestInputs(repoPath) {
-  const inputsDir = join2(repoPath, ".cejel", "inputs");
-  let entries;
-  try {
-    entries = readdirSync2(inputsDir);
-  } catch {
-    return [];
-  }
-  return entries.filter((name) => /\.(sarif|json)$/i.test(name)).sort().map((name) => join2(inputsDir, name));
+
+// src/witan/repo-signals.ts
+import { execFileSync } from "child_process";
+import { createHash as createHash2 } from "crypto";
+import { readFileSync, readdirSync, realpathSync, statSync } from "fs";
+import { basename, join, relative, resolve, sep } from "path";
+
+// src/witan/json-safe.ts
+function stripBom(text) {
+  return text.charCodeAt(0) === 65279 ? text.slice(1) : text;
 }
 
-// ../witan/src/repo-signals.ts
-import { execFileSync } from "child_process";
-import { createHash } from "crypto";
-import { readFileSync as readFileSync6, readdirSync as readdirSync3, realpathSync, statSync as statSync2 } from "fs";
-import { basename, join as join3, relative, resolve, sep } from "path";
+// src/witan/repo-signals.ts
 function buildWitanInputFromRepo(options) {
   assertRepoPathExists(options.repoPath);
   const generatedAt = options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
@@ -6702,7 +5042,7 @@ function isLikelyMonorepo(repoFiles) {
 function assertRepoPathExists(repoPath) {
   let stats;
   try {
-    stats = statSync2(repoPath);
+    stats = statSync(repoPath);
   } catch {
     throw new Error(`Cejel: path not found: ${repoPath}`);
   }
@@ -6770,7 +5110,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles) {
   const runnerFiles = repoFiles.filter(isTestRunnerConfig).slice(0, 6);
   const coverageFiles = repoFiles.filter(isCoverageConfig).slice(0, 4);
   const packageJson = findRootPackageJson(repoFiles);
-  const packageScripts = packageJson ? readPackageScripts(join3(repoPath, packageJson)) : /* @__PURE__ */ new Map();
+  const packageScripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
   const coveragePercent = readCoveragePercent(repoPath, coverageFiles);
   const ciWorkflows = repoFiles.filter(isCiWorkflow);
   const ciTestWorkflow = ciWorkflows.find(
@@ -7231,7 +5571,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles) {
   const evidence = [];
   const findings = [];
   const packageJson = findRootPackageJson(repoFiles);
-  const scripts = packageJson ? readPackageScripts(join3(repoPath, packageJson)) : /* @__PURE__ */ new Map();
+  const scripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
   const workflows = repoFiles.filter(isCiWorkflow);
   const workflow = workflows[0];
   const deployConfigs = repoFiles.filter(isDeployConfig);
@@ -7665,7 +6005,7 @@ function collectB2PrTraceEvidence(repoPath, repoFiles) {
 function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
   const evidence = [];
   const packageJson = findRootPackageJson(repoFiles);
-  const scripts = packageJson ? readPackageScripts(join3(repoPath, packageJson)) : /* @__PURE__ */ new Map();
+  const scripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
   const workflows = repoFiles.filter(isCiWorkflow);
   const workflow = workflows[0];
   const rootWorkflows = mono ? mono.sharedFiles.filter(isCiWorkflow) : [];
@@ -7986,16 +6326,16 @@ function lineHasInsecureSecretCompare(line) {
   return !NUMERIC_SHAPED_OPERAND_PATTERN.test(operand.trim());
 }
 function findInsecureSecretCompareLine(repoPath, file) {
-  const fullPath = join3(repoPath, file);
+  const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return null;
-  const lines = readFileSync6(fullPath, "utf8").split("\n");
+  const lines = readFileSync(fullPath, "utf8").split("\n");
   const index = lines.findIndex((line) => lineHasInsecureSecretCompare(line));
   return index === -1 ? null : index + 1;
 }
 function findFirstMatchingLine(repoPath, file, pattern) {
-  const fullPath = join3(repoPath, file);
+  const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return null;
-  const lines = readFileSync6(fullPath, "utf8").split("\n");
+  const lines = readFileSync(fullPath, "utf8").split("\n");
   const index = lines.findIndex((line) => pattern.test(line));
   return index === -1 ? null : index + 1;
 }
@@ -8110,13 +6450,13 @@ function listGitTrackedFiles(repoPath) {
 function visitRepoDir(repoPath, dirPath, files) {
   let entries;
   try {
-    entries = readdirSync3(dirPath, { withFileTypes: true });
+    entries = readdirSync(dirPath, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
     if (shouldSkipDir(entry.name)) continue;
-    const fullPath = join3(dirPath, entry.name);
+    const fullPath = join(dirPath, entry.name);
     if (entry.isDirectory()) {
       visitRepoDir(repoPath, fullPath, files);
       continue;
@@ -8124,7 +6464,7 @@ function visitRepoDir(repoPath, dirPath, files) {
     if (!entry.isFile()) continue;
     let size;
     try {
-      size = statSync2(fullPath).size;
+      size = statSync(fullPath).size;
     } catch {
       continue;
     }
@@ -8155,9 +6495,9 @@ function isHardExcludedPath(path) {
 function collectContentBasedCppTestFiles(repoPath, repoFiles) {
   const candidates = repoFiles.filter((file) => /\.(cpp|cc|cxx)$/.test(file) && !isTestFile(file)).slice(0, CPP_CONTENT_SCAN_LIMIT);
   return candidates.filter((file) => {
-    const fullPath = join3(repoPath, file);
+    const fullPath = join(repoPath, file);
     if (!isRegularFile(fullPath)) return false;
-    const contents = readFileSync6(fullPath, "utf8");
+    const contents = readFileSync(fullPath, "utf8");
     return CPP_TEST_FRAMEWORK_PATTERN.test(contents) || CPP_TEST_MACRO_PATTERN.test(contents);
   });
 }
@@ -8175,9 +6515,9 @@ function measureNonHollowTestShare(repoPath, files) {
   let nonHollowCount = 0;
   let ratedCount = 0;
   for (const file of files) {
-    const fullPath = join3(repoPath, file);
+    const fullPath = join(repoPath, file);
     if (!isRegularFile(fullPath)) continue;
-    const contents = readFileSync6(fullPath, "utf8");
+    const contents = readFileSync(fullPath, "utf8");
     const nonHollow = (JS_TEST_ASSERTION_PATTERN.test(contents) || CPP_TEST_ASSERTION_PATTERN.test(contents) || MULTI_ECOSYSTEM_TEST_ASSERTION_PATTERN.test(contents)) && !SUITE_LEVEL_SKIP_PATTERN.test(contents);
     if (nonHollow) {
       nonHollowCount += 1;
@@ -8196,17 +6536,17 @@ function countPatternMatches(repoPath, files, pattern) {
   const matcher = new RegExp(pattern.source, flags);
   let count = 0;
   for (const file of files) {
-    const fullPath = join3(repoPath, file);
+    const fullPath = join(repoPath, file);
     if (!isRegularFile(fullPath)) continue;
-    count += [...readFileSync6(fullPath, "utf8").matchAll(matcher)].length;
+    count += [...readFileSync(fullPath, "utf8").matchAll(matcher)].length;
   }
   return count;
 }
 function readCoveragePercent(repoPath, files) {
   for (const file of files) {
-    const fullPath = join3(repoPath, file);
+    const fullPath = join(repoPath, file);
     if (!isRegularFile(fullPath)) continue;
-    const contents = readFileSync6(fullPath, "utf8");
+    const contents = readFileSync(fullPath, "utf8");
     const summaryPercent = parseCoverageSummaryPercent(contents);
     if (summaryPercent !== null) return summaryPercent;
     const thresholdPercent = parseCoverageThresholdPercent(contents);
@@ -8250,7 +6590,7 @@ function pickPrimaryDependencyManifest(repoPath, manifests) {
 function readDependencySpecs(repoPath, manifests) {
   const specs = [];
   for (const manifest of manifests) {
-    const fullPath = join3(repoPath, manifest);
+    const fullPath = join(repoPath, manifest);
     if (!isRegularFile(fullPath)) continue;
     if (manifest.endsWith("package.json")) {
       specs.push(...readPackageJsonDependencySpecs(fullPath));
@@ -8296,7 +6636,7 @@ function readDependencySpecs(repoPath, manifests) {
 }
 function readGoModDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync6(path, "utf8");
+  const contents = readFileSync(path, "utf8");
   const blockPattern = /require\s*\(([^)]+)\)/gs;
   const singlePattern = /^require\s+(\S+)\s+(\S+)/gm;
   for (const blockMatch of contents.matchAll(blockPattern)) {
@@ -8317,7 +6657,7 @@ function readGoModDependencySpecs(path) {
 }
 function readCargoTomlDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync6(path, "utf8");
+  const contents = readFileSync(path, "utf8");
   const depSectionPattern = /^\[(?:dependencies|dev-dependencies|build-dependencies)\]([\s\S]*?)(?=^\[|(?![\s\S]))/gm;
   for (const sectionMatch of contents.matchAll(depSectionPattern)) {
     const section = sectionMatch[1] ?? "";
@@ -8339,7 +6679,7 @@ function readCargoTomlDependencySpecs(path) {
 }
 function readPyprojectDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync6(path, "utf8");
+  const contents = readFileSync(path, "utf8");
   const poetrySectionPattern = /^\[tool\.poetry\.dependencies\]([\s\S]*?)(?=^\[|(?![\s\S]))/gm;
   for (const sectionMatch of contents.matchAll(poetrySectionPattern)) {
     const section = sectionMatch[1] ?? "";
@@ -8373,7 +6713,7 @@ function readPyprojectDependencySpecs(path) {
 }
 function readPipfileDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync6(path, "utf8");
+  const contents = readFileSync(path, "utf8");
   const sectionPattern = /^\[(?:packages|dev-packages)\]([\s\S]*?)(?=^\[|$(?![\s\S]))/gm;
   for (const sectionMatch of contents.matchAll(sectionPattern)) {
     for (const line of (sectionMatch[1] ?? "").split("\n")) {
@@ -8386,7 +6726,7 @@ function readPipfileDependencySpecs(path) {
   return specs;
 }
 function readVcpkgJsonDependencySpecs(path) {
-  const parsed = parseJsonObject(readFileSync6(path, "utf8"));
+  const parsed = parseJsonObject(readFileSync(path, "utf8"));
   if (!parsed) return [];
   const rawDeps = Array.isArray(parsed.dependencies) ? parsed.dependencies : [];
   const specs = [];
@@ -8402,7 +6742,7 @@ function readVcpkgJsonDependencySpecs(path) {
 }
 function readConanfileTxtDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync6(path, "utf8");
+  const contents = readFileSync(path, "utf8");
   const requiresMatch = /^\[requires\]([\s\S]*?)(?=^\[|$(?![\s\S]))/m.exec(contents);
   if (!requiresMatch) return specs;
   for (const line of (requiresMatch[1] ?? "").split("\n")) {
@@ -8415,7 +6755,7 @@ function readConanfileTxtDependencySpecs(path) {
 }
 function readConanfilePyDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync6(path, "utf8");
+  const contents = readFileSync(path, "utf8");
   for (const match of contents.matchAll(/self\.requires\s*\(\s*["']([\w.\-]+)\/([\w.\-]+)["']/g)) {
     specs.push({ name: match[1] ?? "", version: match[2] ?? "" });
   }
@@ -8429,7 +6769,7 @@ function readConanfilePyDependencySpecs(path) {
 }
 function readCMakeDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync6(path, "utf8");
+  const contents = readFileSync(path, "utf8");
   for (const match of contents.matchAll(/find_package\s*\(\s*([\w]+)(?:\s+([\d.]+))?/gi)) {
     const name = match[1];
     if (!name) continue;
@@ -8444,7 +6784,7 @@ function readCMakeDependencySpecs(path) {
   return specs;
 }
 function readPackageJsonDependencySpecs(packageJsonPath) {
-  const parsed = parseJsonObject(readFileSync6(packageJsonPath, "utf8"));
+  const parsed = parseJsonObject(readFileSync(packageJsonPath, "utf8"));
   if (!parsed) return [];
   const optionalPeerNames = /* @__PURE__ */ new Set();
   const peerDependenciesMeta = parsed.peerDependenciesMeta;
@@ -8471,7 +6811,7 @@ function readPackageJsonDependencySpecs(packageJsonPath) {
   return specs;
 }
 function readRequirementsDependencySpecs(path) {
-  return readFileSync6(path, "utf8").split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).map((line) => {
+  return readFileSync(path, "utf8").split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).map((line) => {
     const [name = line, version = ""] = line.split(/[<>=~!]=?/, 2);
     return { name: name.trim(), version: line.includes("==") ? version.trim() : line };
   });
@@ -8487,9 +6827,9 @@ function isPinnedDependencyVersion(version) {
   return /^\d+\.\d+(?:\.\d+)?(?:[-+][0-9A-Za-z.-]+)?$/.test(trimmed);
 }
 function workflowTargetsDefaultBranch(repoPath, file) {
-  const fullPath = join3(repoPath, file);
+  const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return false;
-  const contents = readFileSync6(fullPath, "utf8").toLowerCase();
+  const contents = readFileSync(fullPath, "utf8").toLowerCase();
   return /\bpull_request\b/.test(contents) || /\bbranches:\s*\[[^\]]*\b(main|master)\b[^\]]*\]/.test(contents) || /\bbranches:\s*\n\s*-\s*(main|master)\b/.test(contents);
 }
 function isPrMergeCommit(commit) {
@@ -8571,384 +6911,767 @@ function isLockfile(file) {
 function isDependencyUpdateConfig(file) {
   return /(^|\/)(renovate\.json|renovate\.json5|\.renovaterc\.json|dependabot\.ya?ml)$/.test(file) || /^\.github\/dependabot\.ya?ml$/.test(file);
 }
-function packageJsonHasAuditScript(repoPath, manifest) {
-  if (!manifest.endsWith("package.json")) return false;
-  const scripts = readPackageScripts(join3(repoPath, manifest));
-  return [...scripts.values()].some(
-    (script) => /\b(audit|npm audit|pnpm audit|yarn audit)\b/i.test(script)
-  );
+function packageJsonHasAuditScript(repoPath, manifest) {
+  if (!manifest.endsWith("package.json")) return false;
+  const scripts = readPackageScripts(join(repoPath, manifest));
+  return [...scripts.values()].some(
+    (script) => /\b(audit|npm audit|pnpm audit|yarn audit)\b/i.test(script)
+  );
+}
+function packageJsonHasHeavyTestDependency(repoPath, manifest) {
+  const fullPath = join(repoPath, manifest);
+  if (!isRegularFile(fullPath)) return false;
+  const parsed = parseJsonObject(readFileSync(fullPath, "utf8"));
+  if (!parsed) return false;
+  const names = [
+    ...Object.keys(isRecord(parsed.dependencies) ? parsed.dependencies : {}),
+    ...Object.keys(isRecord(parsed.devDependencies) ? parsed.devDependencies : {})
+  ];
+  return names.some((name) => HEAVY_TEST_DEPENDENCY_NAME_PATTERN.test(name));
+}
+function isImplementationFile(file) {
+  return /(^|\/)(src|app|lib|packages|cmd|include|source|Sources)\//.test(file) && /\.(ts|tsx|js|jsx|py|go|rs|java|rb|cpp|cc|cxx|c|h|hpp|kt|swift|php)$/.test(file);
+}
+function isAuditFile(file) {
+  return (
+    // goal_cejel_calibration_fix_with_strict_gate_2026-07-06: mature OSS repos document the
+    // same audit-trail practice under different filenames/extensions than Alfred's own
+    // conventions (Flask ships CHANGES.rst, not CHANGELOG.md) — recognize the common OSS
+    // release-notes/security-policy/provenance equivalents so real audit-trail artifacts are
+    // credited instead of silently missing the pattern.
+    /(^|\/)(CHANGELOG|CHANGES|HISTORY|NEWS|RELEASE_NOTES|RELEASES|SECURITY|AUDIT|STATUS)\.(md|rst|txt)$/i.test(
+      file
+    ) || /(^|\/)docs\/.*(audit|runbook|incident|changelog|security).*\.(md|rst)$/i.test(file) || // Provenance/signed-release tooling config is itself audit-trail evidence (a repo that
+    // wires SLSA/cosign attestation or CITATION.cff is documenting release provenance).
+    /(^|\/)CITATION\.cff$/i.test(file)
+  );
+}
+function isSecurityPolicyOnlyAuditFile(file) {
+  return /(^|\/)SECURITY\.(md|rst|txt)$/i.test(file) || /(^|\/)docs\/.*security.*\.(md|rst)$/i.test(file);
+}
+function isFreshnessRatableAuditFile(file) {
+  return isAuditFile(file) && !isSecurityPolicyOnlyAuditFile(file);
+}
+function isIgnoredScanFile(file) {
+  return /(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|README\.md|CHANGELOG\.md)$/.test(file) || isEnvTemplatePath(file);
+}
+function findRootPackageJson(repoFiles) {
+  return repoFiles.includes("package.json") ? "package.json" : null;
+}
+function isRegularFile(path) {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function fileContains(repoPath, file, pattern) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return false;
+  return pattern.test(readFileSync(fullPath, "utf8"));
+}
+function fileContainsCommittedSecret(repoPath, file) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return false;
+  return containsRealSecret(readFileSync(fullPath, "utf8"));
+}
+function containsRealSecret(contents) {
+  SECRET_ASSIGNMENT_PATTERN.lastIndex = 0;
+  for (const match of contents.matchAll(SECRET_ASSIGNMENT_PATTERN)) {
+    const rawValue = match[1];
+    if (!rawValue) continue;
+    const value = rawValue.replace(/[,;)]$/, "");
+    if (isPlaceholderSecretValue(value)) continue;
+    if (looksLikeSecretValue(value)) return true;
+  }
+  return false;
+}
+function collectHistorySecretEvidence(repoPath) {
+  const historyEntries = readCredentialHistoryEntries(repoPath);
+  let scannedFiles = 0;
+  let envPathEvidence = null;
+  for (const entry of historyEntries) {
+    if (scannedFiles >= HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT) {
+      return { evidence: null, envPathEvidence, truncated: true };
+    }
+    scannedFiles += 1;
+    const contents = readGitBlob(repoPath, entry.commit, entry.path);
+    if (!contents) continue;
+    if (containsRealSecret(contents)) {
+      return {
+        evidence: {
+          kind: "secret_scan",
+          label: "Committed secret in recent git history",
+          path: entry.path,
+          contentHash: entry.commit
+        },
+        envPathEvidence,
+        truncated: false
+      };
+    }
+    if (!envPathEvidence && isEnvHistoryPath(entry.path)) {
+      envPathEvidence = {
+        kind: "secret_scan",
+        label: ".env file (not a template) tracked in git history; no confirmed secret value found",
+        path: entry.path,
+        contentHash: entry.commit
+      };
+    }
+  }
+  return { evidence: null, envPathEvidence, truncated: false };
+}
+function readCredentialHistoryEntries(repoPath) {
+  const entries = [];
+  const seen = /* @__PURE__ */ new Set();
+  const appendEntry = (entry) => {
+    const key = `${entry.commit}:${entry.path}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    entries.push(entry);
+  };
+  try {
+    const commits = execFileSync("git", ["rev-list", "--all"], {
+      cwd: repoPath,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const output = execFileSync(
+      "git",
+      [
+        "diff-tree",
+        "--stdin",
+        "--root",
+        "--name-only",
+        "-r",
+        "--diff-filter=AM",
+        "--pretty=format:commit:%H"
+      ],
+      {
+        cwd: repoPath,
+        encoding: "utf8",
+        input: commits,
+        stdio: ["pipe", "pipe", "ignore"]
+      }
+    );
+    let currentCommit = null;
+    for (const line of output.split("\n")) {
+      if (line.startsWith("commit:")) {
+        currentCommit = line.slice("commit:".length);
+        continue;
+      }
+      const path = line.trim();
+      if (!currentCommit || !path) continue;
+      if (!isCredentialHistoryPath(path)) continue;
+      appendEntry({ commit: currentCommit, path });
+    }
+  } catch {
+  }
+  for (const entry of readDeletedCredentialHistoryEntries(repoPath)) {
+    appendEntry(entry);
+  }
+  return entries;
+}
+function readDeletedCredentialHistoryEntries(repoPath) {
+  const deletedPaths = readDeletedCredentialHistoryPaths(repoPath);
+  const entries = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const path of deletedPaths) {
+    for (const commit of readHistoryCommitsForPath(repoPath, path)) {
+      const key = `${commit}:${path}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      entries.push({ commit, path });
+    }
+  }
+  return entries;
+}
+function readDeletedCredentialHistoryPaths(repoPath) {
+  try {
+    const output = execFileSync(
+      "git",
+      ["log", "--all", "--diff-filter=D", "--name-status", "--format=commit:%H"],
+      {
+        cwd: repoPath,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"]
+      }
+    );
+    const paths = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const line of output.split("\n")) {
+      if (!line.startsWith("D	")) continue;
+      const path = line.slice(2).trim();
+      if (!path || seen.has(path)) continue;
+      if (!isCredentialHistoryPath(path)) continue;
+      seen.add(path);
+      paths.push(path);
+    }
+    return paths;
+  } catch {
+    return [];
+  }
+}
+function readHistoryCommitsForPath(repoPath, path) {
+  try {
+    const output = execFileSync(
+      "git",
+      ["log", "--all", "--diff-filter=AM", "--format=%H", "--", path],
+      {
+        cwd: repoPath,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"]
+      }
+    );
+    return output.split("\n").map((line) => line.trim()).filter((line) => /^[0-9a-f]{40}$/i.test(line));
+  } catch {
+    return [];
+  }
+}
+function isCredentialHistoryPath(path) {
+  if (isHardExcludedPath(path)) return false;
+  const lowerPath = path.toLowerCase();
+  const basename3 = lowerPath.split("/").at(-1) ?? lowerPath;
+  if (/\.env(?:\.|$)/.test(basename3)) {
+    return true;
+  }
+  return lowerPath.includes("secret") || lowerPath.includes("credential") || basename3.endsWith(".pem") || basename3.endsWith(".key") || basename3 === "id_rsa" || basename3.endsWith(".p12") || basename3.endsWith(".pfx");
+}
+function isEnvHistoryPath(path) {
+  if (isEnvTemplatePath(path)) return false;
+  const basename3 = path.toLowerCase().split("/").at(-1) ?? path.toLowerCase();
+  return /\.env(?:\.|$)/.test(basename3);
+}
+function readGitBlob(repoPath, commit, path) {
+  try {
+    return execFileSync("git", ["show", `${commit}:${path}`], {
+      cwd: repoPath,
+      encoding: "utf8",
+      maxBuffer: 512e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+  } catch {
+    return null;
+  }
+}
+var ALL_CAPS_SNAKE_PLACEHOLDER_PATTERN = /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/;
+function isPlaceholderSecretValue(value) {
+  const normalized = value.trim().toLowerCase();
+  return PLACEHOLDER_SECRET_PATTERN.test(normalized) || normalized.includes("your-") || normalized.includes("example") || ALL_CAPS_SNAKE_PLACEHOLDER_PATTERN.test(value.trim()) || isSyntheticFixtureSecretValue(normalized) || isFillerRunSecretValue(normalized);
+}
+function isFillerRunSecretValue(value) {
+  const candidates = [value];
+  const sepIdx = Math.max(value.lastIndexOf("_"), value.lastIndexOf("-"));
+  if (sepIdx > 0 && sepIdx < value.length - 1) {
+    candidates.push(value.slice(sepIdx + 1));
+  }
+  for (const body of candidates) {
+    if (body.length < 8) continue;
+    const counts = /* @__PURE__ */ new Map();
+    for (const ch of body) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+    const distinct = counts.size;
+    const maxRun = Math.max(...counts.values());
+    if (distinct <= 2 && maxRun / body.length >= 0.8) return true;
+  }
+  return false;
+}
+function isSyntheticFixtureSecretValue(value) {
+  return value.includes("abcdefghijklmnopqrstuvwxyz") || value.includes("0123456789abcdefghijklmnopqrstuvwxyz") || value.includes("abcdefghijklmnopqrstuvwxyz0123456789") || value.includes("abcdefghijklmnopqrst");
 }
-function packageJsonHasHeavyTestDependency(repoPath, manifest) {
-  const fullPath = join3(repoPath, manifest);
+function hasSuspiciousDependencies(repoPath, manifest) {
+  if (!manifest.endsWith("package.json")) return false;
+  const fullPath = join(repoPath, manifest);
   if (!isRegularFile(fullPath)) return false;
-  const parsed = parseJsonObject(readFileSync6(fullPath, "utf8"));
+  const parsed = parseJsonObject(readFileSync(fullPath, "utf8"));
   if (!parsed) return false;
-  const names = [
-    ...Object.keys(isRecord(parsed.dependencies) ? parsed.dependencies : {}),
-    ...Object.keys(isRecord(parsed.devDependencies) ? parsed.devDependencies : {})
-  ];
-  return names.some((name) => HEAVY_TEST_DEPENDENCY_NAME_PATTERN.test(name));
+  const dependencies = isRecord(parsed.dependencies) ? parsed.dependencies : {};
+  const devDependencies = isRecord(parsed.devDependencies) ? parsed.devDependencies : {};
+  const names = [...Object.keys(dependencies), ...Object.keys(devDependencies)];
+  return names.some(
+    (name) => /^(todo|fake|placeholder|example)-|does-not-exist| hallucinated/i.test(name)
+  );
 }
-function isImplementationFile(file) {
-  return /(^|\/)(src|app|lib|packages|cmd|include|source|Sources)\//.test(file) && /\.(ts|tsx|js|jsx|py|go|rs|java|rb|cpp|cc|cxx|c|h|hpp|kt|swift|php)$/.test(file);
+function readRecentCommits(repoPath) {
+  try {
+    const output = execFileSync("git", ["log", "--max-count=12", "--format=%H%x00%s"], {
+      cwd: repoPath,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    if (!output) return [];
+    return output.split("\n").map((line) => {
+      const [sha = "", subject = ""] = line.split("\0");
+      return { sha, subject };
+    }).filter((commit) => commit.sha.length >= 7);
+  } catch {
+    return [];
+  }
 }
-function isAuditFile(file) {
-  return (
-    // goal_cejel_calibration_fix_with_strict_gate_2026-07-06: mature OSS repos document the
-    // same audit-trail practice under different filenames/extensions than Alfred's own
-    // conventions (Flask ships CHANGES.rst, not CHANGELOG.md) — recognize the common OSS
-    // release-notes/security-policy/provenance equivalents so real audit-trail artifacts are
-    // credited instead of silently missing the pattern.
-    /(^|\/)(CHANGELOG|CHANGES|HISTORY|NEWS|RELEASE_NOTES|RELEASES|SECURITY|AUDIT|STATUS)\.(md|rst|txt)$/i.test(
-      file
-    ) || /(^|\/)docs\/.*(audit|runbook|incident|changelog|security).*\.(md|rst)$/i.test(file) || // Provenance/signed-release tooling config is itself audit-trail evidence (a repo that
-    // wires SLSA/cosign attestation or CITATION.cff is documenting release provenance).
-    /(^|\/)CITATION\.cff$/i.test(file)
+function readPackageScripts(packageJsonPath) {
+  if (!isRegularFile(packageJsonPath)) return /* @__PURE__ */ new Map();
+  const parsed = parseJsonObject(readFileSync(packageJsonPath, "utf8"));
+  const scripts = parsed?.scripts;
+  if (!isRecord(scripts)) return /* @__PURE__ */ new Map();
+  return new Map(
+    Object.entries(scripts).filter(
+      (entry) => typeof entry[1] === "string"
+    )
   );
 }
-function isSecurityPolicyOnlyAuditFile(file) {
-  return /(^|\/)SECURITY\.(md|rst|txt)$/i.test(file) || /(^|\/)docs\/.*security.*\.(md|rst)$/i.test(file);
+function evidenceForRelative(repoPath, path, kind, label) {
+  const fullPath = join(repoPath, path);
+  const contents = isRegularFile(fullPath) ? readFileSync(fullPath, "utf8") : "";
+  return {
+    kind,
+    label,
+    path,
+    ...contents ? {
+      line: firstMeaningfulLine(contents),
+      contentHash: createHash2("sha256").update(contents).digest("hex")
+    } : {}
+  };
 }
-function isFreshnessRatableAuditFile(file) {
-  return isAuditFile(file) && !isSecurityPolicyOnlyAuditFile(file);
+function evidenceForRelativeAtLine(repoPath, path, kind, label, line) {
+  const fullPath = join(repoPath, path);
+  const contents = isRegularFile(fullPath) ? readFileSync(fullPath, "utf8") : "";
+  return {
+    kind,
+    label,
+    path,
+    line,
+    ...contents ? { contentHash: createHash2("sha256").update(contents).digest("hex") } : {}
+  };
 }
-function isIgnoredScanFile(file) {
-  return /(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|README\.md|CHANGELOG\.md)$/.test(file) || isEnvTemplatePath(file);
+function metric(name, label, value, max, weight, unit, description, kind) {
+  return {
+    name,
+    label,
+    value: Math.max(0, value),
+    max,
+    ...kind ? { kind } : {},
+    weight,
+    unit,
+    description
+  };
 }
-function findRootPackageJson(repoFiles) {
-  return repoFiles.includes("package.json") ? "package.json" : null;
+function firstMeaningfulLine(contents) {
+  const lines = contents.split("\n");
+  const index = lines.findIndex((line) => line.trim().length > 0);
+  return index === -1 ? 1 : index + 1;
 }
-function isRegularFile(path) {
+function readGitHead(repoPath) {
+  try {
+    return execFileSync("git", ["rev-parse", "HEAD"], {
+      cwd: repoPath,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function hasEnvPathInGitHistory(repoPath) {
   try {
-    return statSync2(path).isFile();
+    const output = execFileSync(
+      "git",
+      ["log", "--all", "--diff-filter=AM", "--name-only", "--format="],
+      {
+        cwd: repoPath,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        maxBuffer: 512e3
+      }
+    ).trim();
+    if (!output) return false;
+    return output.split("\n").some((p) => /(?:^|\/)\.env(?:\.|$)/i.test(p.trim()));
   } catch {
     return false;
   }
 }
-function fileContains(repoPath, file, pattern) {
-  const fullPath = join3(repoPath, file);
-  if (!isRegularFile(fullPath)) return false;
-  return pattern.test(readFileSync6(fullPath, "utf8"));
+
+// src/witan/public-scan.ts
+import { resolve as resolve2 } from "path";
+
+// src/witan/ingest.ts
+import { readFileSync as readFileSync5, readdirSync as readdirSync2 } from "fs";
+import { join as join2 } from "path";
+
+// src/witan/finding-limits.ts
+var RULE_ID_MAX = 200;
+var MESSAGE_MAX = 500;
+var LOCATION_MAX = 700;
+function clamp(value, max) {
+  if (value.length <= max) return value;
+  const ellipsis = "...";
+  return `${value.slice(0, Math.max(max - ellipsis.length, 0))}${ellipsis}`;
 }
-function fileContainsCommittedSecret(repoPath, file) {
-  const fullPath = join3(repoPath, file);
-  if (!isRegularFile(fullPath)) return false;
-  return containsRealSecret(readFileSync6(fullPath, "utf8"));
+function clampFinding(finding) {
+  return {
+    ...finding,
+    ruleId: clamp(finding.ruleId, RULE_ID_MAX),
+    message: clamp(finding.message, MESSAGE_MAX),
+    ...finding.location ? { location: clamp(finding.location, LOCATION_MAX) } : {}
+  };
 }
-function containsRealSecret(contents) {
-  SECRET_ASSIGNMENT_PATTERN.lastIndex = 0;
-  for (const match of contents.matchAll(SECRET_ASSIGNMENT_PATTERN)) {
-    const rawValue = match[1];
-    if (!rawValue) continue;
-    const value = rawValue.replace(/[,;)]$/, "");
-    if (isPlaceholderSecretValue(value)) continue;
-    if (looksLikeSecretValue(value)) return true;
+
+// src/witan/generic-adapter.ts
+import { readFileSync as readFileSync2 } from "fs";
+var VALID_DIMENSIONS = /* @__PURE__ */ new Set([
+  "A1",
+  "A2",
+  "A3",
+  "A4",
+  "A5",
+  "B1",
+  "B2",
+  "B3",
+  "B4",
+  "B5",
+  "B6"
+]);
+var VALID_SEVERITIES = /* @__PURE__ */ new Set(["critical", "warning", "info"]);
+function isGenericSignalDocument(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
+  const doc = raw;
+  return typeof doc.tool === "string" && doc.tool.length > 0 && Array.isArray(doc.signals);
+}
+function parseGenericJson(raw) {
+  if (!isGenericSignalDocument(raw)) return [];
+  const source = raw.tool ?? "unknown";
+  const signals = [];
+  for (const signal of raw.signals ?? []) {
+    const dimension = signal.dimension;
+    if (!dimension || !VALID_DIMENSIONS.has(dimension)) continue;
+    const weight = typeof signal.weight === "number" && Number.isFinite(signal.weight) ? Math.min(Math.max(signal.weight, 0), 1) : 0.5;
+    const findings = [];
+    for (const finding of signal.findings ?? []) {
+      const severity = finding.severity;
+      if (!severity || !VALID_SEVERITIES.has(severity)) continue;
+      const ruleId = finding.ruleId ?? "unknown";
+      findings.push({
+        ruleId,
+        severity,
+        message: finding.message ?? ruleId,
+        ...finding.location ? { location: finding.location } : {}
+      });
+    }
+    if (findings.length === 0) continue;
+    signals.push({ source, dimension, weight, findings });
+  }
+  return signals;
+}
+
+// src/witan/sarif-adapter.ts
+import { readFileSync as readFileSync3 } from "fs";
+var DIMENSION_RULES = [
+  // A2 — injection / secrets / auth (high weight)
+  {
+    pattern: /sql[- _]?inject|cwe-89|sqli|command[- _]?inject|cwe-78|os[- _]?cmd|rce|remote[- _]?code/i,
+    dimension: "A2",
+    weight: 0.9
+  },
+  {
+    pattern: /secret|credential|api[- _]?key|password[- _]?leak|hardcoded[- _]?(token|key|secret)|cwe-259|cwe-798/i,
+    dimension: "A2",
+    weight: 0.9
+  },
+  {
+    pattern: /path[- _]?traversal|directory[- _]?traversal|cwe-22|lfi|rfi/i,
+    dimension: "A2",
+    weight: 0.8
+  },
+  {
+    pattern: /ssrf|server[- _]?side[- _]?request[- _]?forg|cwe-918/i,
+    dimension: "A2",
+    weight: 0.8
+  },
+  {
+    pattern: /xxe|xml[- _]?external[- _]?entity|cwe-611/i,
+    dimension: "A2",
+    weight: 0.8
+  },
+  {
+    pattern: /auth[- _]?bypass|broken[- _]?auth|missing[- _]?auth|cwe-287|cwe-306|cwe-863|cwe-862/i,
+    dimension: "A2",
+    weight: 0.7
+  },
+  {
+    pattern: /xss|cross[- _]?site[- _]?script|cwe-79/i,
+    dimension: "A2",
+    weight: 0.6
+  },
+  // A4 — dependency vulnerabilities
+  {
+    pattern: /cve-\d{4}-\d+|supply[- _]?chain|depend[a-z]*[- _]?vulner|outdated[- _]?depend|deprecated[- _]?package/i,
+    dimension: "A4",
+    weight: 0.8
+  },
+  {
+    pattern: /npm[- _]?audit|yarn[- _]?audit|pnpm[- _]?audit|pip[- _]?audit|cargo[- _]?audit/i,
+    dimension: "A4",
+    weight: 0.7
+  },
+  // A3 — production readiness / insecure config
+  {
+    pattern: /insecure[- _]?tls|weak[- _]?cipher|tls[- _]?version|http[- _]?strict|hsts|csp[- _]?missing|cwe-326|cwe-327/i,
+    dimension: "A3",
+    weight: 0.5
+  },
+  {
+    pattern: /error[- _]?handl|unhandled[- _]?exception|crash|uncaught|stacktrace[- _]?leak/i,
+    dimension: "A3",
+    weight: 0.4
+  },
+  {
+    pattern: /debug[- _]?mode|dev[- _]?endpoint|staging[- _]?secret/i,
+    dimension: "A3",
+    weight: 0.4
+  },
+  // A1 — test integrity (low weight; SARIF rarely surfaces this)
+  {
+    pattern: /skipped[- _]?test|hollow[- _]?test|empty[- _]?assert|no[- _]?assertion/i,
+    dimension: "A1",
+    weight: 0.2
   }
-  return false;
+];
+var DEFAULT_DIMENSION = "A2";
+var DEFAULT_WEIGHT = 0.3;
+var DROP_LEVEL = /* @__PURE__ */ new Set(["none"]);
+function mapLevel(level) {
+  if (!level || DROP_LEVEL.has(level)) return null;
+  if (level === "error") return "critical";
+  if (level === "warning") return "warning";
+  return "info";
 }
-function collectHistorySecretEvidence(repoPath) {
-  const historyEntries = readCredentialHistoryEntries(repoPath);
-  let scannedFiles = 0;
-  let envPathEvidence = null;
-  for (const entry of historyEntries) {
-    if (scannedFiles >= HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT) {
-      return { evidence: null, envPathEvidence, truncated: true };
-    }
-    scannedFiles += 1;
-    const contents = readGitBlob(repoPath, entry.commit, entry.path);
-    if (!contents) continue;
-    if (containsRealSecret(contents)) {
-      return {
-        evidence: {
-          kind: "secret_scan",
-          label: "Committed secret in recent git history",
-          path: entry.path,
-          contentHash: entry.commit
-        },
-        envPathEvidence,
-        truncated: false
-      };
-    }
-    if (!envPathEvidence && isEnvHistoryPath(entry.path)) {
-      envPathEvidence = {
-        kind: "secret_scan",
-        label: ".env file (not a template) tracked in git history; no confirmed secret value found",
-        path: entry.path,
-        contentHash: entry.commit
-      };
+function mapRuleToDimension(ruleId, rules) {
+  for (const rule of rules) {
+    if (rule.pattern.test(ruleId)) {
+      return { dimension: rule.dimension, weight: rule.weight };
     }
   }
-  return { evidence: null, envPathEvidence, truncated: false };
+  return { dimension: DEFAULT_DIMENSION, weight: DEFAULT_WEIGHT };
 }
-function readCredentialHistoryEntries(repoPath) {
-  const entries = [];
-  const seen = /* @__PURE__ */ new Set();
-  const appendEntry = (entry) => {
-    const key = `${entry.commit}:${entry.path}`;
-    if (seen.has(key)) return;
-    seen.add(key);
-    entries.push(entry);
-  };
-  try {
-    const commits = execFileSync("git", ["rev-list", "--all"], {
-      cwd: repoPath,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-    const output = execFileSync(
-      "git",
-      [
-        "diff-tree",
-        "--stdin",
-        "--root",
-        "--name-only",
-        "-r",
-        "--diff-filter=AM",
-        "--pretty=format:commit:%H"
-      ],
-      {
-        cwd: repoPath,
-        encoding: "utf8",
-        input: commits,
-        stdio: ["pipe", "pipe", "ignore"]
-      }
-    );
-    let currentCommit = null;
-    for (const line of output.split("\n")) {
-      if (line.startsWith("commit:")) {
-        currentCommit = line.slice("commit:".length);
-        continue;
-      }
-      const path = line.trim();
-      if (!currentCommit || !path) continue;
-      if (!isCredentialHistoryPath(path)) continue;
-      appendEntry({ commit: currentCommit, path });
-    }
-  } catch {
-  }
-  for (const entry of readDeletedCredentialHistoryEntries(repoPath)) {
-    appendEntry(entry);
-  }
-  return entries;
+function renderLocation(result) {
+  const loc = result.locations?.[0]?.physicalLocation;
+  if (!loc) return void 0;
+  const uri = loc.artifactLocation?.uri;
+  const line = loc.region?.startLine;
+  if (!uri) return void 0;
+  return line != null ? `${uri}:${line}` : uri;
 }
-function readDeletedCredentialHistoryEntries(repoPath) {
-  const deletedPaths = readDeletedCredentialHistoryPaths(repoPath);
-  const entries = [];
+function dedupeFindings(findings) {
   const seen = /* @__PURE__ */ new Set();
-  for (const path of deletedPaths) {
-    for (const commit of readHistoryCommitsForPath(repoPath, path)) {
-      const key = `${commit}:${path}`;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      entries.push({ commit, path });
-    }
-  }
-  return entries;
+  return findings.filter((f) => {
+    const key = `${f.ruleId}|${f.severity}|${f.location ?? ""}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
 }
-function readDeletedCredentialHistoryPaths(repoPath) {
-  try {
-    const output = execFileSync(
-      "git",
-      ["log", "--all", "--diff-filter=D", "--name-status", "--format=commit:%H"],
-      {
-        cwd: repoPath,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"]
+function parseSarifJson(raw, extraDimensionRules) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
+  const dimensionRules = extraDimensionRules ? [...DIMENSION_RULES, ...extraDimensionRules] : DIMENSION_RULES;
+  const doc = raw;
+  if (!Array.isArray(doc.runs)) return [];
+  const buckets = /* @__PURE__ */ new Map();
+  for (const run of doc.runs) {
+    const driverName = run.tool?.driver?.name ?? "unknown";
+    const source = `sarif:${driverName}`;
+    const ruleDefaultLevels = /* @__PURE__ */ new Map();
+    for (const rule of run.tool?.driver?.rules ?? []) {
+      if (rule.id && rule.defaultConfiguration?.level) {
+        ruleDefaultLevels.set(rule.id, rule.defaultConfiguration.level);
       }
-    );
-    const paths = [];
-    const seen = /* @__PURE__ */ new Set();
-    for (const line of output.split("\n")) {
-      if (!line.startsWith("D	")) continue;
-      const path = line.slice(2).trim();
-      if (!path || seen.has(path)) continue;
-      if (!isCredentialHistoryPath(path)) continue;
-      seen.add(path);
-      paths.push(path);
     }
-    return paths;
-  } catch {
-    return [];
-  }
-}
-function readHistoryCommitsForPath(repoPath, path) {
-  try {
-    const output = execFileSync(
-      "git",
-      ["log", "--all", "--diff-filter=AM", "--format=%H", "--", path],
-      {
-        cwd: repoPath,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"]
+    for (const result of run.results ?? []) {
+      const ruleId = result.ruleId ?? "unknown";
+      const effectiveLevel = result.level ?? ruleDefaultLevels.get(ruleId) ?? "warning";
+      const severity = mapLevel(effectiveLevel);
+      if (!severity) continue;
+      const message = result.message?.text ?? ruleId;
+      const location = renderLocation(result);
+      const { dimension, weight } = mapRuleToDimension(ruleId, dimensionRules);
+      const bucketKey = `${source}|${dimension}`;
+      if (!buckets.has(bucketKey)) {
+        buckets.set(bucketKey, { source, dimension, weight, findings: [] });
       }
-    );
-    return output.split("\n").map((line) => line.trim()).filter((line) => /^[0-9a-f]{40}$/i.test(line));
-  } catch {
-    return [];
-  }
-}
-function isCredentialHistoryPath(path) {
-  if (isHardExcludedPath(path)) return false;
-  const lowerPath = path.toLowerCase();
-  const basename4 = lowerPath.split("/").at(-1) ?? lowerPath;
-  if (/\.env(?:\.|$)/.test(basename4)) {
-    return true;
+      buckets.get(bucketKey)?.findings.push({ ruleId, severity, message, ...location ? { location } : {} });
+    }
   }
-  return lowerPath.includes("secret") || lowerPath.includes("credential") || basename4.endsWith(".pem") || basename4.endsWith(".key") || basename4 === "id_rsa" || basename4.endsWith(".p12") || basename4.endsWith(".pfx");
+  return Array.from(buckets.values()).map(({ source, dimension, weight, findings }) => ({
+    source,
+    dimension,
+    weight,
+    findings: dedupeFindings(findings)
+  }));
 }
-function isEnvHistoryPath(path) {
-  if (isEnvTemplatePath(path)) return false;
-  const basename4 = path.toLowerCase().split("/").at(-1) ?? path.toLowerCase();
-  return /\.env(?:\.|$)/.test(basename4);
+
+// src/witan/scorecard-adapter.ts
+import { readFileSync as readFileSync4 } from "fs";
+var CHECK_RULES = {
+  // B2 — PR outcome traceability
+  "Branch-Protection": { dimension: "B2", weight: 0.8 },
+  "Code-Review": { dimension: "B2", weight: 0.7 },
+  // B3 — CI and QA discipline
+  "Dangerous-Workflow": { dimension: "B3", weight: 0.9 },
+  "Token-Permissions": { dimension: "B3", weight: 0.8 },
+  "CI-Tests": { dimension: "B3", weight: 0.7 },
+  Maintained: { dimension: "B3", weight: 0.3 },
+  // B4 — audit trail / release integrity
+  "Signed-Releases": { dimension: "B4", weight: 0.7 },
+  Packaging: { dimension: "B4", weight: 0.4 },
+  "Security-Policy": { dimension: "B4", weight: 0.4 },
+  // A4 — dependency hygiene
+  Vulnerabilities: { dimension: "A4", weight: 0.9 },
+  "Pinned-Dependencies": { dimension: "A4", weight: 0.8 },
+  "Dependency-Update-Tool": { dimension: "A4", weight: 0.6 },
+  // A2 — data-layer / static analysis
+  SAST: { dimension: "A2", weight: 0.7 },
+  "Binary-Artifacts": { dimension: "A2", weight: 0.6 },
+  // A1 — test integrity
+  Fuzzing: { dimension: "A1", weight: 0.3 }
+};
+function mapScoreToSeverity(score) {
+  if (score == null || Number.isNaN(score)) return null;
+  if (score < 0) return null;
+  if (score >= 10) return null;
+  if (score <= 3) return "critical";
+  if (score <= 6) return "warning";
+  return "info";
 }
-function readGitBlob(repoPath, commit, path) {
-  try {
-    return execFileSync("git", ["show", `${commit}:${path}`], {
-      cwd: repoPath,
-      encoding: "utf8",
-      maxBuffer: 512e3,
-      stdio: ["ignore", "pipe", "ignore"]
+function dedupeFindings2(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  return findings.filter((f) => {
+    const key = `${f.ruleId}|${f.severity}|${f.location ?? ""}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function parseScorecardJson(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
+  const doc = raw;
+  if (!Array.isArray(doc.checks)) return [];
+  const buckets = /* @__PURE__ */ new Map();
+  for (const check of doc.checks) {
+    const name = check.name;
+    if (!name) continue;
+    const rule = CHECK_RULES[name];
+    if (!rule) continue;
+    const severity = mapScoreToSeverity(check.score);
+    if (!severity) continue;
+    const scoreText = typeof check.score === "number" ? `${check.score}/10` : "n/a";
+    const message = `${name} (Scorecard ${scoreText}): ${check.reason ?? "weakness detected"}`.slice(0, 500);
+    const location = check.documentation?.url;
+    const bucket = buckets.get(rule.dimension) ?? { weight: 0, findings: [] };
+    bucket.weight = Math.max(bucket.weight, rule.weight);
+    bucket.findings.push({
+      ruleId: `scorecard:${name}`,
+      severity,
+      message,
+      ...location ? { location } : {}
     });
-  } catch {
-    return null;
+    buckets.set(rule.dimension, bucket);
   }
+  return Array.from(buckets.entries()).map(([dimension, { weight, findings }]) => ({
+    source: "scorecard",
+    dimension,
+    weight,
+    findings: dedupeFindings2(findings)
+  }));
 }
-var ALL_CAPS_SNAKE_PLACEHOLDER_PATTERN = /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/;
-function isPlaceholderSecretValue(value) {
-  const normalized = value.trim().toLowerCase();
-  return PLACEHOLDER_SECRET_PATTERN.test(normalized) || normalized.includes("your-") || normalized.includes("example") || ALL_CAPS_SNAKE_PLACEHOLDER_PATTERN.test(value.trim()) || isSyntheticFixtureSecretValue(normalized) || isFillerRunSecretValue(normalized);
+
+// src/witan/ingest.ts
+function looksLikeSarif(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
+  return Array.isArray(raw.runs);
 }
-function isFillerRunSecretValue(value) {
-  const candidates = [value];
-  const sepIdx = Math.max(value.lastIndexOf("_"), value.lastIndexOf("-"));
-  if (sepIdx > 0 && sepIdx < value.length - 1) {
-    candidates.push(value.slice(sepIdx + 1));
+function looksLikeScorecard(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
+  return Array.isArray(raw.checks);
+}
+function countRawEntries(raw) {
+  const obj = raw;
+  if (Array.isArray(obj.runs)) {
+    return obj.runs.reduce((sum, run) => {
+      const results = run.results;
+      return sum + (Array.isArray(results) ? results.length : 0);
+    }, 0);
   }
-  for (const body of candidates) {
-    if (body.length < 8) continue;
-    const counts = /* @__PURE__ */ new Map();
-    for (const ch of body) counts.set(ch, (counts.get(ch) ?? 0) + 1);
-    const distinct = counts.size;
-    const maxRun = Math.max(...counts.values());
-    if (distinct <= 2 && maxRun / body.length >= 0.8) return true;
+  if (Array.isArray(obj.checks)) return obj.checks.length;
+  if (Array.isArray(obj.signals)) {
+    return obj.signals.reduce((sum, signal) => {
+      const findings = signal.findings;
+      return sum + (Array.isArray(findings) ? findings.length : 0);
+    }, 0);
   }
-  return false;
-}
-function isSyntheticFixtureSecretValue(value) {
-  return value.includes("abcdefghijklmnopqrstuvwxyz") || value.includes("0123456789abcdefghijklmnopqrstuvwxyz") || value.includes("abcdefghijklmnopqrstuvwxyz0123456789") || value.includes("abcdefghijklmnopqrst");
+  return 0;
 }
-function hasSuspiciousDependencies(repoPath, manifest) {
-  if (!manifest.endsWith("package.json")) return false;
-  const fullPath = join3(repoPath, manifest);
-  if (!isRegularFile(fullPath)) return false;
-  const parsed = parseJsonObject(readFileSync6(fullPath, "utf8"));
-  if (!parsed) return false;
-  const dependencies = isRecord(parsed.dependencies) ? parsed.dependencies : {};
-  const devDependencies = isRecord(parsed.devDependencies) ? parsed.devDependencies : {};
-  const names = [...Object.keys(dependencies), ...Object.keys(devDependencies)];
-  return names.some(
-    (name) => /^(todo|fake|placeholder|example)-|does-not-exist| hallucinated/i.test(name)
-  );
+function rawToolName(raw) {
+  const obj = raw;
+  if (Array.isArray(obj.runs)) {
+    const firstRun = obj.runs[0];
+    return firstRun?.tool?.driver?.name ?? "unknown";
+  }
+  if (typeof obj.tool === "string" && obj.tool.length > 0) return obj.tool;
+  return "scorecard";
 }
-function readRecentCommits(repoPath) {
+function parseIngestFile(filePath) {
+  let raw;
   try {
-    const output = execFileSync("git", ["log", "--max-count=12", "--format=%H%x00%s"], {
-      cwd: repoPath,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-    if (!output) return [];
-    return output.split("\n").map((line) => {
-      const [sha = "", subject = ""] = line.split("\0");
-      return { sha, subject };
-    }).filter((commit) => commit.sha.length >= 7);
-  } catch {
-    return [];
+    raw = JSON.parse(stripBom(readFileSync5(filePath, "utf8")));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Cejel: could not parse ingest file as JSON: ${filePath} (${message})`);
   }
+  let signals;
+  if (looksLikeSarif(raw)) signals = parseSarifJson(raw);
+  else if (looksLikeScorecard(raw)) signals = parseScorecardJson(raw);
+  else if (isGenericSignalDocument(raw)) signals = parseGenericJson(raw);
+  if (!signals) {
+    throw new Error(
+      `Cejel: unrecognized ingest file format: ${filePath} \u2014 expected SARIF (a "runs" array), OpenSSF Scorecard JSON (a "checks" array), or the generic Cejel external-signal shape (a "tool" string + "signals" array). See the cejel README "Aggregate your scanners".`
+    );
+  }
+  const rawCount = countRawEntries(raw);
+  const mappedCount = signals.reduce((sum, signal) => sum + signal.findings.length, 0);
+  if (rawCount > 0 && mappedCount === 0) {
+    process.stderr.write(
+      `Cejel: ${rawCount} findings from ${rawToolName(raw)} (${filePath}), 0 mapped to trust criteria
+`
+    );
+  }
+  return signals.map((signal) => ({
+    ...signal,
+    findings: signal.findings.map(clampFinding)
+  }));
 }
-function readPackageScripts(packageJsonPath) {
-  if (!isRegularFile(packageJsonPath)) return /* @__PURE__ */ new Map();
-  const parsed = parseJsonObject(readFileSync6(packageJsonPath, "utf8"));
-  const scripts = parsed?.scripts;
-  if (!isRecord(scripts)) return /* @__PURE__ */ new Map();
-  return new Map(
-    Object.entries(scripts).filter(
-      (entry) => typeof entry[1] === "string"
-    )
-  );
-}
-function evidenceForRelative(repoPath, path, kind, label) {
-  const fullPath = join3(repoPath, path);
-  const contents = isRegularFile(fullPath) ? readFileSync6(fullPath, "utf8") : "";
-  return {
-    kind,
-    label,
-    path,
-    ...contents ? {
-      line: firstMeaningfulLine(contents),
-      contentHash: createHash("sha256").update(contents).digest("hex")
-    } : {}
-  };
-}
-function evidenceForRelativeAtLine(repoPath, path, kind, label, line) {
-  const fullPath = join3(repoPath, path);
-  const contents = isRegularFile(fullPath) ? readFileSync6(fullPath, "utf8") : "";
-  return {
-    kind,
-    label,
-    path,
-    line,
-    ...contents ? { contentHash: createHash("sha256").update(contents).digest("hex") } : {}
-  };
-}
-function metric(name, label, value, max, weight, unit, description, kind) {
-  return {
-    name,
-    label,
-    value: Math.max(0, value),
-    max,
-    ...kind ? { kind } : {},
-    weight,
-    unit,
-    description
-  };
-}
-function firstMeaningfulLine(contents) {
-  const lines = contents.split("\n");
-  const index = lines.findIndex((line) => line.trim().length > 0);
-  return index === -1 ? 1 : index + 1;
-}
-function readGitHead(repoPath) {
+function expandIngestPattern(pattern) {
+  if (!pattern.includes("*")) return [pattern];
+  const lastSlash = pattern.lastIndexOf("/");
+  const dir = lastSlash === -1 ? "." : pattern.slice(0, lastSlash);
+  const filePattern = lastSlash === -1 ? pattern : pattern.slice(lastSlash + 1);
+  const regexSource = filePattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  const regex = new RegExp(`^${regexSource}$`);
+  let entries;
   try {
-    return execFileSync("git", ["rev-parse", "HEAD"], {
-      cwd: repoPath,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
+    entries = readdirSync2(dir);
   } catch {
-    return null;
+    return [];
   }
+  return entries.filter((name) => regex.test(name)).sort().map((name) => join2(dir, name));
 }
-function hasEnvPathInGitHistory(repoPath) {
+function discoverIngestInputs(repoPath) {
+  const inputsDir = join2(repoPath, ".cejel", "inputs");
+  let entries;
   try {
-    const output = execFileSync(
-      "git",
-      ["log", "--all", "--diff-filter=AM", "--name-only", "--format="],
-      {
-        cwd: repoPath,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-        maxBuffer: 512e3
-      }
-    ).trim();
-    if (!output) return false;
-    return output.split("\n").some((p) => /(?:^|\/)\.env(?:\.|$)/i.test(p.trim()));
+    entries = readdirSync2(inputsDir);
   } catch {
-    return false;
+    return [];
   }
+  return entries.filter((name) => /\.(sarif|json)$/i.test(name)).sort().map((name) => join2(inputsDir, name));
 }
 
-// ../witan/src/rubric.ts
+// src/witan/rubric.ts
 var WITAN_RUBRIC = [
   {
     id: "A1",
@@ -9007,7 +7730,7 @@ var WITAN_RUBRIC = [
   }
 ];
 
-// ../witan/src/scoring.ts
+// src/witan/scoring.ts
 var MAX_SIGNAL_ADJUSTMENT = 0.8;
 function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
   const parsedInput = WitanReportInputSchema.parse(input);
@@ -9080,20 +7803,22 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
   const overallScore = roundScore(
     categoryOrder.reduce((sum, category) => sum + (categoryScoreMap[category] ?? 0), 0) / Math.max(categoryOrder.length, 1)
   );
+  const abstained = parsedInput.insufficientSourceReason != null;
   return WitanReportSchema.parse({
     productSlug: parsedInput.productSlug,
     productDisplayName: parsedInput.productDisplayName,
     repo: parsedInput.repo,
     generatedAt: parsedInput.generatedAt,
     rubricVersion: parsedInput.rubricVersion,
-    codeTrustScore,
-    processTrustScore,
-    overallScore,
+    verdict: abstained ? "insufficient_source" : witanVerdictForScore(overallScore),
+    codeTrustScore: abstained ? null : codeTrustScore,
+    processTrustScore: abstained ? null : processTrustScore,
+    overallScore: abstained ? null : overallScore,
     criteria,
     ...consumedSignals.length > 0 ? { consumedSignals } : {},
     // Only surface the full per-category map for rubrics with more than two buckets —
     // the default two-category rubric is fully represented by codeTrustScore/processTrustScore.
-    ...categoryOrder.length > 2 ? { categoryScores: categoryScoreMap } : {},
+    ...!abstained && categoryOrder.length > 2 ? { categoryScores: categoryScoreMap } : {},
     // Pass through repo-archetype metadata verbatim — createWitanReport does not compute or
     // alter it (see classifyRepoArchetype in repo-signals.ts); per-criterion scoring above is
     // unaffected by archetype, only presentation layers (badge/terminal/verdict) key off it.
@@ -9315,7 +8040,7 @@ function roundScore(score) {
   return Math.round(score * 10) / 10;
 }
 
-// ../witan/src/public-scan.ts
+// src/witan/public-scan.ts
 function scoreRepoWithPublicCejel(options) {
   const input = buildWitanInputFromRepo({
     productSlug: options.productSlug,
@@ -9351,85 +8076,15 @@ function resolvePublicIngestSignals(options) {
   return files.flatMap((file) => parseIngestFile(file));
 }
 
-// ../witan/src/repo-clone.ts
-import { execFileSync as execFileSync2 } from "child_process";
-import { mkdirSync, rmSync } from "fs";
-import { tmpdir } from "os";
-import { join as join4 } from "path";
-
-// ../witan/src/cejel-package-name.ts
-import { readFileSync as readFileSync7 } from "fs";
-import { fileURLToPath } from "url";
-
-// ../witan/src/leaderboard.ts
-var RESERVED_CORPUS_SLUGS = ["biome", "tsconfig", "package"];
-var LeaderboardCorpusEntrySchema = external_exports.object({
-  // Also the evidence-report slug (reports/<name>.{json,md,svg}) — min length 3
-  // to satisfy the WitanReport productSlug pattern.
-  name: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/).refine((value) => !RESERVED_CORPUS_SLUGS.includes(value), {
-    message: "Corpus entry name collides with a tool config filename (reports/<name>.json would be discovered by that tool) \u2014 pick a different slug, e.g. biomejs."
-  }),
-  category: external_exports.string().min(1).max(80),
-  expectedArchetype: external_exports.string().min(1).max(40),
-  license: external_exports.string().min(1).max(80),
-  /**
-   * Repository visibility — the redaction policy's first-class input
-   * (goal_cejel_redaction_policy_is_verifiability_2026-07-12): a path is
-   * published exactly when the reader can check it (public), and withheld
-   * entirely when they can't (private). FAIL CLOSED: absent or unrecognized
-   * resolves to 'private' via `.catch` rather than throwing or defaulting
-   * open, so a corpus entry can never accidentally publish paths by omission.
-   */
-  visibility: external_exports.enum(["public", "private"]).catch("private"),
-  url: external_exports.string().url().optional(),
-  /**
-   * Immutable source snapshot for URL entries. A rubric rescore always uses
-   * the same commits; changing one is a separate corpus update.
-   */
-  commit: external_exports.string().regex(/^[0-9a-f]{40}$/).optional(),
-  self: external_exports.literal(true).optional(),
-  /**
-   * A directory inside THIS repository (relative to its root), for internal
-   * entries that are a sub-package rather than the whole repo (e.g. the public
-   * cejel CLI at packages/witan-cli). Scored locally like "self".
-   */
-  path: external_exports.string().min(1).max(200).regex(/^[A-Za-z0-9._/-]+$/).refine((value) => !value.startsWith("/") && !value.split("/").includes(".."), {
-    message: 'Corpus entry "path" must be relative and must not traverse upward.'
-  }).optional()
-}).strict().refine((entry) => (entry.url ? 1 : 0) + (entry.self ? 1 : 0) + (entry.path ? 1 : 0) === 1, {
-  message: 'Corpus entry must have exactly one of "url", "self", or "path".'
-}).refine((entry) => entry.url ? entry.commit !== void 0 : entry.commit === void 0, {
-  message: 'Every URL corpus entry must declare exactly one immutable 40-character "commit".'
-});
-var LeaderboardCorpusSchema = external_exports.object({
-  comment: external_exports.string().min(1),
-  entries: external_exports.array(LeaderboardCorpusEntrySchema).min(1)
-}).strict().refine(
-  (corpus) => new Set(corpus.entries.map((entry) => entry.name)).size === corpus.entries.length,
-  { message: "Corpus entry names must be unique." }
-);
-
-// ../witan/src/quant-integrity.ts
-import { readFileSync as readFileSync10 } from "fs";
-import { join as join8 } from "path";
-
-// ../witan/src/quant-metrics-grading.ts
-import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync9 } from "fs";
-import { join as join7 } from "path";
-
-// ../witan/src/quant-run-tier-grading.ts
-import { createHash as createHash3 } from "crypto";
-
 // src/product-identity.ts
-import { existsSync as existsSync3, readFileSync as readFileSync11 } from "fs";
-import { basename as basename3, join as join9 } from "path";
+import { existsSync, readFileSync as readFileSync6 } from "fs";
+import { basename as basename2, join as join3 } from "path";
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/;
 var FALLBACK_SLUG = "repo";
 var FALLBACK_DISPLAY_NAME = "Repository";
 function deriveProductIdentity(repoPath) {
-  const packageJsonPath = join9(repoPath, "package.json");
-  const raw = readPackageName(packageJsonPath) ?? basename3(repoPath);
+  const packageJsonPath = join3(repoPath, "package.json");
+  const raw = readPackageName(packageJsonPath) ?? basename2(repoPath);
   const displayName = raw.trim().length > 0 ? raw.trim() : FALLBACK_DISPLAY_NAME;
   return {
     productSlug: slugify(raw),
@@ -9437,9 +8092,9 @@ function deriveProductIdentity(repoPath) {
   };
 }
 function readPackageName(packageJsonPath) {
-  if (!existsSync3(packageJsonPath)) return void 0;
+  if (!existsSync(packageJsonPath)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync11(packageJsonPath, "utf8"));
+    const parsed = JSON.parse(readFileSync6(packageJsonPath, "utf8"));
     if (typeof parsed === "object" && parsed !== null && "name" in parsed) {
       const name = parsed.name;
       if (typeof name === "string" && name.trim().length > 0) return name;
@@ -9479,21 +8134,33 @@ function buildWitanCliSummary(report) {
   ).sort();
   const externalSources = summarizeExternalSources(report.consumedSignals ?? []);
   const allExternalFindings = collectExternalFindings(report.consumedSignals ?? []);
-  return {
+  const common = {
     productSlug: report.productSlug,
     productDisplayName: report.productDisplayName,
     generatedAt: report.generatedAt,
-    overallScore: report.overallScore,
-    codeTrustScore: report.codeTrustScore,
-    processTrustScore: report.processTrustScore,
-    verdict: renderReportVerdict(report),
     findingCount: allFindings.length,
     topFindings: sorted.slice(0, TOP_FINDINGS_LIMIT),
     contributingSources,
     externalSources,
     externalFindingCount: allExternalFindings.length,
-    topExternalFindings: allExternalFindings.slice(0, EXTERNAL_FINDINGS_DISPLAY_LIMIT),
-    ...report.insufficientSourceReason ? { insufficientSourceReason: report.insufficientSourceReason } : {}
+    topExternalFindings: allExternalFindings.slice(0, EXTERNAL_FINDINGS_DISPLAY_LIMIT)
+  };
+  if (report.verdict === "insufficient_source") {
+    return {
+      ...common,
+      overallScore: null,
+      codeTrustScore: null,
+      processTrustScore: null,
+      verdict: "Insufficient source",
+      insufficientSourceReason: report.insufficientSourceReason
+    };
+  }
+  return {
+    ...common,
+    overallScore: report.overallScore,
+    codeTrustScore: report.codeTrustScore,
+    processTrustScore: report.processTrustScore,
+    verdict: renderReportVerdict(report)
   };
 }
 
@@ -9515,13 +8182,15 @@ export {
   __commonJS,
   __export,
   __toESM,
-  formatExternalSourceLine,
-  renderWitanHtmlReport,
-  renderWitanBadgeEndpoint,
-  renderWitanBadgeSvg,
   ZodOptional,
   ZodFirstPartyTypeKind,
   objectType,
   external_exports,
+  formatExternalSourceLine,
+  renderWitanHtmlReport,
+  renderWitanBadgeEndpoint,
+  renderWitanBadgeSvg,
+  serializeWitanReport,
+  createWitanAttestation,
   runCejelScan
 };