@cejel/cejel 0.4.5 → 0.4.6

package/dist/{chunk-4IXESHG7.js → chunk-VEJLHO5F.js}

@@ -5,19 +5,21 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-EPK7UTIK.js";
+} from "./chunk-BZXBLDCJ.js";
 import {
   external_exports
-} from "./chunk-KGFGX3TP.js";
+} from "./chunk-Y6NO5HAI.js";
 import {
+  MAX_REPOSITORY_CONTENT_BYTES,
   init_esm_shims,
   readRepoText,
   readRepoTextPrefix,
   recordContentSkip,
+  recordContentSkipForCriteria,
   recordFilesystemSkip,
   trackContentReads,
   withContentReadCriterion
-} from "./chunk-R4DPQLS2.js";
+} from "./chunk-H55KECVT.js";
 
 // src/witan/schemas.ts
 init_esm_shims();
@@ -117,10 +119,26 @@ var WitanEvidencePointerSchema = external_exports.object({
 }).strict().refine((value) => Boolean(value.url ?? value.path ?? value.contentHash), {
   message: "Witan evidence must include a path, url, or content hash."
 });
+var WitanInventoryScanDerivationSchema = external_exports.object({
+  kind: external_exports.literal("inventory-scan"),
+  inventoryScope: external_exports.enum(["tracked-scan-eligible", "tracked-complete"]),
+  inventoryCount: external_exports.number().int().nonnegative(),
+  patternSetId: external_exports.string().min(1).max(180),
+  patternCount: external_exports.number().int().positive(),
+  matchCount: external_exports.number().int().nonnegative()
+}).strict();
+var WitanFindingDerivationSchema = external_exports.discriminatedUnion("kind", [
+  WitanInventoryScanDerivationSchema
+]);
 var WitanFindingSchema = external_exports.object({
   severity: WitanFindingSeveritySchema,
   summary: external_exports.string().min(1).max(500),
-  evidence: WitanEvidencePointerSchema
+  evidence: WitanEvidencePointerSchema,
+  // Absence findings emitted by the native repository detector must name the exact
+  // inventory and versioned pattern set whose zero result supports the proposition.
+  // This remains optional at the shared schema boundary because positive findings and
+  // semantic derivations are separate contracts; native absence emitters require it.
+  derivation: WitanFindingDerivationSchema.optional()
 }).strict();
 var WitanCriterionMetricSchema = external_exports.object({
   name: external_exports.string().min(1).max(80),
@@ -321,6 +339,7 @@ var WitanReportSchema = external_exports.preprocess((value) => {
 }, StrictWitanReportSchema);
 var WITAN_ATTESTATION_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
 var WITAN_ATTESTATION_PREDICATE_TYPE = "https://cejel.dev/attestations/scan/v1";
+var WITAN_REPORT_FORMAT_VERSION = "1.0";
 var WitanAttestationOutcomeSchema = external_exports.discriminatedUnion("status", [
   external_exports.object({
     status: external_exports.literal("scored"),
@@ -350,6 +369,10 @@ var WitanAttestationStatementSchema = external_exports.object({
       version: external_exports.string().min(1).max(80)
     }).strict(),
     generatedAt: external_exports.string().datetime({ offset: true }),
+    // Optional on read for attestations emitted before Evidence Seam v1. New attestations
+    // always carry it, keeping report.json byte-stable while giving paired consumers an
+    // explicit report contract version.
+    reportFormatVersion: external_exports.string().regex(/^1\.\d+$/).optional(),
     rubricVersion: external_exports.string().min(1).max(120),
     repository: external_exports.object({
       productSlug: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/),
@@ -421,7 +444,9 @@ init_esm_shims();
 // src/witan/abstention.ts
 init_esm_shims();
 var WITAN_NO_MEASUREMENT_REASON = "No free-core rubric criterion produced a measurable signal. Cejel abstains rather than publish a numeric zero for an entirely unmeasured repository.";
-var WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the complete tracked inventory contains no concrete test file, configured test runner, CI test command, or coverage configuration.";
+var WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the tracked scan-eligible inventory matched no concrete test file, configured test runner, CI test command, or coverage configuration.";
+var WITAN_DIRECTORY_WALK_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the bounded directory walk matched no concrete test file, configured test runner, CI test command, or coverage configuration.";
+var WITAN_LEGACY_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the complete tracked inventory contains no concrete test file, configured test runner, CI test command, or coverage configuration.";
 function isWitanNoMeasurementAbstention(report) {
   return report.verdict === "insufficient_source" && report.insufficientSourceReason.startsWith(WITAN_NO_MEASUREMENT_REASON) && report.criteria.every(
     ({ status }) => status === "not_applicable" || status === "insufficient_data"
@@ -1027,6 +1052,7 @@ function formatMetricMember(criterion, metric2) {
 }
 
 // src/witan/html.ts
+var CEJEL_CERTIFICATE_FORMAT_VERSION = "1.0";
 function renderWitanHtmlReport(report, options = {}) {
   const codeCriteria = criteriaByCategory(report, "code_trust");
   const processCriteria = criteriaByCategory(report, "process_trust");
@@ -1045,6 +1071,7 @@ function renderWitanHtmlReport(report, options = {}) {
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="cejel-certificate-format" content="${CEJEL_CERTIFICATE_FORMAT_VERSION}">
   <title>Cejel Trust Certificate - ${escapeHtml(report.productDisplayName)}</title>
   <style>${CERTIFICATE_CSS}</style>
 </head>
@@ -1639,6 +1666,7 @@ function createWitanAttestation(report, options) {
     predicate: {
       tool: { name: "cejel", version: options.toolVersion },
       generatedAt: options.generatedAt,
+      reportFormatVersion: WITAN_REPORT_FORMAT_VERSION,
       rubricVersion: report.rubricVersion,
       repository: {
         productSlug: report.productSlug,
@@ -1724,6 +1752,23 @@ init_esm_shims();
 // src/witan/markdown.ts
 init_esm_shims();
 
+// src/presentation-safety.ts
+init_esm_shims();
+var PRESENTATION_CONTROL_PATTERN = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+function sanitizePresentationLine(value, options) {
+  const withoutControls = value.replace(PRESENTATION_CONTROL_PATTERN, "").trim();
+  const safeValue = withoutControls.length > 0 ? withoutControls : options.fallback;
+  if (safeValue.length <= options.maxLength) return safeValue;
+  const ellipsis = ".".repeat(Math.min(3, options.maxLength));
+  const contentLimit = Math.max(options.maxLength - ellipsis.length, 0);
+  let prefix = "";
+  for (const character of safeValue) {
+    if (prefix.length + character.length > contentLimit) break;
+    prefix += character;
+  }
+  return `${prefix}${ellipsis}`;
+}
+
 // src/witan/repo-signals.ts
 init_esm_shims();
 import { createHash as createHash2 } from "crypto";
@@ -1745,6 +1790,71 @@ function stripBom(text) {
 function usesV17DetectorClosure(rubricVersion) {
   return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
 }
+var LEGACY_INVENTORY_ABSENCE_CONTEXT = {
+  rubricGeneration: "legacy",
+  inventoryProvenance: "directory-walk"
+};
+var INVENTORY_SCAN_PATTERN_SETS = {
+  a1AuthenticatedAbsence: {
+    id: "cejel.core-a1.test-integrity-surface.v1",
+    count: 4
+  },
+  a1ConcreteTests: {
+    id: "cejel.core-a1.concrete-test-files.v1",
+    count: 16
+  },
+  a1CoverageConfiguration: {
+    id: "cejel.core-a1.coverage-configuration.v1",
+    count: 10
+  },
+  a2CurrentSecret: {
+    id: "cejel.core-a2.current-secret-shape.v1",
+    count: 3
+  },
+  a2RlsPolicy: {
+    id: "cejel.core-a2.rls-policy.v1",
+    count: 3
+  },
+  a3CiOrReleaseDeploy: {
+    id: "cejel.core-a3.ci-or-release-deploy.v1",
+    count: 12
+  },
+  a4Lockfile: {
+    id: "cejel.core-a4.lockfile.v1",
+    count: 11
+  },
+  a5ClaimRealityArtifact: {
+    id: "cejel.core-a5.claim-reality-artifact.v1",
+    count: 3
+  }
+};
+function inventoryScanDerivation(inventoryCount, patternSet, matchCount) {
+  return {
+    kind: "inventory-scan",
+    inventoryScope: "tracked-scan-eligible",
+    inventoryCount,
+    patternSetId: patternSet.id,
+    patternCount: patternSet.count,
+    matchCount
+  };
+}
+function inventoryAbsenceFinding(options) {
+  const { context, summaries } = options;
+  const summary = context.rubricGeneration === "legacy" ? summaries.legacy : context.inventoryProvenance === "tracked-scan-eligible" ? summaries.currentTracked : summaries.currentDirectoryWalk;
+  const emitsDerivation = context.rubricGeneration === "current" && context.inventoryProvenance === "tracked-scan-eligible";
+  return {
+    severity: options.severity,
+    summary,
+    evidence: options.evidence,
+    ...emitsDerivation ? {
+      derivation: inventoryScanDerivation(
+        options.inventoryCount,
+        options.patternSet,
+        options.matchCount
+      )
+    } : {}
+  };
+}
 function buildWitanInputFromRepo(options) {
   const tracked = trackContentReads(options.repoPath, () => buildWitanInputFromRepoUntracked(options));
   const affectedCriteria = tracked.affectedCriteria;
@@ -1783,6 +1893,10 @@ function buildWitanInputFromRepoUntracked(options) {
   const inventoryFiles = fileInventory.inventoryFiles;
   const ignoredTargetReason = repoFiles.length === 0 ? explainIgnoredScanTarget(options.repoPath) : void 0;
   const usesV17Detectors = usesV17DetectorClosure(rubricVersion);
+  const inventoryAbsenceContext = {
+    rubricGeneration: usesV17Detectors ? "current" : "legacy",
+    inventoryProvenance: fileInventory.repoFileInventoryScope === "tracked-scan-eligible" ? "tracked-scan-eligible" : "directory-walk"
+  };
   const usesV18NativeRls = rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
   const usesV19CommitYear = rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
   const usesV20A3ExplicitGaps = rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
@@ -1824,6 +1938,7 @@ function buildWitanInputFromRepoUntracked(options) {
     usesV21ExecutedEscalations,
     usesV22PackageStartEntrypoint,
     reviewableSourceProof,
+    inventoryAbsenceContext,
     scanLimitations
   );
   const archetype = usesV17Detectors && reviewableSourceProof?.passes === true && isV17RescuableAbstention(gatedArchetype.abstentionKind) && coreSignals.some(isMeasuredCriterionSignal) ? {
@@ -1833,7 +1948,10 @@ function buildWitanInputFromRepoUntracked(options) {
   } : gatedArchetype;
   return {
     productSlug: options.productSlug,
-    productDisplayName: options.productDisplayName,
+    productDisplayName: sanitizePresentationLine(options.productDisplayName, {
+      fallback: "Repository",
+      maxLength: 120
+    }),
     repo: {
       ...headSha ? { headSha } : {}
     },
@@ -2430,7 +2548,7 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, reviewableSourceProof, scanLimitations = /* @__PURE__ */ new Set()) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
   const signals = [];
   const mono = resolveMonorepoContext(repoPath, scanLimitations);
   const collectCriterion = (criterionId, collect) => withContentReadCriterion(criterionId, collect);
@@ -2442,7 +2560,8 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV27Detectors,
       useV33Detectors,
       useV36Detectors,
-      reviewableSourceProof
+      reviewableSourceProof,
+      inventoryAbsenceContext
     )
   );
   const a2Signal = collectCriterion(
@@ -2456,6 +2575,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV39Detectors,
       useV47Detectors,
       useV18NativeRls,
+      inventoryAbsenceContext,
       scanLimitations
     )
   );
@@ -2466,7 +2586,8 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       repoFiles,
       useV27Detectors,
       useV20A3ExplicitGaps,
-      useV22PackageStartEntrypoint
+      useV22PackageStartEntrypoint,
+      inventoryAbsenceContext
     )
   );
   const a4Signal = collectCriterion(
@@ -2476,12 +2597,18 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       repoFiles,
       mono,
       useV27Detectors,
-      useV47Detectors
+      useV47Detectors,
+      inventoryAbsenceContext
     )
   );
   const a5Signal = collectCriterion(
     "A5",
-    () => collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors)
+    () => collectA5ClaimRealityEvidence(
+      repoPath,
+      repoFiles,
+      useV27Detectors,
+      inventoryAbsenceContext
+    )
   );
   const b1Signal = buildNotApplicableSignal(
     "B1",
@@ -2532,7 +2659,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
   }
   return signals;
 }
-function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, reviewableSourceProof) {
+function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const evidence = [];
   const findings = [];
   const allTestFiles = findConcreteTestFiles(
@@ -2629,7 +2756,12 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
     }
   }
   if (evidence.length === 0 && findings.length === 0 && configuredRunnerFiles.length === 0) {
-    return reviewableSourceProof?.passes === true && reviewableSourceProof.firstReadablePath ? buildA1AuthenticatedAbsenceSignal(repoPath, reviewableSourceProof) : null;
+    return reviewableSourceProof?.passes === true && reviewableSourceProof.firstReadablePath ? buildA1AuthenticatedAbsenceSignal(
+      repoPath,
+      reviewableSourceProof,
+      repoFiles.length,
+      inventoryAbsenceContext
+    ) : null;
   }
   if (testFiles.length === 0) {
     const fallback = configuredRunnerFiles[0] ? evidenceForRelative(
@@ -2639,11 +2771,21 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
       "Configured test runner"
     ) : useV33Detectors ? void 0 : evidence[0] ?? findings[0]?.evidence;
     if (fallback) {
-      findings.push({
-        severity: "warning",
-        summary: "A test runner is configured, but no concrete test files were detected.",
-        evidence: fallback
-      });
+      findings.push(
+        inventoryAbsenceFinding({
+          severity: "warning",
+          summaries: {
+            legacy: "A test runner is configured, but no concrete test files were detected.",
+            currentTracked: "A test runner is configured, but the tracked scan-eligible inventory matched no concrete test file.",
+            currentDirectoryWalk: "A test runner is configured, but the bounded directory walk matched no concrete test file."
+          },
+          evidence: fallback,
+          context: inventoryAbsenceContext,
+          inventoryCount: repoFiles.length,
+          patternSet: INVENTORY_SCAN_PATTERN_SETS.a1ConcreteTests,
+          matchCount: 0
+        })
+      );
     }
   } else if (coverageFiles.length === 0 && (!useV33Detectors || configuredRunnerFiles.length > 0)) {
     if (isLeanTestToolchain) {
@@ -2661,11 +2803,21 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
     } else {
       const firstEvidence = evidence[0];
       if (!firstEvidence) return null;
-      findings.push({
-        severity: "info",
-        summary: "Test suite files are present, but no coverage configuration was detected.",
-        evidence: firstEvidence
-      });
+      findings.push(
+        inventoryAbsenceFinding({
+          severity: "info",
+          summaries: {
+            legacy: "Test suite files are present, but no coverage configuration was detected.",
+            currentTracked: "Test suite files are present, but the tracked scan-eligible inventory matched no coverage configuration.",
+            currentDirectoryWalk: "Test suite files are present, but the bounded directory walk matched no coverage configuration."
+          },
+          evidence: firstEvidence,
+          context: inventoryAbsenceContext,
+          inventoryCount: repoFiles.length,
+          patternSet: INVENTORY_SCAN_PATTERN_SETS.a1CoverageConfiguration,
+          matchCount: 0
+        })
+      );
     }
   }
   const nonHollowShare = measureNonHollowTestShare(
@@ -2738,7 +2890,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
     notes: "A1 is detected from real test files, test runner configuration, and optional coverage configuration."
   };
 }
-function buildA1AuthenticatedAbsenceSignal(repoPath, proof) {
+function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inventoryAbsenceContext) {
   const sourcePath = proof.firstReadablePath;
   if (!sourcePath) {
     throw new Error("Cejel invariant: a passing reviewable-source proof must have a readable path");
@@ -2753,11 +2905,19 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof) {
     criterionId: "A1",
     positiveEvidence: [anchor],
     findings: [
-      {
+      inventoryAbsenceFinding({
         severity: "critical",
-        summary: WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY,
-        evidence: anchor
-      }
+        summaries: {
+          legacy: WITAN_LEGACY_AUTHENTICATED_A1_ABSENCE_SUMMARY,
+          currentTracked: WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY,
+          currentDirectoryWalk: WITAN_DIRECTORY_WALK_AUTHENTICATED_A1_ABSENCE_SUMMARY
+        },
+        evidence: anchor,
+        context: inventoryAbsenceContext,
+        inventoryCount,
+        patternSet: INVENTORY_SCAN_PATTERN_SETS.a1AuthenticatedAbsence,
+        matchCount: 0
+      })
     ],
     metrics: [
       metric(
@@ -2811,7 +2971,7 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof) {
     notes: `V17 authenticated absence: ${proof.eligibleSourceFileCount} criterion-ratable of ${proof.sourceShapedFileCount} source-shaped files; sampled ${proof.sampledFileCount}; ${proof.readableSampledFileCount} representative-text files.`
   };
 }
-function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, scanLimitations) {
+function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, inventoryAbsenceContext, scanLimitations) {
   const evidence = [];
   const findings = [];
   const gitignore = repoFiles.find((file) => basename(file) === ".gitignore");
@@ -2964,16 +3124,26 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       )
     });
   } else if (committedEnvFilePath) {
-    findings.push({
-      severity: useV33Detectors ? "info" : "warning",
-      summary: "A non-template .env file is committed in the current repository tree; no secret-shaped value was detected.",
-      evidence: evidenceForRelative(
-        repoPath,
-        committedEnvFilePath,
-        "secret_scan",
-        "Committed .env file (no confirmed secret value found)"
-      )
-    });
+    findings.push(
+      inventoryAbsenceFinding({
+        severity: useV33Detectors ? "info" : "warning",
+        summaries: {
+          legacy: "A non-template .env file is committed in the current repository tree; no secret-shaped value was detected.",
+          currentTracked: "A tracked non-template .env file is present, while the bounded scan over the tracked scan-eligible inventory matched no secret-shaped value.",
+          currentDirectoryWalk: "A non-template .env file is present in the bounded directory walk, which matched no secret-shaped value."
+        },
+        evidence: evidenceForRelative(
+          repoPath,
+          committedEnvFilePath,
+          "secret_scan",
+          "Committed .env file (no confirmed secret value found)"
+        ),
+        context: inventoryAbsenceContext,
+        inventoryCount: repoFiles.length,
+        patternSet: INVENTORY_SCAN_PATTERN_SETS.a2CurrentSecret,
+        matchCount: 0
+      })
+    );
   }
   if (historySecretScan?.evidence) {
     const historyPath = historySecretScan.evidence.path ?? "";
@@ -3005,16 +3175,26 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   if (hasTenantWithoutRlsGap) {
     const gapEvidence = rlsMigration ?? tenantScopedFile ?? tenantWithoutRlsPremiseFiles[0];
     if (gapEvidence) {
-      findings.push({
-        severity: "warning",
-        summary: "Tenant-scoped schema detected but no row-level-security policies found \u2014 isolation gap.",
-        evidence: evidenceForRelative(
-          repoPath,
-          gapEvidence,
-          "artifact",
-          "Tenant schema without RLS policies"
-        )
-      });
+      findings.push(
+        inventoryAbsenceFinding({
+          severity: "warning",
+          summaries: {
+            legacy: "Tenant-scoped schema detected but no row-level-security policies found \u2014 isolation gap.",
+            currentTracked: "A tenant-scoped schema signal is present, while the tracked scan-eligible inventory matched no row-level-security policy.",
+            currentDirectoryWalk: "A tenant-scoped schema signal is present, while the bounded directory walk matched no row-level-security policy."
+          },
+          evidence: evidenceForRelative(
+            repoPath,
+            gapEvidence,
+            "artifact",
+            "Tenant schema without RLS policies"
+          ),
+          context: inventoryAbsenceContext,
+          inventoryCount: repoFiles.length,
+          patternSet: INVENTORY_SCAN_PATTERN_SETS.a2RlsPolicy,
+          matchCount: 0
+        })
+      );
     }
   }
   evidence.push(...cryptoHygiene.evidence);
@@ -3199,7 +3379,7 @@ function collectCryptoHygieneEvidence(repoPath, implFiles, useV39Detectors = fal
   }
   return { evidence, findings, hasSurface, clean: hasSurface && !insecureFound };
 }
-function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, useV20ExplicitGaps = false, useV22PackageStartEntrypoint = false) {
+function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, useV20ExplicitGaps = false, useV22PackageStartEntrypoint = false, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const v20DirectHttpEntrypoint = useV20ExplicitGaps ? findV20DirectHttpServerEntrypointFile(repoPath, repoFiles) : null;
   const v22PackageStartHttpEntrypoint = useV22PackageStartEntrypoint ? findV22PackageStartHttpServerEntrypointFile(repoPath, repoFiles) : null;
   const v20RuntimeContainer = useV20ExplicitGaps ? findRuntimeContainerEntrypointFile(repoPath, repoFiles, true) : null;
@@ -3361,11 +3541,21 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
   if (!workflow && releaseDeployConfigs.length === 0) {
     const firstEvidence = evidence[0];
     if (!firstEvidence) return null;
-    findings.push({
-      severity: "info",
-      summary: "A deployable service surface exists, but no CI or release-deployment automation was detected.",
-      evidence: firstEvidence
-    });
+    findings.push(
+      inventoryAbsenceFinding({
+        severity: "info",
+        summaries: {
+          legacy: "A deployable service surface exists, but no CI or release-deployment automation was detected.",
+          currentTracked: "A deployable service signal is present, while the tracked scan-eligible inventory matched no CI workflow or release-deployment automation.",
+          currentDirectoryWalk: "A deployable service signal is present, while the bounded directory walk matched no CI workflow or release-deployment automation."
+        },
+        evidence: firstEvidence,
+        context: inventoryAbsenceContext,
+        inventoryCount: repoFiles.length,
+        patternSet: INVENTORY_SCAN_PATTERN_SETS.a3CiOrReleaseDeploy,
+        matchCount: 0
+      })
+    );
   }
   return {
     criterionId: "A3",
@@ -3435,7 +3625,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
     ]
   };
 }
-function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors, useV47Detectors) {
+function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors, useV47Detectors, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const evidence = [];
   const findings = [];
   const manifests = repoFiles.filter(isDependencyManifest);
@@ -3488,11 +3678,26 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors,
   const deployableServiceFiles = useV47Detectors ? findDeployableServicePremiseFiles(repoPath, repoFiles, true) : [];
   const isAppOrService = (useV47Detectors ? deployableServiceFiles.length > 0 : isDeployableService(repoPath, repoFiles, useV27Detectors)) || packagedApplicationFiles.length > 0;
   if (isAppOrService && !hasLockfile && manifest) {
-    findings.push({
-      severity: "critical",
-      summary: "Dependency manifest is present without a detected lockfile \u2014 non-reproducible installs.",
-      evidence: evidenceForRelative(repoPath, manifest, "dependency_report", "Dependency manifest")
-    });
+    findings.push(
+      inventoryAbsenceFinding({
+        severity: "critical",
+        summaries: {
+          legacy: "Dependency manifest is present without a detected lockfile \u2014 non-reproducible installs.",
+          currentTracked: "Dependency manifest is present, but the tracked scan-eligible inventory matched no recognized lockfile.",
+          currentDirectoryWalk: "Dependency manifest is present, but the bounded directory walk matched no recognized lockfile."
+        },
+        evidence: evidenceForRelative(
+          repoPath,
+          manifest,
+          "dependency_report",
+          "Dependency manifest"
+        ),
+        context: inventoryAbsenceContext,
+        inventoryCount: repoFiles.length + (mono?.sharedFiles.length ?? 0),
+        patternSet: INVENTORY_SCAN_PATTERN_SETS.a4Lockfile,
+        matchCount: 0
+      })
+    );
   }
   if (manifest && hasSuspiciousDependencies(repoPath, manifest, useV47Detectors)) {
     findings.push({
@@ -3600,7 +3805,7 @@ function hasDeclaredVersionConstraint(dependency) {
   if (/[~^<>=!]/.test(trimmed)) return true;
   return /^v?\d/.test(trimmed);
 }
-function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors) {
+function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const reconciliationArtifacts = useV27Detectors ? findClaimRealityReconciliationArtifacts(repoPath, repoFiles) : [];
   const claimSourceFiles = useV27Detectors ? findClaimSourceFiles(repoFiles) : repoFiles.filter(
     (file) => /^(?:README|readme)\.md$/.test(file) || /^docs\/[^/]+\.(?:md|mdx)$/.test(file)
@@ -3665,15 +3870,23 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors) {
     criterionId: "A5",
     positiveEvidence: evidence,
     findings: reconciliationArtifacts.length > 0 ? [] : [
-      {
+      inventoryAbsenceFinding({
         // Proxy-only A5: cap at warning (never critical) — a static proxy is lower-confidence
         // than a curated registry or reconciliation artifact. Downgraded to info when the repo
         // documents honest negative space: that scoping IS a form of claim-reality discipline,
         // not an additional gap on top of the missing dedicated artifact.
         severity: negativeSpaceDoc ? "info" : "warning",
-        summary: negativeSpaceDoc ? "Claim source and implementation files are present; no dedicated claim-reality report artifact was supplied, but the repo explicitly documents what it does NOT cover/protect against \u2014 honest scoping, not overclaiming." : "Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied.",
-        evidence: firstEvidence
-      }
+        summaries: {
+          legacy: negativeSpaceDoc ? "Claim source and implementation files are present; no dedicated claim-reality report artifact was supplied, but the repo explicitly documents what it does NOT cover/protect against \u2014 honest scoping, not overclaiming." : "Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied.",
+          currentTracked: negativeSpaceDoc ? "Claim-source and implementation-file signals are present, while the tracked scan-eligible inventory matched no dedicated claim-reality report artifact; the repo separately documents what it does NOT cover or protect against." : "Claim-source and implementation-file signals are present, while the tracked scan-eligible inventory matched no dedicated claim-reality report artifact.",
+          currentDirectoryWalk: negativeSpaceDoc ? "Claim-source and implementation-file signals are present, while the bounded directory walk matched no dedicated claim-reality report artifact; the repo separately documents what it does NOT cover or protect against." : "Claim-source and implementation-file signals are present, while the bounded directory walk matched no dedicated claim-reality report artifact."
+        },
+        evidence: firstEvidence,
+        context: inventoryAbsenceContext,
+        inventoryCount: repoFiles.length,
+        patternSet: INVENTORY_SCAN_PATTERN_SETS.a5ClaimRealityArtifact,
+        matchCount: 0
+      })
     ],
     // Recalibrated (goal_cejel_launch_hardening_combined_2026-07-06, Phase 3 H1):
     // reconciliation_artifact_depth is usually 0 on the generic-proxy path, so its prior 0.3
@@ -4021,7 +4234,7 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detecto
     const isV21ExecutedShape = v21ExecutedEscalationFileSet.has(file);
     findings.push({
       severity: "critical",
-      summary: isV21ExecutedShape ? "An authored SQL artifact contains, or a direct database-driver call executes, an administrative role grant, SUPERUSER escalation, or schema-wide table privilege grant with no documented human gate." : "Role-membership GRANT or SUPERUSER escalation executes in code with no documented human gate.",
+      summary: isV21ExecutedShape ? "This file contains an authored administrative SQL statement \u2014 role-membership grant, SUPERUSER escalation, or schema-wide table privilege grant \u2014 or executes one through a direct database-driver call, and does not itself contain text matching the human-gate marker pattern." : "This file executes a role-membership GRANT or SUPERUSER escalation and does not itself contain text matching the human-gate marker pattern.",
       evidence: evidenceForRelative(
         repoPath,
         file,
@@ -4348,10 +4561,20 @@ function parseGitTrackedFiles(repoPath, output, includeHardExcluded) {
       continue;
     }
     try {
-      if (!lstatSync(fullPath).isFile()) {
+      const stat = lstatSync(fullPath);
+      if (!stat.isFile()) {
         recordContentSkip(fullPath, "non_regular_file", true);
         continue;
       }
+      if (stat.size > MAX_REPOSITORY_CONTENT_BYTES) {
+        const affectedCriteria = affectedCriteriaForUnavailablePath(file);
+        if (affectedCriteria.length > 0) {
+          recordContentSkipForCriteria(fullPath, "too_large", affectedCriteria, true);
+        } else {
+          recordContentSkip(fullPath, "too_large", true);
+        }
+        continue;
+      }
     } catch (error) {
       recordFilesystemSkip(fullPath, error, false, true);
       continue;
@@ -4363,6 +4586,39 @@ function parseGitTrackedFiles(repoPath, output, includeHardExcluded) {
   }
   return files.sort();
 }
+function affectedCriteriaForUnavailablePath(file) {
+  const affected = /* @__PURE__ */ new Set();
+  if (isDependencyManifest(file) || isLockfile(file)) affected.add("A4");
+  if (isCiWorkflow(file)) {
+    affected.add("A1");
+    affected.add("A3");
+    affected.add("B2");
+    affected.add("B3");
+  }
+  if (isDeployConfig(file)) {
+    affected.add("A3");
+    affected.add("B2");
+  }
+  if (isTestFile(file)) {
+    affected.add("A1");
+    affected.add("A2");
+  }
+  if (isImplementationFile(file)) {
+    affected.add("A1");
+    affected.add("A2");
+    affected.add("A3");
+    affected.add("B1");
+    affected.add("B6");
+  }
+  if (/\.(?:md|mdx|rst|txt)$/i.test(file)) {
+    affected.add("A5");
+    affected.add("B4");
+    affected.add("B5");
+    affected.add("B6");
+  }
+  if (isAuditFile(file)) affected.add("B5");
+  return [...affected];
+}
 function directoryInventory(repoPath) {
   const files = [];
   const rootDevice = statSync(repoPath).dev;
@@ -4375,6 +4631,7 @@ function collectRepoFileInventory(repoPath) {
     return {
       repoFiles: parseGitTrackedFiles(repoPath, tracked.stdout, false),
       inventoryFiles: parseGitTrackedFiles(repoPath, tracked.stdout, true),
+      repoFileInventoryScope: "tracked-scan-eligible",
       scanLimitations: []
     };
   }
@@ -4482,8 +4739,13 @@ function visitRepoDir(repoPath, dirPath, files, rootDevice) {
       continue;
     }
     const repoRelativePath = relative(repoPath, fullPath);
-    if (size > 512e3) {
-      recordContentSkip(fullPath, "too_large");
+    if (size > MAX_REPOSITORY_CONTENT_BYTES) {
+      const affectedCriteria = affectedCriteriaForUnavailablePath(repoRelativePath);
+      if (affectedCriteria.length > 0) {
+        recordContentSkipForCriteria(fullPath, "too_large", affectedCriteria);
+      } else {
+        recordContentSkip(fullPath, "too_large");
+      }
       continue;
     }
     if (!isPotentialContentPath(repoRelativePath)) {
@@ -6475,12 +6737,11 @@ function hasEnvPathInGitHistory(repoPath, scanLimitations) {
 
 // src/witan/public-scan.ts
 init_esm_shims();
-import { resolve as resolve2 } from "path";
 
 // src/witan/ingest.ts
 init_esm_shims();
-import { readFileSync as readFileSync4, readdirSync as readdirSync2 } from "fs";
-import { join as join2 } from "path";
+import { lstatSync as lstatSync3, opendirSync, readFileSync as readFileSync4, realpathSync as realpathSync3 } from "fs";
+import { join as join2, resolve as resolve3 } from "path";
 
 // src/witan/finding-limits.ts
 init_esm_shims();
@@ -6504,49 +6765,118 @@ function clampFinding(finding) {
 // src/witan/generic-adapter.ts
 init_esm_shims();
 import { readFileSync } from "fs";
-var VALID_DIMENSIONS = /* @__PURE__ */ new Set([
-  "A1",
-  "A2",
-  "A3",
-  "A4",
-  "A5",
-  "B1",
-  "B2",
-  "B3",
-  "B4",
-  "B5",
-  "B6"
-]);
-var VALID_SEVERITIES = /* @__PURE__ */ new Set(["critical", "warning", "info"]);
+
+// src/witan/ingest-files.ts
+init_esm_shims();
+import { lstatSync as lstatSync2, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname2, isAbsolute, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
+var MAX_INGEST_DOCUMENT_BYTES = 8 * 1024 * 1024;
+function isContainedPath(candidate, directory) {
+  const relativePath = relative2(directory, candidate);
+  return relativePath === "" || relativePath !== ".." && !relativePath.startsWith(`..${sep2}`) && !isAbsolute(relativePath);
+}
+function isMissingIngestPath(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function resolveIngestFilePath(filePath, inputDirectory = dirname2(filePath)) {
+  const lexicalDirectory = resolve2(inputDirectory);
+  const lexicalCandidate = resolve2(filePath);
+  const directoryStat = lstatSync2(lexicalDirectory);
+  if (directoryStat.isSymbolicLink()) {
+    throw new Error(`Cejel: refusing symlinked ingest directory: ${inputDirectory}`);
+  }
+  if (!directoryStat.isDirectory()) {
+    throw new Error(`Cejel: refusing non-directory ingest boundary: ${inputDirectory}`);
+  }
+  const candidateStat = lstatSync2(lexicalCandidate);
+  if (candidateStat.isSymbolicLink()) {
+    throw new Error(`Cejel: refusing symlinked ingest file: ${filePath}`);
+  }
+  if (!candidateStat.isFile()) {
+    throw new Error(`Cejel: refusing non-regular ingest file: ${filePath}`);
+  }
+  if (candidateStat.size > MAX_INGEST_DOCUMENT_BYTES) {
+    throw new Error(
+      `Cejel: ingest file exceeds the ${MAX_INGEST_DOCUMENT_BYTES.toLocaleString("en-US")} byte budget: ${filePath}`
+    );
+  }
+  const resolvedDirectory = realpathSync2(lexicalDirectory);
+  const resolvedCandidate = realpathSync2(lexicalCandidate);
+  if (!isContainedPath(resolvedCandidate, resolvedDirectory)) {
+    throw new Error(`Cejel: refusing ingest file outside its resolved input directory: ${filePath}`);
+  }
+  return resolvedCandidate;
+}
+function isResolvedIngestPathContained(candidate, directory) {
+  return isContainedPath(candidate, directory);
+}
+
+// src/witan/generic-adapter.ts
+var CEJEL_GENERIC_INGEST_CONTRACT_VERSION = "1.0";
+var CEJEL_GENERIC_INGEST_CONTRACT_MAJOR = 1;
+var GenericFindingV1Schema = external_exports.object({
+  ruleId: external_exports.string().min(1),
+  severity: external_exports.enum(["critical", "warning", "info"]),
+  message: external_exports.string().min(1),
+  location: external_exports.string().min(1).optional()
+}).passthrough();
+var GenericSignalV1Schema = external_exports.object({
+  dimension: external_exports.enum(["A1", "A2", "A3", "A4", "A5", "B1", "B2", "B3", "B4", "B5", "B6"]),
+  weight: external_exports.number().min(0).max(1).default(0.5),
+  findings: external_exports.array(GenericFindingV1Schema).min(1)
+}).passthrough();
+var GenericSignalDocumentV1Schema = external_exports.object({
+  version: external_exports.string().regex(/^1\.\d+$/),
+  tool: external_exports.string().trim().min(1),
+  signals: external_exports.array(GenericSignalV1Schema)
+}).passthrough();
 function isGenericSignalDocument(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
   const doc = raw;
   return typeof doc.tool === "string" && doc.tool.length > 0 && Array.isArray(doc.signals);
 }
+function assertSupportedContractVersion(version) {
+  if (typeof version !== "string") {
+    throw new Error(
+      `Cejel: generic ingest contract version is required; expected "version": "${CEJEL_GENERIC_INGEST_CONTRACT_VERSION}". Refusing to guess an unversioned contract.`
+    );
+  }
+  const match = /^(\d+)\.(\d+)$/.exec(version);
+  if (!match) {
+    throw new Error(
+      `Cejel: invalid generic ingest contract version "${version}"; expected <major>.<minor> (current ${CEJEL_GENERIC_INGEST_CONTRACT_VERSION}).`
+    );
+  }
+  const major = Number(match[1]);
+  if (major !== CEJEL_GENERIC_INGEST_CONTRACT_MAJOR) {
+    throw new Error(
+      `Cejel: unsupported generic ingest contract major version ${major} (declared "${version}"); this Cejel build supports major ${CEJEL_GENERIC_INGEST_CONTRACT_MAJOR}. Refusing to guess.`
+    );
+  }
+}
+function formatValidationIssues(error) {
+  return error.issues.map((issue) => `${issue.path.length > 0 ? issue.path.join(".") : "<document>"}: ${issue.message}`).join("; ");
+}
 function parseGenericJson(raw) {
   if (!isGenericSignalDocument(raw)) return [];
-  const source = raw.tool ?? "unknown";
-  const signals = [];
-  for (const signal of raw.signals ?? []) {
-    const dimension = signal.dimension;
-    if (!dimension || !VALID_DIMENSIONS.has(dimension)) continue;
-    const weight = typeof signal.weight === "number" && Number.isFinite(signal.weight) ? Math.min(Math.max(signal.weight, 0), 1) : 0.5;
-    const findings = [];
-    for (const finding of signal.findings ?? []) {
-      const severity = finding.severity;
-      if (!severity || !VALID_SEVERITIES.has(severity)) continue;
-      const ruleId = finding.ruleId ?? "unknown";
-      findings.push({
-        ruleId,
-        severity,
-        message: finding.message ?? ruleId,
-        ...finding.location ? { location: finding.location } : {}
-      });
-    }
-    if (findings.length === 0) continue;
-    signals.push({ source, dimension, weight, findings });
+  assertSupportedContractVersion(raw.version);
+  const parsed = GenericSignalDocumentV1Schema.safeParse(raw);
+  if (!parsed.success) {
+    throw new Error(
+      `Cejel: invalid generic ingest contract v${raw.version}: ${formatValidationIssues(parsed.error)}`
+    );
   }
-  return signals;
+  return parsed.data.signals.map((signal) => ({
+    source: parsed.data.tool,
+    dimension: signal.dimension,
+    weight: signal.weight,
+    findings: signal.findings.map((finding) => ({
+      ruleId: finding.ruleId,
+      severity: finding.severity,
+      message: finding.message,
+      ...finding.location ? { location: finding.location } : {}
+    }))
+  }));
 }
 
 // src/witan/sarif-adapter.ts
@@ -6808,30 +7138,35 @@ function rawToolName(raw) {
 }
 var MAX_INGEST_SOURCE_LENGTH = 120;
 function sanitizeIngestSource(source) {
-  const withoutControls = source.replace(/[\p{Cc}\p{Cf}]/gu, "").trim();
-  const safeSource = withoutControls.length > 0 ? withoutControls : "unknown";
-  const codePoints = Array.from(safeSource);
-  if (codePoints.length <= MAX_INGEST_SOURCE_LENGTH) return safeSource;
-  return `${codePoints.slice(0, MAX_INGEST_SOURCE_LENGTH - 3).join("")}...`;
+  return sanitizePresentationLine(source, {
+    fallback: "unknown",
+    maxLength: MAX_INGEST_SOURCE_LENGTH
+  });
 }
 function parseIngestFile(filePath, options = {}) {
+  const resolvedFilePath = resolveIngestFilePath(filePath);
   let raw;
   try {
-    raw = JSON.parse(stripBom(readFileSync4(filePath, "utf8")));
+    raw = JSON.parse(stripBom(readFileSync4(resolvedFilePath, "utf8")));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Cejel: could not parse ingest file as JSON: ${filePath} (${message})`);
   }
+  const rawCount = countRawEntries(raw);
+  if (options.maxFindingCandidates !== void 0 && rawCount > options.maxFindingCandidates) {
+    throw new Error(
+      `Cejel: ${rawCount.toLocaleString("en-US")} ingest finding candidates exceed the ${options.maxFindingCandidates.toLocaleString("en-US")} remaining retained ingest finding budget; refusing before adapter materialization.`
+    );
+  }
   let signals;
   if (looksLikeSarif(raw)) signals = parseSarifJson(raw, options.extraSarifDimensionRules);
   else if (looksLikeScorecard(raw)) signals = parseScorecardJson(raw);
   else if (isGenericSignalDocument(raw)) signals = parseGenericJson(raw);
   if (!signals) {
     throw new Error(
-      `Cejel: unrecognized ingest file format: ${filePath} \u2014 expected SARIF (a "runs" array), OpenSSF Scorecard JSON (a "checks" array), or the generic Cejel external-signal shape (a "tool" string + "signals" array). See the cejel README "Aggregate your scanners".`
+      `Cejel: unrecognized ingest file format: ${filePath} \u2014 expected SARIF (a "runs" array), OpenSSF Scorecard JSON (a "checks" array), or the versioned generic Cejel external-signal shape (a "version" string + "tool" string + "signals" array). See the cejel README "Aggregate your scanners".`
     );
   }
-  const rawCount = countRawEntries(raw);
   const mappedCount = signals.reduce((sum, signal) => sum + signal.findings.length, 0);
   if (rawCount > 0 && mappedCount === 0) {
     process.stderr.write(
@@ -6846,30 +7181,83 @@ function parseIngestFile(filePath, options = {}) {
     findings: signal.findings.map(clampFinding)
   }));
 }
-function expandIngestPattern(pattern) {
+function expandIngestPattern(pattern, maxMatches = Number.POSITIVE_INFINITY) {
   if (!pattern.includes("*")) return [pattern];
   const lastSlash = pattern.lastIndexOf("/");
   const dir = lastSlash === -1 ? "." : pattern.slice(0, lastSlash);
   const filePattern = lastSlash === -1 ? pattern : pattern.slice(lastSlash + 1);
   const regexSource = filePattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
   const regex = new RegExp(`^${regexSource}$`);
-  let entries;
+  const entries = [];
   try {
-    entries = readdirSync2(dir);
-  } catch {
+    const directoryStat = lstatSync3(resolve3(dir));
+    if (directoryStat.isSymbolicLink()) {
+      throw new Error(`Cejel: refusing symlinked ingest directory: ${dir}`);
+    }
+    if (!directoryStat.isDirectory()) return [];
+    const directory = opendirSync(dir);
+    try {
+      for (; ; ) {
+        const entry = directory.readSync();
+        if (!entry) break;
+        if (!regex.test(entry.name)) continue;
+        entries.push(entry.name);
+        if (entries.length >= maxMatches) break;
+      }
+    } finally {
+      directory.closeSync();
+    }
+  } catch (error) {
+    if (!isMissingIngestPath(error)) throw error;
     return [];
   }
-  return entries.filter((name) => regex.test(name)).sort().map((name) => join2(dir, name));
+  return entries.sort().map((name) => {
+    const candidate = join2(dir, name);
+    resolveIngestFilePath(candidate, dir);
+    return candidate;
+  });
 }
-function discoverIngestInputs(repoPath) {
+function discoverIngestInputs(repoPath, maxMatches = Number.POSITIVE_INFINITY) {
+  const resolvedRoot = realpathSync3(repoPath);
+  const cejelDir = join2(repoPath, ".cejel");
   const inputsDir = join2(repoPath, ".cejel", "inputs");
-  let entries;
+  const entries = [];
   try {
-    entries = readdirSync2(inputsDir);
-  } catch {
+    const cejelStat = lstatSync3(cejelDir);
+    if (cejelStat.isSymbolicLink()) {
+      throw new Error(`Cejel: refusing symlinked ingest path component: ${cejelDir}`);
+    }
+    if (!cejelStat.isDirectory()) {
+      throw new Error(`Cejel: refusing non-directory ingest path component: ${cejelDir}`);
+    }
+    const inputsStat = lstatSync3(inputsDir);
+    if (inputsStat.isSymbolicLink()) {
+      throw new Error(`Cejel: refusing symlinked ingest path component: ${inputsDir}`);
+    }
+    if (!inputsStat.isDirectory()) {
+      throw new Error(`Cejel: refusing non-directory ingest path component: ${inputsDir}`);
+    }
+    const resolvedInputs = realpathSync3(inputsDir);
+    if (!isResolvedIngestPathContained(resolvedInputs, resolvedRoot)) {
+      throw new Error(`Cejel: refusing auto-discovery directory outside the repository root.`);
+    }
+    const directory = opendirSync(inputsDir);
+    try {
+      for (; ; ) {
+        const entry = directory.readSync();
+        if (!entry) break;
+        if (!/\.(sarif|json)$/i.test(entry.name)) continue;
+        entries.push(entry.name);
+        if (entries.length >= maxMatches) break;
+      }
+    } finally {
+      directory.closeSync();
+    }
+  } catch (error) {
+    if (!isMissingIngestPath(error)) throw error;
     return [];
   }
-  return entries.filter((name) => /\.(sarif|json)$/i.test(name)).sort().map((name) => join2(inputsDir, name));
+  return entries.sort().map((name) => resolveIngestFilePath(join2(inputsDir, name), inputsDir));
 }
 
 // src/witan/scoring.ts
@@ -7281,7 +7669,11 @@ function scoreMetrics(metrics) {
 function capScoreForFindings(score, findings, rubricVersion, criterionId) {
   if (findings.some((finding) => finding.severity === "critical")) {
     const criticalFindings = findings.filter(({ severity }) => severity === "critical");
-    const authenticatedA1Absence = usesV17DetectorClosure2(rubricVersion) && criterionId === "A1" && criticalFindings.length === 1 && criticalFindings[0]?.summary === WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY;
+    const authenticatedA1Absence = usesV17DetectorClosure2(rubricVersion) && criterionId === "A1" && criticalFindings.length === 1 && [
+      WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY,
+      WITAN_DIRECTORY_WALK_AUTHENTICATED_A1_ABSENCE_SUMMARY,
+      WITAN_LEGACY_AUTHENTICATED_A1_ABSENCE_SUMMARY
+    ].includes(criticalFindings[0]?.summary ?? "");
     return authenticatedA1Absence ? Math.min(score, 1.4) : 1.4;
   }
   if (findings.some((finding) => finding.severity === "warning")) return Math.min(score, 2.4);
@@ -7553,6 +7945,8 @@ function roundScore(score) {
 }
 
 // src/witan/public-scan.ts
+var MAX_INGEST_DOCUMENTS = 128;
+var MAX_RETAINED_INGEST_FINDINGS = 1e4;
 function scoreRepoWithPublicCejel(options) {
   if (options.rubricVersion !== void 0) {
     assertSelectableRubricVersion(options.rubricVersion);
@@ -7580,36 +7974,58 @@ function scoreRepoWithPublicCejel(options) {
 }
 function resolvePublicIngestSignals(options) {
   const seen = /* @__PURE__ */ new Set();
-  const explicitFiles = [];
+  const documents = [];
+  const addDocument = (file, provenance) => {
+    const resolved = resolveIngestFilePath(file);
+    if (seen.has(resolved)) return;
+    seen.add(resolved);
+    documents.push({ file: resolved, provenance });
+    if (documents.length > MAX_INGEST_DOCUMENTS) {
+      throw new Error(
+        `Cejel: ${documents.length} unique ingest documents exceed the ${MAX_INGEST_DOCUMENTS} ingest document budget; refusing to produce a partial certificate.`
+      );
+    }
+  };
   for (const pattern of options.ingestPatterns ?? []) {
-    const matches = expandIngestPattern(pattern);
+    const matches = expandIngestPattern(pattern, MAX_INGEST_DOCUMENTS + 1);
     if (matches.length === 0 && options.warnOnEmptyIngestMatch) {
       process.stderr.write(`Cejel: --ingest pattern matched no files: ${pattern}
 `);
     }
     for (const match of matches) {
-      const resolved = resolve2(match);
-      if (seen.has(resolved)) continue;
-      seen.add(resolved);
-      explicitFiles.push(match);
+      addDocument(match, "operator_supplied");
     }
   }
-  const signals = explicitFiles.flatMap(
-    (file) => parseIngestFile(file, { provenance: "operator_supplied" })
-  );
-  if (!options.autoDiscoverIngest) return signals;
-  for (const discovered of discoverIngestInputs(options.repoPath)) {
-    const resolved = resolve2(discovered);
-    if (seen.has(resolved)) continue;
-    seen.add(resolved);
-    signals.push(...parseIngestFile(discovered, { provenance: "auto_discovered" }));
+  if (options.autoDiscoverIngest) {
+    for (const discovered of discoverIngestInputs(
+      options.repoPath,
+      MAX_INGEST_DOCUMENTS + 1
+    )) {
+      addDocument(discovered, "auto_discovered");
+    }
+  }
+  const signals = [];
+  let retainedFindings = 0;
+  for (const document of documents) {
+    const parsed = parseIngestFile(document.file, {
+      maxFindingCandidates: MAX_RETAINED_INGEST_FINDINGS - retainedFindings,
+      provenance: document.provenance
+    });
+    const documentFindings = parsed.reduce((count, signal) => count + signal.findings.length, 0);
+    retainedFindings += documentFindings;
+    if (retainedFindings > MAX_RETAINED_INGEST_FINDINGS) {
+      throw new Error(
+        `Cejel: ${retainedFindings.toLocaleString("en-US")} retained findings exceed the ${MAX_RETAINED_INGEST_FINDINGS.toLocaleString("en-US")} retained ingest finding budget; refusing to truncate evidence.`
+      );
+    }
+    signals.push(...parsed);
   }
   return signals;
 }
 
 // src/product-identity.ts
 init_esm_shims();
-import { existsSync, readFileSync as readFileSync5 } from "fs";
+import { existsSync, lstatSync as lstatSync4, readFileSync as readFileSync5 } from "fs";
 import { basename as basename2, join as join3 } from "path";
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/;
 var FALLBACK_SLUG = "repo";
@@ -7617,7 +8033,10 @@ var FALLBACK_DISPLAY_NAME = "Repository";
 function deriveProductIdentity(repoPath, productName) {
   const packageJsonPath = join3(repoPath, "package.json");
   const raw = productName ?? readPackageName(packageJsonPath) ?? basename2(repoPath);
-  const displayName = raw.trim().length > 0 ? raw.trim() : FALLBACK_DISPLAY_NAME;
+  const displayName = sanitizePresentationLine(raw, {
+    fallback: FALLBACK_DISPLAY_NAME,
+    maxLength: 120
+  });
   return {
     productSlug: slugify(raw),
     productDisplayName: displayName
@@ -7626,6 +8045,8 @@ function deriveProductIdentity(repoPath, productName) {
 function readPackageName(packageJsonPath) {
   if (!existsSync(packageJsonPath)) return void 0;
   try {
+    const stat = lstatSync4(packageJsonPath);
+    if (!stat.isFile() || stat.size > MAX_REPOSITORY_CONTENT_BYTES) return void 0;
     const parsed = JSON.parse(readFileSync5(packageJsonPath, "utf8"));
     if (typeof parsed === "object" && parsed !== null && "name" in parsed) {
       const name = parsed.name;