@cejel/cejel 0.4.4 → 0.4.6

package/dist/{chunk-PJEKYFVM.js → chunk-VEJLHO5F.js}

@@ -5,19 +5,21 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-EPK7UTIK.js";
+} from "./chunk-BZXBLDCJ.js";
 import {
   external_exports
-} from "./chunk-KGFGX3TP.js";
+} from "./chunk-Y6NO5HAI.js";
 import {
+  MAX_REPOSITORY_CONTENT_BYTES,
   init_esm_shims,
   readRepoText,
   readRepoTextPrefix,
   recordContentSkip,
+  recordContentSkipForCriteria,
   recordFilesystemSkip,
   trackContentReads,
   withContentReadCriterion
-} from "./chunk-R4DPQLS2.js";
+} from "./chunk-H55KECVT.js";
 
 // src/witan/schemas.ts
 init_esm_shims();
@@ -117,10 +119,26 @@ var WitanEvidencePointerSchema = external_exports.object({
 }).strict().refine((value) => Boolean(value.url ?? value.path ?? value.contentHash), {
   message: "Witan evidence must include a path, url, or content hash."
 });
+var WitanInventoryScanDerivationSchema = external_exports.object({
+  kind: external_exports.literal("inventory-scan"),
+  inventoryScope: external_exports.enum(["tracked-scan-eligible", "tracked-complete"]),
+  inventoryCount: external_exports.number().int().nonnegative(),
+  patternSetId: external_exports.string().min(1).max(180),
+  patternCount: external_exports.number().int().positive(),
+  matchCount: external_exports.number().int().nonnegative()
+}).strict();
+var WitanFindingDerivationSchema = external_exports.discriminatedUnion("kind", [
+  WitanInventoryScanDerivationSchema
+]);
 var WitanFindingSchema = external_exports.object({
   severity: WitanFindingSeveritySchema,
   summary: external_exports.string().min(1).max(500),
-  evidence: WitanEvidencePointerSchema
+  evidence: WitanEvidencePointerSchema,
+  // Absence findings emitted by the native repository detector must name the exact
+  // inventory and versioned pattern set whose zero result supports the proposition.
+  // This remains optional at the shared schema boundary because positive findings and
+  // semantic derivations are separate contracts; native absence emitters require it.
+  derivation: WitanFindingDerivationSchema.optional()
 }).strict();
 var WitanCriterionMetricSchema = external_exports.object({
   name: external_exports.string().min(1).max(80),
@@ -130,7 +148,16 @@ var WitanCriterionMetricSchema = external_exports.object({
   kind: external_exports.enum(["ratio", "saturating_count"]).optional(),
   weight: external_exports.number().positive().max(1).default(1),
   unit: external_exports.string().min(1).max(40).optional(),
-  description: external_exports.string().min(1).max(300).optional()
+  description: external_exports.string().min(1).max(300).optional(),
+  presentation: external_exports.object({
+    components: external_exports.array(
+      external_exports.object({
+        label: external_exports.string().min(1).max(120),
+        count: external_exports.number().int().nonnegative()
+      }).strict()
+    ).min(1).optional(),
+    condition: external_exports.string().min(1).max(240).optional()
+  }).strict().optional()
 }).strict();
 var WitanCriterionSignalSchema = external_exports.object({
   criterionId: WitanCriterionIdSchema,
@@ -312,6 +339,7 @@ var WitanReportSchema = external_exports.preprocess((value) => {
 }, StrictWitanReportSchema);
 var WITAN_ATTESTATION_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
 var WITAN_ATTESTATION_PREDICATE_TYPE = "https://cejel.dev/attestations/scan/v1";
+var WITAN_REPORT_FORMAT_VERSION = "1.0";
 var WitanAttestationOutcomeSchema = external_exports.discriminatedUnion("status", [
   external_exports.object({
     status: external_exports.literal("scored"),
@@ -341,6 +369,10 @@ var WitanAttestationStatementSchema = external_exports.object({
       version: external_exports.string().min(1).max(80)
     }).strict(),
     generatedAt: external_exports.string().datetime({ offset: true }),
+    // Optional on read for attestations emitted before Evidence Seam v1. New attestations
+    // always carry it, keeping report.json byte-stable while giving paired consumers an
+    // explicit report contract version.
+    reportFormatVersion: external_exports.string().regex(/^1\.\d+$/).optional(),
     rubricVersion: external_exports.string().min(1).max(120),
     repository: external_exports.object({
       productSlug: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/),
@@ -367,13 +399,54 @@ var WitanAttestationStatementSchema = external_exports.object({
   }).strict()
 }).strict();
 
+// src/witan/rubric-version.ts
+init_esm_shims();
+var WITAN_RUBRIC_VERSION_V9 = "witan-rubric-v9-2026-07-22";
+var WITAN_RUBRIC_VERSION_V10 = "witan-rubric-v10-2026-07-23";
+var WITAN_RUBRIC_VERSION_V11 = "witan-rubric-v11-2026-07-23";
+var WITAN_RUBRIC_VERSION_V12 = "witan-rubric-v12-2026-07-23";
+var WITAN_RUBRIC_VERSION_V13 = "witan-rubric-v13-2026-07-23";
+var WITAN_RUBRIC_VERSION_V14 = "witan-rubric-v14-2026-07-23";
+var WITAN_RUBRIC_VERSION_V15 = "witan-rubric-v15-2026-07-24";
+var WITAN_RUBRIC_VERSION_V16 = "witan-rubric-v16-2026-07-24";
+var WITAN_RUBRIC_VERSION_V17 = "witan-rubric-v17-2026-07-24";
+var WITAN_RUBRIC_VERSION_V18 = "witan-rubric-v18-prospective-2026-07-25";
+var WITAN_RUBRIC_VERSION_V19 = "witan-rubric-v19-prospective-2026-08-09";
+var WITAN_RUBRIC_VERSION_V20 = "witan-rubric-v20-prospective-2026-08-10";
+var WITAN_RUBRIC_VERSION_V21 = "witan-rubric-v21-prospective-2026-08-10";
+var WITAN_RUBRIC_VERSION_V22 = "witan-rubric-v22-prospective-2026-08-10";
+var WITAN_LAST_CALIBRATED_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V17;
+var WITAN_PROSPECTIVE_RUBRIC_VERSIONS = Object.freeze([
+  WITAN_RUBRIC_VERSION_V18,
+  WITAN_RUBRIC_VERSION_V19,
+  WITAN_RUBRIC_VERSION_V20,
+  WITAN_RUBRIC_VERSION_V21,
+  WITAN_RUBRIC_VERSION_V22
+]);
+var WITAN_SELECTABLE_RUBRIC_VERSIONS = Object.freeze([
+  WITAN_LAST_CALIBRATED_RUBRIC_VERSION,
+  ...WITAN_PROSPECTIVE_RUBRIC_VERSIONS
+]);
+function assertSelectableRubricVersion(rubricVersion) {
+  if (WITAN_SELECTABLE_RUBRIC_VERSIONS.includes(rubricVersion)) return;
+  throw new Error(
+    `Cejel: unrecognized rubric version: "${rubricVersion}". Accepted values: ${WITAN_SELECTABLE_RUBRIC_VERSIONS.join(", ")}.`
+  );
+}
+function isProspectiveRubricVersion(rubricVersion) {
+  return WITAN_PROSPECTIVE_RUBRIC_VERSIONS.includes(rubricVersion);
+}
+var PROSPECTIVE_RUBRIC_NOTICE = "PROSPECTIVE / UNCALIBRATED RUBRIC \u2014 this rubric has not cleared a calibration gate. Scores, verdicts, and findings produced under it carry no precision/recall claim and are not comparable to a calibrated certificate.";
+
 // src/witan/html.ts
 init_esm_shims();
 
 // src/witan/abstention.ts
 init_esm_shims();
 var WITAN_NO_MEASUREMENT_REASON = "No free-core rubric criterion produced a measurable signal. Cejel abstains rather than publish a numeric zero for an entirely unmeasured repository.";
-var WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the complete tracked inventory contains no concrete test file, configured test runner, CI test command, or coverage configuration.";
+var WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the tracked scan-eligible inventory matched no concrete test file, configured test runner, CI test command, or coverage configuration.";
+var WITAN_DIRECTORY_WALK_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the bounded directory walk matched no concrete test file, configured test runner, CI test command, or coverage configuration.";
+var WITAN_LEGACY_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the complete tracked inventory contains no concrete test file, configured test runner, CI test command, or coverage configuration.";
 function isWitanNoMeasurementAbstention(report) {
   return report.verdict === "insufficient_source" && report.insufficientSourceReason.startsWith(WITAN_NO_MEASUREMENT_REASON) && report.criteria.every(
     ({ status }) => status === "not_applicable" || status === "insufficient_data"
@@ -476,6 +549,45 @@ init_esm_shims();
 
 // src/witan/certificate-presentation.ts
 init_esm_shims();
+var CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE = "Product name and slug are caller context and are excluded from certificate byte-comparison claims.";
+var CERTIFICATE_METRIC_REGISTRY = {
+  test_to_source_ratio: { displayLabel: "Test-to-source file ratio" },
+  coverage_percent: { displayLabel: "Static coverage percentage" },
+  verification_script_ratio: { displayLabel: "Verification script ratio" },
+  non_hollow_test_share: { displayLabel: "Non-hollow test share" },
+  secret_cleanliness: { displayLabel: "Secret cleanliness" },
+  env_handling_depth: { displayLabel: "Environment handling depth" },
+  rls_policy_count: { displayLabel: "RLS policy count" },
+  tenant_scope_ratio: { displayLabel: "Tenant-scoped schema ratio" },
+  crypto_comparison_hygiene: { displayLabel: "Crypto comparison hygiene" },
+  prod_readiness_primitives: { displayLabel: "Production-readiness basic checks" },
+  prod_workflow_depth: {
+    displayLabel: "Production workflow depth (automated build/test/release pipeline)"
+  },
+  observability_depth: { displayLabel: "Observability depth" },
+  rollback_safety_depth: { displayLabel: "Rollback and migration-safety depth" },
+  dependency_automation_ratio: { displayLabel: "Dependency automation ratio" },
+  pinned_dependency_ratio: { displayLabel: "Pinned dependency ratio" },
+  lockfile_coverage: { displayLabel: "Lockfile coverage" },
+  declared_version_range_ratio: { displayLabel: "Declared version range ratio" },
+  dependency_count_sanity: { displayLabel: "Dependency count sanity" },
+  claim_match_rate: { displayLabel: "Implementation-to-claim-source file ratio" },
+  claim_source_depth: { displayLabel: "Claim source depth" },
+  reconciliation_artifact_depth: { displayLabel: "Reconciliation artifact depth" },
+  pr_trace_primitives: { displayLabel: "PR trace basic checks" },
+  pr_merge_ratio: { displayLabel: "Recent commits with recognizable PR references" },
+  ci_script_depth: { displayLabel: "CI verification depth" },
+  default_branch_ci_depth: {
+    displayLabel: "PR-gate CI workflow count (automated build/test pipeline)"
+  },
+  audit_artifact_depth: { displayLabel: "Audit artifact depth" },
+  audit_freshness_depth: { displayLabel: "Audit freshness depth" },
+  kill_switch_fail_safe_present: { displayLabel: "Un-overridable kill-switch present" },
+  human_gate_documented: { displayLabel: "Human gate documented" },
+  fail_closed_privilege_check: { displayLabel: "Fail-closed privilege check present" },
+  privilege_escalation_cleanliness: { displayLabel: "Privilege-escalation cleanliness" },
+  protected_path_review_gate: { displayLabel: "Protected-path review gate" }
+};
 var CERTIFICATE_GLOSSARY = [
   {
     key: "labels",
@@ -491,188 +603,194 @@ var CERTIFICATE_GLOSSARY = [
   },
   {
     key: "test-to-source-file-ratio",
-    term: "test-to-source file ratio",
+    term: "Test-to-source file ratio",
     definition: "The number of detected test files compared with detected source files. A larger implementation surface needs a correspondingly visible test surface.",
     metricNames: ["test_to_source_ratio"]
   },
   {
     key: "static-coverage",
-    term: "static coverage",
+    term: "Static coverage percentage",
     definition: "A percentage read from a coverage report or threshold that the repository itself publishes. Cejel does not run the repository's tests. The scoring rubric defines how much credit the published percentage receives.",
     metricNames: ["coverage_percent"]
   },
   {
     key: "verification-script",
-    term: "verification script",
-    definition: "the checks that run automatically: tests, linting, type-checking, build",
+    term: "Verification script ratio",
+    definition: "A capped scoring input that adds one for each detected test, coverage, lint, or type-check command and one for each detected test-runner configuration file. The raw count is capped at four for scoring. Build is not measured by this metric.",
     metricNames: ["verification_script_ratio"]
   },
   {
     key: "non-hollow",
-    term: "non-hollow",
+    term: "Non-hollow test share",
     definition: "test files that actually assert something rather than being empty or skipped",
     metricNames: ["non_hollow_test_share"]
   },
   {
     key: "secrets",
-    term: "secrets",
-    definition: "credentials like API keys and tokens",
+    term: "Secret cleanliness",
+    definition: "A binary result. Clean means the static repository-tree and reachable-history scan produced no critical secret finding. It is not a count of files containing secrets.",
     metricNames: ["secret_cleanliness"]
   },
   {
     key: "environment-handling-depth",
-    term: "environment handling depth",
-    definition: "The visible controls for keeping environment-specific configuration and credentials out of source. Unsafe configuration handling can expose production access.",
+    term: "Environment handling depth",
+    definition: "A count of three named practices: an environment template file, a .gitignore rule for environment files, and environment reads in implementation code in a supported language.",
     metricNames: ["env_handling_depth"]
   },
   {
     key: "rls-policy-count",
     term: "RLS policy count",
-    definition: "The number of detected database row-level security policies. Those policies can enforce which rows each tenant or user may reach.",
+    definition: "A selected-rubric static count of row-level-security markers. The calibrated detector counts CREATE POLICY, ENABLE ROW LEVEL SECURITY, and FORCE ROW LEVEL SECURITY matches. Prospective native-RLS detection counts repository-native CREATE POLICY definitions.",
     metricNames: ["rls_policy_count"]
   },
   {
     key: "tenant-scoped-schema-ratio",
-    term: "tenant-scoped schema ratio",
-    definition: "The share of relevant database tables with a visible tenant boundary. Missing tenant scope can allow one customer's data to mix with another's.",
+    term: "Tenant-scoped schema ratio",
+    definition: "The share of detected data-layer or migration files carrying the selected rubric's tenant-scope marker. Prospective native-RLS detection instead uses repository-native scoped storage files. It is a file-level static proxy, not a table-by-table proof.",
     metricNames: ["tenant_scope_ratio"]
   },
   {
     key: "crypto-comparison-hygiene",
-    term: "crypto comparison hygiene",
-    definition: "Comparisons of secret values that take the same time whether or not the values match. Attackers therefore cannot recover secrets by measuring response times.",
+    term: "Crypto comparison hygiene",
+    definition: "A conditional binary result shown only when production code exposes a signing, HMAC, or secret-comparison surface. Clean means no detected plain-equality secret comparison or non-canonical JSON signing pattern. Detected constant-time comparison and canonical serialization are positive evidence, but the metric does not require both when only one relevant surface exists.",
     metricNames: ["crypto_comparison_hygiene"]
   },
   {
-    key: "basic-checks",
-    term: "basic checks",
-    definition: "In code trust, production-readiness basic checks cover build or type-check commands, automated pipelines, deployment configuration, environment templates, health checks, and error boundaries. In process trust, PR trace basic checks cover automated pipelines, pull-request templates, and review-gate records. Missing checks leave part of the acceptance path unsupported.",
-    metricNames: ["prod_readiness_primitives", "pr_trace_primitives"]
+    key: "production-readiness-basic-checks",
+    term: "Production-readiness basic checks",
+    definition: "A count of six named checks: a build or type-check command, a CI workflow, deployment configuration, an environment template, a health or readiness signal, and an error boundary.",
+    metricNames: ["prod_readiness_primitives"]
+  },
+  {
+    key: "pr-trace-basic-checks",
+    term: "PR trace basic checks",
+    definition: "A capped scoring input that counts detected CI workflow files, a pull-request template, and a review-gate record such as CODEOWNERS or branch-protection documentation. The raw count is capped at two for scoring.",
+    metricNames: ["pr_trace_primitives"]
   },
   {
     key: "workflow-depth",
-    term: "workflow depth",
-    definition: "Workflows here are automated build, test, or release pipelines, such as GitHub Actions, not team policy. This measures how many relevant pipeline stages Cejel can see rather than how many workflow files exist. A deeper pipeline checks more of the path to a release.",
+    term: "Production workflow depth (automated build/test/release pipeline)",
+    definition: "The number of detected CI workflow files plus deployment-configuration files, capped at six for scoring. It counts files, not team policies or distinct pipeline stages.",
     metricNames: ["prod_workflow_depth"]
   },
   {
     key: "observability-depth",
-    term: "observability depth",
-    definition: "The visible health, logging, and error-reporting controls. Operators need evidence that failures can be detected and investigated.",
+    term: "Observability depth",
+    definition: "The number of implementation files containing a recognized logging, metrics, tracing, or error-reporting marker, capped at four for scoring.",
     metricNames: ["observability_depth"]
   },
   {
     key: "rollback-and-migration-safety-depth",
-    term: "rollback and migration-safety depth",
-    definition: "The visible procedures and checks for reversing a release or changing stored data safely. Recovery and data changes are high-risk parts of accepting software.",
+    term: "Rollback and migration-safety depth",
+    definition: "The number of files under recognized documentation, migration, or script paths containing a rollback, reversal, undo, or migration-safety marker, capped at four for scoring.",
     metricNames: ["rollback_safety_depth"]
   },
   {
     key: "dependency-automation-ratio",
-    term: "dependency automation ratio",
+    term: "Dependency automation ratio",
     definition: "The share of expected automated dependency-update and audit controls that are present. Stale or vulnerable packages otherwise depend on manual discovery.",
     metricNames: ["dependency_automation_ratio"]
   },
   {
     key: "pinned-dependency-ratio",
-    term: "pinned dependency ratio",
+    term: "Pinned dependency ratio",
     definition: "The share of application dependencies fixed to exact versions. Exact inputs make deployed builds more reproducible.",
     metricNames: ["pinned_dependency_ratio"]
   },
   {
     key: "lockfile-coverage",
-    term: "lockfile coverage",
-    definition: "Whether the package manifests are backed by committed lockfiles. Lockfiles record the exact dependency versions selected for a build.",
+    term: "Lockfile coverage",
+    definition: "A binary check for at least one detected lockfile in the scanned package or its covering monorepo root. It does not compare each manifest with a separate lockfile.",
     metricNames: ["lockfile_coverage"]
   },
   {
     key: "declared-version-range-ratio",
-    term: "declared version range ratio",
-    definition: "The share of library dependencies with an explicit compatible version range. Unconstrained dependencies can change without a deliberate source change.",
+    term: "Declared version range ratio",
+    definition: "For a library or CLI, the share of detected dependency specifications carrying any explicit constraint, including an exact version or a compatible range. Bare names, *, latest, and x do not count.",
     metricNames: ["declared_version_range_ratio"]
   },
   {
     key: "dependency-count-sanity",
-    term: "dependency count sanity",
-    definition: "A bounded check for an unusually long list of direct dependencies for a library. Every direct dependency adds maintenance and supply-chain exposure.",
+    term: "Dependency count sanity",
+    definition: "A low-weight library/CLI metric with full credit through 120 detected dependency specifications across manifests, then linearly declining to zero over the next 240.",
     metricNames: ["dependency_count_sanity"]
   },
   {
     key: "claim-match-rate",
-    term: "claim match rate",
-    definition: "The share of documented product claims that match visible repository evidence. An acceptance claim should be checkable against the delivered revision.",
+    term: "Implementation-to-claim-source file ratio",
+    definition: "A bounded file-count ratio: detected implementation-file count divided by that count plus detected headline claim-source document count. It does not verify whether individual prose claims are true.",
     metricNames: ["claim_match_rate"]
   },
   {
     key: "claim-source-depth",
-    term: "claim source depth",
-    definition: "How much concrete, checkable claim material is present. Vague or missing claims give a relying party nothing specific to verify.",
+    term: "Claim source depth",
+    definition: "The number of detected README or headline claim-source documents, capped at four for scoring. It measures visible document depth, not the truth or specificity of their prose.",
     metricNames: ["claim_source_depth"]
   },
   {
     key: "reconciliation-artifact-depth",
-    term: "reconciliation artifact depth",
-    definition: "The visible records connecting stated claims to evidence. A relying party needs to trace what was promised to what was inspected.",
+    term: "Reconciliation artifact depth",
+    definition: "The number of detected dedicated claim-reality reconciliation artifacts, capped at three for scoring.",
     metricNames: ["reconciliation_artifact_depth"]
   },
   {
     key: "recent-pr-merge-ratio",
-    term: "recent PR merge ratio",
-    definition: "The share of recent visible commits associated with merged pull requests. Review history helps a relying party inspect how changes reached the revision.",
+    term: "Recent commits with recognizable PR references",
+    definition: "Among up to 12 recent local commit subjects, the share containing \u201Cmerge pull request\u201D, \u201Cpull request\u201D, or a #number reference. A zero means no recognizable reference was found, not that Cejel detected a merge without a PR. When history is empty or unavailable, scoring conservatively uses a denominator of one.",
     metricNames: ["pr_merge_ratio"]
   },
   {
     key: "ci-verification-depth",
     term: "CI verification depth",
-    definition: "The number of test, lint, type-check, and build categories Cejel sees running in continuous integration. Automated gates make checks repeatable for each change.",
+    definition: "A capped scoring input that adds package-script and CI-command detections separately for test, lint, type-check, and build. The same category can therefore contribute once as a package script and once in CI. The raw count is capped at four for scoring.",
     metricNames: ["ci_script_depth"]
   },
   {
     key: "pr-gate-ci-workflow-count",
-    term: "PR-gate CI workflow count",
-    definition: "Workflows here are automated build and test pipelines, such as GitHub Actions, not team policy. This counts pipelines that visibly run on pull requests or the default branch. Checks that never gate changes cannot support the acceptance decision.",
+    term: "PR-gate CI workflow count (automated build/test pipeline)",
+    definition: "The number of detected CI workflow files configured for pull requests or the main or master branch, including a covering monorepo-root workflow, capped at four for scoring.",
     metricNames: ["default_branch_ci_depth"]
   },
   {
     key: "audit-artifact-depth",
-    term: "audit artifact depth",
-    definition: "How many durable audit records such as changelogs, incident notes, or security records are present. Past operational decisions should remain inspectable.",
+    term: "Audit artifact depth",
+    definition: "The number of files whose paths match recognized changelog, audit, incident, status, runbook, provenance, release-note, or security-policy forms, capped at three for scoring.",
     metricNames: ["audit_artifact_depth"]
   },
   {
     key: "audit-freshness-depth",
-    term: "audit freshness depth",
-    definition: "How recently the visible audit records were maintained. Stale records may not describe the revision being accepted.",
+    term: "Audit freshness depth",
+    definition: "The share of detected audit-artifact files containing recent, latest, or current, or the applicable reference year. The calibrated rubric uses the scan year. Prospective v19 uses the scanned HEAD committer year when available. This is a text-marker proxy, not a file-history age check.",
     metricNames: ["audit_freshness_depth"]
   },
   {
     key: "un-overridable-kill-switch",
-    term: "un-overridable kill-switch",
-    definition: "A stop control that ordinary automation cannot bypass. Operators need a dependable way to halt privileged behavior.",
+    term: "Un-overridable kill-switch present",
+    definition: "A positive-only binary check for a named governance or safety toggle whose falsy state immediately returns or throws before lower-priority configuration can proceed. The metric is omitted when no such pattern is detected.",
     metricNames: ["kill_switch_fail_safe_present"]
   },
   {
     key: "human-gate-documented",
-    term: "human gate documented",
-    definition: "A written requirement for a person to approve sensitive operations. High-impact actions should not rely only on unattended automation.",
+    term: "Human gate documented",
+    definition: "A binary check for documentation saying privileged or credentialed operations are human-executed or human-gated and never agent-run. It is scored only when a privileged-operation-shaped surface exists.",
     metricNames: ["human_gate_documented"]
   },
   {
     key: "fail-closed-privilege-check",
-    term: "fail-closed privilege check",
-    definition: "A permission check that refuses the operation when it cannot reach a confident allow decision. Errors must not silently grant elevated access.",
+    term: "Fail-closed privilege check present",
+    definition: "A binary check for implementation code that checks role membership and fails closed before setting or elevating a role. It is scored only when a privileged-operation-shaped surface exists.",
     metricNames: ["fail_closed_privilege_check"]
   },
   {
     key: "privilege-escalation-cleanliness",
-    term: "privilege-escalation cleanliness",
-    definition: "The absence of detected patterns that unsafely widen permissions. Unnecessary elevation increases the impact of a mistake or compromise.",
+    term: "Privilege-escalation cleanliness",
+    definition: "A binary result. Clean means the selected rubric detected no ungated production privilege-escalation pattern. The calibrated detector checks executed role-membership grants and SUPERUSER escalation. Prospective v21 also checks authored administrative SQL and direct database-driver literals for administrative role grants and schema-wide table grants. Tests and fixtures are excluded from the metric.",
     metricNames: ["privilege_escalation_cleanliness"]
   },
   {
     key: "protected-path-review-gate",
-    term: "protected-path review gate",
-    definition: "A rule requiring review before sensitive files or directories can change. Critical controls deserve an explicit second check.",
+    term: "Protected-path review gate",
+    definition: "A binary check for a CODEOWNERS file or documentation of required review or branch protection. This is the repository-visible proxy for human review of sensitive-path changes.",
     metricNames: ["protected_path_review_gate"]
   }
 ];
@@ -689,14 +807,8 @@ function glossaryEntryForMetric(metric2) {
     metricNames: [metric2.name]
   };
 }
-var CERTIFICATE_METRIC_LABELS = {
-  prod_readiness_primitives: "Production-readiness basic checks",
-  pr_trace_primitives: "PR trace basic checks",
-  prod_workflow_depth: "Production workflow depth (automated build/test/release pipeline)",
-  default_branch_ci_depth: "PR-gate CI workflow count (automated build/test pipeline)"
-};
 function formatCertificateMetricLabel(metric2) {
-  return CERTIFICATE_METRIC_LABELS[metric2.name] ?? metric2.label;
+  return CERTIFICATE_METRIC_REGISTRY[metric2.name]?.displayLabel ?? metric2.label;
 }
 function glossaryEntriesForReport(report) {
   const entries = new Map(CERTIFICATE_GLOSSARY.map((entry) => [entry.key, entry]));
@@ -718,6 +830,62 @@ function labelAlreadyStatesUnit(label, unit) {
   const escapedUnit = unit.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   return new RegExp(`(?:^|[\\s-])${escapedUnit}$`, "i").test(label.trim());
 }
+var BINARY_METRIC_COPY = {
+  secret_cleanliness: {
+    positive: "clean \u2014 no critical secret findings detected",
+    negative: "not clean \u2014 one or more critical secret findings detected"
+  },
+  crypto_comparison_hygiene: {
+    positive: "clean \u2014 no insecure comparison or serialization pattern detected",
+    negative: "not clean \u2014 an insecure comparison or serialization pattern was detected"
+  },
+  lockfile_coverage: {
+    positive: "present \u2014 at least one covering lockfile detected",
+    negative: "missing \u2014 no covering lockfile detected"
+  },
+  kill_switch_fail_safe_present: {
+    positive: "present \u2014 a fail-closed safety toggle was detected",
+    negative: "missing \u2014 no fail-closed safety toggle detected"
+  },
+  human_gate_documented: {
+    positive: "present \u2014 privileged operations are documented as human-executed or gated",
+    negative: "missing \u2014 no human-gate documentation detected"
+  },
+  fail_closed_privilege_check: {
+    positive: "present \u2014 role membership is checked fail-closed before elevation",
+    negative: "missing \u2014 no fail-closed pre-elevation role check detected"
+  },
+  privilege_escalation_cleanliness: {
+    positive: "clean \u2014 no ungated production privilege-escalation pattern detected",
+    negative: "not clean \u2014 an ungated production privilege-escalation pattern was detected"
+  },
+  protected_path_review_gate: {
+    positive: "present \u2014 CODEOWNERS or a documented required-review policy was detected",
+    negative: "missing \u2014 no CODEOWNERS or documented required-review policy detected"
+  }
+};
+var CONDITIONAL_METRIC_COPY = {
+  crypto_comparison_hygiene: "scored because a signing, HMAC, or secret-comparison surface was detected",
+  rls_policy_count: "scored because a multi-tenant data surface was detected",
+  tenant_scope_ratio: "scored because a multi-tenant data surface was detected",
+  human_gate_documented: "scored because a privileged-operation-shaped surface was detected",
+  fail_closed_privilege_check: "scored because a privileged-operation-shaped surface was detected",
+  kill_switch_fail_safe_present: "shown because a fail-closed kill switch was detected; this positive-only metric is omitted when absent"
+};
+function appendMetricCondition(metric2, value) {
+  const condition = metric2.presentation?.condition ?? CONDITIONAL_METRIC_COPY[metric2.name];
+  return condition ? `${value}; ${condition}` : value;
+}
+function formatEnumerableMetric(metric2) {
+  const components = metric2.presentation?.components;
+  if (!components || metric2.max === void 0) return null;
+  const present = components.filter((component) => component.count > 0).map(
+    (component) => component.count === 1 ? component.label : `${component.label} (${component.count} detected)`
+  );
+  const missing = components.filter((component) => component.count === 0).map((component) => component.label);
+  const value = metric2.kind === "saturating_count" && metric2.value > metric2.max ? `${formatMetricNumber(metric2.max)}/${formatMetricNumber(metric2.max)} (capped; ${formatMetricNumber(metric2.value)} raw)` : `${formatMetricNumber(metric2.value)}/${formatMetricNumber(metric2.max)}`;
+  return `${value} \u2014 present: ${present.length > 0 ? present.join(", ") : "none"}; missing: ${missing.length > 0 ? missing.join(", ") : "none"}`;
+}
 function formatCertificateMetricValue(criterion, metric2) {
   if (isCoverageNotMeasured(criterion, metric2)) {
     return "no coverage report found \u2014 not measured";
@@ -726,15 +894,36 @@ function formatCertificateMetricValue(criterion, metric2) {
     const tests = formatMetricNumber(metric2.value);
     const sources = formatMetricNumber(metric2.max);
     const comparison = `${tests} test file${metric2.value === 1 ? "" : "s"} / ${sources} source file${metric2.max === 1 ? "" : "s"}`;
-    return metric2.value > metric2.max ? `${comparison} (credit capped at parity)` : comparison;
+    return appendMetricCondition(
+      metric2,
+      metric2.value > metric2.max ? `${comparison} (credit capped at parity)` : comparison
+    );
   }
+  const binaryCopy = BINARY_METRIC_COPY[metric2.name];
+  if (binaryCopy && metric2.max === 1 && (metric2.value === 0 || metric2.value === 1)) {
+    return appendMetricCondition(metric2, metric2.value === 1 ? binaryCopy.positive : binaryCopy.negative);
+  }
+  if (metric2.name === "pr_merge_ratio" && metric2.max !== void 0) {
+    const value = metric2.value === 0 ? `none found in bounded recent commit subjects (scoring value 0/${formatMetricNumber(metric2.max)})` : `${formatMetricNumber(metric2.value)} of ${formatMetricNumber(metric2.max)} recent commit subjects contain a recognizable PR reference`;
+    return appendMetricCondition(metric2, value);
+  }
+  const enumerable = formatEnumerableMetric(metric2);
+  if (enumerable) return appendMetricCondition(metric2, enumerable);
   const displayUnit = metric2.name === "prod_readiness_primitives" || metric2.name === "pr_trace_primitives" ? "checks" : labelAlreadyStatesUnit(formatCertificateMetricLabel(metric2), metric2.unit) ? void 0 : metric2.unit;
   const unit = displayUnit ? ` ${displayUnit}` : "";
-  if (metric2.max === void 0) return `${formatMetricNumber(metric2.value)}${unit}`;
+  if (metric2.max === void 0) {
+    return appendMetricCondition(metric2, `${formatMetricNumber(metric2.value)}${unit}`);
+  }
   if (metric2.kind === "saturating_count" && metric2.value > metric2.max) {
-    return `${formatMetricNumber(metric2.max)}${unit} (capped; ${formatMetricNumber(metric2.value)} raw)`;
+    return appendMetricCondition(
+      metric2,
+      `${formatMetricNumber(metric2.max)}${unit} (capped; ${formatMetricNumber(metric2.value)} raw)`
+    );
   }
-  return `${formatMetricNumber(metric2.value)}/${formatMetricNumber(metric2.max)}${unit}`;
+  return appendMetricCondition(
+    metric2,
+    `${formatMetricNumber(metric2.value)}/${formatMetricNumber(metric2.max)}${unit}`
+  );
 }
 function buildRelyingPartySummary(report) {
   const applicable = report.criteria.filter((criterion) => criterion.status !== "not_applicable");
@@ -749,6 +938,13 @@ function buildRelyingPartySummary(report) {
       "No coverage report or configured threshold was found, so static coverage was not measured; Cejel does not run the subject's tests."
     );
   }
+  if (!report.repo.headSha && report.criteria.some(
+    (criterion) => criterion.metrics.some((metric2) => metric2.name === "pr_merge_ratio")
+  )) {
+    gaps.push(
+      "Git history was unavailable, so the recent-commit PR-reference proxy found no commit subjects to inspect; its conservative scoring zero is not a detected merge outcome."
+    );
+  }
   const unmeasured = applicable.filter((criterion) => criterion.status === "insufficient_data");
   if (unmeasured.length > 0) {
     gaps.push(`The report did not measure ${unmeasured.map((criterion) => criterion.id).join(", ")}.`);
@@ -788,7 +984,7 @@ var METRIC_DERIVED_FINDING_PATTERN = /^[A-Z]\d+ metric-derived score is (\d+\.\d
 var REMEDIATION_BY_METRIC = {
   test_to_source_ratio: "add concrete regression tests for the implementation surface",
   coverage_percent: "configure coverage and publish a measured threshold or report",
-  verification_script_ratio: "add explicit test, lint, and typecheck verification commands",
+  verification_script_ratio: "add the missing test, coverage, lint, or type-check command or a test-runner configuration",
   non_hollow_test_share: "replace skipped or placeholder tests with live assertions",
   env_handling_depth: "document and enforce safe environment-secret handling",
   secret_cleanliness: "remove committed secrets and rotate any exposed credentials",
@@ -806,7 +1002,7 @@ var REMEDIATION_BY_METRIC = {
   claim_match_rate: "align documented product claims with observable repository evidence",
   claim_source_depth: "document concrete, checkable product claims",
   reconciliation_artifact_depth: "publish a claim-to-evidence reconciliation record",
-  pr_merge_ratio: "preserve merged pull-request history in the scanned clone",
+  pr_merge_ratio: "preserve recognizable pull-request references in recent commit subjects",
   pr_trace_primitives: "add pull-request templates and outcome-trace records",
   ci_script_depth: "run the repository verification commands in CI",
   default_branch_ci_depth: "run CI on the default branch and pull requests",
@@ -856,6 +1052,7 @@ function formatMetricMember(criterion, metric2) {
 }
 
 // src/witan/html.ts
+var CEJEL_CERTIFICATE_FORMAT_VERSION = "1.0";
 function renderWitanHtmlReport(report, options = {}) {
   const codeCriteria = criteriaByCategory(report, "code_trust");
   const processCriteria = criteriaByCategory(report, "process_trust");
@@ -874,6 +1071,7 @@ function renderWitanHtmlReport(report, options = {}) {
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="cejel-certificate-format" content="${CEJEL_CERTIFICATE_FORMAT_VERSION}">
   <title>Cejel Trust Certificate - ${escapeHtml(report.productDisplayName)}</title>
   <style>${CERTIFICATE_CSS}</style>
 </head>
@@ -889,10 +1087,14 @@ function renderWitanHtmlReport(report, options = {}) {
           <p class="eyebrow">Trust Certificate</p>
           <h1>${escapeHtml(report.productDisplayName)}</h1>
           <dl class="meta">
+            <div><dt>Product identity</dt><dd>${escapeHtml(CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE)}</dd></div>
             ${options.generatedAt ? `<div><dt>Date</dt><dd>${escapeHtml(formatDate(options.generatedAt))}</dd></div>` : ""}
             <div><dt>Run</dt><dd>${escapeHtml(renderRepo(report))}</dd></div>
             <div><dt>CLI</dt><dd>${escapeHtml(options.cliVersion ? `Cejel ${options.cliVersion}` : "Not recorded")}</dd></div>
             <div><dt>Rubric</dt><dd>${escapeHtml(report.rubricVersion)}</dd></div>
+            ${// Gated on the rubric actually being prospective — a calibrated (v17) certificate's
+  // HTML stays byte-identical to before --rubric-pin existed.
+  isProspectiveRubricVersion(report.rubricVersion) ? `<div><dt>Calibration</dt><dd class="prospective-rubric-notice">${escapeHtml(PROSPECTIVE_RUBRIC_NOTICE)}</dd></div>` : ""}
             ${contributingSources.length > 0 ? `<div><dt>Sources</dt><dd>Incorporates findings from: ${escapeHtml(contributingSources.join(", "))}<ul class="source-counts">${externalSourceSummaries.map((s) => `<li>${escapeHtml(formatSourceProvenanceLine(s))}</li>`).join("")}</ul></dd></div>` : ""}
           </dl>
         </section>
@@ -1052,7 +1254,7 @@ function renderNotApplicableGroup(criteria) {
 }
 function renderNotApplicableItem(criterion) {
   const reason = criterion.notes ?? "Not applicable to this repository.";
-  return `<li><span class="na-id">${escapeHtml(criterion.id)}</span> ${escapeHtml(criterion.title)} \u2014 <span class="na-reason">${escapeHtml(reason)}</span></li>`;
+  return `<li><span class="na-id">${escapeHtml(criterion.id)}</span> ${escapeHtml(criterion.title)} \u2014 <span class="na-reason">${escapeHtml(reason)}</span><span class="na-reconciliation"><strong>Why no label comparison applies:</strong> this dimension is not applicable to this repository, so it has no weighted numeric score band to compare.</span></li>`;
 }
 function renderCriterionCard(criterion, gitHistoryUnavailable) {
   const evidence = [
@@ -1061,7 +1263,7 @@ function renderCriterionCard(criterion, gitHistoryUnavailable) {
   ];
   const metrics = criterion.metrics.map((metric2) => renderMetric(criterion, metric2));
   const statusReconciliation = renderStatusReconciliation(criterion);
-  const historyWarning = gitHistoryUnavailable && criterion.metrics.some((metric2) => metric2.name === "pr_merge_ratio") ? `<p class="scan-warning"><strong>Scan limitation:</strong> Git history was unavailable (for example, this may be a source tarball), so the recent PR merge ratio is not a measured repository outcome and its displayed zero may undercount ${escapeHtml(criterion.id)}. Re-scan a full Git clone for this signal.</p>` : "";
+  const historyWarning = gitHistoryUnavailable && criterion.metrics.some((metric2) => metric2.name === "pr_merge_ratio") ? `<p class="scan-warning"><strong>Scan limitation:</strong> Git history was unavailable (for example, this may be a source tarball), so the recent-commit PR-reference proxy found no commit subjects to inspect. Its conservative scoring zero is not a detected merge outcome and may undercount ${escapeHtml(criterion.id)}. Re-scan a full Git clone for this signal.</p>` : "";
   return `<article class="criterion">
             <div class="criterion-top">
               <div>
@@ -1082,11 +1284,22 @@ function renderCriterionCard(criterion, gitHistoryUnavailable) {
           </article>`;
 }
 function renderStatusReconciliation(criterion) {
-  if (criterion.status === "not_applicable" || criterion.status === "insufficient_data" || criterion.status === "unverified") {
-    return "";
+  if (criterion.status === "not_applicable") {
+    return '<p class="status-explanation"><strong>Why no label comparison applies:</strong> this dimension is not applicable to this repository, so it has no weighted numeric score band to compare.</p>';
+  }
+  if (criterion.status === "insufficient_data") {
+    return '<p class="status-explanation"><strong>Why no label comparison applies:</strong> this dimension has insufficient measurable data, so it has no weighted numeric score band to compare.</p>';
+  }
+  if (criterion.status === "unverified") {
+    return '<p class="status-explanation"><strong>Why no label comparison applies:</strong> the unverified dimension state is a fail-closed or legacy zero state, not a calibrated numeric band.</p>';
   }
   const numericBand = scoreBandForPresentation(criterion.score);
-  if (numericBand === criterion.status) return "";
+  if (numericBand === criterion.status) {
+    return `<p class="status-explanation"><strong>How the labels agree:</strong> the ${escapeHtml(criterion.status)} dimension band matches the ${formatScore(criterion.score)}/4.0 weighted score (the ${numericBand} numeric band).</p>`;
+  }
+  if (criterion.status !== "verified" && criterion.status !== "info" && criterion.status !== "warning" && criterion.status !== "critical") {
+    return `<p class="status-explanation"><strong>Why no label comparison applies:</strong> this report contains an unrecognized dimension state (${escapeHtml(String(criterion.status))}), so Cejel will not infer a comparison.</p>`;
+  }
   const entry = CERTIFICATE_GLOSSARY.find((candidate) => candidate.key === "labels");
   const help = entry ? `<span class="term-help" tabindex="0" aria-describedby="tooltip-${criterion.id}-labels"><strong>Why the labels differ:</strong><span class="term-tooltip" id="tooltip-${criterion.id}-labels" role="tooltip">${escapeHtml(entry.definition)}</span></span>` : "<strong>Why the labels differ:</strong>";
   return `<p class="status-explanation">${help} the ${escapeHtml(criterion.status)} dimension band is calibrated from criterion evidence thresholds and findings, independently of the ${formatScore(criterion.score)}/4.0 weighted score (which falls in the ${numericBand} numeric band).</p>`;
@@ -1103,7 +1316,7 @@ function renderMetric(criterion, metric2) {
   const formatted = formatCertificateMetricValue(criterion, metric2);
   const cappedEntry = formatted.includes("capped") ? CERTIFICATE_GLOSSARY.find((candidate) => candidate.key === "capped") : void 0;
   const label = `<span class="term-help" tabindex="0" aria-describedby="${escapeAttribute(tooltipId)}"><strong>${escapeHtml(formatCertificateMetricLabel(metric2))}</strong><span class="term-tooltip" id="${escapeAttribute(tooltipId)}" role="tooltip">${escapeHtml(entry.definition)}</span></span>`;
-  if (!cappedEntry) return `${label}<span>${escapeHtml(formatted)}</span>`;
+  if (!cappedEntry) return `${label}<span class="metric-value">${escapeHtml(formatted)}</span>`;
   const cappedTooltipId = `${tooltipId}-capped`;
   return `${label}<span class="term-help metric-value" tabindex="0" aria-describedby="${escapeAttribute(cappedTooltipId)}">${escapeHtml(formatted)}<span class="term-tooltip" id="${escapeAttribute(cappedTooltipId)}" role="tooltip">${escapeHtml(cappedEntry.definition)}</span></span>`;
 }
@@ -1274,6 +1487,8 @@ h2 { font-family: var(--serif); font-size: 30px; font-weight: 400; letter-spacin
 .na-list li { margin: 0; color: var(--muted); }
 .na-id { color: var(--faint); font-family: var(--mono); font-size: 11px; margin-right: 6px; }
 .na-reason { color: var(--muted); }
+.na-reconciliation { display: block; margin-top: 4px; color: var(--muted); }
+.na-reconciliation strong { color: var(--text); }
 .criterion { border: 1px solid var(--line); border-radius: 8px; padding: 16px; background: var(--surface-2); }
 .criterion-top { display: flex; justify-content: space-between; align-items: flex-start; gap: 14px; }
 .criterion-id { color: var(--periwinkle); font-family: var(--mono); font-size: 12px; margin-bottom: 4px; }
@@ -1288,7 +1503,10 @@ h3 { font-size: 15px; line-height: 1.35; font-weight: 600; margin-bottom: 0; }
 .criterion-metrics { display: grid; gap: 7px; margin-top: 10px; padding: 0; list-style: none; font-size: 12px; }
 .criterion-metrics li { display: flex; justify-content: space-between; gap: 12px; border-bottom: 1px solid rgba(238, 244, 247, .08); padding-bottom: 6px; }
 .criterion-metrics strong { color: var(--text); font-weight: 650; }
-.criterion-metrics span { white-space: nowrap; color: var(--muted); }
+.criterion-metrics span { color: var(--muted); }
+.criterion-metrics > li > .metric-value {
+  min-width: 0; white-space: normal; overflow-wrap: anywhere; text-align: right;
+}
 .term-help { position: relative; cursor: help; outline: none; }
 .term-help:focus-visible { box-shadow: 0 0 0 2px var(--periwinkle); border-radius: 3px; }
 .term-tooltip {
@@ -1448,6 +1666,7 @@ function createWitanAttestation(report, options) {
     predicate: {
       tool: { name: "cejel", version: options.toolVersion },
       generatedAt: options.generatedAt,
+      reportFormatVersion: WITAN_REPORT_FORMAT_VERSION,
       rubricVersion: report.rubricVersion,
       repository: {
         productSlug: report.productSlug,
@@ -1527,47 +1746,29 @@ function verifyWitanAttestationBinding(statement, report, options = {}) {
   return { valid: errors.length === 0, errors };
 }
 
-// src/witan/rubric-version.ts
-init_esm_shims();
-var WITAN_RUBRIC_VERSION_V9 = "witan-rubric-v9-2026-07-22";
-var WITAN_RUBRIC_VERSION_V10 = "witan-rubric-v10-2026-07-23";
-var WITAN_RUBRIC_VERSION_V11 = "witan-rubric-v11-2026-07-23";
-var WITAN_RUBRIC_VERSION_V12 = "witan-rubric-v12-2026-07-23";
-var WITAN_RUBRIC_VERSION_V13 = "witan-rubric-v13-2026-07-23";
-var WITAN_RUBRIC_VERSION_V14 = "witan-rubric-v14-2026-07-23";
-var WITAN_RUBRIC_VERSION_V15 = "witan-rubric-v15-2026-07-24";
-var WITAN_RUBRIC_VERSION_V16 = "witan-rubric-v16-2026-07-24";
-var WITAN_RUBRIC_VERSION_V17 = "witan-rubric-v17-2026-07-24";
-var WITAN_RUBRIC_VERSION_V18 = "witan-rubric-v18-prospective-2026-07-25";
-var WITAN_RUBRIC_VERSION_V19 = "witan-rubric-v19-prospective-2026-08-09";
-var WITAN_RUBRIC_VERSION_V20 = "witan-rubric-v20-prospective-2026-08-10";
-var WITAN_RUBRIC_VERSION_V21 = "witan-rubric-v21-prospective-2026-08-10";
-var WITAN_RUBRIC_VERSION_V22 = "witan-rubric-v22-prospective-2026-08-10";
-var WITAN_LAST_CALIBRATED_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V17;
-var WITAN_PROSPECTIVE_RUBRIC_VERSIONS = Object.freeze([
-  WITAN_RUBRIC_VERSION_V18,
-  WITAN_RUBRIC_VERSION_V19,
-  WITAN_RUBRIC_VERSION_V20,
-  WITAN_RUBRIC_VERSION_V21,
-  WITAN_RUBRIC_VERSION_V22
-]);
-var WITAN_SELECTABLE_RUBRIC_VERSIONS = Object.freeze([
-  WITAN_LAST_CALIBRATED_RUBRIC_VERSION,
-  ...WITAN_PROSPECTIVE_RUBRIC_VERSIONS
-]);
-function assertSelectableRubricVersion(rubricVersion) {
-  if (WITAN_SELECTABLE_RUBRIC_VERSIONS.includes(rubricVersion)) return;
-  throw new Error(
-    `Cejel: unrecognized rubric version: "${rubricVersion}". Accepted values: ${WITAN_SELECTABLE_RUBRIC_VERSIONS.join(", ")}.`
-  );
-}
-
 // src/witan/index.ts
 init_esm_shims();
 
 // src/witan/markdown.ts
 init_esm_shims();
 
+// src/presentation-safety.ts
+init_esm_shims();
+var PRESENTATION_CONTROL_PATTERN = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+function sanitizePresentationLine(value, options) {
+  const withoutControls = value.replace(PRESENTATION_CONTROL_PATTERN, "").trim();
+  const safeValue = withoutControls.length > 0 ? withoutControls : options.fallback;
+  if (safeValue.length <= options.maxLength) return safeValue;
+  const ellipsis = ".".repeat(Math.min(3, options.maxLength));
+  const contentLimit = Math.max(options.maxLength - ellipsis.length, 0);
+  let prefix = "";
+  for (const character of safeValue) {
+    if (prefix.length + character.length > contentLimit) break;
+    prefix += character;
+  }
+  return `${prefix}${ellipsis}`;
+}
+
 // src/witan/repo-signals.ts
 init_esm_shims();
 import { createHash as createHash2 } from "crypto";
@@ -1589,6 +1790,71 @@ function stripBom(text) {
 function usesV17DetectorClosure(rubricVersion) {
   return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
 }
+var LEGACY_INVENTORY_ABSENCE_CONTEXT = {
+  rubricGeneration: "legacy",
+  inventoryProvenance: "directory-walk"
+};
+var INVENTORY_SCAN_PATTERN_SETS = {
+  a1AuthenticatedAbsence: {
+    id: "cejel.core-a1.test-integrity-surface.v1",
+    count: 4
+  },
+  a1ConcreteTests: {
+    id: "cejel.core-a1.concrete-test-files.v1",
+    count: 16
+  },
+  a1CoverageConfiguration: {
+    id: "cejel.core-a1.coverage-configuration.v1",
+    count: 10
+  },
+  a2CurrentSecret: {
+    id: "cejel.core-a2.current-secret-shape.v1",
+    count: 3
+  },
+  a2RlsPolicy: {
+    id: "cejel.core-a2.rls-policy.v1",
+    count: 3
+  },
+  a3CiOrReleaseDeploy: {
+    id: "cejel.core-a3.ci-or-release-deploy.v1",
+    count: 12
+  },
+  a4Lockfile: {
+    id: "cejel.core-a4.lockfile.v1",
+    count: 11
+  },
+  a5ClaimRealityArtifact: {
+    id: "cejel.core-a5.claim-reality-artifact.v1",
+    count: 3
+  }
+};
+function inventoryScanDerivation(inventoryCount, patternSet, matchCount) {
+  return {
+    kind: "inventory-scan",
+    inventoryScope: "tracked-scan-eligible",
+    inventoryCount,
+    patternSetId: patternSet.id,
+    patternCount: patternSet.count,
+    matchCount
+  };
+}
+function inventoryAbsenceFinding(options) {
+  const { context, summaries } = options;
+  const summary = context.rubricGeneration === "legacy" ? summaries.legacy : context.inventoryProvenance === "tracked-scan-eligible" ? summaries.currentTracked : summaries.currentDirectoryWalk;
+  const emitsDerivation = context.rubricGeneration === "current" && context.inventoryProvenance === "tracked-scan-eligible";
+  return {
+    severity: options.severity,
+    summary,
+    evidence: options.evidence,
+    ...emitsDerivation ? {
+      derivation: inventoryScanDerivation(
+        options.inventoryCount,
+        options.patternSet,
+        options.matchCount
+      )
+    } : {}
+  };
+}
 function buildWitanInputFromRepo(options) {
   const tracked = trackContentReads(options.repoPath, () => buildWitanInputFromRepoUntracked(options));
   const affectedCriteria = tracked.affectedCriteria;
@@ -1627,6 +1893,10 @@ function buildWitanInputFromRepoUntracked(options) {
   const inventoryFiles = fileInventory.inventoryFiles;
   const ignoredTargetReason = repoFiles.length === 0 ? explainIgnoredScanTarget(options.repoPath) : void 0;
   const usesV17Detectors = usesV17DetectorClosure(rubricVersion);
+  const inventoryAbsenceContext = {
+    rubricGeneration: usesV17Detectors ? "current" : "legacy",
+    inventoryProvenance: fileInventory.repoFileInventoryScope === "tracked-scan-eligible" ? "tracked-scan-eligible" : "directory-walk"
+  };
   const usesV18NativeRls = rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
   const usesV19CommitYear = rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
   const usesV20A3ExplicitGaps = rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
@@ -1668,6 +1938,7 @@ function buildWitanInputFromRepoUntracked(options) {
     usesV21ExecutedEscalations,
     usesV22PackageStartEntrypoint,
     reviewableSourceProof,
+    inventoryAbsenceContext,
     scanLimitations
   );
   const archetype = usesV17Detectors && reviewableSourceProof?.passes === true && isV17RescuableAbstention(gatedArchetype.abstentionKind) && coreSignals.some(isMeasuredCriterionSignal) ? {
@@ -1677,7 +1948,10 @@ function buildWitanInputFromRepoUntracked(options) {
   } : gatedArchetype;
   return {
     productSlug: options.productSlug,
-    productDisplayName: options.productDisplayName,
+    productDisplayName: sanitizePresentationLine(options.productDisplayName, {
+      fallback: "Repository",
+      maxLength: 120
+    }),
     repo: {
       ...headSha ? { headSha } : {}
     },
@@ -2274,7 +2548,7 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, reviewableSourceProof, scanLimitations = /* @__PURE__ */ new Set()) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
   const signals = [];
   const mono = resolveMonorepoContext(repoPath, scanLimitations);
   const collectCriterion = (criterionId, collect) => withContentReadCriterion(criterionId, collect);
@@ -2286,7 +2560,8 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV27Detectors,
       useV33Detectors,
       useV36Detectors,
-      reviewableSourceProof
+      reviewableSourceProof,
+      inventoryAbsenceContext
     )
   );
   const a2Signal = collectCriterion(
@@ -2300,6 +2575,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV39Detectors,
       useV47Detectors,
       useV18NativeRls,
+      inventoryAbsenceContext,
       scanLimitations
     )
   );
@@ -2310,7 +2586,8 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       repoFiles,
       useV27Detectors,
       useV20A3ExplicitGaps,
-      useV22PackageStartEntrypoint
+      useV22PackageStartEntrypoint,
+      inventoryAbsenceContext
     )
   );
   const a4Signal = collectCriterion(
@@ -2320,12 +2597,18 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       repoFiles,
       mono,
       useV27Detectors,
-      useV47Detectors
+      useV47Detectors,
+      inventoryAbsenceContext
     )
   );
   const a5Signal = collectCriterion(
     "A5",
-    () => collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors)
+    () => collectA5ClaimRealityEvidence(
+      repoPath,
+      repoFiles,
+      useV27Detectors,
+      inventoryAbsenceContext
+    )
   );
   const b1Signal = buildNotApplicableSignal(
     "B1",
@@ -2376,7 +2659,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
   }
   return signals;
 }
-function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, reviewableSourceProof) {
+function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const evidence = [];
   const findings = [];
   const allTestFiles = findConcreteTestFiles(
@@ -2473,7 +2756,12 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
     }
   }
   if (evidence.length === 0 && findings.length === 0 && configuredRunnerFiles.length === 0) {
-    return reviewableSourceProof?.passes === true && reviewableSourceProof.firstReadablePath ? buildA1AuthenticatedAbsenceSignal(repoPath, reviewableSourceProof) : null;
+    return reviewableSourceProof?.passes === true && reviewableSourceProof.firstReadablePath ? buildA1AuthenticatedAbsenceSignal(
+      repoPath,
+      reviewableSourceProof,
+      repoFiles.length,
+      inventoryAbsenceContext
+    ) : null;
   }
   if (testFiles.length === 0) {
     const fallback = configuredRunnerFiles[0] ? evidenceForRelative(
@@ -2483,11 +2771,21 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
       "Configured test runner"
     ) : useV33Detectors ? void 0 : evidence[0] ?? findings[0]?.evidence;
     if (fallback) {
-      findings.push({
-        severity: "warning",
-        summary: "A test runner is configured, but no concrete test files were detected.",
-        evidence: fallback
-      });
+      findings.push(
+        inventoryAbsenceFinding({
+          severity: "warning",
+          summaries: {
+            legacy: "A test runner is configured, but no concrete test files were detected.",
+            currentTracked: "A test runner is configured, but the tracked scan-eligible inventory matched no concrete test file.",
+            currentDirectoryWalk: "A test runner is configured, but the bounded directory walk matched no concrete test file."
+          },
+          evidence: fallback,
+          context: inventoryAbsenceContext,
+          inventoryCount: repoFiles.length,
+          patternSet: INVENTORY_SCAN_PATTERN_SETS.a1ConcreteTests,
+          matchCount: 0
+        })
+      );
     }
   } else if (coverageFiles.length === 0 && (!useV33Detectors || configuredRunnerFiles.length > 0)) {
     if (isLeanTestToolchain) {
@@ -2505,11 +2803,21 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
     } else {
       const firstEvidence = evidence[0];
       if (!firstEvidence) return null;
-      findings.push({
-        severity: "info",
-        summary: "Test suite files are present, but no coverage configuration was detected.",
-        evidence: firstEvidence
-      });
+      findings.push(
+        inventoryAbsenceFinding({
+          severity: "info",
+          summaries: {
+            legacy: "Test suite files are present, but no coverage configuration was detected.",
+            currentTracked: "Test suite files are present, but the tracked scan-eligible inventory matched no coverage configuration.",
+            currentDirectoryWalk: "Test suite files are present, but the bounded directory walk matched no coverage configuration."
+          },
+          evidence: firstEvidence,
+          context: inventoryAbsenceContext,
+          inventoryCount: repoFiles.length,
+          patternSet: INVENTORY_SCAN_PATTERN_SETS.a1CoverageConfiguration,
+          matchCount: 0
+        })
+      );
     }
   }
   const nonHollowShare = measureNonHollowTestShare(
@@ -2548,8 +2856,26 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
         4,
         0.25,
         "ratio",
-        "Measures explicit test/lint/typecheck verification commands (via npm script or CI-invoked tool) plus test runner configuration.",
-        "saturating_count"
+        "Counts detected test, coverage, lint, and typecheck commands plus detected test-runner configuration files; raw credit is capped at four.",
+        "saturating_count",
+        {
+          components: [
+            {
+              label: "test command",
+              count: packageScripts.has("test") || Boolean(ciTestWorkflow) ? 1 : 0
+            },
+            { label: "coverage command", count: packageScripts.has("coverage") ? 1 : 0 },
+            {
+              label: "lint command",
+              count: packageScripts.has("lint") || ciHasLintCommand ? 1 : 0
+            },
+            {
+              label: "type-check command",
+              count: packageScripts.has("typecheck") || ciHasTypecheckCommand ? 1 : 0
+            },
+            { label: "test-runner configuration", count: runnerFiles.length }
+          ]
+        }
       ),
       metric(
         "non_hollow_test_share",
@@ -2564,7 +2890,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
     notes: "A1 is detected from real test files, test runner configuration, and optional coverage configuration."
   };
 }
-function buildA1AuthenticatedAbsenceSignal(repoPath, proof) {
+function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inventoryAbsenceContext) {
   const sourcePath = proof.firstReadablePath;
   if (!sourcePath) {
     throw new Error("Cejel invariant: a passing reviewable-source proof must have a readable path");
@@ -2579,11 +2905,19 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof) {
     criterionId: "A1",
     positiveEvidence: [anchor],
     findings: [
-      {
+      inventoryAbsenceFinding({
         severity: "critical",
-        summary: WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY,
-        evidence: anchor
-      }
+        summaries: {
+          legacy: WITAN_LEGACY_AUTHENTICATED_A1_ABSENCE_SUMMARY,
+          currentTracked: WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY,
+          currentDirectoryWalk: WITAN_DIRECTORY_WALK_AUTHENTICATED_A1_ABSENCE_SUMMARY
+        },
+        evidence: anchor,
+        context: inventoryAbsenceContext,
+        inventoryCount,
+        patternSet: INVENTORY_SCAN_PATTERN_SETS.a1AuthenticatedAbsence,
+        matchCount: 0
+      })
     ],
     metrics: [
       metric(
@@ -2612,8 +2946,17 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof) {
         4,
         0.25,
         "ratio",
-        "Measures explicit test/lint/typecheck verification commands plus test runner configuration.",
-        "saturating_count"
+        "Counts detected test, coverage, lint, and typecheck commands plus detected test-runner configuration files; raw credit is capped at four.",
+        "saturating_count",
+        {
+          components: [
+            { label: "test command", count: 0 },
+            { label: "coverage command", count: 0 },
+            { label: "lint command", count: 0 },
+            { label: "type-check command", count: 0 },
+            { label: "test-runner configuration", count: 0 }
+          ]
+        }
       ),
       metric(
         "non_hollow_test_share",
@@ -2628,7 +2971,7 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof) {
     notes: `V17 authenticated absence: ${proof.eligibleSourceFileCount} criterion-ratable of ${proof.sourceShapedFileCount} source-shaped files; sampled ${proof.sampledFileCount}; ${proof.readableSampledFileCount} representative-text files.`
   };
 }
-function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, scanLimitations) {
+function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, inventoryAbsenceContext, scanLimitations) {
   const evidence = [];
   const findings = [];
   const gitignore = repoFiles.find((file) => basename(file) === ".gitignore");
@@ -2781,16 +3124,26 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       )
     });
   } else if (committedEnvFilePath) {
-    findings.push({
-      severity: useV33Detectors ? "info" : "warning",
-      summary: "A non-template .env file is committed in the current repository tree; no secret-shaped value was detected.",
-      evidence: evidenceForRelative(
-        repoPath,
-        committedEnvFilePath,
-        "secret_scan",
-        "Committed .env file (no confirmed secret value found)"
-      )
-    });
+    findings.push(
+      inventoryAbsenceFinding({
+        severity: useV33Detectors ? "info" : "warning",
+        summaries: {
+          legacy: "A non-template .env file is committed in the current repository tree; no secret-shaped value was detected.",
+          currentTracked: "A tracked non-template .env file is present, while the bounded scan over the tracked scan-eligible inventory matched no secret-shaped value.",
+          currentDirectoryWalk: "A non-template .env file is present in the bounded directory walk, which matched no secret-shaped value."
+        },
+        evidence: evidenceForRelative(
+          repoPath,
+          committedEnvFilePath,
+          "secret_scan",
+          "Committed .env file (no confirmed secret value found)"
+        ),
+        context: inventoryAbsenceContext,
+        inventoryCount: repoFiles.length,
+        patternSet: INVENTORY_SCAN_PATTERN_SETS.a2CurrentSecret,
+        matchCount: 0
+      })
+    );
   }
   if (historySecretScan?.evidence) {
     const historyPath = historySecretScan.evidence.path ?? "";
@@ -2822,16 +3175,26 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   if (hasTenantWithoutRlsGap) {
     const gapEvidence = rlsMigration ?? tenantScopedFile ?? tenantWithoutRlsPremiseFiles[0];
     if (gapEvidence) {
-      findings.push({
-        severity: "warning",
-        summary: "Tenant-scoped schema detected but no row-level-security policies found \u2014 isolation gap.",
-        evidence: evidenceForRelative(
-          repoPath,
-          gapEvidence,
-          "artifact",
-          "Tenant schema without RLS policies"
-        )
-      });
+      findings.push(
+        inventoryAbsenceFinding({
+          severity: "warning",
+          summaries: {
+            legacy: "Tenant-scoped schema detected but no row-level-security policies found \u2014 isolation gap.",
+            currentTracked: "A tenant-scoped schema signal is present, while the tracked scan-eligible inventory matched no row-level-security policy.",
+            currentDirectoryWalk: "A tenant-scoped schema signal is present, while the bounded directory walk matched no row-level-security policy."
+          },
+          evidence: evidenceForRelative(
+            repoPath,
+            gapEvidence,
+            "artifact",
+            "Tenant schema without RLS policies"
+          ),
+          context: inventoryAbsenceContext,
+          inventoryCount: repoFiles.length,
+          patternSet: INVENTORY_SCAN_PATTERN_SETS.a2RlsPolicy,
+          matchCount: 0
+        })
+      );
     }
   }
   evidence.push(...cryptoHygiene.evidence);
@@ -2855,7 +3218,22 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       3,
       isMultiTenant ? 0.1 : 0.3,
       "practices",
-      "Counts three bounded env-handling practices (0\u20133): template file, gitignore rule, env reads in any supported language."
+      "Counts three bounded env-handling practices (0\u20133): template file, gitignore rule, env reads in any supported language.",
+      void 0,
+      {
+        components: [
+          { label: "environment template file", count: envExamples.length > 0 ? 1 : 0 },
+          { label: ".gitignore environment-file rule", count: gitignoreEnvFile ? 1 : 0 },
+          {
+            label: "environment reads in implementation code",
+            count: countFilesContaining(
+              repoPath,
+              repoFiles.filter(isImplementationFile),
+              ENV_READ_PATTERN
+            ) > 0 ? 1 : 0
+          }
+        ]
+      }
     )
   ];
   const isolationMetrics = isMultiTenant ? [
@@ -2867,7 +3245,8 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       0.4,
       "policies",
       useV18NativeRls ? "Counts CREATE POLICY definitions with repository-native USING/WITH CHECK clauses against the repository-native scoped data-layer surface." : "Counts static row-level-security enables, forced-RLS statements, and policy definitions.",
-      "saturating_count"
+      "saturating_count",
+      { condition: "scored because a multi-tenant data surface was detected" }
     ),
     metric(
       "tenant_scope_ratio",
@@ -2876,7 +3255,9 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       Math.max(migrationFiles.length, 1),
       0.25,
       "ratio",
-      useV18NativeRls ? `Measures repository-native RLS scope identifiers (${nativeRlsInventory?.scopeIdentifiers.join(", ")}) across data-layer files.` : "Measures tenant/studio/workspace scoping evidence across data-layer files."
+      useV18NativeRls ? `Measures repository-native RLS scope identifiers (${nativeRlsInventory?.scopeIdentifiers.join(", ")}) across data-layer files.` : "Measures tenant/studio/workspace scoping evidence across data-layer files.",
+      void 0,
+      { condition: "scored because a multi-tenant data surface was detected" }
     )
   ] : [];
   const cryptoMetrics = cryptoHygiene.hasSurface ? [
@@ -2887,7 +3268,11 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       1,
       0.2,
       "clean",
-      "Credits constant-time secret/HMAC comparison and canonical serialization before signing when a signing/HMAC surface is detected in source; only scored when such a surface exists."
+      "Credits constant-time secret/HMAC comparison and canonical serialization before signing when a signing/HMAC surface is detected in source; only scored when such a surface exists.",
+      void 0,
+      {
+        condition: "scored because a signing, HMAC, or secret-comparison surface was detected"
+      }
     )
   ] : [];
   return {
@@ -2994,7 +3379,7 @@ function collectCryptoHygieneEvidence(repoPath, implFiles, useV39Detectors = fal
   }
   return { evidence, findings, hasSurface, clean: hasSurface && !insecureFound };
 }
-function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, useV20ExplicitGaps = false, useV22PackageStartEntrypoint = false) {
+function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, useV20ExplicitGaps = false, useV22PackageStartEntrypoint = false, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const v20DirectHttpEntrypoint = useV20ExplicitGaps ? findV20DirectHttpServerEntrypointFile(repoPath, repoFiles) : null;
   const v22PackageStartHttpEntrypoint = useV22PackageStartEntrypoint ? findV22PackageStartHttpServerEntrypointFile(repoPath, repoFiles) : null;
   const v20RuntimeContainer = useV20ExplicitGaps ? findRuntimeContainerEntrypointFile(repoPath, repoFiles, true) : null;
@@ -3156,11 +3541,21 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
   if (!workflow && releaseDeployConfigs.length === 0) {
     const firstEvidence = evidence[0];
     if (!firstEvidence) return null;
-    findings.push({
-      severity: "info",
-      summary: "A deployable service surface exists, but no CI or release-deployment automation was detected.",
-      evidence: firstEvidence
-    });
+    findings.push(
+      inventoryAbsenceFinding({
+        severity: "info",
+        summaries: {
+          legacy: "A deployable service surface exists, but no CI or release-deployment automation was detected.",
+          currentTracked: "A deployable service signal is present, while the tracked scan-eligible inventory matched no CI workflow or release-deployment automation.",
+          currentDirectoryWalk: "A deployable service signal is present, while the bounded directory walk matched no CI workflow or release-deployment automation."
+        },
+        evidence: firstEvidence,
+        context: inventoryAbsenceContext,
+        inventoryCount: repoFiles.length,
+        patternSet: INVENTORY_SCAN_PATTERN_SETS.a3CiOrReleaseDeploy,
+        matchCount: 0
+      })
+    );
   }
   return {
     criterionId: "A3",
@@ -3181,7 +3576,21 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
         6,
         0.55,
         "checks",
-        "Counts distinct static production-readiness checks instead of treating presence as enough."
+        "Counts distinct static production-readiness checks instead of treating presence as enough.",
+        void 0,
+        {
+          components: [
+            {
+              label: "build or type-check command",
+              count: packageJson && (scripts.has("build") || scripts.has("typecheck")) ? 1 : 0
+            },
+            { label: "CI workflow", count: workflows.length > 0 ? 1 : 0 },
+            { label: "deployment configuration", count: deployConfigs.length > 0 ? 1 : 0 },
+            { label: "environment template", count: envTemplate ? 1 : 0 },
+            { label: "health or readiness signal", count: healthChecks.length > 0 ? 1 : 0 },
+            { label: "error boundary", count: errorBoundaries.length > 0 ? 1 : 0 }
+          ]
+        }
       ),
       metric(
         "prod_workflow_depth",
@@ -3216,7 +3625,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
     ]
   };
 }
-function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors, useV47Detectors) {
+function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors, useV47Detectors, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const evidence = [];
   const findings = [];
   const manifests = repoFiles.filter(isDependencyManifest);
@@ -3269,11 +3678,26 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors,
   const deployableServiceFiles = useV47Detectors ? findDeployableServicePremiseFiles(repoPath, repoFiles, true) : [];
   const isAppOrService = (useV47Detectors ? deployableServiceFiles.length > 0 : isDeployableService(repoPath, repoFiles, useV27Detectors)) || packagedApplicationFiles.length > 0;
   if (isAppOrService && !hasLockfile && manifest) {
-    findings.push({
-      severity: "critical",
-      summary: "Dependency manifest is present without a detected lockfile \u2014 non-reproducible installs.",
-      evidence: evidenceForRelative(repoPath, manifest, "dependency_report", "Dependency manifest")
-    });
+    findings.push(
+      inventoryAbsenceFinding({
+        severity: "critical",
+        summaries: {
+          legacy: "Dependency manifest is present without a detected lockfile \u2014 non-reproducible installs.",
+          currentTracked: "Dependency manifest is present, but the tracked scan-eligible inventory matched no recognized lockfile.",
+          currentDirectoryWalk: "Dependency manifest is present, but the bounded directory walk matched no recognized lockfile."
+        },
+        evidence: evidenceForRelative(
+          repoPath,
+          manifest,
+          "dependency_report",
+          "Dependency manifest"
+        ),
+        context: inventoryAbsenceContext,
+        inventoryCount: repoFiles.length + (mono?.sharedFiles.length ?? 0),
+        patternSet: INVENTORY_SCAN_PATTERN_SETS.a4Lockfile,
+        matchCount: 0
+      })
+    );
   }
   if (manifest && hasSuspiciousDependencies(repoPath, manifest, useV47Detectors)) {
     findings.push({
@@ -3294,7 +3718,14 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors,
     2,
     0.25,
     "ratio",
-    "Credits automated dependency updates and package-manager audit hooks."
+    "Credits automated dependency updates and package-manager audit hooks.",
+    void 0,
+    {
+      components: [
+        { label: "automated dependency-update configuration", count: hasUpdateConfig ? 1 : 0 },
+        { label: "package-manager audit hook", count: auditConfig ? 1 : 0 }
+      ]
+    }
   );
   const appMetrics = [
     metric(
@@ -3374,7 +3805,7 @@ function hasDeclaredVersionConstraint(dependency) {
   if (/[~^<>=!]/.test(trimmed)) return true;
   return /^v?\d/.test(trimmed);
 }
-function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors) {
+function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const reconciliationArtifacts = useV27Detectors ? findClaimRealityReconciliationArtifacts(repoPath, repoFiles) : [];
   const claimSourceFiles = useV27Detectors ? findClaimSourceFiles(repoFiles) : repoFiles.filter(
     (file) => /^(?:README|readme)\.md$/.test(file) || /^docs\/[^/]+\.(?:md|mdx)$/.test(file)
@@ -3439,15 +3870,23 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors) {
     criterionId: "A5",
     positiveEvidence: evidence,
     findings: reconciliationArtifacts.length > 0 ? [] : [
-      {
+      inventoryAbsenceFinding({
         // Proxy-only A5: cap at warning (never critical) — a static proxy is lower-confidence
         // than a curated registry or reconciliation artifact. Downgraded to info when the repo
         // documents honest negative space: that scoping IS a form of claim-reality discipline,
         // not an additional gap on top of the missing dedicated artifact.
         severity: negativeSpaceDoc ? "info" : "warning",
-        summary: negativeSpaceDoc ? "Claim source and implementation files are present; no dedicated claim-reality report artifact was supplied, but the repo explicitly documents what it does NOT cover/protect against \u2014 honest scoping, not overclaiming." : "Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied.",
-        evidence: firstEvidence
-      }
+        summaries: {
+          legacy: negativeSpaceDoc ? "Claim source and implementation files are present; no dedicated claim-reality report artifact was supplied, but the repo explicitly documents what it does NOT cover/protect against \u2014 honest scoping, not overclaiming." : "Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied.",
+          currentTracked: negativeSpaceDoc ? "Claim-source and implementation-file signals are present, while the tracked scan-eligible inventory matched no dedicated claim-reality report artifact; the repo separately documents what it does NOT cover or protect against." : "Claim-source and implementation-file signals are present, while the tracked scan-eligible inventory matched no dedicated claim-reality report artifact.",
+          currentDirectoryWalk: negativeSpaceDoc ? "Claim-source and implementation-file signals are present, while the bounded directory walk matched no dedicated claim-reality report artifact; the repo separately documents what it does NOT cover or protect against." : "Claim-source and implementation-file signals are present, while the bounded directory walk matched no dedicated claim-reality report artifact."
+        },
+        evidence: firstEvidence,
+        context: inventoryAbsenceContext,
+        inventoryCount: repoFiles.length,
+        patternSet: INVENTORY_SCAN_PATTERN_SETS.a5ClaimRealityArtifact,
+        matchCount: 0
+      })
     ],
     // Recalibrated (goal_cejel_launch_hardening_combined_2026-07-06, Phase 3 H1):
     // reconciliation_artifact_depth is usually 0 on the generic-proxy path, so its prior 0.3
@@ -3528,7 +3967,14 @@ function collectB2PrTraceEvidence(repoPath, repoFiles) {
         0.8,
         "signals",
         "Measures CI, PR template, and review-gate evidence for pull-request traceability.",
-        "saturating_count"
+        "saturating_count",
+        {
+          components: [
+            { label: "CI workflow", count: workflows.length },
+            { label: "pull-request template", count: prTemplate ? 1 : 0 },
+            { label: "review-gate record", count: branchProtectionDoc ? 1 : 0 }
+          ]
+        }
       ),
       // Weight lowered from 0.35 (Phase 3 H1): squash-merge and local-history repos with
       // no "Merge pull request"/"#123" commit-subject convention legitimately score 0/N
@@ -3591,8 +4037,24 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
         4,
         0.45,
         "signals",
-        "Counts npm verification scripts plus distinct test/lint/typecheck/build command categories detected anywhere in CI workflows; language-agnostic, counted by category not by file.",
-        "saturating_count"
+        "Counts test/lint/typecheck/build package scripts plus those command categories in repository CI and, when applicable, monorepo-root CI; raw credit is capped at four.",
+        "saturating_count",
+        {
+          components: [
+            ...["test", "lint", "typecheck", "build"].map((name) => ({
+              label: `package script: ${name === "typecheck" ? "type-check" : name}`,
+              count: scripts.has(name) ? 1 : 0
+            })),
+            ...CI_COMMAND_CATEGORIES.map((pattern, index) => ({
+              label: `repository CI command: ${["test", "lint", "type-check", "build"][index]}`,
+              count: workflows.some((file) => fileContains(repoPath, file, pattern)) ? 1 : 0
+            })),
+            ...mono ? CI_COMMAND_CATEGORIES.map((pattern, index) => ({
+              label: `monorepo-root CI command: ${["test", "lint", "type-check", "build"][index]}`,
+              count: rootWorkflows.some((file) => fileContains(mono.root, file, pattern)) ? 1 : 0
+            })) : []
+          ]
+        }
       ),
       metric(
         "default_branch_ci_depth",
@@ -3772,7 +4234,7 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detecto
     const isV21ExecutedShape = v21ExecutedEscalationFileSet.has(file);
     findings.push({
       severity: "critical",
-      summary: isV21ExecutedShape ? "An authored SQL artifact contains, or a direct database-driver call executes, an administrative role grant, SUPERUSER escalation, or schema-wide table privilege grant with no documented human gate." : "Role-membership GRANT or SUPERUSER escalation executes in code with no documented human gate.",
+      summary: isV21ExecutedShape ? "This file contains an authored administrative SQL statement \u2014 role-membership grant, SUPERUSER escalation, or schema-wide table privilege grant \u2014 or executes one through a direct database-driver call, and does not itself contain text matching the human-gate marker pattern." : "This file executes a role-membership GRANT or SUPERUSER escalation and does not itself contain text matching the human-gate marker pattern.",
       evidence: evidenceForRelative(
         repoPath,
         file,
@@ -3795,7 +4257,11 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detecto
       1,
       0.15,
       "present",
-      "Credits a governance/safety toggle that fails closed before any lower-priority config can override it."
+      "Credits a governance/safety toggle that fails closed before any lower-priority config can override it.",
+      void 0,
+      {
+        condition: "shown because a fail-closed kill switch was detected; this positive-only metric is omitted when absent"
+      }
     )
   ] : [];
   const hasPrivilegedOpsSurface = humanGateDoc != null || gatedPrivilegeCheckFile != null || executableFiles.length > 0 || v21ExecutedEscalationFiles.length > 0;
@@ -3812,7 +4278,11 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detecto
           1,
           0.4,
           "present",
-          "Credits explicit documentation that privileged/credentialed operations are human-executed, never agent-run."
+          "Credits explicit documentation that privileged/credentialed operations are human-executed, never agent-run.",
+          void 0,
+          {
+            condition: "scored because a privileged-operation-shaped surface was detected"
+          }
         ),
         metric(
           "fail_closed_privilege_check",
@@ -3821,7 +4291,11 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detecto
           1,
           0.3,
           "present",
-          "Credits code that checks role membership and fails closed before elevating privilege, instead of attempting elevation blind."
+          "Credits code that checks role membership and fails closed before elevating privilege, instead of attempting elevation blind.",
+          void 0,
+          {
+            condition: "scored because a privileged-operation-shaped surface was detected"
+          }
         )
       ] : [],
       metric(
@@ -4087,10 +4561,20 @@ function parseGitTrackedFiles(repoPath, output, includeHardExcluded) {
       continue;
     }
     try {
-      if (!lstatSync(fullPath).isFile()) {
+      const stat = lstatSync(fullPath);
+      if (!stat.isFile()) {
         recordContentSkip(fullPath, "non_regular_file", true);
         continue;
       }
+      if (stat.size > MAX_REPOSITORY_CONTENT_BYTES) {
+        const affectedCriteria = affectedCriteriaForUnavailablePath(file);
+        if (affectedCriteria.length > 0) {
+          recordContentSkipForCriteria(fullPath, "too_large", affectedCriteria, true);
+        } else {
+          recordContentSkip(fullPath, "too_large", true);
+        }
+        continue;
+      }
     } catch (error) {
       recordFilesystemSkip(fullPath, error, false, true);
       continue;
@@ -4102,6 +4586,39 @@ function parseGitTrackedFiles(repoPath, output, includeHardExcluded) {
   }
   return files.sort();
 }
+function affectedCriteriaForUnavailablePath(file) {
+  const affected = /* @__PURE__ */ new Set();
+  if (isDependencyManifest(file) || isLockfile(file)) affected.add("A4");
+  if (isCiWorkflow(file)) {
+    affected.add("A1");
+    affected.add("A3");
+    affected.add("B2");
+    affected.add("B3");
+  }
+  if (isDeployConfig(file)) {
+    affected.add("A3");
+    affected.add("B2");
+  }
+  if (isTestFile(file)) {
+    affected.add("A1");
+    affected.add("A2");
+  }
+  if (isImplementationFile(file)) {
+    affected.add("A1");
+    affected.add("A2");
+    affected.add("A3");
+    affected.add("B1");
+    affected.add("B6");
+  }
+  if (/\.(?:md|mdx|rst|txt)$/i.test(file)) {
+    affected.add("A5");
+    affected.add("B4");
+    affected.add("B5");
+    affected.add("B6");
+  }
+  if (isAuditFile(file)) affected.add("B5");
+  return [...affected];
+}
 function directoryInventory(repoPath) {
   const files = [];
   const rootDevice = statSync(repoPath).dev;
@@ -4114,6 +4631,7 @@ function collectRepoFileInventory(repoPath) {
     return {
       repoFiles: parseGitTrackedFiles(repoPath, tracked.stdout, false),
       inventoryFiles: parseGitTrackedFiles(repoPath, tracked.stdout, true),
+      repoFileInventoryScope: "tracked-scan-eligible",
       scanLimitations: []
     };
   }
@@ -4221,8 +4739,13 @@ function visitRepoDir(repoPath, dirPath, files, rootDevice) {
       continue;
     }
     const repoRelativePath = relative(repoPath, fullPath);
-    if (size > 512e3) {
-      recordContentSkip(fullPath, "too_large");
+    if (size > MAX_REPOSITORY_CONTENT_BYTES) {
+      const affectedCriteria = affectedCriteriaForUnavailablePath(repoRelativePath);
+      if (affectedCriteria.length > 0) {
+        recordContentSkipForCriteria(fullPath, "too_large", affectedCriteria);
+      } else {
+        recordContentSkip(fullPath, "too_large");
+      }
       continue;
     }
     if (!isPotentialContentPath(repoRelativePath)) {
@@ -6152,16 +6675,29 @@ function evidenceForRelativeAtLine(repoPath, path, kind, label, line) {
     ...contents ? { contentHash: createHash2("sha256").update(contents).digest("hex") } : {}
   };
 }
-function metric(name, label, value, max, weight, unit, description, kind) {
+function metric(name, label, value, max, weight, unit, description, kind, presentation) {
+  const normalizedValue = Math.max(0, value);
+  if (presentation?.components) {
+    const explainedValue = presentation.components.reduce(
+      (sum, component) => sum + component.count,
+      0
+    );
+    if (explainedValue !== normalizedValue) {
+      throw new Error(
+        `Cejel invariant: presentation components for ${name} total ${explainedValue}, expected ${normalizedValue}`
+      );
+    }
+  }
   return {
     name,
     label,
-    value: Math.max(0, value),
+    value: normalizedValue,
     max,
     ...kind ? { kind } : {},
     weight,
     unit,
-    description
+    description,
+    ...presentation ? { presentation } : {}
   };
 }
 function firstMeaningfulLine(contents) {
@@ -6201,12 +6737,11 @@ function hasEnvPathInGitHistory(repoPath, scanLimitations) {
 
 // src/witan/public-scan.ts
 init_esm_shims();
-import { resolve as resolve2 } from "path";
 
 // src/witan/ingest.ts
 init_esm_shims();
-import { readFileSync as readFileSync4, readdirSync as readdirSync2 } from "fs";
-import { join as join2 } from "path";
+import { lstatSync as lstatSync3, opendirSync, readFileSync as readFileSync4, realpathSync as realpathSync3 } from "fs";
+import { join as join2, resolve as resolve3 } from "path";
 
 // src/witan/finding-limits.ts
 init_esm_shims();
@@ -6230,49 +6765,118 @@ function clampFinding(finding) {
 // src/witan/generic-adapter.ts
 init_esm_shims();
 import { readFileSync } from "fs";
-var VALID_DIMENSIONS = /* @__PURE__ */ new Set([
-  "A1",
-  "A2",
-  "A3",
-  "A4",
-  "A5",
-  "B1",
-  "B2",
-  "B3",
-  "B4",
-  "B5",
-  "B6"
-]);
-var VALID_SEVERITIES = /* @__PURE__ */ new Set(["critical", "warning", "info"]);
+
+// src/witan/ingest-files.ts
+init_esm_shims();
+import { lstatSync as lstatSync2, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname2, isAbsolute, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
+var MAX_INGEST_DOCUMENT_BYTES = 8 * 1024 * 1024;
+function isContainedPath(candidate, directory) {
+  const relativePath = relative2(directory, candidate);
+  return relativePath === "" || relativePath !== ".." && !relativePath.startsWith(`..${sep2}`) && !isAbsolute(relativePath);
+}
+function isMissingIngestPath(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function resolveIngestFilePath(filePath, inputDirectory = dirname2(filePath)) {
+  const lexicalDirectory = resolve2(inputDirectory);
+  const lexicalCandidate = resolve2(filePath);
+  const directoryStat = lstatSync2(lexicalDirectory);
+  if (directoryStat.isSymbolicLink()) {
+    throw new Error(`Cejel: refusing symlinked ingest directory: ${inputDirectory}`);
+  }
+  if (!directoryStat.isDirectory()) {
+    throw new Error(`Cejel: refusing non-directory ingest boundary: ${inputDirectory}`);
+  }
+  const candidateStat = lstatSync2(lexicalCandidate);
+  if (candidateStat.isSymbolicLink()) {
+    throw new Error(`Cejel: refusing symlinked ingest file: ${filePath}`);
+  }
+  if (!candidateStat.isFile()) {
+    throw new Error(`Cejel: refusing non-regular ingest file: ${filePath}`);
+  }
+  if (candidateStat.size > MAX_INGEST_DOCUMENT_BYTES) {
+    throw new Error(
+      `Cejel: ingest file exceeds the ${MAX_INGEST_DOCUMENT_BYTES.toLocaleString("en-US")} byte budget: ${filePath}`
+    );
+  }
+  const resolvedDirectory = realpathSync2(lexicalDirectory);
+  const resolvedCandidate = realpathSync2(lexicalCandidate);
+  if (!isContainedPath(resolvedCandidate, resolvedDirectory)) {
+    throw new Error(`Cejel: refusing ingest file outside its resolved input directory: ${filePath}`);
+  }
+  return resolvedCandidate;
+}
+function isResolvedIngestPathContained(candidate, directory) {
+  return isContainedPath(candidate, directory);
+}
+
+// src/witan/generic-adapter.ts
+var CEJEL_GENERIC_INGEST_CONTRACT_VERSION = "1.0";
+var CEJEL_GENERIC_INGEST_CONTRACT_MAJOR = 1;
+var GenericFindingV1Schema = external_exports.object({
+  ruleId: external_exports.string().min(1),
+  severity: external_exports.enum(["critical", "warning", "info"]),
+  message: external_exports.string().min(1),
+  location: external_exports.string().min(1).optional()
+}).passthrough();
+var GenericSignalV1Schema = external_exports.object({
+  dimension: external_exports.enum(["A1", "A2", "A3", "A4", "A5", "B1", "B2", "B3", "B4", "B5", "B6"]),
+  weight: external_exports.number().min(0).max(1).default(0.5),
+  findings: external_exports.array(GenericFindingV1Schema).min(1)
+}).passthrough();
+var GenericSignalDocumentV1Schema = external_exports.object({
+  version: external_exports.string().regex(/^1\.\d+$/),
+  tool: external_exports.string().trim().min(1),
+  signals: external_exports.array(GenericSignalV1Schema)
+}).passthrough();
 function isGenericSignalDocument(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
   const doc = raw;
   return typeof doc.tool === "string" && doc.tool.length > 0 && Array.isArray(doc.signals);
 }
+function assertSupportedContractVersion(version) {
+  if (typeof version !== "string") {
+    throw new Error(
+      `Cejel: generic ingest contract version is required; expected "version": "${CEJEL_GENERIC_INGEST_CONTRACT_VERSION}". Refusing to guess an unversioned contract.`
+    );
+  }
+  const match = /^(\d+)\.(\d+)$/.exec(version);
+  if (!match) {
+    throw new Error(
+      `Cejel: invalid generic ingest contract version "${version}"; expected <major>.<minor> (current ${CEJEL_GENERIC_INGEST_CONTRACT_VERSION}).`
+    );
+  }
+  const major = Number(match[1]);
+  if (major !== CEJEL_GENERIC_INGEST_CONTRACT_MAJOR) {
+    throw new Error(
+      `Cejel: unsupported generic ingest contract major version ${major} (declared "${version}"); this Cejel build supports major ${CEJEL_GENERIC_INGEST_CONTRACT_MAJOR}. Refusing to guess.`
+    );
+  }
+}
+function formatValidationIssues(error) {
+  return error.issues.map((issue) => `${issue.path.length > 0 ? issue.path.join(".") : "<document>"}: ${issue.message}`).join("; ");
+}
 function parseGenericJson(raw) {
   if (!isGenericSignalDocument(raw)) return [];
-  const source = raw.tool ?? "unknown";
-  const signals = [];
-  for (const signal of raw.signals ?? []) {
-    const dimension = signal.dimension;
-    if (!dimension || !VALID_DIMENSIONS.has(dimension)) continue;
-    const weight = typeof signal.weight === "number" && Number.isFinite(signal.weight) ? Math.min(Math.max(signal.weight, 0), 1) : 0.5;
-    const findings = [];
-    for (const finding of signal.findings ?? []) {
-      const severity = finding.severity;
-      if (!severity || !VALID_SEVERITIES.has(severity)) continue;
-      const ruleId = finding.ruleId ?? "unknown";
-      findings.push({
-        ruleId,
-        severity,
-        message: finding.message ?? ruleId,
-        ...finding.location ? { location: finding.location } : {}
-      });
-    }
-    if (findings.length === 0) continue;
-    signals.push({ source, dimension, weight, findings });
+  assertSupportedContractVersion(raw.version);
+  const parsed = GenericSignalDocumentV1Schema.safeParse(raw);
+  if (!parsed.success) {
+    throw new Error(
+      `Cejel: invalid generic ingest contract v${raw.version}: ${formatValidationIssues(parsed.error)}`
+    );
   }
-  return signals;
+  return parsed.data.signals.map((signal) => ({
+    source: parsed.data.tool,
+    dimension: signal.dimension,
+    weight: signal.weight,
+    findings: signal.findings.map((finding) => ({
+      ruleId: finding.ruleId,
+      severity: finding.severity,
+      message: finding.message,
+      ...finding.location ? { location: finding.location } : {}
+    }))
+  }));
 }
 
 // src/witan/sarif-adapter.ts
@@ -6534,30 +7138,35 @@ function rawToolName(raw) {
 }
 var MAX_INGEST_SOURCE_LENGTH = 120;
 function sanitizeIngestSource(source) {
-  const withoutControls = source.replace(/[\p{Cc}\p{Cf}]/gu, "").trim();
-  const safeSource = withoutControls.length > 0 ? withoutControls : "unknown";
-  const codePoints = Array.from(safeSource);
-  if (codePoints.length <= MAX_INGEST_SOURCE_LENGTH) return safeSource;
-  return `${codePoints.slice(0, MAX_INGEST_SOURCE_LENGTH - 3).join("")}...`;
+  return sanitizePresentationLine(source, {
+    fallback: "unknown",
+    maxLength: MAX_INGEST_SOURCE_LENGTH
+  });
 }
 function parseIngestFile(filePath, options = {}) {
+  const resolvedFilePath = resolveIngestFilePath(filePath);
   let raw;
   try {
-    raw = JSON.parse(stripBom(readFileSync4(filePath, "utf8")));
+    raw = JSON.parse(stripBom(readFileSync4(resolvedFilePath, "utf8")));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Cejel: could not parse ingest file as JSON: ${filePath} (${message})`);
   }
+  const rawCount = countRawEntries(raw);
+  if (options.maxFindingCandidates !== void 0 && rawCount > options.maxFindingCandidates) {
+    throw new Error(
+      `Cejel: ${rawCount.toLocaleString("en-US")} ingest finding candidates exceed the ${options.maxFindingCandidates.toLocaleString("en-US")} remaining retained ingest finding budget; refusing before adapter materialization.`
+    );
+  }
   let signals;
   if (looksLikeSarif(raw)) signals = parseSarifJson(raw, options.extraSarifDimensionRules);
   else if (looksLikeScorecard(raw)) signals = parseScorecardJson(raw);
   else if (isGenericSignalDocument(raw)) signals = parseGenericJson(raw);
   if (!signals) {
     throw new Error(
-      `Cejel: unrecognized ingest file format: ${filePath} \u2014 expected SARIF (a "runs" array), OpenSSF Scorecard JSON (a "checks" array), or the generic Cejel external-signal shape (a "tool" string + "signals" array). See the cejel README "Aggregate your scanners".`
+      `Cejel: unrecognized ingest file format: ${filePath} \u2014 expected SARIF (a "runs" array), OpenSSF Scorecard JSON (a "checks" array), or the versioned generic Cejel external-signal shape (a "version" string + "tool" string + "signals" array). See the cejel README "Aggregate your scanners".`
     );
   }
-  const rawCount = countRawEntries(raw);
   const mappedCount = signals.reduce((sum, signal) => sum + signal.findings.length, 0);
   if (rawCount > 0 && mappedCount === 0) {
     process.stderr.write(
@@ -6572,30 +7181,83 @@ function parseIngestFile(filePath, options = {}) {
     findings: signal.findings.map(clampFinding)
   }));
 }
-function expandIngestPattern(pattern) {
+function expandIngestPattern(pattern, maxMatches = Number.POSITIVE_INFINITY) {
   if (!pattern.includes("*")) return [pattern];
   const lastSlash = pattern.lastIndexOf("/");
   const dir = lastSlash === -1 ? "." : pattern.slice(0, lastSlash);
   const filePattern = lastSlash === -1 ? pattern : pattern.slice(lastSlash + 1);
   const regexSource = filePattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
   const regex = new RegExp(`^${regexSource}$`);
-  let entries;
+  const entries = [];
   try {
-    entries = readdirSync2(dir);
-  } catch {
+    const directoryStat = lstatSync3(resolve3(dir));
+    if (directoryStat.isSymbolicLink()) {
+      throw new Error(`Cejel: refusing symlinked ingest directory: ${dir}`);
+    }
+    if (!directoryStat.isDirectory()) return [];
+    const directory = opendirSync(dir);
+    try {
+      for (; ; ) {
+        const entry = directory.readSync();
+        if (!entry) break;
+        if (!regex.test(entry.name)) continue;
+        entries.push(entry.name);
+        if (entries.length >= maxMatches) break;
+      }
+    } finally {
+      directory.closeSync();
+    }
+  } catch (error) {
+    if (!isMissingIngestPath(error)) throw error;
     return [];
   }
-  return entries.filter((name) => regex.test(name)).sort().map((name) => join2(dir, name));
+  return entries.sort().map((name) => {
+    const candidate = join2(dir, name);
+    resolveIngestFilePath(candidate, dir);
+    return candidate;
+  });
 }
-function discoverIngestInputs(repoPath) {
+function discoverIngestInputs(repoPath, maxMatches = Number.POSITIVE_INFINITY) {
+  const resolvedRoot = realpathSync3(repoPath);
+  const cejelDir = join2(repoPath, ".cejel");
   const inputsDir = join2(repoPath, ".cejel", "inputs");
-  let entries;
+  const entries = [];
   try {
-    entries = readdirSync2(inputsDir);
-  } catch {
+    const cejelStat = lstatSync3(cejelDir);
+    if (cejelStat.isSymbolicLink()) {
+      throw new Error(`Cejel: refusing symlinked ingest path component: ${cejelDir}`);
+    }
+    if (!cejelStat.isDirectory()) {
+      throw new Error(`Cejel: refusing non-directory ingest path component: ${cejelDir}`);
+    }
+    const inputsStat = lstatSync3(inputsDir);
+    if (inputsStat.isSymbolicLink()) {
+      throw new Error(`Cejel: refusing symlinked ingest path component: ${inputsDir}`);
+    }
+    if (!inputsStat.isDirectory()) {
+      throw new Error(`Cejel: refusing non-directory ingest path component: ${inputsDir}`);
+    }
+    const resolvedInputs = realpathSync3(inputsDir);
+    if (!isResolvedIngestPathContained(resolvedInputs, resolvedRoot)) {
+      throw new Error(`Cejel: refusing auto-discovery directory outside the repository root.`);
+    }
+    const directory = opendirSync(inputsDir);
+    try {
+      for (; ; ) {
+        const entry = directory.readSync();
+        if (!entry) break;
+        if (!/\.(sarif|json)$/i.test(entry.name)) continue;
+        entries.push(entry.name);
+        if (entries.length >= maxMatches) break;
+      }
+    } finally {
+      directory.closeSync();
+    }
+  } catch (error) {
+    if (!isMissingIngestPath(error)) throw error;
     return [];
   }
-  return entries.filter((name) => /\.(sarif|json)$/i.test(name)).sort().map((name) => join2(inputsDir, name));
+  return entries.sort().map((name) => resolveIngestFilePath(join2(inputsDir, name), inputsDir));
 }
 
 // src/witan/scoring.ts
@@ -7007,7 +7669,11 @@ function scoreMetrics(metrics) {
 function capScoreForFindings(score, findings, rubricVersion, criterionId) {
   if (findings.some((finding) => finding.severity === "critical")) {
     const criticalFindings = findings.filter(({ severity }) => severity === "critical");
-    const authenticatedA1Absence = usesV17DetectorClosure2(rubricVersion) && criterionId === "A1" && criticalFindings.length === 1 && criticalFindings[0]?.summary === WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY;
+    const authenticatedA1Absence = usesV17DetectorClosure2(rubricVersion) && criterionId === "A1" && criticalFindings.length === 1 && [
+      WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY,
+      WITAN_DIRECTORY_WALK_AUTHENTICATED_A1_ABSENCE_SUMMARY,
+      WITAN_LEGACY_AUTHENTICATED_A1_ABSENCE_SUMMARY
+    ].includes(criticalFindings[0]?.summary ?? "");
     return authenticatedA1Absence ? Math.min(score, 1.4) : 1.4;
   }
   if (findings.some((finding) => finding.severity === "warning")) return Math.min(score, 2.4);
@@ -7279,6 +7945,8 @@ function roundScore(score) {
 }
 
 // src/witan/public-scan.ts
+var MAX_INGEST_DOCUMENTS = 128;
+var MAX_RETAINED_INGEST_FINDINGS = 1e4;
 function scoreRepoWithPublicCejel(options) {
   if (options.rubricVersion !== void 0) {
     assertSelectableRubricVersion(options.rubricVersion);
@@ -7306,44 +7974,69 @@ function scoreRepoWithPublicCejel(options) {
 }
 function resolvePublicIngestSignals(options) {
   const seen = /* @__PURE__ */ new Set();
-  const explicitFiles = [];
+  const documents = [];
+  const addDocument = (file, provenance) => {
+    const resolved = resolveIngestFilePath(file);
+    if (seen.has(resolved)) return;
+    seen.add(resolved);
+    documents.push({ file: resolved, provenance });
+    if (documents.length > MAX_INGEST_DOCUMENTS) {
+      throw new Error(
+        `Cejel: ${documents.length} unique ingest documents exceed the ${MAX_INGEST_DOCUMENTS} ingest document budget; refusing to produce a partial certificate.`
+      );
+    }
+  };
   for (const pattern of options.ingestPatterns ?? []) {
-    const matches = expandIngestPattern(pattern);
+    const matches = expandIngestPattern(pattern, MAX_INGEST_DOCUMENTS + 1);
     if (matches.length === 0 && options.warnOnEmptyIngestMatch) {
       process.stderr.write(`Cejel: --ingest pattern matched no files: ${pattern}
 `);
     }
     for (const match of matches) {
-      const resolved = resolve2(match);
-      if (seen.has(resolved)) continue;
-      seen.add(resolved);
-      explicitFiles.push(match);
+      addDocument(match, "operator_supplied");
     }
   }
-  const signals = explicitFiles.flatMap(
-    (file) => parseIngestFile(file, { provenance: "operator_supplied" })
-  );
-  if (!options.autoDiscoverIngest) return signals;
-  for (const discovered of discoverIngestInputs(options.repoPath)) {
-    const resolved = resolve2(discovered);
-    if (seen.has(resolved)) continue;
-    seen.add(resolved);
-    signals.push(...parseIngestFile(discovered, { provenance: "auto_discovered" }));
+  if (options.autoDiscoverIngest) {
+    for (const discovered of discoverIngestInputs(
+      options.repoPath,
+      MAX_INGEST_DOCUMENTS + 1
+    )) {
+      addDocument(discovered, "auto_discovered");
+    }
+  }
+  const signals = [];
+  let retainedFindings = 0;
+  for (const document of documents) {
+    const parsed = parseIngestFile(document.file, {
+      maxFindingCandidates: MAX_RETAINED_INGEST_FINDINGS - retainedFindings,
+      provenance: document.provenance
+    });
+    const documentFindings = parsed.reduce((count, signal) => count + signal.findings.length, 0);
+    retainedFindings += documentFindings;
+    if (retainedFindings > MAX_RETAINED_INGEST_FINDINGS) {
+      throw new Error(
+        `Cejel: ${retainedFindings.toLocaleString("en-US")} retained findings exceed the ${MAX_RETAINED_INGEST_FINDINGS.toLocaleString("en-US")} retained ingest finding budget; refusing to truncate evidence.`
+      );
+    }
+    signals.push(...parsed);
   }
   return signals;
 }
 
 // src/product-identity.ts
 init_esm_shims();
-import { existsSync, readFileSync as readFileSync5 } from "fs";
+import { existsSync, lstatSync as lstatSync4, readFileSync as readFileSync5 } from "fs";
 import { basename as basename2, join as join3 } from "path";
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/;
 var FALLBACK_SLUG = "repo";
 var FALLBACK_DISPLAY_NAME = "Repository";
-function deriveProductIdentity(repoPath) {
+function deriveProductIdentity(repoPath, productName) {
   const packageJsonPath = join3(repoPath, "package.json");
-  const raw = readPackageName(packageJsonPath) ?? basename2(repoPath);
-  const displayName = raw.trim().length > 0 ? raw.trim() : FALLBACK_DISPLAY_NAME;
+  const raw = productName ?? readPackageName(packageJsonPath) ?? basename2(repoPath);
+  const displayName = sanitizePresentationLine(raw, {
+    fallback: FALLBACK_DISPLAY_NAME,
+    maxLength: 120
+  });
   return {
     productSlug: slugify(raw),
     productDisplayName: displayName
@@ -7352,6 +8045,8 @@ function deriveProductIdentity(repoPath) {
 function readPackageName(packageJsonPath) {
   if (!existsSync(packageJsonPath)) return void 0;
   try {
+    const stat = lstatSync4(packageJsonPath);
+    if (!stat.isFile() || stat.size > MAX_REPOSITORY_CONTENT_BYTES) return void 0;
     const parsed = JSON.parse(readFileSync5(packageJsonPath, "utf8"));
     if (typeof parsed === "object" && parsed !== null && "name" in parsed) {
       const name = parsed.name;
@@ -7381,7 +8076,7 @@ var METRIC_DERIVED_FINDING_PATTERN2 = /^[A-Z]\d+ metric-derived score is (\d+\.\
 var REMEDIATION_BY_METRIC2 = {
   test_to_source_ratio: "add concrete regression tests for the implementation surface",
   coverage_percent: "configure coverage and publish a measured threshold or report",
-  verification_script_ratio: "add explicit test, lint, and typecheck verification commands",
+  verification_script_ratio: "add the missing test, coverage, lint, or type-check command or a test-runner configuration",
   non_hollow_test_share: "replace skipped or placeholder tests with live assertions",
   env_handling_depth: "document and enforce safe environment-secret handling",
   secret_cleanliness: "remove committed secrets and rotate any exposed credentials",
@@ -7399,7 +8094,7 @@ var REMEDIATION_BY_METRIC2 = {
   claim_match_rate: "align documented product claims with observable repository evidence",
   claim_source_depth: "document concrete, checkable product claims",
   reconciliation_artifact_depth: "publish a claim-to-evidence reconciliation record",
-  pr_merge_ratio: "preserve merged pull-request history in the scanned clone",
+  pr_merge_ratio: "preserve recognizable pull-request references in recent commit subjects",
   pr_trace_primitives: "add pull-request templates and outcome-trace records",
   ci_script_depth: "run the repository verification commands in CI",
   default_branch_ci_depth: "run CI on the default branch and pull requests",
@@ -7509,7 +8204,7 @@ function buildWitanCliSummary(report) {
 
 // src/scan.ts
 function runCejelScan(options) {
-  const identity = deriveProductIdentity(options.repoPath);
+  const identity = deriveProductIdentity(options.repoPath, options.productName);
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
   const report = scoreRepoWithPublicCejel({
     productSlug: identity.productSlug,
@@ -7531,17 +8226,21 @@ function runCejelScan(options) {
 export {
   WitanReportSchema,
   formatExternalSourceLine,
+  CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE,
   CERTIFICATE_GLOSSARY,
   formatCertificateMetricLabel,
   formatCertificateMetricValue,
   buildRelyingPartySummary,
+  WITAN_RUBRIC_VERSION_V22,
+  assertSelectableRubricVersion,
+  isProspectiveRubricVersion,
+  PROSPECTIVE_RUBRIC_NOTICE,
   renderWitanHtmlReport,
   renderWitanBadgeEndpoint,
   renderWitanBadgeSvg,
   serializeWitanReport,
   createWitanAttestation,
   verifyWitanAttestationBinding,
-  WITAN_RUBRIC_VERSION_V22,
   deriveProductIdentity,
   runCejelScan
 };