@cejel/cejel 0.4.4 → 0.4.6

package/README.md

@@ -79,7 +79,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.4.4 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.4.6 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM and an
@@ -102,7 +102,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.4.4` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.4.6` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry.
 
 `npx` can reuse a stale cached package. Force the current npm release with the `@latest`
@@ -119,6 +119,16 @@ name while keeping the repository-derived stable slug:
 npx @cejel/cejel@latest . --name "Customer Portal"
 ```
 
+From 0.4.5, use `--product-name` when two checkout directories must emit the
+same identity fields. The supplied value sets both the display name and its slugified stable ID:
+
+```bash
+npx @cejel/cejel@latest . --product-name "Customer Portal"
+```
+
+Product identity is caller context, not scored repository evidence, and is excluded from
+certificate byte-comparison claims.
+
 The npm package is scoped as `@cejel/cejel`; its executable remains the short command `cejel`.
 
 **GitHub Action** — score every PR and publish the badge:
@@ -129,6 +139,9 @@ The npm package is scoped as `@cejel/cejel`; its executable remains the short co
     min-score: "2.5"   # optional: fail the build below this
 ```
 
+For an executed public example that binds a release artifact to the same commit named by its
+Cejel certificate, see [Certified releases with GitHub build provenance](./docs/certified-release-example.md).
+
 **From source** — it is AGPL and it runs offline, so reading it is rather the point:
 
 ```bash
@@ -151,16 +164,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.4.4`:
+**Docker / OCI.** The current container release is `0.4.6`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.4
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.6
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.4 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.6 .
 ```
 
 The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
@@ -253,9 +266,21 @@ prints that boundary on every successful verification.
 - `--min-score <n>` — exit non-zero if the overall score is below `n` (0–4), or if Cejel
   abstains and therefore cannot evaluate the threshold; used by the GitHub Action's optional
   threshold gate
+- `--product-name <name>` — Set both the caller-context
+  display name and slugified product ID so differently named checkouts can emit identical
+  certificates.
+- `--name <display>` — override only the displayed project name while leaving the derived slug
+  unchanged; retained for compatibility
 - `--ingest <file|glob>` — fold another scanner's output into the score (repeatable). Accepts
   SARIF, OpenSSF Scorecard JSON, or the generic Cejel external-signal shape — format is
   auto-detected. See "Aggregate your scanners" below.
+- `--rubric-pin <version>` — Explicit opt-in only: pin an alternate rubric instead of the
+  calibrated public default. It
+  accepts the calibrated version or any published prospective rubric
+  (`witan-rubric-v18-prospective-*` through `v22`) and fails closed, naming what was accepted, on
+  anything else. Omit this flag for the calibrated result every default scan produces — a
+  prospective pin carries no precision/recall claim, and the terminal certificate, HTML
+  certificate, and Markdown report all state that plainly whenever one is used.
 - `--quiet` — suppress the terminal certificate (files are still written)
 - `-h`, `--help` — print usage and exit successfully
 - `-v`, `--version` — print the version derived from the package manifest and exit successfully
@@ -326,6 +351,7 @@ Three ways a scanner's output gets ingested:
 
    ```json
    {
+     "version": "1.0",
      "tool": "my-scanner",
      "signals": [
        {
@@ -348,6 +374,12 @@ Three ways a scanner's output gets ingested:
    (0–1, default `0.5`) bounds how much this signal can move that dimension; `severity` is
    `critical` | `warning` | `info`; `location` is optional.
 
+   The version field is required. Cejel rejects unversioned generic documents and unknown major
+   versions rather than guessing. See the [generic ingest contract](docs/ingest-contract.md), its
+   [published JSON Schema](docs/schemas/cejel-ingest-v1.schema.json), and the
+   [synthetic CI heal-log mapping](docs/heal-log-mapping.md). Output-field stability and version
+   routing are documented in [format stability](docs/format-stability.md).
+
 ## Displaying the trust badge
 
 Endpoint JSON (host `badge.json` anywhere static — a repo file, a gist, GitHub Pages — and
@@ -463,7 +495,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.4"]}'
+npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.6"]}'
 npx -y openclaw@latest mcp doctor cejel-oci --probe
 ```
 

package/dist/calibration/llm-detector.js

@@ -5,20 +5,20 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-PJEKYFVM.js";
+} from "../chunk-VEJLHO5F.js";
 import {
   listCejelLlmPackFiles
-} from "../chunk-RW6YJVHZ.js";
-import "../chunk-EPK7UTIK.js";
+} from "../chunk-QRWLHTGR.js";
+import "../chunk-BZXBLDCJ.js";
 import {
   external_exports
-} from "../chunk-KGFGX3TP.js";
+} from "../chunk-Y6NO5HAI.js";
 import {
   init_esm_shims,
   readRepoText,
   recordContentSkip,
   recordFilesystemSkip
-} from "../chunk-R4DPQLS2.js";
+} from "../chunk-H55KECVT.js";
 
 // src/calibration/llm-detector.ts
 init_esm_shims();

package/dist/{chunk-EW6NAHE4.js → chunk-2IBG5OBF.js}

@@ -7,7 +7,7 @@ import {
   __filename,
   __require,
   init_esm_shims
-} from "./chunk-R4DPQLS2.js";
+} from "./chunk-H55KECVT.js";
 
 // node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/typescript.js
 var require_typescript = __commonJS({

package/dist/{chunk-EPK7UTIK.js → chunk-BZXBLDCJ.js}

@@ -3,7 +3,7 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-R4DPQLS2.js";
+} from "./chunk-H55KECVT.js";
 
 // src/witan/git-exec.ts
 init_esm_shims();

package/dist/{chunk-R4DPQLS2.js → chunk-H55KECVT.js}

@@ -54,6 +54,10 @@ var init_esm_shims = __esm({
   }
 });
 
+// src/filesystem-limits.ts
+init_esm_shims();
+var MAX_REPOSITORY_CONTENT_BYTES = 512e3;
+
 // src/witan/content-reads.ts
 init_esm_shims();
 import { closeSync, lstatSync, openSync, readFileSync, readSync } from "fs";
@@ -145,6 +149,13 @@ function withContentReadCriterion(criterion, collect) {
 function recordContentSkip(path2, reason, deduplicate = false) {
   recordSkip(path2, reason, void 0, false, deduplicate);
 }
+function recordContentSkipForCriteria(path2, reason, criteria, deduplicate = false) {
+  const session = activeSession;
+  if (session) {
+    for (const criterion of criteria) session.affectedCriteria.add(criterion);
+  }
+  recordSkip(path2, reason, void 0, false, deduplicate);
+}
 function recordFilesystemSkip(path2, error, deniedContext = false, deduplicate = true) {
   const errno = errnoClass(error);
   if (!errno) throw error;
@@ -161,6 +172,10 @@ function readRepoText(path2, encoding = "utf8") {
       recordSkip(path2, "non_regular_file", void 0, true, true);
       return "";
     }
+    if (stat.size > MAX_REPOSITORY_CONTENT_BYTES) {
+      recordSkip(path2, "too_large", void 0, true, true);
+      return "";
+    }
   } catch (error) {
     recordFilesystemSkip(path2, error);
     return "";
@@ -211,9 +226,11 @@ export {
   __dirname,
   __filename,
   init_esm_shims,
+  MAX_REPOSITORY_CONTENT_BYTES,
   trackContentReads,
   withContentReadCriterion,
   recordContentSkip,
+  recordContentSkipForCriteria,
   recordFilesystemSkip,
   readRepoText,
   readRepoTextPrefix

package/dist/{chunk-RW6YJVHZ.js → chunk-QRWLHTGR.js}

@@ -5,10 +5,10 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-EPK7UTIK.js";
+} from "./chunk-BZXBLDCJ.js";
 import {
   init_esm_shims
-} from "./chunk-R4DPQLS2.js";
+} from "./chunk-H55KECVT.js";
 
 // src/packs/llm/files.ts
 init_esm_shims();