@cejel/cejel 0.1.7 → 0.1.8

package/README.md

@@ -70,7 +70,7 @@ The npm package is scoped as `@cejel/cejel`; its executable remains the short co
 **GitHub Action** — score every PR and publish the badge:
 
 ```yaml
-- uses: BargLabs/cejel/action@v0.1.6
+- uses: BargLabs/cejel/action@v0.1.8
   with:
     min-score: "2.5"   # optional: fail the build below this
 ```
@@ -99,21 +99,21 @@ Microsoft Authenticode code-signing.
 **Docker / OCI.** The same MCP server is published as a non-root, multi-platform image:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.1.6
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.1.8
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.1.6 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.1.8 .
 ```
 
 Beginning with v0.1.7, the standard CLI identity flags are also available directly, while an
 invocation without arguments continues to start the MCP server:
 
 ```bash
-docker run --rm ghcr.io/barglabs/cejel:0.1.7 --version
-docker run --rm ghcr.io/barglabs/cejel:0.1.7 --help
+docker run --rm ghcr.io/barglabs/cejel:0.1.8 --version
+docker run --rm ghcr.io/barglabs/cejel:0.1.8 --help
 ```
 
 The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
@@ -324,7 +324,7 @@ a configurable `min-score` threshold. The scoring step makes no network calls an
 secrets.
 
 ```yaml
-- uses: BargLabs/cejel/action@v0.1.6
+- uses: BargLabs/cejel/action@v0.1.8
   with:
     min-score: '2.5' # optional; omit to never fail the check
 ```
@@ -403,7 +403,7 @@ enforced structurally — the public artifacts are built from filtered data rath
 rendered and then scrubbed — and a build that would emit a private path fails rather than
 publishes.
 
-**What we exclude from ranking.** The v5 repository scanner does not evaluate B1 (dispatch
+**What we exclude from ranking.** The v6 repository scanner does not evaluate B1 (dispatch
 trace completeness) or B5 (verified learning trace) for repository inputs, including ours:
 both are always *not applicable* in a repository certificate. They remain defined in the
 rubric for structured substrate evidence, but that evidence is not accepted by this scanner.
@@ -480,6 +480,11 @@ scoring tool that has not been checked:
   "Unverified". Every real legacy repository has a deploy script, so the fix that passed every
   test was unreachable for essentially all of them. Recognised source must now be *dominant*,
   not merely present. **A fixture cleaner than reality proves nothing.**
+- **Version 0.1.7 missed AVA's root-level `test.js` convention.** A smoke test against
+  `sindresorhus/slugify` reported that a runner was configured but no concrete test files were
+  detected even though `test.js` was present at the repository root. That was a detection gap
+  in Cejel, not evidence about the repository. Rubric v6 recognizes AVA's `test.js` and
+  `test-*.js` conventions; a regression fixture preserves the correction.
 
 Every one was a trust failure produced by *us* — false alarms about other people's code,
 silent omissions, inconsistent presentation, or a home-only scoring path — and we would

package/dist/{chunk-OMIRVZSF.js → chunk-SFEPABAX.js}

@@ -4076,7 +4076,8 @@ var WITAN_RUBRIC_VERSION_V2 = "witan-rubric-v2-2026-07-12";
 var WITAN_RUBRIC_VERSION_V3 = "witan-rubric-v3-2026-07-13";
 var WITAN_RUBRIC_VERSION_V4 = "witan-rubric-v4-2026-07-18";
 var WITAN_RUBRIC_VERSION_V5 = "witan-rubric-v5-2026-07-18";
-var WITAN_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V5;
+var WITAN_RUBRIC_VERSION_V6 = "witan-rubric-v6-2026-07-21";
+var WITAN_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V6;
 var WITAN_TRADING_RUBRIC_VERSION_V0 = "witan-trading-rubric-v0-2026-07-01";
 var WITAN_CRITERION_IDS = [
   "A1",
@@ -6329,9 +6330,11 @@ function isProductionSourcePath(path) {
 function isTestFile(file) {
   return /(^|\/)(__tests__|test|tests|spec)\/.*\.(?:[cm]?[jt]sx?|py|go|rs|java|rb|cpp|cc|cxx)$/.test(
     file
-  ) || /\.(test|spec)\.[cm]?[jt]sx?$/.test(file) || /(^|\/)test_.*\.py$/.test(file) || /_test\.go$/.test(file) || /(^|\/)test_.*\.(cpp|cc|cxx)$/.test(file) || /_(test|tests)\.(cpp|cc|cxx)$/.test(file) || /Tests?\.(java|kt)$/.test(file) || /(_test|_spec)\.(rs|rb|php|swift|kt)$/.test(file);
+  ) || // AVA's default discovery includes test.js and test-*.js at the scanned package root.
+  // Keep this root-anchored: nested files need an existing test-directory/suffix convention.
+  /^test(?:-[^/]+)?\.[cm]?[jt]sx?$/.test(file) || /\.(test|spec)\.[cm]?[jt]sx?$/.test(file) || /(^|\/)test_.*\.py$/.test(file) || /_test\.go$/.test(file) || /(^|\/)test_.*\.(cpp|cc|cxx)$/.test(file) || /_(test|tests)\.(cpp|cc|cxx)$/.test(file) || /Tests?\.(java|kt)$/.test(file) || /(_test|_spec)\.(rs|rb|php|swift|kt)$/.test(file);
 }
-var NAME_SHAPED_TEST_FILE_PATTERN = /\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)__tests__\/|(^|\/)test_[^/]*\.py$|(^|\/)tests?\.py$|_test\.go$|(^|\/)test_[^/]*\.(cpp|cc|cxx)$|_(test|tests)\.(cpp|cc|cxx)$|Tests?\.(java|kt)$|(_test|_spec)\.(rs|rb|php|swift|kt)$/;
+var NAME_SHAPED_TEST_FILE_PATTERN = /^test(?:-[^/]+)?\.[cm]?[jt]sx?$|\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)__tests__\/|(^|\/)test_[^/]*\.py$|(^|\/)tests?\.py$|_test\.go$|(^|\/)test_[^/]*\.(cpp|cc|cxx)$|_(test|tests)\.(cpp|cc|cxx)$|Tests?\.(java|kt)$|(_test|_spec)\.(rs|rb|php|swift|kt)$/;
 var TEST_RUNNER_PATTERN = /\b(vitest|jest|mocha|ava|tap|pytest|go test|cargo test|rspec|phpunit|gradle test|mvn test)\b/i;
 var CI_TEST_COMMAND_PATTERN = /\b(pytest|go\s+test|cargo\s+test|mvn\s+test|gradle\s+test|ctest|make\s+test|jest|vitest|mocha|rspec|phpunit|pnpm\s+test|npm\s+test|yarn\s+test|node\s+--test|node:test)\b/i;
 var CI_LINT_COMMAND_PATTERN = /\b(eslint|pylint|flake8|black|ruff)\b/i;
@@ -7937,7 +7940,7 @@ function mergeSignalsByCriterion(signals) {
   return merged;
 }
 function usesMetricScoring(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
 }
 function unmeasuredStatus(rubricVersion) {
   return rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0 ? "unverified" : "insufficient_data";

package/dist/index.js

@@ -9,7 +9,7 @@ import {
   runCejelScan,
   serializeWitanReport,
   verifyWitanAttestationBinding
-} from "./chunk-OMIRVZSF.js";
+} from "./chunk-SFEPABAX.js";
 
 // src/index.ts
 import { createHash } from "crypto";

package/dist/mcp/index.js

@@ -10,7 +10,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "../chunk-OMIRVZSF.js";
+} from "../chunk-SFEPABAX.js";
 
 // node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {