@cejel/cejel 0.2.0 → 0.2.2

package/README.md

@@ -18,7 +18,10 @@ certificate + badge over all of them. See "Aggregate your scanners" below.
 
 > Dogfooded in production. Cejel is run continuously on Barg Labs' own multi-product
 > monorepo — the ten-product studio it was built inside — which it currently scores
-> 3.5/4.0 ("Verified"). We score ourselves before asking you to score yourself.
+> 3.3/4.0 on its rubric-native certificate. That transparency snapshot opts into prospective
+> v18; the public CLI default remains calibrated v17. On the comparative board, our code sits
+> outside the ranked population and receives no verdict band. We score ourselves before
+> asking you to score yourself.
 
 ## Install
 
@@ -46,6 +49,29 @@ chmod +x cejel
 ./cejel .
 ```
 
+**Windows x86_64 (PowerShell).**
+
+```powershell
+$asset = "cejel-Windows-x86_64.exe"
+Invoke-WebRequest "https://github.com/BargLabs/cejel/releases/latest/download/$asset" -OutFile $asset
+Invoke-WebRequest "https://github.com/BargLabs/cejel/releases/latest/download/SHA256SUMS" -OutFile SHA256SUMS
+$expected = ((Select-String -Path SHA256SUMS -Pattern "  $([regex]::Escape($asset))$").Line -split "\s+")[0]
+$actual = (Get-FileHash -Algorithm SHA256 $asset).Hash.ToLowerInvariant()
+if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
+  throw "SHA-256 verification failed for $asset"
+}
+.\cejel-Windows-x86_64.exe .
+```
+
+> **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
+> 0.2.2 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
+> it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
+> GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM and an
+> own-platform verification receipt covering `--version`, `--help`, a real scan,
+> source/binary parity, and a network-denied scan. If your policy requires Authenticode,
+> use the npm package or the OCI image until a human-approved signing path is available.
+
 **Don't take the offline claim on trust — check it.** Turn your network off, then run the
 binary. It will score your repository and write you a certificate anyway. That is the whole
 product, and you can falsify it in ten seconds:
@@ -58,7 +84,17 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 **npm.**
 
 ```bash
-npx @cejel/cejel .
+npx @cejel/cejel@latest .
+```
+
+> **Distribution note:** Cejel `0.2.2` is the coordinated release version for npm,
+> standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry.
+
+`npx` can reuse a stale cached package. Force the current npm release with the `@latest`
+specifier above, and check the version that will run before comparing certificates:
+
+```bash
+npx @cejel/cejel@latest --version
 ```
 
 If a root `package.json` still carries a template name, override only the certificate display
@@ -86,29 +122,30 @@ pnpm install && pnpm build
 node dist/index.js .
 ```
 
-Released binaries: `cejel-Darwin-arm64`, `cejel-Darwin-x86_64`, `cejel-Linux-aarch64`, and
-`cejel-Linux-x86_64`. The release also carries `SHA256SUMS`; each binary is executed against
-the source build and with networking denied before attachment. Releases from v0.1.6 also
-carry a Sigstore bundle containing GitHub's signed build-provenance attestation for all four
-binaries. Verify a downloaded binary with:
+Released binaries: `cejel-Darwin-arm64`, `cejel-Darwin-x86_64`, `cejel-Linux-aarch64`,
+`cejel-Linux-x86_64`, and `cejel-Windows-x86_64.exe`. The release also carries
+`SHA256SUMS`, a per-binary SPDX SBOM, and an own-platform verification receipt. Each binary
+is executed against the source build and with networking denied before attachment. Releases
+from v0.1.6 also carry a Sigstore bundle containing GitHub's signed build-provenance
+attestation for the release set. Verify a downloaded binary with:
 
 ```bash
-gh attestation verify ./cejel-Darwin-arm64 -R BargLabs/cejel
+gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 ```
 
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The same MCP server is published as a non-root, multi-platform image:
+**Docker / OCI.** The current container release is `0.2.2`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.2.0
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.2.2
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.2.0 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.2.2 .
 ```
 
 The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
@@ -356,6 +393,46 @@ The server exposes one tool and two resources:
 Like the CLI, scoring over MCP is fully offline: no network calls, no telemetry, no signup,
 and the server writes no files.
 
+## Install on OpenClaw
+
+OpenClaw stores outbound MCP servers under `mcp.servers`. Add Cejel with the npm package's
+shipped `cejel-mcp` bin:
+
+```json
+{
+  "mcp": {
+    "servers": {
+      "cejel": {
+        "command": "npx",
+        "args": ["-y", "--package=@cejel/cejel", "cejel-mcp"]
+      }
+    }
+  }
+}
+```
+
+The equivalent OpenClaw command is:
+
+```bash
+openclaw mcp add cejel --command npx --arg -y --arg --package=@cejel/cejel --arg cejel-mcp
+openclaw mcp doctor cejel --probe
+```
+
+The OCI image is an alternative when Docker is the preferred execution boundary. Replace
+the host path with the repository OpenClaw should allow Cejel to read:
+
+```bash
+openclaw mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.2.2"]}'
+openclaw mcp doctor cejel-oci --probe
+```
+
+Cejel is active in the Official MCP Registry as `io.github.BargLabs/cejel`. The explicit
+OpenClaw configuration above works independently of catalog indexing.
+
+Cejel scans code you point it at. This free adoption surface does **not** watch, intercept,
+or govern an agent's runtime actions. Runtime-action governance is a separate boundary for
+the future paid Agent Pack.
+
 ## What "offline" means here
 
 Scoring a repo — `cejel scan .` itself, and the Action's scoring step — makes zero network

package/dist/{chunk-PYI3OIBW.js → chunk-SNDRU52Z.js}

@@ -4368,7 +4368,7 @@ var WitanAttestationStatementSchema = external_exports.object({
 var WITAN_NO_MEASUREMENT_REASON = "No free-core rubric criterion produced a measurable signal. Cejel abstains rather than publish a numeric zero for an entirely unmeasured repository.";
 var WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the complete tracked inventory contains no concrete test file, configured test runner, CI test command, or coverage configuration.";
 function isWitanNoMeasurementAbstention(report) {
-  return report.verdict === "insufficient_source" && report.insufficientSourceReason === WITAN_NO_MEASUREMENT_REASON && report.criteria.every(
+  return report.verdict === "insufficient_source" && report.insufficientSourceReason.startsWith(WITAN_NO_MEASUREMENT_REASON) && report.criteria.every(
     ({ status }) => status === "not_applicable" || status === "insufficient_data"
   );
 }
@@ -4544,7 +4544,7 @@ function formatMetricValue(value) {
 }
 
 // src/witan/html.ts
-function renderWitanHtmlReport(report) {
+function renderWitanHtmlReport(report, options = {}) {
   const codeCriteria = criteriaByCategory(report, "code_trust");
   const processCriteria = criteriaByCategory(report, "process_trust");
   const verifiedEvidence = report.criteria.flatMap(
@@ -4555,6 +4555,7 @@ function renderWitanHtmlReport(report) {
   const externalSourceSummaries = summarizeExternalSources(report.consumedSignals ?? []);
   const externalFindings = collectExternalFindings(report.consumedSignals ?? []);
   const coverage = computeMeasuredCoverage(report);
+  const gitHistoryUnavailable = !report.repo.headSha;
   return `<!doctype html>
 <html lang="en">
 <head>
@@ -4577,6 +4578,7 @@ function renderWitanHtmlReport(report) {
           <dl class="meta">
             <div><dt>Date</dt><dd>${escapeHtml(formatDate(report.generatedAt))}</dd></div>
             <div><dt>Run</dt><dd>${escapeHtml(renderRepo(report))}</dd></div>
+            <div><dt>CLI</dt><dd>${escapeHtml(options.cliVersion ? `Cejel ${options.cliVersion}` : "Not recorded")}</dd></div>
             <div><dt>Rubric</dt><dd>${escapeHtml(report.rubricVersion)}</dd></div>
             ${contributingSources.length > 0 ? `<div><dt>Sources</dt><dd>Incorporates findings from: ${escapeHtml(contributingSources.join(", "))}<ul class="source-counts">${externalSourceSummaries.map((s) => `<li>${escapeHtml(formatExternalSourceLine(s))}</li>`).join("")}</ul></dd></div>` : ""}
           </dl>
@@ -4597,8 +4599,8 @@ function renderWitanHtmlReport(report) {
     </header>
 
     <section class="trust-grid" aria-label="Rubric criteria">
-      ${renderCriterionColumn("Code trust", codeCriteria)}
-      ${renderCriterionColumn("Process trust", processCriteria)}
+      ${renderCriterionColumn("Code trust", codeCriteria, gitHistoryUnavailable)}
+      ${renderCriterionColumn("Process trust", processCriteria, gitHistoryUnavailable)}
     </section>
 
     <section class="evidence-grid" aria-label="Evidence and gaps">
@@ -4641,7 +4643,7 @@ function renderExternalFindingItems(findings) {
 function criteriaByCategory(report, category) {
   return report.criteria.filter((criterion) => criterion.category === category);
 }
-function renderCriterionColumn(title, criteria) {
+function renderCriterionColumn(title, criteria, gitHistoryUnavailable) {
   const applicable = criteria.filter((criterion) => criterion.status !== "not_applicable");
   const notApplicable = criteria.filter((criterion) => criterion.status === "not_applicable");
   const notApplicableGroup = notApplicable.length > 0 ? `
@@ -4649,7 +4651,7 @@ function renderCriterionColumn(title, criteria) {
   return `<section class="criteria-column">
         <h2>${escapeHtml(title)}</h2>
         <div class="criteria-list">
-          ${applicable.map(renderCriterionCard).join("")}
+          ${applicable.map((criterion) => renderCriterionCard(criterion, gitHistoryUnavailable)).join("")}
         </div>${notApplicableGroup}
       </section>`;
 }
@@ -4665,12 +4667,14 @@ function renderNotApplicableItem(criterion) {
   const reason = criterion.notes ?? "Not applicable to this repository.";
   return `<li><span class="na-id">${escapeHtml(criterion.id)}</span> ${escapeHtml(criterion.title)} \u2014 <span class="na-reason">${escapeHtml(reason)}</span></li>`;
 }
-function renderCriterionCard(criterion) {
+function renderCriterionCard(criterion, gitHistoryUnavailable) {
   const evidence = [
     ...criterion.evidence.map(renderEvidencePointer),
     ...criterion.findings.map((finding) => renderFindingEvidence(criterion, finding))
   ];
   const metrics = criterion.metrics.map(renderMetric);
+  const statusReconciliation = renderStatusReconciliation(criterion);
+  const historyWarning = gitHistoryUnavailable && criterion.metrics.some((metric2) => metric2.name === "pr_merge_ratio") ? `<p class="scan-warning"><strong>Scan limitation:</strong> Git history was unavailable (for example, this may be a source tarball), so the recent PR merge ratio is not a measured repository outcome and its displayed zero may undercount ${escapeHtml(criterion.id)}. Re-scan a full Git clone for this signal.</p>` : "";
   return `<article class="criterion">
             <div class="criterion-top">
               <div>
@@ -4680,6 +4684,8 @@ function renderCriterionCard(criterion) {
               ${renderStatusChip(criterion.status)}
             </div>
             <div class="criterion-score">${criterion.status === "not_applicable" ? "N/A" : criterion.status === "insufficient_data" ? "No data" : formatScore(criterion.score)}</div>
+            ${statusReconciliation}
+            ${historyWarning}
             <ul class="criterion-metrics">
               ${metrics.length > 0 ? metrics.map((item) => `<li>${item}</li>`).join("") : "<li>No measured depth metrics supplied.</li>"}
             </ul>
@@ -4688,6 +4694,20 @@ function renderCriterionCard(criterion) {
             </ul>
           </article>`;
 }
+function renderStatusReconciliation(criterion) {
+  if (criterion.status === "not_applicable" || criterion.status === "insufficient_data" || criterion.status === "unverified") {
+    return "";
+  }
+  const numericBand = scoreBandForPresentation(criterion.score);
+  if (numericBand === criterion.status) return "";
+  return `<p class="status-explanation"><strong>Why the labels differ:</strong> the ${escapeHtml(criterion.status)} dimension band is calibrated from criterion evidence thresholds and findings, independently of the ${formatScore(criterion.score)}/4.0 weighted score (which falls in the ${numericBand} numeric band).</p>`;
+}
+function scoreBandForPresentation(score) {
+  if (score >= 3.5) return "verified";
+  if (score >= 2.5) return "info";
+  if (score >= 1.5) return "warning";
+  return "critical";
+}
 function renderMetric(metric2) {
   const unit = metric2.unit ? ` ${escapeHtml(metric2.unit)}` : "";
   if (metric2.kind === "saturating_count" && metric2.max !== void 0 && metric2.value > metric2.max) {
@@ -4860,6 +4880,12 @@ h2 { font-family: var(--serif); font-size: 30px; font-weight: 400; letter-spacin
 .criterion-id { color: var(--periwinkle); font-family: var(--mono); font-size: 12px; margin-bottom: 4px; }
 h3 { font-size: 15px; line-height: 1.35; font-weight: 600; margin-bottom: 0; }
 .criterion-score { margin-top: 12px; color: var(--text); font-family: var(--mono); font-size: 24px; }
+.status-explanation, .scan-warning {
+  margin: 10px 0 0; border-left: 3px solid var(--periwinkle); padding: 8px 10px;
+  background: var(--periwinkle-weak); color: var(--muted); font-size: 12px; line-height: 1.5;
+}
+.scan-warning { border-left-color: var(--warn); background: var(--warn-weak); }
+.status-explanation strong, .scan-warning strong { color: var(--text); }
 .criterion-metrics { display: grid; gap: 7px; margin-top: 10px; padding: 0; list-style: none; font-size: 12px; }
 .criterion-metrics li { display: flex; justify-content: space-between; gap: 12px; border-bottom: 1px solid rgba(238, 244, 247, .08); padding-bottom: 6px; }
 .criterion-metrics strong { color: var(--text); font-weight: 650; }
@@ -5086,8 +5112,12 @@ var WITAN_RUBRIC_VERSION_V14 = "witan-rubric-v14-2026-07-23";
 var WITAN_RUBRIC_VERSION_V15 = "witan-rubric-v15-2026-07-24";
 var WITAN_RUBRIC_VERSION_V16 = "witan-rubric-v16-2026-07-24";
 var WITAN_RUBRIC_VERSION_V17 = "witan-rubric-v17-2026-07-24";
+var WITAN_RUBRIC_VERSION_V18 = "witan-rubric-v18-prospective-2026-07-25";
 
 // src/witan/repo-signals.ts
+function usesV17DetectorClosure(rubricVersion) {
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18;
+}
 function buildWitanInputFromRepo(options) {
   assertRepoPathExists(options.repoPath);
   const generatedAt = options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
@@ -5096,26 +5126,27 @@ function buildWitanInputFromRepo(options) {
   const repoFiles = listRepoFiles(options.repoPath);
   const inventoryFiles = listRepoInventory(options.repoPath, repoFiles);
   const ignoredTargetReason = repoFiles.length === 0 ? explainIgnoredScanTarget(options.repoPath) : void 0;
-  const usesV17Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V17;
+  const usesV17Detectors = usesV17DetectorClosure(rubricVersion);
+  const usesV18NativeRls = rubricVersion === WITAN_RUBRIC_VERSION_V18;
   const structuralArchetype = classifyRepoArchetype(inventoryFiles, rubricVersion);
-  const readableArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 ? applyReadableSourceRepresentationGate(
+  const readableArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion) ? applyReadableSourceRepresentationGate(
     options.repoPath,
     inventoryFiles,
     structuralArchetype,
     headSha,
     rubricVersion
   ) : structuralArchetype;
-  const gatedArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 ? applySemanticSourceRepresentationGate(
+  const gatedArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion) ? applySemanticSourceRepresentationGate(
     options.repoPath,
     inventoryFiles,
     readableArchetype,
     rubricVersion
   ) : readableArchetype;
-  const usesV8Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17;
-  const usesV33Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17;
-  const usesV36Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17;
-  const usesV39Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17;
-  const usesV47Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17;
+  const usesV8Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion);
+  const usesV33Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion);
+  const usesV36Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion);
+  const usesV39Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion);
+  const usesV47Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion);
   const reviewableSourceProof = usesV17Detectors ? buildReviewableSourceProof(options.repoPath, inventoryFiles, headSha, rubricVersion) : void 0;
   const coreSignals = collectRepoSignals(
     options.repoPath,
@@ -5126,6 +5157,7 @@ function buildWitanInputFromRepo(options) {
     usesV36Detectors,
     usesV39Detectors,
     usesV47Detectors,
+    usesV18NativeRls,
     reviewableSourceProof
   );
   const archetype = usesV17Detectors && reviewableSourceProof?.passes === true && isV17RescuableAbstention(gatedArchetype.abstentionKind) && coreSignals.some(isMeasuredCriterionSignal) ? {
@@ -5233,7 +5265,7 @@ var SOURCE_EXTENSION_PATTERN_V10 = new RegExp(
   "i"
 );
 function isRecognizedSourcePath(path, rubricVersion = WITAN_RUBRIC_VERSION) {
-  return (rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 ? SOURCE_EXTENSION_PATTERN_V10 : SOURCE_EXTENSION_PATTERN).test(path);
+  return (rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion) ? SOURCE_EXTENSION_PATTERN_V10 : SOURCE_EXTENSION_PATTERN).test(path);
 }
 var BUNDLED_BINARY_EXTENSION_PATTERN = /\.(vsix|zip|tgz|whl|exe|dmg|pkg|msi|jar|war|apk|ipa|dll|dylib|ttf|otf|woff2?|eot|eps)$/i;
 var DOCS_OR_MEDIA_EXTENSION_PATTERN = /\.(md|mdx|rst|png|jpe?g|gif|svg|webp|ico|pdf)$/i;
@@ -5249,6 +5281,7 @@ var SOURCE_DOMINANCE_RATIO_THRESHOLD_V8 = 0.2;
 var SOURCE_DOMINANCE_RATIO_THRESHOLD_V9 = 0.8;
 var SOURCE_DOMINANCE_RATIO_THRESHOLD_V10 = 0.5;
 var SOURCE_DOMINANCE_RATIO_THRESHOLD_V11 = 0.2;
+var V17_REVIEWABLE_SOURCE_RATABLE_SHARE_THRESHOLD = 0.2;
 var GENERATED_SOURCE_MINIMUM = 8;
 var GENERATED_SOURCE_RATIO_THRESHOLD = 0.8;
 var GENERATED_AUTHORED_MAXIMUM = 3;
@@ -5292,7 +5325,7 @@ function classifyRepoArchetype(repoFiles, rubricVersion = WITAN_RUBRIC_VERSION)
       insufficientSourceReason: `${catalogSourceFiles.length} of ${sourceFileCount} source-shaped file(s) are under independent solution, exercise, challenge, or algorithm catalog paths; only ${sourceFileCount - catalogSourceFiles.length} source-shaped file(s) remain outside that catalog. Cejel abstains because the repository does not expose one cohesive product implementation to score. ${INGEST_POINTER}`
     };
   }
-  if (rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) {
+  if (rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion)) {
     const authoredSourceFiles = sourceFiles.filter(isAuthoredProductionPath);
     const documentationFiles = repoFiles.filter(
       (file) => DOCS_OR_MEDIA_EXTENSION_PATTERN.test(file)
@@ -5310,7 +5343,7 @@ function classifyRepoArchetype(repoFiles, rubricVersion = WITAN_RUBRIC_VERSION)
       (file) => ARTIFACT_DOMINANCE_EXTENSION_PATTERN.test(file)
     );
     const materialFiles = authoredSourceFiles.length + artifactFiles.length;
-    if (artifactFiles.length >= 10 && (authoredSourceFiles.length <= 10 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) && materialFiles > 0 && authoredSourceFiles.length / materialFiles <= 0.1) {
+    if (artifactFiles.length >= 10 && (authoredSourceFiles.length <= 10 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion)) && materialFiles > 0 && authoredSourceFiles.length / materialFiles <= 0.1) {
       return {
         archetype: "binary_only",
         sourceFileCount,
@@ -5337,7 +5370,7 @@ function classifyRepoArchetype(repoFiles, rubricVersion = WITAN_RUBRIC_VERSION)
     const docsDistributionFiles = repoFiles.filter(
       (file) => DOCS_OR_MEDIA_EXTENSION_PATTERN.test(file) || DOC_DISTRIBUTION_COMPANION_PATTERN.test(file)
     );
-    if (docsFiles.length > 0 && (docsDistributionFiles.length === totalFileCount || (rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) && unrecognisedSourceFiles.length === 0)) {
+    if (docsFiles.length > 0 && (docsDistributionFiles.length === totalFileCount || (rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion)) && unrecognisedSourceFiles.length === 0)) {
       return {
         archetype: "docs_only",
         sourceFileCount,
@@ -5456,6 +5489,23 @@ function isRepresentativeSourceText(contents) {
 function representativeSourceRank(rankKey, file) {
   return createHash2("sha256").update(`${rankKey}:${file}`).digest("hex");
 }
+function explainNoMeasurementSourceCoverage(repoPath, rubricVersion) {
+  if (!usesV17DetectorClosure(rubricVersion)) return void 0;
+  const repoFiles = listRepoFiles(repoPath);
+  const inventoryFiles = listRepoInventory(repoPath, repoFiles);
+  const proof = buildReviewableSourceProof(
+    repoPath,
+    inventoryFiles,
+    readGitHead(repoPath),
+    rubricVersion
+  );
+  if (proof.sourceShapedFileCount === 0) return void 0;
+  const ratableShare = proof.eligibleSourceFileCount / proof.sourceShapedFileCount;
+  if (ratableShare >= V17_REVIEWABLE_SOURCE_RATABLE_SHARE_THRESHOLD) return void 0;
+  const ratablePct = (ratableShare * 100).toFixed(1);
+  const thresholdPct = (V17_REVIEWABLE_SOURCE_RATABLE_SHARE_THRESHOLD * 100).toFixed(0);
+  return `${WITAN_NO_MEASUREMENT_REASON} Source coverage: ${proof.eligibleSourceFileCount} of ${proof.sourceShapedFileCount} source-shaped files (${ratablePct}%) are criterion-ratable, below the ${thresholdPct}% reviewable-source threshold (${inventoryFiles.length} tracked files in total).`;
+}
 function buildReviewableSourceProof(repoPath, repoFiles, headSha, rubricVersion) {
   const sourceShapedFiles = repoFiles.filter(
     (path) => isRecognizedSourcePath(path, rubricVersion) || isUnrecognisedSourcePath(path, rubricVersion) || /\.ipynb$/i.test(path)
@@ -5480,7 +5530,7 @@ function buildReviewableSourceProof(repoPath, repoFiles, headSha, rubricVersion)
     sampledFileCount: sample.length,
     readableSampledFileCount: readablePaths.length,
     ...readablePaths[0] ? { firstReadablePath: readablePaths[0] } : {},
-    passes: eligibleSourceFiles.length > 0 && ratableShare >= 0.2 && readablePaths.length > 0 && (readableShare >= 0.75 || readablePaths.length >= 8)
+    passes: eligibleSourceFiles.length > 0 && ratableShare >= V17_REVIEWABLE_SOURCE_RATABLE_SHARE_THRESHOLD && readablePaths.length > 0 && (readableShare >= 0.75 || readablePaths.length >= 8)
   };
 }
 function applyReadableSourceRepresentationGate(repoPath, repoFiles, classification, headSha, rubricVersion) {
@@ -5622,7 +5672,7 @@ function readRepresentativeSourceText(repoPath, file) {
   }
 }
 function sourceDominanceThreshold(rubricVersion) {
-  if (rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) {
+  if (rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion)) {
     return SOURCE_DOMINANCE_RATIO_THRESHOLD_V11;
   }
   if (rubricVersion === WITAN_RUBRIC_VERSION_V10) return SOURCE_DOMINANCE_RATIO_THRESHOLD_V10;
@@ -5636,7 +5686,7 @@ function isUnrecognisedSourcePath(file, rubricVersion = WITAN_RUBRIC_VERSION) {
   const base = basename(file);
   if (!/\.([a-zA-Z0-9_]+)$/.test(base)) return false;
   if (KNOWN_NON_SOURCE_EXTENSION_PATTERN.test(base)) return false;
-  if ((rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) && V13_NON_SOURCE_EXTENSION_PATTERN.test(base)) {
+  if ((rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion)) && V13_NON_SOURCE_EXTENSION_PATTERN.test(base)) {
     return false;
   }
   if (DOCS_OR_MEDIA_EXTENSION_PATTERN.test(base)) return false;
@@ -5722,7 +5772,7 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, reviewableSourceProof) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, reviewableSourceProof) {
   const signals = [];
   const mono = resolveMonorepoContext(repoPath);
   const a1Signal = collectA1TestIntegrityEvidence(
@@ -5740,7 +5790,8 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
     useV33Detectors,
     useV36Detectors,
     useV39Detectors,
-    useV47Detectors
+    useV47Detectors,
+    useV18NativeRls
   );
   const a3Signal = collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors);
   const a4Signal = collectA4DependencyEvidence(
@@ -6032,7 +6083,7 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof) {
     notes: `V17 authenticated absence: ${proof.eligibleSourceFileCount} criterion-ratable of ${proof.sourceShapedFileCount} source-shaped files; sampled ${proof.sampledFileCount}; ${proof.readableSampledFileCount} representative-text files.`
   };
 }
-function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors) {
+function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls) {
   const evidence = [];
   const findings = [];
   const gitignore = repoFiles.find((file) => basename(file) === ".gitignore");
@@ -6128,19 +6179,21 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
     evidence.push(evidenceForRelative(repoPath, dbLayerImportFile, "artifact", "DB client import"));
   }
   const v47RlsPolicyFiles = useV47Detectors ? findRlsPolicyFiles(repoPath, repoFiles) : [];
-  const v47TenantStorageFiles = useV47Detectors ? findTenantStoragePremiseFiles(repoPath, repoFiles) : [];
+  const nativeRlsInventory = useV18NativeRls ? deriveRlsPolicyScopeInventory(repoPath, repoFiles) : null;
+  const tenantWithoutRlsPremiseFiles = useV18NativeRls ? findTenantStoragePremiseFiles(repoPath, repoFiles) : [];
+  const v47TenantStorageFiles = useV47Detectors && !useV18NativeRls ? findTenantStoragePremiseFiles(repoPath, repoFiles) : [];
   const rlsMigration = useV47Detectors ? v47RlsPolicyFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, RLS_PATTERN));
   const tenantScopePattern = useV39Detectors ? TENANT_SCOPE_PATTERN_V11 : useV36Detectors ? TENANT_SCOPE_PATTERN_V10 : TENANT_SCOPE_PATTERN;
-  const tenantScopedFile = useV47Detectors ? v47TenantStorageFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, tenantScopePattern));
-  const rlsPolicyCount = useV47Detectors ? v47RlsPolicyFiles.length : countPatternMatches(
+  const tenantScopedFile = useV18NativeRls ? nativeRlsInventory?.storageFiles[0] : useV47Detectors ? v47TenantStorageFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, tenantScopePattern));
+  const rlsPolicyCount = useV18NativeRls ? nativeRlsInventory?.policyCount ?? 0 : useV47Detectors ? v47RlsPolicyFiles.length : countPatternMatches(
     repoPath,
     migrationFiles,
     /create policy|enable row level security|force row level security/gi
   );
-  const tenantScopedMigrationFileCount = useV47Detectors ? v47TenantStorageFiles.length : countFilesContaining(repoPath, migrationFiles, tenantScopePattern);
+  const tenantScopedMigrationFileCount = useV18NativeRls ? nativeRlsInventory?.storageFiles.length ?? 0 : useV47Detectors ? v47TenantStorageFiles.length : countFilesContaining(repoPath, migrationFiles, tenantScopePattern);
   const gitignoreEnvFile = gitignore && fileContains(repoPath, gitignore, /^\.env(\*|\b)|\.env\./m) ? gitignore : null;
   const envHandlingDepth = (envExamples.length > 0 ? 1 : 0) + (gitignoreEnvFile ? 1 : 0) + (countFilesContaining(repoPath, repoFiles.filter(isImplementationFile), ENV_READ_PATTERN) > 0 ? 1 : 0);
-  const isMultiTenant = tenantScopedMigrationFileCount > 0;
+  const isMultiTenant = useV18NativeRls ? (nativeRlsInventory?.policyCount ?? 0) > 0 && (nativeRlsInventory?.scopeIdentifiers.length ?? 0) > 0 : tenantScopedMigrationFileCount > 0;
   if (gitignoreEnvFile) {
     evidence.push(
       evidenceForRelative(repoPath, gitignoreEnvFile, "secret_scan", ".env files are gitignored")
@@ -6156,7 +6209,12 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   }
   if (tenantScopedFile) {
     evidence.push(
-      evidenceForRelative(repoPath, tenantScopedFile, "artifact", "Tenant scoping signal")
+      evidenceForRelative(
+        repoPath,
+        tenantScopedFile,
+        "artifact",
+        useV18NativeRls ? `Repository-native RLS scope (${nativeRlsInventory?.scopeIdentifiers.join(", ")})` : "Tenant scoping signal"
+      )
     );
   }
   if (committedSecret) {
@@ -6214,8 +6272,9 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       evidence: historySecretScan.envPathEvidence
     });
   }
-  if (isMultiTenant && rlsPolicyCount === 0) {
-    const gapEvidence = rlsMigration ?? tenantScopedFile;
+  const hasTenantWithoutRlsGap = rlsPolicyCount === 0 && (useV18NativeRls ? tenantWithoutRlsPremiseFiles.length > 0 : isMultiTenant);
+  if (hasTenantWithoutRlsGap) {
+    const gapEvidence = rlsMigration ?? tenantScopedFile ?? tenantWithoutRlsPremiseFiles[0];
     if (gapEvidence) {
       findings.push({
         severity: "warning",
@@ -6258,20 +6317,20 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       "rls_policy_count",
       "RLS policy count",
       rlsPolicyCount,
-      Math.max(tenantScopedMigrationFileCount * 3, 3),
+      useV18NativeRls ? Math.max(tenantScopedMigrationFileCount, 1) : Math.max(tenantScopedMigrationFileCount * 3, 3),
       0.4,
       "policies",
-      "Counts static row-level-security enables, forced-RLS statements, and policy definitions.",
+      useV18NativeRls ? "Counts CREATE POLICY definitions with repository-native USING/WITH CHECK clauses against the repository-native scoped data-layer surface." : "Counts static row-level-security enables, forced-RLS statements, and policy definitions.",
       "saturating_count"
     ),
     metric(
       "tenant_scope_ratio",
       "Tenant-scoped schema ratio",
-      countFilesContaining(repoPath, migrationFiles, tenantScopePattern),
+      useV18NativeRls ? tenantScopedMigrationFileCount : countFilesContaining(repoPath, migrationFiles, tenantScopePattern),
       Math.max(migrationFiles.length, 1),
       0.25,
       "ratio",
-      "Measures tenant/studio/workspace scoping evidence across data-layer files."
+      useV18NativeRls ? `Measures repository-native RLS scope identifiers (${nativeRlsInventory?.scopeIdentifiers.join(", ")}) across data-layer files.` : "Measures tenant/studio/workspace scoping evidence across data-layer files."
     )
   ] : [];
   const cryptoMetrics = cryptoHygiene.hasSurface ? [
@@ -6290,7 +6349,7 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
     positiveEvidence: evidence,
     findings,
     metrics: [...baseMetrics, ...isolationMetrics, ...cryptoMetrics],
-    notes: "History secret scanning covers all reachable git history for credential-pattern paths unless the explicit credential-blob safety valve is reported."
+    notes: useV18NativeRls ? "History secret scanning covers all reachable git history for credential-pattern paths unless the explicit credential-blob safety valve is reported. Positive multi-tenancy credit is derived only from this repository\u2019s own CREATE POLICY USING/WITH CHECK clauses; no fixed tenant-token vocabulary can create isolation credit. A conservative schema premise is retained only to fail closed when a tenant-shaped schema has zero RLS policies." : "History secret scanning covers all reachable git history for credential-pattern paths unless the explicit credential-blob safety valve is reported."
   };
 }
 function collectCryptoHygieneEvidence(repoPath, implFiles, useV39Detectors = false) {
@@ -7186,7 +7245,7 @@ var TEST_DIRECTORY_SOURCE_PATTERN_V17 = new RegExp(
   "i"
 );
 function isTestFile(file, rubricVersion = WITAN_RUBRIC_VERSION) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V17 && (TEST_DIRECTORY_SOURCE_PATTERN_V17.test(file) || /\.tftest\.hcl$/i.test(file) || /\.bats$/i.test(file) || /(^|\/)test[^/]*\.m$/i.test(file) || /_test\.m$/i.test(file)) || TEST_DIRECTORY_SOURCE_PATTERN.test(file) || // AVA's default discovery includes test.js and test-*.js at the scanned package root.
+  return usesV17DetectorClosure(rubricVersion) && (TEST_DIRECTORY_SOURCE_PATTERN_V17.test(file) || /\.tftest\.hcl$/i.test(file) || /\.bats$/i.test(file) || /(^|\/)test[^/]*\.m$/i.test(file) || /_test\.m$/i.test(file)) || TEST_DIRECTORY_SOURCE_PATTERN.test(file) || // AVA's default discovery includes test.js and test-*.js at the scanned package root.
   // Keep this root-anchored: nested files need an existing test-directory/suffix convention.
   /^test(?:-[^/]+)?\.[cm]?[jt]sx?$/.test(file) || /\.(test|spec)\.[cm]?[jt]sx?$/.test(file) || /(^|\/)test_.*\.py$/.test(file) || /_test\.go$/.test(file) || /(^|\/)test_.*\.(cpp|cc|cxx)$/.test(file) || /_(test|tests)\.(cpp|cc|cxx)$/.test(file) || /Tests?\.(java|kt)$/.test(file) || /(_test|_spec)\.(rs|rb|php|swift|kt)$/.test(file);
 }
@@ -7857,6 +7916,138 @@ function findRlsPolicyFiles(repoPath, repoFiles) {
     )
   );
 }
+var RLS_CLAUSE_SQL_WORDS = /* @__PURE__ */ new Set([
+  "all",
+  "and",
+  "any",
+  "as",
+  "asc",
+  "between",
+  "by",
+  "case",
+  "cast",
+  "current",
+  "desc",
+  "distinct",
+  "else",
+  "end",
+  "exists",
+  "false",
+  "from",
+  "in",
+  "is",
+  "join",
+  "like",
+  "limit",
+  "not",
+  "null",
+  "on",
+  "or",
+  "order",
+  "select",
+  "then",
+  "text",
+  "true",
+  "uuid",
+  "varchar",
+  "when",
+  "where"
+]);
+function extractBalancedSqlClause(statement, keyword) {
+  const clauses = [];
+  const keywordPattern = keyword === "using" ? /\busing\s*\(/gi : /\bwith\s+check\s*\(/gi;
+  for (const match of statement.matchAll(keywordPattern)) {
+    const openingParen = (match.index ?? 0) + match[0].lastIndexOf("(");
+    let depth = 0;
+    let quote = null;
+    for (let index = openingParen; index < statement.length; index += 1) {
+      const character = statement[index];
+      if (quote) {
+        if (character === quote && statement[index - 1] !== "\\") quote = null;
+        continue;
+      }
+      if (character === "'" || character === '"') {
+        quote = character;
+      } else if (character === "(") {
+        depth += 1;
+      } else if (character === ")") {
+        depth -= 1;
+        if (depth === 0) {
+          clauses.push(statement.slice(openingParen + 1, index));
+          break;
+        }
+      }
+    }
+  }
+  return clauses;
+}
+function extractRlsScopeIdentifiers(clause) {
+  const scrubbed = clause.replace(/'(?:''|[^'])*'/g, " ").replace(/"(?:""|[^"])*"/g, " ");
+  const identifiers = /* @__PURE__ */ new Set();
+  const identifierPattern = /\b[A-Za-z_][A-Za-z0-9_$]*(?:\.[A-Za-z_][A-Za-z0-9_$]*)*\b/g;
+  for (const match of scrubbed.matchAll(identifierPattern)) {
+    const token = match[0];
+    const segments = token.split(".").map((segment) => segment.toLowerCase());
+    const lastSegment = segments.at(-1);
+    if (!lastSegment || lastSegment.length < 2 || RLS_CLAUSE_SQL_WORDS.has(lastSegment)) continue;
+    if (["app", "auth", "jwt", "request", "session"].includes(segments[0] ?? "")) continue;
+    const remainder = scrubbed.slice((match.index ?? 0) + token.length);
+    if (/^\s*\(/.test(remainder)) continue;
+    if (["auth", "current_setting", "jwt", "pg_catalog", "public", "uid"].includes(lastSegment)) {
+      continue;
+    }
+    identifiers.add(lastSegment);
+  }
+  return [...identifiers].sort();
+}
+function deriveRlsPolicyScopeInventory(repoPath, repoFiles) {
+  const candidatePolicyFiles = findRlsPolicyFiles(repoPath, repoFiles);
+  const policyFiles = /* @__PURE__ */ new Set();
+  const scopeIdentifiers = /* @__PURE__ */ new Set();
+  let policyCount = 0;
+  for (const file of candidatePolicyFiles) {
+    let content;
+    try {
+      content = readFileSync(join(repoPath, file), "utf8");
+    } catch {
+      continue;
+    }
+    for (const match of content.matchAll(/\bcreate\s+policy\b[\s\S]*?(?:;|$)/gi)) {
+      const statement = match[0];
+      const clauses = [
+        ...extractBalancedSqlClause(statement, "using"),
+        ...extractBalancedSqlClause(statement, "with check")
+      ];
+      if (clauses.length === 0) continue;
+      policyCount += 1;
+      policyFiles.add(file);
+      for (const clause of clauses) {
+        for (const identifier of extractRlsScopeIdentifiers(clause)) {
+          scopeIdentifiers.add(identifier);
+        }
+      }
+    }
+  }
+  const identifiers = [...scopeIdentifiers].sort();
+  const dataLayerFiles = repoFiles.filter(
+    (file) => /(^|\/)(?:migrations?|drizzle|prisma)\/|\.(?:sql|prisma)$/i.test(file)
+  );
+  const storageFiles = identifiers.length === 0 ? [] : dataLayerFiles.filter(
+    (file) => identifiers.some(
+      (identifier) => fileContains(
+        repoPath,
+        file,
+        new RegExp(`\\b${identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`, "i")
+      )
+    )
+  );
+  return {
+    policyFiles: [...policyFiles].sort(),
+    policyCount,
+    scopeIdentifiers: identifiers,
+    storageFiles
+  };
+}
 function findDeployableServicePremiseFiles(repoPath, repoFiles, strictOperationalBoundary = false) {
   const explicitTargets = repoFiles.filter(
     (file) => isAuthoredProductionPath(file) && isExplicitDeployTarget(file) && (!strictOperationalBoundary || isV47OperationalApplicationPath(file))
@@ -9605,6 +9796,9 @@ var WITAN_RUBRIC = [
 ];
 
 // src/witan/scoring.ts
+function usesV17DetectorClosure2(rubricVersion) {
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18;
+}
 var MAX_SIGNAL_ADJUSTMENT = 0.8;
 function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
   const parsedInput = WitanReportInputSchema.parse(input);
@@ -9688,7 +9882,7 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
   const isFreeCoreRubric = rubric.length === WITAN_RUBRIC.length && rubric.every(
     ({ id, category }, index) => id === WITAN_RUBRIC[index]?.id && category === WITAN_RUBRIC[index]?.category
   );
-  const noMeasurementAbstention = (parsedInput.rubricVersion === WITAN_RUBRIC_VERSION_V16 || parsedInput.rubricVersion === WITAN_RUBRIC_VERSION_V17) && isFreeCoreRubric && !hasMeasuredCriterion;
+  const noMeasurementAbstention = (parsedInput.rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure2(parsedInput.rubricVersion)) && isFreeCoreRubric && !hasMeasuredCriterion;
   const insufficientSourceReason = parsedInput.insufficientSourceReason ?? (noMeasurementAbstention ? WITAN_NO_MEASUREMENT_REASON : void 0);
   const abstained = insufficientSourceReason != null;
   return WitanReportSchema.parse({
@@ -9756,7 +9950,7 @@ function statusForScore(score) {
 }
 function statusAfterInputAdjustment(nativeStatus, nativeScore, adjustment, rubricVersion) {
   if (adjustment === 0) return nativeStatus;
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18) {
     return statusForScore(roundScore(Math.max(0, nativeScore - adjustment)));
   }
   const statusFloor = {
@@ -9800,7 +9994,7 @@ function mergeSignalsByCriterion(signals) {
   return merged;
 }
 function usesMetricScoring(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
 }
 function unmeasuredStatus(rubricVersion) {
   return rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0 ? "unverified" : "insufficient_data";
@@ -9931,7 +10125,7 @@ function scoreMetrics(metrics) {
 function capScoreForFindings(score, findings, rubricVersion, criterionId) {
   if (findings.some((finding) => finding.severity === "critical")) {
     const criticalFindings = findings.filter(({ severity }) => severity === "critical");
-    const authenticatedA1Absence = rubricVersion === WITAN_RUBRIC_VERSION_V17 && criterionId === "A1" && criticalFindings.length === 1 && criticalFindings[0]?.summary === WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY;
+    const authenticatedA1Absence = usesV17DetectorClosure2(rubricVersion) && criterionId === "A1" && criticalFindings.length === 1 && criticalFindings[0]?.summary === WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY;
     return authenticatedA1Absence ? Math.min(score, 1.4) : 1.4;
   }
   if (findings.some((finding) => finding.severity === "warning")) return Math.min(score, 2.4);
@@ -9940,8 +10134,8 @@ function capScoreForFindings(score, findings, rubricVersion, criterionId) {
 }
 function statusForScoreAndFindings(criterionId, score, findings, metrics, rubricVersion) {
   if (findings.some((finding) => finding.severity === "critical")) return "critical";
-  if (rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17) {
-    const calibrated = rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 ? calibratedCriterionStateV11(criterionId, metrics) : rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 ? calibratedCriterionStateV9(criterionId, metrics) : calibratedCriterionStateV8(criterionId, metrics);
+  if (rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure2(rubricVersion)) {
+    const calibrated = rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure2(rubricVersion) ? calibratedCriterionStateV11(criterionId, metrics) : rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 ? calibratedCriterionStateV9(criterionId, metrics) : calibratedCriterionStateV8(criterionId, metrics);
     if (calibrated && calibrated !== "verified") return calibrated;
     if (calibrated === "verified" && !findings.some((finding) => finding.severity === "warning")) {
       return "verified";
@@ -10167,7 +10361,7 @@ function calibratedCriterionStateV11(criterionId, metrics) {
   return void 0;
 }
 function ensureFindingsExplainStatus(criterionId, score, status, findings, evidence, rubricVersion) {
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && findings.length > 0) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && findings.length > 0) {
     return [...findings];
   }
   if (status !== "critical" && status !== "warning") return [...findings];
@@ -10212,7 +10406,18 @@ function scoreRepoWithPublicCejel(options) {
     ...options.rubricVersion ? { rubricVersion: options.rubricVersion } : {}
   });
   const inputSignals = resolvePublicIngestSignals(options);
-  return createWitanReport(input, inputSignals.length > 0 ? inputSignals : void 0);
+  const report = createWitanReport(input, inputSignals.length > 0 ? inputSignals : void 0);
+  if (report.verdict !== "insufficient_source" || !isWitanNoMeasurementAbstention(report)) {
+    return report;
+  }
+  const contextualReason = explainNoMeasurementSourceCoverage(
+    options.repoPath,
+    report.rubricVersion
+  );
+  return contextualReason ? {
+    ...report,
+    insufficientSourceReason: contextualReason
+  } : report;
 }
 function resolvePublicIngestSignals(options) {
   const seen = /* @__PURE__ */ new Set();

package/dist/index.js

@@ -9,7 +9,7 @@ import {
   runCejelScan,
   serializeWitanReport,
   verifyWitanAttestationBinding
-} from "./chunk-PYI3OIBW.js";
+} from "./chunk-SNDRU52Z.js";
 
 // src/index.ts
 import { createHash } from "crypto";
@@ -224,7 +224,11 @@ async function runWitanFreeCli(args) {
     JSON.stringify(attestation, null, 2),
     "utf8"
   );
-  writeFileSync(join(options.outDir, "certificate.html"), renderWitanHtmlReport(report), "utf8");
+  writeFileSync(
+    join(options.outDir, "certificate.html"),
+    renderWitanHtmlReport(report, { cliVersion: cliVersion() }),
+    "utf8"
+  );
   writeFileSync(
     join(options.outDir, "badge.json"),
     JSON.stringify(renderWitanBadgeEndpoint(report), null, 2),

package/dist/mcp/index.js

@@ -10,7 +10,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "../chunk-PYI3OIBW.js";
+} from "../chunk-SNDRU52Z.js";
 
 // node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({
@@ -17097,7 +17097,11 @@ function createCejelMcpServer(identity) {
       if (!lastScan) throw new Error("No scan has run yet \u2014 call the scan tool first.");
       return {
         contents: [
-          { uri: uri.href, mimeType: "text/html", text: renderWitanHtmlReport(lastScan.report) }
+          {
+            uri: uri.href,
+            mimeType: "text/html",
+            text: renderWitanHtmlReport(lastScan.report, { cliVersion: identity.version })
+          }
         ]
       };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {