@cejel/cejel 0.1.8 → 0.1.10

package/README.md

@@ -20,10 +20,6 @@ certificate + badge over all of them. See "Aggregate your scanners" below.
 > monorepo — the ten-product studio it was built inside — which it currently scores
 > 3.1/4.0 ("Conditional"). We score ourselves before asking you to score yourself.
 
-The reusable Barg Labs listing mark is kept at [`brand/barg-icon.png`](./brand/barg-icon.png)
-for directories and registries that accept a custom image. GitHub Actions Marketplace uses
-GitHub's predefined `action.yml` branding icons instead.
-
 ## Install
 
 No account, no key, no signup.
@@ -65,12 +61,19 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel .
 ```
 
+If a root `package.json` still carries a template name, override only the certificate display
+name while keeping the repository-derived stable slug:
+
+```bash
+npx @cejel/cejel . --name "Customer Portal"
+```
+
 The npm package is scoped as `@cejel/cejel`; its executable remains the short command `cejel`.
 
 **GitHub Action** — score every PR and publish the badge:
 
 ```yaml
-- uses: BargLabs/cejel/action@v0.1.8
+- uses: BargLabs/cejel/action@v1
   with:
     min-score: "2.5"   # optional: fail the build below this
 ```
@@ -99,26 +102,17 @@ Microsoft Authenticode code-signing.
 **Docker / OCI.** The same MCP server is published as a non-root, multi-platform image:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.1.8
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.1.10
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.1.8 .
-```
-
-Beginning with v0.1.7, the standard CLI identity flags are also available directly, while an
-invocation without arguments continues to start the MCP server:
-
-```bash
-docker run --rm ghcr.io/barglabs/cejel:0.1.8 --version
-docker run --rm ghcr.io/barglabs/cejel:0.1.8 --help
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.1.10 .
 ```
 
 The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
-attestation. It is also the package referenced by [`server.json`](./server.json) for the
-Official MCP Registry.
+attestation.
 
 ## Leaderboard
 
@@ -227,9 +221,10 @@ honestly rather than guessing:
   dependency hygiene, audit trail, secrets), but without ecosystem-specific test-framework
   tuning.
 - **Recognised but unmodelled** — shell, R, Lua, Julia, Haskell, Terraform, SQL, Perl, OCaml,
-  Clojure, Erlang, Nim, Zig, F#, Groovy: counted as source so a repo isn't misread as empty,
-  but with the least ecosystem-specific tuning of the three tiers.
-- **Not yet recognised** — other ecosystems, including COBOL, Fortran, and MATLAB. Cejel does
+  Clojure, Erlang, Nim, Zig, F#, Groovy, Fortran, CUDA/HIP, Web templates/styles: counted as
+  source so a repo isn't misread as empty, but with the least ecosystem-specific tuning of the
+  three tiers.
+- **Not yet recognised** — other ecosystems, including COBOL and MATLAB. Cejel does
   not score these as "source" at all: a repository with zero
   recognised-extension files gets the `unrecognised_ecosystem` archetype, an explicit
   `insufficient_data` criterion status, `null` headline scores, and an explicit machine verdict
@@ -324,7 +319,7 @@ a configurable `min-score` threshold. The scoring step makes no network calls an
 secrets.
 
 ```yaml
-- uses: BargLabs/cejel/action@v0.1.8
+- uses: BargLabs/cejel/action@v1
   with:
     min-score: '2.5' # optional; omit to never fail the check
 ```
@@ -336,10 +331,6 @@ server over stdio, so any MCP client (Claude Code, Cowork, Cursor, Codex) can re
 trust certificate as a tool call. It wraps the exact same scan the CLI runs — same scores,
 same verdict — and is listed on Smithery via the repo's `smithery.yaml`.
 
-The canonical discovery manifest is [`server.json`](./server.json), published under
-`io.github.BargLabs/cejel` in the Official MCP Registry. Its npm ownership metadata,
-OCI ownership label, image version, and registry version are checked together before release.
-
 Add it to an MCP client config:
 
 ```json
@@ -403,7 +394,7 @@ enforced structurally — the public artifacts are built from filtered data rath
 rendered and then scrubbed — and a build that would emit a private path fails rather than
 publishes.
 
-**What we exclude from ranking.** The v6 repository scanner does not evaluate B1 (dispatch
+**What we exclude from ranking.** The v5 repository scanner does not evaluate B1 (dispatch
 trace completeness) or B5 (verified learning trace) for repository inputs, including ours:
 both are always *not applicable* in a repository certificate. They remain defined in the
 rubric for structured substrate evidence, but that evidence is not accepted by this scanner.
@@ -485,6 +476,18 @@ scoring tool that has not been checked:
   detected even though `test.js` was present at the repository root. That was a detection gap
   in Cejel, not evidence about the repository. Rubric v6 recognizes AVA's `test.js` and
   `test-*.js` conventions; a regression fixture preserves the correction.
+- **Version 0.1.9 claimed Express had no coverage configuration while its package scripts used
+  `nyc`.** The detector looked only for standalone coverage files and framework configuration.
+  Version 0.1.10 also recognizes actual `nyc`, `c8`, and Istanbul commands or configuration in
+  `package.json`. An unused dependency is not treated as coverage evidence. This removes a false
+  finding without changing the measured coverage score.
+- **Metric-only dimension bands told users that “combined metric weighting” was responsible,
+  then stopped.** The underlying metrics were present in the full certificate but absent from
+  the terminal finding, and `info` finding severity could appear beside a `critical` dimension
+  band without naming the two different concepts. Version 0.1.10 prints the two lowest
+  contributing measurements, concrete next actions, `finding severity`, and `dimension band`
+  explicitly. It also explains when a requested scan target is gitignored instead of presenting
+  the target as a generic empty repository.
 
 Every one was a trust failure produced by *us* — false alarms about other people's code,
 silent omissions, inconsistent presentation, or a home-only scoring path — and we would