@cejel/cejel 0.2.2 → 0.3.1

package/dist/{chunk-SNDRU52Z.js → chunk-XB65L6WE.js}

@@ -1,33 +1,25 @@
 #!/usr/bin/env node
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
+import { createRequire as __cejelCreateRequire } from 'node:module';
+const require = __cejelCreateRequire(import.meta.url);
+import {
+  __export,
+  describeGitFailure,
+  execGit,
+  init_esm_shims,
+  isExpectedGitAbsence,
+  readRepoText,
+  readRepoTextPrefix,
+  recordContentSkip,
+  recordFilesystemSkip,
+  trackContentReads,
+  withContentReadCriterion
+} from "./chunk-LZVKQV3R.js";
+
+// src/witan/schemas.ts
+init_esm_shims();
+
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/index.js
+init_esm_shims();
 
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
@@ -140,8 +132,19 @@ __export(external_exports, {
   util: () => util,
   void: () => voidType
 });
+init_esm_shims();
+
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/errors.js
+init_esm_shims();
+
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/locales/en.js
+init_esm_shims();
+
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/ZodError.js
+init_esm_shims();
 
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
+init_esm_shims();
 var util;
 (function(util2) {
   util2.assertEqual = (_) => {
@@ -506,6 +509,7 @@ function getErrorMap() {
 }
 
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
+init_esm_shims();
 var makeIssue = (params) => {
   const { data, path, errorMaps, issueData } = params;
   const fullPath = [...path, ...issueData.path || []];
@@ -615,7 +619,11 @@ var isDirty = (x) => x.status === "dirty";
 var isValid = (x) => x.status === "valid";
 var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
 
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
+init_esm_shims();
+
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
+init_esm_shims();
 var errorUtil;
 (function(errorUtil2) {
   errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
@@ -4188,8 +4196,45 @@ var WitanCriterionSignalSchema = external_exports.object({
   findings: external_exports.array(WitanFindingSchema).default([]),
   metrics: external_exports.array(WitanCriterionMetricSchema).default([]),
   notes: external_exports.string().min(1).max(1e3).optional(),
-  notApplicable: external_exports.literal(true).optional()
-}).strict();
+  notApplicable: external_exports.literal(true).optional(),
+  // A collector reached relevant files but could not read their contents. This is a
+  // measurement gap, never negative evidence: scoreCriterion maps it to insufficient_data.
+  insufficientData: external_exports.literal(true).optional()
+}).strict().refine((signal) => !(signal.notApplicable && signal.insufficientData), {
+  message: "A criterion cannot be both not applicable and insufficient data."
+});
+var WitanContentReadSummarySchema = external_exports.object({
+  skipped: external_exports.number().int().nonnegative(),
+  byReason: external_exports.object({
+    unreadable: external_exports.number().int().nonnegative(),
+    tooLarge: external_exports.number().int().nonnegative(),
+    excludedByExtension: external_exports.number().int().nonnegative(),
+    deniedPath: external_exports.number().int().nonnegative(),
+    nonRegularFile: external_exports.number().int().nonnegative()
+  }).strict(),
+  unreadableByErrno: external_exports.record(external_exports.string().min(1).max(32), external_exports.number().int().positive()),
+  affectedCriteria: external_exports.array(WitanCriterionIdSchema)
+}).strict().superRefine((summary, context) => {
+  const reasonTotal = Object.values(summary.byReason).reduce((sum, count) => sum + count, 0);
+  if (reasonTotal !== summary.skipped) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Content-read reason counts must sum to skipped.",
+      path: ["byReason"]
+    });
+  }
+  const errnoTotal = Object.values(summary.unreadableByErrno).reduce(
+    (sum, count) => sum + count,
+    0
+  );
+  if (errnoTotal !== summary.byReason.unreadable) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Unreadable errno counts must sum to the unreadable count.",
+      path: ["unreadableByErrno"]
+    });
+  }
+});
 var WitanRepoRefSchema = external_exports.object({
   path: external_exports.string().min(1).max(700).optional(),
   url: external_exports.string().url().optional(),
@@ -4205,7 +4250,9 @@ var WitanReportInputSchema = external_exports.object({
   rubricVersion: external_exports.string().min(1).max(120).default(WITAN_RUBRIC_VERSION),
   signals: external_exports.array(WitanCriterionSignalSchema).default([]),
   archetype: WitanRepoArchetypeSchema.optional(),
-  insufficientSourceReason: external_exports.string().min(1).max(2e3).optional()
+  insufficientSourceReason: external_exports.string().min(1).max(2e3).optional(),
+  scanLimitations: external_exports.array(external_exports.string().min(1).max(1e3)).max(16).default([]),
+  contentReadSummary: WitanContentReadSummarySchema.optional()
 }).strict();
 var WitanCriterionScoreSchema = external_exports.object({
   id: WitanCriterionIdSchema,
@@ -4225,14 +4272,21 @@ var WitanInputSignalFindingSchema = external_exports.object({
   message: external_exports.string().min(1).max(500),
   location: external_exports.string().max(700).optional()
 }).strict();
+var WitanIngestProvenanceSchema = external_exports.enum(["operator_supplied", "auto_discovered"]);
 var WitanInputSignalSchema = external_exports.object({
   source: external_exports.string().min(1).max(120),
+  // Adapters can still be used directly by internal callers; absent provenance retains the
+  // historical operator-supplied meaning. The ingest funnel always sets this explicitly.
+  provenance: WitanIngestProvenanceSchema.optional(),
   dimension: WitanCriterionIdSchema,
   findings: external_exports.array(WitanInputSignalFindingSchema),
   weight: external_exports.number().min(0).max(1)
 }).strict();
 var WitanConsumedSignalSummarySchema = external_exports.object({
   source: external_exports.string().min(1).max(120),
+  // Optional on read for compatibility with already-published reports. Newly generated
+  // reports always carry the explicit value copied from WitanInputSignal.
+  provenance: WitanIngestProvenanceSchema.optional(),
   dimension: WitanCriterionIdSchema,
   findingCount: external_exports.number().int().min(0),
   severityBreakdown: external_exports.object({
@@ -4269,12 +4323,13 @@ var WitanReportCommonSchema = external_exports.object({
   productSlug: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/),
   productDisplayName: external_exports.string().min(1).max(120),
   repo: WitanRepoRefSchema,
-  generatedAt: external_exports.string().datetime({ offset: true }),
   rubricVersion: external_exports.string().min(1).max(120),
   // Rubric-driven: length matches whatever rubric produced this report, not a fixed enum.
   criteria: external_exports.array(WitanCriterionScoreSchema).min(1),
   consumedSignals: external_exports.array(WitanConsumedSignalSummarySchema).optional(),
-  archetype: WitanRepoArchetypeSchema.optional()
+  archetype: WitanRepoArchetypeSchema.optional(),
+  scanLimitations: external_exports.array(external_exports.string().min(1).max(1e3)).max(16).optional(),
+  contentReadSummary: WitanContentReadSummarySchema.optional()
 });
 var WitanScoredReportSchema = WitanReportCommonSchema.extend({
   verdict: WitanScoredVerdictSchema,
@@ -4354,6 +4409,12 @@ var WitanAttestationStatementSchema = external_exports.object({
       artifact: external_exports.literal("report.json"),
       sha256: external_exports.string().regex(/^[a-f0-9]{64}$/)
     }).strict(),
+    externalSignalProvenance: external_exports.array(
+      external_exports.object({
+        source: external_exports.string().min(1).max(120),
+        provenance: WitanIngestProvenanceSchema
+      }).strict()
+    ).default([]),
     outcome: WitanAttestationOutcomeSchema,
     assurance: external_exports.object({
       status: external_exports.literal("unsigned"),
@@ -4364,7 +4425,11 @@ var WitanAttestationStatementSchema = external_exports.object({
   }).strict()
 }).strict();
 
+// src/witan/html.ts
+init_esm_shims();
+
 // src/witan/abstention.ts
+init_esm_shims();
 var WITAN_NO_MEASUREMENT_REASON = "No free-core rubric criterion produced a measurable signal. Cejel abstains rather than publish a numeric zero for an entirely unmeasured repository.";
 var WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the complete tracked inventory contains no concrete test file, configured test runner, CI test command, or coverage configuration.";
 function isWitanNoMeasurementAbstention(report) {
@@ -4377,6 +4442,7 @@ function renderWitanAbstentionLabel(report) {
 }
 
 // src/witan/coverage.ts
+init_esm_shims();
 var LOW_CONFIDENCE_COVERAGE_THRESHOLD = 0.5;
 function isMeasuredCriterionStatus(status) {
   return status !== "not_applicable" && status !== "insufficient_data";
@@ -4410,6 +4476,7 @@ function formatCoverageCounts(coverage) {
 }
 
 // src/witan/external-findings.ts
+init_esm_shims();
 var EXTERNAL_FINDINGS_DISPLAY_LIMIT = 10;
 var SEVERITY_RANK = {
   critical: 0,
@@ -4463,6 +4530,7 @@ function collectExternalFindings(consumedSignals) {
 }
 
 // src/witan/finding-presentation.ts
+init_esm_shims();
 var METRIC_DERIVED_FINDING_PATTERN = /^[A-Z]\d+ metric-derived score is (\d+\.\d)\/4\.0, in the (critical|warning) band — no single finding drove this; it reflects the combined metric weighting below\.$/;
 var REMEDIATION_BY_METRIC = {
   test_to_source_ratio: "add concrete regression tests for the implementation surface",
@@ -4551,8 +4619,8 @@ function renderWitanHtmlReport(report, options = {}) {
     (criterion) => criterion.status === "verified" ? criterion.evidence.map((evidence) => renderEvidenceListItem(criterion, evidence)) : []
   );
   const openItems = report.criteria.flatMap(renderOpenItems);
-  const contributingSources = renderContributingSources(report.consumedSignals ?? []);
-  const externalSourceSummaries = summarizeExternalSources(report.consumedSignals ?? []);
+  const externalSourceSummaries = summarizeSourcesByProvenance(report.consumedSignals ?? []);
+  const contributingSources = externalSourceSummaries.map(renderSourceProvenanceLabel);
   const externalFindings = collectExternalFindings(report.consumedSignals ?? []);
   const coverage = computeMeasuredCoverage(report);
   const gitHistoryUnavailable = !report.repo.headSha;
@@ -4576,11 +4644,11 @@ function renderWitanHtmlReport(report, options = {}) {
           <p class="eyebrow">Trust Certificate</p>
           <h1>${escapeHtml(report.productDisplayName)}</h1>
           <dl class="meta">
-            <div><dt>Date</dt><dd>${escapeHtml(formatDate(report.generatedAt))}</dd></div>
+            ${options.generatedAt ? `<div><dt>Date</dt><dd>${escapeHtml(formatDate(options.generatedAt))}</dd></div>` : ""}
             <div><dt>Run</dt><dd>${escapeHtml(renderRepo(report))}</dd></div>
             <div><dt>CLI</dt><dd>${escapeHtml(options.cliVersion ? `Cejel ${options.cliVersion}` : "Not recorded")}</dd></div>
             <div><dt>Rubric</dt><dd>${escapeHtml(report.rubricVersion)}</dd></div>
-            ${contributingSources.length > 0 ? `<div><dt>Sources</dt><dd>Incorporates findings from: ${escapeHtml(contributingSources.join(", "))}<ul class="source-counts">${externalSourceSummaries.map((s) => `<li>${escapeHtml(formatExternalSourceLine(s))}</li>`).join("")}</ul></dd></div>` : ""}
+            ${contributingSources.length > 0 ? `<div><dt>Sources</dt><dd>Incorporates findings from: ${escapeHtml(contributingSources.join(", "))}<ul class="source-counts">${externalSourceSummaries.map((s) => `<li>${escapeHtml(formatSourceProvenanceLine(s))}</li>`).join("")}</ul></dd></div>` : ""}
           </dl>
         </section>
         <aside class="score-panel" aria-label="Summary trust score">
@@ -4598,6 +4666,15 @@ function renderWitanHtmlReport(report, options = {}) {
       </div>
     </header>
 
+    ${(report.scanLimitations?.length ?? 0) > 0 ? `<section class="scan-limitations-section evidence-section" aria-label="Scan limitations">
+      <h2>Scan limitations</h2>
+      <ul>${(report.scanLimitations ?? []).map(
+    (limitation) => `<li class="scan-warning"><strong>Scan limitation</strong><span>${escapeHtml(limitation)}</span></li>`
+  ).join("")}</ul>
+    </section>` : ""}
+
+    ${renderContentReadSummary(report)}
+
     <section class="trust-grid" aria-label="Rubric criteria">
       ${renderCriterionColumn("Code trust", codeCriteria, gitHistoryUnavailable)}
       ${renderCriterionColumn("Process trust", processCriteria, gitHistoryUnavailable)}
@@ -4626,8 +4703,50 @@ function renderWitanHtmlReport(report, options = {}) {
 </html>
 `;
 }
-function renderContributingSources(signals) {
-  return Array.from(new Set(signals.map((s) => s.source))).sort();
+function renderContentReadSummary(report) {
+  const summary = report.contentReadSummary;
+  if (!summary || summary.skipped === 0) return "";
+  const errnoCounts = Object.entries(summary.unreadableByErrno).map(([errno, count]) => `${errno}: ${count}`).join(", ");
+  const affected = summary.affectedCriteria.length > 0 ? `<p>Affected criteria abstained as <code>insufficient_data</code>: ${escapeHtml(summary.affectedCriteria.join(", "))}.</p>` : "";
+  return `<section class="scan-limitations-section evidence-section" aria-label="Skipped content reads">
+      <h2>Skipped content reads</h2>
+      <p>${summary.skipped} content entr${summary.skipped === 1 ? "y was" : "ies were"} skipped. Counts only; repository paths are intentionally omitted.</p>
+      <ul>
+        <li>Unreadable: ${summary.byReason.unreadable}${errnoCounts ? ` (${escapeHtml(errnoCounts)})` : ""}</li>
+        <li>Too large: ${summary.byReason.tooLarge}</li>
+        <li>Excluded by extension: ${summary.byReason.excludedByExtension}</li>
+        <li>Denied path: ${summary.byReason.deniedPath}</li>
+        <li>Non-regular file: ${summary.byReason.nonRegularFile}</li>
+      </ul>
+      ${affected}
+    </section>`;
+}
+function summarizeSourcesByProvenance(signals) {
+  const grouped = /* @__PURE__ */ new Map();
+  for (const signal of signals) {
+    const provenance = signal.provenance ?? "operator_supplied";
+    const key = `${signal.source}\0${provenance}`;
+    const summary = grouped.get(key) ?? {
+      source: signal.source,
+      provenance,
+      findingCount: 0,
+      dimensions: /* @__PURE__ */ new Set()
+    };
+    summary.findingCount += signal.findingCount;
+    summary.dimensions.add(signal.dimension);
+    grouped.set(key, summary);
+  }
+  return Array.from(grouped.values()).map((summary) => ({ ...summary, dimensions: Array.from(summary.dimensions).sort() })).sort(
+    (a, b) => a.source.localeCompare(b.source) || a.provenance.localeCompare(b.provenance)
+  );
+}
+function renderSourceProvenanceLabel(summary) {
+  const label = formatExternalSourceLabel(summary.source);
+  return summary.provenance === "auto_discovered" ? `"${label}" (self-declared by the scanned repository \u2014 not verified)` : `${label} (operator-supplied)`;
+}
+function formatSourceProvenanceLine(summary) {
+  const noun = summary.findingCount === 1 ? "finding" : "findings";
+  return `${renderSourceProvenanceLabel(summary)}: ${summary.findingCount} ${noun} ingested (folded into ${summary.dimensions.join(", ")})`;
 }
 function renderExternalFindingItems(findings) {
   const shown = findings.slice(0, EXTERNAL_FINDINGS_DISPLAY_LIMIT);
@@ -4864,6 +4983,8 @@ dd { margin: 0; color: var(--muted); overflow-wrap: anywhere; }
 .coverage-note { margin-top: 8px; color: var(--faint); font-family: var(--mono); font-size: 11px; }
 .source-counts { margin: 8px 0 0; padding-left: 18px; font-family: var(--mono); font-size: 12px; color: var(--muted); }
 .trust-grid, .evidence-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 18px; margin-top: 28px; }
+.scan-limitations-section { margin-top: 28px; border-color: rgba(231, 191, 114, .44); }
+.scan-limitations-section .scan-warning { list-style: none; margin-left: -18px; }
 .external-findings-section { margin-top: 18px; }
 .external-note { margin: 0 0 14px; color: var(--muted); font-size: 13px; }
 .criteria-column, .evidence-section { border: 1px solid var(--line); border-radius: 8px; background: var(--surface); padding: 22px; }
@@ -4913,6 +5034,7 @@ a:hover { text-decoration: underline; text-underline-offset: 2px; }
 `;
 
 // src/witan/badge.ts
+init_esm_shims();
 var VERDICT_COLOR = {
   Verified: "brightgreen",
   Conditional: "yellow",
@@ -4930,24 +5052,26 @@ var VERDICT_SVG_FILL = {
   "Insufficient evidence": "#8c8c8c"
 };
 function badgeMessage(report, verdict) {
+  if ((report.scanLimitations?.length ?? 0) > 0) return "unrated: limited evidence";
   if (isWitanNoMeasurementAbstention(report)) return "unrated: no measurable evidence";
   if (report.verdict === "insufficient_source") return "unrated: no source";
   return `${formatScore2(report.overallScore)}/4.0 ${verdict.toLowerCase()}`;
 }
 function renderWitanBadgeEndpoint(report) {
   const verdict = renderReportVerdict(report);
+  const limited = (report.scanLimitations?.length ?? 0) > 0;
   return {
     schemaVersion: 1,
     label: "cejel trust",
     message: badgeMessage(report, verdict),
-    color: VERDICT_COLOR[verdict] ?? "lightgrey"
+    color: limited ? "lightgrey" : VERDICT_COLOR[verdict] ?? "lightgrey"
   };
 }
 function renderWitanBadgeSvg(report) {
   const verdict = renderReportVerdict(report);
   const label = "cejel trust";
   const message = badgeMessage(report, verdict);
-  const fill = VERDICT_SVG_FILL[verdict] ?? "#8c8c8c";
+  const fill = (report.scanLimitations?.length ?? 0) > 0 ? "#8c8c8c" : VERDICT_SVG_FILL[verdict] ?? "#8c8c8c";
   const charWidth = 6.5;
   const padding = 10;
   const labelWidth = Math.round(label.length * charWidth + padding);
@@ -4983,6 +5107,7 @@ function escapeXml(value) {
 }
 
 // src/witan/attestation.ts
+init_esm_shims();
 import { createHash } from "crypto";
 var ATTESTATION_LIMITATIONS = [
   "Cejel measures observable repository signals; it is not a security or compliance guarantee.",
@@ -4996,6 +5121,19 @@ function hashWitanReport(report) {
 }
 function createWitanAttestation(report, options) {
   const reportSha256 = hashWitanReport(report);
+  const externalSignalProvenance = Array.from(
+    new Map(
+      (report.consumedSignals ?? []).map((signal) => {
+        const provenance = signal.provenance ?? "operator_supplied";
+        return [
+          `${signal.source}\0${provenance}`,
+          { source: signal.source, provenance }
+        ];
+      })
+    ).values()
+  ).sort(
+    (a, b) => a.source.localeCompare(b.source) || a.provenance.localeCompare(b.provenance)
+  );
   const outcome = report.verdict === "insufficient_source" ? {
     status: "abstained",
     reason: report.insufficientSourceReason
@@ -5016,7 +5154,7 @@ function createWitanAttestation(report, options) {
     predicateType: WITAN_ATTESTATION_PREDICATE_TYPE,
     predicate: {
       tool: { name: "cejel", version: options.toolVersion },
-      generatedAt: report.generatedAt,
+      generatedAt: options.generatedAt,
       rubricVersion: report.rubricVersion,
       repository: {
         productSlug: report.productSlug,
@@ -5027,6 +5165,7 @@ function createWitanAttestation(report, options) {
         artifact: "report.json",
         sha256: reportSha256
       },
+      externalSignalProvenance,
       outcome,
       assurance: {
         status: "unsigned",
@@ -5059,9 +5198,6 @@ function verifyWitanAttestationBinding(statement, report, options = {}) {
   if (parsed.data.predicate.rubricVersion !== report.rubricVersion) {
     errors.push("rubric version does not match report.json");
   }
-  if (parsed.data.predicate.generatedAt !== report.generatedAt) {
-    errors.push("generated timestamp does not match report.json");
-  }
   if (parsed.data.predicate.repository.headSha !== report.repo.headSha) {
     errors.push("repository revision does not match report.json");
   }
@@ -5071,6 +5207,22 @@ function verifyWitanAttestationBinding(statement, report, options = {}) {
   if (parsed.data.predicate.repository.url !== report.repo.url) {
     errors.push("repository URL does not match report.json");
   }
+  const expectedExternalSignalProvenance = Array.from(
+    new Map(
+      (report.consumedSignals ?? []).map((signal) => {
+        const provenance = signal.provenance ?? "operator_supplied";
+        return [
+          `${signal.source}\0${provenance}`,
+          { source: signal.source, provenance }
+        ];
+      })
+    ).values()
+  ).sort(
+    (a, b) => a.source.localeCompare(b.source) || a.provenance.localeCompare(b.provenance)
+  );
+  if (JSON.stringify(parsed.data.predicate.externalSignalProvenance) !== JSON.stringify(expectedExternalSignalProvenance)) {
+    errors.push("external signal provenance does not match report.json");
+  }
   const outcome = parsed.data.predicate.outcome;
   if (report.verdict === "insufficient_source") {
     if (outcome.status !== "abstained" || outcome.reason !== report.insufficientSourceReason) {
@@ -5082,15 +5234,17 @@ function verifyWitanAttestationBinding(statement, report, options = {}) {
   return { valid: errors.length === 0, errors };
 }
 
+// src/witan/index.ts
+init_esm_shims();
+
+// src/witan/markdown.ts
+init_esm_shims();
+
 // src/witan/repo-signals.ts
-import { execFileSync } from "child_process";
+init_esm_shims();
 import { createHash as createHash2 } from "crypto";
 import {
-  closeSync,
   lstatSync,
-  openSync,
-  readFileSync,
-  readSync,
   readdirSync,
   realpathSync,
   statSync
@@ -5098,11 +5252,13 @@ import {
 import { basename, dirname, extname, join, relative, resolve, sep } from "path";
 
 // src/witan/json-safe.ts
+init_esm_shims();
 function stripBom(text) {
   return text.charCodeAt(0) === 65279 ? text.slice(1) : text;
 }
 
 // src/witan/rubric-version.ts
+init_esm_shims();
 var WITAN_RUBRIC_VERSION_V9 = "witan-rubric-v9-2026-07-22";
 var WITAN_RUBRIC_VERSION_V10 = "witan-rubric-v10-2026-07-23";
 var WITAN_RUBRIC_VERSION_V11 = "witan-rubric-v11-2026-07-23";
@@ -5119,12 +5275,41 @@ function usesV17DetectorClosure(rubricVersion) {
   return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18;
 }
 function buildWitanInputFromRepo(options) {
+  const tracked = trackContentReads(options.repoPath, () => buildWitanInputFromRepoUntracked(options));
+  const affectedCriteria = tracked.affectedCriteria;
+  const signals = (tracked.value.signals ?? []).map((signal) => {
+    if (!affectedCriteria.has(signal.criterionId)) return signal;
+    return {
+      criterionId: signal.criterionId,
+      positiveEvidence: [],
+      findings: [],
+      metrics: [],
+      insufficientData: true,
+      notes: "Cejel abstained on this criterion because one or more relevant repository files could not be read. Resolve the content-read limitations and re-scan."
+    };
+  });
+  const affectedCount = affectedCriteria.size;
+  const scanLimitations = [...tracked.value.scanLimitations ?? []];
+  if (affectedCount > 0 && scanLimitations.length < 16) {
+    scanLimitations.push(
+      `${affectedCount} ${affectedCount === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+    );
+  }
+  return {
+    ...tracked.value,
+    signals,
+    ...scanLimitations.length > 0 ? { scanLimitations } : {},
+    contentReadSummary: tracked.summary
+  };
+}
+function buildWitanInputFromRepoUntracked(options) {
   assertRepoPathExists(options.repoPath);
   const generatedAt = options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
   const rubricVersion = options.rubricVersion ?? WITAN_RUBRIC_VERSION;
+  const fileInventory = collectRepoFileInventory(options.repoPath);
   const headSha = readGitHead(options.repoPath);
-  const repoFiles = listRepoFiles(options.repoPath);
-  const inventoryFiles = listRepoInventory(options.repoPath, repoFiles);
+  const repoFiles = fileInventory.repoFiles;
+  const inventoryFiles = fileInventory.inventoryFiles;
   const ignoredTargetReason = repoFiles.length === 0 ? explainIgnoredScanTarget(options.repoPath) : void 0;
   const usesV17Detectors = usesV17DetectorClosure(rubricVersion);
   const usesV18NativeRls = rubricVersion === WITAN_RUBRIC_VERSION_V18;
@@ -5148,6 +5333,7 @@ function buildWitanInputFromRepo(options) {
   const usesV39Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion);
   const usesV47Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion);
   const reviewableSourceProof = usesV17Detectors ? buildReviewableSourceProof(options.repoPath, inventoryFiles, headSha, rubricVersion) : void 0;
+  const scanLimitations = new Set(fileInventory.scanLimitations);
   const coreSignals = collectRepoSignals(
     options.repoPath,
     generatedAt,
@@ -5158,7 +5344,8 @@ function buildWitanInputFromRepo(options) {
     usesV39Detectors,
     usesV47Detectors,
     usesV18NativeRls,
-    reviewableSourceProof
+    reviewableSourceProof,
+    scanLimitations
   );
   const archetype = usesV17Detectors && reviewableSourceProof?.passes === true && isV17RescuableAbstention(gatedArchetype.abstentionKind) && coreSignals.some(isMeasuredCriterionSignal) ? {
     archetype: isLikelyMonorepo(inventoryFiles) ? "monorepo" : "source",
@@ -5176,6 +5363,7 @@ function buildWitanInputFromRepo(options) {
     ...options.rubricVersion ? { rubricVersion: options.rubricVersion } : {},
     archetype: archetype.archetype,
     ...ignoredTargetReason ?? archetype.insufficientSourceReason ? { insufficientSourceReason: ignoredTargetReason ?? archetype.insufficientSourceReason } : {},
+    ...scanLimitations.size > 0 ? { scanLimitations: [...scanLimitations] } : {},
     signals: [
       ...coreSignals,
       ...(options.domainCollectors ?? []).map((collect) => collect(options.repoPath, repoFiles)),
@@ -5648,26 +5836,21 @@ function isRubyPackageRecipeMetadataSource(repoPath, file) {
 function readSemanticMetadataPrefix(repoPath, file) {
   const absolutePath = join(repoPath, file);
   if (!isRegularFile(absolutePath)) return null;
-  let descriptor = null;
-  try {
-    descriptor = openSync(absolutePath, "r");
-    const buffer = Buffer.allocUnsafe(SEMANTIC_METADATA_PREFIX_BYTES_V14);
-    const bytesRead = readSync(descriptor, buffer, 0, SEMANTIC_METADATA_PREFIX_BYTES_V14, 0);
-    return buffer.subarray(0, bytesRead).toString("utf8");
-  } catch {
-    return null;
-  } finally {
-    if (descriptor !== null) closeSync(descriptor);
-  }
+  return readRepoTextPrefix(absolutePath, SEMANTIC_METADATA_PREFIX_BYTES_V14);
 }
 function readRepresentativeSourceText(repoPath, file) {
   const absolutePath = join(repoPath, file);
   try {
     if (!isRegularFile(absolutePath)) return null;
     const size = statSync(absolutePath).size;
-    if (size === 0 || size > READABLE_SOURCE_REPRESENTATION_FILE_BYTES_V13) return null;
-    return readFileSync(absolutePath, "utf8");
-  } catch {
+    if (size === 0) return null;
+    if (size > READABLE_SOURCE_REPRESENTATION_FILE_BYTES_V13) {
+      recordContentSkip(absolutePath, "too_large", true);
+      return null;
+    }
+    return readRepoText(absolutePath, "utf8");
+  } catch (error) {
+    recordFilesystemSkip(absolutePath, error, false, true);
     return null;
   }
 }
@@ -5737,28 +5920,25 @@ function assertRepoPathExists(repoPath) {
   }
 }
 function explainIgnoredScanTarget(repoPath) {
-  let top;
-  try {
-    top = execFileSync("git", ["rev-parse", "--show-toplevel"], {
-      cwd: repoPath,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-  } catch {
-    return void 0;
+  const topResult = execGit(["rev-parse", "--show-toplevel"], { cwd: repoPath });
+  if (!topResult.ok) {
+    if (isExpectedGitAbsence(topResult)) return void 0;
+    throw new Error(describeGitFailure(topResult.reason, "repository-root discovery"));
   }
+  const top = topResult.stdout.trim();
   if (!top) return void 0;
   const topResolved = realpathSync(top);
   const targetResolved = realpathSync(repoPath);
   const target = relative(topResolved, targetResolved).split(sep).join("/");
   if (!target || target.startsWith("../")) return void 0;
-  try {
-    execFileSync("git", ["check-ignore", "--quiet", "--", `${target}/`], {
-      cwd: topResolved,
-      stdio: "ignore"
-    });
-  } catch {
-    return void 0;
+  const ignored = execGit(["check-ignore", "--quiet", "--", `${target}/`], {
+    cwd: topResolved
+  });
+  if (!ignored.ok) {
+    if (isExpectedGitAbsence(ignored) || ignored.reason === "exec_failed" && ignored.exitCode === 1) {
+      return void 0;
+    }
+    throw new Error(describeGitFailure(ignored.reason, "ignore-rule check"));
   }
   return `The requested scan path (${target}) is excluded by this repository's Git ignore rules, so Cejel found no tracked source to evaluate. Scan a tracked project or intentionally add the path to version control; Cejel abstains rather than score an ignored or vendored working tree.`;
 }
@@ -5772,48 +5952,74 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, reviewableSourceProof) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, reviewableSourceProof, scanLimitations = /* @__PURE__ */ new Set()) {
   const signals = [];
-  const mono = resolveMonorepoContext(repoPath);
-  const a1Signal = collectA1TestIntegrityEvidence(
-    repoPath,
-    repoFiles,
-    useV27Detectors,
-    useV33Detectors,
-    useV36Detectors,
-    reviewableSourceProof
+  const mono = resolveMonorepoContext(repoPath, scanLimitations);
+  const collectCriterion = (criterionId, collect) => withContentReadCriterion(criterionId, collect);
+  const a1Signal = collectCriterion(
+    "A1",
+    () => collectA1TestIntegrityEvidence(
+      repoPath,
+      repoFiles,
+      useV27Detectors,
+      useV33Detectors,
+      useV36Detectors,
+      reviewableSourceProof
+    )
   );
-  const a2Signal = collectA2IsolationEvidence(
-    repoPath,
-    repoFiles,
-    useV27Detectors,
-    useV33Detectors,
-    useV36Detectors,
-    useV39Detectors,
-    useV47Detectors,
-    useV18NativeRls
+  const a2Signal = collectCriterion(
+    "A2",
+    () => collectA2IsolationEvidence(
+      repoPath,
+      repoFiles,
+      useV27Detectors,
+      useV33Detectors,
+      useV36Detectors,
+      useV39Detectors,
+      useV47Detectors,
+      useV18NativeRls,
+      scanLimitations
+    )
   );
-  const a3Signal = collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors);
-  const a4Signal = collectA4DependencyEvidence(
-    repoPath,
-    repoFiles,
-    mono,
-    useV27Detectors,
-    useV47Detectors
+  const a3Signal = collectCriterion(
+    "A3",
+    () => collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors)
+  );
+  const a4Signal = collectCriterion(
+    "A4",
+    () => collectA4DependencyEvidence(
+      repoPath,
+      repoFiles,
+      mono,
+      useV27Detectors,
+      useV47Detectors
+    )
+  );
+  const a5Signal = collectCriterion(
+    "A5",
+    () => collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors)
   );
-  const a5Signal = collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors);
   const b1Signal = buildNotApplicableSignal(
     "B1",
     "Repository scans do not evaluate the dispatch-trace process dimension."
   );
-  const b2Signal = collectB2PrTraceEvidence(repoPath, repoFiles);
-  const b3Signal = collectB3CiDisciplineEvidence(repoPath, repoFiles, mono);
-  const b4Signal = collectB4AuditEvidence(repoPath, repoFiles, generatedAt);
+  const b2Signal = collectCriterion("B2", () => collectB2PrTraceEvidence(repoPath, repoFiles));
+  const b3Signal = collectCriterion(
+    "B3",
+    () => collectB3CiDisciplineEvidence(repoPath, repoFiles, mono)
+  );
+  const b4Signal = collectCriterion(
+    "B4",
+    () => collectB4AuditEvidence(repoPath, repoFiles, generatedAt)
+  );
   const b5Signal = buildNotApplicableSignal(
     "B5",
     "Repository scans do not evaluate the learning-trace process dimension."
   );
-  const b6Signal = collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detectors);
+  const b6Signal = collectCriterion(
+    "B6",
+    () => collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detectors)
+  );
   for (const signal of [
     a1Signal,
     a2Signal,
@@ -6083,7 +6289,7 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof) {
     notes: `V17 authenticated absence: ${proof.eligibleSourceFileCount} criterion-ratable of ${proof.sourceShapedFileCount} source-shaped files; sampled ${proof.sampledFileCount}; ${proof.readableSampledFileCount} representative-text files.`
   };
 }
-function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls) {
+function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, scanLimitations) {
   const evidence = [];
   const findings = [];
   const gitignore = repoFiles.find((file) => basename(file) === ".gitignore");
@@ -6129,6 +6335,7 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
     repoPath,
     useV27Detectors,
     currentSecretFingerprintsByPath,
+    scanLimitations,
     useV33Detectors,
     useV36Detectors,
     useV39Detectors,
@@ -6145,7 +6352,7 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   const committedEnvFilePath = repoFiles.find(
     (f) => /(?:^|\/)\.env(?:\.|$)/i.test(f) && !isEnvTemplatePath(f, useV47Detectors) && (!useV47Detectors || isV47AuthoredProductionPath(f)) && (!useV39Detectors || !hasTemplateOnlyEnvContent(repoPath, f))
   );
-  const hasEnvInHistory = committedEnvFilePath === void 0 && hasEnvPathInGitHistory(repoPath);
+  const hasEnvInHistory = committedEnvFilePath === void 0 && hasEnvPathInGitHistory(repoPath, scanLimitations);
   const dbLayerImportFile = migrationFiles.length === 0 ? implFiles.slice(0, 30).find((f) => fileContains(repoPath, f, DB_CLIENT_PATTERN)) : void 0;
   const hasDataLayer = migrationFiles.length > 0 || dbLayerImportFile !== void 0;
   const hasSecretsSurface = envExamples.length > 0 || committedEnvFilePath !== void 0 || gitignoreHasEnvRule || hasEnvInHistory;
@@ -7305,14 +7512,14 @@ function lineHasInsecureSecretCompare(line, useV39Detectors = false) {
 function findInsecureSecretCompareLine(repoPath, file, useV39Detectors = false) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return null;
-  const lines = readFileSync(fullPath, "utf8").split("\n");
+  const lines = readRepoText(fullPath, "utf8").split("\n");
   const index = lines.findIndex((line) => lineHasInsecureSecretCompare(line, useV39Detectors));
   return index === -1 ? null : index + 1;
 }
 function findFirstMatchingLine(repoPath, file, pattern) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return null;
-  const lines = readFileSync(fullPath, "utf8").split("\n");
+  const lines = readRepoText(fullPath, "utf8").split("\n");
   const index = lines.findIndex((line) => pattern.test(line));
   return index === -1 ? null : index + 1;
 }
@@ -7320,7 +7527,7 @@ function lineAt(repoPath, file, line) {
   if (line < 1) return null;
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return null;
-  return readFileSync(fullPath, "utf8").split("\n")[line - 1] ?? null;
+  return readRepoText(fullPath, "utf8").split("\n")[line - 1] ?? null;
 }
 var UNSORTED_JSON_SIGN_PATTERN = /\.update\s*\(\s*JSON\.stringify\s*\(|\.sign\s*\([^)]*JSON\.stringify\s*\(/;
 var UNSORTED_JSON_DIRECT_SIGN_PATTERN = /\.sign\s*\([^)]*JSON\.stringify\s*\(/;
@@ -7329,7 +7536,7 @@ var JSON_STRINGIFY_ASSIGNMENT_PATTERN = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*
 function findUnsortedJsonHmacLine(repoPath, file) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return null;
-  const contents = readFileSync(fullPath, "utf8");
+  const contents = readRepoText(fullPath, "utf8");
   const directSign = findFirstMatchingLine(repoPath, file, UNSORTED_JSON_DIRECT_SIGN_PATTERN);
   if (directSign !== null) return directSign;
   const directConstructorUpdate = findFirstMatchingLine(
@@ -7410,27 +7617,92 @@ function isEnvTemplatePath(path, useV47Detectors = false) {
 }
 var HARD_EXCLUDED_PATH_PATTERN = /(^|\/)(?:\.git|\.venv|venv|site-packages|node_modules|dist|build|\.next|__pycache__|vendor|\.terraform|coverage)(?:\/|$)/;
 var COVERAGE_PERCENT_PATTERN = /(?:statements|branches|lines|functions|fail_under)\s*[:=]\s*["']?(\d+(?:\.\d+)?)/gi;
-function listRepoFiles(repoPath) {
-  const gitFiles = listGitTrackedFiles(repoPath, false);
-  if (gitFiles) return gitFiles;
+function gitFailureDetail(reason) {
+  if (reason === "buffer_exceeded") return "output exceeded the explicit 8 MiB limit";
+  if (reason === "timeout") return "execution exceeded the explicit 30 second timeout";
+  return "the local Git command failed";
+}
+function readGitTrackedFileOutput(repoPath) {
+  const workTree = execGit(["rev-parse", "--is-inside-work-tree"], { cwd: repoPath });
+  if (!workTree.ok) return workTree;
+  if (workTree.stdout.trim() !== "true") return { ok: false, reason: "not_a_repo" };
+  return execGit(["ls-files", "--cached"], { cwd: repoPath });
+}
+function parseGitTrackedFiles(repoPath, output, includeHardExcluded) {
   const files = [];
-  visitRepoDir(repoPath, repoPath, files);
+  for (const file of output.trim().split("\n")) {
+    if (file.length === 0) continue;
+    const fullPath = join(repoPath, file);
+    if (!includeHardExcluded && isHardExcludedPath(file)) {
+      recordContentSkip(fullPath, "denied_path", true);
+      continue;
+    }
+    try {
+      if (!lstatSync(fullPath).isFile()) {
+        recordContentSkip(fullPath, "non_regular_file", true);
+        continue;
+      }
+    } catch (error) {
+      recordFilesystemSkip(fullPath, error, false, true);
+      continue;
+    }
+    if (!isPotentialContentPath(file)) {
+      recordContentSkip(fullPath, "excluded_by_extension", true);
+    }
+    files.push(file);
+  }
+  return files.sort();
+}
+function directoryInventory(repoPath) {
+  const files = [];
+  const rootDevice = statSync(repoPath).dev;
+  visitRepoDir(repoPath, repoPath, files, rootDevice);
   return files.filter((file) => !isHardExcludedPath(file)).sort();
 }
-function listRepoInventory(repoPath, fallbackFiles) {
-  return listGitTrackedFiles(repoPath, true) ?? [...fallbackFiles];
+function collectRepoFileInventory(repoPath) {
+  const tracked = readGitTrackedFileOutput(repoPath);
+  if (tracked.ok) {
+    return {
+      repoFiles: parseGitTrackedFiles(repoPath, tracked.stdout, false),
+      inventoryFiles: parseGitTrackedFiles(repoPath, tracked.stdout, true),
+      scanLimitations: []
+    };
+  }
+  const fallbackFiles = directoryInventory(repoPath);
+  if (isExpectedGitAbsence(tracked)) {
+    return {
+      repoFiles: fallbackFiles,
+      inventoryFiles: fallbackFiles,
+      scanLimitations: []
+    };
+  }
+  return {
+    repoFiles: fallbackFiles,
+    inventoryFiles: fallbackFiles,
+    scanLimitations: [
+      `Tracked-file inventory was unavailable because ${gitFailureDetail(tracked.reason)}. Cejel used a bounded directory walk with different exclusion semantics; re-scan after the local Git failure is resolved to compare the certificate.`
+    ]
+  };
 }
-function resolveMonorepoContext(repoPath) {
-  let top;
-  try {
-    top = execFileSync("git", ["rev-parse", "--show-toplevel"], {
-      cwd: repoPath,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-  } catch {
+function listRepoFiles(repoPath) {
+  return [...collectRepoFileInventory(repoPath).repoFiles];
+}
+function listRepoInventory(repoPath, fallbackFiles) {
+  const tracked = readGitTrackedFileOutput(repoPath);
+  if (tracked.ok) return parseGitTrackedFiles(repoPath, tracked.stdout, true);
+  if (isExpectedGitAbsence(tracked)) return [...fallbackFiles];
+  throw new Error(describeGitFailure(tracked.reason, "tracked-file inventory"));
+}
+function resolveMonorepoContext(repoPath, scanLimitations) {
+  const topResult = execGit(["rev-parse", "--show-toplevel"], { cwd: repoPath });
+  if (!topResult.ok) {
+    if (isExpectedGitAbsence(topResult)) return null;
+    scanLimitations.add(
+      `${describeGitFailure(topResult.reason, "repository-root discovery")} Cejel continued without monorepo root-level shared configuration.`
+    );
     return null;
   }
+  const top = topResult.stdout.trim();
   if (!top) return null;
   const rootResolved = resolve(top);
   const repoResolved = (() => {
@@ -7442,7 +7714,7 @@ function resolveMonorepoContext(repoPath) {
   })();
   if (rootResolved === repoResolved) return null;
   if (!repoResolved.startsWith(rootResolved + sep)) return null;
-  const rootFiles = listGitTrackedFiles(rootResolved);
+  const rootFiles = listGitTrackedFiles(rootResolved, scanLimitations);
   if (!rootFiles || rootFiles.length === 0) return null;
   const subRel = repoResolved.slice(rootResolved.length + 1).split(sep).join("/");
   const subPrefix = subRel ? `${subRel}/` : "";
@@ -7452,50 +7724,119 @@ function resolveMonorepoContext(repoPath) {
   if (sharedFiles.length === 0) return null;
   return { root: rootResolved, sharedFiles };
 }
-function listGitTrackedFiles(repoPath, includeHardExcluded = false) {
-  try {
-    execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
-      cwd: repoPath,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-    const output = execFileSync("git", ["ls-files", "--cached"], {
-      cwd: repoPath,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-    if (!output) return [];
-    return output.split("\n").filter(
-      (file) => file.length > 0 && (includeHardExcluded || !isHardExcludedPath(file)) && isRegularFile(join(repoPath, file))
-    ).sort();
-  } catch {
-    return null;
-  }
+function listGitTrackedFiles(repoPath, scanLimitations, includeHardExcluded = false) {
+  const tracked = readGitTrackedFileOutput(repoPath);
+  if (tracked.ok) return parseGitTrackedFiles(repoPath, tracked.stdout, includeHardExcluded);
+  if (isExpectedGitAbsence(tracked)) return null;
+  scanLimitations.add(
+    `${describeGitFailure(tracked.reason, "monorepo shared-file inventory")} Cejel continued without monorepo root-level shared configuration.`
+  );
+  return null;
 }
-function visitRepoDir(repoPath, dirPath, files) {
+function visitRepoDir(repoPath, dirPath, files, rootDevice) {
   let entries;
   try {
     entries = readdirSync(dirPath, { withFileTypes: true });
-  } catch {
+  } catch (error) {
+    recordFilesystemSkip(dirPath, error, true);
     return;
   }
   for (const entry of entries) {
-    if (shouldSkipDir(entry.name)) continue;
     const fullPath = join(dirPath, entry.name);
+    if (shouldSkipDir(entry.name)) {
+      recordContentSkip(fullPath, "denied_path");
+      continue;
+    }
     if (entry.isDirectory()) {
-      visitRepoDir(repoPath, fullPath, files);
+      try {
+        if (lstatSync(fullPath, { bigint: true }).dev !== BigInt(rootDevice)) {
+          recordContentSkip(fullPath, "denied_path");
+          continue;
+        }
+      } catch (error) {
+        recordFilesystemSkip(fullPath, error);
+        continue;
+      }
+      visitRepoDir(repoPath, fullPath, files, rootDevice);
+      continue;
+    }
+    if (!entry.isFile()) {
+      recordContentSkip(fullPath, "non_regular_file");
       continue;
     }
-    if (!entry.isFile()) continue;
     let size;
     try {
       size = statSync(fullPath).size;
-    } catch {
+    } catch (error) {
+      recordFilesystemSkip(fullPath, error);
       continue;
     }
-    if (size > 512e3) continue;
-    files.push(relative(repoPath, fullPath));
-  }
+    const repoRelativePath = relative(repoPath, fullPath);
+    if (size > 512e3) {
+      recordContentSkip(fullPath, "too_large");
+      continue;
+    }
+    if (!isPotentialContentPath(repoRelativePath)) {
+      recordContentSkip(fullPath, "excluded_by_extension");
+    }
+    files.push(repoRelativePath);
+  }
+}
+var CONTENT_FILE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".c",
+  ".cc",
+  ".cfg",
+  ".cjs",
+  ".cmake",
+  ".conf",
+  ".cpp",
+  ".cs",
+  ".css",
+  ".cts",
+  ".cxx",
+  ".env",
+  ".go",
+  ".gradle",
+  ".graphql",
+  ".h",
+  ".hpp",
+  ".html",
+  ".ini",
+  ".java",
+  ".js",
+  ".json",
+  ".json5",
+  ".jsx",
+  ".kt",
+  ".kts",
+  ".lua",
+  ".md",
+  ".mdx",
+  ".mjs",
+  ".mts",
+  ".php",
+  ".properties",
+  ".proto",
+  ".py",
+  ".rb",
+  ".rs",
+  ".rst",
+  ".scss",
+  ".sh",
+  ".sql",
+  ".swift",
+  ".toml",
+  ".ts",
+  ".tsx",
+  ".txt",
+  ".xml",
+  ".yaml",
+  ".yml"
+]);
+function isPotentialContentPath(path) {
+  const name = basename(path);
+  if (CONTENT_FILE_EXTENSIONS.has(extname(name).toLowerCase())) return true;
+  return /^(?:Dockerfile|Makefile|Rakefile|Gemfile|Pipfile|Procfile|CMakeLists\.txt)$/i.test(name) || /^\.(?:env|gitignore|npmrc|nvmrc|prettierrc|eslintrc)(?:\.|$)/i.test(name);
 }
 function shouldSkipDir(name) {
   return [
@@ -7522,7 +7863,7 @@ function collectContentBasedCppTestFiles(repoPath, repoFiles) {
   return candidates.filter((file) => {
     const fullPath = join(repoPath, file);
     if (!isRegularFile(fullPath)) return false;
-    const contents = readFileSync(fullPath, "utf8");
+    const contents = readRepoText(fullPath, "utf8");
     return CPP_TEST_FRAMEWORK_PATTERN.test(contents) || CPP_TEST_MACRO_PATTERN.test(contents);
   });
 }
@@ -7542,7 +7883,7 @@ function measureNonHollowTestShare(repoPath, files, useV17Detectors = false) {
   for (const file of files) {
     const fullPath = join(repoPath, file);
     if (!isRegularFile(fullPath)) continue;
-    const contents = readFileSync(fullPath, "utf8");
+    const contents = readRepoText(fullPath, "utf8");
     const nonHollow = (JS_TEST_ASSERTION_PATTERN.test(contents) || CPP_TEST_ASSERTION_PATTERN.test(contents) || MULTI_ECOSYSTEM_TEST_ASSERTION_PATTERN.test(contents)) && !SUITE_LEVEL_SKIP_PATTERN.test(contents);
     if (nonHollow) {
       nonHollowCount += 1;
@@ -7563,7 +7904,7 @@ function countPatternMatches(repoPath, files, pattern) {
   for (const file of files) {
     const fullPath = join(repoPath, file);
     if (!isRegularFile(fullPath)) continue;
-    count += [...readFileSync(fullPath, "utf8").matchAll(matcher)].length;
+    count += [...readRepoText(fullPath, "utf8").matchAll(matcher)].length;
   }
   return count;
 }
@@ -7571,7 +7912,7 @@ function readCoveragePercent(repoPath, files) {
   for (const file of files) {
     const fullPath = join(repoPath, file);
     if (!isRegularFile(fullPath)) continue;
-    const contents = readFileSync(fullPath, "utf8");
+    const contents = readRepoText(fullPath, "utf8");
     const summaryPercent = parseCoverageSummaryPercent(contents);
     if (summaryPercent !== null) return summaryPercent;
     const thresholdPercent = parseCoverageThresholdPercent(contents);
@@ -7661,7 +8002,7 @@ function readDependencySpecs(repoPath, manifests) {
 }
 function readGoModDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync(path, "utf8");
+  const contents = readRepoText(path, "utf8");
   const blockPattern = /require\s*\(([^)]+)\)/gs;
   const singlePattern = /^require\s+(\S+)\s+(\S+)/gm;
   for (const blockMatch of contents.matchAll(blockPattern)) {
@@ -7682,7 +8023,7 @@ function readGoModDependencySpecs(path) {
 }
 function readCargoTomlDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync(path, "utf8");
+  const contents = readRepoText(path, "utf8");
   const depSectionPattern = /^\[(?:dependencies|dev-dependencies|build-dependencies)\]([\s\S]*?)(?=^\[|(?![\s\S]))/gm;
   for (const sectionMatch of contents.matchAll(depSectionPattern)) {
     const section = sectionMatch[1] ?? "";
@@ -7704,7 +8045,7 @@ function readCargoTomlDependencySpecs(path) {
 }
 function readPyprojectDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync(path, "utf8");
+  const contents = readRepoText(path, "utf8");
   const poetrySectionPattern = /^\[tool\.poetry\.dependencies\]([\s\S]*?)(?=^\[|(?![\s\S]))/gm;
   for (const sectionMatch of contents.matchAll(poetrySectionPattern)) {
     const section = sectionMatch[1] ?? "";
@@ -7738,7 +8079,7 @@ function readPyprojectDependencySpecs(path) {
 }
 function readPipfileDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync(path, "utf8");
+  const contents = readRepoText(path, "utf8");
   const sectionPattern = /^\[(?:packages|dev-packages)\]([\s\S]*?)(?=^\[|$(?![\s\S]))/gm;
   for (const sectionMatch of contents.matchAll(sectionPattern)) {
     for (const line of (sectionMatch[1] ?? "").split("\n")) {
@@ -7751,7 +8092,7 @@ function readPipfileDependencySpecs(path) {
   return specs;
 }
 function readVcpkgJsonDependencySpecs(path) {
-  const parsed = parseJsonObject(readFileSync(path, "utf8"));
+  const parsed = parseJsonObject(readRepoText(path, "utf8"));
   if (!parsed) return [];
   const rawDeps = Array.isArray(parsed.dependencies) ? parsed.dependencies : [];
   const specs = [];
@@ -7767,7 +8108,7 @@ function readVcpkgJsonDependencySpecs(path) {
 }
 function readConanfileTxtDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync(path, "utf8");
+  const contents = readRepoText(path, "utf8");
   const requiresMatch = /^\[requires\]([\s\S]*?)(?=^\[|$(?![\s\S]))/m.exec(contents);
   if (!requiresMatch) return specs;
   for (const line of (requiresMatch[1] ?? "").split("\n")) {
@@ -7780,7 +8121,7 @@ function readConanfileTxtDependencySpecs(path) {
 }
 function readConanfilePyDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync(path, "utf8");
+  const contents = readRepoText(path, "utf8");
   for (const match of contents.matchAll(/self\.requires\s*\(\s*["']([\w.\-]+)\/([\w.\-]+)["']/g)) {
     specs.push({ name: match[1] ?? "", version: match[2] ?? "" });
   }
@@ -7794,7 +8135,7 @@ function readConanfilePyDependencySpecs(path) {
 }
 function readCMakeDependencySpecs(path) {
   const specs = [];
-  const contents = readFileSync(path, "utf8");
+  const contents = readRepoText(path, "utf8");
   for (const match of contents.matchAll(/find_package\s*\(\s*([\w]+)(?:\s+([\d.]+))?/gi)) {
     const name = match[1];
     if (!name) continue;
@@ -7809,7 +8150,7 @@ function readCMakeDependencySpecs(path) {
   return specs;
 }
 function readPackageJsonDependencySpecs(packageJsonPath) {
-  const parsed = parseJsonObject(readFileSync(packageJsonPath, "utf8"));
+  const parsed = parseJsonObject(readRepoText(packageJsonPath, "utf8"));
   if (!parsed) return [];
   const optionalPeerNames = /* @__PURE__ */ new Set();
   const peerDependenciesMeta = parsed.peerDependenciesMeta;
@@ -7836,7 +8177,7 @@ function readPackageJsonDependencySpecs(packageJsonPath) {
   return specs;
 }
 function readRequirementsDependencySpecs(path) {
-  return readFileSync(path, "utf8").split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).map((line) => {
+  return readRepoText(path, "utf8").split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).map((line) => {
     const [name = line, version = ""] = line.split(/[<>=~!]=?/, 2);
     return { name: name.trim(), version: line.includes("==") ? version.trim() : line };
   });
@@ -7854,7 +8195,7 @@ function isPinnedDependencyVersion(version) {
 function workflowTargetsDefaultBranch(repoPath, file) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return false;
-  const contents = readFileSync(fullPath, "utf8").toLowerCase();
+  const contents = readRepoText(fullPath, "utf8").toLowerCase();
   return /\bpull_request\b/.test(contents) || /\bbranches:\s*\[[^\]]*\b(main|master)\b[^\]]*\]/.test(contents) || /\bbranches:\s*\n\s*-\s*(main|master)\b/.test(contents);
 }
 function isPrMergeCommit(commit) {
@@ -8008,7 +8349,7 @@ function deriveRlsPolicyScopeInventory(repoPath, repoFiles) {
   for (const file of candidatePolicyFiles) {
     let content;
     try {
-      content = readFileSync(join(repoPath, file), "utf8");
+      content = readRepoText(join(repoPath, file), "utf8");
     } catch {
       continue;
     }
@@ -8112,7 +8453,7 @@ function findClaimRealityReconciliationArtifacts(repoPath, repoFiles) {
 function isAuthenticatedClaimRealityArtifact(repoPath, file) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return false;
-  const contents = readFileSync(fullPath, "utf8");
+  const contents = readRepoText(fullPath, "utf8");
   if (/\.json$/i.test(file)) {
     return parseJsonObject(contents)?.artifactKind === "claim_reality_reconciliation";
   }
@@ -8151,7 +8492,7 @@ function isCoverageConfig(repoPath, file) {
 function packageJsonHasCoverageTooling(repoPath, file) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return false;
-  const parsed = parseJsonObject(readFileSync(fullPath, "utf8"));
+  const parsed = parseJsonObject(readRepoText(fullPath, "utf8"));
   if (!parsed) return false;
   const scripts = parsed.scripts;
   if (typeof scripts === "object" && scripts !== null && !Array.isArray(scripts)) {
@@ -8625,7 +8966,7 @@ function findRuntimeContainerEntrypointFile(repoPath, repoFiles) {
   return repoFiles.filter((file) => /(^|\/)Dockerfile$/i.test(file) && isAuthoredProductionPath(file)).find((file) => {
     const fullPath = join(repoPath, file);
     if (!isRegularFile(fullPath)) return false;
-    const lines = readFileSync(fullPath, "utf8").split(/\r?\n/);
+    const lines = readRepoText(fullPath, "utf8").split(/\r?\n/);
     const finalStageStart = lines.reduce(
       (last, line, index) => /^\s*FROM\b/i.test(line) ? index : last,
       0
@@ -8674,7 +9015,7 @@ function packageJsonHasAuditScript(repoPath, manifest) {
 function packageJsonHasHeavyTestDependency(repoPath, manifest) {
   const fullPath = join(repoPath, manifest);
   if (!isRegularFile(fullPath)) return false;
-  const parsed = parseJsonObject(readFileSync(fullPath, "utf8"));
+  const parsed = parseJsonObject(readRepoText(fullPath, "utf8"));
   if (!parsed) return false;
   const names = [
     ...Object.keys(isRecord(parsed.dependencies) ? parsed.dependencies : {}),
@@ -8685,7 +9026,7 @@ function packageJsonHasHeavyTestDependency(repoPath, manifest) {
 function packageJsonDescribesPackagedApplication(repoPath, manifest, repoFiles) {
   const fullPath = join(repoPath, manifest);
   if (!isRegularFile(fullPath)) return false;
-  const parsed = parseJsonObject(readFileSync(fullPath, "utf8"));
+  const parsed = parseJsonObject(readRepoText(fullPath, "utf8"));
   if (!parsed) return false;
   const scripts = isRecord(parsed.scripts) ? Object.values(parsed.scripts) : [];
   const dependencies = {
@@ -8710,7 +9051,7 @@ function findTauriApplicationMetadata(repoPath, manifest, repoFiles) {
     if (!repoFiles.includes(file)) return false;
     const fullPath = join(repoPath, file);
     if (!isRegularFile(fullPath)) return false;
-    const config = parseJsonObject(readFileSync(fullPath, "utf8"));
+    const config = parseJsonObject(readRepoText(fullPath, "utf8"));
     const packageMetadata = isRecord(config?.package) ? config.package : null;
     return isNonEmptyString(config?.productName) || isNonEmptyString(config?.identifier) || packageMetadata != null && isNonEmptyString(packageMetadata.productName);
   });
@@ -8757,12 +9098,12 @@ function isRegularFile(path) {
 function fileContains(repoPath, file, pattern) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return false;
-  return pattern.test(readFileSync(fullPath, "utf8"));
+  return pattern.test(readRepoText(fullPath, "utf8"));
 }
 function findCommittedSecretInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return null;
-  const contents = readFileSync(fullPath, "utf8");
+  const contents = readRepoText(fullPath, "utf8");
   const isTestCredentialConfiguration = useV39Detectors && isLikelyTestCredentialConfiguration(file, contents);
   const secretScanContents = prepareCredentialScanContents(
     contents,
@@ -8855,7 +9196,7 @@ function isLikelyTestCredentialConfiguration(file, contents) {
 function hasTemplateOnlyEnvContent(repoPath, file) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return false;
-  const substantiveLines = readFileSync(fullPath, "utf8").split(/\r?\n/).filter((line) => line.trim().length > 0 && !/^\s*#/.test(line));
+  const substantiveLines = readRepoText(fullPath, "utf8").split(/\r?\n/).filter((line) => line.trim().length > 0 && !/^\s*#/.test(line));
   if (substantiveLines.length === 0) return true;
   const assignments = substantiveLines.map(
     (line) => /^\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*\s*=\s*(.*?)\s*$/.exec(line)?.[1] ?? null
@@ -8870,7 +9211,7 @@ function hasTemplateOnlyEnvContent(repoPath, file) {
 function findSecretFingerprintsInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return [];
-  const contents = readFileSync(fullPath, "utf8");
+  const contents = readRepoText(fullPath, "utf8");
   const scanContents = prepareCredentialScanContents(
     contents,
     file,
@@ -9021,8 +9362,18 @@ function secretEvidenceLabel(prefix, match) {
 function isSecretIdentifierCharacter(characterCode) {
   return characterCode >= 48 && characterCode <= 57 || characterCode >= 65 && characterCode <= 90 || characterCode === 95 || characterCode >= 97 && characterCode <= 122;
 }
-function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFingerprintsByPath, authoredProductionOnly = false, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
-  const historyEntries = readCredentialHistoryEntries(repoPath, useV36Detectors);
+var CONTROL_CHARACTER_HISTORY_PATH_LIMITATION = "Git history contained a credential-shaped pathname with control characters. Cejel omitted that path from historical blob inspection and continued with reduced history evidence.";
+function declareHistoryFailure(scanLimitations, reason, operation, maxBufferBytes) {
+  scanLimitations.add(
+    `${describeGitFailure(reason, operation, maxBufferBytes)} Cejel continued with reduced Git history evidence.`
+  );
+}
+function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFingerprintsByPath, scanLimitations, authoredProductionOnly = false, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
+  const historyEntries = readCredentialHistoryEntries(
+    repoPath,
+    scanLimitations,
+    useV36Detectors
+  );
   const head = excludeHead ? readGitHead(repoPath) : null;
   let scannedFiles = 0;
   let envPathEvidence = null;
@@ -9035,7 +9386,7 @@ function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFinger
       return { evidence: null, envPathEvidence, truncated: true };
     }
     scannedFiles += 1;
-    const contents = readGitBlob(repoPath, entry.commit, entry.path);
+    const contents = readGitBlob(repoPath, entry.commit, entry.path, scanLimitations);
     if (!contents) continue;
     const scanContents = prepareCredentialScanContents(
       contents,
@@ -9078,7 +9429,7 @@ function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFinger
   }
   return { evidence: null, envPathEvidence, truncated: false };
 }
-function readCredentialHistoryEntries(repoPath, useV36Detectors = false) {
+function readCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors = false) {
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
   const appendEntry = (entry) => {
@@ -9087,14 +9438,12 @@ function readCredentialHistoryEntries(repoPath, useV36Detectors = false) {
     seen.add(key);
     entries.push(entry);
   };
-  try {
-    const commits = execFileSync("git", ["rev-list", "HEAD"], {
-      cwd: repoPath,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-    const output = execFileSync(
-      "git",
+  const commitsResult = execGit(["rev-list", "HEAD"], { cwd: repoPath });
+  if (!commitsResult.ok && !isExpectedGitAbsence(commitsResult)) {
+    declareHistoryFailure(scanLimitations, commitsResult.reason, "history revision enumeration");
+  }
+  if (commitsResult.ok) {
+    const historyResult = execGit(
       [
         "diff-tree",
         "--stdin",
@@ -9102,39 +9451,53 @@ function readCredentialHistoryEntries(repoPath, useV36Detectors = false) {
         "--name-only",
         "-r",
         "--diff-filter=AM",
-        "--pretty=format:commit:%H"
+        "-z",
+        "--pretty=format:commit:%H%x00"
       ],
-      {
-        cwd: repoPath,
-        encoding: "utf8",
-        input: commits,
-        stdio: ["pipe", "pipe", "ignore"]
-      }
+      { cwd: repoPath, input: commitsResult.stdout }
     );
-    let currentCommit = null;
-    for (const line of output.split("\n")) {
-      if (line.startsWith("commit:")) {
-        currentCommit = line.slice("commit:".length);
-        continue;
+    if (!historyResult.ok) {
+      if (!isExpectedGitAbsence(historyResult)) {
+        declareHistoryFailure(scanLimitations, historyResult.reason, "history tree enumeration");
+      }
+    } else {
+      let currentCommit = null;
+      for (const rawToken of historyResult.stdout.split("\0")) {
+        const token = rawToken.startsWith("\n") ? rawToken.slice(1) : rawToken;
+        if (token.startsWith("commit:")) {
+          currentCommit = token.slice("commit:".length);
+          continue;
+        }
+        const path = token;
+        if (!currentCommit || !path) continue;
+        if (/[\u0000-\u001f\u007f]/.test(path)) {
+          scanLimitations.add(CONTROL_CHARACTER_HISTORY_PATH_LIMITATION);
+          continue;
+        }
+        if (!isCredentialHistoryPath(path, useV36Detectors)) continue;
+        appendEntry({ commit: currentCommit, path });
       }
-      const path = line.trim();
-      if (!currentCommit || !path) continue;
-      if (!isCredentialHistoryPath(path, useV36Detectors)) continue;
-      appendEntry({ commit: currentCommit, path });
     }
-  } catch {
   }
-  for (const entry of readDeletedCredentialHistoryEntries(repoPath, useV36Detectors)) {
+  for (const entry of readDeletedCredentialHistoryEntries(
+    repoPath,
+    scanLimitations,
+    useV36Detectors
+  )) {
     appendEntry(entry);
   }
   return entries;
 }
-function readDeletedCredentialHistoryEntries(repoPath, useV36Detectors = false) {
-  const deletedPaths = readDeletedCredentialHistoryPaths(repoPath, useV36Detectors);
+function readDeletedCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors = false) {
+  const deletedPaths = readDeletedCredentialHistoryPaths(
+    repoPath,
+    scanLimitations,
+    useV36Detectors
+  );
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
   for (const path of deletedPaths) {
-    for (const commit of readHistoryCommitsForPath(repoPath, path)) {
+    for (const commit of readHistoryCommitsForPath(repoPath, path, scanLimitations)) {
       const key = `${commit}:${path}`;
       if (seen.has(key)) continue;
       seen.add(key);
@@ -9143,47 +9506,51 @@ function readDeletedCredentialHistoryEntries(repoPath, useV36Detectors = false)
   }
   return entries;
 }
-function readDeletedCredentialHistoryPaths(repoPath, useV36Detectors = false) {
-  try {
-    const output = execFileSync(
-      "git",
-      ["log", "HEAD", "--diff-filter=D", "--name-status", "--format=commit:%H"],
-      {
-        cwd: repoPath,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"]
-      }
-    );
-    const paths = [];
-    const seen = /* @__PURE__ */ new Set();
-    for (const line of output.split("\n")) {
-      if (!line.startsWith("D	")) continue;
-      const path = line.slice(2).trim();
-      if (!path || seen.has(path)) continue;
-      if (!isCredentialHistoryPath(path, useV36Detectors)) continue;
-      seen.add(path);
-      paths.push(path);
-    }
-    return paths;
-  } catch {
+function readDeletedCredentialHistoryPaths(repoPath, scanLimitations, useV36Detectors = false) {
+  const historyResult = execGit(
+    [
+      "log",
+      "--no-show-signature",
+      "HEAD",
+      "--diff-filter=D",
+      "--name-only",
+      "-z",
+      "--format=commit:%H%x00"
+    ],
+    { cwd: repoPath }
+  );
+  if (!historyResult.ok) {
+    if (isExpectedGitAbsence(historyResult)) return [];
+    declareHistoryFailure(scanLimitations, historyResult.reason, "deleted-path history scan");
     return [];
   }
+  const paths = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const rawToken of historyResult.stdout.split("\0")) {
+    const path = rawToken.startsWith("\n") ? rawToken.slice(1) : rawToken;
+    if (path.startsWith("commit:") || !path) continue;
+    if (/[\u0000-\u001f\u007f]/.test(path)) {
+      scanLimitations.add(CONTROL_CHARACTER_HISTORY_PATH_LIMITATION);
+      continue;
+    }
+    if (!path || seen.has(path)) continue;
+    if (!isCredentialHistoryPath(path, useV36Detectors)) continue;
+    seen.add(path);
+    paths.push(path);
+  }
+  return paths;
 }
-function readHistoryCommitsForPath(repoPath, path) {
-  try {
-    const output = execFileSync(
-      "git",
-      ["log", "HEAD", "--diff-filter=AM", "--format=%H", "--", path],
-      {
-        cwd: repoPath,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"]
-      }
-    );
-    return output.split("\n").map((line) => line.trim()).filter((line) => /^[0-9a-f]{40}$/i.test(line));
-  } catch {
+function readHistoryCommitsForPath(repoPath, path, scanLimitations) {
+  const historyResult = execGit(
+    ["log", "--no-show-signature", "HEAD", "--diff-filter=AM", "--format=%H", "--", path],
+    { cwd: repoPath }
+  );
+  if (!historyResult.ok) {
+    if (isExpectedGitAbsence(historyResult)) return [];
+    declareHistoryFailure(scanLimitations, historyResult.reason, "path history scan");
     return [];
   }
+  return historyResult.stdout.split("\n").map((line) => line.trim()).filter((line) => /^[0-9a-f]{40}$/i.test(line));
 }
 function isCredentialHistoryPath(path, _useV36Detectors = false) {
   if (isHardExcludedPath(path)) return false;
@@ -9200,17 +9567,23 @@ function isEnvHistoryPath(path, useV36Detectors = false, useV47Detectors = false
   const basename3 = path.toLowerCase().split("/").at(-1) ?? path.toLowerCase();
   return (useV36Detectors ? /^\.env(?:\.|$)/ : /\.env(?:\.|$)/).test(basename3);
 }
-function readGitBlob(repoPath, commit, path) {
-  try {
-    return execFileSync("git", ["show", `${commit}:${path}`], {
-      cwd: repoPath,
-      encoding: "utf8",
-      maxBuffer: 512e3,
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-  } catch {
+function readGitBlob(repoPath, commit, path, scanLimitations) {
+  const maxBufferBytes = 512e3;
+  const blobResult = execGit(["show", `${commit}:${path}`], {
+    cwd: repoPath,
+    maxBufferBytes
+  });
+  if (!blobResult.ok) {
+    if (isExpectedGitAbsence(blobResult)) return null;
+    declareHistoryFailure(
+      scanLimitations,
+      blobResult.reason,
+      "historical blob read",
+      maxBufferBytes
+    );
     return null;
   }
+  return blobResult.stdout;
 }
 var ALL_CAPS_SNAKE_PLACEHOLDER_PATTERN = /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/;
 function isPlaceholderSecretValue(value) {
@@ -9240,7 +9613,7 @@ function hasSuspiciousDependencies(repoPath, manifest, useV47Detectors = false)
   if (!manifest.endsWith("package.json")) return false;
   const fullPath = join(repoPath, manifest);
   if (!isRegularFile(fullPath)) return false;
-  const parsed = parseJsonObject(readFileSync(fullPath, "utf8"));
+  const parsed = parseJsonObject(readRepoText(fullPath, "utf8"));
   if (!parsed) return false;
   const dependencies = isRecord(parsed.dependencies) ? parsed.dependencies : {};
   const devDependencies = isRecord(parsed.devDependencies) ? parsed.devDependencies : {};
@@ -9256,24 +9629,26 @@ function hasSuspiciousDependencies(repoPath, manifest, useV47Detectors = false)
   return placeholderIdentity && placeholderMetadata;
 }
 function readRecentCommits(repoPath) {
-  try {
-    const output = execFileSync("git", ["log", "--max-count=12", "--format=%H%x00%s"], {
-      cwd: repoPath,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-    if (!output) return [];
-    return output.split("\n").map((line) => {
-      const [sha = "", subject = ""] = line.split("\0");
-      return { sha, subject };
-    }).filter((commit) => commit.sha.length >= 7);
-  } catch {
-    return [];
+  const historyResult = execGit(
+    ["log", "--no-show-signature", "--max-count=12", "--format=%H%x00%s"],
+    {
+      cwd: repoPath
+    }
+  );
+  if (!historyResult.ok) {
+    if (isExpectedGitAbsence(historyResult)) return [];
+    throw new Error(describeGitFailure(historyResult.reason, "recent history scan"));
   }
+  const output = historyResult.stdout.trim();
+  if (!output) return [];
+  return output.split("\n").map((line) => {
+    const [sha = "", subject = ""] = line.split("\0");
+    return { sha, subject };
+  }).filter((commit) => commit.sha.length >= 7);
 }
 function readPackageScripts(packageJsonPath) {
   if (!isRegularFile(packageJsonPath)) return /* @__PURE__ */ new Map();
-  const parsed = parseJsonObject(readFileSync(packageJsonPath, "utf8"));
+  const parsed = parseJsonObject(readRepoText(packageJsonPath, "utf8"));
   const scripts = parsed?.scripts;
   if (!isRecord(scripts)) return /* @__PURE__ */ new Map();
   return new Map(
@@ -9284,7 +9659,7 @@ function readPackageScripts(packageJsonPath) {
 }
 function evidenceForRelative(repoPath, path, kind, label) {
   const fullPath = join(repoPath, path);
-  const contents = isRegularFile(fullPath) ? readFileSync(fullPath, "utf8") : "";
+  const contents = isRegularFile(fullPath) ? readRepoText(fullPath, "utf8") : "";
   return {
     kind,
     label,
@@ -9297,7 +9672,7 @@ function evidenceForRelative(repoPath, path, kind, label) {
 }
 function evidenceForRelativeAtLine(repoPath, path, kind, label, line) {
   const fullPath = join(repoPath, path);
-  const contents = isRegularFile(fullPath) ? readFileSync(fullPath, "utf8") : "";
+  const contents = isRegularFile(fullPath) ? readRepoText(fullPath, "utf8") : "";
   return {
     kind,
     label,
@@ -9324,43 +9699,46 @@ function firstMeaningfulLine(contents) {
   return index === -1 ? 1 : index + 1;
 }
 function readGitHead(repoPath) {
-  try {
-    return execFileSync("git", ["rev-parse", "HEAD"], {
-      cwd: repoPath,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-  } catch {
-    return null;
+  const headResult = execGit(["rev-parse", "HEAD"], { cwd: repoPath });
+  if (!headResult.ok) {
+    if (isExpectedGitAbsence(headResult)) return null;
+    throw new Error(describeGitFailure(headResult.reason, "HEAD resolution"));
   }
+  return headResult.stdout.trim() || null;
 }
-function hasEnvPathInGitHistory(repoPath) {
-  try {
-    const output = execFileSync(
-      "git",
-      ["log", "HEAD", "--diff-filter=AM", "--name-only", "--format="],
-      {
-        cwd: repoPath,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-        maxBuffer: 512e3
-      }
-    ).trim();
-    if (!output) return false;
-    return output.split("\n").some((p) => /(?:^|\/)\.env(?:\.|$)/i.test(p.trim()));
-  } catch {
+function hasEnvPathInGitHistory(repoPath, scanLimitations) {
+  const historyResult = execGit(
+    ["log", "--no-show-signature", "HEAD", "--diff-filter=AM", "--name-only", "-z", "--format="],
+    { cwd: repoPath }
+  );
+  if (!historyResult.ok) {
+    if (isExpectedGitAbsence(historyResult)) return false;
+    declareHistoryFailure(scanLimitations, historyResult.reason, "environment-file history scan");
     return false;
   }
+  const output = historyResult.stdout;
+  if (!output) return false;
+  return output.split("\0").some((rawPath) => {
+    const path = rawPath.startsWith("\n") ? rawPath.slice(1) : rawPath;
+    if (/[\u0000-\u001f\u007f]/.test(path)) {
+      scanLimitations.add(CONTROL_CHARACTER_HISTORY_PATH_LIMITATION);
+      return false;
+    }
+    return /(?:^|\/)\.env(?:\.|$)/i.test(path);
+  });
 }
 
 // src/witan/public-scan.ts
+init_esm_shims();
 import { resolve as resolve2 } from "path";
 
 // src/witan/ingest.ts
-import { readFileSync as readFileSync5, readdirSync as readdirSync2 } from "fs";
+init_esm_shims();
+import { readFileSync as readFileSync4, readdirSync as readdirSync2 } from "fs";
 import { join as join2 } from "path";
 
 // src/witan/finding-limits.ts
+init_esm_shims();
 var RULE_ID_MAX = 200;
 var MESSAGE_MAX = 500;
 var LOCATION_MAX = 700;
@@ -9379,7 +9757,8 @@ function clampFinding(finding) {
 }
 
 // src/witan/generic-adapter.ts
-import { readFileSync as readFileSync2 } from "fs";
+init_esm_shims();
+import { readFileSync } from "fs";
 var VALID_DIMENSIONS = /* @__PURE__ */ new Set([
   "A1",
   "A2",
@@ -9426,7 +9805,8 @@ function parseGenericJson(raw) {
 }
 
 // src/witan/sarif-adapter.ts
-import { readFileSync as readFileSync3 } from "fs";
+init_esm_shims();
+import { readFileSync as readFileSync2 } from "fs";
 var DIMENSION_RULES = [
   // A2 — injection / secrets / auth (high weight)
   {
@@ -9571,7 +9951,8 @@ function parseSarifJson(raw, extraDimensionRules) {
 }
 
 // src/witan/scorecard-adapter.ts
-import { readFileSync as readFileSync4 } from "fs";
+init_esm_shims();
+import { readFileSync as readFileSync3 } from "fs";
 var CHECK_RULES = {
   // B2 — PR outcome traceability
   "Branch-Protection": { dimension: "B2", weight: 0.8 },
@@ -9680,10 +10061,18 @@ function rawToolName(raw) {
   if (typeof obj.tool === "string" && obj.tool.length > 0) return obj.tool;
   return "scorecard";
 }
+var MAX_INGEST_SOURCE_LENGTH = 120;
+function sanitizeIngestSource(source) {
+  const withoutControls = source.replace(/[\p{Cc}\p{Cf}]/gu, "").trim();
+  const safeSource = withoutControls.length > 0 ? withoutControls : "unknown";
+  const codePoints = Array.from(safeSource);
+  if (codePoints.length <= MAX_INGEST_SOURCE_LENGTH) return safeSource;
+  return `${codePoints.slice(0, MAX_INGEST_SOURCE_LENGTH - 3).join("")}...`;
+}
 function parseIngestFile(filePath, options = {}) {
   let raw;
   try {
-    raw = JSON.parse(stripBom(readFileSync5(filePath, "utf8")));
+    raw = JSON.parse(stripBom(readFileSync4(filePath, "utf8")));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Cejel: could not parse ingest file as JSON: ${filePath} (${message})`);
@@ -9707,6 +10096,8 @@ function parseIngestFile(filePath, options = {}) {
   }
   return signals.map((signal) => ({
     ...signal,
+    source: sanitizeIngestSource(signal.source),
+    provenance: options.provenance ?? "operator_supplied",
     findings: signal.findings.map(clampFinding)
   }));
 }
@@ -9715,7 +10106,7 @@ function expandIngestPattern(pattern) {
   const lastSlash = pattern.lastIndexOf("/");
   const dir = lastSlash === -1 ? "." : pattern.slice(0, lastSlash);
   const filePattern = lastSlash === -1 ? pattern : pattern.slice(lastSlash + 1);
-  const regexSource = filePattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  const regexSource = filePattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
   const regex = new RegExp(`^${regexSource}$`);
   let entries;
   try {
@@ -9736,7 +10127,11 @@ function discoverIngestInputs(repoPath) {
   return entries.filter((name) => /\.(sarif|json)$/i.test(name)).sort().map((name) => join2(inputsDir, name));
 }
 
+// src/witan/scoring.ts
+init_esm_shims();
+
 // src/witan/rubric.ts
+init_esm_shims();
 var WITAN_RUBRIC = [
   {
     id: "A1",
@@ -9803,6 +10198,9 @@ var MAX_SIGNAL_ADJUSTMENT = 0.8;
 function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
   const parsedInput = WitanReportInputSchema.parse(input);
   const signalsByCriterion = mergeSignalsByCriterion(parsedInput.signals);
+  const readFailureAbstentions = new Set(
+    [...signalsByCriterion.values()].filter((signal) => signal.insufficientData === true).map((signal) => signal.criterionId)
+  );
   const hasInputSignals = inputSignals != null && inputSignals.length > 0;
   const inputSignalsByDimension = /* @__PURE__ */ new Map();
   if (hasInputSignals && inputSignals) {
@@ -9866,7 +10264,8 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
   const categoryScoreMap = {};
   for (const category of categoryOrder) {
     categoryScoreMap[category] = averageScore(
-      criteria.filter((criterion) => criterion.category === category)
+      criteria.filter((criterion) => criterion.category === category),
+      readFailureAbstentions
     );
   }
   const firstCategory = categoryOrder[0];
@@ -9889,7 +10288,6 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
     productSlug: parsedInput.productSlug,
     productDisplayName: parsedInput.productDisplayName,
     repo: parsedInput.repo,
-    generatedAt: parsedInput.generatedAt,
     rubricVersion: parsedInput.rubricVersion,
     verdict: abstained ? "insufficient_source" : witanVerdictForScore(overallScore),
     codeTrustScore: abstained ? null : codeTrustScore,
@@ -9897,6 +10295,8 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
     overallScore: abstained ? null : overallScore,
     criteria,
     ...consumedSignals.length > 0 ? { consumedSignals } : {},
+    ...parsedInput.scanLimitations.length > 0 ? { scanLimitations: parsedInput.scanLimitations } : {},
+    ...parsedInput.contentReadSummary ? { contentReadSummary: parsedInput.contentReadSummary } : {},
     // Only surface the full per-category map for rubrics with more than two buckets —
     // the default two-category rubric is fully represented by codeTrustScore/processTrustScore.
     ...!abstained && categoryOrder.length > 2 ? { categoryScores: categoryScoreMap } : {},
@@ -9922,6 +10322,7 @@ function applySignalAdjustment(nativeScore, dimension, signals) {
     totalRawAdj += signalAdj;
     summaries.push({
       source: signal.source,
+      provenance: signal.provenance ?? "operator_supplied",
       dimension,
       findingCount: signal.findings.length,
       severityBreakdown: { critical: criticalCount, warning: warningCount, info: infoCount },
@@ -9987,8 +10388,9 @@ function mergeSignalsByCriterion(signals) {
       findings: [...existing.findings, ...signal.findings],
       metrics: [...existing.metrics ?? [], ...signal.metrics ?? []],
       notes: signal.notes ?? existing.notes,
-      // N/A wins on merge: if either signal is N/A, the criterion is N/A.
-      ...existing.notApplicable === true || signal.notApplicable === true ? { notApplicable: true } : {}
+      // Read-failure abstention wins on merge: partial sibling evidence cannot turn an
+      // incomplete criterion into a score. Otherwise N/A retains its historical precedence.
+      ...existing.insufficientData === true || signal.insufficientData === true ? { insufficientData: true } : existing.notApplicable === true || signal.notApplicable === true ? { notApplicable: true } : {}
     });
   }
   return merged;
@@ -10009,6 +10411,15 @@ function scoreCriterion(signal, rubricVersion) {
       metrics: []
     };
   }
+  if (signal.insufficientData === true) {
+    return {
+      score: 0,
+      status: unmeasuredStatus(rubricVersion),
+      evidence: [],
+      findings: [],
+      metrics: []
+    };
+  }
   if (signal.notApplicable === true) {
     return {
       score: 0,
@@ -10384,9 +10795,9 @@ function ensureFindingsExplainStatus(criterionId, score, status, findings, evide
     }
   ];
 }
-function averageScore(criteria) {
+function averageScore(criteria, readFailureAbstentions = /* @__PURE__ */ new Set()) {
   const applicable = criteria.filter(
-    (criterion) => criterion.status !== "not_applicable" && criterion.status !== "insufficient_data"
+    (criterion) => criterion.status !== "not_applicable" && (criterion.status !== "insufficient_data" || readFailureAbstentions.has(criterion.id))
   );
   if (applicable.length === 0) return 0;
   const total = applicable.reduce((sum, criterion) => sum + criterion.score, 0);
@@ -10421,7 +10832,7 @@ function scoreRepoWithPublicCejel(options) {
 }
 function resolvePublicIngestSignals(options) {
   const seen = /* @__PURE__ */ new Set();
-  const files = [];
+  const explicitFiles = [];
   for (const pattern of options.ingestPatterns ?? []) {
     const matches = expandIngestPattern(pattern);
     if (matches.length === 0 && options.warnOnEmptyIngestMatch) {
@@ -10432,20 +10843,28 @@ function resolvePublicIngestSignals(options) {
       const resolved = resolve2(match);
       if (seen.has(resolved)) continue;
       seen.add(resolved);
-      files.push(match);
+      explicitFiles.push(match);
     }
   }
+  const signals = explicitFiles.flatMap(
+    (file) => parseIngestFile(file, { provenance: "operator_supplied" })
+  );
+  if (!options.autoDiscoverIngest) return signals;
   for (const discovered of discoverIngestInputs(options.repoPath)) {
     const resolved = resolve2(discovered);
     if (seen.has(resolved)) continue;
     seen.add(resolved);
-    files.push(discovered);
+    signals.push(...parseIngestFile(discovered, { provenance: "auto_discovered" }));
   }
-  return files.flatMap((file) => parseIngestFile(file));
+  return signals;
 }
 
+// src/scan.ts
+init_esm_shims();
+
 // src/product-identity.ts
-import { existsSync, readFileSync as readFileSync6 } from "fs";
+init_esm_shims();
+import { existsSync, readFileSync as readFileSync5 } from "fs";
 import { basename as basename2, join as join3 } from "path";
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/;
 var FALLBACK_SLUG = "repo";
@@ -10462,7 +10881,7 @@ function deriveProductIdentity(repoPath) {
 function readPackageName(packageJsonPath) {
   if (!existsSync(packageJsonPath)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync6(packageJsonPath, "utf8"));
+    const parsed = JSON.parse(readFileSync5(packageJsonPath, "utf8"));
     if (typeof parsed === "object" && parsed !== null && "name" in parsed) {
       const name = parsed.name;
       if (typeof name === "string" && name.trim().length > 0) return name;
@@ -10479,7 +10898,11 @@ function slugify(raw) {
   return FALLBACK_SLUG;
 }
 
+// src/summary.ts
+init_esm_shims();
+
 // src/finding-presentation.ts
+init_esm_shims();
 var METRIC_DERIVED_FINDING_PATTERN2 = /^[A-Z]\d+ metric-derived score is (\d+\.\d)\/4\.0, in the (critical|warning) band — no single finding drove this; it reflects the combined metric weighting below\.$/;
 var REMEDIATION_BY_METRIC2 = {
   test_to_source_ratio: "add concrete regression tests for the implementation surface",
@@ -10591,13 +11014,14 @@ function buildWitanCliSummary(report) {
   const common = {
     productSlug: report.productSlug,
     productDisplayName: report.productDisplayName,
-    generatedAt: report.generatedAt,
     findingCount: allFindings.length,
     topFindings: sorted.slice(0, TOP_FINDINGS_LIMIT),
     contributingSources,
     externalSources,
     externalFindingCount: allExternalFindings.length,
-    topExternalFindings: allExternalFindings.slice(0, EXTERNAL_FINDINGS_DISPLAY_LIMIT)
+    topExternalFindings: allExternalFindings.slice(0, EXTERNAL_FINDINGS_DISPLAY_LIMIT),
+    scanLimitations: [...report.scanLimitations ?? []],
+    ...report.contentReadSummary ? { contentReadSummary: report.contentReadSummary } : {}
   };
   if (report.verdict === "insufficient_source") {
     return {
@@ -10621,21 +11045,24 @@ function buildWitanCliSummary(report) {
 // src/scan.ts
 function runCejelScan(options) {
   const identity = deriveProductIdentity(options.repoPath);
+  const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
   const report = scoreRepoWithPublicCejel({
     productSlug: identity.productSlug,
     productDisplayName: options.productDisplayName ?? identity.productDisplayName,
     repoPath: options.repoPath,
+    generatedAt,
     ingestPatterns: options.ingestPatterns,
+    // Local CLI/MCP scans retain the documented convenience default: their operator controls
+    // the repository. Direct public/leaderboard scans default this off because their targets
+    // are third-party repositories and must opt in explicitly.
+    autoDiscoverIngest: true,
     warnOnEmptyIngestMatch: options.warnOnEmptyIngestMatch
   });
   const summary = buildWitanCliSummary(report);
-  return { report, summary };
+  return { report, summary, generatedAt };
 }
 
 export {
-  __commonJS,
-  __export,
-  __toESM,
   ZodOptional,
   ZodFirstPartyTypeKind,
   objectType,