@cejel/cejel 0.1.8 → 0.1.10

package/dist/{chunk-SFEPABAX.js → chunk-EFOUXVJE.js}

@@ -4077,7 +4077,10 @@ var WITAN_RUBRIC_VERSION_V3 = "witan-rubric-v3-2026-07-13";
 var WITAN_RUBRIC_VERSION_V4 = "witan-rubric-v4-2026-07-18";
 var WITAN_RUBRIC_VERSION_V5 = "witan-rubric-v5-2026-07-18";
 var WITAN_RUBRIC_VERSION_V6 = "witan-rubric-v6-2026-07-21";
-var WITAN_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V6;
+var WITAN_RUBRIC_VERSION_V7 = "witan-rubric-v7-2026-07-21";
+var WITAN_RUBRIC_VERSION_V8 = "witan-rubric-v8-2026-07-21";
+var WITAN_RUBRIC_VERSION_V9 = "witan-rubric-v9-2026-07-22";
+var WITAN_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V9;
 var WITAN_TRADING_RUBRIC_VERSION_V0 = "witan-trading-rubric-v0-2026-07-01";
 var WITAN_CRITERION_IDS = [
   "A1",
@@ -4145,6 +4148,8 @@ var WITAN_REPO_ARCHETYPES = [
   "monorepo",
   "docs_only",
   "binary_only",
+  "generated_only",
+  "non_cohesive_source",
   "unrecognised_ecosystem",
   "empty"
 ];
@@ -4360,6 +4365,51 @@ var WitanAttestationStatementSchema = external_exports.object({
   }).strict()
 }).strict();
 
+// src/witan/abstention.ts
+var WITAN_NO_MEASUREMENT_REASON = "No free-core rubric criterion produced a measurable signal. Cejel abstains rather than publish a numeric zero for an entirely unmeasured repository.";
+var WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the complete tracked inventory contains no concrete test file, configured test runner, CI test command, or coverage configuration.";
+function isWitanNoMeasurementAbstention(report) {
+  return report.verdict === "insufficient_source" && report.insufficientSourceReason === WITAN_NO_MEASUREMENT_REASON && report.criteria.every(
+    ({ status }) => status === "not_applicable" || status === "insufficient_data"
+  );
+}
+function renderWitanAbstentionLabel(report) {
+  return isWitanNoMeasurementAbstention(report) ? "Insufficient evidence" : "Insufficient source";
+}
+
+// src/witan/coverage.ts
+var LOW_CONFIDENCE_COVERAGE_THRESHOLD = 0.5;
+function isMeasuredCriterionStatus(status) {
+  return status !== "not_applicable" && status !== "insufficient_data";
+}
+function computeMeasuredCoverage(report) {
+  const byCategory = [];
+  const overall = { measured: 0, total: 0 };
+  for (const criterion of report.criteria) {
+    let bucket = byCategory.find((entry) => entry.category === criterion.category);
+    if (!bucket) {
+      bucket = { category: criterion.category, measured: 0, total: 0 };
+      byCategory.push(bucket);
+    }
+    bucket.total += 1;
+    overall.total += 1;
+    if (isMeasuredCriterionStatus(criterion.status)) {
+      bucket.measured += 1;
+      overall.measured += 1;
+    }
+  }
+  const lowConfidence = [...byCategory, overall].some(
+    (counts) => counts.total > 0 && counts.measured / counts.total < LOW_CONFIDENCE_COVERAGE_THRESHOLD
+  );
+  return { byCategory, overall, lowConfidence };
+}
+function shortCategoryLabel(category) {
+  return category.replace(/_trust$/, "").replaceAll("_", " ");
+}
+function formatCoverageCounts(coverage) {
+  return coverage.byCategory.map((entry) => `${shortCategoryLabel(entry.category)} ${entry.measured}/${entry.total}`).join(" \xB7 ");
+}
+
 // src/witan/external-findings.ts
 var EXTERNAL_FINDINGS_DISPLAY_LIMIT = 10;
 var SEVERITY_RANK = {
@@ -4413,6 +4463,87 @@ function collectExternalFindings(consumedSignals) {
   });
 }
 
+// src/witan/finding-presentation.ts
+var METRIC_DERIVED_FINDING_PATTERN = /^[A-Z]\d+ metric-derived score is (\d+\.\d)\/4\.0, in the (critical|warning) band — no single finding drove this; it reflects the combined metric weighting below\.$/;
+var REMEDIATION_BY_METRIC = {
+  test_to_source_ratio: "add concrete regression tests for the implementation surface",
+  coverage_percent: "configure coverage and publish a measured threshold or report",
+  verification_script_ratio: "add explicit test, lint, and typecheck verification commands",
+  non_hollow_test_share: "replace skipped or placeholder tests with live assertions",
+  env_handling_depth: "document and enforce safe environment-secret handling",
+  secret_cleanliness: "remove committed secrets and rotate any exposed credentials",
+  tenant_scope_ratio: "apply tenant scoping consistently across data access",
+  rls_policy_count: "add database row-level security policies where the data model requires them",
+  crypto_comparison_hygiene: "use constant-time comparison for signature or MAC checks",
+  prod_readiness_primitives: "add the missing deployment-readiness controls",
+  observability_depth: "add health checks, structured logging, and error boundaries",
+  rollback_safety_depth: "document and test rollback or recovery procedures",
+  pinned_dependency_ratio: "pin application dependencies that determine the deployed artifact",
+  lockfile_coverage: "commit the package-manager lockfile used by CI and deployment",
+  dependency_automation_ratio: "enable automated dependency updates and an audit command",
+  declared_version_range_ratio: "declare an explicit compatible version for every dependency",
+  dependency_count_sanity: "review and reduce unnecessary direct dependencies",
+  claim_match_rate: "align documented product claims with observable repository evidence",
+  claim_source_depth: "document concrete, checkable product claims",
+  reconciliation_artifact_depth: "publish a claim-to-evidence reconciliation record",
+  pr_merge_ratio: "preserve merged pull-request history in the scanned clone",
+  pr_trace_primitives: "add pull-request templates and outcome-trace records",
+  ci_script_depth: "run the repository verification commands in CI",
+  default_branch_ci_depth: "run CI on the default branch and pull requests",
+  prod_workflow_depth: "add a production or release verification workflow",
+  audit_artifact_depth: "publish changelog, incident, security, or audit records",
+  audit_freshness_depth: "keep the audit trail current",
+  human_gate_documented: "document which privileged operations require human approval",
+  protected_path_review_gate: "require review for changes to protected paths",
+  fail_closed_privilege_check: "make privileged-operation checks fail closed",
+  kill_switch_fail_safe_present: "add a fail-safe kill switch for privileged automation",
+  privilege_escalation_cleanliness: "remove unsafe privilege-escalation patterns"
+};
+function renderFindingSummary(criterion, finding) {
+  const match = METRIC_DERIVED_FINDING_PATTERN.exec(finding.summary);
+  if (!match) return finding.summary;
+  const score = match[1] ?? criterion.score.toFixed(1);
+  const band = match[2] ?? criterion.status;
+  const drivers = selectLowestDrivers(criterion.metrics);
+  if (drivers.length === 0) {
+    return `${criterion.id} dimension band is ${band} at ${score}/4.0. To improve this dimension, add stronger measurable evidence for ${criterion.title.toLowerCase()}.`;
+  }
+  const measurements = drivers.map(formatMetricMember).join("; ");
+  const actions = Array.from(
+    new Set(
+      drivers.map(
+        (metric2) => REMEDIATION_BY_METRIC[metric2.name] ?? `raise the measured ${metric2.label.toLowerCase()}`
+      )
+    )
+  ).join("; ");
+  return `${criterion.id} dimension band is ${band} at ${score}/4.0. Lowest contributing measurements: ${measurements}. To improve: ${actions}.`;
+}
+function selectLowestDrivers(metrics) {
+  return [...metrics].filter((metric2) => metric2.max !== void 0).sort((left, right) => {
+    const leftRatio = normalizedMetricValue(left);
+    const rightRatio = normalizedMetricValue(right);
+    if (leftRatio !== rightRatio) return leftRatio - rightRatio;
+    if (left.weight !== right.weight) return right.weight - left.weight;
+    return left.name.localeCompare(right.name);
+  }).slice(0, 2);
+}
+function normalizedMetricValue(metric2) {
+  if (metric2.max === void 0) return 1;
+  return Math.min(metric2.value / metric2.max, 1);
+}
+function formatMetricMember(metric2) {
+  const unit = metric2.unit ? ` ${metric2.unit}` : "";
+  const maximum = metric2.max;
+  if (maximum === void 0) return `${metric2.label} ${formatMetricValue(metric2.value)}${unit}`;
+  if (metric2.kind === "saturating_count" && metric2.value > maximum) {
+    return `${metric2.label} ${formatMetricValue(maximum)}${unit} capped (${formatMetricValue(metric2.value)} raw)`;
+  }
+  return `${metric2.label} ${formatMetricValue(metric2.value)}/${formatMetricValue(maximum)}${unit}`;
+}
+function formatMetricValue(value) {
+  return Number.isInteger(value) ? String(value) : value.toFixed(2).replace(/0+$/, "").replace(/\.$/, "");
+}
+
 // src/witan/html.ts
 function renderWitanHtmlReport(report) {
   const codeCriteria = criteriaByCategory(report, "code_trust");
@@ -4424,6 +4555,7 @@ function renderWitanHtmlReport(report) {
   const contributingSources = renderContributingSources(report.consumedSignals ?? []);
   const externalSourceSummaries = summarizeExternalSources(report.consumedSignals ?? []);
   const externalFindings = collectExternalFindings(report.consumedSignals ?? []);
+  const coverage = computeMeasuredCoverage(report);
   return `<!doctype html>
 <html lang="en">
 <head>
@@ -4452,14 +4584,15 @@ function renderWitanHtmlReport(report) {
         </section>
         <aside class="score-panel" aria-label="Summary trust score">
           <div class="score-badge">Summary</div>
-          ${report.verdict === "insufficient_source" ? `<div class="verdict">Insufficient source</div>
+          ${report.verdict === "insufficient_source" ? `<div class="verdict">${escapeHtml(renderWitanAbstentionLabel(report))}</div>
           <p class="insufficient-note">${escapeHtml(report.insufficientSourceReason)}</p>` : `<div class="score">${formatScore(report.overallScore)}</div>
           <div class="score-unit">/ 4.0 overall</div>
           <div class="verdict">${escapeHtml(renderVerdict(report.overallScore))}</div>
           <div class="subscores">
-            <span>Code ${formatScore(report.codeTrustScore)}</span>
-            <span>Process ${formatScore(report.processTrustScore)}</span>
-          </div>`}
+            <span>Code ${renderCategoryScore(report.codeTrustScore, coverage, "code_trust")}</span>
+            <span>Process ${renderCategoryScore(report.processTrustScore, coverage, "process_trust")}</span>
+          </div>
+          <div class="coverage-note">${escapeHtml(formatCoverageCounts(coverage))} measured${coverage.lowConfidence ? " \xB7 low confidence" : ""}</div>`}
         </aside>
       </div>
     </header>
@@ -4536,7 +4669,7 @@ function renderNotApplicableItem(criterion) {
 function renderCriterionCard(criterion) {
   const evidence = [
     ...criterion.evidence.map(renderEvidencePointer),
-    ...criterion.findings.map((finding) => renderFindingEvidence(finding))
+    ...criterion.findings.map((finding) => renderFindingEvidence(criterion, finding))
   ];
   const metrics = criterion.metrics.map(renderMetric);
   return `<article class="criterion">
@@ -4557,19 +4690,26 @@ function renderCriterionCard(criterion) {
           </article>`;
 }
 function renderMetric(metric2) {
-  const max = metric2.max ? `/${formatMetricValue(metric2.max)}` : "";
   const unit = metric2.unit ? ` ${escapeHtml(metric2.unit)}` : "";
-  return `<strong>${escapeHtml(metric2.label)}</strong><span>${formatMetricValue(metric2.value)}${max}${unit}</span>`;
+  if (metric2.kind === "saturating_count" && metric2.max !== void 0 && metric2.value > metric2.max) {
+    return `<strong>${escapeHtml(metric2.label)}</strong><span>${formatMetricValue2(metric2.max)}${unit} (capped; ${formatMetricValue2(metric2.value)} raw)</span>`;
+  }
+  const max = metric2.max ? `/${formatMetricValue2(metric2.max)}` : "";
+  return `<strong>${escapeHtml(metric2.label)}</strong><span>${formatMetricValue2(metric2.value)}${max}${unit}</span>`;
+}
+function renderCategoryScore(score, coverage, category) {
+  const categoryCoverage = coverage.byCategory.find((entry) => entry.category === category);
+  return categoryCoverage !== void 0 && categoryCoverage.measured === 0 || score === null ? "not measured" : formatScore(score);
 }
 function renderStatusChip(status) {
-  return `<span class="status" data-status="${status}">${status}</span>`;
+  return `<span class="status" data-status="${status}">dimension band: ${status}</span>`;
 }
 function renderEvidenceListItem(criterion, evidence) {
   return `<li><strong>${escapeHtml(criterion.id)} - ${escapeHtml(criterion.title)}</strong><span>${renderEvidencePointer(evidence)}</span></li>`;
 }
 function renderOpenItems(criterion) {
   const findingItems = criterion.findings.map(
-    (finding) => `<li><strong>${escapeHtml(criterion.id)} - ${escapeHtml(criterion.title)}</strong><span>${escapeHtml(finding.severity)}: ${escapeHtml(finding.summary)} (${renderEvidencePointer(finding.evidence)})</span></li>`
+    (finding) => `<li><strong>${escapeHtml(criterion.id)} - ${escapeHtml(criterion.title)}</strong><span>finding severity ${escapeHtml(finding.severity)}: ${escapeHtml(renderFindingSummary(criterion, finding))} (${renderEvidencePointer(finding.evidence)})</span></li>`
   );
   if ((criterion.status === "unverified" || criterion.status === "insufficient_data") && criterion.evidence.length === 0 && criterion.findings.length === 0) {
     const message = criterion.status === "insufficient_data" ? "Insufficient data \u2014 no measurable signal; excluded from composite (unmeasured, not inapplicable)." : "No concrete evidence supplied.";
@@ -4580,10 +4720,8 @@ function renderOpenItems(criterion) {
   if (criterion.status === "verified") return [];
   return findingItems;
 }
-function renderFindingEvidence(finding) {
-  return `${escapeHtml(finding.severity)}: ${escapeHtml(finding.summary)} (${renderEvidencePointer(
-    finding.evidence
-  )})`;
+function renderFindingEvidence(criterion, finding) {
+  return `finding severity ${escapeHtml(finding.severity)}: ${escapeHtml(renderFindingSummary(criterion, finding))} (${renderEvidencePointer(finding.evidence)})`;
 }
 function renderEvidencePointer(evidence) {
   const target = evidence.url ?? renderPathEvidenceTarget(evidence);
@@ -4606,6 +4744,9 @@ function renderVerdict(score) {
   return renderMachineVerdict(witanVerdictForScore(score));
 }
 function renderReportVerdict(report) {
+  if (report.verdict === "insufficient_source") {
+    return renderWitanAbstentionLabel(report);
+  }
   return renderMachineVerdict(report.verdict);
 }
 function renderMachineVerdict(verdict) {
@@ -4625,7 +4766,7 @@ function renderMachineVerdict(verdict) {
 function formatScore(score) {
   return score.toFixed(1);
 }
-function formatMetricValue(value) {
+function formatMetricValue2(value) {
   return Number.isInteger(value) ? value.toString() : value.toFixed(2);
 }
 function formatDate(value) {
@@ -4701,6 +4842,7 @@ dd { margin: 0; color: var(--muted); overflow-wrap: anywhere; }
 .verdict { margin-top: 12px; font-family: var(--serif); font-size: 30px; color: var(--periwinkle); }
 .insufficient-note { margin-top: 10px; color: var(--muted); font-size: 13px; line-height: 1.5; }
 .subscores { display: flex; gap: 12px; flex-wrap: wrap; margin-top: 18px; color: var(--muted); font-family: var(--mono); font-size: 12px; }
+.coverage-note { margin-top: 8px; color: var(--faint); font-family: var(--mono); font-size: 11px; }
 .source-counts { margin: 8px 0 0; padding-left: 18px; font-family: var(--mono); font-size: 12px; color: var(--muted); }
 .trust-grid, .evidence-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 18px; margin-top: 28px; }
 .external-findings-section { margin-top: 18px; }
@@ -4751,16 +4893,19 @@ var VERDICT_COLOR = {
   Conditional: "yellow",
   "At risk": "orange",
   Unverified: "red",
-  "Insufficient source": "lightgrey"
+  "Insufficient source": "lightgrey",
+  "Insufficient evidence": "lightgrey"
 };
 var VERDICT_SVG_FILL = {
   Verified: "#2fc86a",
   Conditional: "#dfb92f",
   "At risk": "#e08a3c",
   Unverified: "#d64545",
-  "Insufficient source": "#8c8c8c"
+  "Insufficient source": "#8c8c8c",
+  "Insufficient evidence": "#8c8c8c"
 };
 function badgeMessage(report, verdict) {
+  if (isWitanNoMeasurementAbstention(report)) return "unrated: no measurable evidence";
   if (report.verdict === "insufficient_source") return "unrated: no source";
   return `${formatScore2(report.overallScore)}/4.0 ${verdict.toLowerCase()}`;
 }
@@ -4915,21 +5060,80 @@ function verifyWitanAttestationBinding(statement, report, options = {}) {
 // src/witan/repo-signals.ts
 import { execFileSync } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { lstatSync, readFileSync, readdirSync, realpathSync, statSync } from "fs";
-import { basename, join, relative, resolve, sep } from "path";
+import {
+  closeSync,
+  lstatSync,
+  openSync,
+  readFileSync,
+  readSync,
+  readdirSync,
+  realpathSync,
+  statSync
+} from "fs";
+import { basename, dirname, extname, join, relative, resolve, sep } from "path";
 
 // src/witan/json-safe.ts
 function stripBom(text) {
   return text.charCodeAt(0) === 65279 ? text.slice(1) : text;
 }
 
+// src/witan/rubric-version.ts
+var WITAN_RUBRIC_VERSION_V92 = "witan-rubric-v9-2026-07-22";
+var WITAN_RUBRIC_VERSION_V10 = "witan-rubric-v10-2026-07-23";
+var WITAN_RUBRIC_VERSION_V11 = "witan-rubric-v11-2026-07-23";
+var WITAN_RUBRIC_VERSION_V12 = "witan-rubric-v12-2026-07-23";
+var WITAN_RUBRIC_VERSION_V13 = "witan-rubric-v13-2026-07-23";
+var WITAN_RUBRIC_VERSION_V14 = "witan-rubric-v14-2026-07-23";
+var WITAN_RUBRIC_VERSION_V15 = "witan-rubric-v15-2026-07-24";
+var WITAN_RUBRIC_VERSION_V16 = "witan-rubric-v16-2026-07-24";
+var WITAN_RUBRIC_VERSION_V17 = "witan-rubric-v17-2026-07-24";
+
 // src/witan/repo-signals.ts
 function buildWitanInputFromRepo(options) {
   assertRepoPathExists(options.repoPath);
   const generatedAt = options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const rubricVersion = options.rubricVersion ?? WITAN_RUBRIC_VERSION;
   const headSha = readGitHead(options.repoPath);
   const repoFiles = listRepoFiles(options.repoPath);
-  const archetype = classifyRepoArchetype(repoFiles);
+  const inventoryFiles = listRepoInventory(options.repoPath, repoFiles);
+  const ignoredTargetReason = repoFiles.length === 0 ? explainIgnoredScanTarget(options.repoPath) : void 0;
+  const usesV17Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V17;
+  const structuralArchetype = classifyRepoArchetype(inventoryFiles, rubricVersion);
+  const readableArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 ? applyReadableSourceRepresentationGate(
+    options.repoPath,
+    inventoryFiles,
+    structuralArchetype,
+    headSha,
+    rubricVersion
+  ) : structuralArchetype;
+  const gatedArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 ? applySemanticSourceRepresentationGate(
+    options.repoPath,
+    inventoryFiles,
+    readableArchetype,
+    rubricVersion
+  ) : readableArchetype;
+  const usesV8Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17;
+  const usesV33Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17;
+  const usesV36Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17;
+  const usesV39Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17;
+  const usesV47Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17;
+  const reviewableSourceProof = usesV17Detectors ? buildReviewableSourceProof(options.repoPath, inventoryFiles, headSha, rubricVersion) : void 0;
+  const coreSignals = collectRepoSignals(
+    options.repoPath,
+    generatedAt,
+    repoFiles,
+    usesV8Detectors,
+    usesV33Detectors,
+    usesV36Detectors,
+    usesV39Detectors,
+    usesV47Detectors,
+    reviewableSourceProof
+  );
+  const archetype = usesV17Detectors && reviewableSourceProof?.passes === true && isV17RescuableAbstention(gatedArchetype.abstentionKind) && coreSignals.some(isMeasuredCriterionSignal) ? {
+    archetype: isLikelyMonorepo(inventoryFiles) ? "monorepo" : "source",
+    sourceFileCount: gatedArchetype.sourceFileCount,
+    totalFileCount: gatedArchetype.totalFileCount
+  } : gatedArchetype;
   return {
     productSlug: options.productSlug,
     productDisplayName: options.productDisplayName,
@@ -4940,14 +5144,21 @@ function buildWitanInputFromRepo(options) {
     generatedAt,
     ...options.rubricVersion ? { rubricVersion: options.rubricVersion } : {},
     archetype: archetype.archetype,
-    ...archetype.insufficientSourceReason ? { insufficientSourceReason: archetype.insufficientSourceReason } : {},
+    ...ignoredTargetReason ?? archetype.insufficientSourceReason ? { insufficientSourceReason: ignoredTargetReason ?? archetype.insufficientSourceReason } : {},
     signals: [
-      ...collectRepoSignals(options.repoPath, generatedAt, repoFiles),
+      ...coreSignals,
       ...(options.domainCollectors ?? []).map((collect) => collect(options.repoPath, repoFiles)),
       ...options.additionalSignals ?? []
     ]
   };
 }
+function isV17RescuableAbstention(kind) {
+  return kind === "artifact_dominance" || kind === "docs_source_role" || kind === "readable_representation" || kind === "semantic_auxiliary";
+}
+function isMeasuredCriterionSignal(signal) {
+  if (signal.notApplicable === true) return false;
+  return (signal.metrics?.length ?? 0) > 0 || (signal.positiveEvidence?.length ?? 0) > 0 || (signal.findings?.length ?? 0) > 0;
+}
 var SOURCE_LANGUAGES = [
   {
     name: "JS/TS",
@@ -4967,7 +5178,7 @@ var SOURCE_LANGUAGES = [
   { name: "Dart", tier: "partial", extensions: ["dart"] },
   { name: "Elixir", tier: "partial", extensions: ["ex", "exs"] },
   { name: "Scala", tier: "partial", extensions: ["scala"] },
-  { name: "shell", tier: "unmodelled", extensions: ["sh", "bash", "zsh"] },
+  { name: "shell", tier: "unmodelled", extensions: ["sh", "bash", "zsh", "bat", "cmd"] },
   { name: "R", tier: "unmodelled", extensions: ["r"] },
   { name: "Lua", tier: "unmodelled", extensions: ["lua"] },
   { name: "Julia", tier: "unmodelled", extensions: ["jl"] },
@@ -4981,29 +5192,136 @@ var SOURCE_LANGUAGES = [
   { name: "Nim", tier: "unmodelled", extensions: ["nim"] },
   { name: "Zig", tier: "unmodelled", extensions: ["zig"] },
   { name: "F#", tier: "unmodelled", extensions: ["fs", "fsx"] },
-  { name: "Groovy", tier: "unmodelled", extensions: ["groovy", "gvy"] }
+  { name: "Groovy", tier: "unmodelled", extensions: ["groovy", "gvy"] },
+  { name: "Fortran", tier: "unmodelled", extensions: ["f", "for", "f77", "f90", "f95", "f03"] },
+  { name: "CUDA/HIP", tier: "unmodelled", extensions: ["cu", "cuh", "hip"] },
+  {
+    name: "Web templates/styles",
+    tier: "unmodelled",
+    extensions: [
+      "html",
+      "htm",
+      "css",
+      "scss",
+      "sass",
+      "less",
+      "hbs",
+      "handlebars",
+      "variables",
+      "overrides",
+      "vue",
+      "svelte",
+      "astro",
+      "erb",
+      "haml",
+      "slim",
+      "erubis",
+      "hamlit"
+    ]
+  }
+];
+var SOURCE_LANGUAGES_V10 = [
+  ...SOURCE_LANGUAGES,
+  { name: "COBOL", tier: "unmodelled", extensions: ["cob", "cbl", "cpy"] },
+  { name: "MATLAB/Objective-C", tier: "unmodelled", extensions: ["m"] }
 ];
 var SOURCE_EXTENSION_PATTERN = new RegExp(
   `\\.(${SOURCE_LANGUAGES.flatMap((language) => language.extensions).join("|")})$`,
   "i"
 );
-var BUNDLED_BINARY_EXTENSION_PATTERN = /\.(vsix|zip|tgz|whl|exe|dmg|pkg|msi|jar|war|apk|ipa|dll|dylib)$/i;
+var SOURCE_EXTENSION_PATTERN_V10 = new RegExp(
+  `\\.(${SOURCE_LANGUAGES_V10.flatMap((language) => language.extensions).join("|")})$`,
+  "i"
+);
+function isRecognizedSourcePath(path, rubricVersion = WITAN_RUBRIC_VERSION) {
+  return (rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 ? SOURCE_EXTENSION_PATTERN_V10 : SOURCE_EXTENSION_PATTERN).test(path);
+}
+var BUNDLED_BINARY_EXTENSION_PATTERN = /\.(vsix|zip|tgz|whl|exe|dmg|pkg|msi|jar|war|apk|ipa|dll|dylib|ttf|otf|woff2?|eot|eps)$/i;
 var DOCS_OR_MEDIA_EXTENSION_PATTERN = /\.(md|mdx|rst|png|jpe?g|gif|svg|webp|ico|pdf)$/i;
-var KNOWN_NON_SOURCE_EXTENSION_PATTERN = /\.(json|jsonc|json5|ya?ml|toml|txt|lock|xml|csv|tsv|ini|cfg|conf|properties|env|sum|mod|graphql|gql|proto|editorconfig|gitignore|gitattributes|npmrc|nvmrc|dockerignore|log|txt\.license)$/i;
+var ARTIFACT_DOMINANCE_EXTENSION_PATTERN = /\.(vsix|zip|tgz|whl|exe|dmg|pkg|msi|jar|war|apk|ipa|dll|dylib|ttf|otf|woff2?|eot|eps|png|jpe?g|gif|svg|webp|ico|pdf)$/i;
+var DOC_DISTRIBUTION_COMPANION_PATTERN = /(^|\/)(LICENSE|LICENCE|NOTICE|COPYING|AUTHORS|CONTRIBUTORS|CODE_OF_CONDUCT)(\.[A-Za-z0-9]+)?$/i;
+var GENERATED_OR_VENDOR_PATH_PATTERN = /(^|\/)(vendor|vendors|dist|build|generated|gen|coverage|node_modules|site-packages|\.venv|venv|\.next|__pycache__|\.terraform|public\/assets|static\/assets)(\/|$)|(^|\/)[^/]+\.min\.(?:js|css)$/i;
+var V17_BUILD_OR_DEPENDENCY_CACHE_PATH_PATTERN = /(^|\/)(?:target|_build|\.build|DerivedData|Pods|Carthage\/Build|\.cache|\.gradle|\.m2|\.yarn\/cache|\.pnpm-store|\.dart_tool|\.tox|\.pytest_cache|\.ruff_cache|\.mypy_cache|\.turbo|\.parcel-cache|\.angular\/cache|\.svelte-kit|\.nuxt|bazel-(?:bin|out|testlogs)|buck-out)(\/|$)/i;
+var INDEPENDENT_CATALOG_PATH_PATTERN = /(^|\/)(solutions?|exercises?|challenges?|algorithms?)(\/|$)/i;
+var KNOWN_NON_SOURCE_EXTENSION_PATTERN = /\.(json|jsonc|json5|ya?ml|toml|txt|lock|xml|csv|tsv|ini|cfg|conf|cnf|properties|env|sum|mod|graphql|gql|proto|sarif|editorconfig|gitignore|gitattributes|npmrc|nvmrc|dockerignore|prettierignore|prettierrc|log|stderr|snap|grit|po|mo|dbf|shp|shx|egg|pem|key|csr|ai|txt\.license|pf|in|case|common|fortls)$/i;
+var V13_NON_SOURCE_EXTENSION_PATTERN = /\.(?:\d+|class|py[co]|gz|bz2|xz|7z|rar|mat|npy|npz|h5|hdf5|onnx|pt|pth|ckpt|safetensors|crt|cer|der|p12|pfx|diff|patch|plist|pbxproj|xcworkspacedata|xcbuild|xcplayground|xcscheme|xcsettings|xcconfig|xcprivacy|xcstrings|csproj|fsproj|vbproj|sln|slnf|props|targets|projitems|shproj|pubxml|resw|resources|storyboard|xib|entitlements|modulemap|podspec|nuspec|appxmanifest|webmanifest|manifest|map|fls|aux|bbl|bib|ocm|tdb|db|sqlite|sqlcipher\d*|bin|dat|pdb|prj|resolved|sim|input|list|fig|drawio|puml|sketch|icns|flac|wav|mp3|mp4|mov|avi|mkv|nv21|xls[xb]?|mex[a-z0-9_]*|gitconfig|profile|yapf|config|desktop|typed|example|bak|_|test(?:_[a-z0-9]+)*_location_override|xamltest|tld(?:_[a-z0-9]+)?|xsd|cmake|gradle|mk|am|pro|upri|dockerfile|dockergen|makefile|alpine|android|debian|ubuntu\d+|cuda\d+_ubuntu\d+|manylinux[a-z0-9_]*)$/i;
 var INGEST_POINTER = "To assess a closed/bundled tool, ingest its scanner output via --ingest <sarif|scorecard>.";
-var SOURCE_DOMINANCE_RATIO_THRESHOLD = 0.2;
-function classifyRepoArchetype(repoFiles) {
+var SOURCE_DOMINANCE_RATIO_THRESHOLD_V8 = 0.2;
+var SOURCE_DOMINANCE_RATIO_THRESHOLD_V9 = 0.8;
+var SOURCE_DOMINANCE_RATIO_THRESHOLD_V10 = 0.5;
+var SOURCE_DOMINANCE_RATIO_THRESHOLD_V11 = 0.2;
+var GENERATED_SOURCE_MINIMUM = 8;
+var GENERATED_SOURCE_RATIO_THRESHOLD = 0.8;
+var GENERATED_AUTHORED_MAXIMUM = 3;
+var CATALOG_SOURCE_MINIMUM = 12;
+var CATALOG_SOURCE_RATIO_THRESHOLD = 0.9;
+var CATALOG_OUTSIDE_MAXIMUM = 2;
+function classifyRepoArchetype(repoFiles, rubricVersion = WITAN_RUBRIC_VERSION) {
   const totalFileCount = repoFiles.length;
-  const sourceFileCount = repoFiles.filter((file) => SOURCE_EXTENSION_PATTERN.test(file)).length;
+  const sourceFiles = repoFiles.filter((path) => isRecognizedSourcePath(path, rubricVersion));
+  const sourceFileCount = sourceFiles.length;
   if (totalFileCount === 0) {
     return {
       archetype: "empty",
       sourceFileCount: 0,
       totalFileCount: 0,
+      abstentionKind: "empty",
       insufficientSourceReason: "Repository has no tracked files \u2014 there is nothing to certify."
     };
   }
-  const unrecognisedSourceFiles = collectUnrecognisedSourceFiles(repoFiles);
+  const generatedSourceFiles = sourceFiles.filter(
+    (file) => GENERATED_OR_VENDOR_PATH_PATTERN.test(file)
+  );
+  if (sourceFileCount >= GENERATED_SOURCE_MINIMUM && generatedSourceFiles.length / sourceFileCount >= GENERATED_SOURCE_RATIO_THRESHOLD && sourceFileCount - generatedSourceFiles.length <= GENERATED_AUTHORED_MAXIMUM) {
+    return {
+      archetype: "generated_only",
+      sourceFileCount,
+      totalFileCount,
+      abstentionKind: "generated_only",
+      insufficientSourceReason: `${generatedSourceFiles.length} of ${sourceFileCount} source-shaped file(s) are under generated, vendor, build, distribution, coverage, or bundled-asset paths; only ${sourceFileCount - generatedSourceFiles.length} authored source-shaped file(s) remain. Cejel abstains because generated/vendor output is not a reviewable implementation surface. ${INGEST_POINTER}`
+    };
+  }
+  const catalogSourceFiles = sourceFiles.filter(
+    (file) => INDEPENDENT_CATALOG_PATH_PATTERN.test(file)
+  );
+  if (sourceFileCount >= CATALOG_SOURCE_MINIMUM && catalogSourceFiles.length / sourceFileCount >= CATALOG_SOURCE_RATIO_THRESHOLD && sourceFileCount - catalogSourceFiles.length <= CATALOG_OUTSIDE_MAXIMUM) {
+    return {
+      archetype: "non_cohesive_source",
+      sourceFileCount,
+      totalFileCount,
+      abstentionKind: "independent_catalog",
+      insufficientSourceReason: `${catalogSourceFiles.length} of ${sourceFileCount} source-shaped file(s) are under independent solution, exercise, challenge, or algorithm catalog paths; only ${sourceFileCount - catalogSourceFiles.length} source-shaped file(s) remain outside that catalog. Cejel abstains because the repository does not expose one cohesive product implementation to score. ${INGEST_POINTER}`
+    };
+  }
+  if (rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) {
+    const authoredSourceFiles = sourceFiles.filter(isAuthoredProductionPath);
+    const documentationFiles = repoFiles.filter(
+      (file) => DOCS_OR_MEDIA_EXTENSION_PATTERN.test(file)
+    );
+    if (sourceFileCount > 0 && authoredSourceFiles.length === 0 && documentationFiles.length > 0) {
+      return {
+        archetype: "docs_only",
+        sourceFileCount,
+        totalFileCount,
+        abstentionKind: "docs_source_role",
+        insufficientSourceReason: `${sourceFileCount} source-shaped file(s) are tests/fixtures around a documentation tree; no authored product source remains. Cejel abstains because documentation tests do not support a product-source headline score. ${INGEST_POINTER}`
+      };
+    }
+    const artifactFiles = repoFiles.filter(
+      (file) => ARTIFACT_DOMINANCE_EXTENSION_PATTERN.test(file)
+    );
+    const materialFiles = authoredSourceFiles.length + artifactFiles.length;
+    if (artifactFiles.length >= 10 && (authoredSourceFiles.length <= 10 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) && materialFiles > 0 && authoredSourceFiles.length / materialFiles <= 0.1) {
+      return {
+        archetype: "binary_only",
+        sourceFileCount,
+        totalFileCount,
+        abstentionKind: "artifact_dominance",
+        insufficientSourceReason: `${authoredSourceFiles.length} authored source-shaped file(s) accompany ${artifactFiles.length} packaged, font, image, or media artifact(s); the source is sparse tooling rather than a representative product implementation. Cejel abstains because incidental tooling cannot support a product-source headline score. ${INGEST_POINTER}`
+      };
+    }
+  }
+  const unrecognisedSourceFiles = collectUnrecognisedSourceFiles(repoFiles, rubricVersion);
   if (sourceFileCount === 0) {
     const binaryFiles = repoFiles.filter((file) => BUNDLED_BINARY_EXTENSION_PATTERN.test(file));
     if (binaryFiles.length > 0) {
@@ -5012,20 +5330,30 @@ function classifyRepoArchetype(repoFiles) {
         archetype: "binary_only",
         sourceFileCount,
         totalFileCount,
+        abstentionKind: "binary_distribution",
         insufficientSourceReason: `${sourceFileCount} source file(s) found among ${totalFileCount} tracked file(s); repo appears to be a binary/bundled-distribution tree (e.g. ${sample ? basename(sample) : "a packaged artifact"}) \u2014 cejel rates source, not binaries. ${INGEST_POINTER}`
       };
     }
     const docsFiles = repoFiles.filter((file) => DOCS_OR_MEDIA_EXTENSION_PATTERN.test(file));
-    if (docsFiles.length > 0 && docsFiles.length === totalFileCount) {
+    const docsDistributionFiles = repoFiles.filter(
+      (file) => DOCS_OR_MEDIA_EXTENSION_PATTERN.test(file) || DOC_DISTRIBUTION_COMPANION_PATTERN.test(file)
+    );
+    if (docsFiles.length > 0 && (docsDistributionFiles.length === totalFileCount || (rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) && unrecognisedSourceFiles.length === 0)) {
       return {
         archetype: "docs_only",
         sourceFileCount,
         totalFileCount,
+        abstentionKind: "docs_distribution",
         insufficientSourceReason: `${sourceFileCount} source file(s) found among ${totalFileCount} tracked file(s); repo appears to be a docs/distribution tree (README/markdown/media), not a source tree \u2014 cejel rates source, not docs. ${INGEST_POINTER}`
       };
     }
     if (unrecognisedSourceFiles.length > 0) {
-      return unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognisedSourceFiles);
+      return unrecognisedEcosystemResult(
+        sourceFileCount,
+        totalFileCount,
+        unrecognisedSourceFiles,
+        sourceDominanceThreshold(rubricVersion)
+      );
     }
     return { archetype: "source", sourceFileCount, totalFileCount };
   }
@@ -5037,25 +5365,285 @@ function classifyRepoArchetype(repoFiles) {
     };
   }
   const dominanceRatio = sourceFileCount / (sourceFileCount + unrecognisedSourceFiles.length);
-  if (dominanceRatio >= SOURCE_DOMINANCE_RATIO_THRESHOLD) {
+  const dominanceThreshold = sourceDominanceThreshold(rubricVersion);
+  if (dominanceRatio >= dominanceThreshold) {
     return {
       archetype: isLikelyMonorepo(repoFiles) ? "monorepo" : "source",
       sourceFileCount,
       totalFileCount
     };
   }
-  return unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognisedSourceFiles);
+  return unrecognisedEcosystemResult(
+    sourceFileCount,
+    totalFileCount,
+    unrecognisedSourceFiles,
+    dominanceThreshold
+  );
 }
-function collectUnrecognisedSourceFiles(repoFiles) {
-  return repoFiles.filter((file) => {
-    const base = basename(file);
-    if (!/\.([a-zA-Z0-9_]+)$/.test(base)) return false;
-    if (KNOWN_NON_SOURCE_EXTENSION_PATTERN.test(base)) return false;
-    if (DOCS_OR_MEDIA_EXTENSION_PATTERN.test(base)) return false;
-    if (BUNDLED_BINARY_EXTENSION_PATTERN.test(base)) return false;
-    if (SOURCE_EXTENSION_PATTERN.test(base)) return false;
-    return true;
+var READABLE_SOURCE_REPRESENTATION_THRESHOLD_V13 = 0.8;
+var READABLE_SOURCE_REPRESENTATION_SAMPLE_LIMIT_V13 = 32;
+var READABLE_SOURCE_REPRESENTATION_FILE_BYTES_V13 = 256 * 1024;
+var SEMANTIC_AUXILIARY_SOURCE_MINIMUM_V14 = 20;
+var SEMANTIC_AUXILIARY_SOURCE_RATIO_V14 = 0.8;
+var SEMANTIC_METADATA_PREFIX_BYTES_V14 = 16 * 1024;
+var SEMANTIC_AUXILIARY_PATH_PATTERN_V14 = /(^|\/)(?:locales?|i18n|l10n|translations?|styles?|themes?)(\/|$)|\.(?:css|scss|sass|less|styl)$/i;
+var HTML_SOURCE_EXTENSION_PATTERN = /\.(?:html?|xhtml)$/i;
+var HTML_META_REFRESH_PATTERN = /<meta\b(?=[^>]*\bhttp-equiv\s*=\s*["']?\s*refresh\b)(?=[^>]*\bcontent\s*=\s*["'][^"']*\burl\s*=)[^>]*>/i;
+var RUBY_PACKAGE_RECIPE_CLASS_PATTERN = /\bclass\s+[A-Za-z0-9_:]+\s*<\s*(?:Formula|Cask)\b/;
+var RUBY_PACKAGE_RECIPE_URL_PATTERN = /^\s*url\s+["'][^"']+["']/m;
+var RUBY_PACKAGE_RECIPE_PATH_PATTERN = /(^|\/)(?:Formula|Casks?)(\/|$)/;
+function selectProportionalRepresentativeSourceFiles(files, rankKey, limit) {
+  const eligibleFiles = [...new Set(files)];
+  const slotCount = Math.min(Math.max(Math.floor(limit), 0), eligibleFiles.length);
+  if (slotCount === 0) return [];
+  const grouped = /* @__PURE__ */ new Map();
+  for (const file of eligibleFiles) {
+    const extension = extname(file).toLowerCase() || "(none)";
+    const bucket = grouped.get(extension) ?? [];
+    bucket.push(file);
+    grouped.set(extension, bucket);
+  }
+  const groups = [...grouped.entries()].map(([extension, groupFiles]) => {
+    const quota = groupFiles.length / eligibleFiles.length * slotCount;
+    return {
+      extension,
+      files: [...groupFiles].sort(
+        (left, right) => representativeSourceRank(rankKey, left).localeCompare(
+          representativeSourceRank(rankKey, right)
+        )
+      ),
+      allocation: Math.floor(quota),
+      remainder: quota - Math.floor(quota)
+    };
+  }).sort(
+    (left, right) => right.files.length - left.files.length || left.extension.localeCompare(right.extension)
+  );
+  let remaining = slotCount - groups.reduce((sum, group) => sum + group.allocation, 0);
+  const remainderOrder = [...groups].sort(
+    (left, right) => right.remainder - left.remainder || right.files.length - left.files.length || left.extension.localeCompare(right.extension)
+  );
+  for (const group of remainderOrder) {
+    if (remaining === 0) break;
+    if (group.allocation >= group.files.length) continue;
+    group.allocation += 1;
+    remaining -= 1;
+  }
+  const selected = [];
+  for (let offset = 0; selected.length < slotCount; offset += 1) {
+    let added = false;
+    for (const group of groups) {
+      if (offset >= group.allocation) continue;
+      const file = group.files[offset];
+      if (!file) continue;
+      selected.push(file);
+      added = true;
+    }
+    if (!added) break;
+  }
+  return selected;
+}
+function isRepresentativeSourceText(contents) {
+  if (contents.trim().length === 0) return false;
+  if (contents.includes("\0") || contents.includes("\uFFFD")) return false;
+  let disallowedControls = 0;
+  for (const character of contents) {
+    const code = character.charCodeAt(0);
+    if (code < 32 && character !== "\n" && character !== "\r" && character !== "	") {
+      disallowedControls += 1;
+    }
+  }
+  return disallowedControls / contents.length <= 0.01;
+}
+function representativeSourceRank(rankKey, file) {
+  return createHash2("sha256").update(`${rankKey}:${file}`).digest("hex");
+}
+function buildReviewableSourceProof(repoPath, repoFiles, headSha, rubricVersion) {
+  const sourceShapedFiles = repoFiles.filter(
+    (path) => isRecognizedSourcePath(path, rubricVersion) || isUnrecognisedSourcePath(path, rubricVersion) || /\.ipynb$/i.test(path)
+  );
+  const eligibleSourceFiles = sourceShapedFiles.filter(
+    (path) => !GENERATED_OR_VENDOR_PATH_PATTERN.test(path) && !V17_BUILD_OR_DEPENDENCY_CACHE_PATH_PATTERN.test(path) && (SOURCE_EXTENSION_PATTERN.test(path) || /\.m$/i.test(path))
+  );
+  const sample = selectProportionalRepresentativeSourceFiles(
+    eligibleSourceFiles,
+    `witan-v17-reviewable-source:${headSha ?? "unversioned"}`,
+    READABLE_SOURCE_REPRESENTATION_SAMPLE_LIMIT_V13
+  );
+  const readablePaths = sample.filter((file) => {
+    const contents = readRepresentativeSourceText(repoPath, file);
+    return contents !== null && isRepresentativeSourceText(contents);
   });
+  const ratableShare = sourceShapedFiles.length === 0 ? 0 : eligibleSourceFiles.length / sourceShapedFiles.length;
+  const readableShare = sample.length === 0 ? 0 : readablePaths.length / sample.length;
+  return {
+    sourceShapedFileCount: sourceShapedFiles.length,
+    eligibleSourceFileCount: eligibleSourceFiles.length,
+    sampledFileCount: sample.length,
+    readableSampledFileCount: readablePaths.length,
+    ...readablePaths[0] ? { firstReadablePath: readablePaths[0] } : {},
+    passes: eligibleSourceFiles.length > 0 && ratableShare >= 0.2 && readablePaths.length > 0 && (readableShare >= 0.75 || readablePaths.length >= 8)
+  };
+}
+function applyReadableSourceRepresentationGate(repoPath, repoFiles, classification, headSha, rubricVersion) {
+  if (classification.archetype !== "source" && classification.archetype !== "monorepo") {
+    return classification;
+  }
+  const authoredSourceFiles = repoFiles.filter(
+    (path) => isAuthoredProductionPath(path) && (isRecognizedSourcePath(path, rubricVersion) || isUnrecognisedSourcePath(path, rubricVersion) || /\.ipynb$/i.test(path))
+  );
+  if (authoredSourceFiles.length === 0) return classification;
+  const sample = selectProportionalRepresentativeSourceFiles(
+    authoredSourceFiles,
+    `witan-v13-readable-source:${headSha ?? "unversioned"}`,
+    READABLE_SOURCE_REPRESENTATION_SAMPLE_LIMIT_V13
+  );
+  const sampledByExtension = /* @__PURE__ */ new Map();
+  for (const file of sample) {
+    const extension = extname(file).toLowerCase() || "(none)";
+    const counts = sampledByExtension.get(extension) ?? { sampled: 0, readable: 0 };
+    counts.sampled += 1;
+    const contents = readRepresentativeSourceText(repoPath, file);
+    if (contents !== null && isRepresentativeSourceText(contents)) {
+      counts.readable += 1;
+    }
+    sampledByExtension.set(extension, counts);
+  }
+  const sourceCountByExtension = /* @__PURE__ */ new Map();
+  for (const file of authoredSourceFiles) {
+    const extension = extname(file).toLowerCase() || "(none)";
+    sourceCountByExtension.set(extension, (sourceCountByExtension.get(extension) ?? 0) + 1);
+  }
+  const readableSourceFileCount = [...sourceCountByExtension.entries()].reduce(
+    (total, [extension, sourceCount]) => {
+      const sampled = sampledByExtension.get(extension);
+      if (!sampled || sampled.sampled === 0) return total;
+      return total + sourceCount * (sampled.readable / sampled.sampled);
+    },
+    0
+  );
+  const readableRatio = readableSourceFileCount / authoredSourceFiles.length;
+  if (readableRatio >= READABLE_SOURCE_REPRESENTATION_THRESHOLD_V13) return classification;
+  const readableCountLabel = Number.isInteger(readableSourceFileCount) ? String(readableSourceFileCount) : readableSourceFileCount.toFixed(2);
+  const readablePct = (readableRatio * 100).toFixed(1);
+  const thresholdPct = (READABLE_SOURCE_REPRESENTATION_THRESHOLD_V13 * 100).toFixed(0);
+  return {
+    archetype: "non_cohesive_source",
+    sourceFileCount: classification.sourceFileCount,
+    totalFileCount: classification.totalFileCount,
+    abstentionKind: "readable_representation",
+    insufficientSourceReason: `Readable source representation covers ${readableCountLabel} of ${authoredSourceFiles.length} authored source-shaped file(s) (${readablePct}%); this is below the ${thresholdPct}% representation threshold. Cejel abstains because unreadable, compressed, binary-shaped, or opaque source families cannot support a representative headline score. ${INGEST_POINTER}`
+  };
+}
+function applySemanticSourceRepresentationGate(repoPath, repoFiles, classification, rubricVersion) {
+  if (classification.archetype !== "source" && classification.archetype !== "monorepo") {
+    return classification;
+  }
+  const authoredSourceFiles = repoFiles.filter(
+    (path) => isAuthoredProductionPath(path) && (isRecognizedSourcePath(path, rubricVersion) || isUnrecognisedSourcePath(path, rubricVersion) || /\.ipynb$/i.test(path))
+  );
+  if (authoredSourceFiles.length === 0) return classification;
+  const auxiliaryFiles = authoredSourceFiles.filter(
+    (path) => SEMANTIC_AUXILIARY_PATH_PATTERN_V14.test(path)
+  );
+  const packageMetadataFiles = authoredSourceFiles.filter(
+    (path) => isRubyPackageRecipeMetadataSource(repoPath, path)
+  );
+  const redirectMetadataFiles = authoredSourceFiles.filter(
+    (path) => isHtmlRedirectMetadataSource(repoPath, path)
+  );
+  const auxiliarySet = /* @__PURE__ */ new Set([
+    ...auxiliaryFiles,
+    ...packageMetadataFiles,
+    ...redirectMetadataFiles
+  ]);
+  const representativeImplementationCount = authoredSourceFiles.filter(
+    (path) => !auxiliarySet.has(path)
+  ).length;
+  if (representativeImplementationCount === 0) {
+    const detail = redirectMetadataFiles.length > 0 ? `${redirectMetadataFiles.length} redirect metadata file(s)` : packageMetadataFiles.length > 0 ? `${packageMetadataFiles.length} package metadata file(s)` : `${auxiliaryFiles.length} localization or style metadata file(s)`;
+    return {
+      archetype: "non_cohesive_source",
+      sourceFileCount: classification.sourceFileCount,
+      totalFileCount: classification.totalFileCount,
+      abstentionKind: "semantic_auxiliary",
+      insufficientSourceReason: `${detail} provide no representative product implementation. Cejel abstains because auxiliary metadata or payload files cannot support a product-source headline score. ${INGEST_POINTER}`
+    };
+  }
+  const auxiliaryCount = auxiliarySet.size;
+  const auxiliaryRatio = auxiliaryCount / authoredSourceFiles.length;
+  if (authoredSourceFiles.length >= SEMANTIC_AUXILIARY_SOURCE_MINIMUM_V14 && auxiliaryRatio >= SEMANTIC_AUXILIARY_SOURCE_RATIO_V14) {
+    return {
+      archetype: "non_cohesive_source",
+      sourceFileCount: classification.sourceFileCount,
+      totalFileCount: classification.totalFileCount,
+      abstentionKind: "semantic_auxiliary",
+      insufficientSourceReason: `${auxiliaryCount} of ${authoredSourceFiles.length} authored source-shaped file(s) are localization, style, package, or redirect auxiliary material. Cejel abstains because an auxiliary-dominated tree does not expose representative product implementation for a headline score. ${INGEST_POINTER}`
+    };
+  }
+  return classification;
+}
+function isHtmlRedirectMetadataSource(repoPath, file) {
+  if (!HTML_SOURCE_EXTENSION_PATTERN.test(file)) return false;
+  const contents = readSemanticMetadataPrefix(repoPath, file);
+  if (contents === null) return false;
+  const operativeContents = contents.replace(/<!--[\s\S]*?-->/g, "");
+  if (!HTML_META_REFRESH_PATTERN.test(operativeContents)) return false;
+  return !/<(?:script|form|main|article|section|canvas|template)\b/i.test(operativeContents);
+}
+function isRubyPackageRecipeMetadataSource(repoPath, file) {
+  if (!/\.rb$/i.test(file) || !RUBY_PACKAGE_RECIPE_PATH_PATTERN.test(file)) return false;
+  const contents = readSemanticMetadataPrefix(repoPath, file);
+  const operativeContents = contents?.replace(/^\s*#.*$/gm, "");
+  return operativeContents !== void 0 && RUBY_PACKAGE_RECIPE_CLASS_PATTERN.test(operativeContents) && RUBY_PACKAGE_RECIPE_URL_PATTERN.test(operativeContents);
+}
+function readSemanticMetadataPrefix(repoPath, file) {
+  const absolutePath = join(repoPath, file);
+  if (!isRegularFile(absolutePath)) return null;
+  let descriptor = null;
+  try {
+    descriptor = openSync(absolutePath, "r");
+    const buffer = Buffer.allocUnsafe(SEMANTIC_METADATA_PREFIX_BYTES_V14);
+    const bytesRead = readSync(descriptor, buffer, 0, SEMANTIC_METADATA_PREFIX_BYTES_V14, 0);
+    return buffer.subarray(0, bytesRead).toString("utf8");
+  } catch {
+    return null;
+  } finally {
+    if (descriptor !== null) closeSync(descriptor);
+  }
+}
+function readRepresentativeSourceText(repoPath, file) {
+  const absolutePath = join(repoPath, file);
+  try {
+    if (!isRegularFile(absolutePath)) return null;
+    const size = statSync(absolutePath).size;
+    if (size === 0 || size > READABLE_SOURCE_REPRESENTATION_FILE_BYTES_V13) return null;
+    return readFileSync(absolutePath, "utf8");
+  } catch {
+    return null;
+  }
+}
+function sourceDominanceThreshold(rubricVersion) {
+  if (rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) {
+    return SOURCE_DOMINANCE_RATIO_THRESHOLD_V11;
+  }
+  if (rubricVersion === WITAN_RUBRIC_VERSION_V10) return SOURCE_DOMINANCE_RATIO_THRESHOLD_V10;
+  if (rubricVersion === WITAN_RUBRIC_VERSION_V92) return SOURCE_DOMINANCE_RATIO_THRESHOLD_V9;
+  return SOURCE_DOMINANCE_RATIO_THRESHOLD_V8;
+}
+function collectUnrecognisedSourceFiles(repoFiles, rubricVersion) {
+  return repoFiles.filter((path) => isUnrecognisedSourcePath(path, rubricVersion));
+}
+function isUnrecognisedSourcePath(file, rubricVersion = WITAN_RUBRIC_VERSION) {
+  const base = basename(file);
+  if (!/\.([a-zA-Z0-9_]+)$/.test(base)) return false;
+  if (KNOWN_NON_SOURCE_EXTENSION_PATTERN.test(base)) return false;
+  if ((rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) && V13_NON_SOURCE_EXTENSION_PATTERN.test(base)) {
+    return false;
+  }
+  if (DOCS_OR_MEDIA_EXTENSION_PATTERN.test(base)) return false;
+  if (BUNDLED_BINARY_EXTENSION_PATTERN.test(base)) return false;
+  if (isRecognizedSourcePath(base, rubricVersion)) return false;
+  return true;
 }
 function extensionsByFileCountDescending(files) {
   const counts = /* @__PURE__ */ new Map();
@@ -5068,16 +5656,17 @@ function extensionsByFileCountDescending(files) {
   }
   return [...counts.entries()].sort(([extA, countA], [extB, countB]) => countB - countA || extA.localeCompare(extB)).map(([ext]) => ext);
 }
-function unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognisedSourceFiles) {
+function unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognisedSourceFiles, dominanceThreshold = SOURCE_DOMINANCE_RATIO_THRESHOLD_V9) {
   const sample = extensionsByFileCountDescending(unrecognisedSourceFiles).slice(0, 6).join(", ");
   const candidateCount = sourceFileCount + unrecognisedSourceFiles.length;
   const dominancePct = candidateCount > 0 ? (sourceFileCount / candidateCount * 100).toFixed(1) : "0.0";
-  const thresholdPct = (SOURCE_DOMINANCE_RATIO_THRESHOLD * 100).toFixed(0);
+  const thresholdPct = (dominanceThreshold * 100).toFixed(0);
   const measuredClause = sourceFileCount > 0 ? `${sourceFileCount} of ${candidateCount} source-shaped file(s) (${dominancePct}%) are in a language Cejel reads \u2014 below the ${thresholdPct}% dominance threshold a score would need to be meaningful (${totalFileCount} tracked files in total; manifests, lockfiles, docs, media and bundled binaries are excluded from both sides of the ratio)` : `0 of ${totalFileCount} tracked file(s) matched a recognised source extension`;
   return {
     archetype: "unrecognised_ecosystem",
     sourceFileCount,
     totalFileCount,
+    abstentionKind: "unrecognised_ecosystem",
     insufficientSourceReason: `Cejel does not yet read this repository's dominant source language(s) (${sample}) \u2014 ${measuredClause}. Cejel abstains from a verdict rather than score a repository whose recognised source is incidental rather than dominant; the Criterion Profile and Measured coverage below show exactly which dimensions were and were not measured. ${INGEST_POINTER}`
   };
 }
@@ -5098,6 +5687,32 @@ function assertRepoPathExists(repoPath) {
     throw new Error(`Cejel: path is not a directory: ${repoPath}`);
   }
 }
+function explainIgnoredScanTarget(repoPath) {
+  let top;
+  try {
+    top = execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd: repoPath,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return void 0;
+  }
+  if (!top) return void 0;
+  const topResolved = realpathSync(top);
+  const targetResolved = realpathSync(repoPath);
+  const target = relative(topResolved, targetResolved).split(sep).join("/");
+  if (!target || target.startsWith("../")) return void 0;
+  try {
+    execFileSync("git", ["check-ignore", "--quiet", "--", `${target}/`], {
+      cwd: topResolved,
+      stdio: "ignore"
+    });
+  } catch {
+    return void 0;
+  }
+  return `The requested scan path (${target}) is excluded by this repository's Git ignore rules, so Cejel found no tracked source to evaluate. Scan a tracked project or intentionally add the path to version control; Cejel abstains rather than score an ignored or vendored working tree.`;
+}
 function buildNotApplicableSignal(criterionId, reason) {
   return {
     criterionId,
@@ -5108,14 +5723,35 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, reviewableSourceProof) {
   const signals = [];
   const mono = resolveMonorepoContext(repoPath);
-  const a1Signal = collectA1TestIntegrityEvidence(repoPath, repoFiles);
-  const a2Signal = collectA2IsolationEvidence(repoPath, repoFiles);
-  const a3Signal = collectA3ProdReadinessEvidence(repoPath, repoFiles);
-  const a4Signal = collectA4DependencyEvidence(repoPath, repoFiles, mono);
-  const a5Signal = collectA5ClaimRealityEvidence(repoPath, repoFiles);
+  const a1Signal = collectA1TestIntegrityEvidence(
+    repoPath,
+    repoFiles,
+    useV27Detectors,
+    useV33Detectors,
+    useV36Detectors,
+    reviewableSourceProof
+  );
+  const a2Signal = collectA2IsolationEvidence(
+    repoPath,
+    repoFiles,
+    useV27Detectors,
+    useV33Detectors,
+    useV36Detectors,
+    useV39Detectors,
+    useV47Detectors
+  );
+  const a3Signal = collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors);
+  const a4Signal = collectA4DependencyEvidence(
+    repoPath,
+    repoFiles,
+    mono,
+    useV27Detectors,
+    useV47Detectors
+  );
+  const a5Signal = collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors);
   const b1Signal = buildNotApplicableSignal(
     "B1",
     "Repository scans do not evaluate the dispatch-trace process dimension."
@@ -5127,7 +5763,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles) {
     "B5",
     "Repository scans do not evaluate the learning-trace process dimension."
   );
-  const b6Signal = collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles);
+  const b6Signal = collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detectors);
   for (const signal of [
     a1Signal,
     a2Signal,
@@ -5145,22 +5781,31 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles) {
   }
   return signals;
 }
-function collectA1TestIntegrityEvidence(repoPath, repoFiles) {
+function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, reviewableSourceProof) {
   const evidence = [];
   const findings = [];
-  const contentCppTests = collectContentBasedCppTestFiles(repoPath, repoFiles);
-  const allTestFiles = [
-    ...repoFiles.filter(isTestFile),
-    ...contentCppTests.filter((file) => !isTestFile(file))
-  ];
+  const allTestFiles = findConcreteTestFiles(
+    repoPath,
+    repoFiles,
+    reviewableSourceProof ? WITAN_RUBRIC_VERSION_V17 : void 0
+  );
   const testFiles = allTestFiles.slice(0, 8);
   const sourceFiles = repoFiles.filter(isSourceFile);
-  const runnerFiles = repoFiles.filter(isTestRunnerConfig).slice(0, 6);
-  const coverageFiles = repoFiles.filter(isCoverageConfig).slice(0, 4);
+  const runnerFiles = repoFiles.filter(
+    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isTestRunnerConfig(repoPath, file)
+  ).slice(0, 6);
+  const configuredRunnerFiles = useV33Detectors ? findConfiguredTestRunnerFiles(repoPath, repoFiles) : runnerFiles;
+  const allCoverageFiles = findCoverageConfigFiles(repoPath, repoFiles, useV27Detectors);
+  const coverageFiles = allCoverageFiles.slice(0, 4);
   const packageJson = findRootPackageJson(repoFiles);
   const packageScripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
+  const packageJsonFiles = useV27Detectors ? repoFiles.filter(
+    (file) => /(^|\/)package\.json$/.test(file) && isAuthoredProductionPath(file)
+  ) : packageJson ? [packageJson] : [];
   const coveragePercent = readCoveragePercent(repoPath, coverageFiles);
-  const ciWorkflows = repoFiles.filter(isCiWorkflow);
+  const ciWorkflows = repoFiles.filter(
+    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isCiWorkflow(file)
+  );
   const ciTestWorkflow = ciWorkflows.find(
     (file) => fileContains(repoPath, file, CI_TEST_COMMAND_PATTERN)
   );
@@ -5179,7 +5824,9 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles) {
   const usesLeanBuiltInTestRunner = packageJson != null && [...packageScripts.values()].some(
     (script) => LEAN_TEST_RUNNER_SCRIPT_PATTERN.test(script)
   ) || testFiles.some((file) => fileContains(repoPath, file, LEAN_TEST_RUNNER_IMPORT_PATTERN));
-  const hasHeavyTestDependency = packageJson != null && packageJsonHasHeavyTestDependency(repoPath, packageJson);
+  const hasHeavyTestDependency = packageJsonFiles.some(
+    (manifest) => packageJsonHasHeavyTestDependency(repoPath, manifest)
+  );
   const isLeanTestToolchain = usesLeanBuiltInTestRunner && !hasHeavyTestDependency;
   for (const file of testFiles) {
     evidence.push(evidenceForRelative(repoPath, file, "test_run", "Detected test file"));
@@ -5199,7 +5846,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles) {
     );
   }
   const scheduledHealthWorkflow = ciWorkflows.find(
-    (file) => fileContains(repoPath, file, SCHEDULE_TRIGGER_PATTERN) && fileContains(repoPath, file, CI_TEST_COMMAND_PATTERN)
+    (file) => fileContains(repoPath, file, SCHEDULE_TRIGGER_PATTERN) && fileContains(repoPath, file, CI_TEST_COMMAND_PATTERN) && (!useV36Detectors || SCHEDULED_HEALTH_PATH_PATTERN.test(file) || fileContains(repoPath, file, SCHEDULED_HEALTH_INTENT_PATTERN))
   );
   if (scheduledHealthWorkflow) {
     const isPublished = fileContains(
@@ -5230,9 +5877,16 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles) {
       });
     }
   }
-  if (evidence.length === 0 && findings.length === 0) return null;
+  if (evidence.length === 0 && findings.length === 0 && configuredRunnerFiles.length === 0) {
+    return reviewableSourceProof?.passes === true && reviewableSourceProof.firstReadablePath ? buildA1AuthenticatedAbsenceSignal(repoPath, reviewableSourceProof) : null;
+  }
   if (testFiles.length === 0) {
-    const fallback = evidence[0] ?? findings[0]?.evidence;
+    const fallback = configuredRunnerFiles[0] ? evidenceForRelative(
+      repoPath,
+      configuredRunnerFiles[0],
+      "test_run",
+      "Configured test runner"
+    ) : useV33Detectors ? void 0 : evidence[0] ?? findings[0]?.evidence;
     if (fallback) {
       findings.push({
         severity: "warning",
@@ -5240,7 +5894,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles) {
         evidence: fallback
       });
     }
-  } else if (coverageFiles.length === 0) {
+  } else if (coverageFiles.length === 0 && (!useV33Detectors || configuredRunnerFiles.length > 0)) {
     if (isLeanTestToolchain) {
       const leanEvidenceFile = packageJson ?? testFiles[0];
       if (leanEvidenceFile) {
@@ -5263,7 +5917,11 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles) {
       });
     }
   }
-  const nonHollowShare = measureNonHollowTestShare(repoPath, allTestFiles);
+  const nonHollowShare = measureNonHollowTestShare(
+    repoPath,
+    allTestFiles,
+    reviewableSourceProof !== void 0
+  );
   return {
     criterionId: "A1",
     positiveEvidence: evidence,
@@ -5311,27 +5969,131 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles) {
     notes: "A1 is detected from real test files, test runner configuration, and optional coverage configuration."
   };
 }
-function collectA2IsolationEvidence(repoPath, repoFiles) {
+function buildA1AuthenticatedAbsenceSignal(repoPath, proof) {
+  const sourcePath = proof.firstReadablePath;
+  if (!sourcePath) {
+    throw new Error("Cejel invariant: a passing reviewable-source proof must have a readable path");
+  }
+  const anchor = evidenceForRelative(
+    repoPath,
+    sourcePath,
+    "artifact",
+    `Reviewable source anchor (${proof.readableSampledFileCount}/${proof.sampledFileCount} sampled files readable; ${proof.eligibleSourceFileCount}/${proof.sourceShapedFileCount} source-shaped files criterion-ratable)`
+  );
+  return {
+    criterionId: "A1",
+    positiveEvidence: [anchor],
+    findings: [
+      {
+        severity: "critical",
+        summary: WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY,
+        evidence: anchor
+      }
+    ],
+    metrics: [
+      metric(
+        "test_to_source_ratio",
+        "Test-to-source file ratio",
+        0,
+        proof.eligibleSourceFileCount,
+        0.3,
+        "ratio",
+        "Measures how much concrete test surface exists relative to criterion-ratable implementation source.",
+        "saturating_count"
+      ),
+      metric(
+        "coverage_percent",
+        "Static coverage percentage",
+        0,
+        100,
+        0.3,
+        "percent",
+        "Uses a static coverage report value or configured threshold when present, without running tests."
+      ),
+      metric(
+        "verification_script_ratio",
+        "Verification script ratio",
+        0,
+        4,
+        0.25,
+        "ratio",
+        "Measures explicit test/lint/typecheck verification commands plus test runner configuration.",
+        "saturating_count"
+      ),
+      metric(
+        "non_hollow_test_share",
+        "Non-hollow test share",
+        0,
+        1,
+        0.15,
+        "ratio",
+        "No concrete test files were present to establish non-hollow test behavior."
+      )
+    ],
+    notes: `V17 authenticated absence: ${proof.eligibleSourceFileCount} criterion-ratable of ${proof.sourceShapedFileCount} source-shaped files; sampled ${proof.sampledFileCount}; ${proof.readableSampledFileCount} representative-text files.`
+  };
+}
+function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors) {
   const evidence = [];
   const findings = [];
   const gitignore = repoFiles.find((file) => basename(file) === ".gitignore");
-  const envExamples = repoFiles.filter((file) => isEnvTemplatePath(file));
+  const envExamples = repoFiles.filter((file) => isEnvTemplatePath(file, useV47Detectors));
   const migrationFiles = repoFiles.filter(
     (file) => /(^|\/)(migrations?|drizzle|prisma)\//.test(file)
   );
-  const committedSecret = repoFiles.find(
-    (file) => !isIgnoredScanFile(file) && fileContainsCommittedSecret(repoPath, file)
+  let committedSecret;
+  for (const path of repoFiles) {
+    const authoredProductionPath = useV47Detectors ? isV47AuthoredProductionPath(path) : useV39Detectors ? isV39AuthoredProductionPath(path) : isAuthoredProductionPath(path);
+    if (isIgnoredScanFile(path, useV47Detectors) || useV33Detectors && !authoredProductionPath) {
+      continue;
+    }
+    const match = findCommittedSecretInFile(
+      repoPath,
+      path,
+      useV36Detectors,
+      useV39Detectors,
+      useV47Detectors
+    );
+    if (!match) continue;
+    committedSecret = { path, match };
+    break;
+  }
+  const currentSecretFingerprintsByPath = /* @__PURE__ */ new Map();
+  if (useV27Detectors) {
+    for (const path of repoFiles.filter((candidate) => isCredentialHistoryPath(candidate))) {
+      currentSecretFingerprintsByPath.set(
+        path,
+        new Set(
+          findSecretFingerprintsInFile(
+            repoPath,
+            path,
+            useV36Detectors,
+            useV39Detectors,
+            useV47Detectors
+          )
+        )
+      );
+    }
+  }
+  const historySecretScan = committedSecret && !useV27Detectors ? null : collectHistorySecretEvidence(
+    repoPath,
+    useV27Detectors,
+    currentSecretFingerprintsByPath,
+    useV33Detectors,
+    useV36Detectors,
+    useV39Detectors,
+    useV47Detectors
   );
-  const historySecretScan = committedSecret ? null : collectHistorySecretEvidence(repoPath);
   const hasConfirmedSecretFinding = committedSecret != null || historySecretScan?.evidence != null;
   const cryptoHygiene = collectCryptoHygieneEvidence(
     repoPath,
-    repoFiles.filter(isImplementationFile).slice(0, 60)
+    repoFiles.filter(isImplementationFile).slice(0, 60),
+    useV39Detectors
   );
   const implFiles = repoFiles.filter(isImplementationFile);
   const gitignoreHasEnvRule = gitignore != null && fileContains(repoPath, gitignore, /^\.env(\*|\b)|\.env\./m);
   const committedEnvFilePath = repoFiles.find(
-    (f) => /(?:^|\/)\.env(?:\.|$)/i.test(f) && !isEnvTemplatePath(f)
+    (f) => /(?:^|\/)\.env(?:\.|$)/i.test(f) && !isEnvTemplatePath(f, useV47Detectors) && (!useV47Detectors || isV47AuthoredProductionPath(f)) && (!useV39Detectors || !hasTemplateOnlyEnvContent(repoPath, f))
   );
   const hasEnvInHistory = committedEnvFilePath === void 0 && hasEnvPathInGitHistory(repoPath);
   const dbLayerImportFile = migrationFiles.length === 0 ? implFiles.slice(0, 30).find((f) => fileContains(repoPath, f, DB_CLIENT_PATTERN)) : void 0;
@@ -5366,20 +6128,17 @@ function collectA2IsolationEvidence(repoPath, repoFiles) {
   } else if (dbLayerImportFile != null) {
     evidence.push(evidenceForRelative(repoPath, dbLayerImportFile, "artifact", "DB client import"));
   }
-  const rlsMigration = migrationFiles.find((file) => fileContains(repoPath, file, RLS_PATTERN));
-  const tenantScopedFile = migrationFiles.find(
-    (file) => fileContains(repoPath, file, TENANT_SCOPE_PATTERN)
-  );
-  const rlsPolicyCount = countPatternMatches(
+  const v47RlsPolicyFiles = useV47Detectors ? findRlsPolicyFiles(repoPath, repoFiles) : [];
+  const v47TenantStorageFiles = useV47Detectors ? findTenantStoragePremiseFiles(repoPath, repoFiles) : [];
+  const rlsMigration = useV47Detectors ? v47RlsPolicyFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, RLS_PATTERN));
+  const tenantScopePattern = useV39Detectors ? TENANT_SCOPE_PATTERN_V11 : useV36Detectors ? TENANT_SCOPE_PATTERN_V10 : TENANT_SCOPE_PATTERN;
+  const tenantScopedFile = useV47Detectors ? v47TenantStorageFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, tenantScopePattern));
+  const rlsPolicyCount = useV47Detectors ? v47RlsPolicyFiles.length : countPatternMatches(
     repoPath,
     migrationFiles,
     /create policy|enable row level security|force row level security/gi
   );
-  const tenantScopedMigrationFileCount = countFilesContaining(
-    repoPath,
-    migrationFiles,
-    TENANT_SCOPE_PATTERN
-  );
+  const tenantScopedMigrationFileCount = useV47Detectors ? v47TenantStorageFiles.length : countFilesContaining(repoPath, migrationFiles, tenantScopePattern);
   const gitignoreEnvFile = gitignore && fileContains(repoPath, gitignore, /^\.env(\*|\b)|\.env\./m) ? gitignore : null;
   const envHandlingDepth = (envExamples.length > 0 ? 1 : 0) + (gitignoreEnvFile ? 1 : 0) + (countFilesContaining(repoPath, repoFiles.filter(isImplementationFile), ENV_READ_PATTERN) > 0 ? 1 : 0);
   const isMultiTenant = tenantScopedMigrationFileCount > 0;
@@ -5402,15 +6161,31 @@ function collectA2IsolationEvidence(repoPath, repoFiles) {
     );
   }
   if (committedSecret) {
-    const isTestPath = isTestOrFixturePath(committedSecret);
+    const isTestPath = isTestOrFixturePath(committedSecret.path);
+    const isDefaultAdmin = committedSecret.match.kind === "default_admin";
     findings.push({
       severity: isTestPath ? "info" : "critical",
-      summary: isTestPath ? `Secret-shaped value in a test/fixture file (${committedSecret}) \u2014 likely fixture data, not a production leak; verify.` : "Secret-shaped value appears committed in the scanned repository.",
+      summary: isDefaultAdmin ? isTestPath ? `Default administrative credential in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production deployment default; verify.` : "An explicit default administrative credential appears committed in production configuration." : isTestPath ? `Secret-shaped value in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production leak; verify.` : "Secret-shaped value appears committed in the scanned repository.",
+      evidence: evidenceForRelativeAtLine(
+        repoPath,
+        committedSecret.path,
+        "secret_scan",
+        secretEvidenceLabel(
+          isDefaultAdmin ? "Committed default administrative credential" : "Committed secret-shaped value",
+          committedSecret.match
+        ),
+        committedSecret.match.line
+      )
+    });
+  } else if (committedEnvFilePath) {
+    findings.push({
+      severity: useV33Detectors ? "info" : "warning",
+      summary: "A non-template .env file is committed in the current repository tree; no secret-shaped value was detected.",
       evidence: evidenceForRelative(
         repoPath,
-        committedSecret,
+        committedEnvFilePath,
         "secret_scan",
-        "Committed secret-shaped value"
+        "Committed .env file (no confirmed secret value found)"
       )
     });
   }
@@ -5424,7 +6199,7 @@ function collectA2IsolationEvidence(repoPath, repoFiles) {
     });
   } else if (historySecretScan?.truncated) {
     findings.push({
-      severity: "warning",
+      severity: useV33Detectors ? "info" : "warning",
       summary: "History secret scan reached the credential-path safety valve before scanning every matching blob.",
       evidence: {
         kind: "secret_scan",
@@ -5435,7 +6210,7 @@ function collectA2IsolationEvidence(repoPath, repoFiles) {
     });
   } else if (historySecretScan?.envPathEvidence) {
     findings.push({
-      severity: "warning",
+      severity: useV33Detectors ? "info" : "warning",
       summary: "A non-template .env file was tracked in git history; no secret-shaped value was detected.",
       evidence: historySecretScan.envPathEvidence
     });
@@ -5493,7 +6268,7 @@ function collectA2IsolationEvidence(repoPath, repoFiles) {
     metric(
       "tenant_scope_ratio",
       "Tenant-scoped schema ratio",
-      countFilesContaining(repoPath, migrationFiles, TENANT_SCOPE_PATTERN),
+      countFilesContaining(repoPath, migrationFiles, tenantScopePattern),
       Math.max(migrationFiles.length, 1),
       0.25,
       "ratio",
@@ -5519,12 +6294,14 @@ function collectA2IsolationEvidence(repoPath, repoFiles) {
     notes: "History secret scanning covers all reachable git history for credential-pattern paths unless the explicit credential-blob safety valve is reported."
   };
 }
-function collectCryptoHygieneEvidence(repoPath, implFiles) {
+function collectCryptoHygieneEvidence(repoPath, implFiles, useV39Detectors = false) {
   const evidence = [];
   const findings = [];
   let hasSurface = false;
   let insecureFound = false;
-  const productionImplFiles = implFiles.filter(isProductionSourcePath);
+  const productionImplFiles = implFiles.filter(
+    (file) => useV39Detectors ? isV39AuthoredProductionPath(file) : isProductionSourcePath(file)
+  );
   const timingSafeFile = productionImplFiles.find(
     (file) => fileContains(repoPath, file, TIMING_SAFE_COMPARE_PATTERN)
   );
@@ -5555,8 +6332,9 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
   }
   let insecureCompareFile = null;
   let insecureCompareLine = null;
-  for (const file of implFiles) {
-    const line = findInsecureSecretCompareLine(repoPath, file);
+  const compareFiles = useV39Detectors ? productionImplFiles : implFiles;
+  for (const file of compareFiles) {
+    const line = findInsecureSecretCompareLine(repoPath, file, useV39Detectors);
     if (line != null) {
       insecureCompareFile = file;
       insecureCompareLine = line;
@@ -5564,6 +6342,12 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
     }
   }
   if (insecureCompareFile) {
+    const insecureCompareSourceLine = lineAt(
+      repoPath,
+      insecureCompareFile,
+      insecureCompareLine ?? 0
+    );
+    const comparesDefaultSentinel = useV39Detectors && insecureCompareSourceLine !== null && DEFAULT_SECRET_SENTINEL_COMPARE_LINE_PATTERN.test(insecureCompareSourceLine);
     const isTestPath = isTestOrFixturePath(insecureCompareFile);
     if (!isTestPath) {
       hasSurface = true;
@@ -5571,7 +6355,7 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
     }
     findings.push({
       severity: isTestPath ? "info" : "warning",
-      summary: isTestPath ? `A secret/HMAC/signature comparison via plain equality appears in a test/fixture file (${insecureCompareFile}) \u2014 likely a test assertion, not a production timing leak; verify.` : "A secret/HMAC/signature value appears compared with a plain equality operator instead of a constant-time comparison \u2014 potential timing side-channel.",
+      summary: isTestPath ? `A secret/HMAC/signature comparison via plain equality appears in a test/fixture file (${insecureCompareFile}) \u2014 likely a test assertion, not a production timing leak; verify.` : comparesDefaultSentinel ? "A supplied secret is compared with a configured default-secret sentinel using ordinary equality; verify whether this comparison belongs on a constant-time authentication path." : "A secret/HMAC/signature value appears compared with a plain equality operator instead of a constant-time comparison \u2014 potential timing side-channel.",
       evidence: evidenceForRelativeAtLine(
         repoPath,
         insecureCompareFile,
@@ -5581,8 +6365,9 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
       )
     });
   }
-  const unsortedSignFile = implFiles.find(
-    (file) => fileContains(repoPath, file, UNSORTED_JSON_SIGN_PATTERN) && !fileContains(repoPath, file, CANONICAL_SERIALIZE_PATTERN)
+  const unsortedFiles = useV39Detectors ? productionImplFiles : implFiles;
+  const unsortedSignFile = unsortedFiles.find(
+    (file) => (useV39Detectors ? fileHasVariableUnsortedJsonHmac(repoPath, file) : fileContains(repoPath, file, UNSORTED_JSON_SIGN_PATTERN)) && !fileContains(repoPath, file, CANONICAL_SERIALIZE_PATTERN)
   );
   if (unsortedSignFile) {
     const isTestPath = isTestOrFixturePath(unsortedSignFile);
@@ -5590,11 +6375,7 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
       hasSurface = true;
       insecureFound = true;
     }
-    const unsortedSignLine = findFirstMatchingLine(
-      repoPath,
-      unsortedSignFile,
-      UNSORTED_JSON_SIGN_PATTERN
-    );
+    const unsortedSignLine = useV39Detectors ? findUnsortedJsonHmacLine(repoPath, unsortedSignFile) : findFirstMatchingLine(repoPath, unsortedSignFile, UNSORTED_JSON_SIGN_PATTERN);
     findings.push({
       severity: isTestPath ? "info" : "warning",
       summary: isTestPath ? `Signing over unsorted JSON serialization appears in a test/fixture file (${unsortedSignFile}) \u2014 likely a test assertion, not a production signing gap; verify.` : "A signature/HMAC appears computed directly over JSON.stringify output with no canonical key ordering in the same file \u2014 signatures may not verify across equivalent payloads.",
@@ -5609,36 +6390,53 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
   }
   return { evidence, findings, hasSurface, clean: hasSurface && !insecureFound };
 }
-function collectA3ProdReadinessEvidence(repoPath, repoFiles) {
-  if (!isDeployableService(repoPath, repoFiles)) {
+function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors) {
+  if (!isDeployableService(repoPath, repoFiles, useV27Detectors)) {
+    const dockerApplicabilityNote = useV27Detectors ? "A Dockerfile without an explicit runtime start/service command is ambiguous and does not qualify." : "Dockerfile alone is ambiguous and does not qualify.";
     return buildNotApplicableSignal(
       "A3",
-      "No deployable-service surface detected \u2014 production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). Dockerfile alone is ambiguous and does not qualify."
+      `No deployable-service surface detected \u2014 production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). ${dockerApplicabilityNote}`
     );
   }
   const evidence = [];
   const findings = [];
   const packageJson = findRootPackageJson(repoFiles);
   const scripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
-  const workflows = repoFiles.filter(isCiWorkflow);
+  const workflows = repoFiles.filter(
+    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isCiWorkflow(file)
+  );
   const workflow = workflows[0];
-  const deployConfigs = repoFiles.filter(isDeployConfig);
-  const deployConfig = deployConfigs[0];
-  const envTemplate = repoFiles.find((file) => isEnvTemplatePath(file));
-  const healthChecks = repoFiles.filter((file) => isHealthCheckSignalFile(repoPath, file));
+  const deployConfigs = repoFiles.filter(
+    (file) => (useV27Detectors ? isAuthoredProductionPath(file) : isProductionSourcePath(file)) && isDeployConfig(file)
+  );
+  const releaseDeployConfigs = repoFiles.filter(
+    (file) => (useV27Detectors ? isAuthoredProductionPath(file) : isProductionSourcePath(file)) && isExplicitDeployTarget(file)
+  );
+  const releaseDeployConfig = releaseDeployConfigs[0];
+  const containerBuildConfig = deployConfigs.find((file) => /(^|\/)Dockerfile$/.test(file));
+  const envTemplate = repoFiles.find(
+    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isEnvTemplatePath(file)
+  );
+  const healthChecks = repoFiles.filter(
+    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isHealthCheckSignalFile(repoPath, file)
+  );
   const healthCheck = healthChecks[0];
   const errorBoundaries = repoFiles.filter(
-    (file) => /error-boundary|error\.(tsx|jsx|ts|js)$/.test(file)
+    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && /error-boundary|error\.(tsx|jsx|ts|js)$/.test(file)
   );
   const errorBoundary = errorBoundaries[0];
   const observabilityCount = countFilesContaining(
     repoPath,
-    repoFiles.filter(isImplementationFile),
+    repoFiles.filter(
+      (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isImplementationFile(file)
+    ),
     /sentry|otel|opentelemetry|datadog|prometheus|metrics|logger|logtail/i
   );
   const rollbackSafetyCount = countFilesContaining(
     repoPath,
-    repoFiles.filter((file) => /(^|\/)(docs|migrations?|drizzle|prisma|scripts)\//.test(file)),
+    repoFiles.filter(
+      (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && /(^|\/)(docs|migrations?|drizzle|prisma|scripts)\//.test(file)
+    ),
     /rollback|roll back|migration safety|down migration|reversible|undo migration/i
   );
   if (packageJson && (scripts.has("build") || scripts.has("typecheck"))) {
@@ -5647,9 +6445,23 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles) {
     );
   }
   if (workflow) evidence.push(evidenceForRelative(repoPath, workflow, "ci_run", "CI workflow"));
-  if (deployConfig)
+  if (releaseDeployConfig)
+    evidence.push(
+      evidenceForRelative(
+        repoPath,
+        releaseDeployConfig,
+        "prod_check",
+        "Release deploy configuration"
+      )
+    );
+  if (containerBuildConfig)
     evidence.push(
-      evidenceForRelative(repoPath, deployConfig, "prod_check", "Deploy configuration")
+      evidenceForRelative(
+        repoPath,
+        containerBuildConfig,
+        "prod_check",
+        "Container build configuration"
+      )
     );
   if (envTemplate)
     evidence.push(evidenceForRelative(repoPath, envTemplate, "prod_check", "Environment template"));
@@ -5660,7 +6472,8 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles) {
   if (errorBoundary)
     evidence.push(evidenceForRelative(repoPath, errorBoundary, "prod_check", "Error boundary"));
   if (evidence.length === 0) {
-    const serverEntrypoint = findServerEntrypointFile(repoPath, repoFiles);
+    const serverEntrypoint = findServerEntrypointFile(repoPath, repoFiles, useV27Detectors);
+    const runtimeContainer = useV27Detectors ? findRuntimeContainerEntrypointFile(repoPath, repoFiles) : null;
     if (serverEntrypoint) {
       evidence.push(
         evidenceForRelative(
@@ -5670,15 +6483,24 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles) {
           "Production server entrypoint"
         )
       );
+    } else if (runtimeContainer) {
+      evidence.push(
+        evidenceForRelative(
+          repoPath,
+          runtimeContainer,
+          "prod_check",
+          "Runtime container entrypoint"
+        )
+      );
     }
   }
   if (evidence.length === 0) return null;
-  if (!workflow && !deployConfig) {
+  if (!workflow && releaseDeployConfigs.length === 0) {
     const firstEvidence = evidence[0];
     if (!firstEvidence) return null;
     findings.push({
       severity: "info",
-      summary: "Production readiness signals exist, but no CI/deploy configuration was detected.",
+      summary: "A deployable service surface exists, but no CI or release-deployment automation was detected.",
       evidence: firstEvidence
     });
   }
@@ -5736,7 +6558,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles) {
     ]
   };
 }
-function collectA4DependencyEvidence(repoPath, repoFiles, mono) {
+function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors, useV47Detectors) {
   const evidence = [];
   const findings = [];
   const manifests = repoFiles.filter(isDependencyManifest);
@@ -5785,7 +6607,9 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono) {
     );
   }
   if (!manifest && !hasLockfile) return null;
-  const isAppOrService = isDeployableService(repoPath, repoFiles);
+  const packagedApplicationFiles = useV27Detectors ? findPackagedApplicationPremiseFiles(repoPath, repoFiles) : [];
+  const deployableServiceFiles = useV47Detectors ? findDeployableServicePremiseFiles(repoPath, repoFiles, true) : [];
+  const isAppOrService = (useV47Detectors ? deployableServiceFiles.length > 0 : isDeployableService(repoPath, repoFiles, useV27Detectors)) || packagedApplicationFiles.length > 0;
   if (isAppOrService && !hasLockfile && manifest) {
     findings.push({
       severity: "critical",
@@ -5793,7 +6617,7 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono) {
       evidence: evidenceForRelative(repoPath, manifest, "dependency_report", "Dependency manifest")
     });
   }
-  if (manifest && hasSuspiciousDependencies(repoPath, manifest)) {
+  if (manifest && hasSuspiciousDependencies(repoPath, manifest, useV47Detectors)) {
     findings.push({
       severity: "critical",
       summary: "Dependency manifest contains obviously suspicious placeholder dependency names.",
@@ -5875,7 +6699,7 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono) {
     positiveEvidence: evidence,
     findings,
     metrics: isAppOrService ? appMetrics : libraryMetrics,
-    notes: isAppOrService ? "A4 scored against app/service norms (deploy surface detected): pinned dependencies and a lockfile are required for reproducible installs." : "A4 scored against library/CLI norms (no deploy surface detected \u2014 same archetype line as A3): declared version ranges are correct library behavior; a committed lockfile is credited but not required."
+    notes: isAppOrService ? `A4 scored against app/service norms (${packagedApplicationFiles.length > 0 ? "packaged application" : "deploy surface"} detected): pinned dependencies and a lockfile are required for reproducible installs.` : "A4 scored against library/CLI norms (no deploy surface detected \u2014 same archetype line as A3): declared version ranges are correct library behavior; a committed lockfile is credited but not required."
   };
 }
 var LIBRARY_DEPENDENCY_COUNT_SANE_MAX = 120;
@@ -5892,15 +6716,19 @@ function hasDeclaredVersionConstraint(dependency) {
   if (/[~^<>=!]/.test(trimmed)) return true;
   return /^v?\d/.test(trimmed);
 }
-function collectA5ClaimRealityEvidence(repoPath, repoFiles) {
-  const claimDoc = repoFiles.find((file) => /(^|\/)(README|readme)\.md$/.test(file)) ?? repoFiles.find((file) => /(^|\/)docs\/.*\.(md|mdx)$/.test(file));
+function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors) {
+  const reconciliationArtifacts = useV27Detectors ? findClaimRealityReconciliationArtifacts(repoPath, repoFiles) : [];
+  const claimSourceFiles = useV27Detectors ? findClaimSourceFiles(repoFiles) : repoFiles.filter(
+    (file) => /^(?:README|readme)\.md$/.test(file) || /^docs\/[^/]+\.(?:md|mdx)$/.test(file)
+  );
+  const claimDoc = useV27Detectors ? claimSourceFiles[0] ?? reconciliationArtifacts[0] : repoFiles.find((file) => /^(?:README|readme)\.md$/.test(file)) ?? repoFiles.find((file) => /^docs\/[^/]+\.(?:md|mdx)$/.test(file)) ?? repoFiles.find((file) => /(^|\/)claim[_-]reality[_-]reconciliation\.md$/i.test(file));
   if (!claimDoc) {
     return buildNotApplicableSignal(
       "A5",
       "No README or docs found \u2014 nothing is claimed about this repo, so there is nothing for A5 to reconcile against."
     );
   }
-  const implementationFiles = repoFiles.filter(isImplementationFile);
+  const implementationFiles = findClaimImplementationFiles(repoFiles, useV27Detectors);
   if (implementationFiles.length === 0) return null;
   const implementationFile = implementationFiles[0];
   if (!implementationFile) return null;
@@ -5913,10 +6741,21 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles) {
       "Code presence for claim reconciliation"
     )
   ];
+  for (const artifact of reconciliationArtifacts.slice(0, 3)) {
+    if (artifact === claimDoc) continue;
+    evidence.push(
+      evidenceForRelative(
+        repoPath,
+        artifact,
+        "claim_reconciliation",
+        "Dedicated claim-reality reconciliation artifact"
+      )
+    );
+  }
   const firstEvidence = evidence[0];
   if (!firstEvidence) return null;
-  const allDocFiles = repoFiles.filter(
-    (file) => /^README\.md$/.test(file) || /^docs\/[^/]+\.(md|mdx)$/.test(file)
+  const allDocFiles = useV27Detectors ? claimSourceFiles : repoFiles.filter(
+    (file) => /^README\.md$/.test(file) || /^docs\/[^/]+\.(?:md|mdx)$/.test(file)
   );
   const boundedImplCount = Math.min(implementationFiles.length, 12);
   const boundedDocCount = Math.min(allDocFiles.length, 8);
@@ -5941,7 +6780,7 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles) {
   return {
     criterionId: "A5",
     positiveEvidence: evidence,
-    findings: [
+    findings: reconciliationArtifacts.length > 0 ? [] : [
       {
         // Proxy-only A5: cap at warning (never critical) — a static proxy is lower-confidence
         // than a curated registry or reconciliation artifact. Downgraded to info when the repo
@@ -5953,12 +6792,11 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles) {
       }
     ],
     // Recalibrated (goal_cejel_launch_hardening_combined_2026-07-06, Phase 3 H1):
-    // reconciliation_artifact_depth is structurally 0 for every repo on this generic-proxy
-    // path (only Alfred itself has the dedicated claim-reality artifact), so its prior 0.3
-    // weight was a permanent floor drag on every external repo regardless of how well the
-    // repo otherwise documents and backs its claims. Weight lowered to 0.15 (still a real
-    // ding for lacking the artifact) and redistributed to the two metrics that measure
-    // something a well-run external repo can actually earn; claim_source_depth's
+    // reconciliation_artifact_depth is usually 0 on the generic-proxy path, so its prior 0.3
+    // weight was a floor drag on external repos regardless of how well they otherwise document
+    // and back claims. Weight remains 0.15 (still a real ding when a content-authenticated,
+    // generically named reconciliation artifact is absent) and is redistributed to the two
+    // metrics that every well-run external repo can earn; claim_source_depth's
     // denominator lowered from 8 to 4 (README + a couple of top-level docs is already a
     // reasonably documented repo, not a fraction of an inflated 8-file bar).
     metrics: [
@@ -5984,7 +6822,7 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles) {
       metric(
         "reconciliation_artifact_depth",
         "Reconciliation artifact depth",
-        0,
+        reconciliationArtifacts.length,
         3,
         0.15,
         "artifacts",
@@ -6167,7 +7005,7 @@ function collectB4AuditEvidence(repoPath, repoFiles, generatedAt) {
     ]
   };
 }
-function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles) {
+function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detectors = false) {
   const evidence = [];
   const findings = [];
   const docFiles = repoFiles.filter((file) => /\.(md|mdx)$/i.test(file));
@@ -6190,12 +7028,13 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles) {
     (file) => fileContains(repoPath, file, SQL_EXEC_PATTERN)
   );
   const ungatedEscalationFiles = executableFiles.filter((file) => {
+    if (useV39Detectors && !fileHasExecutedPrivilegeEscalation(repoPath, file)) return false;
     const hasEscalation = fileContains(repoPath, file, ROLE_MEMBERSHIP_GRANT_PATTERN) || fileContains(repoPath, file, SUPERUSER_ESCALATION_PATTERN);
     if (!hasEscalation) return false;
     return !fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN);
   });
   const productionUngatedEscalationFiles = ungatedEscalationFiles.filter(
-    (file) => !isTestOrFixturePath(file)
+    (file) => useV39Detectors ? isV39AuthoredProductionPath(file) : !isTestOrFixturePath(file)
   );
   if (humanGateDoc) {
     evidence.push(
@@ -6237,11 +7076,10 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles) {
       )
     );
   }
-  for (const file of ungatedEscalationFiles.slice(0, 5)) {
-    const isTestPath = isTestOrFixturePath(file);
+  for (const file of productionUngatedEscalationFiles.slice(0, 5)) {
     findings.push({
-      severity: isTestPath ? "info" : "critical",
-      summary: isTestPath ? `Role-membership GRANT or SUPERUSER escalation statement in a test/fixture file (${file}) \u2014 likely a test assertion, not a production escalation; verify.` : "Role-membership GRANT or SUPERUSER escalation executes in code with no documented human gate.",
+      severity: "critical",
+      summary: "Role-membership GRANT or SUPERUSER escalation executes in code with no documented human gate.",
       evidence: evidenceForRelative(
         repoPath,
         file,
@@ -6300,7 +7138,7 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles) {
         1,
         hasPrivilegedOpsSurface ? 0.3 : 0.4,
         "clean",
-        "Penalizes code that executes a role-membership GRANT or SUPERUSER escalation with no documented human gate (test/fixture files are downgraded findings, not penalized here)."
+        "Penalizes code that executes a role-membership GRANT or SUPERUSER escalation with no documented human gate (test/fixture SQL is excluded from this production-code measurement)."
       ),
       metric(
         "protected_path_review_gate",
@@ -6320,41 +7158,70 @@ var CPP_TEST_FRAMEWORK_PATTERN = /<gtest\/gtest\.h>|<catch2\/|<doctest\/|<boost\
 var CPP_TEST_MACRO_PATTERN = /\bTEST\s*\(|\bTEST_F\s*\(|\bTEST_CASE\s*\(|\bSECTION\s*\(|\bCATCH_|BOOST_AUTO_TEST_CASE\b|BOOST_FIXTURE_TEST_CASE\b/;
 var CPP_CONTENT_SCAN_LIMIT = 150;
 var NON_PRODUCTION_DIR_PATTERN = /(^|\/)(__tests__|__mocks__|__fixtures__|tests?|fixtures?|testdata|e2e|cypress|examples?|samples?|demos?)(\/|$)/i;
-var NON_PRODUCTION_FILE_SUFFIX_PATTERN = /\.(test|spec|stories)\.[^/]+$/i;
+var NON_PRODUCTION_FILE_SUFFIX_PATTERN = /\.(test|spec|stories)\.[^/]+$|_test\.go$|(^|\/)test_.*\.py$/i;
 function isTestOrFixturePath(path) {
   return NON_PRODUCTION_DIR_PATTERN.test(path) || NON_PRODUCTION_FILE_SUFFIX_PATTERN.test(path);
 }
 function isProductionSourcePath(path) {
   return !isTestOrFixturePath(path);
 }
-function isTestFile(file) {
-  return /(^|\/)(__tests__|test|tests|spec)\/.*\.(?:[cm]?[jt]sx?|py|go|rs|java|rb|cpp|cc|cxx)$/.test(
-    file
-  ) || // AVA's default discovery includes test.js and test-*.js at the scanned package root.
+function isAuthoredProductionPath(path) {
+  return isProductionSourcePath(path) && !GENERATED_OR_VENDOR_PATH_PATTERN.test(path);
+}
+var V39_NON_PRODUCTION_CREDENTIAL_PATH_PATTERN = /(^|\/)(?:docs?|documentation|e2e[-_]?tests?)(\/|$)|(^|\/)(?:test|tests)[._-][^/]+$|(^|\/)[^/]*(?:appium|e2e[-_]?tests?)[^/]*$/i;
+function isV39AuthoredProductionPath(path) {
+  return isAuthoredProductionPath(path) && !V39_NON_PRODUCTION_CREDENTIAL_PATH_PATTERN.test(path);
+}
+var V47_NON_PRODUCTION_CREDENTIAL_PATH_PATTERN = /(^|\/)(?:auto[-_]?gen(?:erated)?|generated|i18n|locales?|cookbooks?|lessons?)(\/|$)|\.(?:md|mdx|rst|adoc)$/i;
+function isV47AuthoredProductionPath(path) {
+  return isV39AuthoredProductionPath(path) && !V47_NON_PRODUCTION_CREDENTIAL_PATH_PATTERN.test(path);
+}
+var TEST_DIRECTORY_SOURCE_PATTERN = new RegExp(
+  `(^|/)(?:__tests__|tests?|specs?|[^/]+(?:Tests|Specs))/(?:.*\\.)?(?:${SOURCE_LANGUAGES.flatMap((language) => language.extensions).join("|")})$`
+);
+var TEST_DIRECTORY_SOURCE_PATTERN_V17 = new RegExp(
+  `(^|/)(?:__tests__|tests?|specs?|[^/]+(?:Tests|Specs))/(?:.*\\.)?(?:${[
+    ...SOURCE_LANGUAGES_V10.flatMap((language) => language.extensions),
+    "bats"
+  ].join("|")})$`,
+  "i"
+);
+function isTestFile(file, rubricVersion = WITAN_RUBRIC_VERSION) {
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 && (TEST_DIRECTORY_SOURCE_PATTERN_V17.test(file) || /\.tftest\.hcl$/i.test(file) || /\.bats$/i.test(file) || /(^|\/)test[^/]*\.m$/i.test(file) || /_test\.m$/i.test(file)) || TEST_DIRECTORY_SOURCE_PATTERN.test(file) || // AVA's default discovery includes test.js and test-*.js at the scanned package root.
   // Keep this root-anchored: nested files need an existing test-directory/suffix convention.
   /^test(?:-[^/]+)?\.[cm]?[jt]sx?$/.test(file) || /\.(test|spec)\.[cm]?[jt]sx?$/.test(file) || /(^|\/)test_.*\.py$/.test(file) || /_test\.go$/.test(file) || /(^|\/)test_.*\.(cpp|cc|cxx)$/.test(file) || /_(test|tests)\.(cpp|cc|cxx)$/.test(file) || /Tests?\.(java|kt)$/.test(file) || /(_test|_spec)\.(rs|rb|php|swift|kt)$/.test(file);
 }
 var NAME_SHAPED_TEST_FILE_PATTERN = /^test(?:-[^/]+)?\.[cm]?[jt]sx?$|\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)__tests__\/|(^|\/)test_[^/]*\.py$|(^|\/)tests?\.py$|_test\.go$|(^|\/)test_[^/]*\.(cpp|cc|cxx)$|_(test|tests)\.(cpp|cc|cxx)$|Tests?\.(java|kt)$|(_test|_spec)\.(rs|rb|php|swift|kt)$/;
-var TEST_RUNNER_PATTERN = /\b(vitest|jest|mocha|ava|tap|pytest|go test|cargo test|rspec|phpunit|gradle test|mvn test)\b/i;
-var CI_TEST_COMMAND_PATTERN = /\b(pytest|go\s+test|cargo\s+test|mvn\s+test|gradle\s+test|ctest|make\s+test|jest|vitest|mocha|rspec|phpunit|pnpm\s+test|npm\s+test|yarn\s+test|node\s+--test|node:test)\b/i;
+var NAME_SHAPED_TEST_FILE_PATTERN_V17 = /\.tftest\.hcl$|\.bats$|(^|\/)test[^/]*\.m$|_test\.m$/i;
+var TEST_RUNNER_PATTERN = /\b(vitest|jest|mocha|ava|tap|pytest|go test|cargo test|rspec|phpunit|gradle test|mvn test|node\s+--test|node:test)\b/i;
+var CI_TEST_COMMAND_PATTERN = /\b(pytest|go\s+test|cargo\s+test|mvn\s+test|gradle\s+test|dotnet\s+test|ctest|make\s+test|jest|vitest|mocha|rspec|phpunit|pnpm\s+(?:run\s+)?test|npm\s+(?:run\s+)?test|yarn\s+(?:run\s+)?test|node\s+--test|node:test)\b|--target[=\s]+test\b/i;
 var CI_LINT_COMMAND_PATTERN = /\b(eslint|pylint|flake8|black|ruff)\b/i;
 var CI_TYPECHECK_COMMAND_PATTERN = /\b(tsc|mypy|pyright)\b/i;
 var SCHEDULE_TRIGGER_PATTERN = /(^|\n)\s*schedule:\s*\r?\n\s*-\s*cron:/;
 var PUBLISHED_RESULT_MARKER_PATTERN = /actions\/deploy-pages|actions\/upload-pages-artifact|peaceiris\/actions-gh-pages|git\s+push\b|create-or-update-comment/i;
 var EPHEMERAL_ARTIFACT_ONLY_PATTERN = /actions\/upload-artifact/i;
+var SCHEDULED_HEALTH_PATH_PATTERN = /(?:health|smoke|monitor|status|uptime|canary)/i;
+var SCHEDULED_HEALTH_INTENT_PATTERN = /\b(?:product[- ]?health|health check|smoke test|monitor(?:ing)?|uptime|canary|fault detection)\b/i;
 var RLS_PATTERN = /row level security|enable rls|create policy|tenant[_-]?id|studio[_-]?id/i;
 var DB_CLIENT_PATTERN = /\b(pg|mysql|mysql2|sqlite3|mongodb|mongoose|sequelize|drizzle|prisma|knex|typeorm|redis|ioredis|better-sqlite3|asyncpg|psycopg2?|sqlalchemy|pymongo|aiosqlite|database\/sql|gorm|sqlx|diesel|rusqlite|ActiveRecord|Sequel|PDO|JDBC|Hibernate)\b/i;
 var ENV_READ_PATTERN = /process\.env\b|Deno\.env\b|os\.environ\b|getenv\s*\(|std::env::|ENV\[/;
 var TENANT_SCOPE_PATTERN = /tenantId|tenant_id|studioId|studio_id|organizationId|org_id|workspaceId/i;
+var TENANT_SCOPE_PATTERN_V10 = /tenantId|tenant_id|studioId|studio_id|organizationId|organization_id|org_id|accountTenantId|account_tenant_id/i;
+var TENANT_SCOPE_PATTERN_V11 = /tenantId|tenant_id|accountTenantId|account_tenant_id/i;
 var HUMAN_GATE_MARKER_PATTERN = /human[- ]executed|human[- ]gated|operator[- ]run|never agent-run|agents? (?:never|does not|do not) (?:hold|execute|run) (?:prod(?:uction)?\s+)?(?:admin|db) (?:credential|privilege)/i;
 var ROLE_MEMBERSHIP_GRANT_PATTERN = /\bGRANT\s+(?!SELECT\b|INSERT\b|UPDATE\b|DELETE\b|USAGE\b|ALL\b|EXECUTE\b|TRIGGER\b|REFERENCES\b|CREATE\b|CONNECT\b|TEMP(?:ORARY)?\b)[A-Za-z_]\w*\s+TO\b/i;
 var SUPERUSER_ESCALATION_PATTERN = /\b(ALTER|CREATE)\s+(ROLE|USER)\s+\w+[^;]*\bSUPERUSER\b/i;
 var SQL_EXEC_PATTERN = /\.execute\s*\(|sql\.raw\s*\(/;
+var EXECUTED_ESCALATION_LITERAL_PATTERN = /(?:\.execute|sql\.raw)\s*\(\s*(?:[rubf]+)?["'`][^"'`]{0,500}(?:GRANT\s+(?!SELECT\b|INSERT\b|UPDATE\b|DELETE\b|USAGE\b|ALL\b|EXECUTE\b|TRIGGER\b|REFERENCES\b|CREATE\b|CONNECT\b|TEMP(?:ORARY)?\b)[A-Za-z_]\w*\s+TO\b|(?:ALTER|CREATE)\s+(?:ROLE|USER)\s+\w+[^;]*\bSUPERUSER\b)/i;
+function fileHasExecutedPrivilegeEscalation(repoPath, file) {
+  return fileContains(repoPath, file, EXECUTED_ESCALATION_LITERAL_PATTERN);
+}
 var GATED_PRIVILEGE_CHECK_PATTERN = /pg_has_role\s*\(|has_role\s*\(|is not a member of/i;
 var SET_ROLE_PATTERN = /\bset\s+(local\s+)?role\b/i;
 var REQUIRED_REVIEW_PATTERN = /required review|branch protection|protected branch/i;
 var HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT = 5e3;
-var SECRET_ASSIGNMENT_PATTERN = /[A-Za-z0-9_]*(?:secret|token|api[_-]?key|password|access[_-]?key)[A-Za-z0-9_]*\s*[:=]\s*['"]?([^'"\s]+)/gi;
+var SECRET_IDENTIFIER_KEYWORD_PATTERN = /secret|token|api[_-]?key|password|access[_-]?key/gi;
+var SINGLE_WHITESPACE_PATTERN = /\s/u;
 var SECRET_VALUE_BRANDED_PATTERN = /^(?:sk-[A-Za-z0-9_-]{24,}|sk-ant-api\d{2}-[A-Za-z0-9_-]{80,}|ghp_[A-Za-z0-9_]{30,}|xox[baprs]-[A-Za-z0-9-]{24,}|AKIA[0-9A-Z]{16}|vcp_[A-Za-z0-9_:-]{24,})$/;
 var GENERIC_SECRET_SHAPE_PATTERN = /^[A-Za-z0-9/+_-]{40,}$/;
 var KNOWN_HEX_DIGEST_LENGTHS = /* @__PURE__ */ new Set([32, 40, 64, 128]);
@@ -6363,23 +7230,25 @@ var NEGATIVE_SPACE_SECTION_PATTERN = /^#{1,6}\s*(?:security\s+)?(?:limitations?|
 var NEGATIVE_SPACE_PHRASE_PATTERN = /does not (?:protect|defend|guard|cover)s? against|not (?:covered|protected|defended) by this|out of scope for this (?:library|package|tool|sdk|project)/i;
 var LEAN_TEST_RUNNER_SCRIPT_PATTERN = /\bnode\s+(?:--test\b|--experimental-test-coverage\b)/;
 var LEAN_TEST_RUNNER_IMPORT_PATTERN = /from\s+['"]node:test['"]|require\(\s*['"]node:test['"]\s*\)/;
-var HEAVY_TEST_DEPENDENCY_NAME_PATTERN = /^(?:jest|mocha|ava|tape|jasmine|karma)(?:$|-|\/)/i;
+var HEAVY_TEST_DEPENDENCY_NAME_PATTERN = /^(?:(?:jest|mocha|ava|tape|jasmine|karma|vitest|cypress|playwright)(?:$|-|\/)|@(?:vitest|playwright)\/)/i;
 var TIMING_SAFE_COMPARE_PATTERN = /\btiming[-_]?safe[-_]?(?:equal|compare)\b|crypto\.timingSafeEqual\s*\(/i;
 var CANONICAL_SERIALIZE_PATTERN = /\bcanonicalize\s*\(|\bcanonicalJson\b|\bstableStringify\s*\(|json-stable-stringify|safe-stable-stringify|\bsortKeys\s*\(/i;
 var SIGN_OR_HMAC_CALL_PATTERN = /\bcreateHmac\s*\(|\bcreateSign\s*\(|\.sign\s*\(/;
 var INSECURE_SECRET_COMPARE_LINE_PATTERN = /\b\w*(?:hmac|signature|\bmac|digest)\w*\s*(===|!==)\s*(?!['"`]|undefined\b|null\b)([\w.]+(?:\s*[-+]\s*\d+)?)/i;
+var DEFAULT_SECRET_SENTINEL_COMPARE_LINE_PATTERN = /\b(?:secret|token|password|apiKey)\w*\s*(?:===|!==|==|!=)\s*[\w.]*default(?:Secret|Token|Password|ApiKey)\b/i;
 var NUMERIC_SHAPED_OPERAND_PATTERN = /^-?\d+$|\.(?:length|len|size|count)\b|(?:length|index|idx|offset|count|size|len)$/i;
-function lineHasInsecureSecretCompare(line) {
+function lineHasInsecureSecretCompare(line, useV39Detectors = false) {
+  if (useV39Detectors && DEFAULT_SECRET_SENTINEL_COMPARE_LINE_PATTERN.test(line)) return true;
   const match = INSECURE_SECRET_COMPARE_LINE_PATTERN.exec(line);
   const operand = match?.[2];
   if (!operand) return false;
   return !NUMERIC_SHAPED_OPERAND_PATTERN.test(operand.trim());
 }
-function findInsecureSecretCompareLine(repoPath, file) {
+function findInsecureSecretCompareLine(repoPath, file, useV39Detectors = false) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return null;
   const lines = readFileSync(fullPath, "utf8").split("\n");
-  const index = lines.findIndex((line) => lineHasInsecureSecretCompare(line));
+  const index = lines.findIndex((line) => lineHasInsecureSecretCompare(line, useV39Detectors));
   return index === -1 ? null : index + 1;
 }
 function findFirstMatchingLine(repoPath, file, pattern) {
@@ -6389,7 +7258,49 @@ function findFirstMatchingLine(repoPath, file, pattern) {
   const index = lines.findIndex((line) => pattern.test(line));
   return index === -1 ? null : index + 1;
 }
+function lineAt(repoPath, file, line) {
+  if (line < 1) return null;
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return null;
+  return readFileSync(fullPath, "utf8").split("\n")[line - 1] ?? null;
+}
 var UNSORTED_JSON_SIGN_PATTERN = /\.update\s*\(\s*JSON\.stringify\s*\(|\.sign\s*\([^)]*JSON\.stringify\s*\(/;
+var UNSORTED_JSON_DIRECT_SIGN_PATTERN = /\.sign\s*\([^)]*JSON\.stringify\s*\(/;
+var UNSORTED_JSON_CONSTRUCTOR_UPDATE_PATTERN = /\bcreate(?:Hmac|Sign)\s*\([^;\n]{0,256}\)\s*\.update\s*\(\s*JSON\.stringify\s*\(/;
+var JSON_STRINGIFY_ASSIGNMENT_PATTERN = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*JSON\.stringify\s*\(/g;
+function findUnsortedJsonHmacLine(repoPath, file) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return null;
+  const contents = readFileSync(fullPath, "utf8");
+  const directSign = findFirstMatchingLine(repoPath, file, UNSORTED_JSON_DIRECT_SIGN_PATTERN);
+  if (directSign !== null) return directSign;
+  const directConstructorUpdate = findFirstMatchingLine(
+    repoPath,
+    file,
+    UNSORTED_JSON_CONSTRUCTOR_UPDATE_PATTERN
+  );
+  if (directConstructorUpdate !== null) return directConstructorUpdate;
+  JSON_STRINGIFY_ASSIGNMENT_PATTERN.lastIndex = 0;
+  let match = JSON_STRINGIFY_ASSIGNMENT_PATTERN.exec(contents);
+  while (match !== null) {
+    const identifier = match[1];
+    if (identifier) {
+      const escaped = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const constructorUpdate = new RegExp(
+        `\\bcreate(?:Hmac|Sign)\\s*\\([^;\\n]{0,256}\\)\\s*\\.update\\s*\\(\\s*${escaped}\\b`
+      );
+      const usageWindow = contents.slice(match.index, match.index + 2048);
+      if (constructorUpdate.test(usageWindow)) {
+        return contents.slice(0, match.index).split("\n").length;
+      }
+    }
+    match = JSON_STRINGIFY_ASSIGNMENT_PATTERN.exec(contents);
+  }
+  return null;
+}
+function fileHasVariableUnsortedJsonHmac(repoPath, file) {
+  return findUnsortedJsonHmacLine(repoPath, file) !== null;
+}
 var KILL_SWITCH_NAME_FRAGMENT = "kill[_-]?switch|emergency[_-]?stop|circuit[_-]?breaker|safety[_-]?(?:toggle|gate|switch)|governance[_-]?(?:toggle|gate)";
 var KILL_SWITCH_NAME_PATTERN = new RegExp(`\\b(?:${KILL_SWITCH_NAME_FRAGMENT})\\b`, "i");
 var KILL_SWITCH_FAIL_CLOSED_PATTERN = new RegExp(
@@ -6434,19 +7345,23 @@ function looksLikeSecretValue(value) {
   return SECRET_VALUE_BRANDED_PATTERN.test(value) || isGenericSecretValue(value);
 }
 var PLACEHOLDER_SECRET_PATTERN = /(?:^|[-_])(?:your|example|sample|placeholder|dummy|changeme|replace(?:-?me)?|redacted)(?:$|[-_])|^x{3,}$|^\.\.\.|^\$\{[^}]+}$|^<[^>]+>$/i;
-var ENV_TEMPLATE_PATTERN = /(^|\/)\.env\.(example|sample|template|dist)$/;
-function isEnvTemplatePath(path) {
-  return ENV_TEMPLATE_PATTERN.test(path);
+var ENV_TEMPLATE_PATTERN = /(^|\/)\.env(?:\.[^/]+)*\.(?:example|sample|template|dist)$/i;
+var ENV_TEMPLATE_PATTERN_V47 = /(^|\/)\.env(?:\.[^/]+)*\.(?:example|sample|template|dist|exemplo|ejemplo|exemple|esempio|beispiel|voorbeeld)$/i;
+function isEnvTemplatePath(path, useV47Detectors = false) {
+  return (useV47Detectors ? ENV_TEMPLATE_PATTERN_V47 : ENV_TEMPLATE_PATTERN).test(path);
 }
 var HARD_EXCLUDED_PATH_PATTERN = /(^|\/)(?:\.git|\.venv|venv|site-packages|node_modules|dist|build|\.next|__pycache__|vendor|\.terraform|coverage)(?:\/|$)/;
 var COVERAGE_PERCENT_PATTERN = /(?:statements|branches|lines|functions|fail_under)\s*[:=]\s*["']?(\d+(?:\.\d+)?)/gi;
 function listRepoFiles(repoPath) {
-  const gitFiles = listGitTrackedFiles(repoPath);
+  const gitFiles = listGitTrackedFiles(repoPath, false);
   if (gitFiles) return gitFiles;
   const files = [];
   visitRepoDir(repoPath, repoPath, files);
   return files.filter((file) => !isHardExcludedPath(file)).sort();
 }
+function listRepoInventory(repoPath, fallbackFiles) {
+  return listGitTrackedFiles(repoPath, true) ?? [...fallbackFiles];
+}
 function resolveMonorepoContext(repoPath) {
   let top;
   try {
@@ -6479,7 +7394,7 @@ function resolveMonorepoContext(repoPath) {
   if (sharedFiles.length === 0) return null;
   return { root: rootResolved, sharedFiles };
 }
-function listGitTrackedFiles(repoPath) {
+function listGitTrackedFiles(repoPath, includeHardExcluded = false) {
   try {
     execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
       cwd: repoPath,
@@ -6493,7 +7408,7 @@ function listGitTrackedFiles(repoPath) {
     }).trim();
     if (!output) return [];
     return output.split("\n").filter(
-      (file) => file.length > 0 && !isHardExcludedPath(file) && isRegularFile(join(repoPath, file))
+      (file) => file.length > 0 && (includeHardExcluded || !isHardExcludedPath(file)) && isRegularFile(join(repoPath, file))
     ).sort();
   } catch {
     return null;
@@ -6563,7 +7478,7 @@ var JS_TEST_ASSERTION_PATTERN = /(expect\(|assert\.|should\.|toEqual\(|toBe\(|as
 var CPP_TEST_ASSERTION_PATTERN = /\bEXPECT_|ASSERT_EQ\b|ASSERT_TRUE\b|ASSERT_FALSE\b|\bREQUIRE\s*\(|\bCHECK\s*\(|\bTEST\s*\(|\bTEST_F\s*\(|\bTEST_CASE\s*\(|\bSECTION\s*\(/;
 var MULTI_ECOSYSTEM_TEST_ASSERTION_PATTERN = /\.assert[A-Z_]\w*\s*\(|\bassert[A-Z]\w*\s*\(|\bpytest\.raises\b|\bself\.fail\s*\(|\bt\.(?:Error|Errorf|Fatal|Fatalf|Fail|FailNow)\b|\brequire\.[A-Z]\w*\s*\(|\b(?:debug_)?assert(?:_eq|_ne)?!\s*\(|\bassert_\w+\b|\$this->assert\w+\s*\(/;
 var SUITE_LEVEL_SKIP_PATTERN = /\b(?:describe|suite|context)\.skip\s*\(/;
-function measureNonHollowTestShare(repoPath, files) {
+function measureNonHollowTestShare(repoPath, files, useV17Detectors = false) {
   let nonHollowCount = 0;
   let ratedCount = 0;
   for (const file of files) {
@@ -6574,7 +7489,7 @@ function measureNonHollowTestShare(repoPath, files) {
     if (nonHollow) {
       nonHollowCount += 1;
       ratedCount += 1;
-    } else if (NAME_SHAPED_TEST_FILE_PATTERN.test(file)) {
+    } else if (NAME_SHAPED_TEST_FILE_PATTERN.test(file) || useV17Detectors && NAME_SHAPED_TEST_FILE_PATTERN_V17.test(file)) {
       ratedCount += 1;
     }
   }
@@ -6898,43 +7813,639 @@ function parseJsonObject(contents) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isTestRunnerConfig(file) {
-  return /(^|\/)(vitest|jest|pytest|playwright|cypress|mocha)\.config\.[cm]?[jt]s$/.test(file) || /(^|\/)(pytest\.ini|tox\.ini|go\.mod|Cargo\.toml)$/.test(file) || /(^|\/)CMakeLists\.txt$/.test(file) || /(^|\/)Makefile$/.test(file) || /(^|\/)phpunit\.xml(\.dist)?$/.test(file);
+function isTestRunnerConfig(repoPath, file) {
+  return /(^|\/)(vitest|jest|pytest|playwright|cypress|mocha)\.config\.[cm]?[jt]s$/.test(file) || /(^|\/)(pytest\.ini|tox\.ini)$/.test(file) || /(^|\/)phpunit\.xml(\.dist)?$/.test(file) || /(^|\/)pyproject\.toml$/.test(file) && fileContains(repoPath, file, /^\[tool\.pytest(?:\.|\])/m) || /(^|\/)CMakeLists\.txt$/.test(file) && fileContains(repoPath, file, /\b(?:enable_testing|add_test|ctest_add_tests)\s*\(/i) || /(^|\/)Makefile$/.test(file) && fileContains(repoPath, file, /^\s*(?:test|tests|check)\s*:/m);
+}
+function findCoverageConfigFiles(repoPath, repoFiles, authoredOnly = false) {
+  return repoFiles.filter(
+    (file) => (!authoredOnly || isAuthoredProductionPath(file)) && isCoverageConfig(repoPath, file)
+  );
+}
+function findConcreteTestFiles(repoPath, repoFiles, rubricVersion = WITAN_RUBRIC_VERSION) {
+  const contentCppTests = collectContentBasedCppTestFiles(repoPath, repoFiles);
+  return [
+    ...repoFiles.filter((file) => isTestFile(file, rubricVersion)),
+    ...contentCppTests.filter((file) => !isTestFile(file, rubricVersion))
+  ];
+}
+function findConfiguredTestRunnerFiles(repoPath, repoFiles) {
+  const configured = repoFiles.filter(
+    (file) => isAuthoredProductionPath(file) && isTestRunnerConfig(repoPath, file)
+  );
+  for (const packageJson of repoFiles.filter(
+    (file) => /(^|\/)package\.json$/.test(file) && isAuthoredProductionPath(file)
+  )) {
+    if ([...readPackageScripts(join(repoPath, packageJson)).values()].some(
+      (script) => TEST_RUNNER_PATTERN.test(script)
+    )) {
+      configured.push(packageJson);
+    }
+  }
+  configured.push(
+    ...repoFiles.filter((file) => isAuthoredProductionPath(file) && isCiWorkflow(file)).filter((file) => fileContains(repoPath, file, CI_TEST_COMMAND_PATTERN))
+  );
+  return [...new Set(configured)].sort();
+}
+function findTenantStoragePremiseFiles(repoPath, repoFiles) {
+  return repoFiles.filter((file) => /(^|\/)(?:migrations?|drizzle|prisma)\/|\.(?:sql|prisma)$/i.test(file)).filter((file) => fileContains(repoPath, file, TENANT_SCOPE_PATTERN_V11));
+}
+function findRlsPolicyFiles(repoPath, repoFiles) {
+  return repoFiles.filter((file) => /(^|\/)(?:migrations?|drizzle|prisma)\/|\.(?:sql|prisma)$/i.test(file)).filter(
+    (file) => fileContains(
+      repoPath,
+      file,
+      /\b(?:create\s+policy|enable\s+row\s+level\s+security|force\s+row\s+level\s+security)\b/i
+    )
+  );
+}
+function findDeployableServicePremiseFiles(repoPath, repoFiles, strictOperationalBoundary = false) {
+  const explicitTargets = repoFiles.filter(
+    (file) => isAuthoredProductionPath(file) && isExplicitDeployTarget(file) && (!strictOperationalBoundary || isV47OperationalApplicationPath(file))
+  );
+  const deployWorkflows = repoFiles.filter((file) => isAuthoredProductionPath(file) && isCiWorkflow(file)).filter((file) => fileContains(repoPath, file, CI_DEPLOY_JOB_PATTERN)).filter(
+    (file) => !strictOperationalBoundary || !isDocumentationOnlyDeployWorkflow(repoPath, file)
+  );
+  const serverEntrypoint = findServerEntrypointFile(repoPath, repoFiles, true);
+  const runtimeContainer = findRuntimeContainerEntrypointFile(repoPath, repoFiles);
+  if (strictOperationalBoundary) {
+    const runtimeFiles = [serverEntrypoint, runtimeContainer].filter(
+      (file) => file != null && isV47OperationalApplicationPath(file)
+    );
+    const directApplicationTargets = explicitTargets.filter(
+      (file) => !isInfrastructureOnlyDeployTarget(file)
+    );
+    const infrastructureTargets = runtimeFiles.length > 0 ? [...explicitTargets.filter(isInfrastructureOnlyDeployTarget), ...deployWorkflows] : [];
+    return [...directApplicationTargets, ...runtimeFiles, ...infrastructureTargets];
+  }
+  return [
+    ...explicitTargets,
+    ...deployWorkflows,
+    ...serverEntrypoint && (!strictOperationalBoundary || isV47OperationalApplicationPath(serverEntrypoint)) ? [serverEntrypoint] : [],
+    ...runtimeContainer && (!strictOperationalBoundary || isV47OperationalApplicationPath(runtimeContainer)) ? [runtimeContainer] : []
+  ];
+}
+function isInfrastructureOnlyDeployTarget(file) {
+  return /(^|\/)docker-compose\.ya?ml$/i.test(file) || /(^|\/)(?:k8s|kubernetes|manifests?)\/.+\.ya?ml$/i.test(file) || /(^|\/)(?:charts?|helm)\/.+\.ya?ml$/i.test(file);
+}
+var V47_NON_OPERATIONAL_APPLICATION_PATH_PATTERN = /(^|\/)(?:cookbooks?|lessons?|tutorials?|docs?|documentation|examples?|samples?|demos?)(\/|$)/i;
+function isV47OperationalApplicationPath(path) {
+  return !V47_NON_OPERATIONAL_APPLICATION_PATH_PATTERN.test(path);
+}
+function isDocumentationOnlyDeployWorkflow(repoPath, file) {
+  if (/(?:docs?|pages?)/i.test(basename(file))) return true;
+  return fileContains(
+    repoPath,
+    file,
+    /\b(?:deploy[-_ ]?docs?|mkdocs|docusaurus|vitepress|gh-pages|github pages)\b/i
+  );
+}
+function findPackagedApplicationPremiseFiles(repoPath, repoFiles) {
+  return repoFiles.filter((file) => /(^|\/)package\.json$/.test(file) && isAuthoredProductionPath(file)).filter((file) => packageJsonDescribesPackagedApplication(repoPath, file, repoFiles));
+}
+function findClaimSourceFiles(repoFiles) {
+  return repoFiles.filter(
+    (file) => /^(?:README|readme)\.md$/.test(file) || /^docs\/[^/]+\.(?:md|mdx)$/.test(file)
+  ).sort((left, right) => {
+    const leftRootReadme = /^(?:README|readme)\.md$/.test(left);
+    const rightRootReadme = /^(?:README|readme)\.md$/.test(right);
+    return Number(rightRootReadme) - Number(leftRootReadme) || left.localeCompare(right);
+  });
+}
+function findClaimImplementationFiles(repoFiles, authoredOnly = false) {
+  return repoFiles.filter(
+    (file) => isImplementationFile(file) && (!authoredOnly || isAuthoredProductionPath(file))
+  );
+}
+function findClaimRealityReconciliationArtifacts(repoPath, repoFiles) {
+  return repoFiles.filter((file) => /(^|\/)claim[-_]reality[-_]reconciliation\.(?:md|mdx|json)$/i.test(file)).filter((file) => isAuthenticatedClaimRealityArtifact(repoPath, file));
+}
+function isAuthenticatedClaimRealityArtifact(repoPath, file) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return false;
+  const contents = readFileSync(fullPath, "utf8");
+  if (/\.json$/i.test(file)) {
+    return parseJsonObject(contents)?.artifactKind === "claim_reality_reconciliation";
+  }
+  let inFence = false;
+  for (const line of contents.split(/\r?\n/)) {
+    if (/^\s*(?:```|~~~)/.test(line)) {
+      inFence = !inFence;
+      continue;
+    }
+    if (!inFence && /^#\s+Claim Reality Reconciliation\s*$/i.test(line)) return true;
+  }
+  return false;
+}
+function isCoverageConfig(repoPath, file) {
+  if (/(^|\/)(nyc|c8|coverage|codecov)\.(json|yml|yaml)$/.test(file) || /(^|\/)\.coveragerc$/.test(file) || /(^|\/)lcov\.info$/.test(file) || /(^|\/)\.coveralls\.yml$/.test(file)) {
+    return true;
+  }
+  if (/(^|\/)vitest\.config\.[cm]?[jt]s$/.test(file)) {
+    return fileContains(repoPath, file, /\bcoverage\s*:/i);
+  }
+  if (/(^|\/)jest\.config\.[cm]?[jt]s$/.test(file)) {
+    return fileContains(
+      repoPath,
+      file,
+      /\b(?:collectCoverage|coverageThreshold|coverageProvider|coverageDirectory)\s*:/
+    );
+  }
+  if (/(^|\/)pyproject\.toml$/.test(file)) {
+    return fileContains(repoPath, file, /^\[tool\.coverage(?:\.|\])/m);
+  }
+  if (/(^|\/)package\.json$/.test(file)) {
+    return packageJsonHasCoverageTooling(repoPath, file);
+  }
+  return false;
+}
+function packageJsonHasCoverageTooling(repoPath, file) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return false;
+  const parsed = parseJsonObject(readFileSync(fullPath, "utf8"));
+  if (!parsed) return false;
+  const scripts = parsed.scripts;
+  if (typeof scripts === "object" && scripts !== null && !Array.isArray(scripts)) {
+    for (const command of Object.values(scripts)) {
+      if (typeof command === "string" && commandInvokesCoverageTool(command)) {
+        return true;
+      }
+    }
+  }
+  for (const key of ["nyc", "c8", "istanbul"]) {
+    const config = parsed[key];
+    if (typeof config === "object" && config !== null && !Array.isArray(config)) return true;
+  }
+  return false;
 }
-function isCoverageConfig(file) {
-  return /(^|\/)(nyc|c8|coverage|codecov)\.(json|yml|yaml)$/.test(file) || /(^|\/)\.coveragerc$/.test(file) || /(^|\/)lcov\.info$/.test(file) || /(^|\/)\.coveralls\.yml$/.test(file) || fileContainsExtension(file, ["vitest.config.ts", "jest.config.js", "pyproject.toml"]);
+function commandInvokesCoverageTool(command) {
+  return normalizedCommandInvokesCoverageTool(normalizeCoverageCommandPrefixes(command), 0);
 }
-function fileContainsExtension(file, names) {
-  return names.some((name) => file.endsWith(name));
+function normalizedCommandInvokesCoverageTool(normalized, depth) {
+  const segments = normalized.splitShellOperators ? splitShellCommandSegments(normalized.segment) : [normalized.segment];
+  return segments.some((rawSegment) => {
+    const candidate = normalizeCoverageCommandPrefixes(rawSegment);
+    if (/^(?:nyc|c8|istanbul)(?:\s|$)/iu.test(candidate.segment)) return true;
+    return depth < 4 && candidate.splitShellOperators && candidate.segment !== rawSegment.trim() && normalizedCommandInvokesCoverageTool(candidate, depth + 1);
+  });
+}
+function splitShellCommandSegments(command) {
+  const segments = [];
+  let start = 0;
+  let quote = null;
+  let escaped = false;
+  for (let index = 0; index < command.length; index += 1) {
+    const character = command[index];
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (character === "\\" && quote !== "'") {
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      if (character === quote) quote = null;
+      continue;
+    }
+    if (character === "'" || character === '"') {
+      quote = character;
+      continue;
+    }
+    if (character === "#" && (index === 0 || /[\s;|&()]/u.test(command[index - 1] ?? ""))) {
+      segments.push(command.slice(start, index));
+      const newline = command.indexOf("\n", index + 1);
+      if (newline < 0) return segments;
+      index = newline;
+      start = newline + 1;
+      continue;
+    }
+    const isBoundary = character === ";" || character === "|" || character === "&" || character === "\n";
+    if (!isBoundary) continue;
+    segments.push(command.slice(start, index));
+    if ((character === "|" || character === "&") && command[index + 1] === character) index += 1;
+    start = index + 1;
+  }
+  segments.push(command.slice(start));
+  return segments;
+}
+function normalizeCoverageCommandPrefixes(rawSegment) {
+  let segment = rawSegment.trim();
+  let unwrapQuotedShellCommand = false;
+  let splitShellOperators = true;
+  for (let index = 0; index < 8; index += 1) {
+    const before = segment;
+    segment = stripOuterShellGroup(segment);
+    segment = segment.replace(/^(?:[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|[^\s]+)\s+)*/u, "");
+    segment = segment.replace(
+      /^(?:npx|npm\s+exec|pnpm\s+(?:exec|dlx)|yarn\s+(?:exec|dlx))(?:\s+--(?:no-install|yes))*(?:\s+--)?\s+/iu,
+      ""
+    );
+    segment = segment.replace(/^(?:command(?:\s+-p)?(?:\s+--)?|time(?:\s+-p)?)\s+/iu, "");
+    const explicitShellCommand = extractExplicitShellCommand(segment);
+    if (explicitShellCommand !== null) {
+      segment = explicitShellCommand;
+      unwrapQuotedShellCommand = false;
+      splitShellOperators = true;
+    }
+    const environmentPrefix = stripEnvironmentCommandPrefix(segment);
+    segment = environmentPrefix.segment;
+    unwrapQuotedShellCommand ||= environmentPrefix.unwrapQuotedShellCommand;
+    if (environmentPrefix.splitShellOperators !== null) {
+      splitShellOperators = environmentPrefix.splitShellOperators;
+    }
+    if (segment === before) break;
+  }
+  return {
+    segment: unwrapQuotedShellCommand ? segment.replace(/^(["'])(.*)\1$/u, "$2").trim() : segment,
+    splitShellOperators
+  };
+}
+function extractExplicitShellCommand(segment) {
+  const shellExecutable = /^(?:(?:\/(?:usr\/)?bin\/)?(?<shell>(?:ba|da|k|z)?sh))(?=\s|$)/iu.exec(
+    segment
+  );
+  if (!shellExecutable) return null;
+  const shell = shellExecutable.groups?.shell?.toLowerCase();
+  if (!shell) return null;
+  let offset = shellExecutable[0].length;
+  let noExecute = false;
+  let dumpStrings = false;
+  for (let optionCount = 0; optionCount < 32; optionCount += 1) {
+    const option = scanShellWord(segment, offset);
+    if (!option || !option.word.startsWith("-") && !option.word.startsWith("+")) return null;
+    offset = option.end;
+    if (option.word === "--") return null;
+    const zshLongOption = shell === "zsh" ? /^(?<sign>--|\+-)(?<name>[A-Za-z][A-Za-z_-]*)$/u.exec(option.word) : null;
+    if (zshLongOption) {
+      const optionName = zshLongOption.groups?.name?.replaceAll("-", "");
+      if (!optionName) return null;
+      const resolvedSetOption = resolveSupportedShellSetOption(shell, optionName);
+      if (!resolvedSetOption && !isSupportedZshLongInvocationOption(optionName)) return null;
+      if (resolvedSetOption?.name === "noexec") {
+        noExecute = zshLongOption.groups?.sign === "--" !== resolvedSetOption.inverted;
+      }
+      continue;
+    }
+    if (option.word === "--rcfile" || option.word === "--init-file") {
+      const operand = scanShellWord(segment, offset);
+      if (shell !== "bash" || !operand) return null;
+      offset = operand.end;
+      continue;
+    }
+    if (shell === "bash" && /^--(?:debug|debugger|login|noediting|noprofile|norc|posix|protected|restricted|verbose)$/u.test(
+      option.word
+    )) {
+      continue;
+    }
+    const cluster = parseSupportedShellOptionCluster(shell, option.word);
+    if (!cluster) return null;
+    if (cluster.changesNoExecute) noExecute = cluster.sign === "-";
+    if (cluster.enablesDumpStrings) dumpStrings = true;
+    if (cluster.operandKind) {
+      const operand = scanShellWord(segment, offset);
+      const resolvedSetOperand = operand && cluster.operandKind === "set" ? resolveSupportedShellSetOption(shell, operand.word) : null;
+      const operandIsZshInvocationOption = shell === "zsh" && operand !== null && cluster.operandKind === "set" && isSupportedZshLongInvocationOption(operand.word);
+      const operandIsSupported = cluster.operandKind === "set" ? resolvedSetOperand !== null || operandIsZshInvocationOption : shell === "bash" && operand && BASH_SHOPT_OPTIONS.has(operand.word);
+      if (!operand || !operandIsSupported) return null;
+      if (resolvedSetOperand?.name === "noexec") {
+        noExecute = cluster.sign === "-" !== resolvedSetOperand.inverted;
+      }
+      offset = operand.end;
+    }
+    if (cluster.hasCommand) {
+      return noExecute || dumpStrings ? null : readShellWord(segment, offset);
+    }
+  }
+  return null;
+}
+var BASH_SET_OPTIONS = /* @__PURE__ */ new Set([
+  "allexport",
+  "braceexpand",
+  "emacs",
+  "errexit",
+  "errtrace",
+  "functrace",
+  "hashall",
+  "histexpand",
+  "history",
+  "ignoreeof",
+  "keyword",
+  "monitor",
+  "noclobber",
+  "noexec",
+  "noglob",
+  "nolog",
+  "notify",
+  "nounset",
+  "onecmd",
+  "physical",
+  "pipefail",
+  "posix",
+  "privileged",
+  "verbose",
+  "vi",
+  "xtrace"
+]);
+var BASH_SHOPT_OPTIONS = /* @__PURE__ */ new Set([
+  "autocd",
+  "cdable_vars",
+  "cdspell",
+  "checkhash",
+  "checkjobs",
+  "checkwinsize",
+  "cmdhist",
+  "complete_fullquote",
+  "direxpand",
+  "dirspell",
+  "dotglob",
+  "execfail",
+  "expand_aliases",
+  "extdebug",
+  "extglob",
+  "extquote",
+  "failglob",
+  "force_fignore",
+  "globasciiranges",
+  "globskipdots",
+  "globstar",
+  "gnu_errfmt",
+  "histappend",
+  "histreedit",
+  "histverify",
+  "hostcomplete",
+  "huponexit",
+  "inherit_errexit",
+  "interactive_comments",
+  "lastpipe",
+  "lithist",
+  "localvar_inherit",
+  "localvar_unset",
+  "login_shell",
+  "mailwarn",
+  "nocaseglob",
+  "nocasematch",
+  "no_empty_cmd_completion",
+  "nullglob",
+  "progcomp",
+  "progcomp_alias",
+  "promptvars",
+  "restricted_shell",
+  "shift_verbose",
+  "sourcepath",
+  "varredir_close",
+  "xpg_echo"
+]);
+var POSIX_SET_OPTIONS = /* @__PURE__ */ new Set([
+  "allexport",
+  "errexit",
+  "ignoreeof",
+  "noclobber",
+  "noexec",
+  "noglob",
+  "nounset",
+  "verbose",
+  "vi",
+  "xtrace"
+]);
+var ZSH_LONG_INVOCATION_OPTIONS = /* @__PURE__ */ new Set([
+  "interactive",
+  "login",
+  "privileged",
+  "shinstdin",
+  "stdin"
+]);
+function isSupportedShellSetOption(shell, option) {
+  if (shell === "bash") return BASH_SET_OPTIONS.has(option);
+  if (shell === "sh" || shell === "dash") return POSIX_SET_OPTIONS.has(option);
+  if (shell === "ksh" || shell === "zsh") {
+    return POSIX_SET_OPTIONS.has(option) || option === "pipefail";
+  }
+  return false;
+}
+function normalizeShellSetOption(shell, option) {
+  if (shell === "zsh") return option.toLowerCase().replaceAll("_", "");
+  return option;
+}
+function isSupportedZshLongInvocationOption(option) {
+  const normalized = normalizeShellSetOption("zsh", option);
+  if (ZSH_LONG_INVOCATION_OPTIONS.has(normalized)) return true;
+  return normalized.startsWith("no") && !normalized.startsWith("nono") && ZSH_LONG_INVOCATION_OPTIONS.has(normalized.slice(2));
+}
+function resolveSupportedShellSetOption(shell, option) {
+  const normalized = normalizeShellSetOption(shell, option);
+  if (shell === "zsh" && normalized === "exec") {
+    return { name: "noexec", inverted: true };
+  }
+  if (isSupportedShellSetOption(shell, normalized)) {
+    return { name: normalized, inverted: false };
+  }
+  if (shell === "zsh" && normalized.startsWith("no") && !normalized.startsWith("nono") && isSupportedShellSetOption(shell, normalized.slice(2))) {
+    return { name: normalized.slice(2), inverted: true };
+  }
+  return null;
+}
+function parseSupportedShellOptionCluster(shell, option) {
+  if (!/^[+-][A-Za-z]+$/u.test(option)) return null;
+  const sign = option[0];
+  let letters = option.slice(1);
+  let operandKind = null;
+  const operandLetter = letters.at(-1);
+  if (operandLetter === "o" || operandLetter === "O") {
+    if (operandLetter === "O" && shell !== "bash") return null;
+    letters = letters.slice(0, -1);
+    if (letters.includes("c")) return null;
+    operandKind = operandLetter === "o" ? "set" : "shopt";
+  }
+  const supportedLetters = shell === "bash" ? "abcefhkmnptuvxBCEHPTilrsD" : shell === "sh" ? "abCcefimnsuvx" : shell === "dash" ? "abCcefilmnsuvx" : "acefilmnpsuvx";
+  if (![...letters].every((letter) => supportedLetters.includes(letter))) return null;
+  return {
+    sign,
+    hasCommand: letters.includes("c"),
+    changesNoExecute: letters.includes("n"),
+    enablesDumpStrings: shell === "bash" && letters.includes("D"),
+    operandKind
+  };
+}
+function scanShellWord(value, start) {
+  let result = "";
+  let quote = null;
+  let escaped = false;
+  let index = start;
+  while (index < value.length && /\s/u.test(value[index] ?? "")) index += 1;
+  const wordStart = index;
+  for (; index < value.length; index += 1) {
+    const character = value[index];
+    if (escaped) {
+      if (character !== "\n") result += character;
+      escaped = false;
+      continue;
+    }
+    if (character === "\\" && quote !== "'") {
+      const nextCharacter = value[index + 1];
+      const escapesNext = quote !== '"' || nextCharacter === "$" || nextCharacter === "`" || nextCharacter === '"' || nextCharacter === "\\" || nextCharacter === "\n";
+      if (escapesNext) {
+        escaped = true;
+      } else {
+        result += character;
+      }
+      continue;
+    }
+    if (quote) {
+      if (character === quote) {
+        quote = null;
+      } else {
+        result += character;
+      }
+      continue;
+    }
+    if (character === "'" || character === '"') {
+      quote = character;
+      continue;
+    }
+    if (/\s/u.test(character ?? "")) break;
+    result += character;
+  }
+  if (escaped || quote || index === wordStart) return null;
+  return { word: result, end: index };
+}
+function readShellWord(value, start) {
+  return scanShellWord(value, start)?.word ?? null;
+}
+function stripOuterShellGroup(segment) {
+  if (!segment.startsWith("(") || segment.startsWith("((")) return segment;
+  let depth = 0;
+  let quote = null;
+  let escaped = false;
+  for (let index = 0; index < segment.length; index += 1) {
+    const character = segment[index];
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (character === "\\" && quote !== "'") {
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      if (character === quote) quote = null;
+      continue;
+    }
+    if (character === "'" || character === '"') {
+      quote = character;
+      continue;
+    }
+    if (character === "(") {
+      depth += 1;
+      continue;
+    }
+    if (character !== ")") continue;
+    depth -= 1;
+    if (depth < 0) return segment;
+    if (depth === 0) {
+      if (segment.slice(index + 1).trim().length > 0) return segment;
+      return segment.slice(1, index).trim();
+    }
+  }
+  return segment;
+}
+function stripEnvironmentCommandPrefix(segment) {
+  const wrapper = /^(cross-env(?:-shell)?|env)(?:\s|$)/iu.exec(segment);
+  if (!wrapper) {
+    return { segment, unwrapQuotedShellCommand: false, splitShellOperators: null };
+  }
+  let remainder = segment.slice(wrapper[0].length).trimStart();
+  let unwrapQuotedShellCommand = wrapper[1]?.toLowerCase() === "cross-env-shell";
+  let splitShellOperators = true;
+  while (remainder.length > 0) {
+    const splitString = /^(?:-S|--split-string)(?:=|\s+)(?:"([^"]*)"|'([^']*)'|([^\s]+))(?:\s+|$)/u.exec(remainder);
+    if (splitString) {
+      const splitCommand = splitString[1] ?? splitString[2] ?? splitString[3] ?? "";
+      remainder = `${splitCommand} ${remainder.slice(splitString[0].length)}`.trim();
+      unwrapQuotedShellCommand = false;
+      splitShellOperators = false;
+      continue;
+    }
+    const assignment = /^[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|[^\s]+)(?:\s+|$)/u.exec(
+      remainder
+    );
+    if (assignment) {
+      remainder = remainder.slice(assignment[0].length).trimStart();
+      continue;
+    }
+    const optionWithValue = /^(?:-u|--unset|-C|--chdir)(?:=|\s+)(?:"[^"]*"|'[^']*'|[^\s]+)(?:\s+|$)/u.exec(remainder);
+    if (optionWithValue) {
+      remainder = remainder.slice(optionWithValue[0].length).trimStart();
+      continue;
+    }
+    const flag = /^(?:--ignore-environment|-i|--)(?:\s+|$)/u.exec(remainder);
+    if (flag) {
+      remainder = remainder.slice(flag[0].length).trimStart();
+      continue;
+    }
+    break;
+  }
+  return { segment: remainder, unwrapQuotedShellCommand, splitShellOperators };
 }
 function isCiWorkflow(file) {
   return /^\.github\/workflows\/.+\.ya?ml$/.test(file) || /^\.gitlab-ci\.ya?ml$/.test(file) || /^\.circleci\/config\.ya?ml$/.test(file) || /^azure-pipelines\.ya?ml$/.test(file) || /^Jenkinsfile$/.test(file);
 }
 function isDeployConfig(file) {
-  return /^(vercel|netlify|fly|render|railway)\.(json|toml|ya?ml)$/.test(file) || /^Dockerfile$/.test(file) || /^docker-compose\.ya?ml$/.test(file) || /^k8s\//.test(file);
+  return /(^|\/)(vercel|netlify|fly|render|railway)\.(json|toml|ya?ml)$/.test(file) || /(^|\/)Dockerfile$/.test(file) || /(^|\/)docker-compose\.ya?ml$/.test(file) || /(^|\/)k8s\//.test(file);
 }
 function isExplicitDeployTarget(file) {
-  return /^(vercel|netlify|fly|render|railway)\.(json|toml|ya?ml)$/.test(file) || /^docker-compose\.ya?ml$/.test(file) || /^Procfile$/.test(file) || /^app\.ya?ml$/.test(file) || /^serverless\.ya?ml$/.test(file) || /^(k8s|kubernetes|manifests?)\/.+\.ya?ml$/i.test(file) || /^(charts?|helm)\/.+\.ya?ml$/i.test(file);
+  return /(^|\/)(vercel|netlify|fly|render|railway)\.(json|toml|ya?ml)$/.test(file) || /(^|\/)docker-compose\.ya?ml$/.test(file) || /(^|\/)Procfile$/.test(file) || /(^|\/)app\.ya?ml$/.test(file) || /(^|\/)serverless\.ya?ml$/.test(file) || /(^|\/)(k8s|kubernetes|manifests?)\/.+\.ya?ml$/i.test(file) || /(^|\/)(charts?|helm)\/.+\.ya?ml$/i.test(file);
 }
 var MAIN_ENTRYPOINT_FILE_PATTERN = /(^|\/)(main|server|app|wsgi|asgi|index|entry|start|run)\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs)$/i;
+var RACK_ENTRYPOINT_FILE_PATTERN = /(^|\/)(?:config\.ru|(?:main|server|app|start|run)\.rb)$/i;
 var SERVER_ENTRYPOINT_PATTERN = /\bapp\.listen\s*\(|\bserver\.listen\s*\(\s*(?:PORT|port|\d+)|http\.ListenAndServe\s*\(|http\.ListenAndServeTLS\s*\(|axum::Server(?:::|\.)|actix_web::HttpServer(?:::|\.)|uvicorn\.run\s*\(/;
+var RACK_SERVER_ENTRYPOINT_PATTERN = /Rack::(?:Server|Handler(?:::\w+)?)\.(?:start|run)\s*\(/;
+var RACK_CONFIG_RUN_PATTERN = /^\s*run\s+(?:(?:[A-Z]\w*(?:::\w+)*(?:\.new)?|lambda)\b|->)/m;
+var RUNTIME_CONTAINER_COMMAND_PATTERN = /^\s*(?:CMD|ENTRYPOINT)\s+.*(?:\b(?:start|serve|server|qgis|nginx|apache|gunicorn|uvicorn)\b|manage\.py\s+runserver).*$/im;
+var NON_RUNTIME_CONTAINER_COMMAND_PATTERN = /\b(?:test|lint|build|compile|package|check)\b/i;
 var CI_DEPLOY_JOB_PATTERN = /(?:^\s{2,4}deploy\s*:|\b(?:fly|heroku|vercel|netlify|railway|render)\s+deploy\b|kubectl\s+apply\b|helm\s+(?:install|upgrade|deploy)\b|docker\s+push\b)/im;
-function isDeployableService(repoPath, repoFiles) {
-  if (repoFiles.some(isExplicitDeployTarget)) return true;
-  if (detectCiDeployJob(repoPath, repoFiles)) return true;
-  if (detectServerEntrypoint(repoPath, repoFiles)) return true;
+function isDeployableService(repoPath, repoFiles, useV27Detectors) {
+  if (repoFiles.some(
+    (file) => (useV27Detectors ? isAuthoredProductionPath(file) : isProductionSourcePath(file)) && isExplicitDeployTarget(file)
+  )) {
+    return true;
+  }
+  if (detectCiDeployJob(repoPath, repoFiles, useV27Detectors)) return true;
+  if (detectServerEntrypoint(repoPath, repoFiles, useV27Detectors)) return true;
+  if (useV27Detectors && findRuntimeContainerEntrypointFile(repoPath, repoFiles)) return true;
   return false;
 }
-function detectCiDeployJob(repoPath, repoFiles) {
-  const workflows = repoFiles.filter(isCiWorkflow);
+function detectCiDeployJob(repoPath, repoFiles, authoredOnly = false) {
+  const workflows = repoFiles.filter(
+    (file) => (!authoredOnly || isAuthoredProductionPath(file)) && isCiWorkflow(file)
+  );
   return workflows.some((file) => fileContains(repoPath, file, CI_DEPLOY_JOB_PATTERN));
 }
-function detectServerEntrypoint(repoPath, repoFiles) {
-  return findServerEntrypointFile(repoPath, repoFiles) !== null;
+function detectServerEntrypoint(repoPath, repoFiles, useV27Detectors) {
+  return findServerEntrypointFile(repoPath, repoFiles, useV27Detectors) !== null;
 }
-function findServerEntrypointFile(repoPath, repoFiles) {
-  const candidates = repoFiles.filter((file) => MAIN_ENTRYPOINT_FILE_PATTERN.test(file) && isProductionSourcePath(file)).slice(0, 30);
-  return candidates.find((file) => fileContains(repoPath, file, SERVER_ENTRYPOINT_PATTERN)) ?? null;
+function findServerEntrypointFile(repoPath, repoFiles, useV27Detectors) {
+  const candidates = repoFiles.filter(
+    (file) => (MAIN_ENTRYPOINT_FILE_PATTERN.test(file) || useV27Detectors && RACK_ENTRYPOINT_FILE_PATTERN.test(file)) && (useV27Detectors ? isAuthoredProductionPath(file) : isProductionSourcePath(file))
+  ).slice(0, 30);
+  return candidates.find(
+    (file) => fileContains(repoPath, file, SERVER_ENTRYPOINT_PATTERN) || useV27Detectors && fileContains(repoPath, file, RACK_SERVER_ENTRYPOINT_PATTERN) || useV27Detectors && /\.ru$/i.test(file) && fileContains(repoPath, file, RACK_CONFIG_RUN_PATTERN)
+  ) ?? null;
+}
+function findRuntimeContainerEntrypointFile(repoPath, repoFiles) {
+  return repoFiles.filter((file) => /(^|\/)Dockerfile$/i.test(file) && isAuthoredProductionPath(file)).find((file) => {
+    const fullPath = join(repoPath, file);
+    if (!isRegularFile(fullPath)) return false;
+    const lines = readFileSync(fullPath, "utf8").split(/\r?\n/);
+    const finalStageStart = lines.reduce(
+      (last, line, index) => /^\s*FROM\b/i.test(line) ? index : last,
+      0
+    );
+    const finalStageLines = lines.slice(finalStageStart);
+    const entrypoint = [...finalStageLines].reverse().find((line) => /^\s*ENTRYPOINT\b/i.test(line));
+    const command = [...finalStageLines].reverse().find((line) => /^\s*CMD\b/i.test(line));
+    const effectiveCommand = [entrypoint, command].filter(Boolean).join(" ");
+    return effectiveCommand.length > 0 && RUNTIME_CONTAINER_COMMAND_PATTERN.test(effectiveCommand) && !NON_RUNTIME_CONTAINER_COMMAND_PATTERN.test(effectiveCommand);
+  }) ?? null;
 }
 function isHealthCheckSignalFile(repoPath, file) {
   if (/docs\/|audit|architecture|adr/i.test(file)) return false;
@@ -6981,6 +8492,42 @@ function packageJsonHasHeavyTestDependency(repoPath, manifest) {
   ];
   return names.some((name) => HEAVY_TEST_DEPENDENCY_NAME_PATTERN.test(name));
 }
+function packageJsonDescribesPackagedApplication(repoPath, manifest, repoFiles) {
+  const fullPath = join(repoPath, manifest);
+  if (!isRegularFile(fullPath)) return false;
+  const parsed = parseJsonObject(readFileSync(fullPath, "utf8"));
+  if (!parsed) return false;
+  const scripts = isRecord(parsed.scripts) ? Object.values(parsed.scripts) : [];
+  const dependencies = {
+    ...isRecord(parsed.dependencies) ? parsed.dependencies : {},
+    ...isRecord(parsed.devDependencies) ? parsed.devDependencies : {}
+  };
+  const build = isRecord(parsed.build) ? parsed.build : null;
+  const hasDesktopRuntime = Object.keys(dependencies).some(
+    (name) => name.toLowerCase() === "electron" || /^@tauri-apps\/(?:api|plugin-)/i.test(name)
+  );
+  const hasPackagingCommand = scripts.some(
+    (script) => typeof script === "string" && /\b(?:electron-builder|electron-packager|tauri\s+build)\b/i.test(script)
+  );
+  const hasApplicationMetadata = isNonEmptyString(parsed.productName) || isNonEmptyString(parsed.main) || build != null && isNonEmptyString(build.appId) || findTauriApplicationMetadata(repoPath, manifest, repoFiles);
+  return hasDesktopRuntime && hasPackagingCommand && hasApplicationMetadata;
+}
+function findTauriApplicationMetadata(repoPath, manifest, repoFiles) {
+  const manifestDirectory = dirname(manifest);
+  const prefix = manifestDirectory === "." ? "" : `${manifestDirectory}/`;
+  const candidates = [`${prefix}src-tauri/tauri.conf.json`, `${prefix}tauri.conf.json`];
+  return candidates.some((file) => {
+    if (!repoFiles.includes(file)) return false;
+    const fullPath = join(repoPath, file);
+    if (!isRegularFile(fullPath)) return false;
+    const config = parseJsonObject(readFileSync(fullPath, "utf8"));
+    const packageMetadata = isRecord(config?.package) ? config.package : null;
+    return isNonEmptyString(config?.productName) || isNonEmptyString(config?.identifier) || packageMetadata != null && isNonEmptyString(packageMetadata.productName);
+  });
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
 function isImplementationFile(file) {
   return /(^|\/)(src|app|lib|packages|cmd|include|source|Sources)\//.test(file) && /\.(ts|tsx|js|jsx|py|go|rs|java|rb|cpp|cc|cxx|c|h|hpp|kt|swift|php)$/.test(file);
 }
@@ -7004,8 +8551,8 @@ function isSecurityPolicyOnlyAuditFile(file) {
 function isFreshnessRatableAuditFile(file) {
   return isAuditFile(file) && !isSecurityPolicyOnlyAuditFile(file);
 }
-function isIgnoredScanFile(file) {
-  return /(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|README\.md|CHANGELOG\.md)$/.test(file) || isEnvTemplatePath(file);
+function isIgnoredScanFile(file, useV47Detectors = false) {
+  return /(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|README\.md|CHANGELOG\.md)$/.test(file) || isEnvTemplatePath(file, useV47Detectors);
 }
 function findRootPackageJson(repoFiles) {
   return repoFiles.includes("package.json") ? "package.json" : null;
@@ -7022,46 +8569,315 @@ function fileContains(repoPath, file, pattern) {
   if (!isRegularFile(fullPath)) return false;
   return pattern.test(readFileSync(fullPath, "utf8"));
 }
-function fileContainsCommittedSecret(repoPath, file) {
+function findCommittedSecretInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
   const fullPath = join(repoPath, file);
-  if (!isRegularFile(fullPath)) return false;
-  return containsRealSecret(readFileSync(fullPath, "utf8"));
+  if (!isRegularFile(fullPath)) return null;
+  const contents = readFileSync(fullPath, "utf8");
+  const isTestCredentialConfiguration = useV39Detectors && isLikelyTestCredentialConfiguration(file, contents);
+  const secretScanContents = prepareCredentialScanContents(
+    contents,
+    file,
+    useV36Detectors,
+    useV39Detectors,
+    useV47Detectors
+  );
+  const secret = findRealSecretAssignment(secretScanContents, /* @__PURE__ */ new Set(), {
+    allowCredentialNamedDigest: useV36Detectors
+  });
+  if (secret) return secret;
+  if (useV39Detectors && isEnvHistoryPath(file, useV36Detectors)) {
+    const weakCredential = findWeakExplicitEnvCredential(secretScanContents);
+    if (weakCredential) return weakCredential;
+  }
+  return useV36Detectors && !isTestCredentialConfiguration ? findDefaultAdministrativeCredential(secretScanContents) : null;
+}
+function prepareCredentialScanContents(contents, file, useV36Detectors, useV39Detectors, useV47Detectors = false) {
+  const withoutXamlEventNames = useV36Detectors && /\.xaml$/i.test(file) ? contents.replace(/\bTokenItem(?:Added|Removed)(?=\s*=)/gi, "EventHandler") : contents;
+  const withoutDocumentationExamples = useV39Detectors ? stripCommentAndDocumentationExamples(withoutXamlEventNames) : withoutXamlEventNames;
+  return useV47Detectors ? stripV47PublicIdentifiersAndNonCredentialValues(withoutDocumentationExamples, file) : withoutDocumentationExamples;
+}
+function stripV47PublicIdentifiersAndNonCredentialValues(contents, file) {
+  const lines = contents.split(/\r?\n/);
+  return lines.map((line, index) => {
+    let sanitized = line.replace(
+      /^(\s*(?:export\s+)?(?:PUBLIC_)?ALGOLIA_(?:PUBLIC_)?API_KEY\s*[:=]\s*)[^\s#]+/i,
+      '$1""'
+    );
+    if (isPublicDocumentationSearchKeyContext(lines, index, file)) {
+      sanitized = sanitized.replace(/(\bapiKey\s*[:=]\s*)(['"])[^'"]+\2/gi, "$1$2$2");
+    }
+    sanitized = sanitized.replace(
+      /(\b[A-Za-z_][A-Za-z0-9_]*(?:token|api[_-]?key|access[_-]?key)[A-Za-z0-9_]*\s*[:=]\s*)(['"]?)0x[0-9a-f]{40}\2/gi,
+      '$1""'
+    );
+    sanitized = sanitized.replace(
+      /(\b[A-Za-z_][A-Za-z0-9_]*(?:token|api[_-]?key|access[_-]?key)[A-Za-z0-9_]*\s*[:=]\s*)(['"])([a-z][a-z0-9]*(?:_[a-z0-9]+){2,})\2/gi,
+      (assignment, prefix, quote, value) => /\b(?:cost|input|output|context|model|limit|price|usage|audio)\b/i.test(
+        value.replaceAll("_", " ")
+      ) ? `${prefix}${quote}${quote}` : assignment
+    );
+    return sanitized;
+  }).join("\n");
 }
-function containsRealSecret(contents) {
-  SECRET_ASSIGNMENT_PATTERN.lastIndex = 0;
-  for (const match of contents.matchAll(SECRET_ASSIGNMENT_PATTERN)) {
-    const rawValue = match[1];
-    if (!rawValue) continue;
-    const value = rawValue.replace(/[,;)]$/, "");
-    if (isPlaceholderSecretValue(value)) continue;
-    if (looksLikeSecretValue(value)) return true;
+function isPublicDocumentationSearchKeyContext(lines, lineIndex, file) {
+  const windowStart = Math.max(0, lineIndex - 6);
+  const preceding = lines.slice(windowStart, lineIndex + 1);
+  for (let index = preceding.length - 1; index >= 0; index -= 1) {
+    const candidate = preceding[index] ?? "";
+    if (/}/.test(candidate) && index < preceding.length - 1) return false;
+    if (/\bdocsearch(?:Options)?\b/i.test(candidate)) return true;
+    if (/\balgolia\b/i.test(candidate) && /(?:^|\/)(?:website|docs?)(?:\/|$)|(?:site[-_]?config|\.dumirc|docusaurus)/i.test(file)) {
+      return true;
+    }
   }
   return false;
 }
-function collectHistorySecretEvidence(repoPath) {
-  const historyEntries = readCredentialHistoryEntries(repoPath);
+function stripCommentAndDocumentationExamples(contents) {
+  let blockCommentEnd = null;
+  return contents.split(/\r?\n/).map((line) => {
+    const trimmed = line.trimStart();
+    if (blockCommentEnd) {
+      if (trimmed.includes(blockCommentEnd)) blockCommentEnd = null;
+      return "";
+    }
+    if (trimmed.startsWith("/*")) {
+      if (!trimmed.includes("*/")) blockCommentEnd = "*/";
+      return "";
+    }
+    if (trimmed.startsWith("<!--")) {
+      if (!trimmed.includes("-->")) blockCommentEnd = "-->";
+      return "";
+    }
+    if (/^(?:\/\/|#|\*)/.test(trimmed)) return "";
+    if (/\.description\s*\(/i.test(line) && /api[_-]?key|token|password|secret/i.test(line)) {
+      return "";
+    }
+    return line;
+  }).join("\n");
+}
+function isLikelyTestCredentialConfiguration(file, contents) {
+  if (!/\.(?:ya?ml|json|toml|ini|conf)$/i.test(file) && !/(?:^|\/)docker-compose/i.test(file)) {
+    return false;
+  }
+  const testMarkers = contents.match(/(?:^|[^A-Za-z])(?:tests?|testing|e2e|appium|fixture)(?:[^A-Za-z]|$)/gi)?.length ?? 0;
+  return testMarkers >= 2;
+}
+function hasTemplateOnlyEnvContent(repoPath, file) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return false;
+  const substantiveLines = readFileSync(fullPath, "utf8").split(/\r?\n/).filter((line) => line.trim().length > 0 && !/^\s*#/.test(line));
+  if (substantiveLines.length === 0) return true;
+  const assignments = substantiveLines.map(
+    (line) => /^\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*\s*=\s*(.*?)\s*$/.exec(line)?.[1] ?? null
+  );
+  if (assignments.some((value) => value === null)) return false;
+  return assignments.every((raw) => {
+    if (raw === null) return false;
+    const value = raw.replace(/^['"]|['"]$/g, "").trim();
+    return value.length === 0 || isPlaceholderSecretValue(value);
+  });
+}
+function findSecretFingerprintsInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return [];
+  const contents = readFileSync(fullPath, "utf8");
+  const scanContents = prepareCredentialScanContents(
+    contents,
+    file,
+    useV36Detectors,
+    useV39Detectors,
+    useV47Detectors
+  );
+  const fingerprints = findRealSecretAssignments(
+    scanContents,
+    /* @__PURE__ */ new Set(),
+    Number.POSITIVE_INFINITY,
+    { allowCredentialNamedDigest: useV36Detectors }
+  ).map(({ valueFingerprint }) => valueFingerprint);
+  if (useV39Detectors && isEnvHistoryPath(file, useV36Detectors)) {
+    const weakCredential = findWeakExplicitEnvCredential(scanContents);
+    if (weakCredential) fingerprints.push(weakCredential.valueFingerprint);
+  }
+  return [...new Set(fingerprints)];
+}
+function findRealSecretAssignment(contents, excludedValueFingerprints = /* @__PURE__ */ new Set(), options = {}) {
+  return findRealSecretAssignments(contents, excludedValueFingerprints, 1, options)[0] ?? null;
+}
+function findRealSecretAssignments(contents, excludedValueFingerprints = /* @__PURE__ */ new Set(), maximumMatches = Number.POSITIVE_INFINITY, options = {}) {
+  const matches = [];
+  SECRET_IDENTIFIER_KEYWORD_PATTERN.lastIndex = 0;
+  let match = SECRET_IDENTIFIER_KEYWORD_PATTERN.exec(contents);
+  let line = 1;
+  let lineCursor = 0;
+  while (match !== null) {
+    const keyword = match[0];
+    const keywordStart = match.index;
+    while (lineCursor < keywordStart) {
+      if (contents.charCodeAt(lineCursor) === 10) line += 1;
+      lineCursor += 1;
+    }
+    let cursor = keywordStart + keyword.length;
+    while (cursor < contents.length && isSecretIdentifierCharacter(contents.charCodeAt(cursor))) {
+      cursor += 1;
+    }
+    const identifierEnd = cursor;
+    let identifierStart = keywordStart;
+    while (identifierStart > 0 && isSecretIdentifierCharacter(contents.charCodeAt(identifierStart - 1))) {
+      identifierStart -= 1;
+    }
+    const identifier = contents.slice(identifierStart, identifierEnd);
+    let nextSearchIndex = identifierEnd;
+    while (cursor < contents.length && SINGLE_WHITESPACE_PATTERN.test(contents[cursor] ?? "")) {
+      cursor += 1;
+    }
+    const delimiter = contents[cursor];
+    if (delimiter === ":" || delimiter === "=") {
+      cursor += 1;
+      while (cursor < contents.length && SINGLE_WHITESPACE_PATTERN.test(contents[cursor] ?? "")) {
+        cursor += 1;
+      }
+      if (contents[cursor] === "'" || contents[cursor] === '"') cursor += 1;
+      const valueStart = cursor;
+      while (cursor < contents.length) {
+        const character = contents[cursor] ?? "";
+        if (character === "'" || character === '"' || SINGLE_WHITESPACE_PATTERN.test(character)) {
+          break;
+        }
+        cursor += 1;
+      }
+      if (cursor > valueStart) {
+        const value = contents.slice(valueStart, cursor).replace(/[,;)]$/, "");
+        nextSearchIndex = cursor;
+        if (!isPlaceholderSecretValue(value) && (looksLikeSecretValue(value) || options.allowCredentialNamedDigest === true && isLikelyDigestOrHash(value) && isExplicitCredentialIdentifier(identifier))) {
+          const valueFingerprint = createHash2("sha256").update(value).digest("hex");
+          const characterClasses = [
+            /[a-z]/.test(value) ? "lower" : "",
+            /[A-Z]/.test(value) ? "upper" : "",
+            /\d/.test(value) ? "digit" : "",
+            /[^A-Za-z0-9]/.test(value) ? "symbol" : ""
+          ].filter(Boolean).join("+");
+          if (!excludedValueFingerprints.has(valueFingerprint)) {
+            matches.push({
+              identifier,
+              line,
+              valueLength: value.length,
+              characterClasses: characterClasses || "other",
+              valueFingerprint
+            });
+            if (matches.length >= maximumMatches) return matches;
+          }
+        }
+      }
+    }
+    SECRET_IDENTIFIER_KEYWORD_PATTERN.lastIndex = nextSearchIndex;
+    match = SECRET_IDENTIFIER_KEYWORD_PATTERN.exec(contents);
+  }
+  return matches;
+}
+function isExplicitCredentialIdentifier(identifier) {
+  return /^(?:github|gitlab|api|access)[_-]?(?:token|key)$/i.test(identifier);
+}
+function findWeakExplicitEnvCredential(contents) {
+  const lines = contents.split(/\r?\n/);
+  for (const [index, line] of lines.entries()) {
+    if (/^\s*#/.test(line)) continue;
+    const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*(?:PASSWORD|PASSWD|PWD|SECRET(?:_KEY)?|API_KEY|TOKEN))\s*=\s*['"]?([^\s#'"]+)['"]?/i.exec(
+      line
+    );
+    const identifier = match?.[1];
+    const value = match?.[2];
+    if (!identifier || !value || isPlaceholderSecretValue(value)) continue;
+    const minimumLength = /(?:API_KEY|TOKEN)$/i.test(identifier) ? 12 : 6;
+    if (value.length < minimumLength) continue;
+    const characterClasses = [
+      /[a-z]/.test(value) ? "lower" : "",
+      /[A-Z]/.test(value) ? "upper" : "",
+      /\d/.test(value) ? "digit" : "",
+      /[^A-Za-z0-9]/.test(value) ? "symbol" : ""
+    ].filter(Boolean).join("+");
+    return {
+      identifier,
+      line: index + 1,
+      valueLength: value.length,
+      characterClasses: characterClasses || "other",
+      valueFingerprint: createHash2("sha256").update(value).digest("hex")
+    };
+  }
+  return null;
+}
+function findDefaultAdministrativeCredential(contents) {
+  const lines = contents.split(/\r?\n/);
+  for (const [index, line] of lines.entries()) {
+    const match = /\b([A-Za-z0-9_]*(?:ADMIN|ROOT)[A-Za-z0-9_]*(?:PASSWORD|PASSWD|PWD))\s*[:=]\s*["']?(admin|root|password)["']?(?:\s|$)/i.exec(
+      line
+    );
+    const identifier = match?.[1];
+    const value = match?.[2];
+    if (!identifier || !value) continue;
+    return {
+      identifier,
+      line: index + 1,
+      valueLength: value.length,
+      characterClasses: "lower",
+      valueFingerprint: createHash2("sha256").update(value).digest("hex"),
+      kind: "default_admin"
+    };
+  }
+  return null;
+}
+function secretEvidenceLabel(prefix, match) {
+  return `${prefix} (value redacted; length ${match.valueLength}; classes ${match.characterClasses})`;
+}
+function isSecretIdentifierCharacter(characterCode) {
+  return characterCode >= 48 && characterCode <= 57 || characterCode >= 65 && characterCode <= 90 || characterCode === 95 || characterCode >= 97 && characterCode <= 122;
+}
+function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFingerprintsByPath, authoredProductionOnly = false, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
+  const historyEntries = readCredentialHistoryEntries(repoPath, useV36Detectors);
+  const head = excludeHead ? readGitHead(repoPath) : null;
   let scannedFiles = 0;
   let envPathEvidence = null;
   for (const entry of historyEntries) {
+    if (head && entry.commit === head) continue;
+    if (authoredProductionOnly && !(useV47Detectors ? isV47AuthoredProductionPath(entry.path) : useV39Detectors ? isV39AuthoredProductionPath(entry.path) : isAuthoredProductionPath(entry.path))) {
+      continue;
+    }
     if (scannedFiles >= HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT) {
       return { evidence: null, envPathEvidence, truncated: true };
     }
     scannedFiles += 1;
     const contents = readGitBlob(repoPath, entry.commit, entry.path);
     if (!contents) continue;
-    if (containsRealSecret(contents)) {
+    const scanContents = prepareCredentialScanContents(
+      contents,
+      entry.path,
+      useV36Detectors,
+      useV39Detectors,
+      useV47Detectors
+    );
+    const currentFingerprints = currentSecretFingerprintsByPath.get(entry.path) ?? /* @__PURE__ */ new Set();
+    let secretMatch = findRealSecretAssignment(scanContents, currentFingerprints, {
+      allowCredentialNamedDigest: useV36Detectors
+    });
+    if (!secretMatch && useV39Detectors && isEnvHistoryPath(entry.path, useV36Detectors, useV47Detectors)) {
+      const weakCredential = findWeakExplicitEnvCredential(scanContents);
+      if (weakCredential && !currentFingerprints.has(weakCredential.valueFingerprint)) {
+        secretMatch = weakCredential;
+      }
+    }
+    if (secretMatch) {
       return {
         evidence: {
           kind: "secret_scan",
-          label: "Committed secret in recent git history",
+          label: secretEvidenceLabel("Committed secret in recent git history", secretMatch),
           path: entry.path,
+          line: secretMatch.line,
           contentHash: entry.commit
         },
         envPathEvidence,
         truncated: false
       };
     }
-    if (!envPathEvidence && isEnvHistoryPath(entry.path)) {
+    if (!envPathEvidence && isEnvHistoryPath(entry.path, useV36Detectors, useV47Detectors)) {
       envPathEvidence = {
         kind: "secret_scan",
         label: ".env file (not a template) tracked in git history; no confirmed secret value found",
@@ -7072,7 +8888,7 @@ function collectHistorySecretEvidence(repoPath) {
   }
   return { evidence: null, envPathEvidence, truncated: false };
 }
-function readCredentialHistoryEntries(repoPath) {
+function readCredentialHistoryEntries(repoPath, useV36Detectors = false) {
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
   const appendEntry = (entry) => {
@@ -7113,18 +8929,18 @@ function readCredentialHistoryEntries(repoPath) {
       }
       const path = line.trim();
       if (!currentCommit || !path) continue;
-      if (!isCredentialHistoryPath(path)) continue;
+      if (!isCredentialHistoryPath(path, useV36Detectors)) continue;
       appendEntry({ commit: currentCommit, path });
     }
   } catch {
   }
-  for (const entry of readDeletedCredentialHistoryEntries(repoPath)) {
+  for (const entry of readDeletedCredentialHistoryEntries(repoPath, useV36Detectors)) {
     appendEntry(entry);
   }
   return entries;
 }
-function readDeletedCredentialHistoryEntries(repoPath) {
-  const deletedPaths = readDeletedCredentialHistoryPaths(repoPath);
+function readDeletedCredentialHistoryEntries(repoPath, useV36Detectors = false) {
+  const deletedPaths = readDeletedCredentialHistoryPaths(repoPath, useV36Detectors);
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
   for (const path of deletedPaths) {
@@ -7137,7 +8953,7 @@ function readDeletedCredentialHistoryEntries(repoPath) {
   }
   return entries;
 }
-function readDeletedCredentialHistoryPaths(repoPath) {
+function readDeletedCredentialHistoryPaths(repoPath, useV36Detectors = false) {
   try {
     const output = execFileSync(
       "git",
@@ -7154,7 +8970,7 @@ function readDeletedCredentialHistoryPaths(repoPath) {
       if (!line.startsWith("D	")) continue;
       const path = line.slice(2).trim();
       if (!path || seen.has(path)) continue;
-      if (!isCredentialHistoryPath(path)) continue;
+      if (!isCredentialHistoryPath(path, useV36Detectors)) continue;
       seen.add(path);
       paths.push(path);
     }
@@ -7179,7 +8995,7 @@ function readHistoryCommitsForPath(repoPath, path) {
     return [];
   }
 }
-function isCredentialHistoryPath(path) {
+function isCredentialHistoryPath(path, _useV36Detectors = false) {
   if (isHardExcludedPath(path)) return false;
   const lowerPath = path.toLowerCase();
   const basename3 = lowerPath.split("/").at(-1) ?? lowerPath;
@@ -7188,10 +9004,11 @@ function isCredentialHistoryPath(path) {
   }
   return lowerPath.includes("secret") || lowerPath.includes("credential") || basename3.endsWith(".pem") || basename3.endsWith(".key") || basename3 === "id_rsa" || basename3.endsWith(".p12") || basename3.endsWith(".pfx");
 }
-function isEnvHistoryPath(path) {
-  if (isEnvTemplatePath(path)) return false;
+function isEnvHistoryPath(path, useV36Detectors = false, useV47Detectors = false) {
+  if (isEnvTemplatePath(path, useV47Detectors)) return false;
+  if (useV47Detectors && !isV47AuthoredProductionPath(path)) return false;
   const basename3 = path.toLowerCase().split("/").at(-1) ?? path.toLowerCase();
-  return /\.env(?:\.|$)/.test(basename3);
+  return (useV36Detectors ? /^\.env(?:\.|$)/ : /\.env(?:\.|$)/).test(basename3);
 }
 function readGitBlob(repoPath, commit, path) {
   try {
@@ -7229,7 +9046,7 @@ function isFillerRunSecretValue(value) {
 function isSyntheticFixtureSecretValue(value) {
   return value.includes("abcdefghijklmnopqrstuvwxyz") || value.includes("0123456789abcdefghijklmnopqrstuvwxyz") || value.includes("abcdefghijklmnopqrstuvwxyz0123456789") || value.includes("abcdefghijklmnopqrst");
 }
-function hasSuspiciousDependencies(repoPath, manifest) {
+function hasSuspiciousDependencies(repoPath, manifest, useV47Detectors = false) {
   if (!manifest.endsWith("package.json")) return false;
   const fullPath = join(repoPath, manifest);
   if (!isRegularFile(fullPath)) return false;
@@ -7238,9 +9055,15 @@ function hasSuspiciousDependencies(repoPath, manifest) {
   const dependencies = isRecord(parsed.dependencies) ? parsed.dependencies : {};
   const devDependencies = isRecord(parsed.devDependencies) ? parsed.devDependencies : {};
   const names = [...Object.keys(dependencies), ...Object.keys(devDependencies)];
-  return names.some(
+  if (names.some(
     (name) => /^(todo|fake|placeholder|example)-|does-not-exist| hallucinated/i.test(name)
-  );
+  )) {
+    return true;
+  }
+  if (!useV47Detectors || typeof parsed.name !== "string") return false;
+  const placeholderIdentity = /^(?:example|sample|placeholder|todo|fake)(?:-|$)/i.test(parsed.name);
+  const placeholderMetadata = typeof parsed.author === "string" && /^(?:your name|example|placeholder)$/i.test(parsed.author) || typeof parsed.description === "string" && /^(?:package description|example|placeholder|todo)$/i.test(parsed.description);
+  return placeholderIdentity && placeholderMetadata;
 }
 function readRecentCommits(repoPath) {
   try {
@@ -7822,7 +9645,12 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
     );
     consumedSignals.push(...summaries);
     const finalScore = adjustment === 0 ? scored.score : adjustedScore;
-    const finalStatus = adjustment === 0 ? scored.status : statusForScore(finalScore);
+    const finalStatus = statusAfterInputAdjustment(
+      scored.status,
+      scored.score,
+      adjustment,
+      parsedInput.rubricVersion
+    );
     return {
       id,
       title: rubricCriterion.title,
@@ -7855,7 +9683,15 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
   const overallScore = roundScore(
     categoryOrder.reduce((sum, category) => sum + (categoryScoreMap[category] ?? 0), 0) / Math.max(categoryOrder.length, 1)
   );
-  const abstained = parsedInput.insufficientSourceReason != null;
+  const hasMeasuredCriterion = criteria.some(
+    ({ status }) => status !== "not_applicable" && status !== "insufficient_data"
+  );
+  const isFreeCoreRubric = rubric.length === WITAN_RUBRIC.length && rubric.every(
+    ({ id, category }, index) => id === WITAN_RUBRIC[index]?.id && category === WITAN_RUBRIC[index]?.category
+  );
+  const noMeasurementAbstention = (parsedInput.rubricVersion === WITAN_RUBRIC_VERSION_V16 || parsedInput.rubricVersion === WITAN_RUBRIC_VERSION_V17) && isFreeCoreRubric && !hasMeasuredCriterion;
+  const insufficientSourceReason = parsedInput.insufficientSourceReason ?? (noMeasurementAbstention ? WITAN_NO_MEASUREMENT_REASON : void 0);
+  const abstained = insufficientSourceReason != null;
   return WitanReportSchema.parse({
     productSlug: parsedInput.productSlug,
     productDisplayName: parsedInput.productDisplayName,
@@ -7875,7 +9711,7 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
     // alter it (see classifyRepoArchetype in repo-signals.ts); per-criterion scoring above is
     // unaffected by archetype, only presentation layers (badge/terminal/verdict) key off it.
     ...parsedInput.archetype ? { archetype: parsedInput.archetype } : {},
-    ...parsedInput.insufficientSourceReason ? { insufficientSourceReason: parsedInput.insufficientSourceReason } : {}
+    ...insufficientSourceReason ? { insufficientSourceReason } : {}
   });
 }
 function applySignalAdjustment(nativeScore, dimension, signals) {
@@ -7919,6 +9755,31 @@ function statusForScore(score) {
   if (score > 0) return "critical";
   return "critical";
 }
+function statusAfterInputAdjustment(nativeStatus, nativeScore, adjustment, rubricVersion) {
+  if (adjustment === 0) return nativeStatus;
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V92 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17) {
+    return statusForScore(roundScore(Math.max(0, nativeScore - adjustment)));
+  }
+  const statusFloor = {
+    verified: 3.5,
+    info: 2.5,
+    warning: 1.5,
+    critical: 0
+  };
+  const severity = {
+    verified: 0,
+    info: 1,
+    warning: 2,
+    critical: 3
+  };
+  const floor = statusFloor[nativeStatus];
+  const nativeSeverity = severity[nativeStatus];
+  if (floor === void 0 || nativeSeverity === void 0) return nativeStatus;
+  const adjustedSemanticStatus = statusForScore(
+    roundScore(Math.max(0, Math.max(nativeScore, floor) - adjustment))
+  );
+  return (severity[adjustedSemanticStatus] ?? nativeSeverity) > nativeSeverity ? adjustedSemanticStatus : nativeStatus;
+}
 function mergeSignalsByCriterion(signals) {
   const merged = /* @__PURE__ */ new Map();
   for (const signal of signals) {
@@ -7940,7 +9801,7 @@ function mergeSignalsByCriterion(signals) {
   return merged;
 }
 function usesMetricScoring(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
 }
 function unmeasuredStatus(rubricVersion) {
   return rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0 ? "unverified" : "insufficient_data";
@@ -7981,13 +9842,31 @@ function scoreCriterion(signal, rubricVersion) {
   }
   if (usesMetricScoring(rubricVersion)) {
     const measuredMetrics = metrics.length > 0 ? metrics : fallbackMetricsForEvidence(evidence, findings);
-    const score = capScoreForFindings(scoreMetrics(measuredMetrics), findings);
-    const status = statusForScoreAndFindings(score, findings);
+    const score = capScoreForFindings(
+      scoreMetrics(measuredMetrics),
+      findings,
+      rubricVersion,
+      signal.criterionId
+    );
+    const status = statusForScoreAndFindings(
+      signal.criterionId,
+      score,
+      findings,
+      measuredMetrics,
+      rubricVersion
+    );
     return {
       score,
       status,
       evidence,
-      findings: ensureFindingsExplainStatus(signal.criterionId, score, status, findings, evidence),
+      findings: ensureFindingsExplainStatus(
+        signal.criterionId,
+        score,
+        status,
+        findings,
+        evidence,
+        rubricVersion
+      ),
       metrics: measuredMetrics
     };
   }
@@ -8050,29 +9929,261 @@ function scoreMetrics(metrics) {
   if (totalWeight === 0) return 0;
   return roundScore(weightedTotal / totalWeight * 4);
 }
-function capScoreForFindings(score, findings) {
-  if (findings.some((finding) => finding.severity === "critical")) return 1.4;
+function capScoreForFindings(score, findings, rubricVersion, criterionId) {
+  if (findings.some((finding) => finding.severity === "critical")) {
+    const criticalFindings = findings.filter(({ severity }) => severity === "critical");
+    const authenticatedA1Absence = rubricVersion === WITAN_RUBRIC_VERSION_V17 && criterionId === "A1" && criticalFindings.length === 1 && criticalFindings[0]?.summary === WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY;
+    return authenticatedA1Absence ? Math.min(score, 1.4) : 1.4;
+  }
   if (findings.some((finding) => finding.severity === "warning")) return Math.min(score, 2.4);
   if (findings.some((finding) => finding.severity === "info")) return Math.min(score, 3.4);
   return score;
 }
-function statusForScoreAndFindings(score, findings) {
+function statusForScoreAndFindings(criterionId, score, findings, metrics, rubricVersion) {
   if (findings.some((finding) => finding.severity === "critical")) return "critical";
+  if (rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) {
+    const calibrated = rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 ? calibratedCriterionStateV11(criterionId, metrics) : rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 ? calibratedCriterionStateV9(criterionId, metrics) : calibratedCriterionStateV8(criterionId, metrics);
+    if (calibrated && calibrated !== "verified") return calibrated;
+    if (calibrated === "verified" && !findings.some((finding) => finding.severity === "warning")) {
+      return "verified";
+    }
+  }
   if (findings.some((finding) => finding.severity === "warning")) return "warning";
   if (score >= 3.5 && findings.length === 0) return "verified";
   if (score >= 2.5) return "info";
   if (score >= 1.5) return "warning";
   return "critical";
 }
-function ensureFindingsExplainStatus(criterionId, score, status, findings, evidence) {
-  if (findings.length > 0) return [...findings];
+function calibratedCriterionStateV8(criterionId, metrics) {
+  const values = new Map(metrics.map(({ name, value: value2 }) => [name, value2]));
+  if (values.size !== metrics.length) return void 0;
+  const value = (name) => values.get(name);
+  const positive = (name) => (value(name) ?? 0) > 0;
+  if (criterionId === "A1") {
+    if (!values.has("non_hollow_test_share") || !values.has("verification_script_ratio")) {
+      return void 0;
+    }
+    if (!positive("non_hollow_test_share")) return "critical";
+    return positive("verification_script_ratio") ? "verified" : "warning";
+  }
+  if (criterionId === "A2") {
+    if (!values.has("secret_cleanliness") || !values.has("env_handling_depth")) return void 0;
+    if (!positive("secret_cleanliness")) return "critical";
+    return (value("env_handling_depth") ?? 0) >= 2 ? "verified" : "warning";
+  }
+  if (criterionId === "A3") {
+    if (!values.has("observability_depth") || !values.has("rollback_safety_depth")) {
+      return void 0;
+    }
+    const coveredSurfaces = Number(positive("observability_depth")) + Number(positive("rollback_safety_depth"));
+    return coveredSurfaces === 2 ? "verified" : coveredSurfaces === 1 ? "warning" : "critical";
+  }
+  if (criterionId === "A4") {
+    if (!values.has("dependency_automation_ratio") || !values.has("declared_version_range_ratio") && !values.has("pinned_dependency_ratio")) {
+      return void 0;
+    }
+    const dependencyCountSanity = value("dependency_count_sanity");
+    if (dependencyCountSanity !== void 0) {
+      if (dependencyCountSanity <= 0) return "critical";
+      if (dependencyCountSanity < 0.9) return "warning";
+    }
+    const hasVersionControl = positive("declared_version_range_ratio") || positive("pinned_dependency_ratio");
+    const hasLockfile = positive("lockfile_coverage");
+    const hasAutomation = positive("dependency_automation_ratio");
+    if (!hasVersionControl && !hasLockfile && !hasAutomation) return "critical";
+    return hasAutomation && (hasVersionControl || hasLockfile) ? "verified" : "warning";
+  }
+  if (criterionId === "B2") {
+    if (!values.has("pr_trace_primitives") || !values.has("pr_merge_ratio")) return void 0;
+    return positive("pr_trace_primitives") && positive("pr_merge_ratio") ? "verified" : "warning";
+  }
+  if (criterionId === "B3") {
+    if (!values.has("ci_script_depth") || !values.has("default_branch_ci_depth")) return void 0;
+    const coveredSurfaces = Number(positive("ci_script_depth")) + Number(positive("default_branch_ci_depth"));
+    return coveredSurfaces === 2 ? "verified" : coveredSurfaces === 1 ? "warning" : "critical";
+  }
+  if (criterionId === "B4") {
+    if (!values.has("audit_artifact_depth") || !values.has("audit_freshness_depth")) {
+      return void 0;
+    }
+    if (!positive("audit_artifact_depth")) return "critical";
+    return positive("audit_freshness_depth") ? "verified" : "warning";
+  }
+  if (criterionId === "B6") {
+    if (!values.has("human_gate_documented") || !values.has("fail_closed_privilege_check")) {
+      return void 0;
+    }
+    return positive("human_gate_documented") || positive("fail_closed_privilege_check") ? "verified" : "critical";
+  }
+  return void 0;
+}
+function calibratedCriterionStateV9(criterionId, metrics) {
+  const values = new Map(metrics.map(({ name, value: value2 }) => [name, value2]));
+  if (values.size !== metrics.length) return void 0;
+  const value = (name) => values.get(name);
+  const positive = (name) => (value(name) ?? 0) > 0;
+  if (criterionId === "A1") {
+    if (!values.has("non_hollow_test_share") || !values.has("verification_script_ratio")) {
+      return void 0;
+    }
+    const nonHollowTests = value("non_hollow_test_share") ?? 0;
+    if (nonHollowTests === 0) return "critical";
+    return positive("verification_script_ratio") && nonHollowTests >= 3 ? "verified" : "warning";
+  }
+  if (criterionId === "A2") {
+    if (!values.has("secret_cleanliness") || !values.has("env_handling_depth")) return void 0;
+    if (!positive("secret_cleanliness")) return "critical";
+    return (value("env_handling_depth") ?? 0) >= 2 ? "verified" : "warning";
+  }
+  if (criterionId === "A3") {
+    if (!values.has("prod_readiness_primitives") || !values.has("prod_workflow_depth") || !values.has("observability_depth") || !values.has("rollback_safety_depth")) {
+      return void 0;
+    }
+    const observability = value("observability_depth") ?? 0;
+    const rollback = value("rollback_safety_depth") ?? 0;
+    if (observability > 0 && rollback > 0) {
+      return (value("prod_readiness_primitives") ?? 0) >= 4 && observability >= 2 && rollback >= 2 ? "verified" : "warning";
+    }
+    if (observability > 0 || rollback > 0) return "warning";
+    return (value("prod_readiness_primitives") ?? 0) >= 2 && (value("prod_workflow_depth") ?? 0) >= 8 ? "warning" : "critical";
+  }
+  if (criterionId === "A4") {
+    if (!values.has("dependency_automation_ratio") || !values.has("declared_version_range_ratio") && !values.has("pinned_dependency_ratio")) {
+      return void 0;
+    }
+    const dependencyCountSanity = value("dependency_count_sanity");
+    if (dependencyCountSanity !== void 0) {
+      if (dependencyCountSanity <= 0.25) return "critical";
+      if (dependencyCountSanity < 0.5) return "warning";
+    }
+    const hasVersionControl = positive("declared_version_range_ratio") || positive("pinned_dependency_ratio");
+    const hasLockfile = positive("lockfile_coverage");
+    const hasAutomation = positive("dependency_automation_ratio");
+    if (!hasVersionControl && !hasLockfile && !hasAutomation) return "warning";
+    return hasAutomation && (hasVersionControl || hasLockfile) ? "verified" : "warning";
+  }
+  if (criterionId === "B2") {
+    if (!values.has("pr_trace_primitives") || !values.has("pr_merge_ratio")) return void 0;
+    const primitives = value("pr_trace_primitives") ?? 0;
+    const mergedOutcomes = value("pr_merge_ratio") ?? 0;
+    if (mergedOutcomes === 0) return primitives <= 2 ? "critical" : "warning";
+    return mergedOutcomes >= 4 ? "verified" : "warning";
+  }
+  if (criterionId === "B3") {
+    if (!values.has("ci_script_depth") || !values.has("default_branch_ci_depth")) return void 0;
+    const scriptDepth = value("ci_script_depth") ?? 0;
+    const branchDepth = value("default_branch_ci_depth") ?? 0;
+    if (scriptDepth === 0 && branchDepth === 0) return "critical";
+    return scriptDepth >= 2 && branchDepth > 0 ? "verified" : "warning";
+  }
+  if (criterionId === "B4") {
+    if (!values.has("audit_artifact_depth") || !values.has("audit_freshness_depth")) {
+      return void 0;
+    }
+    const artifacts = value("audit_artifact_depth") ?? 0;
+    const freshness = value("audit_freshness_depth") ?? 0;
+    if (artifacts === 0) return "critical";
+    return artifacts >= 2 || freshness >= 2 ? "verified" : "warning";
+  }
+  if (criterionId === "B6") {
+    const humanGate = value("human_gate_documented") ?? 0;
+    const failClosed = value("fail_closed_privilege_check") ?? 0;
+    if (humanGate > 0 || failClosed > 0) return "verified";
+    if (positive("privilege_escalation_cleanliness") || positive("protected_path_review_gate")) {
+      return "warning";
+    }
+    if (values.has("human_gate_documented") || values.has("fail_closed_privilege_check") || values.has("privilege_escalation_cleanliness") || values.has("protected_path_review_gate")) {
+      return "critical";
+    }
+  }
+  return void 0;
+}
+function calibratedCriterionStateV11(criterionId, metrics) {
+  const values = new Map(metrics.map(({ name, value: value2 }) => [name, value2]));
+  if (values.size !== metrics.length) return void 0;
+  const value = (name) => values.get(name);
+  const positive = (name) => (value(name) ?? 0) > 0;
+  if (criterionId === "A1") {
+    if (!values.has("non_hollow_test_share") || !values.has("verification_script_ratio")) {
+      return void 0;
+    }
+    if (!positive("non_hollow_test_share")) return "critical";
+    return positive("verification_script_ratio") ? "verified" : "warning";
+  }
+  if (criterionId === "A2") {
+    if (!values.has("secret_cleanliness") || !values.has("env_handling_depth")) return void 0;
+    if (!positive("secret_cleanliness")) return "critical";
+    return positive("env_handling_depth") ? "verified" : "warning";
+  }
+  if (criterionId === "A3") {
+    if (!values.has("prod_readiness_primitives") || !values.has("prod_workflow_depth") || !values.has("observability_depth") || !values.has("rollback_safety_depth")) {
+      return void 0;
+    }
+    const primitives = value("prod_readiness_primitives") ?? 0;
+    const workflow = value("prod_workflow_depth") ?? 0;
+    const observability = value("observability_depth") ?? 0;
+    const rollback = value("rollback_safety_depth") ?? 0;
+    if (observability > 0 && rollback > 0) return primitives >= 3 ? "verified" : "warning";
+    return primitives > 0 && workflow > 0 ? "warning" : "critical";
+  }
+  if (criterionId === "A4") {
+    if (!values.has("dependency_automation_ratio") || !values.has("declared_version_range_ratio") && !values.has("pinned_dependency_ratio")) {
+      return void 0;
+    }
+    const hasVersionControl = positive("declared_version_range_ratio") || positive("pinned_dependency_ratio");
+    const hasLockfile = positive("lockfile_coverage");
+    const hasAutomation = positive("dependency_automation_ratio");
+    if (!hasVersionControl && !hasLockfile && !hasAutomation) return "critical";
+    return hasAutomation && (hasVersionControl || hasLockfile) ? "verified" : "warning";
+  }
+  if (criterionId === "B2") {
+    if (!values.has("pr_trace_primitives") || !values.has("pr_merge_ratio")) return void 0;
+    if (!positive("pr_trace_primitives")) return "critical";
+    return positive("pr_merge_ratio") ? "verified" : "warning";
+  }
+  if (criterionId === "B3") {
+    if (!values.has("ci_script_depth") || !values.has("default_branch_ci_depth")) return void 0;
+    const covered = Number(positive("ci_script_depth")) + Number(positive("default_branch_ci_depth"));
+    return covered === 2 ? "verified" : covered === 1 ? "warning" : "critical";
+  }
+  if (criterionId === "B4") {
+    if (!values.has("audit_artifact_depth") || !values.has("audit_freshness_depth")) {
+      return void 0;
+    }
+    if (!positive("audit_artifact_depth")) return "critical";
+    return positive("audit_freshness_depth") ? "verified" : "warning";
+  }
+  if (criterionId === "B6") {
+    const humanGate = positive("human_gate_documented");
+    const failClosed = positive("fail_closed_privilege_check");
+    const cleanAndReviewed = positive("privilege_escalation_cleanliness") && positive("protected_path_review_gate");
+    if (humanGate || failClosed || cleanAndReviewed) return "verified";
+    if (positive("privilege_escalation_cleanliness") || positive("protected_path_review_gate")) {
+      return "warning";
+    }
+    if (values.has("human_gate_documented") || values.has("fail_closed_privilege_check") || values.has("privilege_escalation_cleanliness") || values.has("protected_path_review_gate")) {
+      return "critical";
+    }
+  }
+  return void 0;
+}
+function ensureFindingsExplainStatus(criterionId, score, status, findings, evidence, rubricVersion) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V92 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && findings.length > 0) {
+    return [...findings];
+  }
   if (status !== "critical" && status !== "warning") return [...findings];
+  if (findings.some(
+    ({ severity }) => severity === "critical" || status === "warning" && severity === "warning"
+  )) {
+    return [...findings];
+  }
   const anchor = evidence[0] ?? {
     kind: "repository",
     label: `${criterionId} metric-derived score`,
     path: "."
   };
   return [
+    ...findings,
     {
       severity: status,
       summary: `${criterionId} metric-derived score is ${score.toFixed(1)}/4.0, in the ${status} band \u2014 no single finding drove this; it reflects the combined metric weighting below.`,
@@ -8098,7 +10209,8 @@ function scoreRepoWithPublicCejel(options) {
     productSlug: options.productSlug,
     productDisplayName: options.productDisplayName,
     repoPath: options.repoPath,
-    ...options.generatedAt ? { generatedAt: options.generatedAt } : {}
+    ...options.generatedAt ? { generatedAt: options.generatedAt } : {},
+    ...options.rubricVersion ? { rubricVersion: options.rubricVersion } : {}
   });
   const inputSignals = resolvePublicIngestSignals(options);
   return createWitanReport(input, inputSignals.length > 0 ? inputSignals : void 0);
@@ -8163,6 +10275,87 @@ function slugify(raw) {
   return FALLBACK_SLUG;
 }
 
+// src/finding-presentation.ts
+var METRIC_DERIVED_FINDING_PATTERN2 = /^[A-Z]\d+ metric-derived score is (\d+\.\d)\/4\.0, in the (critical|warning) band — no single finding drove this; it reflects the combined metric weighting below\.$/;
+var REMEDIATION_BY_METRIC2 = {
+  test_to_source_ratio: "add concrete regression tests for the implementation surface",
+  coverage_percent: "configure coverage and publish a measured threshold or report",
+  verification_script_ratio: "add explicit test, lint, and typecheck verification commands",
+  non_hollow_test_share: "replace skipped or placeholder tests with live assertions",
+  env_handling_depth: "document and enforce safe environment-secret handling",
+  secret_cleanliness: "remove committed secrets and rotate any exposed credentials",
+  tenant_scope_ratio: "apply tenant scoping consistently across data access",
+  rls_policy_count: "add database row-level security policies where the data model requires them",
+  crypto_comparison_hygiene: "use constant-time comparison for signature or MAC checks",
+  prod_readiness_primitives: "add the missing deployment-readiness controls",
+  observability_depth: "add health checks, structured logging, and error boundaries",
+  rollback_safety_depth: "document and test rollback or recovery procedures",
+  pinned_dependency_ratio: "pin application dependencies that determine the deployed artifact",
+  lockfile_coverage: "commit the package-manager lockfile used by CI and deployment",
+  dependency_automation_ratio: "enable automated dependency updates and an audit command",
+  declared_version_range_ratio: "declare an explicit compatible version for every dependency",
+  dependency_count_sanity: "review and reduce unnecessary direct dependencies",
+  claim_match_rate: "align documented product claims with observable repository evidence",
+  claim_source_depth: "document concrete, checkable product claims",
+  reconciliation_artifact_depth: "publish a claim-to-evidence reconciliation record",
+  pr_merge_ratio: "preserve merged pull-request history in the scanned clone",
+  pr_trace_primitives: "add pull-request templates and outcome-trace records",
+  ci_script_depth: "run the repository verification commands in CI",
+  default_branch_ci_depth: "run CI on the default branch and pull requests",
+  prod_workflow_depth: "add a production or release verification workflow",
+  audit_artifact_depth: "publish changelog, incident, security, or audit records",
+  audit_freshness_depth: "keep the audit trail current",
+  human_gate_documented: "document which privileged operations require human approval",
+  protected_path_review_gate: "require review for changes to protected paths",
+  fail_closed_privilege_check: "make privileged-operation checks fail closed",
+  kill_switch_fail_safe_present: "add a fail-safe kill switch for privileged automation",
+  privilege_escalation_cleanliness: "remove unsafe privilege-escalation patterns"
+};
+function renderFindingSummary2(criterion, finding) {
+  const match = METRIC_DERIVED_FINDING_PATTERN2.exec(finding.summary);
+  if (!match) return finding.summary;
+  const score = match[1] ?? criterion.score.toFixed(1);
+  const band = match[2] ?? criterion.status;
+  const drivers = selectLowestDrivers2(criterion.metrics);
+  if (drivers.length === 0) {
+    return `${criterion.id} dimension band is ${band} at ${score}/4.0. To improve this dimension, add stronger measurable evidence for ${criterion.title.toLowerCase()}.`;
+  }
+  const measurements = drivers.map(formatMetricMember2).join("; ");
+  const actions = Array.from(
+    new Set(
+      drivers.map(
+        (metric2) => REMEDIATION_BY_METRIC2[metric2.name] ?? `raise the measured ${metric2.label.toLowerCase()}`
+      )
+    )
+  ).join("; ");
+  return `${criterion.id} dimension band is ${band} at ${score}/4.0. Lowest contributing measurements: ${measurements}. To improve: ${actions}.`;
+}
+function selectLowestDrivers2(metrics) {
+  return [...metrics].filter((metric2) => metric2.max !== void 0).sort((left, right) => {
+    const leftRatio = normalizedMetricValue2(left);
+    const rightRatio = normalizedMetricValue2(right);
+    if (leftRatio !== rightRatio) return leftRatio - rightRatio;
+    if (left.weight !== right.weight) return right.weight - left.weight;
+    return left.name.localeCompare(right.name);
+  }).slice(0, 2);
+}
+function normalizedMetricValue2(metric2) {
+  if (metric2.max === void 0) return 1;
+  return Math.min(metric2.value / metric2.max, 1);
+}
+function formatMetricMember2(metric2) {
+  const unit = metric2.unit ? ` ${metric2.unit}` : "";
+  const maximum = metric2.max;
+  if (maximum === void 0) return `${metric2.label} ${formatMetricValue3(metric2.value)}${unit}`;
+  if (metric2.kind === "saturating_count" && metric2.value > maximum) {
+    return `${metric2.label} ${formatMetricValue3(maximum)}${unit} capped (${formatMetricValue3(metric2.value)} raw)`;
+  }
+  return `${metric2.label} ${formatMetricValue3(metric2.value)}/${formatMetricValue3(maximum)}${unit}`;
+}
+function formatMetricValue3(value) {
+  return Number.isInteger(value) ? String(value) : value.toFixed(2).replace(/0+$/, "").replace(/\.$/, "");
+}
+
 // src/summary.ts
 var SEVERITY_RANK2 = {
   critical: 0,
@@ -8172,11 +10365,16 @@ var SEVERITY_RANK2 = {
 var TOP_FINDINGS_LIMIT = 5;
 function buildWitanCliSummary(report) {
   const allFindings = report.criteria.flatMap(
-    (criterion) => criterion.findings.map((finding) => ({
-      criterionId: criterion.id,
-      severity: finding.severity,
-      summary: finding.summary
-    }))
+    (criterion) => criterion.findings.map((finding) => {
+      const displaySummary = renderFindingSummary2(criterion, finding);
+      return {
+        criterionId: criterion.id,
+        severity: finding.severity,
+        dimensionBand: criterion.status,
+        summary: finding.summary,
+        ...displaySummary !== finding.summary ? { displaySummary } : {}
+      };
+    })
   );
   const sorted = [...allFindings].sort(
     (a, b) => SEVERITY_RANK2[a.severity] - SEVERITY_RANK2[b.severity]
@@ -8203,7 +10401,7 @@ function buildWitanCliSummary(report) {
       overallScore: null,
       codeTrustScore: null,
       processTrustScore: null,
-      verdict: "Insufficient source",
+      verdict: renderReportVerdict(report),
       insufficientSourceReason: report.insufficientSourceReason
     };
   }
@@ -8221,7 +10419,7 @@ function runCejelScan(options) {
   const identity = deriveProductIdentity(options.repoPath);
   const report = scoreRepoWithPublicCejel({
     productSlug: identity.productSlug,
-    productDisplayName: identity.productDisplayName,
+    productDisplayName: options.productDisplayName ?? identity.productDisplayName,
     repoPath: options.repoPath,
     ingestPatterns: options.ingestPatterns,
     warnOnEmptyIngestMatch: options.warnOnEmptyIngestMatch