@cejel/cejel 0.1.7 → 0.1.9

package/dist/{chunk-OMIRVZSF.js → chunk-DVVBWBAA.js}

@@ -4076,7 +4076,11 @@ var WITAN_RUBRIC_VERSION_V2 = "witan-rubric-v2-2026-07-12";
 var WITAN_RUBRIC_VERSION_V3 = "witan-rubric-v3-2026-07-13";
 var WITAN_RUBRIC_VERSION_V4 = "witan-rubric-v4-2026-07-18";
 var WITAN_RUBRIC_VERSION_V5 = "witan-rubric-v5-2026-07-18";
-var WITAN_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V5;
+var WITAN_RUBRIC_VERSION_V6 = "witan-rubric-v6-2026-07-21";
+var WITAN_RUBRIC_VERSION_V7 = "witan-rubric-v7-2026-07-21";
+var WITAN_RUBRIC_VERSION_V8 = "witan-rubric-v8-2026-07-21";
+var WITAN_RUBRIC_VERSION_V9 = "witan-rubric-v9-2026-07-22";
+var WITAN_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V9;
 var WITAN_TRADING_RUBRIC_VERSION_V0 = "witan-trading-rubric-v0-2026-07-01";
 var WITAN_CRITERION_IDS = [
   "A1",
@@ -4144,6 +4148,8 @@ var WITAN_REPO_ARCHETYPES = [
   "monorepo",
   "docs_only",
   "binary_only",
+  "generated_only",
+  "non_cohesive_source",
   "unrecognised_ecosystem",
   "empty"
 ];
@@ -4359,6 +4365,39 @@ var WitanAttestationStatementSchema = external_exports.object({
   }).strict()
 }).strict();
 
+// src/witan/coverage.ts
+var LOW_CONFIDENCE_COVERAGE_THRESHOLD = 0.5;
+function isMeasuredCriterionStatus(status) {
+  return status !== "not_applicable" && status !== "insufficient_data";
+}
+function computeMeasuredCoverage(report) {
+  const byCategory = [];
+  const overall = { measured: 0, total: 0 };
+  for (const criterion of report.criteria) {
+    let bucket = byCategory.find((entry) => entry.category === criterion.category);
+    if (!bucket) {
+      bucket = { category: criterion.category, measured: 0, total: 0 };
+      byCategory.push(bucket);
+    }
+    bucket.total += 1;
+    overall.total += 1;
+    if (isMeasuredCriterionStatus(criterion.status)) {
+      bucket.measured += 1;
+      overall.measured += 1;
+    }
+  }
+  const lowConfidence = [...byCategory, overall].some(
+    (counts) => counts.total > 0 && counts.measured / counts.total < LOW_CONFIDENCE_COVERAGE_THRESHOLD
+  );
+  return { byCategory, overall, lowConfidence };
+}
+function shortCategoryLabel(category) {
+  return category.replace(/_trust$/, "").replaceAll("_", " ");
+}
+function formatCoverageCounts(coverage) {
+  return coverage.byCategory.map((entry) => `${shortCategoryLabel(entry.category)} ${entry.measured}/${entry.total}`).join(" \xB7 ");
+}
+
 // src/witan/external-findings.ts
 var EXTERNAL_FINDINGS_DISPLAY_LIMIT = 10;
 var SEVERITY_RANK = {
@@ -4423,6 +4462,7 @@ function renderWitanHtmlReport(report) {
   const contributingSources = renderContributingSources(report.consumedSignals ?? []);
   const externalSourceSummaries = summarizeExternalSources(report.consumedSignals ?? []);
   const externalFindings = collectExternalFindings(report.consumedSignals ?? []);
+  const coverage = computeMeasuredCoverage(report);
   return `<!doctype html>
 <html lang="en">
 <head>
@@ -4456,9 +4496,10 @@ function renderWitanHtmlReport(report) {
           <div class="score-unit">/ 4.0 overall</div>
           <div class="verdict">${escapeHtml(renderVerdict(report.overallScore))}</div>
           <div class="subscores">
-            <span>Code ${formatScore(report.codeTrustScore)}</span>
-            <span>Process ${formatScore(report.processTrustScore)}</span>
-          </div>`}
+            <span>Code ${renderCategoryScore(report.codeTrustScore, coverage, "code_trust")}</span>
+            <span>Process ${renderCategoryScore(report.processTrustScore, coverage, "process_trust")}</span>
+          </div>
+          <div class="coverage-note">${escapeHtml(formatCoverageCounts(coverage))} measured${coverage.lowConfidence ? " \xB7 low confidence" : ""}</div>`}
         </aside>
       </div>
     </header>
@@ -4556,10 +4597,17 @@ function renderCriterionCard(criterion) {
           </article>`;
 }
 function renderMetric(metric2) {
-  const max = metric2.max ? `/${formatMetricValue(metric2.max)}` : "";
   const unit = metric2.unit ? ` ${escapeHtml(metric2.unit)}` : "";
+  if (metric2.kind === "saturating_count" && metric2.max !== void 0 && metric2.value > metric2.max) {
+    return `<strong>${escapeHtml(metric2.label)}</strong><span>${formatMetricValue(metric2.max)}${unit} (capped; ${formatMetricValue(metric2.value)} raw)</span>`;
+  }
+  const max = metric2.max ? `/${formatMetricValue(metric2.max)}` : "";
   return `<strong>${escapeHtml(metric2.label)}</strong><span>${formatMetricValue(metric2.value)}${max}${unit}</span>`;
 }
+function renderCategoryScore(score, coverage, category) {
+  const categoryCoverage = coverage.byCategory.find((entry) => entry.category === category);
+  return categoryCoverage !== void 0 && categoryCoverage.measured === 0 || score === null ? "not measured" : formatScore(score);
+}
 function renderStatusChip(status) {
   return `<span class="status" data-status="${status}">${status}</span>`;
 }
@@ -4700,6 +4748,7 @@ dd { margin: 0; color: var(--muted); overflow-wrap: anywhere; }
 .verdict { margin-top: 12px; font-family: var(--serif); font-size: 30px; color: var(--periwinkle); }
 .insufficient-note { margin-top: 10px; color: var(--muted); font-size: 13px; line-height: 1.5; }
 .subscores { display: flex; gap: 12px; flex-wrap: wrap; margin-top: 18px; color: var(--muted); font-family: var(--mono); font-size: 12px; }
+.coverage-note { margin-top: 8px; color: var(--faint); font-family: var(--mono); font-size: 11px; }
 .source-counts { margin: 8px 0 0; padding-left: 18px; font-family: var(--mono); font-size: 12px; color: var(--muted); }
 .trust-grid, .evidence-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 18px; margin-top: 28px; }
 .external-findings-section { margin-top: 18px; }
@@ -4914,21 +4963,59 @@ function verifyWitanAttestationBinding(statement, report, options = {}) {
 // src/witan/repo-signals.ts
 import { execFileSync } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { lstatSync, readFileSync, readdirSync, realpathSync, statSync } from "fs";
-import { basename, join, relative, resolve, sep } from "path";
+import {
+  closeSync,
+  lstatSync,
+  openSync,
+  readFileSync,
+  readSync,
+  readdirSync,
+  realpathSync,
+  statSync
+} from "fs";
+import { basename, dirname, extname, join, relative, resolve, sep } from "path";
 
 // src/witan/json-safe.ts
 function stripBom(text) {
   return text.charCodeAt(0) === 65279 ? text.slice(1) : text;
 }
 
+// src/witan/rubric-version.ts
+var WITAN_RUBRIC_VERSION_V92 = "witan-rubric-v9-2026-07-22";
+var WITAN_RUBRIC_VERSION_V10 = "witan-rubric-v10-2026-07-23";
+var WITAN_RUBRIC_VERSION_V11 = "witan-rubric-v11-2026-07-23";
+var WITAN_RUBRIC_VERSION_V12 = "witan-rubric-v12-2026-07-23";
+var WITAN_RUBRIC_VERSION_V13 = "witan-rubric-v13-2026-07-23";
+var WITAN_RUBRIC_VERSION_V14 = "witan-rubric-v14-2026-07-23";
+var WITAN_RUBRIC_VERSION_V15 = "witan-rubric-v15-2026-07-24";
+
 // src/witan/repo-signals.ts
 function buildWitanInputFromRepo(options) {
   assertRepoPathExists(options.repoPath);
   const generatedAt = options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const rubricVersion = options.rubricVersion ?? WITAN_RUBRIC_VERSION;
   const headSha = readGitHead(options.repoPath);
   const repoFiles = listRepoFiles(options.repoPath);
-  const archetype = classifyRepoArchetype(repoFiles);
+  const inventoryFiles = listRepoInventory(options.repoPath, repoFiles);
+  const structuralArchetype = classifyRepoArchetype(inventoryFiles, rubricVersion);
+  const readableArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 ? applyReadableSourceRepresentationGate(
+    options.repoPath,
+    inventoryFiles,
+    structuralArchetype,
+    headSha,
+    rubricVersion
+  ) : structuralArchetype;
+  const archetype = rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 ? applySemanticSourceRepresentationGate(
+    options.repoPath,
+    inventoryFiles,
+    readableArchetype,
+    rubricVersion
+  ) : readableArchetype;
+  const usesV8Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15;
+  const usesV33Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15;
+  const usesV36Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15;
+  const usesV39Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15;
+  const usesV47Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V15;
   return {
     productSlug: options.productSlug,
     productDisplayName: options.productDisplayName,
@@ -4941,7 +5028,16 @@ function buildWitanInputFromRepo(options) {
     archetype: archetype.archetype,
     ...archetype.insufficientSourceReason ? { insufficientSourceReason: archetype.insufficientSourceReason } : {},
     signals: [
-      ...collectRepoSignals(options.repoPath, generatedAt, repoFiles),
+      ...collectRepoSignals(
+        options.repoPath,
+        generatedAt,
+        repoFiles,
+        usesV8Detectors,
+        usesV33Detectors,
+        usesV36Detectors,
+        usesV39Detectors,
+        usesV47Detectors
+      ),
       ...(options.domainCollectors ?? []).map((collect) => collect(options.repoPath, repoFiles)),
       ...options.additionalSignals ?? []
     ]
@@ -4966,7 +5062,7 @@ var SOURCE_LANGUAGES = [
   { name: "Dart", tier: "partial", extensions: ["dart"] },
   { name: "Elixir", tier: "partial", extensions: ["ex", "exs"] },
   { name: "Scala", tier: "partial", extensions: ["scala"] },
-  { name: "shell", tier: "unmodelled", extensions: ["sh", "bash", "zsh"] },
+  { name: "shell", tier: "unmodelled", extensions: ["sh", "bash", "zsh", "bat", "cmd"] },
   { name: "R", tier: "unmodelled", extensions: ["r"] },
   { name: "Lua", tier: "unmodelled", extensions: ["lua"] },
   { name: "Julia", tier: "unmodelled", extensions: ["jl"] },
@@ -4980,20 +5076,73 @@ var SOURCE_LANGUAGES = [
   { name: "Nim", tier: "unmodelled", extensions: ["nim"] },
   { name: "Zig", tier: "unmodelled", extensions: ["zig"] },
   { name: "F#", tier: "unmodelled", extensions: ["fs", "fsx"] },
-  { name: "Groovy", tier: "unmodelled", extensions: ["groovy", "gvy"] }
+  { name: "Groovy", tier: "unmodelled", extensions: ["groovy", "gvy"] },
+  { name: "Fortran", tier: "unmodelled", extensions: ["f", "for", "f77", "f90", "f95", "f03"] },
+  { name: "CUDA/HIP", tier: "unmodelled", extensions: ["cu", "cuh", "hip"] },
+  {
+    name: "Web templates/styles",
+    tier: "unmodelled",
+    extensions: [
+      "html",
+      "htm",
+      "css",
+      "scss",
+      "sass",
+      "less",
+      "hbs",
+      "handlebars",
+      "variables",
+      "overrides",
+      "vue",
+      "svelte",
+      "astro",
+      "erb",
+      "haml",
+      "slim",
+      "erubis",
+      "hamlit"
+    ]
+  }
+];
+var SOURCE_LANGUAGES_V10 = [
+  ...SOURCE_LANGUAGES,
+  { name: "COBOL", tier: "unmodelled", extensions: ["cob", "cbl", "cpy"] },
+  { name: "MATLAB/Objective-C", tier: "unmodelled", extensions: ["m"] }
 ];
 var SOURCE_EXTENSION_PATTERN = new RegExp(
   `\\.(${SOURCE_LANGUAGES.flatMap((language) => language.extensions).join("|")})$`,
   "i"
 );
-var BUNDLED_BINARY_EXTENSION_PATTERN = /\.(vsix|zip|tgz|whl|exe|dmg|pkg|msi|jar|war|apk|ipa|dll|dylib)$/i;
+var SOURCE_EXTENSION_PATTERN_V10 = new RegExp(
+  `\\.(${SOURCE_LANGUAGES_V10.flatMap((language) => language.extensions).join("|")})$`,
+  "i"
+);
+function isRecognizedSourcePath(path, rubricVersion = WITAN_RUBRIC_VERSION) {
+  return (rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 ? SOURCE_EXTENSION_PATTERN_V10 : SOURCE_EXTENSION_PATTERN).test(path);
+}
+var BUNDLED_BINARY_EXTENSION_PATTERN = /\.(vsix|zip|tgz|whl|exe|dmg|pkg|msi|jar|war|apk|ipa|dll|dylib|ttf|otf|woff2?|eot|eps)$/i;
 var DOCS_OR_MEDIA_EXTENSION_PATTERN = /\.(md|mdx|rst|png|jpe?g|gif|svg|webp|ico|pdf)$/i;
-var KNOWN_NON_SOURCE_EXTENSION_PATTERN = /\.(json|jsonc|json5|ya?ml|toml|txt|lock|xml|csv|tsv|ini|cfg|conf|properties|env|sum|mod|graphql|gql|proto|editorconfig|gitignore|gitattributes|npmrc|nvmrc|dockerignore|log|txt\.license)$/i;
+var ARTIFACT_DOMINANCE_EXTENSION_PATTERN = /\.(vsix|zip|tgz|whl|exe|dmg|pkg|msi|jar|war|apk|ipa|dll|dylib|ttf|otf|woff2?|eot|eps|png|jpe?g|gif|svg|webp|ico|pdf)$/i;
+var DOC_DISTRIBUTION_COMPANION_PATTERN = /(^|\/)(LICENSE|LICENCE|NOTICE|COPYING|AUTHORS|CONTRIBUTORS|CODE_OF_CONDUCT)(\.[A-Za-z0-9]+)?$/i;
+var GENERATED_OR_VENDOR_PATH_PATTERN = /(^|\/)(vendor|vendors|dist|build|generated|gen|coverage|node_modules|site-packages|\.venv|venv|\.next|__pycache__|\.terraform|public\/assets|static\/assets)(\/|$)|(^|\/)[^/]+\.min\.(?:js|css)$/i;
+var INDEPENDENT_CATALOG_PATH_PATTERN = /(^|\/)(solutions?|exercises?|challenges?|algorithms?)(\/|$)/i;
+var KNOWN_NON_SOURCE_EXTENSION_PATTERN = /\.(json|jsonc|json5|ya?ml|toml|txt|lock|xml|csv|tsv|ini|cfg|conf|cnf|properties|env|sum|mod|graphql|gql|proto|sarif|editorconfig|gitignore|gitattributes|npmrc|nvmrc|dockerignore|prettierignore|prettierrc|log|stderr|snap|grit|po|mo|dbf|shp|shx|egg|pem|key|csr|ai|txt\.license|pf|in|case|common|fortls)$/i;
+var V13_NON_SOURCE_EXTENSION_PATTERN = /\.(?:\d+|class|py[co]|gz|bz2|xz|7z|rar|mat|npy|npz|h5|hdf5|onnx|pt|pth|ckpt|safetensors|crt|cer|der|p12|pfx|diff|patch|plist|pbxproj|xcworkspacedata|xcbuild|xcplayground|xcscheme|xcsettings|xcconfig|xcprivacy|xcstrings|csproj|fsproj|vbproj|sln|slnf|props|targets|projitems|shproj|pubxml|resw|resources|storyboard|xib|entitlements|modulemap|podspec|nuspec|appxmanifest|webmanifest|manifest|map|fls|aux|bbl|bib|ocm|tdb|db|sqlite|sqlcipher\d*|bin|dat|pdb|prj|resolved|sim|input|list|fig|drawio|puml|sketch|icns|flac|wav|mp3|mp4|mov|avi|mkv|nv21|xls[xb]?|mex[a-z0-9_]*|gitconfig|profile|yapf|config|desktop|typed|example|bak|_|test(?:_[a-z0-9]+)*_location_override|xamltest|tld(?:_[a-z0-9]+)?|xsd|cmake|gradle|mk|am|pro|upri|dockerfile|dockergen|makefile|alpine|android|debian|ubuntu\d+|cuda\d+_ubuntu\d+|manylinux[a-z0-9_]*)$/i;
 var INGEST_POINTER = "To assess a closed/bundled tool, ingest its scanner output via --ingest <sarif|scorecard>.";
-var SOURCE_DOMINANCE_RATIO_THRESHOLD = 0.2;
-function classifyRepoArchetype(repoFiles) {
+var SOURCE_DOMINANCE_RATIO_THRESHOLD_V8 = 0.2;
+var SOURCE_DOMINANCE_RATIO_THRESHOLD_V9 = 0.8;
+var SOURCE_DOMINANCE_RATIO_THRESHOLD_V10 = 0.5;
+var SOURCE_DOMINANCE_RATIO_THRESHOLD_V11 = 0.2;
+var GENERATED_SOURCE_MINIMUM = 8;
+var GENERATED_SOURCE_RATIO_THRESHOLD = 0.8;
+var GENERATED_AUTHORED_MAXIMUM = 3;
+var CATALOG_SOURCE_MINIMUM = 12;
+var CATALOG_SOURCE_RATIO_THRESHOLD = 0.9;
+var CATALOG_OUTSIDE_MAXIMUM = 2;
+function classifyRepoArchetype(repoFiles, rubricVersion = WITAN_RUBRIC_VERSION) {
   const totalFileCount = repoFiles.length;
-  const sourceFileCount = repoFiles.filter((file) => SOURCE_EXTENSION_PATTERN.test(file)).length;
+  const sourceFiles = repoFiles.filter((path) => isRecognizedSourcePath(path, rubricVersion));
+  const sourceFileCount = sourceFiles.length;
   if (totalFileCount === 0) {
     return {
       archetype: "empty",
@@ -5002,7 +5151,55 @@ function classifyRepoArchetype(repoFiles) {
       insufficientSourceReason: "Repository has no tracked files \u2014 there is nothing to certify."
     };
   }
-  const unrecognisedSourceFiles = collectUnrecognisedSourceFiles(repoFiles);
+  const generatedSourceFiles = sourceFiles.filter(
+    (file) => GENERATED_OR_VENDOR_PATH_PATTERN.test(file)
+  );
+  if (sourceFileCount >= GENERATED_SOURCE_MINIMUM && generatedSourceFiles.length / sourceFileCount >= GENERATED_SOURCE_RATIO_THRESHOLD && sourceFileCount - generatedSourceFiles.length <= GENERATED_AUTHORED_MAXIMUM) {
+    return {
+      archetype: "generated_only",
+      sourceFileCount,
+      totalFileCount,
+      insufficientSourceReason: `${generatedSourceFiles.length} of ${sourceFileCount} source-shaped file(s) are under generated, vendor, build, distribution, coverage, or bundled-asset paths; only ${sourceFileCount - generatedSourceFiles.length} authored source-shaped file(s) remain. Cejel abstains because generated/vendor output is not a reviewable implementation surface. ${INGEST_POINTER}`
+    };
+  }
+  const catalogSourceFiles = sourceFiles.filter(
+    (file) => INDEPENDENT_CATALOG_PATH_PATTERN.test(file)
+  );
+  if (sourceFileCount >= CATALOG_SOURCE_MINIMUM && catalogSourceFiles.length / sourceFileCount >= CATALOG_SOURCE_RATIO_THRESHOLD && sourceFileCount - catalogSourceFiles.length <= CATALOG_OUTSIDE_MAXIMUM) {
+    return {
+      archetype: "non_cohesive_source",
+      sourceFileCount,
+      totalFileCount,
+      insufficientSourceReason: `${catalogSourceFiles.length} of ${sourceFileCount} source-shaped file(s) are under independent solution, exercise, challenge, or algorithm catalog paths; only ${sourceFileCount - catalogSourceFiles.length} source-shaped file(s) remain outside that catalog. Cejel abstains because the repository does not expose one cohesive product implementation to score. ${INGEST_POINTER}`
+    };
+  }
+  if (rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15) {
+    const authoredSourceFiles = sourceFiles.filter(isAuthoredProductionPath);
+    const documentationFiles = repoFiles.filter(
+      (file) => DOCS_OR_MEDIA_EXTENSION_PATTERN.test(file)
+    );
+    if (sourceFileCount > 0 && authoredSourceFiles.length === 0 && documentationFiles.length > 0) {
+      return {
+        archetype: "docs_only",
+        sourceFileCount,
+        totalFileCount,
+        insufficientSourceReason: `${sourceFileCount} source-shaped file(s) are tests/fixtures around a documentation tree; no authored product source remains. Cejel abstains because documentation tests do not support a product-source headline score. ${INGEST_POINTER}`
+      };
+    }
+    const artifactFiles = repoFiles.filter(
+      (file) => ARTIFACT_DOMINANCE_EXTENSION_PATTERN.test(file)
+    );
+    const materialFiles = authoredSourceFiles.length + artifactFiles.length;
+    if (artifactFiles.length >= 10 && (authoredSourceFiles.length <= 10 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15) && materialFiles > 0 && authoredSourceFiles.length / materialFiles <= 0.1) {
+      return {
+        archetype: "binary_only",
+        sourceFileCount,
+        totalFileCount,
+        insufficientSourceReason: `${authoredSourceFiles.length} authored source-shaped file(s) accompany ${artifactFiles.length} packaged, font, image, or media artifact(s); the source is sparse tooling rather than a representative product implementation. Cejel abstains because incidental tooling cannot support a product-source headline score. ${INGEST_POINTER}`
+      };
+    }
+  }
+  const unrecognisedSourceFiles = collectUnrecognisedSourceFiles(repoFiles, rubricVersion);
   if (sourceFileCount === 0) {
     const binaryFiles = repoFiles.filter((file) => BUNDLED_BINARY_EXTENSION_PATTERN.test(file));
     if (binaryFiles.length > 0) {
@@ -5015,7 +5212,10 @@ function classifyRepoArchetype(repoFiles) {
       };
     }
     const docsFiles = repoFiles.filter((file) => DOCS_OR_MEDIA_EXTENSION_PATTERN.test(file));
-    if (docsFiles.length > 0 && docsFiles.length === totalFileCount) {
+    const docsDistributionFiles = repoFiles.filter(
+      (file) => DOCS_OR_MEDIA_EXTENSION_PATTERN.test(file) || DOC_DISTRIBUTION_COMPANION_PATTERN.test(file)
+    );
+    if (docsFiles.length > 0 && (docsDistributionFiles.length === totalFileCount || (rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15) && unrecognisedSourceFiles.length === 0)) {
       return {
         archetype: "docs_only",
         sourceFileCount,
@@ -5024,7 +5224,12 @@ function classifyRepoArchetype(repoFiles) {
       };
     }
     if (unrecognisedSourceFiles.length > 0) {
-      return unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognisedSourceFiles);
+      return unrecognisedEcosystemResult(
+        sourceFileCount,
+        totalFileCount,
+        unrecognisedSourceFiles,
+        sourceDominanceThreshold(rubricVersion)
+      );
     }
     return { archetype: "source", sourceFileCount, totalFileCount };
   }
@@ -5036,25 +5241,255 @@ function classifyRepoArchetype(repoFiles) {
     };
   }
   const dominanceRatio = sourceFileCount / (sourceFileCount + unrecognisedSourceFiles.length);
-  if (dominanceRatio >= SOURCE_DOMINANCE_RATIO_THRESHOLD) {
+  const dominanceThreshold = sourceDominanceThreshold(rubricVersion);
+  if (dominanceRatio >= dominanceThreshold) {
     return {
       archetype: isLikelyMonorepo(repoFiles) ? "monorepo" : "source",
       sourceFileCount,
       totalFileCount
     };
   }
-  return unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognisedSourceFiles);
+  return unrecognisedEcosystemResult(
+    sourceFileCount,
+    totalFileCount,
+    unrecognisedSourceFiles,
+    dominanceThreshold
+  );
 }
-function collectUnrecognisedSourceFiles(repoFiles) {
-  return repoFiles.filter((file) => {
-    const base = basename(file);
-    if (!/\.([a-zA-Z0-9_]+)$/.test(base)) return false;
-    if (KNOWN_NON_SOURCE_EXTENSION_PATTERN.test(base)) return false;
-    if (DOCS_OR_MEDIA_EXTENSION_PATTERN.test(base)) return false;
-    if (BUNDLED_BINARY_EXTENSION_PATTERN.test(base)) return false;
-    if (SOURCE_EXTENSION_PATTERN.test(base)) return false;
-    return true;
-  });
+var READABLE_SOURCE_REPRESENTATION_THRESHOLD_V13 = 0.8;
+var READABLE_SOURCE_REPRESENTATION_SAMPLE_LIMIT_V13 = 32;
+var READABLE_SOURCE_REPRESENTATION_FILE_BYTES_V13 = 256 * 1024;
+var SEMANTIC_AUXILIARY_SOURCE_MINIMUM_V14 = 20;
+var SEMANTIC_AUXILIARY_SOURCE_RATIO_V14 = 0.8;
+var SEMANTIC_METADATA_PREFIX_BYTES_V14 = 16 * 1024;
+var SEMANTIC_AUXILIARY_PATH_PATTERN_V14 = /(^|\/)(?:locales?|i18n|l10n|translations?|styles?|themes?)(\/|$)|\.(?:css|scss|sass|less|styl)$/i;
+var HTML_SOURCE_EXTENSION_PATTERN = /\.(?:html?|xhtml)$/i;
+var HTML_META_REFRESH_PATTERN = /<meta\b(?=[^>]*\bhttp-equiv\s*=\s*["']?\s*refresh\b)(?=[^>]*\bcontent\s*=\s*["'][^"']*\burl\s*=)[^>]*>/i;
+var RUBY_PACKAGE_RECIPE_CLASS_PATTERN = /\bclass\s+[A-Za-z0-9_:]+\s*<\s*(?:Formula|Cask)\b/;
+var RUBY_PACKAGE_RECIPE_URL_PATTERN = /^\s*url\s+["'][^"']+["']/m;
+var RUBY_PACKAGE_RECIPE_PATH_PATTERN = /(^|\/)(?:Formula|Casks?)(\/|$)/;
+function selectProportionalRepresentativeSourceFiles(files, rankKey, limit) {
+  const eligibleFiles = [...new Set(files)];
+  const slotCount = Math.min(Math.max(Math.floor(limit), 0), eligibleFiles.length);
+  if (slotCount === 0) return [];
+  const grouped = /* @__PURE__ */ new Map();
+  for (const file of eligibleFiles) {
+    const extension = extname(file).toLowerCase() || "(none)";
+    const bucket = grouped.get(extension) ?? [];
+    bucket.push(file);
+    grouped.set(extension, bucket);
+  }
+  const groups = [...grouped.entries()].map(([extension, groupFiles]) => {
+    const quota = groupFiles.length / eligibleFiles.length * slotCount;
+    return {
+      extension,
+      files: [...groupFiles].sort(
+        (left, right) => representativeSourceRank(rankKey, left).localeCompare(
+          representativeSourceRank(rankKey, right)
+        )
+      ),
+      allocation: Math.floor(quota),
+      remainder: quota - Math.floor(quota)
+    };
+  }).sort(
+    (left, right) => right.files.length - left.files.length || left.extension.localeCompare(right.extension)
+  );
+  let remaining = slotCount - groups.reduce((sum, group) => sum + group.allocation, 0);
+  const remainderOrder = [...groups].sort(
+    (left, right) => right.remainder - left.remainder || right.files.length - left.files.length || left.extension.localeCompare(right.extension)
+  );
+  for (const group of remainderOrder) {
+    if (remaining === 0) break;
+    if (group.allocation >= group.files.length) continue;
+    group.allocation += 1;
+    remaining -= 1;
+  }
+  const selected = [];
+  for (let offset = 0; selected.length < slotCount; offset += 1) {
+    let added = false;
+    for (const group of groups) {
+      if (offset >= group.allocation) continue;
+      const file = group.files[offset];
+      if (!file) continue;
+      selected.push(file);
+      added = true;
+    }
+    if (!added) break;
+  }
+  return selected;
+}
+function isRepresentativeSourceText(contents) {
+  if (contents.trim().length === 0) return false;
+  if (contents.includes("\0") || contents.includes("\uFFFD")) return false;
+  let disallowedControls = 0;
+  for (const character of contents) {
+    const code = character.charCodeAt(0);
+    if (code < 32 && character !== "\n" && character !== "\r" && character !== "	") {
+      disallowedControls += 1;
+    }
+  }
+  return disallowedControls / contents.length <= 0.01;
+}
+function representativeSourceRank(rankKey, file) {
+  return createHash2("sha256").update(`${rankKey}:${file}`).digest("hex");
+}
+function applyReadableSourceRepresentationGate(repoPath, repoFiles, classification, headSha, rubricVersion) {
+  if (classification.archetype !== "source" && classification.archetype !== "monorepo") {
+    return classification;
+  }
+  const authoredSourceFiles = repoFiles.filter(
+    (path) => isAuthoredProductionPath(path) && (isRecognizedSourcePath(path, rubricVersion) || isUnrecognisedSourcePath(path, rubricVersion) || /\.ipynb$/i.test(path))
+  );
+  if (authoredSourceFiles.length === 0) return classification;
+  const sample = selectProportionalRepresentativeSourceFiles(
+    authoredSourceFiles,
+    `witan-v13-readable-source:${headSha ?? "unversioned"}`,
+    READABLE_SOURCE_REPRESENTATION_SAMPLE_LIMIT_V13
+  );
+  const sampledByExtension = /* @__PURE__ */ new Map();
+  for (const file of sample) {
+    const extension = extname(file).toLowerCase() || "(none)";
+    const counts = sampledByExtension.get(extension) ?? { sampled: 0, readable: 0 };
+    counts.sampled += 1;
+    const contents = readRepresentativeSourceText(repoPath, file);
+    if (contents !== null && isRepresentativeSourceText(contents)) {
+      counts.readable += 1;
+    }
+    sampledByExtension.set(extension, counts);
+  }
+  const sourceCountByExtension = /* @__PURE__ */ new Map();
+  for (const file of authoredSourceFiles) {
+    const extension = extname(file).toLowerCase() || "(none)";
+    sourceCountByExtension.set(extension, (sourceCountByExtension.get(extension) ?? 0) + 1);
+  }
+  const readableSourceFileCount = [...sourceCountByExtension.entries()].reduce(
+    (total, [extension, sourceCount]) => {
+      const sampled = sampledByExtension.get(extension);
+      if (!sampled || sampled.sampled === 0) return total;
+      return total + sourceCount * (sampled.readable / sampled.sampled);
+    },
+    0
+  );
+  const readableRatio = readableSourceFileCount / authoredSourceFiles.length;
+  if (readableRatio >= READABLE_SOURCE_REPRESENTATION_THRESHOLD_V13) return classification;
+  const readableCountLabel = Number.isInteger(readableSourceFileCount) ? String(readableSourceFileCount) : readableSourceFileCount.toFixed(2);
+  const readablePct = (readableRatio * 100).toFixed(1);
+  const thresholdPct = (READABLE_SOURCE_REPRESENTATION_THRESHOLD_V13 * 100).toFixed(0);
+  return {
+    archetype: "non_cohesive_source",
+    sourceFileCount: classification.sourceFileCount,
+    totalFileCount: classification.totalFileCount,
+    insufficientSourceReason: `Readable source representation covers ${readableCountLabel} of ${authoredSourceFiles.length} authored source-shaped file(s) (${readablePct}%); this is below the ${thresholdPct}% representation threshold. Cejel abstains because unreadable, compressed, binary-shaped, or opaque source families cannot support a representative headline score. ${INGEST_POINTER}`
+  };
+}
+function applySemanticSourceRepresentationGate(repoPath, repoFiles, classification, rubricVersion) {
+  if (classification.archetype !== "source" && classification.archetype !== "monorepo") {
+    return classification;
+  }
+  const authoredSourceFiles = repoFiles.filter(
+    (path) => isAuthoredProductionPath(path) && (isRecognizedSourcePath(path, rubricVersion) || isUnrecognisedSourcePath(path, rubricVersion) || /\.ipynb$/i.test(path))
+  );
+  if (authoredSourceFiles.length === 0) return classification;
+  const auxiliaryFiles = authoredSourceFiles.filter(
+    (path) => SEMANTIC_AUXILIARY_PATH_PATTERN_V14.test(path)
+  );
+  const packageMetadataFiles = authoredSourceFiles.filter(
+    (path) => isRubyPackageRecipeMetadataSource(repoPath, path)
+  );
+  const redirectMetadataFiles = authoredSourceFiles.filter(
+    (path) => isHtmlRedirectMetadataSource(repoPath, path)
+  );
+  const auxiliarySet = /* @__PURE__ */ new Set([
+    ...auxiliaryFiles,
+    ...packageMetadataFiles,
+    ...redirectMetadataFiles
+  ]);
+  const representativeImplementationCount = authoredSourceFiles.filter(
+    (path) => !auxiliarySet.has(path)
+  ).length;
+  if (representativeImplementationCount === 0) {
+    const detail = redirectMetadataFiles.length > 0 ? `${redirectMetadataFiles.length} redirect metadata file(s)` : packageMetadataFiles.length > 0 ? `${packageMetadataFiles.length} package metadata file(s)` : `${auxiliaryFiles.length} localization or style metadata file(s)`;
+    return {
+      archetype: "non_cohesive_source",
+      sourceFileCount: classification.sourceFileCount,
+      totalFileCount: classification.totalFileCount,
+      insufficientSourceReason: `${detail} provide no representative product implementation. Cejel abstains because auxiliary metadata or payload files cannot support a product-source headline score. ${INGEST_POINTER}`
+    };
+  }
+  const auxiliaryCount = auxiliarySet.size;
+  const auxiliaryRatio = auxiliaryCount / authoredSourceFiles.length;
+  if (authoredSourceFiles.length >= SEMANTIC_AUXILIARY_SOURCE_MINIMUM_V14 && auxiliaryRatio >= SEMANTIC_AUXILIARY_SOURCE_RATIO_V14) {
+    return {
+      archetype: "non_cohesive_source",
+      sourceFileCount: classification.sourceFileCount,
+      totalFileCount: classification.totalFileCount,
+      insufficientSourceReason: `${auxiliaryCount} of ${authoredSourceFiles.length} authored source-shaped file(s) are localization, style, package, or redirect auxiliary material. Cejel abstains because an auxiliary-dominated tree does not expose representative product implementation for a headline score. ${INGEST_POINTER}`
+    };
+  }
+  return classification;
+}
+function isHtmlRedirectMetadataSource(repoPath, file) {
+  if (!HTML_SOURCE_EXTENSION_PATTERN.test(file)) return false;
+  const contents = readSemanticMetadataPrefix(repoPath, file);
+  if (contents === null) return false;
+  const operativeContents = contents.replace(/<!--[\s\S]*?-->/g, "");
+  if (!HTML_META_REFRESH_PATTERN.test(operativeContents)) return false;
+  return !/<(?:script|form|main|article|section|canvas|template)\b/i.test(operativeContents);
+}
+function isRubyPackageRecipeMetadataSource(repoPath, file) {
+  if (!/\.rb$/i.test(file) || !RUBY_PACKAGE_RECIPE_PATH_PATTERN.test(file)) return false;
+  const contents = readSemanticMetadataPrefix(repoPath, file);
+  const operativeContents = contents?.replace(/^\s*#.*$/gm, "");
+  return operativeContents !== void 0 && RUBY_PACKAGE_RECIPE_CLASS_PATTERN.test(operativeContents) && RUBY_PACKAGE_RECIPE_URL_PATTERN.test(operativeContents);
+}
+function readSemanticMetadataPrefix(repoPath, file) {
+  const absolutePath = join(repoPath, file);
+  if (!isRegularFile(absolutePath)) return null;
+  let descriptor = null;
+  try {
+    descriptor = openSync(absolutePath, "r");
+    const buffer = Buffer.allocUnsafe(SEMANTIC_METADATA_PREFIX_BYTES_V14);
+    const bytesRead = readSync(descriptor, buffer, 0, SEMANTIC_METADATA_PREFIX_BYTES_V14, 0);
+    return buffer.subarray(0, bytesRead).toString("utf8");
+  } catch {
+    return null;
+  } finally {
+    if (descriptor !== null) closeSync(descriptor);
+  }
+}
+function readRepresentativeSourceText(repoPath, file) {
+  const absolutePath = join(repoPath, file);
+  try {
+    if (!isRegularFile(absolutePath)) return null;
+    const size = statSync(absolutePath).size;
+    if (size === 0 || size > READABLE_SOURCE_REPRESENTATION_FILE_BYTES_V13) return null;
+    return readFileSync(absolutePath, "utf8");
+  } catch {
+    return null;
+  }
+}
+function sourceDominanceThreshold(rubricVersion) {
+  if (rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15) {
+    return SOURCE_DOMINANCE_RATIO_THRESHOLD_V11;
+  }
+  if (rubricVersion === WITAN_RUBRIC_VERSION_V10) return SOURCE_DOMINANCE_RATIO_THRESHOLD_V10;
+  if (rubricVersion === WITAN_RUBRIC_VERSION_V92) return SOURCE_DOMINANCE_RATIO_THRESHOLD_V9;
+  return SOURCE_DOMINANCE_RATIO_THRESHOLD_V8;
+}
+function collectUnrecognisedSourceFiles(repoFiles, rubricVersion) {
+  return repoFiles.filter((path) => isUnrecognisedSourcePath(path, rubricVersion));
+}
+function isUnrecognisedSourcePath(file, rubricVersion = WITAN_RUBRIC_VERSION) {
+  const base = basename(file);
+  if (!/\.([a-zA-Z0-9_]+)$/.test(base)) return false;
+  if (KNOWN_NON_SOURCE_EXTENSION_PATTERN.test(base)) return false;
+  if ((rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15) && V13_NON_SOURCE_EXTENSION_PATTERN.test(base)) {
+    return false;
+  }
+  if (DOCS_OR_MEDIA_EXTENSION_PATTERN.test(base)) return false;
+  if (BUNDLED_BINARY_EXTENSION_PATTERN.test(base)) return false;
+  if (isRecognizedSourcePath(base, rubricVersion)) return false;
+  return true;
 }
 function extensionsByFileCountDescending(files) {
   const counts = /* @__PURE__ */ new Map();
@@ -5067,11 +5502,11 @@ function extensionsByFileCountDescending(files) {
   }
   return [...counts.entries()].sort(([extA, countA], [extB, countB]) => countB - countA || extA.localeCompare(extB)).map(([ext]) => ext);
 }
-function unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognisedSourceFiles) {
+function unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognisedSourceFiles, dominanceThreshold = SOURCE_DOMINANCE_RATIO_THRESHOLD_V9) {
   const sample = extensionsByFileCountDescending(unrecognisedSourceFiles).slice(0, 6).join(", ");
   const candidateCount = sourceFileCount + unrecognisedSourceFiles.length;
   const dominancePct = candidateCount > 0 ? (sourceFileCount / candidateCount * 100).toFixed(1) : "0.0";
-  const thresholdPct = (SOURCE_DOMINANCE_RATIO_THRESHOLD * 100).toFixed(0);
+  const thresholdPct = (dominanceThreshold * 100).toFixed(0);
   const measuredClause = sourceFileCount > 0 ? `${sourceFileCount} of ${candidateCount} source-shaped file(s) (${dominancePct}%) are in a language Cejel reads \u2014 below the ${thresholdPct}% dominance threshold a score would need to be meaningful (${totalFileCount} tracked files in total; manifests, lockfiles, docs, media and bundled binaries are excluded from both sides of the ratio)` : `0 of ${totalFileCount} tracked file(s) matched a recognised source extension`;
   return {
     archetype: "unrecognised_ecosystem",
@@ -5107,14 +5542,34 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors) {
   const signals = [];
   const mono = resolveMonorepoContext(repoPath);
-  const a1Signal = collectA1TestIntegrityEvidence(repoPath, repoFiles);
-  const a2Signal = collectA2IsolationEvidence(repoPath, repoFiles);
-  const a3Signal = collectA3ProdReadinessEvidence(repoPath, repoFiles);
-  const a4Signal = collectA4DependencyEvidence(repoPath, repoFiles, mono);
-  const a5Signal = collectA5ClaimRealityEvidence(repoPath, repoFiles);
+  const a1Signal = collectA1TestIntegrityEvidence(
+    repoPath,
+    repoFiles,
+    useV27Detectors,
+    useV33Detectors,
+    useV36Detectors
+  );
+  const a2Signal = collectA2IsolationEvidence(
+    repoPath,
+    repoFiles,
+    useV27Detectors,
+    useV33Detectors,
+    useV36Detectors,
+    useV39Detectors,
+    useV47Detectors
+  );
+  const a3Signal = collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors);
+  const a4Signal = collectA4DependencyEvidence(
+    repoPath,
+    repoFiles,
+    mono,
+    useV27Detectors,
+    useV47Detectors
+  );
+  const a5Signal = collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors);
   const b1Signal = buildNotApplicableSignal(
     "B1",
     "Repository scans do not evaluate the dispatch-trace process dimension."
@@ -5126,7 +5581,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles) {
     "B5",
     "Repository scans do not evaluate the learning-trace process dimension."
   );
-  const b6Signal = collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles);
+  const b6Signal = collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detectors);
   for (const signal of [
     a1Signal,
     a2Signal,
@@ -5144,22 +5599,27 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles) {
   }
   return signals;
 }
-function collectA1TestIntegrityEvidence(repoPath, repoFiles) {
+function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors) {
   const evidence = [];
   const findings = [];
-  const contentCppTests = collectContentBasedCppTestFiles(repoPath, repoFiles);
-  const allTestFiles = [
-    ...repoFiles.filter(isTestFile),
-    ...contentCppTests.filter((file) => !isTestFile(file))
-  ];
+  const allTestFiles = findConcreteTestFiles(repoPath, repoFiles);
   const testFiles = allTestFiles.slice(0, 8);
   const sourceFiles = repoFiles.filter(isSourceFile);
-  const runnerFiles = repoFiles.filter(isTestRunnerConfig).slice(0, 6);
-  const coverageFiles = repoFiles.filter(isCoverageConfig).slice(0, 4);
+  const runnerFiles = repoFiles.filter(
+    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isTestRunnerConfig(repoPath, file)
+  ).slice(0, 6);
+  const configuredRunnerFiles = useV33Detectors ? findConfiguredTestRunnerFiles(repoPath, repoFiles) : runnerFiles;
+  const allCoverageFiles = findCoverageConfigFiles(repoPath, repoFiles, useV27Detectors);
+  const coverageFiles = allCoverageFiles.slice(0, 4);
   const packageJson = findRootPackageJson(repoFiles);
   const packageScripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
+  const packageJsonFiles = useV27Detectors ? repoFiles.filter(
+    (file) => /(^|\/)package\.json$/.test(file) && isAuthoredProductionPath(file)
+  ) : packageJson ? [packageJson] : [];
   const coveragePercent = readCoveragePercent(repoPath, coverageFiles);
-  const ciWorkflows = repoFiles.filter(isCiWorkflow);
+  const ciWorkflows = repoFiles.filter(
+    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isCiWorkflow(file)
+  );
   const ciTestWorkflow = ciWorkflows.find(
     (file) => fileContains(repoPath, file, CI_TEST_COMMAND_PATTERN)
   );
@@ -5178,7 +5638,9 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles) {
   const usesLeanBuiltInTestRunner = packageJson != null && [...packageScripts.values()].some(
     (script) => LEAN_TEST_RUNNER_SCRIPT_PATTERN.test(script)
   ) || testFiles.some((file) => fileContains(repoPath, file, LEAN_TEST_RUNNER_IMPORT_PATTERN));
-  const hasHeavyTestDependency = packageJson != null && packageJsonHasHeavyTestDependency(repoPath, packageJson);
+  const hasHeavyTestDependency = packageJsonFiles.some(
+    (manifest) => packageJsonHasHeavyTestDependency(repoPath, manifest)
+  );
   const isLeanTestToolchain = usesLeanBuiltInTestRunner && !hasHeavyTestDependency;
   for (const file of testFiles) {
     evidence.push(evidenceForRelative(repoPath, file, "test_run", "Detected test file"));
@@ -5198,7 +5660,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles) {
     );
   }
   const scheduledHealthWorkflow = ciWorkflows.find(
-    (file) => fileContains(repoPath, file, SCHEDULE_TRIGGER_PATTERN) && fileContains(repoPath, file, CI_TEST_COMMAND_PATTERN)
+    (file) => fileContains(repoPath, file, SCHEDULE_TRIGGER_PATTERN) && fileContains(repoPath, file, CI_TEST_COMMAND_PATTERN) && (!useV36Detectors || SCHEDULED_HEALTH_PATH_PATTERN.test(file) || fileContains(repoPath, file, SCHEDULED_HEALTH_INTENT_PATTERN))
   );
   if (scheduledHealthWorkflow) {
     const isPublished = fileContains(
@@ -5231,7 +5693,12 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles) {
   }
   if (evidence.length === 0 && findings.length === 0) return null;
   if (testFiles.length === 0) {
-    const fallback = evidence[0] ?? findings[0]?.evidence;
+    const fallback = configuredRunnerFiles[0] ? evidenceForRelative(
+      repoPath,
+      configuredRunnerFiles[0],
+      "test_run",
+      "Configured test runner"
+    ) : useV33Detectors ? void 0 : evidence[0] ?? findings[0]?.evidence;
     if (fallback) {
       findings.push({
         severity: "warning",
@@ -5239,7 +5706,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles) {
         evidence: fallback
       });
     }
-  } else if (coverageFiles.length === 0) {
+  } else if (coverageFiles.length === 0 && (!useV33Detectors || configuredRunnerFiles.length > 0)) {
     if (isLeanTestToolchain) {
       const leanEvidenceFile = packageJson ?? testFiles[0];
       if (leanEvidenceFile) {
@@ -5310,27 +5777,67 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles) {
     notes: "A1 is detected from real test files, test runner configuration, and optional coverage configuration."
   };
 }
-function collectA2IsolationEvidence(repoPath, repoFiles) {
+function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors) {
   const evidence = [];
   const findings = [];
   const gitignore = repoFiles.find((file) => basename(file) === ".gitignore");
-  const envExamples = repoFiles.filter((file) => isEnvTemplatePath(file));
+  const envExamples = repoFiles.filter((file) => isEnvTemplatePath(file, useV47Detectors));
   const migrationFiles = repoFiles.filter(
     (file) => /(^|\/)(migrations?|drizzle|prisma)\//.test(file)
   );
-  const committedSecret = repoFiles.find(
-    (file) => !isIgnoredScanFile(file) && fileContainsCommittedSecret(repoPath, file)
+  let committedSecret;
+  for (const path of repoFiles) {
+    const authoredProductionPath = useV47Detectors ? isV47AuthoredProductionPath(path) : useV39Detectors ? isV39AuthoredProductionPath(path) : isAuthoredProductionPath(path);
+    if (isIgnoredScanFile(path, useV47Detectors) || useV33Detectors && !authoredProductionPath) {
+      continue;
+    }
+    const match = findCommittedSecretInFile(
+      repoPath,
+      path,
+      useV36Detectors,
+      useV39Detectors,
+      useV47Detectors
+    );
+    if (!match) continue;
+    committedSecret = { path, match };
+    break;
+  }
+  const currentSecretFingerprintsByPath = /* @__PURE__ */ new Map();
+  if (useV27Detectors) {
+    for (const path of repoFiles.filter((candidate) => isCredentialHistoryPath(candidate))) {
+      currentSecretFingerprintsByPath.set(
+        path,
+        new Set(
+          findSecretFingerprintsInFile(
+            repoPath,
+            path,
+            useV36Detectors,
+            useV39Detectors,
+            useV47Detectors
+          )
+        )
+      );
+    }
+  }
+  const historySecretScan = committedSecret && !useV27Detectors ? null : collectHistorySecretEvidence(
+    repoPath,
+    useV27Detectors,
+    currentSecretFingerprintsByPath,
+    useV33Detectors,
+    useV36Detectors,
+    useV39Detectors,
+    useV47Detectors
   );
-  const historySecretScan = committedSecret ? null : collectHistorySecretEvidence(repoPath);
   const hasConfirmedSecretFinding = committedSecret != null || historySecretScan?.evidence != null;
   const cryptoHygiene = collectCryptoHygieneEvidence(
     repoPath,
-    repoFiles.filter(isImplementationFile).slice(0, 60)
+    repoFiles.filter(isImplementationFile).slice(0, 60),
+    useV39Detectors
   );
   const implFiles = repoFiles.filter(isImplementationFile);
   const gitignoreHasEnvRule = gitignore != null && fileContains(repoPath, gitignore, /^\.env(\*|\b)|\.env\./m);
   const committedEnvFilePath = repoFiles.find(
-    (f) => /(?:^|\/)\.env(?:\.|$)/i.test(f) && !isEnvTemplatePath(f)
+    (f) => /(?:^|\/)\.env(?:\.|$)/i.test(f) && !isEnvTemplatePath(f, useV47Detectors) && (!useV47Detectors || isV47AuthoredProductionPath(f)) && (!useV39Detectors || !hasTemplateOnlyEnvContent(repoPath, f))
   );
   const hasEnvInHistory = committedEnvFilePath === void 0 && hasEnvPathInGitHistory(repoPath);
   const dbLayerImportFile = migrationFiles.length === 0 ? implFiles.slice(0, 30).find((f) => fileContains(repoPath, f, DB_CLIENT_PATTERN)) : void 0;
@@ -5365,20 +5872,17 @@ function collectA2IsolationEvidence(repoPath, repoFiles) {
   } else if (dbLayerImportFile != null) {
     evidence.push(evidenceForRelative(repoPath, dbLayerImportFile, "artifact", "DB client import"));
   }
-  const rlsMigration = migrationFiles.find((file) => fileContains(repoPath, file, RLS_PATTERN));
-  const tenantScopedFile = migrationFiles.find(
-    (file) => fileContains(repoPath, file, TENANT_SCOPE_PATTERN)
-  );
-  const rlsPolicyCount = countPatternMatches(
+  const v47RlsPolicyFiles = useV47Detectors ? findRlsPolicyFiles(repoPath, repoFiles) : [];
+  const v47TenantStorageFiles = useV47Detectors ? findTenantStoragePremiseFiles(repoPath, repoFiles) : [];
+  const rlsMigration = useV47Detectors ? v47RlsPolicyFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, RLS_PATTERN));
+  const tenantScopePattern = useV39Detectors ? TENANT_SCOPE_PATTERN_V11 : useV36Detectors ? TENANT_SCOPE_PATTERN_V10 : TENANT_SCOPE_PATTERN;
+  const tenantScopedFile = useV47Detectors ? v47TenantStorageFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, tenantScopePattern));
+  const rlsPolicyCount = useV47Detectors ? v47RlsPolicyFiles.length : countPatternMatches(
     repoPath,
     migrationFiles,
     /create policy|enable row level security|force row level security/gi
   );
-  const tenantScopedMigrationFileCount = countFilesContaining(
-    repoPath,
-    migrationFiles,
-    TENANT_SCOPE_PATTERN
-  );
+  const tenantScopedMigrationFileCount = useV47Detectors ? v47TenantStorageFiles.length : countFilesContaining(repoPath, migrationFiles, tenantScopePattern);
   const gitignoreEnvFile = gitignore && fileContains(repoPath, gitignore, /^\.env(\*|\b)|\.env\./m) ? gitignore : null;
   const envHandlingDepth = (envExamples.length > 0 ? 1 : 0) + (gitignoreEnvFile ? 1 : 0) + (countFilesContaining(repoPath, repoFiles.filter(isImplementationFile), ENV_READ_PATTERN) > 0 ? 1 : 0);
   const isMultiTenant = tenantScopedMigrationFileCount > 0;
@@ -5401,15 +5905,31 @@ function collectA2IsolationEvidence(repoPath, repoFiles) {
     );
   }
   if (committedSecret) {
-    const isTestPath = isTestOrFixturePath(committedSecret);
+    const isTestPath = isTestOrFixturePath(committedSecret.path);
+    const isDefaultAdmin = committedSecret.match.kind === "default_admin";
     findings.push({
       severity: isTestPath ? "info" : "critical",
-      summary: isTestPath ? `Secret-shaped value in a test/fixture file (${committedSecret}) \u2014 likely fixture data, not a production leak; verify.` : "Secret-shaped value appears committed in the scanned repository.",
+      summary: isDefaultAdmin ? isTestPath ? `Default administrative credential in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production deployment default; verify.` : "An explicit default administrative credential appears committed in production configuration." : isTestPath ? `Secret-shaped value in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production leak; verify.` : "Secret-shaped value appears committed in the scanned repository.",
+      evidence: evidenceForRelativeAtLine(
+        repoPath,
+        committedSecret.path,
+        "secret_scan",
+        secretEvidenceLabel(
+          isDefaultAdmin ? "Committed default administrative credential" : "Committed secret-shaped value",
+          committedSecret.match
+        ),
+        committedSecret.match.line
+      )
+    });
+  } else if (committedEnvFilePath) {
+    findings.push({
+      severity: useV33Detectors ? "info" : "warning",
+      summary: "A non-template .env file is committed in the current repository tree; no secret-shaped value was detected.",
       evidence: evidenceForRelative(
         repoPath,
-        committedSecret,
+        committedEnvFilePath,
         "secret_scan",
-        "Committed secret-shaped value"
+        "Committed .env file (no confirmed secret value found)"
       )
     });
   }
@@ -5423,7 +5943,7 @@ function collectA2IsolationEvidence(repoPath, repoFiles) {
     });
   } else if (historySecretScan?.truncated) {
     findings.push({
-      severity: "warning",
+      severity: useV33Detectors ? "info" : "warning",
       summary: "History secret scan reached the credential-path safety valve before scanning every matching blob.",
       evidence: {
         kind: "secret_scan",
@@ -5434,7 +5954,7 @@ function collectA2IsolationEvidence(repoPath, repoFiles) {
     });
   } else if (historySecretScan?.envPathEvidence) {
     findings.push({
-      severity: "warning",
+      severity: useV33Detectors ? "info" : "warning",
       summary: "A non-template .env file was tracked in git history; no secret-shaped value was detected.",
       evidence: historySecretScan.envPathEvidence
     });
@@ -5492,7 +6012,7 @@ function collectA2IsolationEvidence(repoPath, repoFiles) {
     metric(
       "tenant_scope_ratio",
       "Tenant-scoped schema ratio",
-      countFilesContaining(repoPath, migrationFiles, TENANT_SCOPE_PATTERN),
+      countFilesContaining(repoPath, migrationFiles, tenantScopePattern),
       Math.max(migrationFiles.length, 1),
       0.25,
       "ratio",
@@ -5518,12 +6038,14 @@ function collectA2IsolationEvidence(repoPath, repoFiles) {
     notes: "History secret scanning covers all reachable git history for credential-pattern paths unless the explicit credential-blob safety valve is reported."
   };
 }
-function collectCryptoHygieneEvidence(repoPath, implFiles) {
+function collectCryptoHygieneEvidence(repoPath, implFiles, useV39Detectors = false) {
   const evidence = [];
   const findings = [];
   let hasSurface = false;
   let insecureFound = false;
-  const productionImplFiles = implFiles.filter(isProductionSourcePath);
+  const productionImplFiles = implFiles.filter(
+    (file) => useV39Detectors ? isV39AuthoredProductionPath(file) : isProductionSourcePath(file)
+  );
   const timingSafeFile = productionImplFiles.find(
     (file) => fileContains(repoPath, file, TIMING_SAFE_COMPARE_PATTERN)
   );
@@ -5554,8 +6076,9 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
   }
   let insecureCompareFile = null;
   let insecureCompareLine = null;
-  for (const file of implFiles) {
-    const line = findInsecureSecretCompareLine(repoPath, file);
+  const compareFiles = useV39Detectors ? productionImplFiles : implFiles;
+  for (const file of compareFiles) {
+    const line = findInsecureSecretCompareLine(repoPath, file, useV39Detectors);
     if (line != null) {
       insecureCompareFile = file;
       insecureCompareLine = line;
@@ -5563,6 +6086,12 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
     }
   }
   if (insecureCompareFile) {
+    const insecureCompareSourceLine = lineAt(
+      repoPath,
+      insecureCompareFile,
+      insecureCompareLine ?? 0
+    );
+    const comparesDefaultSentinel = useV39Detectors && insecureCompareSourceLine !== null && DEFAULT_SECRET_SENTINEL_COMPARE_LINE_PATTERN.test(insecureCompareSourceLine);
     const isTestPath = isTestOrFixturePath(insecureCompareFile);
     if (!isTestPath) {
       hasSurface = true;
@@ -5570,7 +6099,7 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
     }
     findings.push({
       severity: isTestPath ? "info" : "warning",
-      summary: isTestPath ? `A secret/HMAC/signature comparison via plain equality appears in a test/fixture file (${insecureCompareFile}) \u2014 likely a test assertion, not a production timing leak; verify.` : "A secret/HMAC/signature value appears compared with a plain equality operator instead of a constant-time comparison \u2014 potential timing side-channel.",
+      summary: isTestPath ? `A secret/HMAC/signature comparison via plain equality appears in a test/fixture file (${insecureCompareFile}) \u2014 likely a test assertion, not a production timing leak; verify.` : comparesDefaultSentinel ? "A supplied secret is compared with a configured default-secret sentinel using ordinary equality; verify whether this comparison belongs on a constant-time authentication path." : "A secret/HMAC/signature value appears compared with a plain equality operator instead of a constant-time comparison \u2014 potential timing side-channel.",
       evidence: evidenceForRelativeAtLine(
         repoPath,
         insecureCompareFile,
@@ -5580,8 +6109,9 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
       )
     });
   }
-  const unsortedSignFile = implFiles.find(
-    (file) => fileContains(repoPath, file, UNSORTED_JSON_SIGN_PATTERN) && !fileContains(repoPath, file, CANONICAL_SERIALIZE_PATTERN)
+  const unsortedFiles = useV39Detectors ? productionImplFiles : implFiles;
+  const unsortedSignFile = unsortedFiles.find(
+    (file) => (useV39Detectors ? fileHasVariableUnsortedJsonHmac(repoPath, file) : fileContains(repoPath, file, UNSORTED_JSON_SIGN_PATTERN)) && !fileContains(repoPath, file, CANONICAL_SERIALIZE_PATTERN)
   );
   if (unsortedSignFile) {
     const isTestPath = isTestOrFixturePath(unsortedSignFile);
@@ -5589,11 +6119,7 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
       hasSurface = true;
       insecureFound = true;
     }
-    const unsortedSignLine = findFirstMatchingLine(
-      repoPath,
-      unsortedSignFile,
-      UNSORTED_JSON_SIGN_PATTERN
-    );
+    const unsortedSignLine = useV39Detectors ? findUnsortedJsonHmacLine(repoPath, unsortedSignFile) : findFirstMatchingLine(repoPath, unsortedSignFile, UNSORTED_JSON_SIGN_PATTERN);
     findings.push({
       severity: isTestPath ? "info" : "warning",
       summary: isTestPath ? `Signing over unsorted JSON serialization appears in a test/fixture file (${unsortedSignFile}) \u2014 likely a test assertion, not a production signing gap; verify.` : "A signature/HMAC appears computed directly over JSON.stringify output with no canonical key ordering in the same file \u2014 signatures may not verify across equivalent payloads.",
@@ -5608,36 +6134,53 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
   }
   return { evidence, findings, hasSurface, clean: hasSurface && !insecureFound };
 }
-function collectA3ProdReadinessEvidence(repoPath, repoFiles) {
-  if (!isDeployableService(repoPath, repoFiles)) {
+function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors) {
+  if (!isDeployableService(repoPath, repoFiles, useV27Detectors)) {
+    const dockerApplicabilityNote = useV27Detectors ? "A Dockerfile without an explicit runtime start/service command is ambiguous and does not qualify." : "Dockerfile alone is ambiguous and does not qualify.";
     return buildNotApplicableSignal(
       "A3",
-      "No deployable-service surface detected \u2014 production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). Dockerfile alone is ambiguous and does not qualify."
+      `No deployable-service surface detected \u2014 production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). ${dockerApplicabilityNote}`
     );
   }
   const evidence = [];
   const findings = [];
   const packageJson = findRootPackageJson(repoFiles);
   const scripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
-  const workflows = repoFiles.filter(isCiWorkflow);
+  const workflows = repoFiles.filter(
+    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isCiWorkflow(file)
+  );
   const workflow = workflows[0];
-  const deployConfigs = repoFiles.filter(isDeployConfig);
-  const deployConfig = deployConfigs[0];
-  const envTemplate = repoFiles.find((file) => isEnvTemplatePath(file));
-  const healthChecks = repoFiles.filter((file) => isHealthCheckSignalFile(repoPath, file));
+  const deployConfigs = repoFiles.filter(
+    (file) => (useV27Detectors ? isAuthoredProductionPath(file) : isProductionSourcePath(file)) && isDeployConfig(file)
+  );
+  const releaseDeployConfigs = repoFiles.filter(
+    (file) => (useV27Detectors ? isAuthoredProductionPath(file) : isProductionSourcePath(file)) && isExplicitDeployTarget(file)
+  );
+  const releaseDeployConfig = releaseDeployConfigs[0];
+  const containerBuildConfig = deployConfigs.find((file) => /(^|\/)Dockerfile$/.test(file));
+  const envTemplate = repoFiles.find(
+    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isEnvTemplatePath(file)
+  );
+  const healthChecks = repoFiles.filter(
+    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isHealthCheckSignalFile(repoPath, file)
+  );
   const healthCheck = healthChecks[0];
   const errorBoundaries = repoFiles.filter(
-    (file) => /error-boundary|error\.(tsx|jsx|ts|js)$/.test(file)
+    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && /error-boundary|error\.(tsx|jsx|ts|js)$/.test(file)
   );
   const errorBoundary = errorBoundaries[0];
   const observabilityCount = countFilesContaining(
     repoPath,
-    repoFiles.filter(isImplementationFile),
+    repoFiles.filter(
+      (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isImplementationFile(file)
+    ),
     /sentry|otel|opentelemetry|datadog|prometheus|metrics|logger|logtail/i
   );
   const rollbackSafetyCount = countFilesContaining(
     repoPath,
-    repoFiles.filter((file) => /(^|\/)(docs|migrations?|drizzle|prisma|scripts)\//.test(file)),
+    repoFiles.filter(
+      (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && /(^|\/)(docs|migrations?|drizzle|prisma|scripts)\//.test(file)
+    ),
     /rollback|roll back|migration safety|down migration|reversible|undo migration/i
   );
   if (packageJson && (scripts.has("build") || scripts.has("typecheck"))) {
@@ -5646,9 +6189,23 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles) {
     );
   }
   if (workflow) evidence.push(evidenceForRelative(repoPath, workflow, "ci_run", "CI workflow"));
-  if (deployConfig)
+  if (releaseDeployConfig)
+    evidence.push(
+      evidenceForRelative(
+        repoPath,
+        releaseDeployConfig,
+        "prod_check",
+        "Release deploy configuration"
+      )
+    );
+  if (containerBuildConfig)
     evidence.push(
-      evidenceForRelative(repoPath, deployConfig, "prod_check", "Deploy configuration")
+      evidenceForRelative(
+        repoPath,
+        containerBuildConfig,
+        "prod_check",
+        "Container build configuration"
+      )
     );
   if (envTemplate)
     evidence.push(evidenceForRelative(repoPath, envTemplate, "prod_check", "Environment template"));
@@ -5659,7 +6216,8 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles) {
   if (errorBoundary)
     evidence.push(evidenceForRelative(repoPath, errorBoundary, "prod_check", "Error boundary"));
   if (evidence.length === 0) {
-    const serverEntrypoint = findServerEntrypointFile(repoPath, repoFiles);
+    const serverEntrypoint = findServerEntrypointFile(repoPath, repoFiles, useV27Detectors);
+    const runtimeContainer = useV27Detectors ? findRuntimeContainerEntrypointFile(repoPath, repoFiles) : null;
     if (serverEntrypoint) {
       evidence.push(
         evidenceForRelative(
@@ -5669,15 +6227,24 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles) {
           "Production server entrypoint"
         )
       );
+    } else if (runtimeContainer) {
+      evidence.push(
+        evidenceForRelative(
+          repoPath,
+          runtimeContainer,
+          "prod_check",
+          "Runtime container entrypoint"
+        )
+      );
     }
   }
   if (evidence.length === 0) return null;
-  if (!workflow && !deployConfig) {
+  if (!workflow && releaseDeployConfigs.length === 0) {
     const firstEvidence = evidence[0];
     if (!firstEvidence) return null;
     findings.push({
       severity: "info",
-      summary: "Production readiness signals exist, but no CI/deploy configuration was detected.",
+      summary: "A deployable service surface exists, but no CI or release-deployment automation was detected.",
       evidence: firstEvidence
     });
   }
@@ -5735,7 +6302,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles) {
     ]
   };
 }
-function collectA4DependencyEvidence(repoPath, repoFiles, mono) {
+function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors, useV47Detectors) {
   const evidence = [];
   const findings = [];
   const manifests = repoFiles.filter(isDependencyManifest);
@@ -5784,7 +6351,9 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono) {
     );
   }
   if (!manifest && !hasLockfile) return null;
-  const isAppOrService = isDeployableService(repoPath, repoFiles);
+  const packagedApplicationFiles = useV27Detectors ? findPackagedApplicationPremiseFiles(repoPath, repoFiles) : [];
+  const deployableServiceFiles = useV47Detectors ? findDeployableServicePremiseFiles(repoPath, repoFiles, true) : [];
+  const isAppOrService = (useV47Detectors ? deployableServiceFiles.length > 0 : isDeployableService(repoPath, repoFiles, useV27Detectors)) || packagedApplicationFiles.length > 0;
   if (isAppOrService && !hasLockfile && manifest) {
     findings.push({
       severity: "critical",
@@ -5792,7 +6361,7 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono) {
       evidence: evidenceForRelative(repoPath, manifest, "dependency_report", "Dependency manifest")
     });
   }
-  if (manifest && hasSuspiciousDependencies(repoPath, manifest)) {
+  if (manifest && hasSuspiciousDependencies(repoPath, manifest, useV47Detectors)) {
     findings.push({
       severity: "critical",
       summary: "Dependency manifest contains obviously suspicious placeholder dependency names.",
@@ -5874,7 +6443,7 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono) {
     positiveEvidence: evidence,
     findings,
     metrics: isAppOrService ? appMetrics : libraryMetrics,
-    notes: isAppOrService ? "A4 scored against app/service norms (deploy surface detected): pinned dependencies and a lockfile are required for reproducible installs." : "A4 scored against library/CLI norms (no deploy surface detected \u2014 same archetype line as A3): declared version ranges are correct library behavior; a committed lockfile is credited but not required."
+    notes: isAppOrService ? `A4 scored against app/service norms (${packagedApplicationFiles.length > 0 ? "packaged application" : "deploy surface"} detected): pinned dependencies and a lockfile are required for reproducible installs.` : "A4 scored against library/CLI norms (no deploy surface detected \u2014 same archetype line as A3): declared version ranges are correct library behavior; a committed lockfile is credited but not required."
   };
 }
 var LIBRARY_DEPENDENCY_COUNT_SANE_MAX = 120;
@@ -5891,15 +6460,19 @@ function hasDeclaredVersionConstraint(dependency) {
   if (/[~^<>=!]/.test(trimmed)) return true;
   return /^v?\d/.test(trimmed);
 }
-function collectA5ClaimRealityEvidence(repoPath, repoFiles) {
-  const claimDoc = repoFiles.find((file) => /(^|\/)(README|readme)\.md$/.test(file)) ?? repoFiles.find((file) => /(^|\/)docs\/.*\.(md|mdx)$/.test(file));
+function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors) {
+  const reconciliationArtifacts = useV27Detectors ? findClaimRealityReconciliationArtifacts(repoPath, repoFiles) : [];
+  const claimSourceFiles = useV27Detectors ? findClaimSourceFiles(repoFiles) : repoFiles.filter(
+    (file) => /^(?:README|readme)\.md$/.test(file) || /^docs\/[^/]+\.(?:md|mdx)$/.test(file)
+  );
+  const claimDoc = useV27Detectors ? claimSourceFiles[0] ?? reconciliationArtifacts[0] : repoFiles.find((file) => /^(?:README|readme)\.md$/.test(file)) ?? repoFiles.find((file) => /^docs\/[^/]+\.(?:md|mdx)$/.test(file)) ?? repoFiles.find((file) => /(^|\/)claim[_-]reality[_-]reconciliation\.md$/i.test(file));
   if (!claimDoc) {
     return buildNotApplicableSignal(
       "A5",
       "No README or docs found \u2014 nothing is claimed about this repo, so there is nothing for A5 to reconcile against."
     );
   }
-  const implementationFiles = repoFiles.filter(isImplementationFile);
+  const implementationFiles = findClaimImplementationFiles(repoFiles, useV27Detectors);
   if (implementationFiles.length === 0) return null;
   const implementationFile = implementationFiles[0];
   if (!implementationFile) return null;
@@ -5912,10 +6485,21 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles) {
       "Code presence for claim reconciliation"
     )
   ];
+  for (const artifact of reconciliationArtifacts.slice(0, 3)) {
+    if (artifact === claimDoc) continue;
+    evidence.push(
+      evidenceForRelative(
+        repoPath,
+        artifact,
+        "claim_reconciliation",
+        "Dedicated claim-reality reconciliation artifact"
+      )
+    );
+  }
   const firstEvidence = evidence[0];
   if (!firstEvidence) return null;
-  const allDocFiles = repoFiles.filter(
-    (file) => /^README\.md$/.test(file) || /^docs\/[^/]+\.(md|mdx)$/.test(file)
+  const allDocFiles = useV27Detectors ? claimSourceFiles : repoFiles.filter(
+    (file) => /^README\.md$/.test(file) || /^docs\/[^/]+\.(?:md|mdx)$/.test(file)
   );
   const boundedImplCount = Math.min(implementationFiles.length, 12);
   const boundedDocCount = Math.min(allDocFiles.length, 8);
@@ -5940,7 +6524,7 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles) {
   return {
     criterionId: "A5",
     positiveEvidence: evidence,
-    findings: [
+    findings: reconciliationArtifacts.length > 0 ? [] : [
       {
         // Proxy-only A5: cap at warning (never critical) — a static proxy is lower-confidence
         // than a curated registry or reconciliation artifact. Downgraded to info when the repo
@@ -5952,12 +6536,11 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles) {
       }
     ],
     // Recalibrated (goal_cejel_launch_hardening_combined_2026-07-06, Phase 3 H1):
-    // reconciliation_artifact_depth is structurally 0 for every repo on this generic-proxy
-    // path (only Alfred itself has the dedicated claim-reality artifact), so its prior 0.3
-    // weight was a permanent floor drag on every external repo regardless of how well the
-    // repo otherwise documents and backs its claims. Weight lowered to 0.15 (still a real
-    // ding for lacking the artifact) and redistributed to the two metrics that measure
-    // something a well-run external repo can actually earn; claim_source_depth's
+    // reconciliation_artifact_depth is usually 0 on the generic-proxy path, so its prior 0.3
+    // weight was a floor drag on external repos regardless of how well they otherwise document
+    // and back claims. Weight remains 0.15 (still a real ding when a content-authenticated,
+    // generically named reconciliation artifact is absent) and is redistributed to the two
+    // metrics that every well-run external repo can earn; claim_source_depth's
     // denominator lowered from 8 to 4 (README + a couple of top-level docs is already a
     // reasonably documented repo, not a fraction of an inflated 8-file bar).
     metrics: [
@@ -5983,7 +6566,7 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles) {
       metric(
         "reconciliation_artifact_depth",
         "Reconciliation artifact depth",
-        0,
+        reconciliationArtifacts.length,
         3,
         0.15,
         "artifacts",
@@ -6166,7 +6749,7 @@ function collectB4AuditEvidence(repoPath, repoFiles, generatedAt) {
     ]
   };
 }
-function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles) {
+function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detectors = false) {
   const evidence = [];
   const findings = [];
   const docFiles = repoFiles.filter((file) => /\.(md|mdx)$/i.test(file));
@@ -6189,12 +6772,13 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles) {
     (file) => fileContains(repoPath, file, SQL_EXEC_PATTERN)
   );
   const ungatedEscalationFiles = executableFiles.filter((file) => {
+    if (useV39Detectors && !fileHasExecutedPrivilegeEscalation(repoPath, file)) return false;
     const hasEscalation = fileContains(repoPath, file, ROLE_MEMBERSHIP_GRANT_PATTERN) || fileContains(repoPath, file, SUPERUSER_ESCALATION_PATTERN);
     if (!hasEscalation) return false;
     return !fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN);
   });
   const productionUngatedEscalationFiles = ungatedEscalationFiles.filter(
-    (file) => !isTestOrFixturePath(file)
+    (file) => useV39Detectors ? isV39AuthoredProductionPath(file) : !isTestOrFixturePath(file)
   );
   if (humanGateDoc) {
     evidence.push(
@@ -6236,11 +6820,10 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles) {
       )
     );
   }
-  for (const file of ungatedEscalationFiles.slice(0, 5)) {
-    const isTestPath = isTestOrFixturePath(file);
+  for (const file of productionUngatedEscalationFiles.slice(0, 5)) {
     findings.push({
-      severity: isTestPath ? "info" : "critical",
-      summary: isTestPath ? `Role-membership GRANT or SUPERUSER escalation statement in a test/fixture file (${file}) \u2014 likely a test assertion, not a production escalation; verify.` : "Role-membership GRANT or SUPERUSER escalation executes in code with no documented human gate.",
+      severity: "critical",
+      summary: "Role-membership GRANT or SUPERUSER escalation executes in code with no documented human gate.",
       evidence: evidenceForRelative(
         repoPath,
         file,
@@ -6299,7 +6882,7 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles) {
         1,
         hasPrivilegedOpsSurface ? 0.3 : 0.4,
         "clean",
-        "Penalizes code that executes a role-membership GRANT or SUPERUSER escalation with no documented human gate (test/fixture files are downgraded findings, not penalized here)."
+        "Penalizes code that executes a role-membership GRANT or SUPERUSER escalation with no documented human gate (test/fixture SQL is excluded from this production-code measurement)."
       ),
       metric(
         "protected_path_review_gate",
@@ -6319,39 +6902,62 @@ var CPP_TEST_FRAMEWORK_PATTERN = /<gtest\/gtest\.h>|<catch2\/|<doctest\/|<boost\
 var CPP_TEST_MACRO_PATTERN = /\bTEST\s*\(|\bTEST_F\s*\(|\bTEST_CASE\s*\(|\bSECTION\s*\(|\bCATCH_|BOOST_AUTO_TEST_CASE\b|BOOST_FIXTURE_TEST_CASE\b/;
 var CPP_CONTENT_SCAN_LIMIT = 150;
 var NON_PRODUCTION_DIR_PATTERN = /(^|\/)(__tests__|__mocks__|__fixtures__|tests?|fixtures?|testdata|e2e|cypress|examples?|samples?|demos?)(\/|$)/i;
-var NON_PRODUCTION_FILE_SUFFIX_PATTERN = /\.(test|spec|stories)\.[^/]+$/i;
+var NON_PRODUCTION_FILE_SUFFIX_PATTERN = /\.(test|spec|stories)\.[^/]+$|_test\.go$|(^|\/)test_.*\.py$/i;
 function isTestOrFixturePath(path) {
   return NON_PRODUCTION_DIR_PATTERN.test(path) || NON_PRODUCTION_FILE_SUFFIX_PATTERN.test(path);
 }
 function isProductionSourcePath(path) {
   return !isTestOrFixturePath(path);
 }
+function isAuthoredProductionPath(path) {
+  return isProductionSourcePath(path) && !GENERATED_OR_VENDOR_PATH_PATTERN.test(path);
+}
+var V39_NON_PRODUCTION_CREDENTIAL_PATH_PATTERN = /(^|\/)(?:docs?|documentation|e2e[-_]?tests?)(\/|$)|(^|\/)(?:test|tests)[._-][^/]+$|(^|\/)[^/]*(?:appium|e2e[-_]?tests?)[^/]*$/i;
+function isV39AuthoredProductionPath(path) {
+  return isAuthoredProductionPath(path) && !V39_NON_PRODUCTION_CREDENTIAL_PATH_PATTERN.test(path);
+}
+var V47_NON_PRODUCTION_CREDENTIAL_PATH_PATTERN = /(^|\/)(?:auto[-_]?gen(?:erated)?|generated|i18n|locales?|cookbooks?|lessons?)(\/|$)|\.(?:md|mdx|rst|adoc)$/i;
+function isV47AuthoredProductionPath(path) {
+  return isV39AuthoredProductionPath(path) && !V47_NON_PRODUCTION_CREDENTIAL_PATH_PATTERN.test(path);
+}
+var TEST_DIRECTORY_SOURCE_PATTERN = new RegExp(
+  `(^|/)(?:__tests__|tests?|specs?|[^/]+(?:Tests|Specs))/(?:.*\\.)?(?:${SOURCE_LANGUAGES.flatMap((language) => language.extensions).join("|")})$`
+);
 function isTestFile(file) {
-  return /(^|\/)(__tests__|test|tests|spec)\/.*\.(?:[cm]?[jt]sx?|py|go|rs|java|rb|cpp|cc|cxx)$/.test(
-    file
-  ) || /\.(test|spec)\.[cm]?[jt]sx?$/.test(file) || /(^|\/)test_.*\.py$/.test(file) || /_test\.go$/.test(file) || /(^|\/)test_.*\.(cpp|cc|cxx)$/.test(file) || /_(test|tests)\.(cpp|cc|cxx)$/.test(file) || /Tests?\.(java|kt)$/.test(file) || /(_test|_spec)\.(rs|rb|php|swift|kt)$/.test(file);
+  return TEST_DIRECTORY_SOURCE_PATTERN.test(file) || // AVA's default discovery includes test.js and test-*.js at the scanned package root.
+  // Keep this root-anchored: nested files need an existing test-directory/suffix convention.
+  /^test(?:-[^/]+)?\.[cm]?[jt]sx?$/.test(file) || /\.(test|spec)\.[cm]?[jt]sx?$/.test(file) || /(^|\/)test_.*\.py$/.test(file) || /_test\.go$/.test(file) || /(^|\/)test_.*\.(cpp|cc|cxx)$/.test(file) || /_(test|tests)\.(cpp|cc|cxx)$/.test(file) || /Tests?\.(java|kt)$/.test(file) || /(_test|_spec)\.(rs|rb|php|swift|kt)$/.test(file);
 }
-var NAME_SHAPED_TEST_FILE_PATTERN = /\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)__tests__\/|(^|\/)test_[^/]*\.py$|(^|\/)tests?\.py$|_test\.go$|(^|\/)test_[^/]*\.(cpp|cc|cxx)$|_(test|tests)\.(cpp|cc|cxx)$|Tests?\.(java|kt)$|(_test|_spec)\.(rs|rb|php|swift|kt)$/;
-var TEST_RUNNER_PATTERN = /\b(vitest|jest|mocha|ava|tap|pytest|go test|cargo test|rspec|phpunit|gradle test|mvn test)\b/i;
-var CI_TEST_COMMAND_PATTERN = /\b(pytest|go\s+test|cargo\s+test|mvn\s+test|gradle\s+test|ctest|make\s+test|jest|vitest|mocha|rspec|phpunit|pnpm\s+test|npm\s+test|yarn\s+test|node\s+--test|node:test)\b/i;
+var NAME_SHAPED_TEST_FILE_PATTERN = /^test(?:-[^/]+)?\.[cm]?[jt]sx?$|\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)__tests__\/|(^|\/)test_[^/]*\.py$|(^|\/)tests?\.py$|_test\.go$|(^|\/)test_[^/]*\.(cpp|cc|cxx)$|_(test|tests)\.(cpp|cc|cxx)$|Tests?\.(java|kt)$|(_test|_spec)\.(rs|rb|php|swift|kt)$/;
+var TEST_RUNNER_PATTERN = /\b(vitest|jest|mocha|ava|tap|pytest|go test|cargo test|rspec|phpunit|gradle test|mvn test|node\s+--test|node:test)\b/i;
+var CI_TEST_COMMAND_PATTERN = /\b(pytest|go\s+test|cargo\s+test|mvn\s+test|gradle\s+test|dotnet\s+test|ctest|make\s+test|jest|vitest|mocha|rspec|phpunit|pnpm\s+(?:run\s+)?test|npm\s+(?:run\s+)?test|yarn\s+(?:run\s+)?test|node\s+--test|node:test)\b|--target[=\s]+test\b/i;
 var CI_LINT_COMMAND_PATTERN = /\b(eslint|pylint|flake8|black|ruff)\b/i;
 var CI_TYPECHECK_COMMAND_PATTERN = /\b(tsc|mypy|pyright)\b/i;
 var SCHEDULE_TRIGGER_PATTERN = /(^|\n)\s*schedule:\s*\r?\n\s*-\s*cron:/;
 var PUBLISHED_RESULT_MARKER_PATTERN = /actions\/deploy-pages|actions\/upload-pages-artifact|peaceiris\/actions-gh-pages|git\s+push\b|create-or-update-comment/i;
 var EPHEMERAL_ARTIFACT_ONLY_PATTERN = /actions\/upload-artifact/i;
+var SCHEDULED_HEALTH_PATH_PATTERN = /(?:health|smoke|monitor|status|uptime|canary)/i;
+var SCHEDULED_HEALTH_INTENT_PATTERN = /\b(?:product[- ]?health|health check|smoke test|monitor(?:ing)?|uptime|canary|fault detection)\b/i;
 var RLS_PATTERN = /row level security|enable rls|create policy|tenant[_-]?id|studio[_-]?id/i;
 var DB_CLIENT_PATTERN = /\b(pg|mysql|mysql2|sqlite3|mongodb|mongoose|sequelize|drizzle|prisma|knex|typeorm|redis|ioredis|better-sqlite3|asyncpg|psycopg2?|sqlalchemy|pymongo|aiosqlite|database\/sql|gorm|sqlx|diesel|rusqlite|ActiveRecord|Sequel|PDO|JDBC|Hibernate)\b/i;
 var ENV_READ_PATTERN = /process\.env\b|Deno\.env\b|os\.environ\b|getenv\s*\(|std::env::|ENV\[/;
 var TENANT_SCOPE_PATTERN = /tenantId|tenant_id|studioId|studio_id|organizationId|org_id|workspaceId/i;
+var TENANT_SCOPE_PATTERN_V10 = /tenantId|tenant_id|studioId|studio_id|organizationId|organization_id|org_id|accountTenantId|account_tenant_id/i;
+var TENANT_SCOPE_PATTERN_V11 = /tenantId|tenant_id|accountTenantId|account_tenant_id/i;
 var HUMAN_GATE_MARKER_PATTERN = /human[- ]executed|human[- ]gated|operator[- ]run|never agent-run|agents? (?:never|does not|do not) (?:hold|execute|run) (?:prod(?:uction)?\s+)?(?:admin|db) (?:credential|privilege)/i;
 var ROLE_MEMBERSHIP_GRANT_PATTERN = /\bGRANT\s+(?!SELECT\b|INSERT\b|UPDATE\b|DELETE\b|USAGE\b|ALL\b|EXECUTE\b|TRIGGER\b|REFERENCES\b|CREATE\b|CONNECT\b|TEMP(?:ORARY)?\b)[A-Za-z_]\w*\s+TO\b/i;
 var SUPERUSER_ESCALATION_PATTERN = /\b(ALTER|CREATE)\s+(ROLE|USER)\s+\w+[^;]*\bSUPERUSER\b/i;
 var SQL_EXEC_PATTERN = /\.execute\s*\(|sql\.raw\s*\(/;
+var EXECUTED_ESCALATION_LITERAL_PATTERN = /(?:\.execute|sql\.raw)\s*\(\s*(?:[rubf]+)?["'`][^"'`]{0,500}(?:GRANT\s+(?!SELECT\b|INSERT\b|UPDATE\b|DELETE\b|USAGE\b|ALL\b|EXECUTE\b|TRIGGER\b|REFERENCES\b|CREATE\b|CONNECT\b|TEMP(?:ORARY)?\b)[A-Za-z_]\w*\s+TO\b|(?:ALTER|CREATE)\s+(?:ROLE|USER)\s+\w+[^;]*\bSUPERUSER\b)/i;
+function fileHasExecutedPrivilegeEscalation(repoPath, file) {
+  return fileContains(repoPath, file, EXECUTED_ESCALATION_LITERAL_PATTERN);
+}
 var GATED_PRIVILEGE_CHECK_PATTERN = /pg_has_role\s*\(|has_role\s*\(|is not a member of/i;
 var SET_ROLE_PATTERN = /\bset\s+(local\s+)?role\b/i;
 var REQUIRED_REVIEW_PATTERN = /required review|branch protection|protected branch/i;
 var HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT = 5e3;
-var SECRET_ASSIGNMENT_PATTERN = /[A-Za-z0-9_]*(?:secret|token|api[_-]?key|password|access[_-]?key)[A-Za-z0-9_]*\s*[:=]\s*['"]?([^'"\s]+)/gi;
+var SECRET_IDENTIFIER_KEYWORD_PATTERN = /secret|token|api[_-]?key|password|access[_-]?key/gi;
+var SINGLE_WHITESPACE_PATTERN = /\s/u;
 var SECRET_VALUE_BRANDED_PATTERN = /^(?:sk-[A-Za-z0-9_-]{24,}|sk-ant-api\d{2}-[A-Za-z0-9_-]{80,}|ghp_[A-Za-z0-9_]{30,}|xox[baprs]-[A-Za-z0-9-]{24,}|AKIA[0-9A-Z]{16}|vcp_[A-Za-z0-9_:-]{24,})$/;
 var GENERIC_SECRET_SHAPE_PATTERN = /^[A-Za-z0-9/+_-]{40,}$/;
 var KNOWN_HEX_DIGEST_LENGTHS = /* @__PURE__ */ new Set([32, 40, 64, 128]);
@@ -6360,23 +6966,25 @@ var NEGATIVE_SPACE_SECTION_PATTERN = /^#{1,6}\s*(?:security\s+)?(?:limitations?|
 var NEGATIVE_SPACE_PHRASE_PATTERN = /does not (?:protect|defend|guard|cover)s? against|not (?:covered|protected|defended) by this|out of scope for this (?:library|package|tool|sdk|project)/i;
 var LEAN_TEST_RUNNER_SCRIPT_PATTERN = /\bnode\s+(?:--test\b|--experimental-test-coverage\b)/;
 var LEAN_TEST_RUNNER_IMPORT_PATTERN = /from\s+['"]node:test['"]|require\(\s*['"]node:test['"]\s*\)/;
-var HEAVY_TEST_DEPENDENCY_NAME_PATTERN = /^(?:jest|mocha|ava|tape|jasmine|karma)(?:$|-|\/)/i;
+var HEAVY_TEST_DEPENDENCY_NAME_PATTERN = /^(?:(?:jest|mocha|ava|tape|jasmine|karma|vitest|cypress|playwright)(?:$|-|\/)|@(?:vitest|playwright)\/)/i;
 var TIMING_SAFE_COMPARE_PATTERN = /\btiming[-_]?safe[-_]?(?:equal|compare)\b|crypto\.timingSafeEqual\s*\(/i;
 var CANONICAL_SERIALIZE_PATTERN = /\bcanonicalize\s*\(|\bcanonicalJson\b|\bstableStringify\s*\(|json-stable-stringify|safe-stable-stringify|\bsortKeys\s*\(/i;
 var SIGN_OR_HMAC_CALL_PATTERN = /\bcreateHmac\s*\(|\bcreateSign\s*\(|\.sign\s*\(/;
 var INSECURE_SECRET_COMPARE_LINE_PATTERN = /\b\w*(?:hmac|signature|\bmac|digest)\w*\s*(===|!==)\s*(?!['"`]|undefined\b|null\b)([\w.]+(?:\s*[-+]\s*\d+)?)/i;
+var DEFAULT_SECRET_SENTINEL_COMPARE_LINE_PATTERN = /\b(?:secret|token|password|apiKey)\w*\s*(?:===|!==|==|!=)\s*[\w.]*default(?:Secret|Token|Password|ApiKey)\b/i;
 var NUMERIC_SHAPED_OPERAND_PATTERN = /^-?\d+$|\.(?:length|len|size|count)\b|(?:length|index|idx|offset|count|size|len)$/i;
-function lineHasInsecureSecretCompare(line) {
+function lineHasInsecureSecretCompare(line, useV39Detectors = false) {
+  if (useV39Detectors && DEFAULT_SECRET_SENTINEL_COMPARE_LINE_PATTERN.test(line)) return true;
   const match = INSECURE_SECRET_COMPARE_LINE_PATTERN.exec(line);
   const operand = match?.[2];
   if (!operand) return false;
   return !NUMERIC_SHAPED_OPERAND_PATTERN.test(operand.trim());
 }
-function findInsecureSecretCompareLine(repoPath, file) {
+function findInsecureSecretCompareLine(repoPath, file, useV39Detectors = false) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return null;
   const lines = readFileSync(fullPath, "utf8").split("\n");
-  const index = lines.findIndex((line) => lineHasInsecureSecretCompare(line));
+  const index = lines.findIndex((line) => lineHasInsecureSecretCompare(line, useV39Detectors));
   return index === -1 ? null : index + 1;
 }
 function findFirstMatchingLine(repoPath, file, pattern) {
@@ -6386,7 +6994,49 @@ function findFirstMatchingLine(repoPath, file, pattern) {
   const index = lines.findIndex((line) => pattern.test(line));
   return index === -1 ? null : index + 1;
 }
+function lineAt(repoPath, file, line) {
+  if (line < 1) return null;
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return null;
+  return readFileSync(fullPath, "utf8").split("\n")[line - 1] ?? null;
+}
 var UNSORTED_JSON_SIGN_PATTERN = /\.update\s*\(\s*JSON\.stringify\s*\(|\.sign\s*\([^)]*JSON\.stringify\s*\(/;
+var UNSORTED_JSON_DIRECT_SIGN_PATTERN = /\.sign\s*\([^)]*JSON\.stringify\s*\(/;
+var UNSORTED_JSON_CONSTRUCTOR_UPDATE_PATTERN = /\bcreate(?:Hmac|Sign)\s*\([^;\n]{0,256}\)\s*\.update\s*\(\s*JSON\.stringify\s*\(/;
+var JSON_STRINGIFY_ASSIGNMENT_PATTERN = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*JSON\.stringify\s*\(/g;
+function findUnsortedJsonHmacLine(repoPath, file) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return null;
+  const contents = readFileSync(fullPath, "utf8");
+  const directSign = findFirstMatchingLine(repoPath, file, UNSORTED_JSON_DIRECT_SIGN_PATTERN);
+  if (directSign !== null) return directSign;
+  const directConstructorUpdate = findFirstMatchingLine(
+    repoPath,
+    file,
+    UNSORTED_JSON_CONSTRUCTOR_UPDATE_PATTERN
+  );
+  if (directConstructorUpdate !== null) return directConstructorUpdate;
+  JSON_STRINGIFY_ASSIGNMENT_PATTERN.lastIndex = 0;
+  let match = JSON_STRINGIFY_ASSIGNMENT_PATTERN.exec(contents);
+  while (match !== null) {
+    const identifier = match[1];
+    if (identifier) {
+      const escaped = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const constructorUpdate = new RegExp(
+        `\\bcreate(?:Hmac|Sign)\\s*\\([^;\\n]{0,256}\\)\\s*\\.update\\s*\\(\\s*${escaped}\\b`
+      );
+      const usageWindow = contents.slice(match.index, match.index + 2048);
+      if (constructorUpdate.test(usageWindow)) {
+        return contents.slice(0, match.index).split("\n").length;
+      }
+    }
+    match = JSON_STRINGIFY_ASSIGNMENT_PATTERN.exec(contents);
+  }
+  return null;
+}
+function fileHasVariableUnsortedJsonHmac(repoPath, file) {
+  return findUnsortedJsonHmacLine(repoPath, file) !== null;
+}
 var KILL_SWITCH_NAME_FRAGMENT = "kill[_-]?switch|emergency[_-]?stop|circuit[_-]?breaker|safety[_-]?(?:toggle|gate|switch)|governance[_-]?(?:toggle|gate)";
 var KILL_SWITCH_NAME_PATTERN = new RegExp(`\\b(?:${KILL_SWITCH_NAME_FRAGMENT})\\b`, "i");
 var KILL_SWITCH_FAIL_CLOSED_PATTERN = new RegExp(
@@ -6431,19 +7081,23 @@ function looksLikeSecretValue(value) {
   return SECRET_VALUE_BRANDED_PATTERN.test(value) || isGenericSecretValue(value);
 }
 var PLACEHOLDER_SECRET_PATTERN = /(?:^|[-_])(?:your|example|sample|placeholder|dummy|changeme|replace(?:-?me)?|redacted)(?:$|[-_])|^x{3,}$|^\.\.\.|^\$\{[^}]+}$|^<[^>]+>$/i;
-var ENV_TEMPLATE_PATTERN = /(^|\/)\.env\.(example|sample|template|dist)$/;
-function isEnvTemplatePath(path) {
-  return ENV_TEMPLATE_PATTERN.test(path);
+var ENV_TEMPLATE_PATTERN = /(^|\/)\.env(?:\.[^/]+)*\.(?:example|sample|template|dist)$/i;
+var ENV_TEMPLATE_PATTERN_V47 = /(^|\/)\.env(?:\.[^/]+)*\.(?:example|sample|template|dist|exemplo|ejemplo|exemple|esempio|beispiel|voorbeeld)$/i;
+function isEnvTemplatePath(path, useV47Detectors = false) {
+  return (useV47Detectors ? ENV_TEMPLATE_PATTERN_V47 : ENV_TEMPLATE_PATTERN).test(path);
 }
 var HARD_EXCLUDED_PATH_PATTERN = /(^|\/)(?:\.git|\.venv|venv|site-packages|node_modules|dist|build|\.next|__pycache__|vendor|\.terraform|coverage)(?:\/|$)/;
 var COVERAGE_PERCENT_PATTERN = /(?:statements|branches|lines|functions|fail_under)\s*[:=]\s*["']?(\d+(?:\.\d+)?)/gi;
 function listRepoFiles(repoPath) {
-  const gitFiles = listGitTrackedFiles(repoPath);
+  const gitFiles = listGitTrackedFiles(repoPath, false);
   if (gitFiles) return gitFiles;
   const files = [];
   visitRepoDir(repoPath, repoPath, files);
   return files.filter((file) => !isHardExcludedPath(file)).sort();
 }
+function listRepoInventory(repoPath, fallbackFiles) {
+  return listGitTrackedFiles(repoPath, true) ?? [...fallbackFiles];
+}
 function resolveMonorepoContext(repoPath) {
   let top;
   try {
@@ -6476,7 +7130,7 @@ function resolveMonorepoContext(repoPath) {
   if (sharedFiles.length === 0) return null;
   return { root: rootResolved, sharedFiles };
 }
-function listGitTrackedFiles(repoPath) {
+function listGitTrackedFiles(repoPath, includeHardExcluded = false) {
   try {
     execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
       cwd: repoPath,
@@ -6490,7 +7144,7 @@ function listGitTrackedFiles(repoPath) {
     }).trim();
     if (!output) return [];
     return output.split("\n").filter(
-      (file) => file.length > 0 && !isHardExcludedPath(file) && isRegularFile(join(repoPath, file))
+      (file) => file.length > 0 && (includeHardExcluded || !isHardExcludedPath(file)) && isRegularFile(join(repoPath, file))
     ).sort();
   } catch {
     return null;
@@ -6895,43 +7549,205 @@ function parseJsonObject(contents) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isTestRunnerConfig(file) {
-  return /(^|\/)(vitest|jest|pytest|playwright|cypress|mocha)\.config\.[cm]?[jt]s$/.test(file) || /(^|\/)(pytest\.ini|tox\.ini|go\.mod|Cargo\.toml)$/.test(file) || /(^|\/)CMakeLists\.txt$/.test(file) || /(^|\/)Makefile$/.test(file) || /(^|\/)phpunit\.xml(\.dist)?$/.test(file);
+function isTestRunnerConfig(repoPath, file) {
+  return /(^|\/)(vitest|jest|pytest|playwright|cypress|mocha)\.config\.[cm]?[jt]s$/.test(file) || /(^|\/)(pytest\.ini|tox\.ini)$/.test(file) || /(^|\/)phpunit\.xml(\.dist)?$/.test(file) || /(^|\/)pyproject\.toml$/.test(file) && fileContains(repoPath, file, /^\[tool\.pytest(?:\.|\])/m) || /(^|\/)CMakeLists\.txt$/.test(file) && fileContains(repoPath, file, /\b(?:enable_testing|add_test|ctest_add_tests)\s*\(/i) || /(^|\/)Makefile$/.test(file) && fileContains(repoPath, file, /^\s*(?:test|tests|check)\s*:/m);
 }
-function isCoverageConfig(file) {
-  return /(^|\/)(nyc|c8|coverage|codecov)\.(json|yml|yaml)$/.test(file) || /(^|\/)\.coveragerc$/.test(file) || /(^|\/)lcov\.info$/.test(file) || /(^|\/)\.coveralls\.yml$/.test(file) || fileContainsExtension(file, ["vitest.config.ts", "jest.config.js", "pyproject.toml"]);
+function findCoverageConfigFiles(repoPath, repoFiles, authoredOnly = false) {
+  return repoFiles.filter(
+    (file) => (!authoredOnly || isAuthoredProductionPath(file)) && isCoverageConfig(repoPath, file)
+  );
 }
-function fileContainsExtension(file, names) {
-  return names.some((name) => file.endsWith(name));
+function findConcreteTestFiles(repoPath, repoFiles) {
+  const contentCppTests = collectContentBasedCppTestFiles(repoPath, repoFiles);
+  return [...repoFiles.filter(isTestFile), ...contentCppTests.filter((file) => !isTestFile(file))];
+}
+function findConfiguredTestRunnerFiles(repoPath, repoFiles) {
+  const configured = repoFiles.filter(
+    (file) => isAuthoredProductionPath(file) && isTestRunnerConfig(repoPath, file)
+  );
+  for (const packageJson of repoFiles.filter(
+    (file) => /(^|\/)package\.json$/.test(file) && isAuthoredProductionPath(file)
+  )) {
+    if ([...readPackageScripts(join(repoPath, packageJson)).values()].some(
+      (script) => TEST_RUNNER_PATTERN.test(script)
+    )) {
+      configured.push(packageJson);
+    }
+  }
+  configured.push(
+    ...repoFiles.filter((file) => isAuthoredProductionPath(file) && isCiWorkflow(file)).filter((file) => fileContains(repoPath, file, CI_TEST_COMMAND_PATTERN))
+  );
+  return [...new Set(configured)].sort();
+}
+function findTenantStoragePremiseFiles(repoPath, repoFiles) {
+  return repoFiles.filter((file) => /(^|\/)(?:migrations?|drizzle|prisma)\/|\.(?:sql|prisma)$/i.test(file)).filter((file) => fileContains(repoPath, file, TENANT_SCOPE_PATTERN_V11));
+}
+function findRlsPolicyFiles(repoPath, repoFiles) {
+  return repoFiles.filter((file) => /(^|\/)(?:migrations?|drizzle|prisma)\/|\.(?:sql|prisma)$/i.test(file)).filter(
+    (file) => fileContains(
+      repoPath,
+      file,
+      /\b(?:create\s+policy|enable\s+row\s+level\s+security|force\s+row\s+level\s+security)\b/i
+    )
+  );
+}
+function findDeployableServicePremiseFiles(repoPath, repoFiles, strictOperationalBoundary = false) {
+  const explicitTargets = repoFiles.filter(
+    (file) => isAuthoredProductionPath(file) && isExplicitDeployTarget(file) && (!strictOperationalBoundary || isV47OperationalApplicationPath(file))
+  );
+  const deployWorkflows = repoFiles.filter((file) => isAuthoredProductionPath(file) && isCiWorkflow(file)).filter((file) => fileContains(repoPath, file, CI_DEPLOY_JOB_PATTERN)).filter(
+    (file) => !strictOperationalBoundary || !isDocumentationOnlyDeployWorkflow(repoPath, file)
+  );
+  const serverEntrypoint = findServerEntrypointFile(repoPath, repoFiles, true);
+  const runtimeContainer = findRuntimeContainerEntrypointFile(repoPath, repoFiles);
+  if (strictOperationalBoundary) {
+    const runtimeFiles = [serverEntrypoint, runtimeContainer].filter(
+      (file) => file != null && isV47OperationalApplicationPath(file)
+    );
+    const directApplicationTargets = explicitTargets.filter(
+      (file) => !isInfrastructureOnlyDeployTarget(file)
+    );
+    const infrastructureTargets = runtimeFiles.length > 0 ? [...explicitTargets.filter(isInfrastructureOnlyDeployTarget), ...deployWorkflows] : [];
+    return [...directApplicationTargets, ...runtimeFiles, ...infrastructureTargets];
+  }
+  return [
+    ...explicitTargets,
+    ...deployWorkflows,
+    ...serverEntrypoint && (!strictOperationalBoundary || isV47OperationalApplicationPath(serverEntrypoint)) ? [serverEntrypoint] : [],
+    ...runtimeContainer && (!strictOperationalBoundary || isV47OperationalApplicationPath(runtimeContainer)) ? [runtimeContainer] : []
+  ];
+}
+function isInfrastructureOnlyDeployTarget(file) {
+  return /(^|\/)docker-compose\.ya?ml$/i.test(file) || /(^|\/)(?:k8s|kubernetes|manifests?)\/.+\.ya?ml$/i.test(file) || /(^|\/)(?:charts?|helm)\/.+\.ya?ml$/i.test(file);
+}
+var V47_NON_OPERATIONAL_APPLICATION_PATH_PATTERN = /(^|\/)(?:cookbooks?|lessons?|tutorials?|docs?|documentation|examples?|samples?|demos?)(\/|$)/i;
+function isV47OperationalApplicationPath(path) {
+  return !V47_NON_OPERATIONAL_APPLICATION_PATH_PATTERN.test(path);
+}
+function isDocumentationOnlyDeployWorkflow(repoPath, file) {
+  if (/(?:docs?|pages?)/i.test(basename(file))) return true;
+  return fileContains(
+    repoPath,
+    file,
+    /\b(?:deploy[-_ ]?docs?|mkdocs|docusaurus|vitepress|gh-pages|github pages)\b/i
+  );
+}
+function findPackagedApplicationPremiseFiles(repoPath, repoFiles) {
+  return repoFiles.filter((file) => /(^|\/)package\.json$/.test(file) && isAuthoredProductionPath(file)).filter((file) => packageJsonDescribesPackagedApplication(repoPath, file, repoFiles));
+}
+function findClaimSourceFiles(repoFiles) {
+  return repoFiles.filter(
+    (file) => /^(?:README|readme)\.md$/.test(file) || /^docs\/[^/]+\.(?:md|mdx)$/.test(file)
+  ).sort((left, right) => {
+    const leftRootReadme = /^(?:README|readme)\.md$/.test(left);
+    const rightRootReadme = /^(?:README|readme)\.md$/.test(right);
+    return Number(rightRootReadme) - Number(leftRootReadme) || left.localeCompare(right);
+  });
+}
+function findClaimImplementationFiles(repoFiles, authoredOnly = false) {
+  return repoFiles.filter(
+    (file) => isImplementationFile(file) && (!authoredOnly || isAuthoredProductionPath(file))
+  );
+}
+function findClaimRealityReconciliationArtifacts(repoPath, repoFiles) {
+  return repoFiles.filter((file) => /(^|\/)claim[-_]reality[-_]reconciliation\.(?:md|mdx|json)$/i.test(file)).filter((file) => isAuthenticatedClaimRealityArtifact(repoPath, file));
+}
+function isAuthenticatedClaimRealityArtifact(repoPath, file) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return false;
+  const contents = readFileSync(fullPath, "utf8");
+  if (/\.json$/i.test(file)) {
+    return parseJsonObject(contents)?.artifactKind === "claim_reality_reconciliation";
+  }
+  let inFence = false;
+  for (const line of contents.split(/\r?\n/)) {
+    if (/^\s*(?:```|~~~)/.test(line)) {
+      inFence = !inFence;
+      continue;
+    }
+    if (!inFence && /^#\s+Claim Reality Reconciliation\s*$/i.test(line)) return true;
+  }
+  return false;
+}
+function isCoverageConfig(repoPath, file) {
+  if (/(^|\/)(nyc|c8|coverage|codecov)\.(json|yml|yaml)$/.test(file) || /(^|\/)\.coveragerc$/.test(file) || /(^|\/)lcov\.info$/.test(file) || /(^|\/)\.coveralls\.yml$/.test(file)) {
+    return true;
+  }
+  if (/(^|\/)vitest\.config\.[cm]?[jt]s$/.test(file)) {
+    return fileContains(repoPath, file, /\bcoverage\s*:/i);
+  }
+  if (/(^|\/)jest\.config\.[cm]?[jt]s$/.test(file)) {
+    return fileContains(
+      repoPath,
+      file,
+      /\b(?:collectCoverage|coverageThreshold|coverageProvider|coverageDirectory)\s*:/
+    );
+  }
+  if (/(^|\/)pyproject\.toml$/.test(file)) {
+    return fileContains(repoPath, file, /^\[tool\.coverage(?:\.|\])/m);
+  }
+  return false;
 }
 function isCiWorkflow(file) {
   return /^\.github\/workflows\/.+\.ya?ml$/.test(file) || /^\.gitlab-ci\.ya?ml$/.test(file) || /^\.circleci\/config\.ya?ml$/.test(file) || /^azure-pipelines\.ya?ml$/.test(file) || /^Jenkinsfile$/.test(file);
 }
 function isDeployConfig(file) {
-  return /^(vercel|netlify|fly|render|railway)\.(json|toml|ya?ml)$/.test(file) || /^Dockerfile$/.test(file) || /^docker-compose\.ya?ml$/.test(file) || /^k8s\//.test(file);
+  return /(^|\/)(vercel|netlify|fly|render|railway)\.(json|toml|ya?ml)$/.test(file) || /(^|\/)Dockerfile$/.test(file) || /(^|\/)docker-compose\.ya?ml$/.test(file) || /(^|\/)k8s\//.test(file);
 }
 function isExplicitDeployTarget(file) {
-  return /^(vercel|netlify|fly|render|railway)\.(json|toml|ya?ml)$/.test(file) || /^docker-compose\.ya?ml$/.test(file) || /^Procfile$/.test(file) || /^app\.ya?ml$/.test(file) || /^serverless\.ya?ml$/.test(file) || /^(k8s|kubernetes|manifests?)\/.+\.ya?ml$/i.test(file) || /^(charts?|helm)\/.+\.ya?ml$/i.test(file);
+  return /(^|\/)(vercel|netlify|fly|render|railway)\.(json|toml|ya?ml)$/.test(file) || /(^|\/)docker-compose\.ya?ml$/.test(file) || /(^|\/)Procfile$/.test(file) || /(^|\/)app\.ya?ml$/.test(file) || /(^|\/)serverless\.ya?ml$/.test(file) || /(^|\/)(k8s|kubernetes|manifests?)\/.+\.ya?ml$/i.test(file) || /(^|\/)(charts?|helm)\/.+\.ya?ml$/i.test(file);
 }
 var MAIN_ENTRYPOINT_FILE_PATTERN = /(^|\/)(main|server|app|wsgi|asgi|index|entry|start|run)\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs)$/i;
+var RACK_ENTRYPOINT_FILE_PATTERN = /(^|\/)(?:config\.ru|(?:main|server|app|start|run)\.rb)$/i;
 var SERVER_ENTRYPOINT_PATTERN = /\bapp\.listen\s*\(|\bserver\.listen\s*\(\s*(?:PORT|port|\d+)|http\.ListenAndServe\s*\(|http\.ListenAndServeTLS\s*\(|axum::Server(?:::|\.)|actix_web::HttpServer(?:::|\.)|uvicorn\.run\s*\(/;
+var RACK_SERVER_ENTRYPOINT_PATTERN = /Rack::(?:Server|Handler(?:::\w+)?)\.(?:start|run)\s*\(/;
+var RACK_CONFIG_RUN_PATTERN = /^\s*run\s+(?:(?:[A-Z]\w*(?:::\w+)*(?:\.new)?|lambda)\b|->)/m;
+var RUNTIME_CONTAINER_COMMAND_PATTERN = /^\s*(?:CMD|ENTRYPOINT)\s+.*(?:\b(?:start|serve|server|qgis|nginx|apache|gunicorn|uvicorn)\b|manage\.py\s+runserver).*$/im;
+var NON_RUNTIME_CONTAINER_COMMAND_PATTERN = /\b(?:test|lint|build|compile|package|check)\b/i;
 var CI_DEPLOY_JOB_PATTERN = /(?:^\s{2,4}deploy\s*:|\b(?:fly|heroku|vercel|netlify|railway|render)\s+deploy\b|kubectl\s+apply\b|helm\s+(?:install|upgrade|deploy)\b|docker\s+push\b)/im;
-function isDeployableService(repoPath, repoFiles) {
-  if (repoFiles.some(isExplicitDeployTarget)) return true;
-  if (detectCiDeployJob(repoPath, repoFiles)) return true;
-  if (detectServerEntrypoint(repoPath, repoFiles)) return true;
+function isDeployableService(repoPath, repoFiles, useV27Detectors) {
+  if (repoFiles.some(
+    (file) => (useV27Detectors ? isAuthoredProductionPath(file) : isProductionSourcePath(file)) && isExplicitDeployTarget(file)
+  )) {
+    return true;
+  }
+  if (detectCiDeployJob(repoPath, repoFiles, useV27Detectors)) return true;
+  if (detectServerEntrypoint(repoPath, repoFiles, useV27Detectors)) return true;
+  if (useV27Detectors && findRuntimeContainerEntrypointFile(repoPath, repoFiles)) return true;
   return false;
 }
-function detectCiDeployJob(repoPath, repoFiles) {
-  const workflows = repoFiles.filter(isCiWorkflow);
+function detectCiDeployJob(repoPath, repoFiles, authoredOnly = false) {
+  const workflows = repoFiles.filter(
+    (file) => (!authoredOnly || isAuthoredProductionPath(file)) && isCiWorkflow(file)
+  );
   return workflows.some((file) => fileContains(repoPath, file, CI_DEPLOY_JOB_PATTERN));
 }
-function detectServerEntrypoint(repoPath, repoFiles) {
-  return findServerEntrypointFile(repoPath, repoFiles) !== null;
+function detectServerEntrypoint(repoPath, repoFiles, useV27Detectors) {
+  return findServerEntrypointFile(repoPath, repoFiles, useV27Detectors) !== null;
 }
-function findServerEntrypointFile(repoPath, repoFiles) {
-  const candidates = repoFiles.filter((file) => MAIN_ENTRYPOINT_FILE_PATTERN.test(file) && isProductionSourcePath(file)).slice(0, 30);
-  return candidates.find((file) => fileContains(repoPath, file, SERVER_ENTRYPOINT_PATTERN)) ?? null;
+function findServerEntrypointFile(repoPath, repoFiles, useV27Detectors) {
+  const candidates = repoFiles.filter(
+    (file) => (MAIN_ENTRYPOINT_FILE_PATTERN.test(file) || useV27Detectors && RACK_ENTRYPOINT_FILE_PATTERN.test(file)) && (useV27Detectors ? isAuthoredProductionPath(file) : isProductionSourcePath(file))
+  ).slice(0, 30);
+  return candidates.find(
+    (file) => fileContains(repoPath, file, SERVER_ENTRYPOINT_PATTERN) || useV27Detectors && fileContains(repoPath, file, RACK_SERVER_ENTRYPOINT_PATTERN) || useV27Detectors && /\.ru$/i.test(file) && fileContains(repoPath, file, RACK_CONFIG_RUN_PATTERN)
+  ) ?? null;
+}
+function findRuntimeContainerEntrypointFile(repoPath, repoFiles) {
+  return repoFiles.filter((file) => /(^|\/)Dockerfile$/i.test(file) && isAuthoredProductionPath(file)).find((file) => {
+    const fullPath = join(repoPath, file);
+    if (!isRegularFile(fullPath)) return false;
+    const lines = readFileSync(fullPath, "utf8").split(/\r?\n/);
+    const finalStageStart = lines.reduce(
+      (last, line, index) => /^\s*FROM\b/i.test(line) ? index : last,
+      0
+    );
+    const finalStageLines = lines.slice(finalStageStart);
+    const entrypoint = [...finalStageLines].reverse().find((line) => /^\s*ENTRYPOINT\b/i.test(line));
+    const command = [...finalStageLines].reverse().find((line) => /^\s*CMD\b/i.test(line));
+    const effectiveCommand = [entrypoint, command].filter(Boolean).join(" ");
+    return effectiveCommand.length > 0 && RUNTIME_CONTAINER_COMMAND_PATTERN.test(effectiveCommand) && !NON_RUNTIME_CONTAINER_COMMAND_PATTERN.test(effectiveCommand);
+  }) ?? null;
 }
 function isHealthCheckSignalFile(repoPath, file) {
   if (/docs\/|audit|architecture|adr/i.test(file)) return false;
@@ -6978,6 +7794,42 @@ function packageJsonHasHeavyTestDependency(repoPath, manifest) {
   ];
   return names.some((name) => HEAVY_TEST_DEPENDENCY_NAME_PATTERN.test(name));
 }
+function packageJsonDescribesPackagedApplication(repoPath, manifest, repoFiles) {
+  const fullPath = join(repoPath, manifest);
+  if (!isRegularFile(fullPath)) return false;
+  const parsed = parseJsonObject(readFileSync(fullPath, "utf8"));
+  if (!parsed) return false;
+  const scripts = isRecord(parsed.scripts) ? Object.values(parsed.scripts) : [];
+  const dependencies = {
+    ...isRecord(parsed.dependencies) ? parsed.dependencies : {},
+    ...isRecord(parsed.devDependencies) ? parsed.devDependencies : {}
+  };
+  const build = isRecord(parsed.build) ? parsed.build : null;
+  const hasDesktopRuntime = Object.keys(dependencies).some(
+    (name) => name.toLowerCase() === "electron" || /^@tauri-apps\/(?:api|plugin-)/i.test(name)
+  );
+  const hasPackagingCommand = scripts.some(
+    (script) => typeof script === "string" && /\b(?:electron-builder|electron-packager|tauri\s+build)\b/i.test(script)
+  );
+  const hasApplicationMetadata = isNonEmptyString(parsed.productName) || isNonEmptyString(parsed.main) || build != null && isNonEmptyString(build.appId) || findTauriApplicationMetadata(repoPath, manifest, repoFiles);
+  return hasDesktopRuntime && hasPackagingCommand && hasApplicationMetadata;
+}
+function findTauriApplicationMetadata(repoPath, manifest, repoFiles) {
+  const manifestDirectory = dirname(manifest);
+  const prefix = manifestDirectory === "." ? "" : `${manifestDirectory}/`;
+  const candidates = [`${prefix}src-tauri/tauri.conf.json`, `${prefix}tauri.conf.json`];
+  return candidates.some((file) => {
+    if (!repoFiles.includes(file)) return false;
+    const fullPath = join(repoPath, file);
+    if (!isRegularFile(fullPath)) return false;
+    const config = parseJsonObject(readFileSync(fullPath, "utf8"));
+    const packageMetadata = isRecord(config?.package) ? config.package : null;
+    return isNonEmptyString(config?.productName) || isNonEmptyString(config?.identifier) || packageMetadata != null && isNonEmptyString(packageMetadata.productName);
+  });
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
 function isImplementationFile(file) {
   return /(^|\/)(src|app|lib|packages|cmd|include|source|Sources)\//.test(file) && /\.(ts|tsx|js|jsx|py|go|rs|java|rb|cpp|cc|cxx|c|h|hpp|kt|swift|php)$/.test(file);
 }
@@ -7001,8 +7853,8 @@ function isSecurityPolicyOnlyAuditFile(file) {
 function isFreshnessRatableAuditFile(file) {
   return isAuditFile(file) && !isSecurityPolicyOnlyAuditFile(file);
 }
-function isIgnoredScanFile(file) {
-  return /(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|README\.md|CHANGELOG\.md)$/.test(file) || isEnvTemplatePath(file);
+function isIgnoredScanFile(file, useV47Detectors = false) {
+  return /(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|README\.md|CHANGELOG\.md)$/.test(file) || isEnvTemplatePath(file, useV47Detectors);
 }
 function findRootPackageJson(repoFiles) {
   return repoFiles.includes("package.json") ? "package.json" : null;
@@ -7019,46 +7871,315 @@ function fileContains(repoPath, file, pattern) {
   if (!isRegularFile(fullPath)) return false;
   return pattern.test(readFileSync(fullPath, "utf8"));
 }
-function fileContainsCommittedSecret(repoPath, file) {
+function findCommittedSecretInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
   const fullPath = join(repoPath, file);
-  if (!isRegularFile(fullPath)) return false;
-  return containsRealSecret(readFileSync(fullPath, "utf8"));
+  if (!isRegularFile(fullPath)) return null;
+  const contents = readFileSync(fullPath, "utf8");
+  const isTestCredentialConfiguration = useV39Detectors && isLikelyTestCredentialConfiguration(file, contents);
+  const secretScanContents = prepareCredentialScanContents(
+    contents,
+    file,
+    useV36Detectors,
+    useV39Detectors,
+    useV47Detectors
+  );
+  const secret = findRealSecretAssignment(secretScanContents, /* @__PURE__ */ new Set(), {
+    allowCredentialNamedDigest: useV36Detectors
+  });
+  if (secret) return secret;
+  if (useV39Detectors && isEnvHistoryPath(file, useV36Detectors)) {
+    const weakCredential = findWeakExplicitEnvCredential(secretScanContents);
+    if (weakCredential) return weakCredential;
+  }
+  return useV36Detectors && !isTestCredentialConfiguration ? findDefaultAdministrativeCredential(secretScanContents) : null;
+}
+function prepareCredentialScanContents(contents, file, useV36Detectors, useV39Detectors, useV47Detectors = false) {
+  const withoutXamlEventNames = useV36Detectors && /\.xaml$/i.test(file) ? contents.replace(/\bTokenItem(?:Added|Removed)(?=\s*=)/gi, "EventHandler") : contents;
+  const withoutDocumentationExamples = useV39Detectors ? stripCommentAndDocumentationExamples(withoutXamlEventNames) : withoutXamlEventNames;
+  return useV47Detectors ? stripV47PublicIdentifiersAndNonCredentialValues(withoutDocumentationExamples, file) : withoutDocumentationExamples;
+}
+function stripV47PublicIdentifiersAndNonCredentialValues(contents, file) {
+  const lines = contents.split(/\r?\n/);
+  return lines.map((line, index) => {
+    let sanitized = line.replace(
+      /^(\s*(?:export\s+)?(?:PUBLIC_)?ALGOLIA_(?:PUBLIC_)?API_KEY\s*[:=]\s*)[^\s#]+/i,
+      '$1""'
+    );
+    if (isPublicDocumentationSearchKeyContext(lines, index, file)) {
+      sanitized = sanitized.replace(/(\bapiKey\s*[:=]\s*)(['"])[^'"]+\2/gi, "$1$2$2");
+    }
+    sanitized = sanitized.replace(
+      /(\b[A-Za-z_][A-Za-z0-9_]*(?:token|api[_-]?key|access[_-]?key)[A-Za-z0-9_]*\s*[:=]\s*)(['"]?)0x[0-9a-f]{40}\2/gi,
+      '$1""'
+    );
+    sanitized = sanitized.replace(
+      /(\b[A-Za-z_][A-Za-z0-9_]*(?:token|api[_-]?key|access[_-]?key)[A-Za-z0-9_]*\s*[:=]\s*)(['"])([a-z][a-z0-9]*(?:_[a-z0-9]+){2,})\2/gi,
+      (assignment, prefix, quote, value) => /\b(?:cost|input|output|context|model|limit|price|usage|audio)\b/i.test(
+        value.replaceAll("_", " ")
+      ) ? `${prefix}${quote}${quote}` : assignment
+    );
+    return sanitized;
+  }).join("\n");
 }
-function containsRealSecret(contents) {
-  SECRET_ASSIGNMENT_PATTERN.lastIndex = 0;
-  for (const match of contents.matchAll(SECRET_ASSIGNMENT_PATTERN)) {
-    const rawValue = match[1];
-    if (!rawValue) continue;
-    const value = rawValue.replace(/[,;)]$/, "");
-    if (isPlaceholderSecretValue(value)) continue;
-    if (looksLikeSecretValue(value)) return true;
+function isPublicDocumentationSearchKeyContext(lines, lineIndex, file) {
+  const windowStart = Math.max(0, lineIndex - 6);
+  const preceding = lines.slice(windowStart, lineIndex + 1);
+  for (let index = preceding.length - 1; index >= 0; index -= 1) {
+    const candidate = preceding[index] ?? "";
+    if (/}/.test(candidate) && index < preceding.length - 1) return false;
+    if (/\bdocsearch(?:Options)?\b/i.test(candidate)) return true;
+    if (/\balgolia\b/i.test(candidate) && /(?:^|\/)(?:website|docs?)(?:\/|$)|(?:site[-_]?config|\.dumirc|docusaurus)/i.test(file)) {
+      return true;
+    }
   }
   return false;
 }
-function collectHistorySecretEvidence(repoPath) {
-  const historyEntries = readCredentialHistoryEntries(repoPath);
+function stripCommentAndDocumentationExamples(contents) {
+  let blockCommentEnd = null;
+  return contents.split(/\r?\n/).map((line) => {
+    const trimmed = line.trimStart();
+    if (blockCommentEnd) {
+      if (trimmed.includes(blockCommentEnd)) blockCommentEnd = null;
+      return "";
+    }
+    if (trimmed.startsWith("/*")) {
+      if (!trimmed.includes("*/")) blockCommentEnd = "*/";
+      return "";
+    }
+    if (trimmed.startsWith("<!--")) {
+      if (!trimmed.includes("-->")) blockCommentEnd = "-->";
+      return "";
+    }
+    if (/^(?:\/\/|#|\*)/.test(trimmed)) return "";
+    if (/\.description\s*\(/i.test(line) && /api[_-]?key|token|password|secret/i.test(line)) {
+      return "";
+    }
+    return line;
+  }).join("\n");
+}
+function isLikelyTestCredentialConfiguration(file, contents) {
+  if (!/\.(?:ya?ml|json|toml|ini|conf)$/i.test(file) && !/(?:^|\/)docker-compose/i.test(file)) {
+    return false;
+  }
+  const testMarkers = contents.match(/(?:^|[^A-Za-z])(?:tests?|testing|e2e|appium|fixture)(?:[^A-Za-z]|$)/gi)?.length ?? 0;
+  return testMarkers >= 2;
+}
+function hasTemplateOnlyEnvContent(repoPath, file) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return false;
+  const substantiveLines = readFileSync(fullPath, "utf8").split(/\r?\n/).filter((line) => line.trim().length > 0 && !/^\s*#/.test(line));
+  if (substantiveLines.length === 0) return true;
+  const assignments = substantiveLines.map(
+    (line) => /^\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*\s*=\s*(.*?)\s*$/.exec(line)?.[1] ?? null
+  );
+  if (assignments.some((value) => value === null)) return false;
+  return assignments.every((raw) => {
+    if (raw === null) return false;
+    const value = raw.replace(/^['"]|['"]$/g, "").trim();
+    return value.length === 0 || isPlaceholderSecretValue(value);
+  });
+}
+function findSecretFingerprintsInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return [];
+  const contents = readFileSync(fullPath, "utf8");
+  const scanContents = prepareCredentialScanContents(
+    contents,
+    file,
+    useV36Detectors,
+    useV39Detectors,
+    useV47Detectors
+  );
+  const fingerprints = findRealSecretAssignments(
+    scanContents,
+    /* @__PURE__ */ new Set(),
+    Number.POSITIVE_INFINITY,
+    { allowCredentialNamedDigest: useV36Detectors }
+  ).map(({ valueFingerprint }) => valueFingerprint);
+  if (useV39Detectors && isEnvHistoryPath(file, useV36Detectors)) {
+    const weakCredential = findWeakExplicitEnvCredential(scanContents);
+    if (weakCredential) fingerprints.push(weakCredential.valueFingerprint);
+  }
+  return [...new Set(fingerprints)];
+}
+function findRealSecretAssignment(contents, excludedValueFingerprints = /* @__PURE__ */ new Set(), options = {}) {
+  return findRealSecretAssignments(contents, excludedValueFingerprints, 1, options)[0] ?? null;
+}
+function findRealSecretAssignments(contents, excludedValueFingerprints = /* @__PURE__ */ new Set(), maximumMatches = Number.POSITIVE_INFINITY, options = {}) {
+  const matches = [];
+  SECRET_IDENTIFIER_KEYWORD_PATTERN.lastIndex = 0;
+  let match = SECRET_IDENTIFIER_KEYWORD_PATTERN.exec(contents);
+  let line = 1;
+  let lineCursor = 0;
+  while (match !== null) {
+    const keyword = match[0];
+    const keywordStart = match.index;
+    while (lineCursor < keywordStart) {
+      if (contents.charCodeAt(lineCursor) === 10) line += 1;
+      lineCursor += 1;
+    }
+    let cursor = keywordStart + keyword.length;
+    while (cursor < contents.length && isSecretIdentifierCharacter(contents.charCodeAt(cursor))) {
+      cursor += 1;
+    }
+    const identifierEnd = cursor;
+    let identifierStart = keywordStart;
+    while (identifierStart > 0 && isSecretIdentifierCharacter(contents.charCodeAt(identifierStart - 1))) {
+      identifierStart -= 1;
+    }
+    const identifier = contents.slice(identifierStart, identifierEnd);
+    let nextSearchIndex = identifierEnd;
+    while (cursor < contents.length && SINGLE_WHITESPACE_PATTERN.test(contents[cursor] ?? "")) {
+      cursor += 1;
+    }
+    const delimiter = contents[cursor];
+    if (delimiter === ":" || delimiter === "=") {
+      cursor += 1;
+      while (cursor < contents.length && SINGLE_WHITESPACE_PATTERN.test(contents[cursor] ?? "")) {
+        cursor += 1;
+      }
+      if (contents[cursor] === "'" || contents[cursor] === '"') cursor += 1;
+      const valueStart = cursor;
+      while (cursor < contents.length) {
+        const character = contents[cursor] ?? "";
+        if (character === "'" || character === '"' || SINGLE_WHITESPACE_PATTERN.test(character)) {
+          break;
+        }
+        cursor += 1;
+      }
+      if (cursor > valueStart) {
+        const value = contents.slice(valueStart, cursor).replace(/[,;)]$/, "");
+        nextSearchIndex = cursor;
+        if (!isPlaceholderSecretValue(value) && (looksLikeSecretValue(value) || options.allowCredentialNamedDigest === true && isLikelyDigestOrHash(value) && isExplicitCredentialIdentifier(identifier))) {
+          const valueFingerprint = createHash2("sha256").update(value).digest("hex");
+          const characterClasses = [
+            /[a-z]/.test(value) ? "lower" : "",
+            /[A-Z]/.test(value) ? "upper" : "",
+            /\d/.test(value) ? "digit" : "",
+            /[^A-Za-z0-9]/.test(value) ? "symbol" : ""
+          ].filter(Boolean).join("+");
+          if (!excludedValueFingerprints.has(valueFingerprint)) {
+            matches.push({
+              identifier,
+              line,
+              valueLength: value.length,
+              characterClasses: characterClasses || "other",
+              valueFingerprint
+            });
+            if (matches.length >= maximumMatches) return matches;
+          }
+        }
+      }
+    }
+    SECRET_IDENTIFIER_KEYWORD_PATTERN.lastIndex = nextSearchIndex;
+    match = SECRET_IDENTIFIER_KEYWORD_PATTERN.exec(contents);
+  }
+  return matches;
+}
+function isExplicitCredentialIdentifier(identifier) {
+  return /^(?:github|gitlab|api|access)[_-]?(?:token|key)$/i.test(identifier);
+}
+function findWeakExplicitEnvCredential(contents) {
+  const lines = contents.split(/\r?\n/);
+  for (const [index, line] of lines.entries()) {
+    if (/^\s*#/.test(line)) continue;
+    const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*(?:PASSWORD|PASSWD|PWD|SECRET(?:_KEY)?|API_KEY|TOKEN))\s*=\s*['"]?([^\s#'"]+)['"]?/i.exec(
+      line
+    );
+    const identifier = match?.[1];
+    const value = match?.[2];
+    if (!identifier || !value || isPlaceholderSecretValue(value)) continue;
+    const minimumLength = /(?:API_KEY|TOKEN)$/i.test(identifier) ? 12 : 6;
+    if (value.length < minimumLength) continue;
+    const characterClasses = [
+      /[a-z]/.test(value) ? "lower" : "",
+      /[A-Z]/.test(value) ? "upper" : "",
+      /\d/.test(value) ? "digit" : "",
+      /[^A-Za-z0-9]/.test(value) ? "symbol" : ""
+    ].filter(Boolean).join("+");
+    return {
+      identifier,
+      line: index + 1,
+      valueLength: value.length,
+      characterClasses: characterClasses || "other",
+      valueFingerprint: createHash2("sha256").update(value).digest("hex")
+    };
+  }
+  return null;
+}
+function findDefaultAdministrativeCredential(contents) {
+  const lines = contents.split(/\r?\n/);
+  for (const [index, line] of lines.entries()) {
+    const match = /\b([A-Za-z0-9_]*(?:ADMIN|ROOT)[A-Za-z0-9_]*(?:PASSWORD|PASSWD|PWD))\s*[:=]\s*["']?(admin|root|password)["']?(?:\s|$)/i.exec(
+      line
+    );
+    const identifier = match?.[1];
+    const value = match?.[2];
+    if (!identifier || !value) continue;
+    return {
+      identifier,
+      line: index + 1,
+      valueLength: value.length,
+      characterClasses: "lower",
+      valueFingerprint: createHash2("sha256").update(value).digest("hex"),
+      kind: "default_admin"
+    };
+  }
+  return null;
+}
+function secretEvidenceLabel(prefix, match) {
+  return `${prefix} (value redacted; length ${match.valueLength}; classes ${match.characterClasses})`;
+}
+function isSecretIdentifierCharacter(characterCode) {
+  return characterCode >= 48 && characterCode <= 57 || characterCode >= 65 && characterCode <= 90 || characterCode === 95 || characterCode >= 97 && characterCode <= 122;
+}
+function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFingerprintsByPath, authoredProductionOnly = false, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
+  const historyEntries = readCredentialHistoryEntries(repoPath, useV36Detectors);
+  const head = excludeHead ? readGitHead(repoPath) : null;
   let scannedFiles = 0;
   let envPathEvidence = null;
   for (const entry of historyEntries) {
+    if (head && entry.commit === head) continue;
+    if (authoredProductionOnly && !(useV47Detectors ? isV47AuthoredProductionPath(entry.path) : useV39Detectors ? isV39AuthoredProductionPath(entry.path) : isAuthoredProductionPath(entry.path))) {
+      continue;
+    }
     if (scannedFiles >= HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT) {
       return { evidence: null, envPathEvidence, truncated: true };
     }
     scannedFiles += 1;
     const contents = readGitBlob(repoPath, entry.commit, entry.path);
     if (!contents) continue;
-    if (containsRealSecret(contents)) {
+    const scanContents = prepareCredentialScanContents(
+      contents,
+      entry.path,
+      useV36Detectors,
+      useV39Detectors,
+      useV47Detectors
+    );
+    const currentFingerprints = currentSecretFingerprintsByPath.get(entry.path) ?? /* @__PURE__ */ new Set();
+    let secretMatch = findRealSecretAssignment(scanContents, currentFingerprints, {
+      allowCredentialNamedDigest: useV36Detectors
+    });
+    if (!secretMatch && useV39Detectors && isEnvHistoryPath(entry.path, useV36Detectors, useV47Detectors)) {
+      const weakCredential = findWeakExplicitEnvCredential(scanContents);
+      if (weakCredential && !currentFingerprints.has(weakCredential.valueFingerprint)) {
+        secretMatch = weakCredential;
+      }
+    }
+    if (secretMatch) {
       return {
         evidence: {
           kind: "secret_scan",
-          label: "Committed secret in recent git history",
+          label: secretEvidenceLabel("Committed secret in recent git history", secretMatch),
           path: entry.path,
+          line: secretMatch.line,
           contentHash: entry.commit
         },
         envPathEvidence,
         truncated: false
       };
     }
-    if (!envPathEvidence && isEnvHistoryPath(entry.path)) {
+    if (!envPathEvidence && isEnvHistoryPath(entry.path, useV36Detectors, useV47Detectors)) {
       envPathEvidence = {
         kind: "secret_scan",
         label: ".env file (not a template) tracked in git history; no confirmed secret value found",
@@ -7069,7 +8190,7 @@ function collectHistorySecretEvidence(repoPath) {
   }
   return { evidence: null, envPathEvidence, truncated: false };
 }
-function readCredentialHistoryEntries(repoPath) {
+function readCredentialHistoryEntries(repoPath, useV36Detectors = false) {
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
   const appendEntry = (entry) => {
@@ -7110,18 +8231,18 @@ function readCredentialHistoryEntries(repoPath) {
       }
       const path = line.trim();
       if (!currentCommit || !path) continue;
-      if (!isCredentialHistoryPath(path)) continue;
+      if (!isCredentialHistoryPath(path, useV36Detectors)) continue;
       appendEntry({ commit: currentCommit, path });
     }
   } catch {
   }
-  for (const entry of readDeletedCredentialHistoryEntries(repoPath)) {
+  for (const entry of readDeletedCredentialHistoryEntries(repoPath, useV36Detectors)) {
     appendEntry(entry);
   }
   return entries;
 }
-function readDeletedCredentialHistoryEntries(repoPath) {
-  const deletedPaths = readDeletedCredentialHistoryPaths(repoPath);
+function readDeletedCredentialHistoryEntries(repoPath, useV36Detectors = false) {
+  const deletedPaths = readDeletedCredentialHistoryPaths(repoPath, useV36Detectors);
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
   for (const path of deletedPaths) {
@@ -7134,7 +8255,7 @@ function readDeletedCredentialHistoryEntries(repoPath) {
   }
   return entries;
 }
-function readDeletedCredentialHistoryPaths(repoPath) {
+function readDeletedCredentialHistoryPaths(repoPath, useV36Detectors = false) {
   try {
     const output = execFileSync(
       "git",
@@ -7151,7 +8272,7 @@ function readDeletedCredentialHistoryPaths(repoPath) {
       if (!line.startsWith("D	")) continue;
       const path = line.slice(2).trim();
       if (!path || seen.has(path)) continue;
-      if (!isCredentialHistoryPath(path)) continue;
+      if (!isCredentialHistoryPath(path, useV36Detectors)) continue;
       seen.add(path);
       paths.push(path);
     }
@@ -7176,7 +8297,7 @@ function readHistoryCommitsForPath(repoPath, path) {
     return [];
   }
 }
-function isCredentialHistoryPath(path) {
+function isCredentialHistoryPath(path, _useV36Detectors = false) {
   if (isHardExcludedPath(path)) return false;
   const lowerPath = path.toLowerCase();
   const basename3 = lowerPath.split("/").at(-1) ?? lowerPath;
@@ -7185,10 +8306,11 @@ function isCredentialHistoryPath(path) {
   }
   return lowerPath.includes("secret") || lowerPath.includes("credential") || basename3.endsWith(".pem") || basename3.endsWith(".key") || basename3 === "id_rsa" || basename3.endsWith(".p12") || basename3.endsWith(".pfx");
 }
-function isEnvHistoryPath(path) {
-  if (isEnvTemplatePath(path)) return false;
+function isEnvHistoryPath(path, useV36Detectors = false, useV47Detectors = false) {
+  if (isEnvTemplatePath(path, useV47Detectors)) return false;
+  if (useV47Detectors && !isV47AuthoredProductionPath(path)) return false;
   const basename3 = path.toLowerCase().split("/").at(-1) ?? path.toLowerCase();
-  return /\.env(?:\.|$)/.test(basename3);
+  return (useV36Detectors ? /^\.env(?:\.|$)/ : /\.env(?:\.|$)/).test(basename3);
 }
 function readGitBlob(repoPath, commit, path) {
   try {
@@ -7226,7 +8348,7 @@ function isFillerRunSecretValue(value) {
 function isSyntheticFixtureSecretValue(value) {
   return value.includes("abcdefghijklmnopqrstuvwxyz") || value.includes("0123456789abcdefghijklmnopqrstuvwxyz") || value.includes("abcdefghijklmnopqrstuvwxyz0123456789") || value.includes("abcdefghijklmnopqrst");
 }
-function hasSuspiciousDependencies(repoPath, manifest) {
+function hasSuspiciousDependencies(repoPath, manifest, useV47Detectors = false) {
   if (!manifest.endsWith("package.json")) return false;
   const fullPath = join(repoPath, manifest);
   if (!isRegularFile(fullPath)) return false;
@@ -7235,9 +8357,15 @@ function hasSuspiciousDependencies(repoPath, manifest) {
   const dependencies = isRecord(parsed.dependencies) ? parsed.dependencies : {};
   const devDependencies = isRecord(parsed.devDependencies) ? parsed.devDependencies : {};
   const names = [...Object.keys(dependencies), ...Object.keys(devDependencies)];
-  return names.some(
+  if (names.some(
     (name) => /^(todo|fake|placeholder|example)-|does-not-exist| hallucinated/i.test(name)
-  );
+  )) {
+    return true;
+  }
+  if (!useV47Detectors || typeof parsed.name !== "string") return false;
+  const placeholderIdentity = /^(?:example|sample|placeholder|todo|fake)(?:-|$)/i.test(parsed.name);
+  const placeholderMetadata = typeof parsed.author === "string" && /^(?:your name|example|placeholder)$/i.test(parsed.author) || typeof parsed.description === "string" && /^(?:package description|example|placeholder|todo)$/i.test(parsed.description);
+  return placeholderIdentity && placeholderMetadata;
 }
 function readRecentCommits(repoPath) {
   try {
@@ -7819,7 +8947,12 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
     );
     consumedSignals.push(...summaries);
     const finalScore = adjustment === 0 ? scored.score : adjustedScore;
-    const finalStatus = adjustment === 0 ? scored.status : statusForScore(finalScore);
+    const finalStatus = statusAfterInputAdjustment(
+      scored.status,
+      scored.score,
+      adjustment,
+      parsedInput.rubricVersion
+    );
     return {
       id,
       title: rubricCriterion.title,
@@ -7916,6 +9049,31 @@ function statusForScore(score) {
   if (score > 0) return "critical";
   return "critical";
 }
+function statusAfterInputAdjustment(nativeStatus, nativeScore, adjustment, rubricVersion) {
+  if (adjustment === 0) return nativeStatus;
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V92 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15) {
+    return statusForScore(roundScore(Math.max(0, nativeScore - adjustment)));
+  }
+  const statusFloor = {
+    verified: 3.5,
+    info: 2.5,
+    warning: 1.5,
+    critical: 0
+  };
+  const severity = {
+    verified: 0,
+    info: 1,
+    warning: 2,
+    critical: 3
+  };
+  const floor = statusFloor[nativeStatus];
+  const nativeSeverity = severity[nativeStatus];
+  if (floor === void 0 || nativeSeverity === void 0) return nativeStatus;
+  const adjustedSemanticStatus = statusForScore(
+    roundScore(Math.max(0, Math.max(nativeScore, floor) - adjustment))
+  );
+  return (severity[adjustedSemanticStatus] ?? nativeSeverity) > nativeSeverity ? adjustedSemanticStatus : nativeStatus;
+}
 function mergeSignalsByCriterion(signals) {
   const merged = /* @__PURE__ */ new Map();
   for (const signal of signals) {
@@ -7937,7 +9095,7 @@ function mergeSignalsByCriterion(signals) {
   return merged;
 }
 function usesMetricScoring(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
 }
 function unmeasuredStatus(rubricVersion) {
   return rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0 ? "unverified" : "insufficient_data";
@@ -7979,12 +9137,25 @@ function scoreCriterion(signal, rubricVersion) {
   if (usesMetricScoring(rubricVersion)) {
     const measuredMetrics = metrics.length > 0 ? metrics : fallbackMetricsForEvidence(evidence, findings);
     const score = capScoreForFindings(scoreMetrics(measuredMetrics), findings);
-    const status = statusForScoreAndFindings(score, findings);
+    const status = statusForScoreAndFindings(
+      signal.criterionId,
+      score,
+      findings,
+      measuredMetrics,
+      rubricVersion
+    );
     return {
       score,
       status,
       evidence,
-      findings: ensureFindingsExplainStatus(signal.criterionId, score, status, findings, evidence),
+      findings: ensureFindingsExplainStatus(
+        signal.criterionId,
+        score,
+        status,
+        findings,
+        evidence,
+        rubricVersion
+      ),
       metrics: measuredMetrics
     };
   }
@@ -8053,23 +9224,251 @@ function capScoreForFindings(score, findings) {
   if (findings.some((finding) => finding.severity === "info")) return Math.min(score, 3.4);
   return score;
 }
-function statusForScoreAndFindings(score, findings) {
+function statusForScoreAndFindings(criterionId, score, findings, metrics, rubricVersion) {
   if (findings.some((finding) => finding.severity === "critical")) return "critical";
+  if (rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15) {
+    const calibrated = rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 ? calibratedCriterionStateV11(criterionId, metrics) : rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 ? calibratedCriterionStateV9(criterionId, metrics) : calibratedCriterionStateV8(criterionId, metrics);
+    if (calibrated && calibrated !== "verified") return calibrated;
+    if (calibrated === "verified" && !findings.some((finding) => finding.severity === "warning")) {
+      return "verified";
+    }
+  }
   if (findings.some((finding) => finding.severity === "warning")) return "warning";
   if (score >= 3.5 && findings.length === 0) return "verified";
   if (score >= 2.5) return "info";
   if (score >= 1.5) return "warning";
   return "critical";
 }
-function ensureFindingsExplainStatus(criterionId, score, status, findings, evidence) {
-  if (findings.length > 0) return [...findings];
+function calibratedCriterionStateV8(criterionId, metrics) {
+  const values = new Map(metrics.map(({ name, value: value2 }) => [name, value2]));
+  if (values.size !== metrics.length) return void 0;
+  const value = (name) => values.get(name);
+  const positive = (name) => (value(name) ?? 0) > 0;
+  if (criterionId === "A1") {
+    if (!values.has("non_hollow_test_share") || !values.has("verification_script_ratio")) {
+      return void 0;
+    }
+    if (!positive("non_hollow_test_share")) return "critical";
+    return positive("verification_script_ratio") ? "verified" : "warning";
+  }
+  if (criterionId === "A2") {
+    if (!values.has("secret_cleanliness") || !values.has("env_handling_depth")) return void 0;
+    if (!positive("secret_cleanliness")) return "critical";
+    return (value("env_handling_depth") ?? 0) >= 2 ? "verified" : "warning";
+  }
+  if (criterionId === "A3") {
+    if (!values.has("observability_depth") || !values.has("rollback_safety_depth")) {
+      return void 0;
+    }
+    const coveredSurfaces = Number(positive("observability_depth")) + Number(positive("rollback_safety_depth"));
+    return coveredSurfaces === 2 ? "verified" : coveredSurfaces === 1 ? "warning" : "critical";
+  }
+  if (criterionId === "A4") {
+    if (!values.has("dependency_automation_ratio") || !values.has("declared_version_range_ratio") && !values.has("pinned_dependency_ratio")) {
+      return void 0;
+    }
+    const dependencyCountSanity = value("dependency_count_sanity");
+    if (dependencyCountSanity !== void 0) {
+      if (dependencyCountSanity <= 0) return "critical";
+      if (dependencyCountSanity < 0.9) return "warning";
+    }
+    const hasVersionControl = positive("declared_version_range_ratio") || positive("pinned_dependency_ratio");
+    const hasLockfile = positive("lockfile_coverage");
+    const hasAutomation = positive("dependency_automation_ratio");
+    if (!hasVersionControl && !hasLockfile && !hasAutomation) return "critical";
+    return hasAutomation && (hasVersionControl || hasLockfile) ? "verified" : "warning";
+  }
+  if (criterionId === "B2") {
+    if (!values.has("pr_trace_primitives") || !values.has("pr_merge_ratio")) return void 0;
+    return positive("pr_trace_primitives") && positive("pr_merge_ratio") ? "verified" : "warning";
+  }
+  if (criterionId === "B3") {
+    if (!values.has("ci_script_depth") || !values.has("default_branch_ci_depth")) return void 0;
+    const coveredSurfaces = Number(positive("ci_script_depth")) + Number(positive("default_branch_ci_depth"));
+    return coveredSurfaces === 2 ? "verified" : coveredSurfaces === 1 ? "warning" : "critical";
+  }
+  if (criterionId === "B4") {
+    if (!values.has("audit_artifact_depth") || !values.has("audit_freshness_depth")) {
+      return void 0;
+    }
+    if (!positive("audit_artifact_depth")) return "critical";
+    return positive("audit_freshness_depth") ? "verified" : "warning";
+  }
+  if (criterionId === "B6") {
+    if (!values.has("human_gate_documented") || !values.has("fail_closed_privilege_check")) {
+      return void 0;
+    }
+    return positive("human_gate_documented") || positive("fail_closed_privilege_check") ? "verified" : "critical";
+  }
+  return void 0;
+}
+function calibratedCriterionStateV9(criterionId, metrics) {
+  const values = new Map(metrics.map(({ name, value: value2 }) => [name, value2]));
+  if (values.size !== metrics.length) return void 0;
+  const value = (name) => values.get(name);
+  const positive = (name) => (value(name) ?? 0) > 0;
+  if (criterionId === "A1") {
+    if (!values.has("non_hollow_test_share") || !values.has("verification_script_ratio")) {
+      return void 0;
+    }
+    const nonHollowTests = value("non_hollow_test_share") ?? 0;
+    if (nonHollowTests === 0) return "critical";
+    return positive("verification_script_ratio") && nonHollowTests >= 3 ? "verified" : "warning";
+  }
+  if (criterionId === "A2") {
+    if (!values.has("secret_cleanliness") || !values.has("env_handling_depth")) return void 0;
+    if (!positive("secret_cleanliness")) return "critical";
+    return (value("env_handling_depth") ?? 0) >= 2 ? "verified" : "warning";
+  }
+  if (criterionId === "A3") {
+    if (!values.has("prod_readiness_primitives") || !values.has("prod_workflow_depth") || !values.has("observability_depth") || !values.has("rollback_safety_depth")) {
+      return void 0;
+    }
+    const observability = value("observability_depth") ?? 0;
+    const rollback = value("rollback_safety_depth") ?? 0;
+    if (observability > 0 && rollback > 0) {
+      return (value("prod_readiness_primitives") ?? 0) >= 4 && observability >= 2 && rollback >= 2 ? "verified" : "warning";
+    }
+    if (observability > 0 || rollback > 0) return "warning";
+    return (value("prod_readiness_primitives") ?? 0) >= 2 && (value("prod_workflow_depth") ?? 0) >= 8 ? "warning" : "critical";
+  }
+  if (criterionId === "A4") {
+    if (!values.has("dependency_automation_ratio") || !values.has("declared_version_range_ratio") && !values.has("pinned_dependency_ratio")) {
+      return void 0;
+    }
+    const dependencyCountSanity = value("dependency_count_sanity");
+    if (dependencyCountSanity !== void 0) {
+      if (dependencyCountSanity <= 0.25) return "critical";
+      if (dependencyCountSanity < 0.5) return "warning";
+    }
+    const hasVersionControl = positive("declared_version_range_ratio") || positive("pinned_dependency_ratio");
+    const hasLockfile = positive("lockfile_coverage");
+    const hasAutomation = positive("dependency_automation_ratio");
+    if (!hasVersionControl && !hasLockfile && !hasAutomation) return "warning";
+    return hasAutomation && (hasVersionControl || hasLockfile) ? "verified" : "warning";
+  }
+  if (criterionId === "B2") {
+    if (!values.has("pr_trace_primitives") || !values.has("pr_merge_ratio")) return void 0;
+    const primitives = value("pr_trace_primitives") ?? 0;
+    const mergedOutcomes = value("pr_merge_ratio") ?? 0;
+    if (mergedOutcomes === 0) return primitives <= 2 ? "critical" : "warning";
+    return mergedOutcomes >= 4 ? "verified" : "warning";
+  }
+  if (criterionId === "B3") {
+    if (!values.has("ci_script_depth") || !values.has("default_branch_ci_depth")) return void 0;
+    const scriptDepth = value("ci_script_depth") ?? 0;
+    const branchDepth = value("default_branch_ci_depth") ?? 0;
+    if (scriptDepth === 0 && branchDepth === 0) return "critical";
+    return scriptDepth >= 2 && branchDepth > 0 ? "verified" : "warning";
+  }
+  if (criterionId === "B4") {
+    if (!values.has("audit_artifact_depth") || !values.has("audit_freshness_depth")) {
+      return void 0;
+    }
+    const artifacts = value("audit_artifact_depth") ?? 0;
+    const freshness = value("audit_freshness_depth") ?? 0;
+    if (artifacts === 0) return "critical";
+    return artifacts >= 2 || freshness >= 2 ? "verified" : "warning";
+  }
+  if (criterionId === "B6") {
+    const humanGate = value("human_gate_documented") ?? 0;
+    const failClosed = value("fail_closed_privilege_check") ?? 0;
+    if (humanGate > 0 || failClosed > 0) return "verified";
+    if (positive("privilege_escalation_cleanliness") || positive("protected_path_review_gate")) {
+      return "warning";
+    }
+    if (values.has("human_gate_documented") || values.has("fail_closed_privilege_check") || values.has("privilege_escalation_cleanliness") || values.has("protected_path_review_gate")) {
+      return "critical";
+    }
+  }
+  return void 0;
+}
+function calibratedCriterionStateV11(criterionId, metrics) {
+  const values = new Map(metrics.map(({ name, value: value2 }) => [name, value2]));
+  if (values.size !== metrics.length) return void 0;
+  const value = (name) => values.get(name);
+  const positive = (name) => (value(name) ?? 0) > 0;
+  if (criterionId === "A1") {
+    if (!values.has("non_hollow_test_share") || !values.has("verification_script_ratio")) {
+      return void 0;
+    }
+    if (!positive("non_hollow_test_share")) return "critical";
+    return positive("verification_script_ratio") ? "verified" : "warning";
+  }
+  if (criterionId === "A2") {
+    if (!values.has("secret_cleanliness") || !values.has("env_handling_depth")) return void 0;
+    if (!positive("secret_cleanliness")) return "critical";
+    return positive("env_handling_depth") ? "verified" : "warning";
+  }
+  if (criterionId === "A3") {
+    if (!values.has("prod_readiness_primitives") || !values.has("prod_workflow_depth") || !values.has("observability_depth") || !values.has("rollback_safety_depth")) {
+      return void 0;
+    }
+    const primitives = value("prod_readiness_primitives") ?? 0;
+    const workflow = value("prod_workflow_depth") ?? 0;
+    const observability = value("observability_depth") ?? 0;
+    const rollback = value("rollback_safety_depth") ?? 0;
+    if (observability > 0 && rollback > 0) return primitives >= 3 ? "verified" : "warning";
+    return primitives > 0 && workflow > 0 ? "warning" : "critical";
+  }
+  if (criterionId === "A4") {
+    if (!values.has("dependency_automation_ratio") || !values.has("declared_version_range_ratio") && !values.has("pinned_dependency_ratio")) {
+      return void 0;
+    }
+    const hasVersionControl = positive("declared_version_range_ratio") || positive("pinned_dependency_ratio");
+    const hasLockfile = positive("lockfile_coverage");
+    const hasAutomation = positive("dependency_automation_ratio");
+    if (!hasVersionControl && !hasLockfile && !hasAutomation) return "critical";
+    return hasAutomation && (hasVersionControl || hasLockfile) ? "verified" : "warning";
+  }
+  if (criterionId === "B2") {
+    if (!values.has("pr_trace_primitives") || !values.has("pr_merge_ratio")) return void 0;
+    if (!positive("pr_trace_primitives")) return "critical";
+    return positive("pr_merge_ratio") ? "verified" : "warning";
+  }
+  if (criterionId === "B3") {
+    if (!values.has("ci_script_depth") || !values.has("default_branch_ci_depth")) return void 0;
+    const covered = Number(positive("ci_script_depth")) + Number(positive("default_branch_ci_depth"));
+    return covered === 2 ? "verified" : covered === 1 ? "warning" : "critical";
+  }
+  if (criterionId === "B4") {
+    if (!values.has("audit_artifact_depth") || !values.has("audit_freshness_depth")) {
+      return void 0;
+    }
+    if (!positive("audit_artifact_depth")) return "critical";
+    return positive("audit_freshness_depth") ? "verified" : "warning";
+  }
+  if (criterionId === "B6") {
+    const humanGate = positive("human_gate_documented");
+    const failClosed = positive("fail_closed_privilege_check");
+    const cleanAndReviewed = positive("privilege_escalation_cleanliness") && positive("protected_path_review_gate");
+    if (humanGate || failClosed || cleanAndReviewed) return "verified";
+    if (positive("privilege_escalation_cleanliness") || positive("protected_path_review_gate")) {
+      return "warning";
+    }
+    if (values.has("human_gate_documented") || values.has("fail_closed_privilege_check") || values.has("privilege_escalation_cleanliness") || values.has("protected_path_review_gate")) {
+      return "critical";
+    }
+  }
+  return void 0;
+}
+function ensureFindingsExplainStatus(criterionId, score, status, findings, evidence, rubricVersion) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V92 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && findings.length > 0) {
+    return [...findings];
+  }
   if (status !== "critical" && status !== "warning") return [...findings];
+  if (findings.some(
+    ({ severity }) => severity === "critical" || status === "warning" && severity === "warning"
+  )) {
+    return [...findings];
+  }
   const anchor = evidence[0] ?? {
     kind: "repository",
     label: `${criterionId} metric-derived score`,
     path: "."
   };
   return [
+    ...findings,
     {
       severity: status,
       summary: `${criterionId} metric-derived score is ${score.toFixed(1)}/4.0, in the ${status} band \u2014 no single finding drove this; it reflects the combined metric weighting below.`,
@@ -8095,7 +9494,8 @@ function scoreRepoWithPublicCejel(options) {
     productSlug: options.productSlug,
     productDisplayName: options.productDisplayName,
     repoPath: options.repoPath,
-    ...options.generatedAt ? { generatedAt: options.generatedAt } : {}
+    ...options.generatedAt ? { generatedAt: options.generatedAt } : {},
+    ...options.rubricVersion ? { rubricVersion: options.rubricVersion } : {}
   });
   const inputSignals = resolvePublicIngestSignals(options);
   return createWitanReport(input, inputSignals.length > 0 ? inputSignals : void 0);