@cejel/cejel 0.4.5 → 0.4.7

package/README.md

@@ -32,12 +32,26 @@ certificate + badge over all of them. See "Aggregate your scanners" below.
 The public CLI default is `witan-rubric-v17-2026-07-24`, the last rubric to clear Cejel's
 preregistered 200-repository untouched holdout. Published calibration figures apply only to that
 exact rubric and frozen evaluation population. Later rubrics—including the current v18 through
-v22 prospective series—are available only to explicit evaluation harnesses. Prospective rubrics
+v23 prospective series—are available only to explicit evaluation harnesses. Prospective rubrics
 inherit none of v17's calibration figures; a bounded paired repair or corpus-delta result can
 validate its stated construction without transferring precision, recall, or false-positive-rate
 claims. Promoting a prospective rubric to the public default requires a fresh authenticated
 untouched holdout, every preregistered gate to pass, and a separately recorded promotion decision.
 
+### Measured recall (bounded)
+
+> **Measured recall (bounded).** Cejel publishes no general detection-recall figure. On a frozen,
+> preregistered, in-scope held-out fixture set of 30 named defects, the released public default
+> (v17, tree `a857f0b3`) cited **16/30**, two-sided 95% Wilson interval **[36.1%, 69.8%]**; the
+> prospective v22 detector (commit `8a289ea`, tree `10960a03`) cited **24/30**, two-sided 95%
+> Wilson interval **[62.7%, 90.5%]**. Same fixtures, same partition, same controls in both runs.
+> v22 is prospective and not the shipped default. Full preregistrations and results:
+> `docs/experiments/in-scope-detection-recall-v3-result-2026-08-09.md` and
+> `docs/experiments/in-scope-detection-recall-v4-result-2026-08-11.md`.
+
+The [defect-class census](docs/defect-class-census.md) publishes the coverage-breadth
+boundary—which defect classes any shipped rule targets—and is explicitly not a recall claim.
+
 ## Install
 
 No account, no key, no signup.
@@ -79,7 +93,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.4.5 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.4.7 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM and an
@@ -102,7 +116,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.4.5` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.4.7` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry.
 
 `npx` can reuse a stale cached package. Force the current npm release with the `@latest`
@@ -139,6 +153,9 @@ The npm package is scoped as `@cejel/cejel`; its executable remains the short co
     min-score: "2.5"   # optional: fail the build below this
 ```
 
+For an executed public example that binds a release artifact to the same commit named by its
+Cejel certificate, see [Certified releases with GitHub build provenance](./docs/certified-release-example.md).
+
 **From source** — it is AGPL and it runs offline, so reading it is rather the point:
 
 ```bash
@@ -161,16 +178,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.4.5`:
+**Docker / OCI.** The current container release is `0.4.7`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.5
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.7
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.5 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.7 .
 ```
 
 The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
@@ -274,10 +291,20 @@ prints that boundary on every successful verification.
 - `--rubric-pin <version>` — Explicit opt-in only: pin an alternate rubric instead of the
   calibrated public default. It
   accepts the calibrated version or any published prospective rubric
-  (`witan-rubric-v18-prospective-*` through `v22`) and fails closed, naming what was accepted, on
-  anything else. Omit this flag for the calibrated result every default scan produces — a
-  prospective pin carries no precision/recall claim, and the terminal certificate, HTML
-  certificate, and Markdown report all state that plainly whenever one is used.
+  (`witan-rubric-v18-prospective-*` through `v23`) and fails closed, naming what was accepted, on
+  anything else. `v23` is prospective and uncalibrated, like every rubric after v17: the public
+  default (`WITAN_LAST_CALIBRATED_RUBRIC_VERSION`) is still `witan-rubric-v17-2026-07-24`, and v23
+  inherits none of v17's precision, recall, or false-positive-rate figures. It inherits v22
+  detector/scoring behavior and adds bounded A1 coverage-flag recognition (#276) plus per-signal
+  (rather than per-criterion) abstention for A1's `coverage_percent`/`non_hollow_test_share`
+  metrics (#278); every other criterion still abstains
+  criterion-wide under v23, same as v17/v22. Omit this flag for the calibrated result every
+  default scan produces — a prospective pin carries no precision/recall claim, and the terminal
+  certificate, HTML certificate, and Markdown report all state that plainly whenever one is used.
+- `--run-attempt <n>` — record which CI run attempt produced this certificate, surfaced on the
+  human-readable certificate and as an additive-optional `predicate.githubRunAttempt` field on
+  `attestation.json`. The GitHub Action sets this automatically from `GITHUB_RUN_ATTEMPT`; omit it
+  for a local scan or any other CI — Cejel never fabricates or defaults a run attempt.
 - `--quiet` — suppress the terminal certificate (files are still written)
 - `-h`, `--help` — print usage and exit successfully
 - `-v`, `--version` — print the version derived from the package manifest and exit successfully
@@ -348,6 +375,7 @@ Three ways a scanner's output gets ingested:
 
    ```json
    {
+     "version": "1.0",
      "tool": "my-scanner",
      "signals": [
        {
@@ -370,6 +398,12 @@ Three ways a scanner's output gets ingested:
    (0–1, default `0.5`) bounds how much this signal can move that dimension; `severity` is
    `critical` | `warning` | `info`; `location` is optional.
 
+   The version field is required. Cejel rejects unversioned generic documents and unknown major
+   versions rather than guessing. See the [generic ingest contract](docs/ingest-contract.md), its
+   [published JSON Schema](docs/schemas/cejel-ingest-v1.schema.json), and the
+   [synthetic CI heal-log mapping](docs/heal-log-mapping.md). Output-field stability and version
+   routing are documented in [format stability](docs/format-stability.md).
+
 ## Displaying the trust badge
 
 Endpoint JSON (host `badge.json` anywhere static — a repo file, a gist, GitHub Pages — and
@@ -485,7 +519,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.5"]}'
+npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.7"]}'
 npx -y openclaw@latest mcp doctor cejel-oci --probe
 ```
 

package/dist/calibration/llm-detector.js

@@ -5,20 +5,20 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-4IXESHG7.js";
+} from "../chunk-QTLLASOO.js";
 import {
   listCejelLlmPackFiles
-} from "../chunk-RW6YJVHZ.js";
-import "../chunk-EPK7UTIK.js";
+} from "../chunk-EP7YYWEP.js";
+import "../chunk-OIGCYULH.js";
 import {
   external_exports
-} from "../chunk-KGFGX3TP.js";
+} from "../chunk-UYJBSQCV.js";
 import {
   init_esm_shims,
   readRepoText,
   recordContentSkip,
   recordFilesystemSkip
-} from "../chunk-R4DPQLS2.js";
+} from "../chunk-ZNVILRHK.js";
 
 // src/calibration/llm-detector.ts
 init_esm_shims();

package/dist/{chunk-RW6YJVHZ.js → chunk-EP7YYWEP.js}

@@ -5,10 +5,10 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-EPK7UTIK.js";
+} from "./chunk-OIGCYULH.js";
 import {
   init_esm_shims
-} from "./chunk-R4DPQLS2.js";
+} from "./chunk-ZNVILRHK.js";
 
 // src/packs/llm/files.ts
 init_esm_shims();

package/dist/{chunk-EPK7UTIK.js → chunk-OIGCYULH.js}

@@ -3,7 +3,7 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-R4DPQLS2.js";
+} from "./chunk-ZNVILRHK.js";
 
 // src/witan/git-exec.ts
 init_esm_shims();