@cejel/cejel 0.4.6 → 0.4.8

package/README.md

@@ -32,12 +32,26 @@ certificate + badge over all of them. See "Aggregate your scanners" below.
 The public CLI default is `witan-rubric-v17-2026-07-24`, the last rubric to clear Cejel's
 preregistered 200-repository untouched holdout. Published calibration figures apply only to that
 exact rubric and frozen evaluation population. Later rubrics—including the current v18 through
-v22 prospective series—are available only to explicit evaluation harnesses. Prospective rubrics
+v23 prospective series—are available only to explicit evaluation harnesses. Prospective rubrics
 inherit none of v17's calibration figures; a bounded paired repair or corpus-delta result can
 validate its stated construction without transferring precision, recall, or false-positive-rate
 claims. Promoting a prospective rubric to the public default requires a fresh authenticated
 untouched holdout, every preregistered gate to pass, and a separately recorded promotion decision.
 
+### Measured recall (bounded)
+
+> **Measured recall (bounded).** Cejel publishes no general detection-recall figure. On a frozen,
+> preregistered, in-scope held-out fixture set of 30 named defects, the released public default
+> (v17, tree `a857f0b3`) cited **16/30**, two-sided 95% Wilson interval **[36.1%, 69.8%]**; the
+> prospective v22 detector (commit `8a289ea`, tree `10960a03`) cited **24/30**, two-sided 95%
+> Wilson interval **[62.7%, 90.5%]**. Same fixtures, same partition, same controls in both runs.
+> v22 is prospective and not the shipped default. Full preregistrations and results:
+> `docs/experiments/in-scope-detection-recall-v3-result-2026-08-09.md` and
+> `docs/experiments/in-scope-detection-recall-v4-result-2026-08-11.md`.
+
+The [defect-class census](docs/defect-class-census.md) publishes the coverage-breadth
+boundary—which defect classes any shipped rule targets—and is explicitly not a recall claim.
+
 ## Install
 
 No account, no key, no signup.
@@ -79,7 +93,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.4.6 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.4.8 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM and an
@@ -102,7 +116,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.4.6` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.4.8` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry.
 
 `npx` can reuse a stale cached package. Force the current npm release with the `@latest`
@@ -164,16 +178,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.4.6`:
+**Docker / OCI.** The current container release is `0.4.8`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.6
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.8
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.6 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.8 .
 ```
 
 The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
@@ -277,10 +291,20 @@ prints that boundary on every successful verification.
 - `--rubric-pin <version>` — Explicit opt-in only: pin an alternate rubric instead of the
   calibrated public default. It
   accepts the calibrated version or any published prospective rubric
-  (`witan-rubric-v18-prospective-*` through `v22`) and fails closed, naming what was accepted, on
-  anything else. Omit this flag for the calibrated result every default scan produces — a
-  prospective pin carries no precision/recall claim, and the terminal certificate, HTML
-  certificate, and Markdown report all state that plainly whenever one is used.
+  (`witan-rubric-v18-prospective-*` through `v23`) and fails closed, naming what was accepted, on
+  anything else. `v23` is prospective and uncalibrated, like every rubric after v17: the public
+  default (`WITAN_LAST_CALIBRATED_RUBRIC_VERSION`) is still `witan-rubric-v17-2026-07-24`, and v23
+  inherits none of v17's precision, recall, or false-positive-rate figures. It inherits v22
+  detector/scoring behavior and adds bounded A1 coverage-flag recognition (#276) plus per-signal
+  (rather than per-criterion) abstention for A1's `coverage_percent`/`non_hollow_test_share`
+  metrics (#278); every other criterion still abstains
+  criterion-wide under v23, same as v17/v22. Omit this flag for the calibrated result every
+  default scan produces — a prospective pin carries no precision/recall claim, and the terminal
+  certificate, HTML certificate, and Markdown report all state that plainly whenever one is used.
+- `--run-attempt <n>` — record which CI run attempt produced this certificate, surfaced on the
+  human-readable certificate and as an additive-optional `predicate.githubRunAttempt` field on
+  `attestation.json`. The GitHub Action sets this automatically from `GITHUB_RUN_ATTEMPT`; omit it
+  for a local scan or any other CI — Cejel never fabricates or defaults a run attempt.
 - `--quiet` — suppress the terminal certificate (files are still written)
 - `-h`, `--help` — print usage and exit successfully
 - `-v`, `--version` — print the version derived from the package manifest and exit successfully
@@ -495,7 +519,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.6"]}'
+npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.8"]}'
 npx -y openclaw@latest mcp doctor cejel-oci --probe
 ```
 

package/dist/calibration/llm-detector.js

@@ -5,20 +5,20 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-VEJLHO5F.js";
+} from "../chunk-6R3VJGJ2.js";
 import {
   listCejelLlmPackFiles
-} from "../chunk-QRWLHTGR.js";
-import "../chunk-BZXBLDCJ.js";
+} from "../chunk-ERNYMFH4.js";
+import "../chunk-KNQBI3IX.js";
 import {
   external_exports
-} from "../chunk-Y6NO5HAI.js";
+} from "../chunk-J6R5OHN7.js";
 import {
   init_esm_shims,
   readRepoText,
   recordContentSkip,
   recordFilesystemSkip
-} from "../chunk-H55KECVT.js";
+} from "../chunk-V3B2V4WA.js";
 
 // src/calibration/llm-detector.ts
 init_esm_shims();