@cejel/cejel 0.1.9 → 0.1.10

package/dist/{chunk-DVVBWBAA.js → chunk-EFOUXVJE.js}

@@ -4365,6 +4365,18 @@ var WitanAttestationStatementSchema = external_exports.object({
   }).strict()
 }).strict();
 
+// src/witan/abstention.ts
+var WITAN_NO_MEASUREMENT_REASON = "No free-core rubric criterion produced a measurable signal. Cejel abstains rather than publish a numeric zero for an entirely unmeasured repository.";
+var WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the complete tracked inventory contains no concrete test file, configured test runner, CI test command, or coverage configuration.";
+function isWitanNoMeasurementAbstention(report) {
+  return report.verdict === "insufficient_source" && report.insufficientSourceReason === WITAN_NO_MEASUREMENT_REASON && report.criteria.every(
+    ({ status }) => status === "not_applicable" || status === "insufficient_data"
+  );
+}
+function renderWitanAbstentionLabel(report) {
+  return isWitanNoMeasurementAbstention(report) ? "Insufficient evidence" : "Insufficient source";
+}
+
 // src/witan/coverage.ts
 var LOW_CONFIDENCE_COVERAGE_THRESHOLD = 0.5;
 function isMeasuredCriterionStatus(status) {
@@ -4451,6 +4463,87 @@ function collectExternalFindings(consumedSignals) {
   });
 }
 
+// src/witan/finding-presentation.ts
+var METRIC_DERIVED_FINDING_PATTERN = /^[A-Z]\d+ metric-derived score is (\d+\.\d)\/4\.0, in the (critical|warning) band — no single finding drove this; it reflects the combined metric weighting below\.$/;
+var REMEDIATION_BY_METRIC = {
+  test_to_source_ratio: "add concrete regression tests for the implementation surface",
+  coverage_percent: "configure coverage and publish a measured threshold or report",
+  verification_script_ratio: "add explicit test, lint, and typecheck verification commands",
+  non_hollow_test_share: "replace skipped or placeholder tests with live assertions",
+  env_handling_depth: "document and enforce safe environment-secret handling",
+  secret_cleanliness: "remove committed secrets and rotate any exposed credentials",
+  tenant_scope_ratio: "apply tenant scoping consistently across data access",
+  rls_policy_count: "add database row-level security policies where the data model requires them",
+  crypto_comparison_hygiene: "use constant-time comparison for signature or MAC checks",
+  prod_readiness_primitives: "add the missing deployment-readiness controls",
+  observability_depth: "add health checks, structured logging, and error boundaries",
+  rollback_safety_depth: "document and test rollback or recovery procedures",
+  pinned_dependency_ratio: "pin application dependencies that determine the deployed artifact",
+  lockfile_coverage: "commit the package-manager lockfile used by CI and deployment",
+  dependency_automation_ratio: "enable automated dependency updates and an audit command",
+  declared_version_range_ratio: "declare an explicit compatible version for every dependency",
+  dependency_count_sanity: "review and reduce unnecessary direct dependencies",
+  claim_match_rate: "align documented product claims with observable repository evidence",
+  claim_source_depth: "document concrete, checkable product claims",
+  reconciliation_artifact_depth: "publish a claim-to-evidence reconciliation record",
+  pr_merge_ratio: "preserve merged pull-request history in the scanned clone",
+  pr_trace_primitives: "add pull-request templates and outcome-trace records",
+  ci_script_depth: "run the repository verification commands in CI",
+  default_branch_ci_depth: "run CI on the default branch and pull requests",
+  prod_workflow_depth: "add a production or release verification workflow",
+  audit_artifact_depth: "publish changelog, incident, security, or audit records",
+  audit_freshness_depth: "keep the audit trail current",
+  human_gate_documented: "document which privileged operations require human approval",
+  protected_path_review_gate: "require review for changes to protected paths",
+  fail_closed_privilege_check: "make privileged-operation checks fail closed",
+  kill_switch_fail_safe_present: "add a fail-safe kill switch for privileged automation",
+  privilege_escalation_cleanliness: "remove unsafe privilege-escalation patterns"
+};
+function renderFindingSummary(criterion, finding) {
+  const match = METRIC_DERIVED_FINDING_PATTERN.exec(finding.summary);
+  if (!match) return finding.summary;
+  const score = match[1] ?? criterion.score.toFixed(1);
+  const band = match[2] ?? criterion.status;
+  const drivers = selectLowestDrivers(criterion.metrics);
+  if (drivers.length === 0) {
+    return `${criterion.id} dimension band is ${band} at ${score}/4.0. To improve this dimension, add stronger measurable evidence for ${criterion.title.toLowerCase()}.`;
+  }
+  const measurements = drivers.map(formatMetricMember).join("; ");
+  const actions = Array.from(
+    new Set(
+      drivers.map(
+        (metric2) => REMEDIATION_BY_METRIC[metric2.name] ?? `raise the measured ${metric2.label.toLowerCase()}`
+      )
+    )
+  ).join("; ");
+  return `${criterion.id} dimension band is ${band} at ${score}/4.0. Lowest contributing measurements: ${measurements}. To improve: ${actions}.`;
+}
+function selectLowestDrivers(metrics) {
+  return [...metrics].filter((metric2) => metric2.max !== void 0).sort((left, right) => {
+    const leftRatio = normalizedMetricValue(left);
+    const rightRatio = normalizedMetricValue(right);
+    if (leftRatio !== rightRatio) return leftRatio - rightRatio;
+    if (left.weight !== right.weight) return right.weight - left.weight;
+    return left.name.localeCompare(right.name);
+  }).slice(0, 2);
+}
+function normalizedMetricValue(metric2) {
+  if (metric2.max === void 0) return 1;
+  return Math.min(metric2.value / metric2.max, 1);
+}
+function formatMetricMember(metric2) {
+  const unit = metric2.unit ? ` ${metric2.unit}` : "";
+  const maximum = metric2.max;
+  if (maximum === void 0) return `${metric2.label} ${formatMetricValue(metric2.value)}${unit}`;
+  if (metric2.kind === "saturating_count" && metric2.value > maximum) {
+    return `${metric2.label} ${formatMetricValue(maximum)}${unit} capped (${formatMetricValue(metric2.value)} raw)`;
+  }
+  return `${metric2.label} ${formatMetricValue(metric2.value)}/${formatMetricValue(maximum)}${unit}`;
+}
+function formatMetricValue(value) {
+  return Number.isInteger(value) ? String(value) : value.toFixed(2).replace(/0+$/, "").replace(/\.$/, "");
+}
+
 // src/witan/html.ts
 function renderWitanHtmlReport(report) {
   const codeCriteria = criteriaByCategory(report, "code_trust");
@@ -4491,7 +4584,7 @@ function renderWitanHtmlReport(report) {
         </section>
         <aside class="score-panel" aria-label="Summary trust score">
           <div class="score-badge">Summary</div>
-          ${report.verdict === "insufficient_source" ? `<div class="verdict">Insufficient source</div>
+          ${report.verdict === "insufficient_source" ? `<div class="verdict">${escapeHtml(renderWitanAbstentionLabel(report))}</div>
           <p class="insufficient-note">${escapeHtml(report.insufficientSourceReason)}</p>` : `<div class="score">${formatScore(report.overallScore)}</div>
           <div class="score-unit">/ 4.0 overall</div>
           <div class="verdict">${escapeHtml(renderVerdict(report.overallScore))}</div>
@@ -4576,7 +4669,7 @@ function renderNotApplicableItem(criterion) {
 function renderCriterionCard(criterion) {
   const evidence = [
     ...criterion.evidence.map(renderEvidencePointer),
-    ...criterion.findings.map((finding) => renderFindingEvidence(finding))
+    ...criterion.findings.map((finding) => renderFindingEvidence(criterion, finding))
   ];
   const metrics = criterion.metrics.map(renderMetric);
   return `<article class="criterion">
@@ -4599,24 +4692,24 @@ function renderCriterionCard(criterion) {
 function renderMetric(metric2) {
   const unit = metric2.unit ? ` ${escapeHtml(metric2.unit)}` : "";
   if (metric2.kind === "saturating_count" && metric2.max !== void 0 && metric2.value > metric2.max) {
-    return `<strong>${escapeHtml(metric2.label)}</strong><span>${formatMetricValue(metric2.max)}${unit} (capped; ${formatMetricValue(metric2.value)} raw)</span>`;
+    return `<strong>${escapeHtml(metric2.label)}</strong><span>${formatMetricValue2(metric2.max)}${unit} (capped; ${formatMetricValue2(metric2.value)} raw)</span>`;
   }
-  const max = metric2.max ? `/${formatMetricValue(metric2.max)}` : "";
-  return `<strong>${escapeHtml(metric2.label)}</strong><span>${formatMetricValue(metric2.value)}${max}${unit}</span>`;
+  const max = metric2.max ? `/${formatMetricValue2(metric2.max)}` : "";
+  return `<strong>${escapeHtml(metric2.label)}</strong><span>${formatMetricValue2(metric2.value)}${max}${unit}</span>`;
 }
 function renderCategoryScore(score, coverage, category) {
   const categoryCoverage = coverage.byCategory.find((entry) => entry.category === category);
   return categoryCoverage !== void 0 && categoryCoverage.measured === 0 || score === null ? "not measured" : formatScore(score);
 }
 function renderStatusChip(status) {
-  return `<span class="status" data-status="${status}">${status}</span>`;
+  return `<span class="status" data-status="${status}">dimension band: ${status}</span>`;
 }
 function renderEvidenceListItem(criterion, evidence) {
   return `<li><strong>${escapeHtml(criterion.id)} - ${escapeHtml(criterion.title)}</strong><span>${renderEvidencePointer(evidence)}</span></li>`;
 }
 function renderOpenItems(criterion) {
   const findingItems = criterion.findings.map(
-    (finding) => `<li><strong>${escapeHtml(criterion.id)} - ${escapeHtml(criterion.title)}</strong><span>${escapeHtml(finding.severity)}: ${escapeHtml(finding.summary)} (${renderEvidencePointer(finding.evidence)})</span></li>`
+    (finding) => `<li><strong>${escapeHtml(criterion.id)} - ${escapeHtml(criterion.title)}</strong><span>finding severity ${escapeHtml(finding.severity)}: ${escapeHtml(renderFindingSummary(criterion, finding))} (${renderEvidencePointer(finding.evidence)})</span></li>`
   );
   if ((criterion.status === "unverified" || criterion.status === "insufficient_data") && criterion.evidence.length === 0 && criterion.findings.length === 0) {
     const message = criterion.status === "insufficient_data" ? "Insufficient data \u2014 no measurable signal; excluded from composite (unmeasured, not inapplicable)." : "No concrete evidence supplied.";
@@ -4627,10 +4720,8 @@ function renderOpenItems(criterion) {
   if (criterion.status === "verified") return [];
   return findingItems;
 }
-function renderFindingEvidence(finding) {
-  return `${escapeHtml(finding.severity)}: ${escapeHtml(finding.summary)} (${renderEvidencePointer(
-    finding.evidence
-  )})`;
+function renderFindingEvidence(criterion, finding) {
+  return `finding severity ${escapeHtml(finding.severity)}: ${escapeHtml(renderFindingSummary(criterion, finding))} (${renderEvidencePointer(finding.evidence)})`;
 }
 function renderEvidencePointer(evidence) {
   const target = evidence.url ?? renderPathEvidenceTarget(evidence);
@@ -4653,6 +4744,9 @@ function renderVerdict(score) {
   return renderMachineVerdict(witanVerdictForScore(score));
 }
 function renderReportVerdict(report) {
+  if (report.verdict === "insufficient_source") {
+    return renderWitanAbstentionLabel(report);
+  }
   return renderMachineVerdict(report.verdict);
 }
 function renderMachineVerdict(verdict) {
@@ -4672,7 +4766,7 @@ function renderMachineVerdict(verdict) {
 function formatScore(score) {
   return score.toFixed(1);
 }
-function formatMetricValue(value) {
+function formatMetricValue2(value) {
   return Number.isInteger(value) ? value.toString() : value.toFixed(2);
 }
 function formatDate(value) {
@@ -4799,16 +4893,19 @@ var VERDICT_COLOR = {
   Conditional: "yellow",
   "At risk": "orange",
   Unverified: "red",
-  "Insufficient source": "lightgrey"
+  "Insufficient source": "lightgrey",
+  "Insufficient evidence": "lightgrey"
 };
 var VERDICT_SVG_FILL = {
   Verified: "#2fc86a",
   Conditional: "#dfb92f",
   "At risk": "#e08a3c",
   Unverified: "#d64545",
-  "Insufficient source": "#8c8c8c"
+  "Insufficient source": "#8c8c8c",
+  "Insufficient evidence": "#8c8c8c"
 };
 function badgeMessage(report, verdict) {
+  if (isWitanNoMeasurementAbstention(report)) return "unrated: no measurable evidence";
   if (report.verdict === "insufficient_source") return "unrated: no source";
   return `${formatScore2(report.overallScore)}/4.0 ${verdict.toLowerCase()}`;
 }
@@ -4988,6 +5085,8 @@ var WITAN_RUBRIC_VERSION_V12 = "witan-rubric-v12-2026-07-23";
 var WITAN_RUBRIC_VERSION_V13 = "witan-rubric-v13-2026-07-23";
 var WITAN_RUBRIC_VERSION_V14 = "witan-rubric-v14-2026-07-23";
 var WITAN_RUBRIC_VERSION_V15 = "witan-rubric-v15-2026-07-24";
+var WITAN_RUBRIC_VERSION_V16 = "witan-rubric-v16-2026-07-24";
+var WITAN_RUBRIC_VERSION_V17 = "witan-rubric-v17-2026-07-24";
 
 // src/witan/repo-signals.ts
 function buildWitanInputFromRepo(options) {
@@ -4997,25 +5096,44 @@ function buildWitanInputFromRepo(options) {
   const headSha = readGitHead(options.repoPath);
   const repoFiles = listRepoFiles(options.repoPath);
   const inventoryFiles = listRepoInventory(options.repoPath, repoFiles);
+  const ignoredTargetReason = repoFiles.length === 0 ? explainIgnoredScanTarget(options.repoPath) : void 0;
+  const usesV17Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V17;
   const structuralArchetype = classifyRepoArchetype(inventoryFiles, rubricVersion);
-  const readableArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 ? applyReadableSourceRepresentationGate(
+  const readableArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 ? applyReadableSourceRepresentationGate(
     options.repoPath,
     inventoryFiles,
     structuralArchetype,
     headSha,
     rubricVersion
   ) : structuralArchetype;
-  const archetype = rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 ? applySemanticSourceRepresentationGate(
+  const gatedArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 ? applySemanticSourceRepresentationGate(
     options.repoPath,
     inventoryFiles,
     readableArchetype,
     rubricVersion
   ) : readableArchetype;
-  const usesV8Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15;
-  const usesV33Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15;
-  const usesV36Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15;
-  const usesV39Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15;
-  const usesV47Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V15;
+  const usesV8Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17;
+  const usesV33Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17;
+  const usesV36Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17;
+  const usesV39Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17;
+  const usesV47Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17;
+  const reviewableSourceProof = usesV17Detectors ? buildReviewableSourceProof(options.repoPath, inventoryFiles, headSha, rubricVersion) : void 0;
+  const coreSignals = collectRepoSignals(
+    options.repoPath,
+    generatedAt,
+    repoFiles,
+    usesV8Detectors,
+    usesV33Detectors,
+    usesV36Detectors,
+    usesV39Detectors,
+    usesV47Detectors,
+    reviewableSourceProof
+  );
+  const archetype = usesV17Detectors && reviewableSourceProof?.passes === true && isV17RescuableAbstention(gatedArchetype.abstentionKind) && coreSignals.some(isMeasuredCriterionSignal) ? {
+    archetype: isLikelyMonorepo(inventoryFiles) ? "monorepo" : "source",
+    sourceFileCount: gatedArchetype.sourceFileCount,
+    totalFileCount: gatedArchetype.totalFileCount
+  } : gatedArchetype;
   return {
     productSlug: options.productSlug,
     productDisplayName: options.productDisplayName,
@@ -5026,23 +5144,21 @@ function buildWitanInputFromRepo(options) {
     generatedAt,
     ...options.rubricVersion ? { rubricVersion: options.rubricVersion } : {},
     archetype: archetype.archetype,
-    ...archetype.insufficientSourceReason ? { insufficientSourceReason: archetype.insufficientSourceReason } : {},
+    ...ignoredTargetReason ?? archetype.insufficientSourceReason ? { insufficientSourceReason: ignoredTargetReason ?? archetype.insufficientSourceReason } : {},
     signals: [
-      ...collectRepoSignals(
-        options.repoPath,
-        generatedAt,
-        repoFiles,
-        usesV8Detectors,
-        usesV33Detectors,
-        usesV36Detectors,
-        usesV39Detectors,
-        usesV47Detectors
-      ),
+      ...coreSignals,
       ...(options.domainCollectors ?? []).map((collect) => collect(options.repoPath, repoFiles)),
       ...options.additionalSignals ?? []
     ]
   };
 }
+function isV17RescuableAbstention(kind) {
+  return kind === "artifact_dominance" || kind === "docs_source_role" || kind === "readable_representation" || kind === "semantic_auxiliary";
+}
+function isMeasuredCriterionSignal(signal) {
+  if (signal.notApplicable === true) return false;
+  return (signal.metrics?.length ?? 0) > 0 || (signal.positiveEvidence?.length ?? 0) > 0 || (signal.findings?.length ?? 0) > 0;
+}
 var SOURCE_LANGUAGES = [
   {
     name: "JS/TS",
@@ -5118,13 +5234,14 @@ var SOURCE_EXTENSION_PATTERN_V10 = new RegExp(
   "i"
 );
 function isRecognizedSourcePath(path, rubricVersion = WITAN_RUBRIC_VERSION) {
-  return (rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 ? SOURCE_EXTENSION_PATTERN_V10 : SOURCE_EXTENSION_PATTERN).test(path);
+  return (rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 ? SOURCE_EXTENSION_PATTERN_V10 : SOURCE_EXTENSION_PATTERN).test(path);
 }
 var BUNDLED_BINARY_EXTENSION_PATTERN = /\.(vsix|zip|tgz|whl|exe|dmg|pkg|msi|jar|war|apk|ipa|dll|dylib|ttf|otf|woff2?|eot|eps)$/i;
 var DOCS_OR_MEDIA_EXTENSION_PATTERN = /\.(md|mdx|rst|png|jpe?g|gif|svg|webp|ico|pdf)$/i;
 var ARTIFACT_DOMINANCE_EXTENSION_PATTERN = /\.(vsix|zip|tgz|whl|exe|dmg|pkg|msi|jar|war|apk|ipa|dll|dylib|ttf|otf|woff2?|eot|eps|png|jpe?g|gif|svg|webp|ico|pdf)$/i;
 var DOC_DISTRIBUTION_COMPANION_PATTERN = /(^|\/)(LICENSE|LICENCE|NOTICE|COPYING|AUTHORS|CONTRIBUTORS|CODE_OF_CONDUCT)(\.[A-Za-z0-9]+)?$/i;
 var GENERATED_OR_VENDOR_PATH_PATTERN = /(^|\/)(vendor|vendors|dist|build|generated|gen|coverage|node_modules|site-packages|\.venv|venv|\.next|__pycache__|\.terraform|public\/assets|static\/assets)(\/|$)|(^|\/)[^/]+\.min\.(?:js|css)$/i;
+var V17_BUILD_OR_DEPENDENCY_CACHE_PATH_PATTERN = /(^|\/)(?:target|_build|\.build|DerivedData|Pods|Carthage\/Build|\.cache|\.gradle|\.m2|\.yarn\/cache|\.pnpm-store|\.dart_tool|\.tox|\.pytest_cache|\.ruff_cache|\.mypy_cache|\.turbo|\.parcel-cache|\.angular\/cache|\.svelte-kit|\.nuxt|bazel-(?:bin|out|testlogs)|buck-out)(\/|$)/i;
 var INDEPENDENT_CATALOG_PATH_PATTERN = /(^|\/)(solutions?|exercises?|challenges?|algorithms?)(\/|$)/i;
 var KNOWN_NON_SOURCE_EXTENSION_PATTERN = /\.(json|jsonc|json5|ya?ml|toml|txt|lock|xml|csv|tsv|ini|cfg|conf|cnf|properties|env|sum|mod|graphql|gql|proto|sarif|editorconfig|gitignore|gitattributes|npmrc|nvmrc|dockerignore|prettierignore|prettierrc|log|stderr|snap|grit|po|mo|dbf|shp|shx|egg|pem|key|csr|ai|txt\.license|pf|in|case|common|fortls)$/i;
 var V13_NON_SOURCE_EXTENSION_PATTERN = /\.(?:\d+|class|py[co]|gz|bz2|xz|7z|rar|mat|npy|npz|h5|hdf5|onnx|pt|pth|ckpt|safetensors|crt|cer|der|p12|pfx|diff|patch|plist|pbxproj|xcworkspacedata|xcbuild|xcplayground|xcscheme|xcsettings|xcconfig|xcprivacy|xcstrings|csproj|fsproj|vbproj|sln|slnf|props|targets|projitems|shproj|pubxml|resw|resources|storyboard|xib|entitlements|modulemap|podspec|nuspec|appxmanifest|webmanifest|manifest|map|fls|aux|bbl|bib|ocm|tdb|db|sqlite|sqlcipher\d*|bin|dat|pdb|prj|resolved|sim|input|list|fig|drawio|puml|sketch|icns|flac|wav|mp3|mp4|mov|avi|mkv|nv21|xls[xb]?|mex[a-z0-9_]*|gitconfig|profile|yapf|config|desktop|typed|example|bak|_|test(?:_[a-z0-9]+)*_location_override|xamltest|tld(?:_[a-z0-9]+)?|xsd|cmake|gradle|mk|am|pro|upri|dockerfile|dockergen|makefile|alpine|android|debian|ubuntu\d+|cuda\d+_ubuntu\d+|manylinux[a-z0-9_]*)$/i;
@@ -5148,6 +5265,7 @@ function classifyRepoArchetype(repoFiles, rubricVersion = WITAN_RUBRIC_VERSION)
       archetype: "empty",
       sourceFileCount: 0,
       totalFileCount: 0,
+      abstentionKind: "empty",
       insufficientSourceReason: "Repository has no tracked files \u2014 there is nothing to certify."
     };
   }
@@ -5159,6 +5277,7 @@ function classifyRepoArchetype(repoFiles, rubricVersion = WITAN_RUBRIC_VERSION)
       archetype: "generated_only",
       sourceFileCount,
       totalFileCount,
+      abstentionKind: "generated_only",
       insufficientSourceReason: `${generatedSourceFiles.length} of ${sourceFileCount} source-shaped file(s) are under generated, vendor, build, distribution, coverage, or bundled-asset paths; only ${sourceFileCount - generatedSourceFiles.length} authored source-shaped file(s) remain. Cejel abstains because generated/vendor output is not a reviewable implementation surface. ${INGEST_POINTER}`
     };
   }
@@ -5170,10 +5289,11 @@ function classifyRepoArchetype(repoFiles, rubricVersion = WITAN_RUBRIC_VERSION)
       archetype: "non_cohesive_source",
       sourceFileCount,
       totalFileCount,
+      abstentionKind: "independent_catalog",
       insufficientSourceReason: `${catalogSourceFiles.length} of ${sourceFileCount} source-shaped file(s) are under independent solution, exercise, challenge, or algorithm catalog paths; only ${sourceFileCount - catalogSourceFiles.length} source-shaped file(s) remain outside that catalog. Cejel abstains because the repository does not expose one cohesive product implementation to score. ${INGEST_POINTER}`
     };
   }
-  if (rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15) {
+  if (rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) {
     const authoredSourceFiles = sourceFiles.filter(isAuthoredProductionPath);
     const documentationFiles = repoFiles.filter(
       (file) => DOCS_OR_MEDIA_EXTENSION_PATTERN.test(file)
@@ -5183,6 +5303,7 @@ function classifyRepoArchetype(repoFiles, rubricVersion = WITAN_RUBRIC_VERSION)
         archetype: "docs_only",
         sourceFileCount,
         totalFileCount,
+        abstentionKind: "docs_source_role",
         insufficientSourceReason: `${sourceFileCount} source-shaped file(s) are tests/fixtures around a documentation tree; no authored product source remains. Cejel abstains because documentation tests do not support a product-source headline score. ${INGEST_POINTER}`
       };
     }
@@ -5190,11 +5311,12 @@ function classifyRepoArchetype(repoFiles, rubricVersion = WITAN_RUBRIC_VERSION)
       (file) => ARTIFACT_DOMINANCE_EXTENSION_PATTERN.test(file)
     );
     const materialFiles = authoredSourceFiles.length + artifactFiles.length;
-    if (artifactFiles.length >= 10 && (authoredSourceFiles.length <= 10 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15) && materialFiles > 0 && authoredSourceFiles.length / materialFiles <= 0.1) {
+    if (artifactFiles.length >= 10 && (authoredSourceFiles.length <= 10 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) && materialFiles > 0 && authoredSourceFiles.length / materialFiles <= 0.1) {
       return {
         archetype: "binary_only",
         sourceFileCount,
         totalFileCount,
+        abstentionKind: "artifact_dominance",
         insufficientSourceReason: `${authoredSourceFiles.length} authored source-shaped file(s) accompany ${artifactFiles.length} packaged, font, image, or media artifact(s); the source is sparse tooling rather than a representative product implementation. Cejel abstains because incidental tooling cannot support a product-source headline score. ${INGEST_POINTER}`
       };
     }
@@ -5208,6 +5330,7 @@ function classifyRepoArchetype(repoFiles, rubricVersion = WITAN_RUBRIC_VERSION)
         archetype: "binary_only",
         sourceFileCount,
         totalFileCount,
+        abstentionKind: "binary_distribution",
         insufficientSourceReason: `${sourceFileCount} source file(s) found among ${totalFileCount} tracked file(s); repo appears to be a binary/bundled-distribution tree (e.g. ${sample ? basename(sample) : "a packaged artifact"}) \u2014 cejel rates source, not binaries. ${INGEST_POINTER}`
       };
     }
@@ -5215,11 +5338,12 @@ function classifyRepoArchetype(repoFiles, rubricVersion = WITAN_RUBRIC_VERSION)
     const docsDistributionFiles = repoFiles.filter(
       (file) => DOCS_OR_MEDIA_EXTENSION_PATTERN.test(file) || DOC_DISTRIBUTION_COMPANION_PATTERN.test(file)
     );
-    if (docsFiles.length > 0 && (docsDistributionFiles.length === totalFileCount || (rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15) && unrecognisedSourceFiles.length === 0)) {
+    if (docsFiles.length > 0 && (docsDistributionFiles.length === totalFileCount || (rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) && unrecognisedSourceFiles.length === 0)) {
       return {
         archetype: "docs_only",
         sourceFileCount,
         totalFileCount,
+        abstentionKind: "docs_distribution",
         insufficientSourceReason: `${sourceFileCount} source file(s) found among ${totalFileCount} tracked file(s); repo appears to be a docs/distribution tree (README/markdown/media), not a source tree \u2014 cejel rates source, not docs. ${INGEST_POINTER}`
       };
     }
@@ -5333,6 +5457,33 @@ function isRepresentativeSourceText(contents) {
 function representativeSourceRank(rankKey, file) {
   return createHash2("sha256").update(`${rankKey}:${file}`).digest("hex");
 }
+function buildReviewableSourceProof(repoPath, repoFiles, headSha, rubricVersion) {
+  const sourceShapedFiles = repoFiles.filter(
+    (path) => isRecognizedSourcePath(path, rubricVersion) || isUnrecognisedSourcePath(path, rubricVersion) || /\.ipynb$/i.test(path)
+  );
+  const eligibleSourceFiles = sourceShapedFiles.filter(
+    (path) => !GENERATED_OR_VENDOR_PATH_PATTERN.test(path) && !V17_BUILD_OR_DEPENDENCY_CACHE_PATH_PATTERN.test(path) && (SOURCE_EXTENSION_PATTERN.test(path) || /\.m$/i.test(path))
+  );
+  const sample = selectProportionalRepresentativeSourceFiles(
+    eligibleSourceFiles,
+    `witan-v17-reviewable-source:${headSha ?? "unversioned"}`,
+    READABLE_SOURCE_REPRESENTATION_SAMPLE_LIMIT_V13
+  );
+  const readablePaths = sample.filter((file) => {
+    const contents = readRepresentativeSourceText(repoPath, file);
+    return contents !== null && isRepresentativeSourceText(contents);
+  });
+  const ratableShare = sourceShapedFiles.length === 0 ? 0 : eligibleSourceFiles.length / sourceShapedFiles.length;
+  const readableShare = sample.length === 0 ? 0 : readablePaths.length / sample.length;
+  return {
+    sourceShapedFileCount: sourceShapedFiles.length,
+    eligibleSourceFileCount: eligibleSourceFiles.length,
+    sampledFileCount: sample.length,
+    readableSampledFileCount: readablePaths.length,
+    ...readablePaths[0] ? { firstReadablePath: readablePaths[0] } : {},
+    passes: eligibleSourceFiles.length > 0 && ratableShare >= 0.2 && readablePaths.length > 0 && (readableShare >= 0.75 || readablePaths.length >= 8)
+  };
+}
 function applyReadableSourceRepresentationGate(repoPath, repoFiles, classification, headSha, rubricVersion) {
   if (classification.archetype !== "source" && classification.archetype !== "monorepo") {
     return classification;
@@ -5379,6 +5530,7 @@ function applyReadableSourceRepresentationGate(repoPath, repoFiles, classificati
     archetype: "non_cohesive_source",
     sourceFileCount: classification.sourceFileCount,
     totalFileCount: classification.totalFileCount,
+    abstentionKind: "readable_representation",
     insufficientSourceReason: `Readable source representation covers ${readableCountLabel} of ${authoredSourceFiles.length} authored source-shaped file(s) (${readablePct}%); this is below the ${thresholdPct}% representation threshold. Cejel abstains because unreadable, compressed, binary-shaped, or opaque source families cannot support a representative headline score. ${INGEST_POINTER}`
   };
 }
@@ -5413,6 +5565,7 @@ function applySemanticSourceRepresentationGate(repoPath, repoFiles, classificati
       archetype: "non_cohesive_source",
       sourceFileCount: classification.sourceFileCount,
       totalFileCount: classification.totalFileCount,
+      abstentionKind: "semantic_auxiliary",
       insufficientSourceReason: `${detail} provide no representative product implementation. Cejel abstains because auxiliary metadata or payload files cannot support a product-source headline score. ${INGEST_POINTER}`
     };
   }
@@ -5423,6 +5576,7 @@ function applySemanticSourceRepresentationGate(repoPath, repoFiles, classificati
       archetype: "non_cohesive_source",
       sourceFileCount: classification.sourceFileCount,
       totalFileCount: classification.totalFileCount,
+      abstentionKind: "semantic_auxiliary",
       insufficientSourceReason: `${auxiliaryCount} of ${authoredSourceFiles.length} authored source-shaped file(s) are localization, style, package, or redirect auxiliary material. Cejel abstains because an auxiliary-dominated tree does not expose representative product implementation for a headline score. ${INGEST_POINTER}`
     };
   }
@@ -5469,7 +5623,7 @@ function readRepresentativeSourceText(repoPath, file) {
   }
 }
 function sourceDominanceThreshold(rubricVersion) {
-  if (rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15) {
+  if (rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) {
     return SOURCE_DOMINANCE_RATIO_THRESHOLD_V11;
   }
   if (rubricVersion === WITAN_RUBRIC_VERSION_V10) return SOURCE_DOMINANCE_RATIO_THRESHOLD_V10;
@@ -5483,7 +5637,7 @@ function isUnrecognisedSourcePath(file, rubricVersion = WITAN_RUBRIC_VERSION) {
   const base = basename(file);
   if (!/\.([a-zA-Z0-9_]+)$/.test(base)) return false;
   if (KNOWN_NON_SOURCE_EXTENSION_PATTERN.test(base)) return false;
-  if ((rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15) && V13_NON_SOURCE_EXTENSION_PATTERN.test(base)) {
+  if ((rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) && V13_NON_SOURCE_EXTENSION_PATTERN.test(base)) {
     return false;
   }
   if (DOCS_OR_MEDIA_EXTENSION_PATTERN.test(base)) return false;
@@ -5512,6 +5666,7 @@ function unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognis
     archetype: "unrecognised_ecosystem",
     sourceFileCount,
     totalFileCount,
+    abstentionKind: "unrecognised_ecosystem",
     insufficientSourceReason: `Cejel does not yet read this repository's dominant source language(s) (${sample}) \u2014 ${measuredClause}. Cejel abstains from a verdict rather than score a repository whose recognised source is incidental rather than dominant; the Criterion Profile and Measured coverage below show exactly which dimensions were and were not measured. ${INGEST_POINTER}`
   };
 }
@@ -5532,6 +5687,32 @@ function assertRepoPathExists(repoPath) {
     throw new Error(`Cejel: path is not a directory: ${repoPath}`);
   }
 }
+function explainIgnoredScanTarget(repoPath) {
+  let top;
+  try {
+    top = execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd: repoPath,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return void 0;
+  }
+  if (!top) return void 0;
+  const topResolved = realpathSync(top);
+  const targetResolved = realpathSync(repoPath);
+  const target = relative(topResolved, targetResolved).split(sep).join("/");
+  if (!target || target.startsWith("../")) return void 0;
+  try {
+    execFileSync("git", ["check-ignore", "--quiet", "--", `${target}/`], {
+      cwd: topResolved,
+      stdio: "ignore"
+    });
+  } catch {
+    return void 0;
+  }
+  return `The requested scan path (${target}) is excluded by this repository's Git ignore rules, so Cejel found no tracked source to evaluate. Scan a tracked project or intentionally add the path to version control; Cejel abstains rather than score an ignored or vendored working tree.`;
+}
 function buildNotApplicableSignal(criterionId, reason) {
   return {
     criterionId,
@@ -5542,7 +5723,7 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, reviewableSourceProof) {
   const signals = [];
   const mono = resolveMonorepoContext(repoPath);
   const a1Signal = collectA1TestIntegrityEvidence(
@@ -5550,7 +5731,8 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
     repoFiles,
     useV27Detectors,
     useV33Detectors,
-    useV36Detectors
+    useV36Detectors,
+    reviewableSourceProof
   );
   const a2Signal = collectA2IsolationEvidence(
     repoPath,
@@ -5599,10 +5781,14 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
   }
   return signals;
 }
-function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors) {
+function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, reviewableSourceProof) {
   const evidence = [];
   const findings = [];
-  const allTestFiles = findConcreteTestFiles(repoPath, repoFiles);
+  const allTestFiles = findConcreteTestFiles(
+    repoPath,
+    repoFiles,
+    reviewableSourceProof ? WITAN_RUBRIC_VERSION_V17 : void 0
+  );
   const testFiles = allTestFiles.slice(0, 8);
   const sourceFiles = repoFiles.filter(isSourceFile);
   const runnerFiles = repoFiles.filter(
@@ -5691,7 +5877,9 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
       });
     }
   }
-  if (evidence.length === 0 && findings.length === 0) return null;
+  if (evidence.length === 0 && findings.length === 0 && configuredRunnerFiles.length === 0) {
+    return reviewableSourceProof?.passes === true && reviewableSourceProof.firstReadablePath ? buildA1AuthenticatedAbsenceSignal(repoPath, reviewableSourceProof) : null;
+  }
   if (testFiles.length === 0) {
     const fallback = configuredRunnerFiles[0] ? evidenceForRelative(
       repoPath,
@@ -5729,7 +5917,11 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
       });
     }
   }
-  const nonHollowShare = measureNonHollowTestShare(repoPath, allTestFiles);
+  const nonHollowShare = measureNonHollowTestShare(
+    repoPath,
+    allTestFiles,
+    reviewableSourceProof !== void 0
+  );
   return {
     criterionId: "A1",
     positiveEvidence: evidence,
@@ -5777,6 +5969,70 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
     notes: "A1 is detected from real test files, test runner configuration, and optional coverage configuration."
   };
 }
+function buildA1AuthenticatedAbsenceSignal(repoPath, proof) {
+  const sourcePath = proof.firstReadablePath;
+  if (!sourcePath) {
+    throw new Error("Cejel invariant: a passing reviewable-source proof must have a readable path");
+  }
+  const anchor = evidenceForRelative(
+    repoPath,
+    sourcePath,
+    "artifact",
+    `Reviewable source anchor (${proof.readableSampledFileCount}/${proof.sampledFileCount} sampled files readable; ${proof.eligibleSourceFileCount}/${proof.sourceShapedFileCount} source-shaped files criterion-ratable)`
+  );
+  return {
+    criterionId: "A1",
+    positiveEvidence: [anchor],
+    findings: [
+      {
+        severity: "critical",
+        summary: WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY,
+        evidence: anchor
+      }
+    ],
+    metrics: [
+      metric(
+        "test_to_source_ratio",
+        "Test-to-source file ratio",
+        0,
+        proof.eligibleSourceFileCount,
+        0.3,
+        "ratio",
+        "Measures how much concrete test surface exists relative to criterion-ratable implementation source.",
+        "saturating_count"
+      ),
+      metric(
+        "coverage_percent",
+        "Static coverage percentage",
+        0,
+        100,
+        0.3,
+        "percent",
+        "Uses a static coverage report value or configured threshold when present, without running tests."
+      ),
+      metric(
+        "verification_script_ratio",
+        "Verification script ratio",
+        0,
+        4,
+        0.25,
+        "ratio",
+        "Measures explicit test/lint/typecheck verification commands plus test runner configuration.",
+        "saturating_count"
+      ),
+      metric(
+        "non_hollow_test_share",
+        "Non-hollow test share",
+        0,
+        1,
+        0.15,
+        "ratio",
+        "No concrete test files were present to establish non-hollow test behavior."
+      )
+    ],
+    notes: `V17 authenticated absence: ${proof.eligibleSourceFileCount} criterion-ratable of ${proof.sourceShapedFileCount} source-shaped files; sampled ${proof.sampledFileCount}; ${proof.readableSampledFileCount} representative-text files.`
+  };
+}
 function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors) {
   const evidence = [];
   const findings = [];
@@ -6923,12 +7179,20 @@ function isV47AuthoredProductionPath(path) {
 var TEST_DIRECTORY_SOURCE_PATTERN = new RegExp(
   `(^|/)(?:__tests__|tests?|specs?|[^/]+(?:Tests|Specs))/(?:.*\\.)?(?:${SOURCE_LANGUAGES.flatMap((language) => language.extensions).join("|")})$`
 );
-function isTestFile(file) {
-  return TEST_DIRECTORY_SOURCE_PATTERN.test(file) || // AVA's default discovery includes test.js and test-*.js at the scanned package root.
+var TEST_DIRECTORY_SOURCE_PATTERN_V17 = new RegExp(
+  `(^|/)(?:__tests__|tests?|specs?|[^/]+(?:Tests|Specs))/(?:.*\\.)?(?:${[
+    ...SOURCE_LANGUAGES_V10.flatMap((language) => language.extensions),
+    "bats"
+  ].join("|")})$`,
+  "i"
+);
+function isTestFile(file, rubricVersion = WITAN_RUBRIC_VERSION) {
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 && (TEST_DIRECTORY_SOURCE_PATTERN_V17.test(file) || /\.tftest\.hcl$/i.test(file) || /\.bats$/i.test(file) || /(^|\/)test[^/]*\.m$/i.test(file) || /_test\.m$/i.test(file)) || TEST_DIRECTORY_SOURCE_PATTERN.test(file) || // AVA's default discovery includes test.js and test-*.js at the scanned package root.
   // Keep this root-anchored: nested files need an existing test-directory/suffix convention.
   /^test(?:-[^/]+)?\.[cm]?[jt]sx?$/.test(file) || /\.(test|spec)\.[cm]?[jt]sx?$/.test(file) || /(^|\/)test_.*\.py$/.test(file) || /_test\.go$/.test(file) || /(^|\/)test_.*\.(cpp|cc|cxx)$/.test(file) || /_(test|tests)\.(cpp|cc|cxx)$/.test(file) || /Tests?\.(java|kt)$/.test(file) || /(_test|_spec)\.(rs|rb|php|swift|kt)$/.test(file);
 }
 var NAME_SHAPED_TEST_FILE_PATTERN = /^test(?:-[^/]+)?\.[cm]?[jt]sx?$|\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)__tests__\/|(^|\/)test_[^/]*\.py$|(^|\/)tests?\.py$|_test\.go$|(^|\/)test_[^/]*\.(cpp|cc|cxx)$|_(test|tests)\.(cpp|cc|cxx)$|Tests?\.(java|kt)$|(_test|_spec)\.(rs|rb|php|swift|kt)$/;
+var NAME_SHAPED_TEST_FILE_PATTERN_V17 = /\.tftest\.hcl$|\.bats$|(^|\/)test[^/]*\.m$|_test\.m$/i;
 var TEST_RUNNER_PATTERN = /\b(vitest|jest|mocha|ava|tap|pytest|go test|cargo test|rspec|phpunit|gradle test|mvn test|node\s+--test|node:test)\b/i;
 var CI_TEST_COMMAND_PATTERN = /\b(pytest|go\s+test|cargo\s+test|mvn\s+test|gradle\s+test|dotnet\s+test|ctest|make\s+test|jest|vitest|mocha|rspec|phpunit|pnpm\s+(?:run\s+)?test|npm\s+(?:run\s+)?test|yarn\s+(?:run\s+)?test|node\s+--test|node:test)\b|--target[=\s]+test\b/i;
 var CI_LINT_COMMAND_PATTERN = /\b(eslint|pylint|flake8|black|ruff)\b/i;
@@ -7214,7 +7478,7 @@ var JS_TEST_ASSERTION_PATTERN = /(expect\(|assert\.|should\.|toEqual\(|toBe\(|as
 var CPP_TEST_ASSERTION_PATTERN = /\bEXPECT_|ASSERT_EQ\b|ASSERT_TRUE\b|ASSERT_FALSE\b|\bREQUIRE\s*\(|\bCHECK\s*\(|\bTEST\s*\(|\bTEST_F\s*\(|\bTEST_CASE\s*\(|\bSECTION\s*\(/;
 var MULTI_ECOSYSTEM_TEST_ASSERTION_PATTERN = /\.assert[A-Z_]\w*\s*\(|\bassert[A-Z]\w*\s*\(|\bpytest\.raises\b|\bself\.fail\s*\(|\bt\.(?:Error|Errorf|Fatal|Fatalf|Fail|FailNow)\b|\brequire\.[A-Z]\w*\s*\(|\b(?:debug_)?assert(?:_eq|_ne)?!\s*\(|\bassert_\w+\b|\$this->assert\w+\s*\(/;
 var SUITE_LEVEL_SKIP_PATTERN = /\b(?:describe|suite|context)\.skip\s*\(/;
-function measureNonHollowTestShare(repoPath, files) {
+function measureNonHollowTestShare(repoPath, files, useV17Detectors = false) {
   let nonHollowCount = 0;
   let ratedCount = 0;
   for (const file of files) {
@@ -7225,7 +7489,7 @@ function measureNonHollowTestShare(repoPath, files) {
     if (nonHollow) {
       nonHollowCount += 1;
       ratedCount += 1;
-    } else if (NAME_SHAPED_TEST_FILE_PATTERN.test(file)) {
+    } else if (NAME_SHAPED_TEST_FILE_PATTERN.test(file) || useV17Detectors && NAME_SHAPED_TEST_FILE_PATTERN_V17.test(file)) {
       ratedCount += 1;
     }
   }
@@ -7557,9 +7821,12 @@ function findCoverageConfigFiles(repoPath, repoFiles, authoredOnly = false) {
     (file) => (!authoredOnly || isAuthoredProductionPath(file)) && isCoverageConfig(repoPath, file)
   );
 }
-function findConcreteTestFiles(repoPath, repoFiles) {
+function findConcreteTestFiles(repoPath, repoFiles, rubricVersion = WITAN_RUBRIC_VERSION) {
   const contentCppTests = collectContentBasedCppTestFiles(repoPath, repoFiles);
-  return [...repoFiles.filter(isTestFile), ...contentCppTests.filter((file) => !isTestFile(file))];
+  return [
+    ...repoFiles.filter((file) => isTestFile(file, rubricVersion)),
+    ...contentCppTests.filter((file) => !isTestFile(file, rubricVersion))
+  ];
 }
 function findConfiguredTestRunnerFiles(repoPath, repoFiles) {
   const configured = repoFiles.filter(
@@ -7686,8 +7953,439 @@ function isCoverageConfig(repoPath, file) {
   if (/(^|\/)pyproject\.toml$/.test(file)) {
     return fileContains(repoPath, file, /^\[tool\.coverage(?:\.|\])/m);
   }
+  if (/(^|\/)package\.json$/.test(file)) {
+    return packageJsonHasCoverageTooling(repoPath, file);
+  }
+  return false;
+}
+function packageJsonHasCoverageTooling(repoPath, file) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return false;
+  const parsed = parseJsonObject(readFileSync(fullPath, "utf8"));
+  if (!parsed) return false;
+  const scripts = parsed.scripts;
+  if (typeof scripts === "object" && scripts !== null && !Array.isArray(scripts)) {
+    for (const command of Object.values(scripts)) {
+      if (typeof command === "string" && commandInvokesCoverageTool(command)) {
+        return true;
+      }
+    }
+  }
+  for (const key of ["nyc", "c8", "istanbul"]) {
+    const config = parsed[key];
+    if (typeof config === "object" && config !== null && !Array.isArray(config)) return true;
+  }
+  return false;
+}
+function commandInvokesCoverageTool(command) {
+  return normalizedCommandInvokesCoverageTool(normalizeCoverageCommandPrefixes(command), 0);
+}
+function normalizedCommandInvokesCoverageTool(normalized, depth) {
+  const segments = normalized.splitShellOperators ? splitShellCommandSegments(normalized.segment) : [normalized.segment];
+  return segments.some((rawSegment) => {
+    const candidate = normalizeCoverageCommandPrefixes(rawSegment);
+    if (/^(?:nyc|c8|istanbul)(?:\s|$)/iu.test(candidate.segment)) return true;
+    return depth < 4 && candidate.splitShellOperators && candidate.segment !== rawSegment.trim() && normalizedCommandInvokesCoverageTool(candidate, depth + 1);
+  });
+}
+function splitShellCommandSegments(command) {
+  const segments = [];
+  let start = 0;
+  let quote = null;
+  let escaped = false;
+  for (let index = 0; index < command.length; index += 1) {
+    const character = command[index];
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (character === "\\" && quote !== "'") {
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      if (character === quote) quote = null;
+      continue;
+    }
+    if (character === "'" || character === '"') {
+      quote = character;
+      continue;
+    }
+    if (character === "#" && (index === 0 || /[\s;|&()]/u.test(command[index - 1] ?? ""))) {
+      segments.push(command.slice(start, index));
+      const newline = command.indexOf("\n", index + 1);
+      if (newline < 0) return segments;
+      index = newline;
+      start = newline + 1;
+      continue;
+    }
+    const isBoundary = character === ";" || character === "|" || character === "&" || character === "\n";
+    if (!isBoundary) continue;
+    segments.push(command.slice(start, index));
+    if ((character === "|" || character === "&") && command[index + 1] === character) index += 1;
+    start = index + 1;
+  }
+  segments.push(command.slice(start));
+  return segments;
+}
+function normalizeCoverageCommandPrefixes(rawSegment) {
+  let segment = rawSegment.trim();
+  let unwrapQuotedShellCommand = false;
+  let splitShellOperators = true;
+  for (let index = 0; index < 8; index += 1) {
+    const before = segment;
+    segment = stripOuterShellGroup(segment);
+    segment = segment.replace(/^(?:[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|[^\s]+)\s+)*/u, "");
+    segment = segment.replace(
+      /^(?:npx|npm\s+exec|pnpm\s+(?:exec|dlx)|yarn\s+(?:exec|dlx))(?:\s+--(?:no-install|yes))*(?:\s+--)?\s+/iu,
+      ""
+    );
+    segment = segment.replace(/^(?:command(?:\s+-p)?(?:\s+--)?|time(?:\s+-p)?)\s+/iu, "");
+    const explicitShellCommand = extractExplicitShellCommand(segment);
+    if (explicitShellCommand !== null) {
+      segment = explicitShellCommand;
+      unwrapQuotedShellCommand = false;
+      splitShellOperators = true;
+    }
+    const environmentPrefix = stripEnvironmentCommandPrefix(segment);
+    segment = environmentPrefix.segment;
+    unwrapQuotedShellCommand ||= environmentPrefix.unwrapQuotedShellCommand;
+    if (environmentPrefix.splitShellOperators !== null) {
+      splitShellOperators = environmentPrefix.splitShellOperators;
+    }
+    if (segment === before) break;
+  }
+  return {
+    segment: unwrapQuotedShellCommand ? segment.replace(/^(["'])(.*)\1$/u, "$2").trim() : segment,
+    splitShellOperators
+  };
+}
+function extractExplicitShellCommand(segment) {
+  const shellExecutable = /^(?:(?:\/(?:usr\/)?bin\/)?(?<shell>(?:ba|da|k|z)?sh))(?=\s|$)/iu.exec(
+    segment
+  );
+  if (!shellExecutable) return null;
+  const shell = shellExecutable.groups?.shell?.toLowerCase();
+  if (!shell) return null;
+  let offset = shellExecutable[0].length;
+  let noExecute = false;
+  let dumpStrings = false;
+  for (let optionCount = 0; optionCount < 32; optionCount += 1) {
+    const option = scanShellWord(segment, offset);
+    if (!option || !option.word.startsWith("-") && !option.word.startsWith("+")) return null;
+    offset = option.end;
+    if (option.word === "--") return null;
+    const zshLongOption = shell === "zsh" ? /^(?<sign>--|\+-)(?<name>[A-Za-z][A-Za-z_-]*)$/u.exec(option.word) : null;
+    if (zshLongOption) {
+      const optionName = zshLongOption.groups?.name?.replaceAll("-", "");
+      if (!optionName) return null;
+      const resolvedSetOption = resolveSupportedShellSetOption(shell, optionName);
+      if (!resolvedSetOption && !isSupportedZshLongInvocationOption(optionName)) return null;
+      if (resolvedSetOption?.name === "noexec") {
+        noExecute = zshLongOption.groups?.sign === "--" !== resolvedSetOption.inverted;
+      }
+      continue;
+    }
+    if (option.word === "--rcfile" || option.word === "--init-file") {
+      const operand = scanShellWord(segment, offset);
+      if (shell !== "bash" || !operand) return null;
+      offset = operand.end;
+      continue;
+    }
+    if (shell === "bash" && /^--(?:debug|debugger|login|noediting|noprofile|norc|posix|protected|restricted|verbose)$/u.test(
+      option.word
+    )) {
+      continue;
+    }
+    const cluster = parseSupportedShellOptionCluster(shell, option.word);
+    if (!cluster) return null;
+    if (cluster.changesNoExecute) noExecute = cluster.sign === "-";
+    if (cluster.enablesDumpStrings) dumpStrings = true;
+    if (cluster.operandKind) {
+      const operand = scanShellWord(segment, offset);
+      const resolvedSetOperand = operand && cluster.operandKind === "set" ? resolveSupportedShellSetOption(shell, operand.word) : null;
+      const operandIsZshInvocationOption = shell === "zsh" && operand !== null && cluster.operandKind === "set" && isSupportedZshLongInvocationOption(operand.word);
+      const operandIsSupported = cluster.operandKind === "set" ? resolvedSetOperand !== null || operandIsZshInvocationOption : shell === "bash" && operand && BASH_SHOPT_OPTIONS.has(operand.word);
+      if (!operand || !operandIsSupported) return null;
+      if (resolvedSetOperand?.name === "noexec") {
+        noExecute = cluster.sign === "-" !== resolvedSetOperand.inverted;
+      }
+      offset = operand.end;
+    }
+    if (cluster.hasCommand) {
+      return noExecute || dumpStrings ? null : readShellWord(segment, offset);
+    }
+  }
+  return null;
+}
+var BASH_SET_OPTIONS = /* @__PURE__ */ new Set([
+  "allexport",
+  "braceexpand",
+  "emacs",
+  "errexit",
+  "errtrace",
+  "functrace",
+  "hashall",
+  "histexpand",
+  "history",
+  "ignoreeof",
+  "keyword",
+  "monitor",
+  "noclobber",
+  "noexec",
+  "noglob",
+  "nolog",
+  "notify",
+  "nounset",
+  "onecmd",
+  "physical",
+  "pipefail",
+  "posix",
+  "privileged",
+  "verbose",
+  "vi",
+  "xtrace"
+]);
+var BASH_SHOPT_OPTIONS = /* @__PURE__ */ new Set([
+  "autocd",
+  "cdable_vars",
+  "cdspell",
+  "checkhash",
+  "checkjobs",
+  "checkwinsize",
+  "cmdhist",
+  "complete_fullquote",
+  "direxpand",
+  "dirspell",
+  "dotglob",
+  "execfail",
+  "expand_aliases",
+  "extdebug",
+  "extglob",
+  "extquote",
+  "failglob",
+  "force_fignore",
+  "globasciiranges",
+  "globskipdots",
+  "globstar",
+  "gnu_errfmt",
+  "histappend",
+  "histreedit",
+  "histverify",
+  "hostcomplete",
+  "huponexit",
+  "inherit_errexit",
+  "interactive_comments",
+  "lastpipe",
+  "lithist",
+  "localvar_inherit",
+  "localvar_unset",
+  "login_shell",
+  "mailwarn",
+  "nocaseglob",
+  "nocasematch",
+  "no_empty_cmd_completion",
+  "nullglob",
+  "progcomp",
+  "progcomp_alias",
+  "promptvars",
+  "restricted_shell",
+  "shift_verbose",
+  "sourcepath",
+  "varredir_close",
+  "xpg_echo"
+]);
+var POSIX_SET_OPTIONS = /* @__PURE__ */ new Set([
+  "allexport",
+  "errexit",
+  "ignoreeof",
+  "noclobber",
+  "noexec",
+  "noglob",
+  "nounset",
+  "verbose",
+  "vi",
+  "xtrace"
+]);
+var ZSH_LONG_INVOCATION_OPTIONS = /* @__PURE__ */ new Set([
+  "interactive",
+  "login",
+  "privileged",
+  "shinstdin",
+  "stdin"
+]);
+function isSupportedShellSetOption(shell, option) {
+  if (shell === "bash") return BASH_SET_OPTIONS.has(option);
+  if (shell === "sh" || shell === "dash") return POSIX_SET_OPTIONS.has(option);
+  if (shell === "ksh" || shell === "zsh") {
+    return POSIX_SET_OPTIONS.has(option) || option === "pipefail";
+  }
   return false;
 }
+function normalizeShellSetOption(shell, option) {
+  if (shell === "zsh") return option.toLowerCase().replaceAll("_", "");
+  return option;
+}
+function isSupportedZshLongInvocationOption(option) {
+  const normalized = normalizeShellSetOption("zsh", option);
+  if (ZSH_LONG_INVOCATION_OPTIONS.has(normalized)) return true;
+  return normalized.startsWith("no") && !normalized.startsWith("nono") && ZSH_LONG_INVOCATION_OPTIONS.has(normalized.slice(2));
+}
+function resolveSupportedShellSetOption(shell, option) {
+  const normalized = normalizeShellSetOption(shell, option);
+  if (shell === "zsh" && normalized === "exec") {
+    return { name: "noexec", inverted: true };
+  }
+  if (isSupportedShellSetOption(shell, normalized)) {
+    return { name: normalized, inverted: false };
+  }
+  if (shell === "zsh" && normalized.startsWith("no") && !normalized.startsWith("nono") && isSupportedShellSetOption(shell, normalized.slice(2))) {
+    return { name: normalized.slice(2), inverted: true };
+  }
+  return null;
+}
+function parseSupportedShellOptionCluster(shell, option) {
+  if (!/^[+-][A-Za-z]+$/u.test(option)) return null;
+  const sign = option[0];
+  let letters = option.slice(1);
+  let operandKind = null;
+  const operandLetter = letters.at(-1);
+  if (operandLetter === "o" || operandLetter === "O") {
+    if (operandLetter === "O" && shell !== "bash") return null;
+    letters = letters.slice(0, -1);
+    if (letters.includes("c")) return null;
+    operandKind = operandLetter === "o" ? "set" : "shopt";
+  }
+  const supportedLetters = shell === "bash" ? "abcefhkmnptuvxBCEHPTilrsD" : shell === "sh" ? "abCcefimnsuvx" : shell === "dash" ? "abCcefilmnsuvx" : "acefilmnpsuvx";
+  if (![...letters].every((letter) => supportedLetters.includes(letter))) return null;
+  return {
+    sign,
+    hasCommand: letters.includes("c"),
+    changesNoExecute: letters.includes("n"),
+    enablesDumpStrings: shell === "bash" && letters.includes("D"),
+    operandKind
+  };
+}
+function scanShellWord(value, start) {
+  let result = "";
+  let quote = null;
+  let escaped = false;
+  let index = start;
+  while (index < value.length && /\s/u.test(value[index] ?? "")) index += 1;
+  const wordStart = index;
+  for (; index < value.length; index += 1) {
+    const character = value[index];
+    if (escaped) {
+      if (character !== "\n") result += character;
+      escaped = false;
+      continue;
+    }
+    if (character === "\\" && quote !== "'") {
+      const nextCharacter = value[index + 1];
+      const escapesNext = quote !== '"' || nextCharacter === "$" || nextCharacter === "`" || nextCharacter === '"' || nextCharacter === "\\" || nextCharacter === "\n";
+      if (escapesNext) {
+        escaped = true;
+      } else {
+        result += character;
+      }
+      continue;
+    }
+    if (quote) {
+      if (character === quote) {
+        quote = null;
+      } else {
+        result += character;
+      }
+      continue;
+    }
+    if (character === "'" || character === '"') {
+      quote = character;
+      continue;
+    }
+    if (/\s/u.test(character ?? "")) break;
+    result += character;
+  }
+  if (escaped || quote || index === wordStart) return null;
+  return { word: result, end: index };
+}
+function readShellWord(value, start) {
+  return scanShellWord(value, start)?.word ?? null;
+}
+function stripOuterShellGroup(segment) {
+  if (!segment.startsWith("(") || segment.startsWith("((")) return segment;
+  let depth = 0;
+  let quote = null;
+  let escaped = false;
+  for (let index = 0; index < segment.length; index += 1) {
+    const character = segment[index];
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (character === "\\" && quote !== "'") {
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      if (character === quote) quote = null;
+      continue;
+    }
+    if (character === "'" || character === '"') {
+      quote = character;
+      continue;
+    }
+    if (character === "(") {
+      depth += 1;
+      continue;
+    }
+    if (character !== ")") continue;
+    depth -= 1;
+    if (depth < 0) return segment;
+    if (depth === 0) {
+      if (segment.slice(index + 1).trim().length > 0) return segment;
+      return segment.slice(1, index).trim();
+    }
+  }
+  return segment;
+}
+function stripEnvironmentCommandPrefix(segment) {
+  const wrapper = /^(cross-env(?:-shell)?|env)(?:\s|$)/iu.exec(segment);
+  if (!wrapper) {
+    return { segment, unwrapQuotedShellCommand: false, splitShellOperators: null };
+  }
+  let remainder = segment.slice(wrapper[0].length).trimStart();
+  let unwrapQuotedShellCommand = wrapper[1]?.toLowerCase() === "cross-env-shell";
+  let splitShellOperators = true;
+  while (remainder.length > 0) {
+    const splitString = /^(?:-S|--split-string)(?:=|\s+)(?:"([^"]*)"|'([^']*)'|([^\s]+))(?:\s+|$)/u.exec(remainder);
+    if (splitString) {
+      const splitCommand = splitString[1] ?? splitString[2] ?? splitString[3] ?? "";
+      remainder = `${splitCommand} ${remainder.slice(splitString[0].length)}`.trim();
+      unwrapQuotedShellCommand = false;
+      splitShellOperators = false;
+      continue;
+    }
+    const assignment = /^[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|[^\s]+)(?:\s+|$)/u.exec(
+      remainder
+    );
+    if (assignment) {
+      remainder = remainder.slice(assignment[0].length).trimStart();
+      continue;
+    }
+    const optionWithValue = /^(?:-u|--unset|-C|--chdir)(?:=|\s+)(?:"[^"]*"|'[^']*'|[^\s]+)(?:\s+|$)/u.exec(remainder);
+    if (optionWithValue) {
+      remainder = remainder.slice(optionWithValue[0].length).trimStart();
+      continue;
+    }
+    const flag = /^(?:--ignore-environment|-i|--)(?:\s+|$)/u.exec(remainder);
+    if (flag) {
+      remainder = remainder.slice(flag[0].length).trimStart();
+      continue;
+    }
+    break;
+  }
+  return { segment: remainder, unwrapQuotedShellCommand, splitShellOperators };
+}
 function isCiWorkflow(file) {
   return /^\.github\/workflows\/.+\.ya?ml$/.test(file) || /^\.gitlab-ci\.ya?ml$/.test(file) || /^\.circleci\/config\.ya?ml$/.test(file) || /^azure-pipelines\.ya?ml$/.test(file) || /^Jenkinsfile$/.test(file);
 }
@@ -8985,7 +9683,15 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
   const overallScore = roundScore(
     categoryOrder.reduce((sum, category) => sum + (categoryScoreMap[category] ?? 0), 0) / Math.max(categoryOrder.length, 1)
   );
-  const abstained = parsedInput.insufficientSourceReason != null;
+  const hasMeasuredCriterion = criteria.some(
+    ({ status }) => status !== "not_applicable" && status !== "insufficient_data"
+  );
+  const isFreeCoreRubric = rubric.length === WITAN_RUBRIC.length && rubric.every(
+    ({ id, category }, index) => id === WITAN_RUBRIC[index]?.id && category === WITAN_RUBRIC[index]?.category
+  );
+  const noMeasurementAbstention = (parsedInput.rubricVersion === WITAN_RUBRIC_VERSION_V16 || parsedInput.rubricVersion === WITAN_RUBRIC_VERSION_V17) && isFreeCoreRubric && !hasMeasuredCriterion;
+  const insufficientSourceReason = parsedInput.insufficientSourceReason ?? (noMeasurementAbstention ? WITAN_NO_MEASUREMENT_REASON : void 0);
+  const abstained = insufficientSourceReason != null;
   return WitanReportSchema.parse({
     productSlug: parsedInput.productSlug,
     productDisplayName: parsedInput.productDisplayName,
@@ -9005,7 +9711,7 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
     // alter it (see classifyRepoArchetype in repo-signals.ts); per-criterion scoring above is
     // unaffected by archetype, only presentation layers (badge/terminal/verdict) key off it.
     ...parsedInput.archetype ? { archetype: parsedInput.archetype } : {},
-    ...parsedInput.insufficientSourceReason ? { insufficientSourceReason: parsedInput.insufficientSourceReason } : {}
+    ...insufficientSourceReason ? { insufficientSourceReason } : {}
   });
 }
 function applySignalAdjustment(nativeScore, dimension, signals) {
@@ -9051,7 +9757,7 @@ function statusForScore(score) {
 }
 function statusAfterInputAdjustment(nativeStatus, nativeScore, adjustment, rubricVersion) {
   if (adjustment === 0) return nativeStatus;
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V92 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V92 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17) {
     return statusForScore(roundScore(Math.max(0, nativeScore - adjustment)));
   }
   const statusFloor = {
@@ -9095,7 +9801,7 @@ function mergeSignalsByCriterion(signals) {
   return merged;
 }
 function usesMetricScoring(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
 }
 function unmeasuredStatus(rubricVersion) {
   return rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0 ? "unverified" : "insufficient_data";
@@ -9136,7 +9842,12 @@ function scoreCriterion(signal, rubricVersion) {
   }
   if (usesMetricScoring(rubricVersion)) {
     const measuredMetrics = metrics.length > 0 ? metrics : fallbackMetricsForEvidence(evidence, findings);
-    const score = capScoreForFindings(scoreMetrics(measuredMetrics), findings);
+    const score = capScoreForFindings(
+      scoreMetrics(measuredMetrics),
+      findings,
+      rubricVersion,
+      signal.criterionId
+    );
     const status = statusForScoreAndFindings(
       signal.criterionId,
       score,
@@ -9218,16 +9929,20 @@ function scoreMetrics(metrics) {
   if (totalWeight === 0) return 0;
   return roundScore(weightedTotal / totalWeight * 4);
 }
-function capScoreForFindings(score, findings) {
-  if (findings.some((finding) => finding.severity === "critical")) return 1.4;
+function capScoreForFindings(score, findings, rubricVersion, criterionId) {
+  if (findings.some((finding) => finding.severity === "critical")) {
+    const criticalFindings = findings.filter(({ severity }) => severity === "critical");
+    const authenticatedA1Absence = rubricVersion === WITAN_RUBRIC_VERSION_V17 && criterionId === "A1" && criticalFindings.length === 1 && criticalFindings[0]?.summary === WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY;
+    return authenticatedA1Absence ? Math.min(score, 1.4) : 1.4;
+  }
   if (findings.some((finding) => finding.severity === "warning")) return Math.min(score, 2.4);
   if (findings.some((finding) => finding.severity === "info")) return Math.min(score, 3.4);
   return score;
 }
 function statusForScoreAndFindings(criterionId, score, findings, metrics, rubricVersion) {
   if (findings.some((finding) => finding.severity === "critical")) return "critical";
-  if (rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15) {
-    const calibrated = rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 ? calibratedCriterionStateV11(criterionId, metrics) : rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 ? calibratedCriterionStateV9(criterionId, metrics) : calibratedCriterionStateV8(criterionId, metrics);
+  if (rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) {
+    const calibrated = rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 ? calibratedCriterionStateV11(criterionId, metrics) : rubricVersion === WITAN_RUBRIC_VERSION_V92 || rubricVersion === WITAN_RUBRIC_VERSION_V10 ? calibratedCriterionStateV9(criterionId, metrics) : calibratedCriterionStateV8(criterionId, metrics);
     if (calibrated && calibrated !== "verified") return calibrated;
     if (calibrated === "verified" && !findings.some((finding) => finding.severity === "warning")) {
       return "verified";
@@ -9453,7 +10168,7 @@ function calibratedCriterionStateV11(criterionId, metrics) {
   return void 0;
 }
 function ensureFindingsExplainStatus(criterionId, score, status, findings, evidence, rubricVersion) {
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V92 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && findings.length > 0) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V92 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && findings.length > 0) {
     return [...findings];
   }
   if (status !== "critical" && status !== "warning") return [...findings];
@@ -9560,6 +10275,87 @@ function slugify(raw) {
   return FALLBACK_SLUG;
 }
 
+// src/finding-presentation.ts
+var METRIC_DERIVED_FINDING_PATTERN2 = /^[A-Z]\d+ metric-derived score is (\d+\.\d)\/4\.0, in the (critical|warning) band — no single finding drove this; it reflects the combined metric weighting below\.$/;
+var REMEDIATION_BY_METRIC2 = {
+  test_to_source_ratio: "add concrete regression tests for the implementation surface",
+  coverage_percent: "configure coverage and publish a measured threshold or report",
+  verification_script_ratio: "add explicit test, lint, and typecheck verification commands",
+  non_hollow_test_share: "replace skipped or placeholder tests with live assertions",
+  env_handling_depth: "document and enforce safe environment-secret handling",
+  secret_cleanliness: "remove committed secrets and rotate any exposed credentials",
+  tenant_scope_ratio: "apply tenant scoping consistently across data access",
+  rls_policy_count: "add database row-level security policies where the data model requires them",
+  crypto_comparison_hygiene: "use constant-time comparison for signature or MAC checks",
+  prod_readiness_primitives: "add the missing deployment-readiness controls",
+  observability_depth: "add health checks, structured logging, and error boundaries",
+  rollback_safety_depth: "document and test rollback or recovery procedures",
+  pinned_dependency_ratio: "pin application dependencies that determine the deployed artifact",
+  lockfile_coverage: "commit the package-manager lockfile used by CI and deployment",
+  dependency_automation_ratio: "enable automated dependency updates and an audit command",
+  declared_version_range_ratio: "declare an explicit compatible version for every dependency",
+  dependency_count_sanity: "review and reduce unnecessary direct dependencies",
+  claim_match_rate: "align documented product claims with observable repository evidence",
+  claim_source_depth: "document concrete, checkable product claims",
+  reconciliation_artifact_depth: "publish a claim-to-evidence reconciliation record",
+  pr_merge_ratio: "preserve merged pull-request history in the scanned clone",
+  pr_trace_primitives: "add pull-request templates and outcome-trace records",
+  ci_script_depth: "run the repository verification commands in CI",
+  default_branch_ci_depth: "run CI on the default branch and pull requests",
+  prod_workflow_depth: "add a production or release verification workflow",
+  audit_artifact_depth: "publish changelog, incident, security, or audit records",
+  audit_freshness_depth: "keep the audit trail current",
+  human_gate_documented: "document which privileged operations require human approval",
+  protected_path_review_gate: "require review for changes to protected paths",
+  fail_closed_privilege_check: "make privileged-operation checks fail closed",
+  kill_switch_fail_safe_present: "add a fail-safe kill switch for privileged automation",
+  privilege_escalation_cleanliness: "remove unsafe privilege-escalation patterns"
+};
+function renderFindingSummary2(criterion, finding) {
+  const match = METRIC_DERIVED_FINDING_PATTERN2.exec(finding.summary);
+  if (!match) return finding.summary;
+  const score = match[1] ?? criterion.score.toFixed(1);
+  const band = match[2] ?? criterion.status;
+  const drivers = selectLowestDrivers2(criterion.metrics);
+  if (drivers.length === 0) {
+    return `${criterion.id} dimension band is ${band} at ${score}/4.0. To improve this dimension, add stronger measurable evidence for ${criterion.title.toLowerCase()}.`;
+  }
+  const measurements = drivers.map(formatMetricMember2).join("; ");
+  const actions = Array.from(
+    new Set(
+      drivers.map(
+        (metric2) => REMEDIATION_BY_METRIC2[metric2.name] ?? `raise the measured ${metric2.label.toLowerCase()}`
+      )
+    )
+  ).join("; ");
+  return `${criterion.id} dimension band is ${band} at ${score}/4.0. Lowest contributing measurements: ${measurements}. To improve: ${actions}.`;
+}
+function selectLowestDrivers2(metrics) {
+  return [...metrics].filter((metric2) => metric2.max !== void 0).sort((left, right) => {
+    const leftRatio = normalizedMetricValue2(left);
+    const rightRatio = normalizedMetricValue2(right);
+    if (leftRatio !== rightRatio) return leftRatio - rightRatio;
+    if (left.weight !== right.weight) return right.weight - left.weight;
+    return left.name.localeCompare(right.name);
+  }).slice(0, 2);
+}
+function normalizedMetricValue2(metric2) {
+  if (metric2.max === void 0) return 1;
+  return Math.min(metric2.value / metric2.max, 1);
+}
+function formatMetricMember2(metric2) {
+  const unit = metric2.unit ? ` ${metric2.unit}` : "";
+  const maximum = metric2.max;
+  if (maximum === void 0) return `${metric2.label} ${formatMetricValue3(metric2.value)}${unit}`;
+  if (metric2.kind === "saturating_count" && metric2.value > maximum) {
+    return `${metric2.label} ${formatMetricValue3(maximum)}${unit} capped (${formatMetricValue3(metric2.value)} raw)`;
+  }
+  return `${metric2.label} ${formatMetricValue3(metric2.value)}/${formatMetricValue3(maximum)}${unit}`;
+}
+function formatMetricValue3(value) {
+  return Number.isInteger(value) ? String(value) : value.toFixed(2).replace(/0+$/, "").replace(/\.$/, "");
+}
+
 // src/summary.ts
 var SEVERITY_RANK2 = {
   critical: 0,
@@ -9569,11 +10365,16 @@ var SEVERITY_RANK2 = {
 var TOP_FINDINGS_LIMIT = 5;
 function buildWitanCliSummary(report) {
   const allFindings = report.criteria.flatMap(
-    (criterion) => criterion.findings.map((finding) => ({
-      criterionId: criterion.id,
-      severity: finding.severity,
-      summary: finding.summary
-    }))
+    (criterion) => criterion.findings.map((finding) => {
+      const displaySummary = renderFindingSummary2(criterion, finding);
+      return {
+        criterionId: criterion.id,
+        severity: finding.severity,
+        dimensionBand: criterion.status,
+        summary: finding.summary,
+        ...displaySummary !== finding.summary ? { displaySummary } : {}
+      };
+    })
   );
   const sorted = [...allFindings].sort(
     (a, b) => SEVERITY_RANK2[a.severity] - SEVERITY_RANK2[b.severity]
@@ -9600,7 +10401,7 @@ function buildWitanCliSummary(report) {
       overallScore: null,
       codeTrustScore: null,
       processTrustScore: null,
-      verdict: "Insufficient source",
+      verdict: renderReportVerdict(report),
       insufficientSourceReason: report.insufficientSourceReason
     };
   }
@@ -9618,7 +10419,7 @@ function runCejelScan(options) {
   const identity = deriveProductIdentity(options.repoPath);
   const report = scoreRepoWithPublicCejel({
     productSlug: identity.productSlug,
-    productDisplayName: identity.productDisplayName,
+    productDisplayName: options.productDisplayName ?? identity.productDisplayName,
     repoPath: options.repoPath,
     ingestPatterns: options.ingestPatterns,
     warnOnEmptyIngestMatch: options.warnOnEmptyIngestMatch