@cejel/cejel 0.4.4 → 0.4.5

package/README.md

@@ -79,7 +79,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.4.4 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.4.5 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM and an
@@ -102,7 +102,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.4.4` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.4.5` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry.
 
 `npx` can reuse a stale cached package. Force the current npm release with the `@latest`
@@ -119,6 +119,16 @@ name while keeping the repository-derived stable slug:
 npx @cejel/cejel@latest . --name "Customer Portal"
 ```
 
+From 0.4.5, use `--product-name` when two checkout directories must emit the
+same identity fields. The supplied value sets both the display name and its slugified stable ID:
+
+```bash
+npx @cejel/cejel@latest . --product-name "Customer Portal"
+```
+
+Product identity is caller context, not scored repository evidence, and is excluded from
+certificate byte-comparison claims.
+
 The npm package is scoped as `@cejel/cejel`; its executable remains the short command `cejel`.
 
 **GitHub Action** — score every PR and publish the badge:
@@ -151,16 +161,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.4.4`:
+**Docker / OCI.** The current container release is `0.4.5`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.4
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.5
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.4 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.5 .
 ```
 
 The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
@@ -253,9 +263,21 @@ prints that boundary on every successful verification.
 - `--min-score <n>` — exit non-zero if the overall score is below `n` (0–4), or if Cejel
   abstains and therefore cannot evaluate the threshold; used by the GitHub Action's optional
   threshold gate
+- `--product-name <name>` — Set both the caller-context
+  display name and slugified product ID so differently named checkouts can emit identical
+  certificates.
+- `--name <display>` — override only the displayed project name while leaving the derived slug
+  unchanged; retained for compatibility
 - `--ingest <file|glob>` — fold another scanner's output into the score (repeatable). Accepts
   SARIF, OpenSSF Scorecard JSON, or the generic Cejel external-signal shape — format is
   auto-detected. See "Aggregate your scanners" below.
+- `--rubric-pin <version>` — Explicit opt-in only: pin an alternate rubric instead of the
+  calibrated public default. It
+  accepts the calibrated version or any published prospective rubric
+  (`witan-rubric-v18-prospective-*` through `v22`) and fails closed, naming what was accepted, on
+  anything else. Omit this flag for the calibrated result every default scan produces — a
+  prospective pin carries no precision/recall claim, and the terminal certificate, HTML
+  certificate, and Markdown report all state that plainly whenever one is used.
 - `--quiet` — suppress the terminal certificate (files are still written)
 - `-h`, `--help` — print usage and exit successfully
 - `-v`, `--version` — print the version derived from the package manifest and exit successfully
@@ -463,7 +485,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.4"]}'
+npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.5"]}'
 npx -y openclaw@latest mcp doctor cejel-oci --probe
 ```
 

package/dist/calibration/llm-detector.js

@@ -5,7 +5,7 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-PJEKYFVM.js";
+} from "../chunk-4IXESHG7.js";
 import {
   listCejelLlmPackFiles
 } from "../chunk-RW6YJVHZ.js";

package/dist/{chunk-PJEKYFVM.js → chunk-4IXESHG7.js}

@@ -130,7 +130,16 @@ var WitanCriterionMetricSchema = external_exports.object({
   kind: external_exports.enum(["ratio", "saturating_count"]).optional(),
   weight: external_exports.number().positive().max(1).default(1),
   unit: external_exports.string().min(1).max(40).optional(),
-  description: external_exports.string().min(1).max(300).optional()
+  description: external_exports.string().min(1).max(300).optional(),
+  presentation: external_exports.object({
+    components: external_exports.array(
+      external_exports.object({
+        label: external_exports.string().min(1).max(120),
+        count: external_exports.number().int().nonnegative()
+      }).strict()
+    ).min(1).optional(),
+    condition: external_exports.string().min(1).max(240).optional()
+  }).strict().optional()
 }).strict();
 var WitanCriterionSignalSchema = external_exports.object({
   criterionId: WitanCriterionIdSchema,
@@ -367,6 +376,45 @@ var WitanAttestationStatementSchema = external_exports.object({
   }).strict()
 }).strict();
 
+// src/witan/rubric-version.ts
+init_esm_shims();
+var WITAN_RUBRIC_VERSION_V9 = "witan-rubric-v9-2026-07-22";
+var WITAN_RUBRIC_VERSION_V10 = "witan-rubric-v10-2026-07-23";
+var WITAN_RUBRIC_VERSION_V11 = "witan-rubric-v11-2026-07-23";
+var WITAN_RUBRIC_VERSION_V12 = "witan-rubric-v12-2026-07-23";
+var WITAN_RUBRIC_VERSION_V13 = "witan-rubric-v13-2026-07-23";
+var WITAN_RUBRIC_VERSION_V14 = "witan-rubric-v14-2026-07-23";
+var WITAN_RUBRIC_VERSION_V15 = "witan-rubric-v15-2026-07-24";
+var WITAN_RUBRIC_VERSION_V16 = "witan-rubric-v16-2026-07-24";
+var WITAN_RUBRIC_VERSION_V17 = "witan-rubric-v17-2026-07-24";
+var WITAN_RUBRIC_VERSION_V18 = "witan-rubric-v18-prospective-2026-07-25";
+var WITAN_RUBRIC_VERSION_V19 = "witan-rubric-v19-prospective-2026-08-09";
+var WITAN_RUBRIC_VERSION_V20 = "witan-rubric-v20-prospective-2026-08-10";
+var WITAN_RUBRIC_VERSION_V21 = "witan-rubric-v21-prospective-2026-08-10";
+var WITAN_RUBRIC_VERSION_V22 = "witan-rubric-v22-prospective-2026-08-10";
+var WITAN_LAST_CALIBRATED_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V17;
+var WITAN_PROSPECTIVE_RUBRIC_VERSIONS = Object.freeze([
+  WITAN_RUBRIC_VERSION_V18,
+  WITAN_RUBRIC_VERSION_V19,
+  WITAN_RUBRIC_VERSION_V20,
+  WITAN_RUBRIC_VERSION_V21,
+  WITAN_RUBRIC_VERSION_V22
+]);
+var WITAN_SELECTABLE_RUBRIC_VERSIONS = Object.freeze([
+  WITAN_LAST_CALIBRATED_RUBRIC_VERSION,
+  ...WITAN_PROSPECTIVE_RUBRIC_VERSIONS
+]);
+function assertSelectableRubricVersion(rubricVersion) {
+  if (WITAN_SELECTABLE_RUBRIC_VERSIONS.includes(rubricVersion)) return;
+  throw new Error(
+    `Cejel: unrecognized rubric version: "${rubricVersion}". Accepted values: ${WITAN_SELECTABLE_RUBRIC_VERSIONS.join(", ")}.`
+  );
+}
+function isProspectiveRubricVersion(rubricVersion) {
+  return WITAN_PROSPECTIVE_RUBRIC_VERSIONS.includes(rubricVersion);
+}
+var PROSPECTIVE_RUBRIC_NOTICE = "PROSPECTIVE / UNCALIBRATED RUBRIC \u2014 this rubric has not cleared a calibration gate. Scores, verdicts, and findings produced under it carry no precision/recall claim and are not comparable to a calibrated certificate.";
+
 // src/witan/html.ts
 init_esm_shims();
 
@@ -476,6 +524,45 @@ init_esm_shims();
 
 // src/witan/certificate-presentation.ts
 init_esm_shims();
+var CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE = "Product name and slug are caller context and are excluded from certificate byte-comparison claims.";
+var CERTIFICATE_METRIC_REGISTRY = {
+  test_to_source_ratio: { displayLabel: "Test-to-source file ratio" },
+  coverage_percent: { displayLabel: "Static coverage percentage" },
+  verification_script_ratio: { displayLabel: "Verification script ratio" },
+  non_hollow_test_share: { displayLabel: "Non-hollow test share" },
+  secret_cleanliness: { displayLabel: "Secret cleanliness" },
+  env_handling_depth: { displayLabel: "Environment handling depth" },
+  rls_policy_count: { displayLabel: "RLS policy count" },
+  tenant_scope_ratio: { displayLabel: "Tenant-scoped schema ratio" },
+  crypto_comparison_hygiene: { displayLabel: "Crypto comparison hygiene" },
+  prod_readiness_primitives: { displayLabel: "Production-readiness basic checks" },
+  prod_workflow_depth: {
+    displayLabel: "Production workflow depth (automated build/test/release pipeline)"
+  },
+  observability_depth: { displayLabel: "Observability depth" },
+  rollback_safety_depth: { displayLabel: "Rollback and migration-safety depth" },
+  dependency_automation_ratio: { displayLabel: "Dependency automation ratio" },
+  pinned_dependency_ratio: { displayLabel: "Pinned dependency ratio" },
+  lockfile_coverage: { displayLabel: "Lockfile coverage" },
+  declared_version_range_ratio: { displayLabel: "Declared version range ratio" },
+  dependency_count_sanity: { displayLabel: "Dependency count sanity" },
+  claim_match_rate: { displayLabel: "Implementation-to-claim-source file ratio" },
+  claim_source_depth: { displayLabel: "Claim source depth" },
+  reconciliation_artifact_depth: { displayLabel: "Reconciliation artifact depth" },
+  pr_trace_primitives: { displayLabel: "PR trace basic checks" },
+  pr_merge_ratio: { displayLabel: "Recent commits with recognizable PR references" },
+  ci_script_depth: { displayLabel: "CI verification depth" },
+  default_branch_ci_depth: {
+    displayLabel: "PR-gate CI workflow count (automated build/test pipeline)"
+  },
+  audit_artifact_depth: { displayLabel: "Audit artifact depth" },
+  audit_freshness_depth: { displayLabel: "Audit freshness depth" },
+  kill_switch_fail_safe_present: { displayLabel: "Un-overridable kill-switch present" },
+  human_gate_documented: { displayLabel: "Human gate documented" },
+  fail_closed_privilege_check: { displayLabel: "Fail-closed privilege check present" },
+  privilege_escalation_cleanliness: { displayLabel: "Privilege-escalation cleanliness" },
+  protected_path_review_gate: { displayLabel: "Protected-path review gate" }
+};
 var CERTIFICATE_GLOSSARY = [
   {
     key: "labels",
@@ -491,188 +578,194 @@ var CERTIFICATE_GLOSSARY = [
   },
   {
     key: "test-to-source-file-ratio",
-    term: "test-to-source file ratio",
+    term: "Test-to-source file ratio",
     definition: "The number of detected test files compared with detected source files. A larger implementation surface needs a correspondingly visible test surface.",
     metricNames: ["test_to_source_ratio"]
   },
   {
     key: "static-coverage",
-    term: "static coverage",
+    term: "Static coverage percentage",
     definition: "A percentage read from a coverage report or threshold that the repository itself publishes. Cejel does not run the repository's tests. The scoring rubric defines how much credit the published percentage receives.",
     metricNames: ["coverage_percent"]
   },
   {
     key: "verification-script",
-    term: "verification script",
-    definition: "the checks that run automatically: tests, linting, type-checking, build",
+    term: "Verification script ratio",
+    definition: "A capped scoring input that adds one for each detected test, coverage, lint, or type-check command and one for each detected test-runner configuration file. The raw count is capped at four for scoring. Build is not measured by this metric.",
     metricNames: ["verification_script_ratio"]
   },
   {
     key: "non-hollow",
-    term: "non-hollow",
+    term: "Non-hollow test share",
     definition: "test files that actually assert something rather than being empty or skipped",
     metricNames: ["non_hollow_test_share"]
   },
   {
     key: "secrets",
-    term: "secrets",
-    definition: "credentials like API keys and tokens",
+    term: "Secret cleanliness",
+    definition: "A binary result. Clean means the static repository-tree and reachable-history scan produced no critical secret finding. It is not a count of files containing secrets.",
     metricNames: ["secret_cleanliness"]
   },
   {
     key: "environment-handling-depth",
-    term: "environment handling depth",
-    definition: "The visible controls for keeping environment-specific configuration and credentials out of source. Unsafe configuration handling can expose production access.",
+    term: "Environment handling depth",
+    definition: "A count of three named practices: an environment template file, a .gitignore rule for environment files, and environment reads in implementation code in a supported language.",
     metricNames: ["env_handling_depth"]
   },
   {
     key: "rls-policy-count",
     term: "RLS policy count",
-    definition: "The number of detected database row-level security policies. Those policies can enforce which rows each tenant or user may reach.",
+    definition: "A selected-rubric static count of row-level-security markers. The calibrated detector counts CREATE POLICY, ENABLE ROW LEVEL SECURITY, and FORCE ROW LEVEL SECURITY matches. Prospective native-RLS detection counts repository-native CREATE POLICY definitions.",
     metricNames: ["rls_policy_count"]
   },
   {
     key: "tenant-scoped-schema-ratio",
-    term: "tenant-scoped schema ratio",
-    definition: "The share of relevant database tables with a visible tenant boundary. Missing tenant scope can allow one customer's data to mix with another's.",
+    term: "Tenant-scoped schema ratio",
+    definition: "The share of detected data-layer or migration files carrying the selected rubric's tenant-scope marker. Prospective native-RLS detection instead uses repository-native scoped storage files. It is a file-level static proxy, not a table-by-table proof.",
     metricNames: ["tenant_scope_ratio"]
   },
   {
     key: "crypto-comparison-hygiene",
-    term: "crypto comparison hygiene",
-    definition: "Comparisons of secret values that take the same time whether or not the values match. Attackers therefore cannot recover secrets by measuring response times.",
+    term: "Crypto comparison hygiene",
+    definition: "A conditional binary result shown only when production code exposes a signing, HMAC, or secret-comparison surface. Clean means no detected plain-equality secret comparison or non-canonical JSON signing pattern. Detected constant-time comparison and canonical serialization are positive evidence, but the metric does not require both when only one relevant surface exists.",
     metricNames: ["crypto_comparison_hygiene"]
   },
   {
-    key: "basic-checks",
-    term: "basic checks",
-    definition: "In code trust, production-readiness basic checks cover build or type-check commands, automated pipelines, deployment configuration, environment templates, health checks, and error boundaries. In process trust, PR trace basic checks cover automated pipelines, pull-request templates, and review-gate records. Missing checks leave part of the acceptance path unsupported.",
-    metricNames: ["prod_readiness_primitives", "pr_trace_primitives"]
+    key: "production-readiness-basic-checks",
+    term: "Production-readiness basic checks",
+    definition: "A count of six named checks: a build or type-check command, a CI workflow, deployment configuration, an environment template, a health or readiness signal, and an error boundary.",
+    metricNames: ["prod_readiness_primitives"]
+  },
+  {
+    key: "pr-trace-basic-checks",
+    term: "PR trace basic checks",
+    definition: "A capped scoring input that counts detected CI workflow files, a pull-request template, and a review-gate record such as CODEOWNERS or branch-protection documentation. The raw count is capped at two for scoring.",
+    metricNames: ["pr_trace_primitives"]
   },
   {
     key: "workflow-depth",
-    term: "workflow depth",
-    definition: "Workflows here are automated build, test, or release pipelines, such as GitHub Actions, not team policy. This measures how many relevant pipeline stages Cejel can see rather than how many workflow files exist. A deeper pipeline checks more of the path to a release.",
+    term: "Production workflow depth (automated build/test/release pipeline)",
+    definition: "The number of detected CI workflow files plus deployment-configuration files, capped at six for scoring. It counts files, not team policies or distinct pipeline stages.",
     metricNames: ["prod_workflow_depth"]
   },
   {
     key: "observability-depth",
-    term: "observability depth",
-    definition: "The visible health, logging, and error-reporting controls. Operators need evidence that failures can be detected and investigated.",
+    term: "Observability depth",
+    definition: "The number of implementation files containing a recognized logging, metrics, tracing, or error-reporting marker, capped at four for scoring.",
     metricNames: ["observability_depth"]
   },
   {
     key: "rollback-and-migration-safety-depth",
-    term: "rollback and migration-safety depth",
-    definition: "The visible procedures and checks for reversing a release or changing stored data safely. Recovery and data changes are high-risk parts of accepting software.",
+    term: "Rollback and migration-safety depth",
+    definition: "The number of files under recognized documentation, migration, or script paths containing a rollback, reversal, undo, or migration-safety marker, capped at four for scoring.",
     metricNames: ["rollback_safety_depth"]
   },
   {
     key: "dependency-automation-ratio",
-    term: "dependency automation ratio",
+    term: "Dependency automation ratio",
     definition: "The share of expected automated dependency-update and audit controls that are present. Stale or vulnerable packages otherwise depend on manual discovery.",
     metricNames: ["dependency_automation_ratio"]
   },
   {
     key: "pinned-dependency-ratio",
-    term: "pinned dependency ratio",
+    term: "Pinned dependency ratio",
     definition: "The share of application dependencies fixed to exact versions. Exact inputs make deployed builds more reproducible.",
     metricNames: ["pinned_dependency_ratio"]
   },
   {
     key: "lockfile-coverage",
-    term: "lockfile coverage",
-    definition: "Whether the package manifests are backed by committed lockfiles. Lockfiles record the exact dependency versions selected for a build.",
+    term: "Lockfile coverage",
+    definition: "A binary check for at least one detected lockfile in the scanned package or its covering monorepo root. It does not compare each manifest with a separate lockfile.",
     metricNames: ["lockfile_coverage"]
   },
   {
     key: "declared-version-range-ratio",
-    term: "declared version range ratio",
-    definition: "The share of library dependencies with an explicit compatible version range. Unconstrained dependencies can change without a deliberate source change.",
+    term: "Declared version range ratio",
+    definition: "For a library or CLI, the share of detected dependency specifications carrying any explicit constraint, including an exact version or a compatible range. Bare names, *, latest, and x do not count.",
     metricNames: ["declared_version_range_ratio"]
   },
   {
     key: "dependency-count-sanity",
-    term: "dependency count sanity",
-    definition: "A bounded check for an unusually long list of direct dependencies for a library. Every direct dependency adds maintenance and supply-chain exposure.",
+    term: "Dependency count sanity",
+    definition: "A low-weight library/CLI metric with full credit through 120 detected dependency specifications across manifests, then linearly declining to zero over the next 240.",
     metricNames: ["dependency_count_sanity"]
   },
   {
     key: "claim-match-rate",
-    term: "claim match rate",
-    definition: "The share of documented product claims that match visible repository evidence. An acceptance claim should be checkable against the delivered revision.",
+    term: "Implementation-to-claim-source file ratio",
+    definition: "A bounded file-count ratio: detected implementation-file count divided by that count plus detected headline claim-source document count. It does not verify whether individual prose claims are true.",
     metricNames: ["claim_match_rate"]
   },
   {
     key: "claim-source-depth",
-    term: "claim source depth",
-    definition: "How much concrete, checkable claim material is present. Vague or missing claims give a relying party nothing specific to verify.",
+    term: "Claim source depth",
+    definition: "The number of detected README or headline claim-source documents, capped at four for scoring. It measures visible document depth, not the truth or specificity of their prose.",
     metricNames: ["claim_source_depth"]
   },
   {
     key: "reconciliation-artifact-depth",
-    term: "reconciliation artifact depth",
-    definition: "The visible records connecting stated claims to evidence. A relying party needs to trace what was promised to what was inspected.",
+    term: "Reconciliation artifact depth",
+    definition: "The number of detected dedicated claim-reality reconciliation artifacts, capped at three for scoring.",
     metricNames: ["reconciliation_artifact_depth"]
   },
   {
     key: "recent-pr-merge-ratio",
-    term: "recent PR merge ratio",
-    definition: "The share of recent visible commits associated with merged pull requests. Review history helps a relying party inspect how changes reached the revision.",
+    term: "Recent commits with recognizable PR references",
+    definition: "Among up to 12 recent local commit subjects, the share containing \u201Cmerge pull request\u201D, \u201Cpull request\u201D, or a #number reference. A zero means no recognizable reference was found, not that Cejel detected a merge without a PR. When history is empty or unavailable, scoring conservatively uses a denominator of one.",
     metricNames: ["pr_merge_ratio"]
   },
   {
     key: "ci-verification-depth",
     term: "CI verification depth",
-    definition: "The number of test, lint, type-check, and build categories Cejel sees running in continuous integration. Automated gates make checks repeatable for each change.",
+    definition: "A capped scoring input that adds package-script and CI-command detections separately for test, lint, type-check, and build. The same category can therefore contribute once as a package script and once in CI. The raw count is capped at four for scoring.",
     metricNames: ["ci_script_depth"]
   },
   {
     key: "pr-gate-ci-workflow-count",
-    term: "PR-gate CI workflow count",
-    definition: "Workflows here are automated build and test pipelines, such as GitHub Actions, not team policy. This counts pipelines that visibly run on pull requests or the default branch. Checks that never gate changes cannot support the acceptance decision.",
+    term: "PR-gate CI workflow count (automated build/test pipeline)",
+    definition: "The number of detected CI workflow files configured for pull requests or the main or master branch, including a covering monorepo-root workflow, capped at four for scoring.",
     metricNames: ["default_branch_ci_depth"]
   },
   {
     key: "audit-artifact-depth",
-    term: "audit artifact depth",
-    definition: "How many durable audit records such as changelogs, incident notes, or security records are present. Past operational decisions should remain inspectable.",
+    term: "Audit artifact depth",
+    definition: "The number of files whose paths match recognized changelog, audit, incident, status, runbook, provenance, release-note, or security-policy forms, capped at three for scoring.",
     metricNames: ["audit_artifact_depth"]
   },
   {
     key: "audit-freshness-depth",
-    term: "audit freshness depth",
-    definition: "How recently the visible audit records were maintained. Stale records may not describe the revision being accepted.",
+    term: "Audit freshness depth",
+    definition: "The share of detected audit-artifact files containing recent, latest, or current, or the applicable reference year. The calibrated rubric uses the scan year. Prospective v19 uses the scanned HEAD committer year when available. This is a text-marker proxy, not a file-history age check.",
     metricNames: ["audit_freshness_depth"]
   },
   {
     key: "un-overridable-kill-switch",
-    term: "un-overridable kill-switch",
-    definition: "A stop control that ordinary automation cannot bypass. Operators need a dependable way to halt privileged behavior.",
+    term: "Un-overridable kill-switch present",
+    definition: "A positive-only binary check for a named governance or safety toggle whose falsy state immediately returns or throws before lower-priority configuration can proceed. The metric is omitted when no such pattern is detected.",
     metricNames: ["kill_switch_fail_safe_present"]
   },
   {
     key: "human-gate-documented",
-    term: "human gate documented",
-    definition: "A written requirement for a person to approve sensitive operations. High-impact actions should not rely only on unattended automation.",
+    term: "Human gate documented",
+    definition: "A binary check for documentation saying privileged or credentialed operations are human-executed or human-gated and never agent-run. It is scored only when a privileged-operation-shaped surface exists.",
     metricNames: ["human_gate_documented"]
   },
   {
     key: "fail-closed-privilege-check",
-    term: "fail-closed privilege check",
-    definition: "A permission check that refuses the operation when it cannot reach a confident allow decision. Errors must not silently grant elevated access.",
+    term: "Fail-closed privilege check present",
+    definition: "A binary check for implementation code that checks role membership and fails closed before setting or elevating a role. It is scored only when a privileged-operation-shaped surface exists.",
     metricNames: ["fail_closed_privilege_check"]
   },
   {
     key: "privilege-escalation-cleanliness",
-    term: "privilege-escalation cleanliness",
-    definition: "The absence of detected patterns that unsafely widen permissions. Unnecessary elevation increases the impact of a mistake or compromise.",
+    term: "Privilege-escalation cleanliness",
+    definition: "A binary result. Clean means the selected rubric detected no ungated production privilege-escalation pattern. The calibrated detector checks executed role-membership grants and SUPERUSER escalation. Prospective v21 also checks authored administrative SQL and direct database-driver literals for administrative role grants and schema-wide table grants. Tests and fixtures are excluded from the metric.",
     metricNames: ["privilege_escalation_cleanliness"]
   },
   {
     key: "protected-path-review-gate",
-    term: "protected-path review gate",
-    definition: "A rule requiring review before sensitive files or directories can change. Critical controls deserve an explicit second check.",
+    term: "Protected-path review gate",
+    definition: "A binary check for a CODEOWNERS file or documentation of required review or branch protection. This is the repository-visible proxy for human review of sensitive-path changes.",
     metricNames: ["protected_path_review_gate"]
   }
 ];
@@ -689,14 +782,8 @@ function glossaryEntryForMetric(metric2) {
     metricNames: [metric2.name]
   };
 }
-var CERTIFICATE_METRIC_LABELS = {
-  prod_readiness_primitives: "Production-readiness basic checks",
-  pr_trace_primitives: "PR trace basic checks",
-  prod_workflow_depth: "Production workflow depth (automated build/test/release pipeline)",
-  default_branch_ci_depth: "PR-gate CI workflow count (automated build/test pipeline)"
-};
 function formatCertificateMetricLabel(metric2) {
-  return CERTIFICATE_METRIC_LABELS[metric2.name] ?? metric2.label;
+  return CERTIFICATE_METRIC_REGISTRY[metric2.name]?.displayLabel ?? metric2.label;
 }
 function glossaryEntriesForReport(report) {
   const entries = new Map(CERTIFICATE_GLOSSARY.map((entry) => [entry.key, entry]));
@@ -718,6 +805,62 @@ function labelAlreadyStatesUnit(label, unit) {
   const escapedUnit = unit.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   return new RegExp(`(?:^|[\\s-])${escapedUnit}$`, "i").test(label.trim());
 }
+var BINARY_METRIC_COPY = {
+  secret_cleanliness: {
+    positive: "clean \u2014 no critical secret findings detected",
+    negative: "not clean \u2014 one or more critical secret findings detected"
+  },
+  crypto_comparison_hygiene: {
+    positive: "clean \u2014 no insecure comparison or serialization pattern detected",
+    negative: "not clean \u2014 an insecure comparison or serialization pattern was detected"
+  },
+  lockfile_coverage: {
+    positive: "present \u2014 at least one covering lockfile detected",
+    negative: "missing \u2014 no covering lockfile detected"
+  },
+  kill_switch_fail_safe_present: {
+    positive: "present \u2014 a fail-closed safety toggle was detected",
+    negative: "missing \u2014 no fail-closed safety toggle detected"
+  },
+  human_gate_documented: {
+    positive: "present \u2014 privileged operations are documented as human-executed or gated",
+    negative: "missing \u2014 no human-gate documentation detected"
+  },
+  fail_closed_privilege_check: {
+    positive: "present \u2014 role membership is checked fail-closed before elevation",
+    negative: "missing \u2014 no fail-closed pre-elevation role check detected"
+  },
+  privilege_escalation_cleanliness: {
+    positive: "clean \u2014 no ungated production privilege-escalation pattern detected",
+    negative: "not clean \u2014 an ungated production privilege-escalation pattern was detected"
+  },
+  protected_path_review_gate: {
+    positive: "present \u2014 CODEOWNERS or a documented required-review policy was detected",
+    negative: "missing \u2014 no CODEOWNERS or documented required-review policy detected"
+  }
+};
+var CONDITIONAL_METRIC_COPY = {
+  crypto_comparison_hygiene: "scored because a signing, HMAC, or secret-comparison surface was detected",
+  rls_policy_count: "scored because a multi-tenant data surface was detected",
+  tenant_scope_ratio: "scored because a multi-tenant data surface was detected",
+  human_gate_documented: "scored because a privileged-operation-shaped surface was detected",
+  fail_closed_privilege_check: "scored because a privileged-operation-shaped surface was detected",
+  kill_switch_fail_safe_present: "shown because a fail-closed kill switch was detected; this positive-only metric is omitted when absent"
+};
+function appendMetricCondition(metric2, value) {
+  const condition = metric2.presentation?.condition ?? CONDITIONAL_METRIC_COPY[metric2.name];
+  return condition ? `${value}; ${condition}` : value;
+}
+function formatEnumerableMetric(metric2) {
+  const components = metric2.presentation?.components;
+  if (!components || metric2.max === void 0) return null;
+  const present = components.filter((component) => component.count > 0).map(
+    (component) => component.count === 1 ? component.label : `${component.label} (${component.count} detected)`
+  );
+  const missing = components.filter((component) => component.count === 0).map((component) => component.label);
+  const value = metric2.kind === "saturating_count" && metric2.value > metric2.max ? `${formatMetricNumber(metric2.max)}/${formatMetricNumber(metric2.max)} (capped; ${formatMetricNumber(metric2.value)} raw)` : `${formatMetricNumber(metric2.value)}/${formatMetricNumber(metric2.max)}`;
+  return `${value} \u2014 present: ${present.length > 0 ? present.join(", ") : "none"}; missing: ${missing.length > 0 ? missing.join(", ") : "none"}`;
+}
 function formatCertificateMetricValue(criterion, metric2) {
   if (isCoverageNotMeasured(criterion, metric2)) {
     return "no coverage report found \u2014 not measured";
@@ -726,15 +869,36 @@ function formatCertificateMetricValue(criterion, metric2) {
     const tests = formatMetricNumber(metric2.value);
     const sources = formatMetricNumber(metric2.max);
     const comparison = `${tests} test file${metric2.value === 1 ? "" : "s"} / ${sources} source file${metric2.max === 1 ? "" : "s"}`;
-    return metric2.value > metric2.max ? `${comparison} (credit capped at parity)` : comparison;
+    return appendMetricCondition(
+      metric2,
+      metric2.value > metric2.max ? `${comparison} (credit capped at parity)` : comparison
+    );
+  }
+  const binaryCopy = BINARY_METRIC_COPY[metric2.name];
+  if (binaryCopy && metric2.max === 1 && (metric2.value === 0 || metric2.value === 1)) {
+    return appendMetricCondition(metric2, metric2.value === 1 ? binaryCopy.positive : binaryCopy.negative);
+  }
+  if (metric2.name === "pr_merge_ratio" && metric2.max !== void 0) {
+    const value = metric2.value === 0 ? `none found in bounded recent commit subjects (scoring value 0/${formatMetricNumber(metric2.max)})` : `${formatMetricNumber(metric2.value)} of ${formatMetricNumber(metric2.max)} recent commit subjects contain a recognizable PR reference`;
+    return appendMetricCondition(metric2, value);
   }
+  const enumerable = formatEnumerableMetric(metric2);
+  if (enumerable) return appendMetricCondition(metric2, enumerable);
   const displayUnit = metric2.name === "prod_readiness_primitives" || metric2.name === "pr_trace_primitives" ? "checks" : labelAlreadyStatesUnit(formatCertificateMetricLabel(metric2), metric2.unit) ? void 0 : metric2.unit;
   const unit = displayUnit ? ` ${displayUnit}` : "";
-  if (metric2.max === void 0) return `${formatMetricNumber(metric2.value)}${unit}`;
+  if (metric2.max === void 0) {
+    return appendMetricCondition(metric2, `${formatMetricNumber(metric2.value)}${unit}`);
+  }
   if (metric2.kind === "saturating_count" && metric2.value > metric2.max) {
-    return `${formatMetricNumber(metric2.max)}${unit} (capped; ${formatMetricNumber(metric2.value)} raw)`;
+    return appendMetricCondition(
+      metric2,
+      `${formatMetricNumber(metric2.max)}${unit} (capped; ${formatMetricNumber(metric2.value)} raw)`
+    );
   }
-  return `${formatMetricNumber(metric2.value)}/${formatMetricNumber(metric2.max)}${unit}`;
+  return appendMetricCondition(
+    metric2,
+    `${formatMetricNumber(metric2.value)}/${formatMetricNumber(metric2.max)}${unit}`
+  );
 }
 function buildRelyingPartySummary(report) {
   const applicable = report.criteria.filter((criterion) => criterion.status !== "not_applicable");
@@ -749,6 +913,13 @@ function buildRelyingPartySummary(report) {
       "No coverage report or configured threshold was found, so static coverage was not measured; Cejel does not run the subject's tests."
     );
   }
+  if (!report.repo.headSha && report.criteria.some(
+    (criterion) => criterion.metrics.some((metric2) => metric2.name === "pr_merge_ratio")
+  )) {
+    gaps.push(
+      "Git history was unavailable, so the recent-commit PR-reference proxy found no commit subjects to inspect; its conservative scoring zero is not a detected merge outcome."
+    );
+  }
   const unmeasured = applicable.filter((criterion) => criterion.status === "insufficient_data");
   if (unmeasured.length > 0) {
     gaps.push(`The report did not measure ${unmeasured.map((criterion) => criterion.id).join(", ")}.`);
@@ -788,7 +959,7 @@ var METRIC_DERIVED_FINDING_PATTERN = /^[A-Z]\d+ metric-derived score is (\d+\.\d
 var REMEDIATION_BY_METRIC = {
   test_to_source_ratio: "add concrete regression tests for the implementation surface",
   coverage_percent: "configure coverage and publish a measured threshold or report",
-  verification_script_ratio: "add explicit test, lint, and typecheck verification commands",
+  verification_script_ratio: "add the missing test, coverage, lint, or type-check command or a test-runner configuration",
   non_hollow_test_share: "replace skipped or placeholder tests with live assertions",
   env_handling_depth: "document and enforce safe environment-secret handling",
   secret_cleanliness: "remove committed secrets and rotate any exposed credentials",
@@ -806,7 +977,7 @@ var REMEDIATION_BY_METRIC = {
   claim_match_rate: "align documented product claims with observable repository evidence",
   claim_source_depth: "document concrete, checkable product claims",
   reconciliation_artifact_depth: "publish a claim-to-evidence reconciliation record",
-  pr_merge_ratio: "preserve merged pull-request history in the scanned clone",
+  pr_merge_ratio: "preserve recognizable pull-request references in recent commit subjects",
   pr_trace_primitives: "add pull-request templates and outcome-trace records",
   ci_script_depth: "run the repository verification commands in CI",
   default_branch_ci_depth: "run CI on the default branch and pull requests",
@@ -889,10 +1060,14 @@ function renderWitanHtmlReport(report, options = {}) {
           <p class="eyebrow">Trust Certificate</p>
           <h1>${escapeHtml(report.productDisplayName)}</h1>
           <dl class="meta">
+            <div><dt>Product identity</dt><dd>${escapeHtml(CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE)}</dd></div>
             ${options.generatedAt ? `<div><dt>Date</dt><dd>${escapeHtml(formatDate(options.generatedAt))}</dd></div>` : ""}
             <div><dt>Run</dt><dd>${escapeHtml(renderRepo(report))}</dd></div>
             <div><dt>CLI</dt><dd>${escapeHtml(options.cliVersion ? `Cejel ${options.cliVersion}` : "Not recorded")}</dd></div>
             <div><dt>Rubric</dt><dd>${escapeHtml(report.rubricVersion)}</dd></div>
+            ${// Gated on the rubric actually being prospective — a calibrated (v17) certificate's
+  // HTML stays byte-identical to before --rubric-pin existed.
+  isProspectiveRubricVersion(report.rubricVersion) ? `<div><dt>Calibration</dt><dd class="prospective-rubric-notice">${escapeHtml(PROSPECTIVE_RUBRIC_NOTICE)}</dd></div>` : ""}
             ${contributingSources.length > 0 ? `<div><dt>Sources</dt><dd>Incorporates findings from: ${escapeHtml(contributingSources.join(", "))}<ul class="source-counts">${externalSourceSummaries.map((s) => `<li>${escapeHtml(formatSourceProvenanceLine(s))}</li>`).join("")}</ul></dd></div>` : ""}
           </dl>
         </section>
@@ -1052,7 +1227,7 @@ function renderNotApplicableGroup(criteria) {
 }
 function renderNotApplicableItem(criterion) {
   const reason = criterion.notes ?? "Not applicable to this repository.";
-  return `<li><span class="na-id">${escapeHtml(criterion.id)}</span> ${escapeHtml(criterion.title)} \u2014 <span class="na-reason">${escapeHtml(reason)}</span></li>`;
+  return `<li><span class="na-id">${escapeHtml(criterion.id)}</span> ${escapeHtml(criterion.title)} \u2014 <span class="na-reason">${escapeHtml(reason)}</span><span class="na-reconciliation"><strong>Why no label comparison applies:</strong> this dimension is not applicable to this repository, so it has no weighted numeric score band to compare.</span></li>`;
 }
 function renderCriterionCard(criterion, gitHistoryUnavailable) {
   const evidence = [
@@ -1061,7 +1236,7 @@ function renderCriterionCard(criterion, gitHistoryUnavailable) {
   ];
   const metrics = criterion.metrics.map((metric2) => renderMetric(criterion, metric2));
   const statusReconciliation = renderStatusReconciliation(criterion);
-  const historyWarning = gitHistoryUnavailable && criterion.metrics.some((metric2) => metric2.name === "pr_merge_ratio") ? `<p class="scan-warning"><strong>Scan limitation:</strong> Git history was unavailable (for example, this may be a source tarball), so the recent PR merge ratio is not a measured repository outcome and its displayed zero may undercount ${escapeHtml(criterion.id)}. Re-scan a full Git clone for this signal.</p>` : "";
+  const historyWarning = gitHistoryUnavailable && criterion.metrics.some((metric2) => metric2.name === "pr_merge_ratio") ? `<p class="scan-warning"><strong>Scan limitation:</strong> Git history was unavailable (for example, this may be a source tarball), so the recent-commit PR-reference proxy found no commit subjects to inspect. Its conservative scoring zero is not a detected merge outcome and may undercount ${escapeHtml(criterion.id)}. Re-scan a full Git clone for this signal.</p>` : "";
   return `<article class="criterion">
             <div class="criterion-top">
               <div>
@@ -1082,11 +1257,22 @@ function renderCriterionCard(criterion, gitHistoryUnavailable) {
           </article>`;
 }
 function renderStatusReconciliation(criterion) {
-  if (criterion.status === "not_applicable" || criterion.status === "insufficient_data" || criterion.status === "unverified") {
-    return "";
+  if (criterion.status === "not_applicable") {
+    return '<p class="status-explanation"><strong>Why no label comparison applies:</strong> this dimension is not applicable to this repository, so it has no weighted numeric score band to compare.</p>';
+  }
+  if (criterion.status === "insufficient_data") {
+    return '<p class="status-explanation"><strong>Why no label comparison applies:</strong> this dimension has insufficient measurable data, so it has no weighted numeric score band to compare.</p>';
+  }
+  if (criterion.status === "unverified") {
+    return '<p class="status-explanation"><strong>Why no label comparison applies:</strong> the unverified dimension state is a fail-closed or legacy zero state, not a calibrated numeric band.</p>';
   }
   const numericBand = scoreBandForPresentation(criterion.score);
-  if (numericBand === criterion.status) return "";
+  if (numericBand === criterion.status) {
+    return `<p class="status-explanation"><strong>How the labels agree:</strong> the ${escapeHtml(criterion.status)} dimension band matches the ${formatScore(criterion.score)}/4.0 weighted score (the ${numericBand} numeric band).</p>`;
+  }
+  if (criterion.status !== "verified" && criterion.status !== "info" && criterion.status !== "warning" && criterion.status !== "critical") {
+    return `<p class="status-explanation"><strong>Why no label comparison applies:</strong> this report contains an unrecognized dimension state (${escapeHtml(String(criterion.status))}), so Cejel will not infer a comparison.</p>`;
+  }
   const entry = CERTIFICATE_GLOSSARY.find((candidate) => candidate.key === "labels");
   const help = entry ? `<span class="term-help" tabindex="0" aria-describedby="tooltip-${criterion.id}-labels"><strong>Why the labels differ:</strong><span class="term-tooltip" id="tooltip-${criterion.id}-labels" role="tooltip">${escapeHtml(entry.definition)}</span></span>` : "<strong>Why the labels differ:</strong>";
   return `<p class="status-explanation">${help} the ${escapeHtml(criterion.status)} dimension band is calibrated from criterion evidence thresholds and findings, independently of the ${formatScore(criterion.score)}/4.0 weighted score (which falls in the ${numericBand} numeric band).</p>`;
@@ -1103,7 +1289,7 @@ function renderMetric(criterion, metric2) {
   const formatted = formatCertificateMetricValue(criterion, metric2);
   const cappedEntry = formatted.includes("capped") ? CERTIFICATE_GLOSSARY.find((candidate) => candidate.key === "capped") : void 0;
   const label = `<span class="term-help" tabindex="0" aria-describedby="${escapeAttribute(tooltipId)}"><strong>${escapeHtml(formatCertificateMetricLabel(metric2))}</strong><span class="term-tooltip" id="${escapeAttribute(tooltipId)}" role="tooltip">${escapeHtml(entry.definition)}</span></span>`;
-  if (!cappedEntry) return `${label}<span>${escapeHtml(formatted)}</span>`;
+  if (!cappedEntry) return `${label}<span class="metric-value">${escapeHtml(formatted)}</span>`;
   const cappedTooltipId = `${tooltipId}-capped`;
   return `${label}<span class="term-help metric-value" tabindex="0" aria-describedby="${escapeAttribute(cappedTooltipId)}">${escapeHtml(formatted)}<span class="term-tooltip" id="${escapeAttribute(cappedTooltipId)}" role="tooltip">${escapeHtml(cappedEntry.definition)}</span></span>`;
 }
@@ -1274,6 +1460,8 @@ h2 { font-family: var(--serif); font-size: 30px; font-weight: 400; letter-spacin
 .na-list li { margin: 0; color: var(--muted); }
 .na-id { color: var(--faint); font-family: var(--mono); font-size: 11px; margin-right: 6px; }
 .na-reason { color: var(--muted); }
+.na-reconciliation { display: block; margin-top: 4px; color: var(--muted); }
+.na-reconciliation strong { color: var(--text); }
 .criterion { border: 1px solid var(--line); border-radius: 8px; padding: 16px; background: var(--surface-2); }
 .criterion-top { display: flex; justify-content: space-between; align-items: flex-start; gap: 14px; }
 .criterion-id { color: var(--periwinkle); font-family: var(--mono); font-size: 12px; margin-bottom: 4px; }
@@ -1288,7 +1476,10 @@ h3 { font-size: 15px; line-height: 1.35; font-weight: 600; margin-bottom: 0; }
 .criterion-metrics { display: grid; gap: 7px; margin-top: 10px; padding: 0; list-style: none; font-size: 12px; }
 .criterion-metrics li { display: flex; justify-content: space-between; gap: 12px; border-bottom: 1px solid rgba(238, 244, 247, .08); padding-bottom: 6px; }
 .criterion-metrics strong { color: var(--text); font-weight: 650; }
-.criterion-metrics span { white-space: nowrap; color: var(--muted); }
+.criterion-metrics span { color: var(--muted); }
+.criterion-metrics > li > .metric-value {
+  min-width: 0; white-space: normal; overflow-wrap: anywhere; text-align: right;
+}
 .term-help { position: relative; cursor: help; outline: none; }
 .term-help:focus-visible { box-shadow: 0 0 0 2px var(--periwinkle); border-radius: 3px; }
 .term-tooltip {
@@ -1527,41 +1718,6 @@ function verifyWitanAttestationBinding(statement, report, options = {}) {
   return { valid: errors.length === 0, errors };
 }
 
-// src/witan/rubric-version.ts
-init_esm_shims();
-var WITAN_RUBRIC_VERSION_V9 = "witan-rubric-v9-2026-07-22";
-var WITAN_RUBRIC_VERSION_V10 = "witan-rubric-v10-2026-07-23";
-var WITAN_RUBRIC_VERSION_V11 = "witan-rubric-v11-2026-07-23";
-var WITAN_RUBRIC_VERSION_V12 = "witan-rubric-v12-2026-07-23";
-var WITAN_RUBRIC_VERSION_V13 = "witan-rubric-v13-2026-07-23";
-var WITAN_RUBRIC_VERSION_V14 = "witan-rubric-v14-2026-07-23";
-var WITAN_RUBRIC_VERSION_V15 = "witan-rubric-v15-2026-07-24";
-var WITAN_RUBRIC_VERSION_V16 = "witan-rubric-v16-2026-07-24";
-var WITAN_RUBRIC_VERSION_V17 = "witan-rubric-v17-2026-07-24";
-var WITAN_RUBRIC_VERSION_V18 = "witan-rubric-v18-prospective-2026-07-25";
-var WITAN_RUBRIC_VERSION_V19 = "witan-rubric-v19-prospective-2026-08-09";
-var WITAN_RUBRIC_VERSION_V20 = "witan-rubric-v20-prospective-2026-08-10";
-var WITAN_RUBRIC_VERSION_V21 = "witan-rubric-v21-prospective-2026-08-10";
-var WITAN_RUBRIC_VERSION_V22 = "witan-rubric-v22-prospective-2026-08-10";
-var WITAN_LAST_CALIBRATED_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V17;
-var WITAN_PROSPECTIVE_RUBRIC_VERSIONS = Object.freeze([
-  WITAN_RUBRIC_VERSION_V18,
-  WITAN_RUBRIC_VERSION_V19,
-  WITAN_RUBRIC_VERSION_V20,
-  WITAN_RUBRIC_VERSION_V21,
-  WITAN_RUBRIC_VERSION_V22
-]);
-var WITAN_SELECTABLE_RUBRIC_VERSIONS = Object.freeze([
-  WITAN_LAST_CALIBRATED_RUBRIC_VERSION,
-  ...WITAN_PROSPECTIVE_RUBRIC_VERSIONS
-]);
-function assertSelectableRubricVersion(rubricVersion) {
-  if (WITAN_SELECTABLE_RUBRIC_VERSIONS.includes(rubricVersion)) return;
-  throw new Error(
-    `Cejel: unrecognized rubric version: "${rubricVersion}". Accepted values: ${WITAN_SELECTABLE_RUBRIC_VERSIONS.join(", ")}.`
-  );
-}
-
 // src/witan/index.ts
 init_esm_shims();
 
@@ -2548,8 +2704,26 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
         4,
         0.25,
         "ratio",
-        "Measures explicit test/lint/typecheck verification commands (via npm script or CI-invoked tool) plus test runner configuration.",
-        "saturating_count"
+        "Counts detected test, coverage, lint, and typecheck commands plus detected test-runner configuration files; raw credit is capped at four.",
+        "saturating_count",
+        {
+          components: [
+            {
+              label: "test command",
+              count: packageScripts.has("test") || Boolean(ciTestWorkflow) ? 1 : 0
+            },
+            { label: "coverage command", count: packageScripts.has("coverage") ? 1 : 0 },
+            {
+              label: "lint command",
+              count: packageScripts.has("lint") || ciHasLintCommand ? 1 : 0
+            },
+            {
+              label: "type-check command",
+              count: packageScripts.has("typecheck") || ciHasTypecheckCommand ? 1 : 0
+            },
+            { label: "test-runner configuration", count: runnerFiles.length }
+          ]
+        }
       ),
       metric(
         "non_hollow_test_share",
@@ -2612,8 +2786,17 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof) {
         4,
         0.25,
         "ratio",
-        "Measures explicit test/lint/typecheck verification commands plus test runner configuration.",
-        "saturating_count"
+        "Counts detected test, coverage, lint, and typecheck commands plus detected test-runner configuration files; raw credit is capped at four.",
+        "saturating_count",
+        {
+          components: [
+            { label: "test command", count: 0 },
+            { label: "coverage command", count: 0 },
+            { label: "lint command", count: 0 },
+            { label: "type-check command", count: 0 },
+            { label: "test-runner configuration", count: 0 }
+          ]
+        }
       ),
       metric(
         "non_hollow_test_share",
@@ -2855,7 +3038,22 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       3,
       isMultiTenant ? 0.1 : 0.3,
       "practices",
-      "Counts three bounded env-handling practices (0\u20133): template file, gitignore rule, env reads in any supported language."
+      "Counts three bounded env-handling practices (0\u20133): template file, gitignore rule, env reads in any supported language.",
+      void 0,
+      {
+        components: [
+          { label: "environment template file", count: envExamples.length > 0 ? 1 : 0 },
+          { label: ".gitignore environment-file rule", count: gitignoreEnvFile ? 1 : 0 },
+          {
+            label: "environment reads in implementation code",
+            count: countFilesContaining(
+              repoPath,
+              repoFiles.filter(isImplementationFile),
+              ENV_READ_PATTERN
+            ) > 0 ? 1 : 0
+          }
+        ]
+      }
     )
   ];
   const isolationMetrics = isMultiTenant ? [
@@ -2867,7 +3065,8 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       0.4,
       "policies",
       useV18NativeRls ? "Counts CREATE POLICY definitions with repository-native USING/WITH CHECK clauses against the repository-native scoped data-layer surface." : "Counts static row-level-security enables, forced-RLS statements, and policy definitions.",
-      "saturating_count"
+      "saturating_count",
+      { condition: "scored because a multi-tenant data surface was detected" }
     ),
     metric(
       "tenant_scope_ratio",
@@ -2876,7 +3075,9 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       Math.max(migrationFiles.length, 1),
       0.25,
       "ratio",
-      useV18NativeRls ? `Measures repository-native RLS scope identifiers (${nativeRlsInventory?.scopeIdentifiers.join(", ")}) across data-layer files.` : "Measures tenant/studio/workspace scoping evidence across data-layer files."
+      useV18NativeRls ? `Measures repository-native RLS scope identifiers (${nativeRlsInventory?.scopeIdentifiers.join(", ")}) across data-layer files.` : "Measures tenant/studio/workspace scoping evidence across data-layer files.",
+      void 0,
+      { condition: "scored because a multi-tenant data surface was detected" }
     )
   ] : [];
   const cryptoMetrics = cryptoHygiene.hasSurface ? [
@@ -2887,7 +3088,11 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       1,
       0.2,
       "clean",
-      "Credits constant-time secret/HMAC comparison and canonical serialization before signing when a signing/HMAC surface is detected in source; only scored when such a surface exists."
+      "Credits constant-time secret/HMAC comparison and canonical serialization before signing when a signing/HMAC surface is detected in source; only scored when such a surface exists.",
+      void 0,
+      {
+        condition: "scored because a signing, HMAC, or secret-comparison surface was detected"
+      }
     )
   ] : [];
   return {
@@ -3181,7 +3386,21 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
         6,
         0.55,
         "checks",
-        "Counts distinct static production-readiness checks instead of treating presence as enough."
+        "Counts distinct static production-readiness checks instead of treating presence as enough.",
+        void 0,
+        {
+          components: [
+            {
+              label: "build or type-check command",
+              count: packageJson && (scripts.has("build") || scripts.has("typecheck")) ? 1 : 0
+            },
+            { label: "CI workflow", count: workflows.length > 0 ? 1 : 0 },
+            { label: "deployment configuration", count: deployConfigs.length > 0 ? 1 : 0 },
+            { label: "environment template", count: envTemplate ? 1 : 0 },
+            { label: "health or readiness signal", count: healthChecks.length > 0 ? 1 : 0 },
+            { label: "error boundary", count: errorBoundaries.length > 0 ? 1 : 0 }
+          ]
+        }
       ),
       metric(
         "prod_workflow_depth",
@@ -3294,7 +3513,14 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors,
     2,
     0.25,
     "ratio",
-    "Credits automated dependency updates and package-manager audit hooks."
+    "Credits automated dependency updates and package-manager audit hooks.",
+    void 0,
+    {
+      components: [
+        { label: "automated dependency-update configuration", count: hasUpdateConfig ? 1 : 0 },
+        { label: "package-manager audit hook", count: auditConfig ? 1 : 0 }
+      ]
+    }
   );
   const appMetrics = [
     metric(
@@ -3528,7 +3754,14 @@ function collectB2PrTraceEvidence(repoPath, repoFiles) {
         0.8,
         "signals",
         "Measures CI, PR template, and review-gate evidence for pull-request traceability.",
-        "saturating_count"
+        "saturating_count",
+        {
+          components: [
+            { label: "CI workflow", count: workflows.length },
+            { label: "pull-request template", count: prTemplate ? 1 : 0 },
+            { label: "review-gate record", count: branchProtectionDoc ? 1 : 0 }
+          ]
+        }
       ),
       // Weight lowered from 0.35 (Phase 3 H1): squash-merge and local-history repos with
       // no "Merge pull request"/"#123" commit-subject convention legitimately score 0/N
@@ -3591,8 +3824,24 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
         4,
         0.45,
         "signals",
-        "Counts npm verification scripts plus distinct test/lint/typecheck/build command categories detected anywhere in CI workflows; language-agnostic, counted by category not by file.",
-        "saturating_count"
+        "Counts test/lint/typecheck/build package scripts plus those command categories in repository CI and, when applicable, monorepo-root CI; raw credit is capped at four.",
+        "saturating_count",
+        {
+          components: [
+            ...["test", "lint", "typecheck", "build"].map((name) => ({
+              label: `package script: ${name === "typecheck" ? "type-check" : name}`,
+              count: scripts.has(name) ? 1 : 0
+            })),
+            ...CI_COMMAND_CATEGORIES.map((pattern, index) => ({
+              label: `repository CI command: ${["test", "lint", "type-check", "build"][index]}`,
+              count: workflows.some((file) => fileContains(repoPath, file, pattern)) ? 1 : 0
+            })),
+            ...mono ? CI_COMMAND_CATEGORIES.map((pattern, index) => ({
+              label: `monorepo-root CI command: ${["test", "lint", "type-check", "build"][index]}`,
+              count: rootWorkflows.some((file) => fileContains(mono.root, file, pattern)) ? 1 : 0
+            })) : []
+          ]
+        }
       ),
       metric(
         "default_branch_ci_depth",
@@ -3795,7 +4044,11 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detecto
       1,
       0.15,
       "present",
-      "Credits a governance/safety toggle that fails closed before any lower-priority config can override it."
+      "Credits a governance/safety toggle that fails closed before any lower-priority config can override it.",
+      void 0,
+      {
+        condition: "shown because a fail-closed kill switch was detected; this positive-only metric is omitted when absent"
+      }
     )
   ] : [];
   const hasPrivilegedOpsSurface = humanGateDoc != null || gatedPrivilegeCheckFile != null || executableFiles.length > 0 || v21ExecutedEscalationFiles.length > 0;
@@ -3812,7 +4065,11 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detecto
           1,
           0.4,
           "present",
-          "Credits explicit documentation that privileged/credentialed operations are human-executed, never agent-run."
+          "Credits explicit documentation that privileged/credentialed operations are human-executed, never agent-run.",
+          void 0,
+          {
+            condition: "scored because a privileged-operation-shaped surface was detected"
+          }
         ),
         metric(
           "fail_closed_privilege_check",
@@ -3821,7 +4078,11 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detecto
           1,
           0.3,
           "present",
-          "Credits code that checks role membership and fails closed before elevating privilege, instead of attempting elevation blind."
+          "Credits code that checks role membership and fails closed before elevating privilege, instead of attempting elevation blind.",
+          void 0,
+          {
+            condition: "scored because a privileged-operation-shaped surface was detected"
+          }
         )
       ] : [],
       metric(
@@ -6152,16 +6413,29 @@ function evidenceForRelativeAtLine(repoPath, path, kind, label, line) {
     ...contents ? { contentHash: createHash2("sha256").update(contents).digest("hex") } : {}
   };
 }
-function metric(name, label, value, max, weight, unit, description, kind) {
+function metric(name, label, value, max, weight, unit, description, kind, presentation) {
+  const normalizedValue = Math.max(0, value);
+  if (presentation?.components) {
+    const explainedValue = presentation.components.reduce(
+      (sum, component) => sum + component.count,
+      0
+    );
+    if (explainedValue !== normalizedValue) {
+      throw new Error(
+        `Cejel invariant: presentation components for ${name} total ${explainedValue}, expected ${normalizedValue}`
+      );
+    }
+  }
   return {
     name,
     label,
-    value: Math.max(0, value),
+    value: normalizedValue,
     max,
     ...kind ? { kind } : {},
     weight,
     unit,
-    description
+    description,
+    ...presentation ? { presentation } : {}
   };
 }
 function firstMeaningfulLine(contents) {
@@ -7340,9 +7614,9 @@ import { basename as basename2, join as join3 } from "path";
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/;
 var FALLBACK_SLUG = "repo";
 var FALLBACK_DISPLAY_NAME = "Repository";
-function deriveProductIdentity(repoPath) {
+function deriveProductIdentity(repoPath, productName) {
   const packageJsonPath = join3(repoPath, "package.json");
-  const raw = readPackageName(packageJsonPath) ?? basename2(repoPath);
+  const raw = productName ?? readPackageName(packageJsonPath) ?? basename2(repoPath);
   const displayName = raw.trim().length > 0 ? raw.trim() : FALLBACK_DISPLAY_NAME;
   return {
     productSlug: slugify(raw),
@@ -7381,7 +7655,7 @@ var METRIC_DERIVED_FINDING_PATTERN2 = /^[A-Z]\d+ metric-derived score is (\d+\.\
 var REMEDIATION_BY_METRIC2 = {
   test_to_source_ratio: "add concrete regression tests for the implementation surface",
   coverage_percent: "configure coverage and publish a measured threshold or report",
-  verification_script_ratio: "add explicit test, lint, and typecheck verification commands",
+  verification_script_ratio: "add the missing test, coverage, lint, or type-check command or a test-runner configuration",
   non_hollow_test_share: "replace skipped or placeholder tests with live assertions",
   env_handling_depth: "document and enforce safe environment-secret handling",
   secret_cleanliness: "remove committed secrets and rotate any exposed credentials",
@@ -7399,7 +7673,7 @@ var REMEDIATION_BY_METRIC2 = {
   claim_match_rate: "align documented product claims with observable repository evidence",
   claim_source_depth: "document concrete, checkable product claims",
   reconciliation_artifact_depth: "publish a claim-to-evidence reconciliation record",
-  pr_merge_ratio: "preserve merged pull-request history in the scanned clone",
+  pr_merge_ratio: "preserve recognizable pull-request references in recent commit subjects",
   pr_trace_primitives: "add pull-request templates and outcome-trace records",
   ci_script_depth: "run the repository verification commands in CI",
   default_branch_ci_depth: "run CI on the default branch and pull requests",
@@ -7509,7 +7783,7 @@ function buildWitanCliSummary(report) {
 
 // src/scan.ts
 function runCejelScan(options) {
-  const identity = deriveProductIdentity(options.repoPath);
+  const identity = deriveProductIdentity(options.repoPath, options.productName);
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
   const report = scoreRepoWithPublicCejel({
     productSlug: identity.productSlug,
@@ -7531,17 +7805,21 @@ function runCejelScan(options) {
 export {
   WitanReportSchema,
   formatExternalSourceLine,
+  CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE,
   CERTIFICATE_GLOSSARY,
   formatCertificateMetricLabel,
   formatCertificateMetricValue,
   buildRelyingPartySummary,
+  WITAN_RUBRIC_VERSION_V22,
+  assertSelectableRubricVersion,
+  isProspectiveRubricVersion,
+  PROSPECTIVE_RUBRIC_NOTICE,
   renderWitanHtmlReport,
   renderWitanBadgeEndpoint,
   renderWitanBadgeSvg,
   serializeWitanReport,
   createWitanAttestation,
   verifyWitanAttestationBinding,
-  WITAN_RUBRIC_VERSION_V22,
   deriveProductIdentity,
   runCejelScan
 };

package/dist/index.js

@@ -2,21 +2,25 @@
 import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
+  CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE,
   CERTIFICATE_GLOSSARY,
+  PROSPECTIVE_RUBRIC_NOTICE,
   WITAN_RUBRIC_VERSION_V22,
   WitanReportSchema,
+  assertSelectableRubricVersion,
   buildRelyingPartySummary,
   createWitanAttestation,
   formatCertificateMetricLabel,
   formatCertificateMetricValue,
   formatExternalSourceLine,
+  isProspectiveRubricVersion,
   renderWitanBadgeEndpoint,
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan,
   serializeWitanReport,
   verifyWitanAttestationBinding
-} from "./chunk-PJEKYFVM.js";
+} from "./chunk-4IXESHG7.js";
 import "./chunk-EPK7UTIK.js";
 import "./chunk-KGFGX3TP.js";
 import {
@@ -65,10 +69,11 @@ function renderTerminalCertificate(summary, report) {
     `  Process trust: ${formatScore(summary.processTrustScore)}/4.0`,
     ""
   ];
+  lines.splice(1, 0, `Product identity: ${CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE}`);
   if (report) {
     const relyingPartySummary = buildRelyingPartySummary(report);
     lines.splice(
-      2,
+      3,
       0,
       `What was examined: ${relyingPartySummary.examined}`,
       `What was established: ${relyingPartySummary.established}`,
@@ -155,6 +160,9 @@ function renderTerminalCertificate(summary, report) {
   for (const entry of CERTIFICATE_GLOSSARY) {
     lines.push(`  ${entry.term} \u2014 ${entry.definition}`);
   }
+  if (report && isProspectiveRubricVersion(report.rubricVersion)) {
+    lines.unshift(`Rubric: ${report.rubricVersion}`, PROSPECTIVE_RUBRIC_NOTICE, "");
+  }
   return `${lines.join("\n")}
 `;
 }
@@ -178,10 +186,16 @@ var CLI_FLAG_SPECS = [
     description: "exit nonzero below this overall score",
     kind: "minScore"
   },
+  {
+    tokens: ["--product-name"],
+    value: "<name>",
+    description: "set caller-context slug and display name for reproducible certificates",
+    kind: "productName"
+  },
   {
     tokens: ["--name"],
     value: "<display>",
-    description: "override the project name shown on the certificate",
+    description: "override only the displayed project name (legacy compatibility)",
     kind: "name"
   },
   {
@@ -190,6 +204,12 @@ var CLI_FLAG_SPECS = [
     description: "fold in a SARIF/JSON scanner report (repeatable)",
     kind: "ingest"
   },
+  {
+    tokens: ["--rubric-pin"],
+    value: "<version>",
+    description: "EXPLICIT OPT-IN: pin a rubric other than the calibrated default (see docs); prospective rubrics carry no calibration claim",
+    kind: "rubricPin"
+  },
   {
     tokens: ["--quiet"],
     description: "suppress the terminal summary",
@@ -287,10 +307,12 @@ async function runWitanCli(args, rubricVersion) {
     process.stdout.write(USAGE);
     return 0;
   }
+  const effectiveRubricVersion = options.rubricPin ?? rubricVersion;
   const { report, summary, generatedAt } = runCejelScan({
     repoPath: options.repoPath,
+    ...options.productName ? { productName: options.productName } : {},
     ...options.productDisplayName ? { productDisplayName: options.productDisplayName } : {},
-    ...rubricVersion ? { rubricVersion } : {},
+    ...effectiveRubricVersion ? { rubricVersion: effectiveRubricVersion } : {},
     ingestPatterns: options.ingestPatterns,
     warnOnEmptyIngestMatch: !options.quiet
   });
@@ -425,10 +447,12 @@ function parseArgs(args) {
   let repoPath;
   let outDir = DEFAULT_OUT_DIR;
   let minScore;
+  let productName;
   let productDisplayName;
   let quiet = false;
   let showHelp = false;
   let showVersion = false;
+  let rubricPin;
   const ingestPatterns = [];
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
@@ -479,6 +503,19 @@ function parseArgs(args) {
           index += 1;
           break;
         }
+        case "productName": {
+          const value = args[index + 1];
+          if (!value) throw new Error("Missing value for --product-name");
+          const trimmed = value.trim();
+          if (trimmed.length === 0 || trimmed.length > 120 || hasUnsafeDisplayNameCharacter(trimmed)) {
+            throw new Error(
+              "--product-name must be a single printable line containing between 1 and 120 characters"
+            );
+          }
+          productName = trimmed;
+          index += 1;
+          break;
+        }
         case "ingest": {
           const value = args[index + 1];
           if (!value) throw new Error("Missing value for --ingest");
@@ -486,6 +523,14 @@ function parseArgs(args) {
           index += 1;
           break;
         }
+        case "rubricPin": {
+          const value = args[index + 1];
+          if (!value) throw new Error("Missing value for --rubric-pin");
+          assertSelectableRubricVersion(value);
+          rubricPin = value;
+          index += 1;
+          break;
+        }
       }
       continue;
     }
@@ -495,15 +540,20 @@ function parseArgs(args) {
       throw new Error(`Unexpected positional argument: ${arg}`);
     }
   }
+  if (productName && productDisplayName) {
+    throw new Error("--product-name and --name cannot be used together");
+  }
   return {
     repoPath: resolve(repoPath ?? "."),
     outDir,
     ...minScore != null ? { minScore } : {},
+    ...productName ? { productName } : {},
     ...productDisplayName ? { productDisplayName } : {},
     quiet,
     showHelp,
     showVersion,
-    ingestPatterns
+    ingestPatterns,
+    ...rubricPin ? { rubricPin } : {}
   };
 }
 function hasUnsafeDisplayNameCharacter(value) {

package/dist/mcp/index.js

@@ -5,7 +5,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "../chunk-PJEKYFVM.js";
+} from "../chunk-4IXESHG7.js";
 import "../chunk-EPK7UTIK.js";
 import {
   ZodFirstPartyTypeKind,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {