@cejel/cejel 0.1.4 → 0.1.6

package/README.md

@@ -20,6 +20,10 @@ certificate + badge over all of them. See "Aggregate your scanners" below.
 > monorepo — the ten-product studio it was built inside — which it currently scores
 > 3.1/4.0 ("Conditional"). We score ourselves before asking you to score yourself.
 
+The reusable Barg Labs listing mark is kept at [`brand/barg-icon.png`](./brand/barg-icon.png)
+for directories and registries that accept a custom image. GitHub Actions Marketplace uses
+GitHub's predefined `action.yml` branding icons instead.
+
 ## Install
 
 No account, no key, no signup.
@@ -27,7 +31,15 @@ No account, no key, no signup.
 **Single-file binary.** One file. No Node, no npm, no `node_modules`, nothing installed.
 
 ```bash
-curl -fsSL https://github.com/BargLabs/cejel/releases/latest/download/cejel-$(uname -s)-$(uname -m) -o cejel
+asset="cejel-$(uname -s)-$(uname -m)"
+curl -fsSL "https://github.com/BargLabs/cejel/releases/latest/download/$asset" -o "$asset"
+curl -fsSL https://github.com/BargLabs/cejel/releases/latest/download/SHA256SUMS -o SHA256SUMS
+if command -v sha256sum >/dev/null; then
+  grep "  $asset$" SHA256SUMS | sha256sum -c -
+else
+  grep "  $asset$" SHA256SUMS | shasum -a 256 -c -
+fi
+mv "$asset" cejel
 chmod +x cejel
 ./cejel .
 ```
@@ -41,15 +53,13 @@ product, and you can falsify it in ten seconds:
 docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debian:stable-slim /cejel .
 ```
 
-**npm (scoped package).**
+**npm.**
 
 ```bash
-npx --yes --package @cejel/cejel cejel .
+npx @cejel/cejel .
 ```
 
-The package is published under the `@cejel` scope while the unscoped name is under npm
-registry review. The installed executable remains `cejel`. For a global install, run
-`npm install --global @cejel/cejel`, then invoke `cejel .`.
+The npm package is scoped as `@cejel/cejel`; its executable remains the short command `cejel`.
 
 **GitHub Action** — score every PR and publish the badge:
 
@@ -67,9 +77,34 @@ pnpm install && pnpm build
 node dist/index.js .
 ```
 
-Released binaries: `cejel-Darwin-arm64`, `cejel-Linux-x86_64`. A Homebrew tap and the
-remaining architectures are in progress; they are not listed here because they do not exist
-yet.
+Released binaries: `cejel-Darwin-arm64`, `cejel-Darwin-x86_64`, `cejel-Linux-aarch64`, and
+`cejel-Linux-x86_64`. The release also carries `SHA256SUMS`; each binary is executed against
+the source build and with networking denied before attachment. Releases from v0.1.6 also
+carry a Sigstore bundle containing GitHub's signed build-provenance attestation for all four
+binaries. Verify a downloaded binary with:
+
+```bash
+gh attestation verify ./cejel-Darwin-arm64 -R BargLabs/cejel
+```
+
+This is cryptographically signed provenance. It is distinct from Apple Developer ID or
+Microsoft Authenticode code-signing.
+
+**Docker / OCI.** The same MCP server is published as a non-root, multi-platform image:
+
+```bash
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.1.6
+```
+
+The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
+
+```bash
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.1.6 .
+```
+
+The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
+attestation. It is also the package referenced by [`server.json`](./server.json) for the
+Official MCP Registry.
 
 ## Leaderboard
 
@@ -78,7 +113,7 @@ corpus scored and published in the open — elite OSS projects, Cejel itself, an
 studio monorepo Cejel was built inside — with a per-repository evidence report for every
 row under [`leaderboard/reports/`](./leaderboard/reports/). The board is also hosted at
 [cejel.dev](https://cejel.dev). Every score on this board is produced by the same sealed
-public scorer used by `npx cejel .` — check out the source commit printed in the
+public scorer used by `npx @cejel/cejel .` — check out the source commit printed in the
 report, run the tool, and you will get this number. A required guard does exactly that for
 every corpus row and compares score, verdict, measured coverage, and evidence. No private
 domain collector contributes to any published score, ours included; nobody is exempt.
@@ -123,7 +158,8 @@ better-evidenced rows.
 Scores the current directory with sensible defaults: no flags, no signup, fully offline.
 Prints a concise terminal certificate and writes to `.cejel/`:
 
-- `report.json` — the full structured report
+- `report.json` — the full structured report; scored runs carry numeric headline scores and a
+  score-band `verdict`, while abstained runs carry `null` scores and `verdict: "insufficient_source"`
 - `attestation.json` — an unsigned in-toto statement binding the report digest, repository
   revision, rubric, and scored-or-abstained outcome; ready for an external signer
 - `certificate.html` — a self-contained HTML certificate (no external assets)
@@ -141,8 +177,9 @@ or provenance system signs it, `assurance.status` is `unsigned` and `issuer` is
 - `<path>` — repo to score (default: current directory)
 - `--out <dir>` — where to write report/certificate/badge files (default: `.cejel`;
   `--out-dir` remains available as a compatibility alias)
-- `--min-score <n>` — exit non-zero if the overall score is below `n` (0–4); used by the
-  GitHub Action's optional threshold gate
+- `--min-score <n>` — exit non-zero if the overall score is below `n` (0–4), or if Cejel
+  abstains and therefore cannot evaluate the threshold; used by the GitHub Action's optional
+  threshold gate
 - `--ingest <file|glob>` — fold another scanner's output into the score (repeatable). Accepts
   SARIF, OpenSSF Scorecard JSON, or the generic Cejel external-signal shape — format is
   auto-detected. See "Aggregate your scanners" below.
@@ -168,9 +205,10 @@ honestly rather than guessing:
 - **Not yet recognised** — other ecosystems, including COBOL, Fortran, and MATLAB. Cejel does
   not score these as "source" at all: a repository with zero
   recognised-extension files gets the `unrecognised_ecosystem` archetype, an explicit
-  `insufficient_data` status, and **no verdict** — never a confident numeric score, and never
-  the word "Unverified" for the sole reason that cejel cannot read the language. The
-  certificate states plainly which of the 11 dimensions were and were not measured.
+  `insufficient_data` criterion status, `null` headline scores, and an explicit machine verdict
+  of `insufficient_source` — never a numeric score-band verdict, and never the word
+  "Unverified" for the sole reason that cejel cannot read the language. The certificate states
+  plainly which of the 11 dimensions were and were not measured.
 
 This list will grow. It will never be "any codebase" — that claim is a promise the parser
 cannot keep, and an honest support matrix is worth more than a marketing line the code
@@ -271,6 +309,10 @@ server over stdio, so any MCP client (Claude Code, Cowork, Cursor, Codex) can re
 trust certificate as a tool call. It wraps the exact same scan the CLI runs — same scores,
 same verdict — and is listed on Smithery via the repo's `smithery.yaml`.
 
+The canonical discovery manifest is [`server.json`](./server.json), published under
+`io.github.BargLabs/cejel` in the Official MCP Registry. Its npm ownership metadata,
+OCI ownership label, image version, and registry version are checked together before release.
+
 Add it to an MCP client config:
 
 ```json
@@ -278,7 +320,7 @@ Add it to an MCP client config:
   "mcpServers": {
     "cejel": {
       "command": "npx",
-      "args": ["-y", "--package=cejel", "cejel-mcp"]
+      "args": ["-y", "--package=@cejel/cejel", "cejel-mcp"]
     }
   }
 }
@@ -299,7 +341,7 @@ and the server writes no files.
 ## What "offline" means here
 
 Scoring a repo — `cejel .` itself, and the Action's scoring step — makes zero network
-calls: no telemetry, no signup, no model call. Fetching the `cejel` package the
+calls: no telemetry, no signup, no model call. Fetching the `@cejel/cejel` package the
 first time (like any npm-distributed CLI, including this Action's own dependency install)
 does need network; that's a one-time install cost, not part of the scoring guarantee.