@cejel/cejel 0.4.6 → 0.4.8

package/dist/{chunk-VEJLHO5F.js → chunk-6R3VJGJ2.js}

@@ -5,21 +5,24 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-BZXBLDCJ.js";
+} from "./chunk-KNQBI3IX.js";
 import {
   external_exports
-} from "./chunk-Y6NO5HAI.js";
+} from "./chunk-J6R5OHN7.js";
 import {
   MAX_REPOSITORY_CONTENT_BYTES,
+  classifyAbstentionReason,
+  contentReadSignalKey,
   init_esm_shims,
   readRepoText,
   readRepoTextPrefix,
   recordContentSkip,
-  recordContentSkipForCriteria,
   recordFilesystemSkip,
   trackContentReads,
-  withContentReadCriterion
-} from "./chunk-H55KECVT.js";
+  withContentReadCriterion,
+  withContentReadSignal,
+  withContentReadSignals
+} from "./chunk-V3B2V4WA.js";
 
 // src/witan/schemas.ts
 init_esm_shims();
@@ -159,6 +162,13 @@ var WitanCriterionMetricSchema = external_exports.object({
     condition: external_exports.string().min(1).max(240).optional()
   }).strict().optional()
 }).strict();
+var WitanContentReadSkipReasonSchema = external_exports.enum([
+  "unreadable",
+  "too_large",
+  "excluded_by_extension",
+  "denied_path",
+  "non_regular_file"
+]);
 var WitanCriterionSignalSchema = external_exports.object({
   criterionId: WitanCriterionIdSchema,
   positiveEvidence: external_exports.array(WitanEvidencePointerSchema).default([]),
@@ -168,9 +178,19 @@ var WitanCriterionSignalSchema = external_exports.object({
   notApplicable: external_exports.literal(true).optional(),
   // A collector reached relevant files but could not read their contents. This is a
   // measurement gap, never negative evidence: scoreCriterion maps it to insufficient_data.
-  insufficientData: external_exports.literal(true).optional()
+  insufficientData: external_exports.literal(true).optional(),
+  // Why insufficientData is true. Omitted (or 'unreadable'/'denied_path') means an
+  // environmental read failure — evidence Cejel expected to see and could not; that stays in
+  // the composite denominator at score 0 so losing evidence never flatters the certificate
+  // (ADR-0001 does not cover this case — it is genuine evidence loss). 'too_large',
+  // 'excluded_by_extension', and 'non_regular_file' are self-imposed coverage limits Cejel
+  // chose itself: those are excluded from the composite exactly like ordinary
+  // insufficient_data (ADR-0001: coverage is disclosed, never discounts a score).
+  insufficientDataReason: WitanContentReadSkipReasonSchema.optional()
 }).strict().refine((signal) => !(signal.notApplicable && signal.insufficientData), {
   message: "A criterion cannot be both not applicable and insufficient data."
+}).refine((signal) => signal.insufficientDataReason === void 0 || signal.insufficientData === true, {
+  message: "insufficientDataReason may only be set alongside insufficientData: true."
 });
 var WitanContentReadSummarySchema = external_exports.object({
   skipped: external_exports.number().int().nonnegative(),
@@ -298,7 +318,14 @@ var WitanReportCommonSchema = external_exports.object({
   consumedSignals: external_exports.array(WitanConsumedSignalSummarySchema).optional(),
   archetype: WitanRepoArchetypeSchema.optional(),
   scanLimitations: external_exports.array(external_exports.string().min(1).max(1e3)).max(16).optional(),
-  contentReadSummary: WitanContentReadSummarySchema.optional()
+  contentReadSummary: WitanContentReadSummarySchema.optional(),
+  // The @cejel/cejel version that produced this report. Absent on reports from before this
+  // field existed and on any caller that does not supply one (createWitanReport never defaults
+  // it). Constant within an installed version, so re-running the same version on the same
+  // commit stays byte-stable (the exact property v0.3.1 removed generatedAt to protect); it
+  // differs across versions, which lets a consumer key incremental reuse on it
+  // (goal_cejel_0_4_8_abstention_scoring_fix_2026-09-08).
+  toolVersion: external_exports.string().min(1).max(80).optional()
 });
 var WitanScoredReportSchema = WitanReportCommonSchema.extend({
   verdict: WitanScoredVerdictSchema,
@@ -339,7 +366,7 @@ var WitanReportSchema = external_exports.preprocess((value) => {
 }, StrictWitanReportSchema);
 var WITAN_ATTESTATION_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
 var WITAN_ATTESTATION_PREDICATE_TYPE = "https://cejel.dev/attestations/scan/v1";
-var WITAN_REPORT_FORMAT_VERSION = "1.0";
+var WITAN_REPORT_FORMAT_VERSION = "1.1";
 var WitanAttestationOutcomeSchema = external_exports.discriminatedUnion("status", [
   external_exports.object({
     status: external_exports.literal("scored"),
@@ -374,6 +401,11 @@ var WitanAttestationStatementSchema = external_exports.object({
     // explicit report contract version.
     reportFormatVersion: external_exports.string().regex(/^1\.\d+$/).optional(),
     rubricVersion: external_exports.string().min(1).max(120),
+    // Only present when the scan ran under the GitHub Action (GITHUB_RUN_ATTEMPT observed in
+    // the runner environment). Absent, never fabricated or defaulted to "1", for a local CLI
+    // or any other CI. Not part of report.json: it is per-invocation, not per-repository-
+    // state, and report.json's reproducibility guarantee excludes exactly that kind of field.
+    githubRunAttempt: external_exports.string().regex(/^[1-9][0-9]*$/).optional(),
     repository: external_exports.object({
       productSlug: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/),
       url: external_exports.string().url().optional(),
@@ -415,13 +447,15 @@ var WITAN_RUBRIC_VERSION_V19 = "witan-rubric-v19-prospective-2026-08-09";
 var WITAN_RUBRIC_VERSION_V20 = "witan-rubric-v20-prospective-2026-08-10";
 var WITAN_RUBRIC_VERSION_V21 = "witan-rubric-v21-prospective-2026-08-10";
 var WITAN_RUBRIC_VERSION_V22 = "witan-rubric-v22-prospective-2026-08-10";
+var WITAN_RUBRIC_VERSION_V23 = "witan-rubric-v23-prospective-2026-09-06";
 var WITAN_LAST_CALIBRATED_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V17;
 var WITAN_PROSPECTIVE_RUBRIC_VERSIONS = Object.freeze([
   WITAN_RUBRIC_VERSION_V18,
   WITAN_RUBRIC_VERSION_V19,
   WITAN_RUBRIC_VERSION_V20,
   WITAN_RUBRIC_VERSION_V21,
-  WITAN_RUBRIC_VERSION_V22
+  WITAN_RUBRIC_VERSION_V22,
+  WITAN_RUBRIC_VERSION_V23
 ]);
 var WITAN_SELECTABLE_RUBRIC_VERSIONS = Object.freeze([
   WITAN_LAST_CALIBRATED_RUBRIC_VERSION,
@@ -810,6 +844,32 @@ function glossaryEntryForMetric(metric2) {
 function formatCertificateMetricLabel(metric2) {
   return CERTIFICATE_METRIC_REGISTRY[metric2.name]?.displayLabel ?? metric2.label;
 }
+function formatCertificateMetricAppliedWeightPercent(criterion, metric2) {
+  const metrics = criterion.metrics;
+  const index = metrics.indexOf(metric2);
+  if (index === -1) {
+    throw new Error(
+      "formatCertificateMetricAppliedWeightPercent: metric does not belong to criterion.metrics"
+    );
+  }
+  const totalWeight = metrics.reduce((sum, m) => sum + m.weight, 0);
+  if (totalWeight <= 0) return 0;
+  const shares = metrics.map((m, i) => {
+    const raw = m.weight / totalWeight * 100;
+    const floor = Math.floor(raw);
+    return { i, floor, fraction: raw - floor };
+  });
+  const flooredTotal = shares.reduce((sum, s) => sum + s.floor, 0);
+  const byLargestRemainder = [...shares].sort((a, b) => b.fraction - a.fraction);
+  const result = new Map(shares.map((s) => [s.i, s.floor]));
+  let remainder = Math.round(100 - flooredTotal);
+  for (const s of byLargestRemainder) {
+    if (remainder <= 0) break;
+    result.set(s.i, (result.get(s.i) ?? s.floor) + 1);
+    remainder -= 1;
+  }
+  return result.get(index) ?? 0;
+}
 function glossaryEntriesForReport(report) {
   const entries = new Map(CERTIFICATE_GLOSSARY.map((entry) => [entry.key, entry]));
   for (const metric2 of report.criteria.flatMap((criterion) => criterion.metrics)) {
@@ -925,6 +985,74 @@ function formatCertificateMetricValue(criterion, metric2) {
     `${formatMetricNumber(metric2.value)}/${formatMetricNumber(metric2.max)}${unit}`
   );
 }
+var NEXT_STEP_FINDING_SEVERITIES = /* @__PURE__ */ new Set(["critical", "warning"]);
+var NEXT_STEP_FINDING_SEVERITY_RANK = {
+  critical: 0,
+  warning: 1,
+  info: 2
+};
+var MAX_NEXT_STEP_FINDINGS = 3;
+function buildNextSteps(report, unmeasured, notApplicable, a1, coverageMetric) {
+  const steps = [];
+  if (unmeasured.length > 0) {
+    const ids = unmeasured.map((criterion) => criterion.id).join(", ");
+    steps.push(
+      `Obtain measurable evidence for ${ids} \u2014 ${unmeasured.length === 1 ? "this scored dimension has" : "these scored dimensions have"} no recorded result, and could change the verdict.`
+    );
+  }
+  const criterionFindings = report.criteria.flatMap(
+    (criterion) => criterion.findings.filter((finding) => NEXT_STEP_FINDING_SEVERITIES.has(finding.severity)).map((finding) => ({ criterionId: criterion.id, finding }))
+  );
+  const sortedFindings = [...criterionFindings].sort(
+    (a, b) => NEXT_STEP_FINDING_SEVERITY_RANK[a.finding.severity] - NEXT_STEP_FINDING_SEVERITY_RANK[b.finding.severity]
+  );
+  for (const { criterionId, finding } of sortedFindings.slice(0, MAX_NEXT_STEP_FINDINGS)) {
+    steps.push(
+      `Evidence is currently absent for the ${finding.severity} finding on ${criterionId}: obtain independent verification before relying on this criterion.`
+    );
+  }
+  if (sortedFindings.length > MAX_NEXT_STEP_FINDINGS) {
+    steps.push(
+      `${sortedFindings.length - MAX_NEXT_STEP_FINDINGS} more critical/warning finding(s) need the same independent verification; see the findings listed above for the complete set.`
+    );
+  }
+  if (a1 && coverageMetric && isCoverageNotMeasured(a1, coverageMetric)) {
+    steps.push(
+      "Obtain a coverage report or configured threshold for A1's static coverage metric; none was found, so it was not measured."
+    );
+  }
+  if (!report.repo.headSha && report.criteria.some(
+    (criterion) => criterion.metrics.some((metric2) => metric2.name === "pr_merge_ratio")
+  )) {
+    steps.push(
+      "Restore Git history access so the recent-commit PR-reference proxy has commit subjects to inspect; its scoring zero here is a conservative default, not a detected outcome."
+    );
+  }
+  if (notApplicable.length > 0) {
+    const ids = notApplicable.map((criterion) => criterion.id).join(", ");
+    steps.push(
+      `Confirm ${ids} ${notApplicable.length === 1 ? "is" : "are"} correctly marked not applicable to this repository; ${notApplicable.length === 1 ? "it was" : "they were"} not examined.`
+    );
+  }
+  const scanLimitationCount = report.scanLimitations?.length ?? 0;
+  if (scanLimitationCount > 0) {
+    steps.push(
+      `Resolve the ${scanLimitationCount} scan limitation${scanLimitationCount === 1 ? "" : "s"} qualifying the readable evidence, then reproduce the scan.`
+    );
+  }
+  const skippedCount = report.contentReadSummary?.skipped ?? 0;
+  if (skippedCount > 0) {
+    steps.push(
+      `Make the ${skippedCount} skipped content entr${skippedCount === 1 ? "y" : "ies"} readable (see the itemized reasons in the certificate), then reproduce the scan.`
+    );
+  }
+  if (steps.length === 0) {
+    steps.push(
+      "No unresolved evidence gaps were identified across the categories Cejel tracks; reproduce the scan at the reported revision when one is available before relying on this certificate."
+    );
+  }
+  return steps;
+}
 function buildRelyingPartySummary(report) {
   const applicable = report.criteria.filter((criterion) => criterion.status !== "not_applicable");
   const measured = applicable.filter((criterion) => criterion.status !== "insufficient_data");
@@ -972,7 +1100,7 @@ function buildRelyingPartySummary(report) {
     examined: `Cejel examined the repository evidence recorded for ${report.productDisplayName}${revision} under ${report.rubricVersion}.`,
     established: `The report established measured results for ${measured.length} of ${applicable.length} applicable rubric dimensions and recorded ${findings} evidence-backed finding${findings === 1 ? "" : "s"}.`,
     notEstablished: gaps.join(" "),
-    next: "Review the cited evidence and open or unverified items, reproduce the scan at the reported revision when one is available, and obtain missing measurements or resolve limitations before deciding whether to accept the code."
+    next: buildNextSteps(report, unmeasured, notApplicable, a1, coverageMetric).join(" ")
   };
 }
 function formatMetricNumber(value) {
@@ -1091,6 +1219,7 @@ function renderWitanHtmlReport(report, options = {}) {
             ${options.generatedAt ? `<div><dt>Date</dt><dd>${escapeHtml(formatDate(options.generatedAt))}</dd></div>` : ""}
             <div><dt>Run</dt><dd>${escapeHtml(renderRepo(report))}</dd></div>
             <div><dt>CLI</dt><dd>${escapeHtml(options.cliVersion ? `Cejel ${options.cliVersion}` : "Not recorded")}</dd></div>
+            ${options.runAttempt ? `<div><dt>Run attempt</dt><dd>${escapeHtml(options.runAttempt)}</dd></div>` : ""}
             <div><dt>Rubric</dt><dd>${escapeHtml(report.rubricVersion)}</dd></div>
             ${// Gated on the rubric actually being prospective — a calibrated (v17) certificate's
   // HTML stays byte-identical to before --rubric-pin existed.
@@ -1113,6 +1242,8 @@ function renderWitanHtmlReport(report, options = {}) {
       </div>
     </header>
 
+    ${renderFindingsFirstSummary(report)}
+
     ${renderRelyingPartySummary(relyingPartySummary)}
 
     ${(report.scanLimitations?.length ?? 0) > 0 ? `<section class="scan-limitations-section evidence-section" aria-label="Scan limitations">
@@ -1154,6 +1285,26 @@ function renderWitanHtmlReport(report, options = {}) {
 </html>
 `;
 }
+var FINDINGS_FIRST_SEVERITY_ORDER = {
+  critical: 0,
+  warning: 1,
+  info: 2
+};
+function collectFindingsFirstEntries(report) {
+  return report.criteria.flatMap(
+    (criterion) => criterion.findings.filter((finding) => finding.severity === "critical" || finding.severity === "warning").map((finding) => ({ criterion, finding }))
+  ).sort(
+    (a, b) => FINDINGS_FIRST_SEVERITY_ORDER[a.finding.severity] - FINDINGS_FIRST_SEVERITY_ORDER[b.finding.severity]
+  );
+}
+function renderFindingsFirstSummary(report) {
+  const entries = collectFindingsFirstEntries(report);
+  const body = entries.length > 0 ? `<ul>${entries.map(({ criterion, finding }) => `<li>${renderFindingEvidence(criterion, finding)}</li>`).join("")}</ul>` : '<p class="findings-first-empty">No critical or warning findings were identified across any criterion in this scan.</p>';
+  return `<section class="findings-first-summary" aria-labelledby="findings-first-heading">
+      <h2 id="findings-first-heading">Critical and warning findings</h2>
+      ${body}
+    </section>`;
+}
 function renderRelyingPartySummary(summary) {
   return `<section class="relying-party-summary" aria-labelledby="relying-party-heading">
       <h2 id="relying-party-heading">How to read this certificate</h2>
@@ -1167,10 +1318,12 @@ function renderRelyingPartySummary(summary) {
 }
 function renderGlossary(entries) {
   return `<section class="glossary" aria-labelledby="glossary-heading">
-      <h2 id="glossary-heading">Plain-language glossary</h2>
-      <dl>${entries.map(
+      <details>
+        <summary><h2 id="glossary-heading">Plain-language glossary</h2></summary>
+        <dl>${entries.map(
     (entry) => `<div><dt id="glossary-${escapeAttribute(entry.key)}">${escapeHtml(entry.term)}</dt><dd>${escapeHtml(entry.definition)}</dd></div>`
   ).join("")}</dl>
+      </details>
     </section>`;
 }
 function renderContentReadSummary(report) {
@@ -1245,12 +1398,12 @@ function renderCriterionColumn(title, criteria, gitHistoryUnavailable) {
       </section>`;
 }
 function renderNotApplicableGroup(criteria) {
-  return `<div class="na-group">
-          <h3 class="na-heading">Not applicable to this repository</h3>
+  return `<details class="na-group">
+          <summary><h3 class="na-heading">Not applicable to this repository</h3></summary>
           <ul class="na-list">
             ${criteria.map(renderNotApplicableItem).join("")}
           </ul>
-        </div>`;
+        </details>`;
 }
 function renderNotApplicableItem(criterion) {
   const reason = criterion.notes ?? "Not applicable to this repository.";
@@ -1310,15 +1463,21 @@ function scoreBandForPresentation(score) {
   if (score >= 1.5) return "warning";
   return "critical";
 }
+function renderMetricWeightBadge(criterion, metric2) {
+  const appliedSharePercent = formatCertificateMetricAppliedWeightPercent(criterion, metric2);
+  return `<span class="metric-weight">weight ${appliedSharePercent}% of ${escapeHtml(criterion.id)}</span>`;
+}
 function renderMetric(criterion, metric2) {
   const entry = glossaryEntryForMetric(metric2);
   const tooltipId = `tooltip-${criterion.id}-${entry.key}`;
   const formatted = formatCertificateMetricValue(criterion, metric2);
+  const weightBadge = renderMetricWeightBadge(criterion, metric2);
   const cappedEntry = formatted.includes("capped") ? CERTIFICATE_GLOSSARY.find((candidate) => candidate.key === "capped") : void 0;
   const label = `<span class="term-help" tabindex="0" aria-describedby="${escapeAttribute(tooltipId)}"><strong>${escapeHtml(formatCertificateMetricLabel(metric2))}</strong><span class="term-tooltip" id="${escapeAttribute(tooltipId)}" role="tooltip">${escapeHtml(entry.definition)}</span></span>`;
-  if (!cappedEntry) return `${label}<span class="metric-value">${escapeHtml(formatted)}</span>`;
+  if (!cappedEntry)
+    return `${label}<span class="metric-value">${escapeHtml(formatted)} ${weightBadge}</span>`;
   const cappedTooltipId = `${tooltipId}-capped`;
-  return `${label}<span class="term-help metric-value" tabindex="0" aria-describedby="${escapeAttribute(cappedTooltipId)}">${escapeHtml(formatted)}<span class="term-tooltip" id="${escapeAttribute(cappedTooltipId)}" role="tooltip">${escapeHtml(cappedEntry.definition)}</span></span>`;
+  return `${label}<span class="term-help metric-value" tabindex="0" aria-describedby="${escapeAttribute(cappedTooltipId)}">${escapeHtml(formatted)} ${weightBadge}<span class="term-tooltip" id="${escapeAttribute(cappedTooltipId)}" role="tooltip">${escapeHtml(cappedEntry.definition)}</span></span>`;
 }
 function renderCategoryScore(score, coverage, category) {
   const categoryCoverage = coverage.byCategory.find((entry) => entry.category === category);
@@ -1466,6 +1625,9 @@ dd { margin: 0; color: var(--muted); overflow-wrap: anywhere; }
 .subscores { display: flex; gap: 12px; flex-wrap: wrap; margin-top: 18px; color: var(--muted); font-family: var(--mono); font-size: 12px; }
 .coverage-note { margin-top: 8px; color: var(--faint); font-family: var(--mono); font-size: 11px; }
 .source-counts { margin: 8px 0 0; padding-left: 18px; font-family: var(--mono); font-size: 12px; color: var(--muted); }
+.findings-first-summary { margin-top: 20px; border: 1px solid var(--line-strong); border-radius: 8px; background: var(--surface); padding: 22px; }
+.findings-first-summary ul { margin: 0; padding-left: 18px; display: grid; gap: 10px; }
+.findings-first-empty { margin: 0; color: var(--muted); }
 .relying-party-summary, .glossary { margin-top: 28px; border: 1px solid var(--line-strong); border-radius: 8px; background: var(--surface); padding: 22px; }
 .relying-party-summary dl { display: grid; gap: 14px; margin: 0; }
 .relying-party-summary dl div { display: grid; grid-template-columns: 190px minmax(0, 1fr); gap: 18px; }
@@ -1473,6 +1635,14 @@ dd { margin: 0; color: var(--muted); overflow-wrap: anywhere; }
 .glossary dl { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 12px 22px; margin: 0; }
 .glossary dl div { border-top: 1px solid var(--line); padding-top: 10px; }
 .glossary dd { margin-top: 4px; font-size: 13px; }
+/* Track A3: native <details>/<summary> disclosure \u2014 the summary is the clickable control, a
+   heading nests inside it as its accessible label (still exposed as a heading), and the heading's
+   own vertical margin is neutralized by making it inline, so the marker sits flush against it. */
+summary { cursor: pointer; }
+summary h2, summary h3 { display: inline; }
+summary::marker { color: var(--periwinkle); }
+summary:focus-visible { outline: none; box-shadow: 0 0 0 2px var(--periwinkle); border-radius: 3px; }
+.glossary details[open] dl, .na-group[open] .na-list { margin-top: 16px; }
 .trust-grid, .evidence-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 18px; margin-top: 28px; }
 .scan-limitations-section { margin-top: 28px; border-color: rgba(231, 191, 114, .44); }
 .scan-limitations-section .scan-warning { list-style: none; margin-left: -18px; }
@@ -1504,6 +1674,7 @@ h3 { font-size: 15px; line-height: 1.35; font-weight: 600; margin-bottom: 0; }
 .criterion-metrics li { display: flex; justify-content: space-between; gap: 12px; border-bottom: 1px solid rgba(238, 244, 247, .08); padding-bottom: 6px; }
 .criterion-metrics strong { color: var(--text); font-weight: 650; }
 .criterion-metrics span { color: var(--muted); }
+.criterion-metrics .metric-weight { font-size: 10px; color: var(--faint); }
 .criterion-metrics > li > .metric-value {
   min-width: 0; white-space: normal; overflow-wrap: anywhere; text-align: right;
 }
@@ -1667,6 +1838,7 @@ function createWitanAttestation(report, options) {
       tool: { name: "cejel", version: options.toolVersion },
       generatedAt: options.generatedAt,
       reportFormatVersion: WITAN_REPORT_FORMAT_VERSION,
+      ...options.githubRunAttempt ? { githubRunAttempt: options.githubRunAttempt } : {},
       rubricVersion: report.rubricVersion,
       repository: {
         productSlug: report.productSlug,
@@ -1788,7 +1960,7 @@ function stripBom(text) {
 
 // src/witan/repo-signals.ts
 function usesV17DetectorClosure(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
 }
 var LEGACY_INVENTORY_ABSENCE_CONTEXT = {
   rubricGeneration: "legacy",
@@ -1803,10 +1975,14 @@ var INVENTORY_SCAN_PATTERN_SETS = {
     id: "cejel.core-a1.concrete-test-files.v1",
     count: 16
   },
-  a1CoverageConfiguration: {
+  a1CoverageConfigurationV1: {
     id: "cejel.core-a1.coverage-configuration.v1",
     count: 10
   },
+  a1CoverageConfigurationV2: {
+    id: "cejel.core-a1.coverage-configuration.v2",
+    count: 14
+  },
   a2CurrentSecret: {
     id: "cejel.core-a2.current-secret-shape.v1",
     count: 3
@@ -1855,25 +2031,127 @@ function inventoryAbsenceFinding(options) {
     } : {}
   };
 }
+function wholesaleCriterionAbstention(signal, reasons) {
+  const { insufficientDataReason } = classifyAbstentionReason(reasons);
+  return {
+    criterionId: signal.criterionId,
+    positiveEvidence: [],
+    findings: [],
+    metrics: [],
+    insufficientData: true,
+    ...insufficientDataReason !== void 0 ? { insufficientDataReason } : {},
+    notes: insufficientDataReason !== void 0 ? "Cejel abstained on this criterion because relevant repository content was declined under the repository content size limit or excluded from scanning by policy. This is a disclosed coverage limit, not a read failure, and does not affect the composite score." : "Cejel abstained on this criterion because one or more relevant repository files could not be read. Resolve the content-read limitations and re-scan."
+  };
+}
+function skipReasonsForCriterion(criterionId, tracked) {
+  const combined = new Set(tracked.criterionSkipReasons.get(criterionId) ?? []);
+  const prefix = contentReadSignalKey(criterionId, "");
+  for (const [key, reasons] of tracked.signalSkipReasons) {
+    if (!key.startsWith(prefix)) continue;
+    for (const reason of reasons) combined.add(reason);
+  }
+  return combined;
+}
+function skipReasonsForSignal(criterionId, signalName, tracked) {
+  const reasons = tracked.signalSkipReasons.get(contentReadSignalKey(criterionId, signalName));
+  return reasons ? new Set(reasons) : void 0;
+}
 function buildWitanInputFromRepo(options) {
   const tracked = trackContentReads(options.repoPath, () => buildWitanInputFromRepoUntracked(options));
   const affectedCriteria = tracked.affectedCriteria;
+  const rubricVersion = options.rubricVersion ?? WITAN_RUBRIC_VERSION;
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V23) {
+    const readFailureCriteria = [];
+    const coverageLimitedCriteria = [];
+    const signals2 = (tracked.value.signals ?? []).map((signal) => {
+      if (!affectedCriteria.has(signal.criterionId)) return signal;
+      const reasons = skipReasonsForCriterion(signal.criterionId, tracked);
+      const { insufficientDataReason } = classifyAbstentionReason(reasons);
+      (insufficientDataReason !== void 0 ? coverageLimitedCriteria : readFailureCriteria).push(
+        signal.criterionId
+      );
+      return wholesaleCriterionAbstention(signal, reasons);
+    });
+    const scanLimitations2 = [...tracked.value.scanLimitations ?? []];
+    if (readFailureCriteria.length > 0 && scanLimitations2.length < 16) {
+      scanLimitations2.push(
+        `${readFailureCriteria.length} ${readFailureCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+      );
+    }
+    if (coverageLimitedCriteria.length > 0 && scanLimitations2.length < 16) {
+      scanLimitations2.push(
+        `${coverageLimitedCriteria.length} ${coverageLimitedCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content was declined under the repository content size limit or excluded from scanning by policy \u2014 a disclosed coverage limit, not a read failure. This does not affect the composite score.`
+      );
+    }
+    return {
+      ...tracked.value,
+      signals: signals2,
+      ...scanLimitations2.length > 0 ? { scanLimitations: scanLimitations2 } : {},
+      contentReadSummary: tracked.summary
+    };
+  }
+  const wholesaleAbstainedReadFailureCriteria = [];
+  const wholesaleAbstainedCoverageLimitedCriteria = [];
+  const partiallyAbstainedReadFailureSignals = [];
+  const partiallyAbstainedCoverageLimitedSignals = [];
   const signals = (tracked.value.signals ?? []).map((signal) => {
     if (!affectedCriteria.has(signal.criterionId)) return signal;
+    if (tracked.unattributedCriteria.has(signal.criterionId)) {
+      const reasons = tracked.criterionSkipReasons.get(signal.criterionId);
+      const { insufficientDataReason: insufficientDataReason2 } = classifyAbstentionReason(reasons);
+      (insufficientDataReason2 !== void 0 ? wholesaleAbstainedCoverageLimitedCriteria : wholesaleAbstainedReadFailureCriteria).push(signal.criterionId);
+      return wholesaleCriterionAbstention(signal, reasons);
+    }
+    const prefix = contentReadSignalKey(signal.criterionId, "");
+    const affectedNames = [...tracked.affectedSignals].filter((key) => key.startsWith(prefix)).map((key) => key.slice(prefix.length));
+    if (affectedNames.length === 0) {
+      wholesaleAbstainedReadFailureCriteria.push(signal.criterionId);
+      return wholesaleCriterionAbstention(signal);
+    }
+    const affectedNameSet = new Set(affectedNames);
+    const metrics = (signal.metrics ?? []).filter((metric2) => !affectedNameSet.has(metric2.name));
+    const anythingSurvives = metrics.length > 0 || (signal.positiveEvidence?.length ?? 0) > 0 || (signal.findings?.length ?? 0) > 0;
+    const droppedReasons = /* @__PURE__ */ new Set();
+    for (const name of affectedNames) {
+      for (const reason of skipReasonsForSignal(signal.criterionId, name, tracked) ?? []) {
+        droppedReasons.add(reason);
+      }
+    }
+    if (!anythingSurvives) {
+      const { insufficientDataReason: insufficientDataReason2 } = classifyAbstentionReason(droppedReasons);
+      (insufficientDataReason2 !== void 0 ? wholesaleAbstainedCoverageLimitedCriteria : wholesaleAbstainedReadFailureCriteria).push(signal.criterionId);
+      return wholesaleCriterionAbstention(signal, droppedReasons);
+    }
+    const { insufficientDataReason } = classifyAbstentionReason(droppedReasons);
+    const isReadFailure = insufficientDataReason === void 0;
+    for (const name of affectedNames) {
+      (isReadFailure ? partiallyAbstainedReadFailureSignals : partiallyAbstainedCoverageLimitedSignals).push(`${signal.criterionId}.${name}`);
+    }
     return {
-      criterionId: signal.criterionId,
-      positiveEvidence: [],
-      findings: [],
-      metrics: [],
-      insufficientData: true,
-      notes: "Cejel abstained on this criterion because one or more relevant repository files could not be read. Resolve the content-read limitations and re-scan."
+      ...signal,
+      metrics,
+      notes: isReadFailure ? `Cejel abstained on ${[...affectedNames].sort().join(", ")} in this criterion because that content could not be read; other signals in this criterion were computed from readable files and are unaffected.` : `Cejel declined ${[...affectedNames].sort().join(", ")} in this criterion under the repository content size limit or an extension exclusion; other signals in this criterion were computed from readable files and are unaffected. This is a disclosed coverage limit, not a read failure.`
     };
   });
-  const affectedCount = affectedCriteria.size;
   const scanLimitations = [...tracked.value.scanLimitations ?? []];
-  if (affectedCount > 0 && scanLimitations.length < 16) {
+  if (wholesaleAbstainedReadFailureCriteria.length > 0 && scanLimitations.length < 16) {
+    scanLimitations.push(
+      `${wholesaleAbstainedReadFailureCriteria.length} ${wholesaleAbstainedReadFailureCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read and the affected signal could not be isolated. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+    );
+  }
+  if (wholesaleAbstainedCoverageLimitedCriteria.length > 0 && scanLimitations.length < 16) {
+    scanLimitations.push(
+      `${wholesaleAbstainedCoverageLimitedCriteria.length} ${wholesaleAbstainedCoverageLimitedCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content was declined under the repository content size limit or excluded from scanning by policy, and the affected signal could not be isolated. This is a disclosed coverage limit, not a read failure, and does not affect the composite score.`
+    );
+  }
+  if (partiallyAbstainedReadFailureSignals.length > 0 && scanLimitations.length < 16) {
     scanLimitations.push(
-      `${affectedCount} ${affectedCount === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+      `${partiallyAbstainedReadFailureSignals.length} ${partiallyAbstainedReadFailureSignals.length === 1 ? "signal" : "signals"} abstained because its own repository content could not be read, while other signals in the same criterion were unaffected: ${[...partiallyAbstainedReadFailureSignals].sort().join(", ")}.`
+    );
+  }
+  if (partiallyAbstainedCoverageLimitedSignals.length > 0 && scanLimitations.length < 16) {
+    scanLimitations.push(
+      `${partiallyAbstainedCoverageLimitedSignals.length} ${partiallyAbstainedCoverageLimitedSignals.length === 1 ? "signal" : "signals"} declined under the repository content size limit or an extension exclusion, while other signals in the same criterion were unaffected: ${[...partiallyAbstainedCoverageLimitedSignals].sort().join(", ")}. This is a disclosed coverage limit, not a read failure.`
     );
   }
   return {
@@ -1897,11 +2175,13 @@ function buildWitanInputFromRepoUntracked(options) {
     rubricGeneration: usesV17Detectors ? "current" : "legacy",
     inventoryProvenance: fileInventory.repoFileInventoryScope === "tracked-scan-eligible" ? "tracked-scan-eligible" : "directory-walk"
   };
-  const usesV18NativeRls = rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
-  const usesV19CommitYear = rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
-  const usesV20A3ExplicitGaps = rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
-  const usesV21ExecutedEscalations = rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
-  const usesV22PackageStartEntrypoint = rubricVersion === WITAN_RUBRIC_VERSION_V22;
+  const usesV18NativeRls = rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV19CommitYear = rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV20A3ExplicitGaps = rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV21ExecutedEscalations = rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV22PackageStartEntrypoint = rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV23CommandCoverage = rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV23PemPrivateKeyGrammar = rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const structuralArchetype = classifyRepoArchetype(inventoryFiles, rubricVersion);
   const readableArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion) ? applyReadableSourceRepresentationGate(
     options.repoPath,
@@ -1937,6 +2217,8 @@ function buildWitanInputFromRepoUntracked(options) {
     usesV20A3ExplicitGaps,
     usesV21ExecutedEscalations,
     usesV22PackageStartEntrypoint,
+    usesV23CommandCoverage,
+    usesV23PemPrivateKeyGrammar,
     reviewableSourceProof,
     inventoryAbsenceContext,
     scanLimitations
@@ -2548,7 +2830,7 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, useV23CommandCoverage, useV23PemPrivateKeyGrammar, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
   const signals = [];
   const mono = resolveMonorepoContext(repoPath, scanLimitations);
   const collectCriterion = (criterionId, collect) => withContentReadCriterion(criterionId, collect);
@@ -2560,6 +2842,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV27Detectors,
       useV33Detectors,
       useV36Detectors,
+      useV23CommandCoverage,
       reviewableSourceProof,
       inventoryAbsenceContext
     )
@@ -2574,6 +2857,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV36Detectors,
       useV39Detectors,
       useV47Detectors,
+      useV23PemPrivateKeyGrammar,
       useV18NativeRls,
       inventoryAbsenceContext,
       scanLimitations
@@ -2659,7 +2943,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
   }
   return signals;
 }
-function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
+function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV23CommandCoverage, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const evidence = [];
   const findings = [];
   const allTestFiles = findConcreteTestFiles(
@@ -2670,17 +2954,33 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
   const testFiles = allTestFiles.slice(0, 8);
   const sourceFiles = repoFiles.filter(isSourceFile);
   const runnerFiles = repoFiles.filter(
-    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isTestRunnerConfig(repoPath, file)
+    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && (isTestRunnerConfig(repoPath, file) || useV23CommandCoverage && isRecipeTestEntry(repoPath, file))
   ).slice(0, 6);
-  const configuredRunnerFiles = useV33Detectors ? findConfiguredTestRunnerFiles(repoPath, repoFiles) : runnerFiles;
-  const allCoverageFiles = findCoverageConfigFiles(repoPath, repoFiles, useV27Detectors);
-  const coverageFiles = allCoverageFiles.slice(0, 4);
+  const baseConfiguredRunnerFiles = useV33Detectors ? findConfiguredTestRunnerFiles(repoPath, repoFiles) : runnerFiles;
+  const configuredRunnerFiles = useV23CommandCoverage ? [
+    .../* @__PURE__ */ new Set([
+      ...baseConfiguredRunnerFiles,
+      ...repoFiles.filter((file) => isRecipeTestEntry(repoPath, file))
+    ])
+  ].sort() : baseConfiguredRunnerFiles;
   const packageJson = findRootPackageJson(repoFiles);
   const packageScripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
+  const { coverageAnalysis, coveragePercent } = withContentReadSignal("A1", "coverage_percent", () => {
+    const analysis = useV23CommandCoverage ? analyzeCoverageConfiguration(repoPath, repoFiles, useV27Detectors) : {
+      coverageFiles: findCoverageConfigFiles(repoPath, repoFiles, useV27Detectors),
+      unresolvedFiles: [],
+      hasCoverageCommand: packageScripts.has("coverage")
+    };
+    return {
+      coverageAnalysis: analysis,
+      coveragePercent: readCoveragePercent(repoPath, analysis.coverageFiles.slice(0, 4))
+    };
+  });
+  const allCoverageFiles = coverageAnalysis.coverageFiles;
+  const coverageFiles = allCoverageFiles.slice(0, 4);
   const packageJsonFiles = useV27Detectors ? repoFiles.filter(
     (file) => /(^|\/)package\.json$/.test(file) && isAuthoredProductionPath(file)
   ) : packageJson ? [packageJson] : [];
-  const coveragePercent = readCoveragePercent(repoPath, coverageFiles);
   const ciWorkflows = repoFiles.filter(
     (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isCiWorkflow(file)
   );
@@ -2695,7 +2995,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
   );
   const verificationScriptCount = [
     packageScripts.has("test") || Boolean(ciTestWorkflow),
-    packageScripts.has("coverage"),
+    coverageAnalysis.hasCoverageCommand,
     packageScripts.has("lint") || ciHasLintCommand,
     packageScripts.has("typecheck") || ciHasTypecheckCommand
   ].filter(Boolean).length;
@@ -2715,9 +3015,11 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
   if (packageJson && [...packageScripts.values()].some((script) => TEST_RUNNER_PATTERN.test(script))) {
     evidence.push(evidenceForRelative(repoPath, packageJson, "test_run", "Configured test runner"));
   }
-  for (const file of coverageFiles) {
-    evidence.push(evidenceForRelative(repoPath, file, "coverage", "Coverage configuration"));
-  }
+  withContentReadSignal("A1", "coverage_percent", () => {
+    for (const file of coverageFiles) {
+      evidence.push(evidenceForRelative(repoPath, file, "coverage", "Coverage configuration"));
+    }
+  });
   if (ciTestWorkflow) {
     evidence.push(
       evidenceForRelative(repoPath, ciTestWorkflow, "test_run", "CI workflow runs the test suite")
@@ -2787,7 +3089,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
         })
       );
     }
-  } else if (coverageFiles.length === 0 && (!useV33Detectors || configuredRunnerFiles.length > 0)) {
+  } else if (coverageFiles.length === 0 && coverageAnalysis.unresolvedFiles.length === 0 && (!useV33Detectors || configuredRunnerFiles.length > 0)) {
     if (isLeanTestToolchain) {
       const leanEvidenceFile = packageJson ?? testFiles[0];
       if (leanEvidenceFile) {
@@ -2814,16 +3116,16 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
           evidence: firstEvidence,
           context: inventoryAbsenceContext,
           inventoryCount: repoFiles.length,
-          patternSet: INVENTORY_SCAN_PATTERN_SETS.a1CoverageConfiguration,
+          patternSet: useV23CommandCoverage ? INVENTORY_SCAN_PATTERN_SETS.a1CoverageConfigurationV2 : INVENTORY_SCAN_PATTERN_SETS.a1CoverageConfigurationV1,
           matchCount: 0
         })
       );
     }
   }
-  const nonHollowShare = measureNonHollowTestShare(
-    repoPath,
-    allTestFiles,
-    reviewableSourceProof !== void 0
+  const nonHollowShare = withContentReadSignal(
+    "A1",
+    "non_hollow_test_share",
+    () => measureNonHollowTestShare(repoPath, allTestFiles, reviewableSourceProof !== void 0)
   );
   return {
     criterionId: "A1",
@@ -2864,7 +3166,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
               label: "test command",
               count: packageScripts.has("test") || Boolean(ciTestWorkflow) ? 1 : 0
             },
-            { label: "coverage command", count: packageScripts.has("coverage") ? 1 : 0 },
+            { label: "coverage command", count: coverageAnalysis.hasCoverageCommand ? 1 : 0 },
             {
               label: "lint command",
               count: packageScripts.has("lint") || ciHasLintCommand ? 1 : 0
@@ -2887,7 +3189,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
         "Penalizes skipped or placeholder-only test files; test-directory support scaffolding (helpers/fixtures with no test in them) is excluded from the denominator."
       )
     ],
-    notes: "A1 is detected from real test files, test runner configuration, and optional coverage configuration."
+    notes: coverageFiles.length === 0 && coverageAnalysis.unresolvedFiles.length > 0 ? `A1 is detected from real test files, test runner configuration, and optional coverage configuration. Coverage command reachability or flag ownership was unresolved in ${coverageAnalysis.unresolvedFiles.slice(0, 4).join(", ")}; the no-coverage absence claim was withheld.` : "A1 is detected from real test files, test runner configuration, and optional coverage configuration."
   };
 }
 function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inventoryAbsenceContext) {
@@ -2971,7 +3273,7 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inve
     notes: `V17 authenticated absence: ${proof.eligibleSourceFileCount} criterion-ratable of ${proof.sourceShapedFileCount} source-shaped files; sampled ${proof.sampledFileCount}; ${proof.readableSampledFileCount} representative-text files.`
   };
 }
-function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, inventoryAbsenceContext, scanLimitations) {
+function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV23PemPrivateKeyGrammar, useV18NativeRls, inventoryAbsenceContext, scanLimitations) {
   const evidence = [];
   const findings = [];
   const gitignore = repoFiles.find((file) => basename(file) === ".gitignore");
@@ -2979,40 +3281,51 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   const migrationFiles = repoFiles.filter(
     (file) => /(^|\/)(migrations?|drizzle|prisma)\//.test(file)
   );
-  let committedSecret;
-  for (const path of repoFiles) {
-    const authoredProductionPath = useV47Detectors ? isV47AuthoredProductionPath(path) : useV39Detectors ? isV39AuthoredProductionPath(path) : isAuthoredProductionPath(path);
-    if (isIgnoredScanFile(path, useV47Detectors) || useV33Detectors && !authoredProductionPath) {
-      continue;
-    }
-    const match = findCommittedSecretInFile(
-      repoPath,
-      path,
-      useV36Detectors,
-      useV39Detectors,
-      useV47Detectors
-    );
-    if (!match) continue;
-    committedSecret = { path, match };
-    break;
-  }
-  const currentSecretFingerprintsByPath = /* @__PURE__ */ new Map();
-  if (useV27Detectors) {
-    for (const path of repoFiles.filter((candidate) => isCredentialHistoryPath(candidate))) {
-      currentSecretFingerprintsByPath.set(
-        path,
-        new Set(
-          findSecretFingerprintsInFile(
-            repoPath,
+  const { committedSecret, currentSecretFingerprintsByPath } = withContentReadSignal(
+    "A2",
+    "secret_cleanliness",
+    () => {
+      let match_;
+      for (const path of repoFiles) {
+        const authoredProductionPath = useV47Detectors ? isV47AuthoredProductionPath(path) : useV39Detectors ? isV39AuthoredProductionPath(path) : isAuthoredProductionPath(path);
+        if (isIgnoredScanFile(path, useV47Detectors) || useV33Detectors && !authoredProductionPath) {
+          continue;
+        }
+        const found = findCommittedSecretInFile(
+          repoPath,
+          path,
+          useV36Detectors,
+          useV39Detectors,
+          useV47Detectors,
+          useV23PemPrivateKeyGrammar
+        );
+        if (!found) continue;
+        match_ = { path, match: found };
+        break;
+      }
+      const fingerprintsByPath = /* @__PURE__ */ new Map();
+      if (useV27Detectors) {
+        for (const path of repoFiles.filter(
+          (candidate) => isCredentialHistoryPath(candidate, useV36Detectors, useV23PemPrivateKeyGrammar)
+        )) {
+          fingerprintsByPath.set(
             path,
-            useV36Detectors,
-            useV39Detectors,
-            useV47Detectors
-          )
-        )
-      );
+            new Set(
+              findSecretFingerprintsInFile(
+                repoPath,
+                path,
+                useV36Detectors,
+                useV39Detectors,
+                useV47Detectors,
+                useV23PemPrivateKeyGrammar
+              )
+            )
+          );
+        }
+      }
+      return { committedSecret: match_, currentSecretFingerprintsByPath: fingerprintsByPath };
     }
-  }
+  );
   const historySecretScan = committedSecret && !useV27Detectors ? null : collectHistorySecretEvidence(
     repoPath,
     useV27Detectors,
@@ -3021,13 +3334,18 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
     useV33Detectors,
     useV36Detectors,
     useV39Detectors,
-    useV47Detectors
+    useV47Detectors,
+    useV23PemPrivateKeyGrammar
   );
   const hasConfirmedSecretFinding = committedSecret != null || historySecretScan?.evidence != null;
-  const cryptoHygiene = collectCryptoHygieneEvidence(
-    repoPath,
-    repoFiles.filter(isImplementationFile).slice(0, 60),
-    useV39Detectors
+  const cryptoHygiene = withContentReadSignal(
+    "A2",
+    "crypto_comparison_hygiene",
+    () => collectCryptoHygieneEvidence(
+      repoPath,
+      repoFiles.filter(isImplementationFile).slice(0, 60),
+      useV39Detectors
+    )
   );
   const implFiles = repoFiles.filter(isImplementationFile);
   const gitignoreHasEnvRule = gitignore != null && fileContains(repoPath, gitignore, /^\.env(\*|\b)|\.env\./m);
@@ -3067,57 +3385,93 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   } else if (dbLayerImportFile != null) {
     evidence.push(evidenceForRelative(repoPath, dbLayerImportFile, "artifact", "DB client import"));
   }
-  const v47RlsPolicyFiles = useV47Detectors ? findRlsPolicyFiles(repoPath, repoFiles) : [];
-  const nativeRlsInventory = useV18NativeRls ? deriveRlsPolicyScopeInventory(repoPath, repoFiles) : null;
-  const tenantWithoutRlsPremiseFiles = useV18NativeRls ? findTenantStoragePremiseFiles(repoPath, repoFiles) : [];
-  const v47TenantStorageFiles = useV47Detectors && !useV18NativeRls ? findTenantStoragePremiseFiles(repoPath, repoFiles) : [];
-  const rlsMigration = useV47Detectors ? v47RlsPolicyFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, RLS_PATTERN));
   const tenantScopePattern = useV39Detectors ? TENANT_SCOPE_PATTERN_V11 : useV36Detectors ? TENANT_SCOPE_PATTERN_V10 : TENANT_SCOPE_PATTERN;
-  const tenantScopedFile = useV18NativeRls ? nativeRlsInventory?.storageFiles[0] : useV47Detectors ? v47TenantStorageFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, tenantScopePattern));
-  const rlsPolicyCount = useV18NativeRls ? nativeRlsInventory?.policyCount ?? 0 : useV47Detectors ? v47RlsPolicyFiles.length : countPatternMatches(
-    repoPath,
-    migrationFiles,
-    /create policy|enable row level security|force row level security/gi
+  const {
+    rlsMigration,
+    tenantScopedFile,
+    rlsPolicyCount,
+    tenantScopedMigrationFileCount,
+    nativeRlsInventory,
+    tenantWithoutRlsPremiseFiles
+  } = withContentReadSignals("A2", ["rls_policy_count", "tenant_scope_ratio"], () => {
+    const v47RlsPolicyFiles = useV47Detectors ? findRlsPolicyFiles(repoPath, repoFiles) : [];
+    const rlsInventory = useV18NativeRls ? deriveRlsPolicyScopeInventory(repoPath, repoFiles) : null;
+    const tenantWithoutRlsFiles = useV18NativeRls ? findTenantStoragePremiseFiles(repoPath, repoFiles) : [];
+    const v47TenantStorageFiles = useV47Detectors && !useV18NativeRls ? findTenantStoragePremiseFiles(repoPath, repoFiles) : [];
+    return {
+      rlsMigration: useV47Detectors ? v47RlsPolicyFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, RLS_PATTERN)),
+      tenantScopedFile: useV18NativeRls ? rlsInventory?.storageFiles[0] : useV47Detectors ? v47TenantStorageFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, tenantScopePattern)),
+      rlsPolicyCount: useV18NativeRls ? rlsInventory?.policyCount ?? 0 : useV47Detectors ? v47RlsPolicyFiles.length : countPatternMatches(
+        repoPath,
+        migrationFiles,
+        /create policy|enable row level security|force row level security/gi
+      ),
+      tenantScopedMigrationFileCount: useV18NativeRls ? rlsInventory?.storageFiles.length ?? 0 : useV47Detectors ? v47TenantStorageFiles.length : countFilesContaining(repoPath, migrationFiles, tenantScopePattern),
+      nativeRlsInventory: rlsInventory,
+      tenantWithoutRlsPremiseFiles: tenantWithoutRlsFiles
+    };
+  });
+  const { gitignoreEnvFile, hasEnvReadsInImplementation, envHandlingDepth } = withContentReadSignal(
+    "A2",
+    "env_handling_depth",
+    () => {
+      const envFile = gitignore && fileContains(repoPath, gitignore, /^\.env(\*|\b)|\.env\./m) ? gitignore : null;
+      const hasEnvReads = countFilesContaining(repoPath, repoFiles.filter(isImplementationFile), ENV_READ_PATTERN) > 0;
+      const depth = (envExamples.length > 0 ? 1 : 0) + (envFile ? 1 : 0) + (hasEnvReads ? 1 : 0);
+      return { gitignoreEnvFile: envFile, hasEnvReadsInImplementation: hasEnvReads, envHandlingDepth: depth };
+    }
   );
-  const tenantScopedMigrationFileCount = useV18NativeRls ? nativeRlsInventory?.storageFiles.length ?? 0 : useV47Detectors ? v47TenantStorageFiles.length : countFilesContaining(repoPath, migrationFiles, tenantScopePattern);
-  const gitignoreEnvFile = gitignore && fileContains(repoPath, gitignore, /^\.env(\*|\b)|\.env\./m) ? gitignore : null;
-  const envHandlingDepth = (envExamples.length > 0 ? 1 : 0) + (gitignoreEnvFile ? 1 : 0) + (countFilesContaining(repoPath, repoFiles.filter(isImplementationFile), ENV_READ_PATTERN) > 0 ? 1 : 0);
   const isMultiTenant = useV18NativeRls ? (nativeRlsInventory?.policyCount ?? 0) > 0 && (nativeRlsInventory?.scopeIdentifiers.length ?? 0) > 0 : tenantScopedMigrationFileCount > 0;
   if (gitignoreEnvFile) {
-    evidence.push(
-      evidenceForRelative(repoPath, gitignoreEnvFile, "secret_scan", ".env files are gitignored")
+    withContentReadSignal(
+      "A2",
+      "env_handling_depth",
+      () => evidence.push(
+        evidenceForRelative(repoPath, gitignoreEnvFile, "secret_scan", ".env files are gitignored")
+      )
     );
   }
-  for (const file of envExamples.slice(0, 3)) {
-    evidence.push(evidenceForRelative(repoPath, file, "secret_scan", "Environment template"));
-  }
+  withContentReadSignal("A2", "env_handling_depth", () => {
+    for (const file of envExamples.slice(0, 3)) {
+      evidence.push(evidenceForRelative(repoPath, file, "secret_scan", "Environment template"));
+    }
+  });
   if (rlsMigration) {
-    evidence.push(
-      evidenceForRelative(repoPath, rlsMigration, "artifact", "RLS or tenant migration")
+    withContentReadSignals(
+      "A2",
+      ["rls_policy_count", "tenant_scope_ratio"],
+      () => evidence.push(
+        evidenceForRelative(repoPath, rlsMigration, "artifact", "RLS or tenant migration")
+      )
     );
   }
   if (tenantScopedFile) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        tenantScopedFile,
-        "artifact",
-        useV18NativeRls ? `Repository-native RLS scope (${nativeRlsInventory?.scopeIdentifiers.join(", ")})` : "Tenant scoping signal"
+    withContentReadSignals(
+      "A2",
+      ["rls_policy_count", "tenant_scope_ratio"],
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          tenantScopedFile,
+          "artifact",
+          useV18NativeRls ? `Repository-native RLS scope (${nativeRlsInventory?.scopeIdentifiers.join(", ")})` : "Tenant scoping signal"
+        )
       )
     );
   }
   if (committedSecret) {
     const isTestPath = isTestOrFixturePath(committedSecret.path);
     const isDefaultAdmin = committedSecret.match.kind === "default_admin";
+    const isPemPrivateKey = committedSecret.match.kind === "pem_private_key";
     findings.push({
       severity: isTestPath ? "info" : "critical",
-      summary: isDefaultAdmin ? isTestPath ? `Default administrative credential in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production deployment default; verify.` : "An explicit default administrative credential appears committed in production configuration." : isTestPath ? `Secret-shaped value in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production leak; verify.` : "Secret-shaped value appears committed in the scanned repository.",
+      summary: isDefaultAdmin ? isTestPath ? `Default administrative credential in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production deployment default; verify.` : "An explicit default administrative credential appears committed in production configuration." : isPemPrivateKey ? isTestPath ? `PEM-formatted private key in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production leak; verify.` : "A PEM-formatted private key appears committed in the scanned repository." : isTestPath ? `Secret-shaped value in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production leak; verify.` : "Secret-shaped value appears committed in the scanned repository.",
       evidence: evidenceForRelativeAtLine(
         repoPath,
         committedSecret.path,
         "secret_scan",
         secretEvidenceLabel(
-          isDefaultAdmin ? "Committed default administrative credential" : "Committed secret-shaped value",
+          isDefaultAdmin ? "Committed default administrative credential" : isPemPrivateKey ? "Committed PEM-formatted private key" : "Committed secret-shaped value",
           committedSecret.match
         ),
         committedSecret.match.line
@@ -3148,9 +3502,10 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   if (historySecretScan?.evidence) {
     const historyPath = historySecretScan.evidence.path ?? "";
     const isTestPath = isTestOrFixturePath(historyPath);
+    const isPemPrivateKey = historySecretScan.secretKind === "pem_private_key";
     findings.push({
       severity: isTestPath ? "info" : "critical",
-      summary: isTestPath ? `Secret-shaped value in git history for a test/fixture file (${historyPath}) \u2014 likely fixture data, not a production leak; verify.` : "Secret-shaped value appears in recent git history.",
+      summary: isPemPrivateKey ? isTestPath ? `PEM-formatted private key in git history for a test/fixture file (${historyPath}) \u2014 likely fixture data, not a production leak; verify.` : "A PEM-formatted private key appears in recent git history." : isTestPath ? `Secret-shaped value in git history for a test/fixture file (${historyPath}) \u2014 likely fixture data, not a production leak; verify.` : "Secret-shaped value appears in recent git history.",
       evidence: historySecretScan.evidence
     });
   } else if (historySecretScan?.truncated) {
@@ -3226,11 +3581,7 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
           { label: ".gitignore environment-file rule", count: gitignoreEnvFile ? 1 : 0 },
           {
             label: "environment reads in implementation code",
-            count: countFilesContaining(
-              repoPath,
-              repoFiles.filter(isImplementationFile),
-              ENV_READ_PATTERN
-            ) > 0 ? 1 : 0
+            count: hasEnvReadsInImplementation ? 1 : 0
           }
         ]
       }
@@ -3409,37 +3760,51 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
   const envTemplate = repoFiles.find(
     (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isEnvTemplatePath(file)
   );
-  const healthChecks = repoFiles.filter(
-    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isHealthCheckSignalFile(repoPath, file)
+  const healthChecks = withContentReadSignal(
+    "A3",
+    "prod_readiness_primitives",
+    () => repoFiles.filter(
+      (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isHealthCheckSignalFile(repoPath, file)
+    )
   );
   const healthCheck = healthChecks[0];
-  const hasV20HealthOrReadinessRoute = useV20ExplicitGaps && repoFiles.some(
-    (file) => isAuthoredProductionPath(file) && isImplementationFile(file) && fileContains(repoPath, file, V20_HEALTH_OR_READINESS_ROUTE_PATTERN)
-  );
-  const hasV22PackageStartHealthOrReadinessRoute = v22PackageStartHttpEntrypoint !== null && fileContains(
-    repoPath,
-    v22PackageStartHttpEntrypoint,
-    V20_HEALTH_OR_READINESS_ROUTE_PATTERN
-  );
+  const { hasV20HealthOrReadinessRoute, hasV22PackageStartHealthOrReadinessRoute } = withContentReadSignal("A3", "health_readiness_route", () => ({
+    hasV20HealthOrReadinessRoute: useV20ExplicitGaps && repoFiles.some(
+      (file) => isAuthoredProductionPath(file) && isImplementationFile(file) && fileContains(repoPath, file, V20_HEALTH_OR_READINESS_ROUTE_PATTERN)
+    ),
+    hasV22PackageStartHealthOrReadinessRoute: v22PackageStartHttpEntrypoint !== null && fileContains(
+      repoPath,
+      v22PackageStartHttpEntrypoint,
+      V20_HEALTH_OR_READINESS_ROUTE_PATTERN
+    )
+  }));
   const serverEntrypoint = v22PackageStartHttpEntrypoint ?? findServerEntrypointFile(repoPath, repoFiles, useV27Detectors) ?? v20DirectHttpEntrypoint ?? null;
   const runtimeContainer = useV27Detectors ? findRuntimeContainerEntrypointFile(repoPath, repoFiles, useV20ExplicitGaps) : null;
   const errorBoundaries = repoFiles.filter(
     (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && /error-boundary|error\.(tsx|jsx|ts|js)$/.test(file)
   );
   const errorBoundary = errorBoundaries[0];
-  const observabilityCount = countFilesContaining(
-    repoPath,
-    repoFiles.filter(
-      (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isImplementationFile(file)
-    ),
-    /sentry|otel|opentelemetry|datadog|prometheus|metrics|logger|logtail/i
+  const observabilityCount = withContentReadSignal(
+    "A3",
+    "observability_depth",
+    () => countFilesContaining(
+      repoPath,
+      repoFiles.filter(
+        (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isImplementationFile(file)
+      ),
+      /sentry|otel|opentelemetry|datadog|prometheus|metrics|logger|logtail/i
+    )
   );
-  const rollbackSafetyCount = countFilesContaining(
-    repoPath,
-    repoFiles.filter(
-      (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && /(^|\/)(docs|migrations?|drizzle|prisma|scripts)\//.test(file)
-    ),
-    /rollback|roll back|migration safety|down migration|reversible|undo migration/i
+  const rollbackSafetyCount = withContentReadSignal(
+    "A3",
+    "rollback_safety_depth",
+    () => countFilesContaining(
+      repoPath,
+      repoFiles.filter(
+        (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && /(^|\/)(docs|migrations?|drizzle|prisma|scripts)\//.test(file)
+      ),
+      /rollback|roll back|migration safety|down migration|reversible|undo migration/i
+    )
   );
   if (packageJson && (scripts.has("build") || scripts.has("typecheck"))) {
     evidence.push(
@@ -3467,10 +3832,15 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
     );
   if (envTemplate)
     evidence.push(evidenceForRelative(repoPath, envTemplate, "prod_check", "Environment template"));
-  if (healthCheck)
-    evidence.push(
-      evidenceForRelative(repoPath, healthCheck, "prod_check", "Health/readiness signal")
+  if (healthCheck) {
+    withContentReadSignal(
+      "A3",
+      "prod_readiness_primitives",
+      () => evidence.push(
+        evidenceForRelative(repoPath, healthCheck, "prod_check", "Health/readiness signal")
+      )
     );
+  }
   if (errorBoundary)
     evidence.push(evidenceForRelative(repoPath, errorBoundary, "prod_check", "Error boundary"));
   if (evidence.length === 0) {
@@ -3509,7 +3879,12 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
         )
       });
     } else if (runtimeContainer) {
-      if (!fileContains(repoPath, runtimeContainer, /^\s*HEALTHCHECK\s+(?!NONE\b)/im)) {
+      const hasActiveHealthcheck = withContentReadSignal(
+        "A3",
+        "dockerfile_healthcheck",
+        () => fileContains(repoPath, runtimeContainer, /^\s*HEALTHCHECK\s+(?!NONE\b)/im)
+      );
+      if (!hasActiveHealthcheck) {
         findings.push({
           severity: "info",
           summary: "A runtime Dockerfile declares no active HEALTHCHECK instruction.",
@@ -3521,10 +3896,14 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
           )
         });
       }
-    } else if (serverEntrypoint && fileContains(
-      repoPath,
-      serverEntrypoint,
-      /\b(?:request|req)\.(?:url|path|pathname|method)\b/i
+    } else if (serverEntrypoint && withContentReadSignal(
+      "A3",
+      "health_readiness_route",
+      () => fileContains(
+        repoPath,
+        serverEntrypoint,
+        /\b(?:request|req)\.(?:url|path|pathname|method)\b/i
+      )
     ) && healthChecks.length === 0 && !hasV20HealthOrReadinessRoute && !hasV22PackageStartHealthOrReadinessRoute) {
       findings.push({
         severity: "info",
@@ -3630,22 +4009,41 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors,
   const findings = [];
   const manifests = repoFiles.filter(isDependencyManifest);
   const lockfiles = repoFiles.filter(isLockfile);
-  const manifest = pickPrimaryDependencyManifest(repoPath, manifests);
   const lockfile = lockfiles[0];
   const rootLockfile = mono ? mono.sharedFiles.find(isLockfile) : void 0;
   const rootUpdateConfig = mono ? mono.sharedFiles.find(isDependencyUpdateConfig) : void 0;
   const hasLockfile = Boolean(lockfile) || Boolean(rootLockfile);
   const updateConfig = repoFiles.find(isDependencyUpdateConfig);
   const hasUpdateConfig = Boolean(updateConfig) || Boolean(rootUpdateConfig);
-  const auditConfig = manifests.some((file) => packageJsonHasAuditScript(repoPath, file));
-  const dependencySpecs = readDependencySpecs(repoPath, manifests);
+  const auditConfig = withContentReadSignal(
+    "A4",
+    "dependency_automation_ratio",
+    () => manifests.some((file) => packageJsonHasAuditScript(repoPath, file))
+  );
+  const { manifest, dependencySpecs } = withContentReadSignals(
+    "A4",
+    ["pinned_dependency_ratio", "declared_version_range_ratio", "dependency_count_sanity"],
+    () => ({
+      // Cite the manifest that actually carries dependencies for evidence/findings, not
+      // whichever sorts first (e.g. a near-empty requirements-windows.txt that precedes the
+      // real requirements.txt), so the evidence pointer reflects the file the A4 score is
+      // derived from. The score itself is unaffected: it aggregates specs across ALL manifests.
+      manifest: pickPrimaryDependencyManifest(repoPath, manifests),
+      dependencySpecs: readDependencySpecs(repoPath, manifests)
+    })
+  );
   const pinnedDependencyCount = dependencySpecs.filter(
     (dependency) => isPinnedDependencyVersion(dependency.version)
   ).length;
-  if (manifest)
-    evidence.push(
-      evidenceForRelative(repoPath, manifest, "dependency_report", "Dependency manifest")
+  if (manifest) {
+    withContentReadSignals(
+      "A4",
+      ["pinned_dependency_ratio", "declared_version_range_ratio", "dependency_count_sanity"],
+      () => evidence.push(
+        evidenceForRelative(repoPath, manifest, "dependency_report", "Dependency manifest")
+      )
     );
+  }
   if (lockfile)
     evidence.push(
       evidenceForRelative(repoPath, lockfile, "dependency_report", "Dependency lockfile")
@@ -3678,28 +4076,36 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors,
   const deployableServiceFiles = useV47Detectors ? findDeployableServicePremiseFiles(repoPath, repoFiles, true) : [];
   const isAppOrService = (useV47Detectors ? deployableServiceFiles.length > 0 : isDeployableService(repoPath, repoFiles, useV27Detectors)) || packagedApplicationFiles.length > 0;
   if (isAppOrService && !hasLockfile && manifest) {
-    findings.push(
-      inventoryAbsenceFinding({
-        severity: "critical",
-        summaries: {
-          legacy: "Dependency manifest is present without a detected lockfile \u2014 non-reproducible installs.",
-          currentTracked: "Dependency manifest is present, but the tracked scan-eligible inventory matched no recognized lockfile.",
-          currentDirectoryWalk: "Dependency manifest is present, but the bounded directory walk matched no recognized lockfile."
-        },
-        evidence: evidenceForRelative(
-          repoPath,
-          manifest,
-          "dependency_report",
-          "Dependency manifest"
-        ),
-        context: inventoryAbsenceContext,
-        inventoryCount: repoFiles.length + (mono?.sharedFiles.length ?? 0),
-        patternSet: INVENTORY_SCAN_PATTERN_SETS.a4Lockfile,
-        matchCount: 0
-      })
+    withContentReadSignals(
+      "A4",
+      ["pinned_dependency_ratio", "declared_version_range_ratio", "dependency_count_sanity"],
+      () => findings.push(
+        inventoryAbsenceFinding({
+          severity: "critical",
+          summaries: {
+            legacy: "Dependency manifest is present without a detected lockfile \u2014 non-reproducible installs.",
+            currentTracked: "Dependency manifest is present, but the tracked scan-eligible inventory matched no recognized lockfile.",
+            currentDirectoryWalk: "Dependency manifest is present, but the bounded directory walk matched no recognized lockfile."
+          },
+          evidence: evidenceForRelative(
+            repoPath,
+            manifest,
+            "dependency_report",
+            "Dependency manifest"
+          ),
+          context: inventoryAbsenceContext,
+          inventoryCount: repoFiles.length + (mono?.sharedFiles.length ?? 0),
+          patternSet: INVENTORY_SCAN_PATTERN_SETS.a4Lockfile,
+          matchCount: 0
+        })
+      )
     );
   }
-  if (manifest && hasSuspiciousDependencies(repoPath, manifest, useV47Detectors)) {
+  if (manifest && withContentReadSignal(
+    "A4",
+    "suspicious_dependencies",
+    () => hasSuspiciousDependencies(repoPath, manifest, useV47Detectors)
+  )) {
     findings.push({
       severity: "critical",
       summary: "Dependency manifest contains obviously suspicious placeholder dependency names.",
@@ -3853,16 +4259,24 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, inv
     ...allDocFiles,
     ...repoFiles.filter((file) => /(^|\/)(SECURITY|THREAT[_-]?MODEL)\.md$/i.test(file))
   ]);
-  const negativeSpaceDoc = [...negativeSpaceCandidates].find(
-    (file) => fileContains(repoPath, file, NEGATIVE_SPACE_SECTION_PATTERN) || fileContains(repoPath, file, NEGATIVE_SPACE_PHRASE_PATTERN)
+  const negativeSpaceDoc = withContentReadSignal(
+    "A5",
+    "negative_space_documentation",
+    () => [...negativeSpaceCandidates].find(
+      (file) => fileContains(repoPath, file, NEGATIVE_SPACE_SECTION_PATTERN) || fileContains(repoPath, file, NEGATIVE_SPACE_PHRASE_PATTERN)
+    )
   );
   if (negativeSpaceDoc) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        negativeSpaceDoc,
-        "claim_reconciliation",
-        'Documented limitations / threat model / "not covered" section'
+    withContentReadSignal(
+      "A5",
+      "negative_space_documentation",
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          negativeSpaceDoc,
+          "claim_reconciliation",
+          'Documented limitations / threat model / "not covered" section'
+        )
       )
     );
   }
@@ -3999,18 +4413,33 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
   const workflows = repoFiles.filter(isCiWorkflow);
   const workflow = workflows[0];
   const rootWorkflows = mono ? mono.sharedFiles.filter(isCiWorkflow) : [];
-  const defaultBranchCiCount = workflows.filter((file) => workflowTargetsDefaultBranch(repoPath, file)).length + (mono ? rootWorkflows.filter((file) => workflowTargetsDefaultBranch(mono.root, file)).length : 0);
+  const defaultBranchCiCount = withContentReadSignal(
+    "B3",
+    "default_branch_ci_depth",
+    () => workflows.filter((file) => workflowTargetsDefaultBranch(repoPath, file)).length + (mono ? rootWorkflows.filter((file) => workflowTargetsDefaultBranch(mono.root, file)).length : 0)
+  );
   if (packageJson && scripts.has("test")) {
     evidence.push(evidenceForRelative(repoPath, packageJson, "test_run", "Test script"));
   }
   if (packageJson && scripts.has("lint")) {
     evidence.push(evidenceForRelative(repoPath, packageJson, "ci_run", "Lint script"));
   }
-  if (workflow) evidence.push(evidenceForRelative(repoPath, workflow, "ci_run", "CI workflow"));
-  else if (rootWorkflows[0] && mono)
-    evidence.push(
-      evidenceForRelative(mono.root, rootWorkflows[0], "ci_run", "CI workflow (monorepo root)")
+  if (workflow) {
+    withContentReadSignals(
+      "B3",
+      ["ci_script_depth", "default_branch_ci_depth"],
+      () => evidence.push(evidenceForRelative(repoPath, workflow, "ci_run", "CI workflow"))
+    );
+  } else if (rootWorkflows[0] && mono) {
+    const rootWorkflow = rootWorkflows[0];
+    withContentReadSignals(
+      "B3",
+      ["ci_script_depth", "default_branch_ci_depth"],
+      () => evidence.push(
+        evidenceForRelative(mono.root, rootWorkflow, "ci_run", "CI workflow (monorepo root)")
+      )
     );
+  }
   if (evidence.length === 0) return null;
   const CI_BUILD_COMMAND_PATTERN = /\b(cargo\s+build|cmake|ninja|make\s+(build|all))\b/i;
   const CI_COMMAND_CATEGORIES = [
@@ -4020,10 +4449,19 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
     CI_BUILD_COMMAND_PATTERN
   ];
   const scriptDepth = ["test", "lint", "typecheck", "build"].filter((s) => scripts.has(s)).length;
-  const countCiCommandCategories = (root, files) => CI_COMMAND_CATEGORIES.filter(
-    (pattern) => files.some((file) => fileContains(root, file, pattern))
-  ).length;
-  const ciCommandDepth = countCiCommandCategories(repoPath, workflows) + (mono ? countCiCommandCategories(mono.root, rootWorkflows) : 0);
+  const { repoCategoryHits, rootCategoryHits } = withContentReadSignal(
+    "B3",
+    "ci_script_depth",
+    () => ({
+      repoCategoryHits: CI_COMMAND_CATEGORIES.map(
+        (pattern) => workflows.some((file) => fileContains(repoPath, file, pattern))
+      ),
+      rootCategoryHits: mono ? CI_COMMAND_CATEGORIES.map(
+        (pattern) => rootWorkflows.some((file) => fileContains(mono.root, file, pattern))
+      ) : []
+    })
+  );
+  const ciCommandDepth = repoCategoryHits.filter(Boolean).length + rootCategoryHits.filter(Boolean).length;
   const combinedDepth = scriptDepth + ciCommandDepth;
   return {
     criterionId: "B3",
@@ -4045,13 +4483,13 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
               label: `package script: ${name === "typecheck" ? "type-check" : name}`,
               count: scripts.has(name) ? 1 : 0
             })),
-            ...CI_COMMAND_CATEGORIES.map((pattern, index) => ({
+            ...CI_COMMAND_CATEGORIES.map((_pattern, index) => ({
               label: `repository CI command: ${["test", "lint", "type-check", "build"][index]}`,
-              count: workflows.some((file) => fileContains(repoPath, file, pattern)) ? 1 : 0
+              count: repoCategoryHits[index] ? 1 : 0
             })),
-            ...mono ? CI_COMMAND_CATEGORIES.map((pattern, index) => ({
+            ...mono ? CI_COMMAND_CATEGORIES.map((_pattern, index) => ({
               label: `monorepo-root CI command: ${["test", "lint", "type-check", "build"][index]}`,
-              count: rootWorkflows.some((file) => fileContains(mono.root, file, pattern)) ? 1 : 0
+              count: rootCategoryHits[index] ? 1 : 0
             })) : []
           ]
         }
@@ -4096,9 +4534,11 @@ function readAuditFreshnessCommitterYear(repoPath, scanLimitations) {
 function collectB4AuditEvidence(repoPath, repoFiles, generatedAt, useV19CommitYear = false, scanLimitations = /* @__PURE__ */ new Set()) {
   const evidence = [];
   const auditFiles = repoFiles.filter(isAuditFile);
-  for (const file of auditFiles.slice(0, 5)) {
-    evidence.push(evidenceForRelative(repoPath, file, "audit_log", "Audit or changelog artifact"));
-  }
+  withContentReadSignal("B4", "audit_freshness_depth", () => {
+    for (const file of auditFiles.slice(0, 5)) {
+      evidence.push(evidenceForRelative(repoPath, file, "audit_log", "Audit or changelog artifact"));
+    }
+  });
   if (evidence.length === 0) {
     return buildNotApplicableSignal(
       "B4",
@@ -4143,7 +4583,11 @@ function collectB4AuditEvidence(repoPath, repoFiles, generatedAt, useV19CommitYe
       metric(
         "audit_freshness_depth",
         "Audit freshness depth",
-        countFilesContaining(repoPath, auditFiles, freshnessPattern),
+        withContentReadSignal(
+          "B4",
+          "audit_freshness_depth",
+          () => countFilesContaining(repoPath, auditFiles, freshnessPattern)
+        ),
         Math.max(auditFiles.length, 1),
         0.2,
         "ratio",
@@ -4156,93 +4600,128 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detecto
   const evidence = [];
   const findings = [];
   const docFiles = repoFiles.filter((file) => /\.(md|mdx)$/i.test(file));
-  const humanGateDoc = docFiles.find(
-    (file) => fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN)
+  const humanGateDoc = withContentReadSignal(
+    "B6",
+    "human_gate_documented",
+    () => docFiles.find((file) => fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN))
   );
   const implFiles = repoFiles.filter(isImplementationFile);
-  const gatedPrivilegeCheckFile = implFiles.find(
-    (file) => fileContains(repoPath, file, GATED_PRIVILEGE_CHECK_PATTERN) && fileContains(repoPath, file, SET_ROLE_PATTERN)
+  const gatedPrivilegeCheckFile = withContentReadSignal(
+    "B6",
+    "fail_closed_privilege_check",
+    () => implFiles.find(
+      (file) => fileContains(repoPath, file, GATED_PRIVILEGE_CHECK_PATTERN) && fileContains(repoPath, file, SET_ROLE_PATTERN)
+    )
   );
-  const killSwitchFile = implFiles.find(
-    (file) => fileContains(repoPath, file, KILL_SWITCH_NAME_PATTERN) && fileContains(repoPath, file, KILL_SWITCH_FAIL_CLOSED_PATTERN)
+  const killSwitchFile = withContentReadSignal(
+    "B6",
+    "kill_switch_fail_safe_present",
+    () => implFiles.find(
+      (file) => fileContains(repoPath, file, KILL_SWITCH_NAME_PATTERN) && fileContains(repoPath, file, KILL_SWITCH_FAIL_CLOSED_PATTERN)
+    )
   );
   const codeownersFile = repoFiles.find((file) => /(^|\/)CODEOWNERS$/.test(file));
-  const reviewGateDoc = docFiles.find(
-    (file) => fileContains(repoPath, file, REQUIRED_REVIEW_PATTERN)
+  const reviewGateDoc = withContentReadSignal(
+    "B6",
+    "protected_path_review_gate",
+    () => docFiles.find((file) => fileContains(repoPath, file, REQUIRED_REVIEW_PATTERN))
   );
   const protectedPathReviewGate = codeownersFile ?? reviewGateDoc;
-  const executableFiles = implFiles.filter(
-    (file) => fileContains(repoPath, file, SQL_EXEC_PATTERN)
-  );
-  const historicalUngatedEscalationFiles = executableFiles.filter((file) => {
-    if (useV39Detectors && !fileHasExecutedPrivilegeEscalation(repoPath, file)) return false;
-    const hasEscalation = fileContains(repoPath, file, ROLE_MEMBERSHIP_GRANT_PATTERN) || fileContains(repoPath, file, SUPERUSER_ESCALATION_PATTERN);
-    if (!hasEscalation) return false;
-    return !fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN);
+  const { executableFiles, v21ExecutedEscalationFileSet, productionUngatedEscalationFiles } = withContentReadSignal("B6", "privilege_escalation_cleanliness", () => {
+    const executable = implFiles.filter((file) => fileContains(repoPath, file, SQL_EXEC_PATTERN));
+    const historicalUngated = executable.filter((file) => {
+      if (useV39Detectors && !fileHasExecutedPrivilegeEscalation(repoPath, file)) return false;
+      const hasEscalation = fileContains(repoPath, file, ROLE_MEMBERSHIP_GRANT_PATTERN) || fileContains(repoPath, file, SUPERUSER_ESCALATION_PATTERN);
+      if (!hasEscalation) return false;
+      return !fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN);
+    });
+    const v21Executed = useV21ExecutedEscalations ? repoFiles.filter(
+      (file) => isV39AuthoredProductionPath(file) && (fileHasV21RawSqlEscalation(repoPath, file) || isImplementationFile(file) && fileHasV21DriverEscalation(repoPath, file))
+    ) : [];
+    const v21ExecutedSet = new Set(v21Executed);
+    const ungated = [.../* @__PURE__ */ new Set([...historicalUngated, ...v21Executed])].filter(
+      (file) => !fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN)
+    );
+    const productionUngated = ungated.filter(
+      (file) => useV39Detectors ? isV39AuthoredProductionPath(file) : !isTestOrFixturePath(file)
+    );
+    return {
+      executableFiles: executable,
+      v21ExecutedEscalationFileSet: v21ExecutedSet,
+      productionUngatedEscalationFiles: productionUngated
+    };
   });
-  const v21ExecutedEscalationFiles = useV21ExecutedEscalations ? repoFiles.filter(
-    (file) => isV39AuthoredProductionPath(file) && (fileHasV21RawSqlEscalation(repoPath, file) || isImplementationFile(file) && fileHasV21DriverEscalation(repoPath, file))
-  ) : [];
-  const v21ExecutedEscalationFileSet = new Set(v21ExecutedEscalationFiles);
-  const ungatedEscalationFiles = [
-    .../* @__PURE__ */ new Set([...historicalUngatedEscalationFiles, ...v21ExecutedEscalationFiles])
-  ].filter((file) => !fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN));
-  const productionUngatedEscalationFiles = ungatedEscalationFiles.filter(
-    (file) => useV39Detectors ? isV39AuthoredProductionPath(file) : !isTestOrFixturePath(file)
-  );
   if (humanGateDoc) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        humanGateDoc,
-        "artifact",
-        "Documents privileged operations as human-executed/gated"
+    withContentReadSignal(
+      "B6",
+      "human_gate_documented",
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          humanGateDoc,
+          "artifact",
+          "Documents privileged operations as human-executed/gated"
+        )
       )
     );
   }
   if (gatedPrivilegeCheckFile) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        gatedPrivilegeCheckFile,
-        "artifact",
-        "Fail-closed privilege-membership check before role elevation"
+    withContentReadSignal(
+      "B6",
+      "fail_closed_privilege_check",
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          gatedPrivilegeCheckFile,
+          "artifact",
+          "Fail-closed privilege-membership check before role elevation"
+        )
       )
     );
   }
   if (killSwitchFile) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        killSwitchFile,
-        "artifact",
-        "Un-overridable kill-switch / fail-safe governance toggle"
+    withContentReadSignal(
+      "B6",
+      "kill_switch_fail_safe_present",
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          killSwitchFile,
+          "artifact",
+          "Un-overridable kill-switch / fail-safe governance toggle"
+        )
       )
     );
   }
   if (protectedPathReviewGate) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        protectedPathReviewGate,
-        "artifact",
-        "CODEOWNERS/required-review gate on protected paths"
+    withContentReadSignal(
+      "B6",
+      "protected_path_review_gate",
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          protectedPathReviewGate,
+          "artifact",
+          "CODEOWNERS/required-review gate on protected paths"
+        )
       )
     );
   }
-  for (const file of productionUngatedEscalationFiles.slice(0, 5)) {
-    const isV21ExecutedShape = v21ExecutedEscalationFileSet.has(file);
-    findings.push({
-      severity: "critical",
-      summary: isV21ExecutedShape ? "This file contains an authored administrative SQL statement \u2014 role-membership grant, SUPERUSER escalation, or schema-wide table privilege grant \u2014 or executes one through a direct database-driver call, and does not itself contain text matching the human-gate marker pattern." : "This file executes a role-membership GRANT or SUPERUSER escalation and does not itself contain text matching the human-gate marker pattern.",
-      evidence: evidenceForRelative(
-        repoPath,
-        file,
-        "artifact",
-        isV21ExecutedShape ? "Ungated authored or directly executed administrative SQL statement" : "Ungated privilege-escalation statement"
-      )
-    });
-  }
+  withContentReadSignal("B6", "privilege_escalation_cleanliness", () => {
+    for (const file of productionUngatedEscalationFiles.slice(0, 5)) {
+      const isV21ExecutedShape = v21ExecutedEscalationFileSet.has(file);
+      findings.push({
+        severity: "critical",
+        summary: isV21ExecutedShape ? "This file contains an authored administrative SQL statement \u2014 role-membership grant, SUPERUSER escalation, or schema-wide table privilege grant \u2014 or executes one through a direct database-driver call, and does not itself contain text matching the human-gate marker pattern." : "This file executes a role-membership GRANT or SUPERUSER escalation and does not itself contain text matching the human-gate marker pattern.",
+        evidence: evidenceForRelative(
+          repoPath,
+          file,
+          "artifact",
+          isV21ExecutedShape ? "Ungated authored or directly executed administrative SQL statement" : "Ungated privilege-escalation statement"
+        )
+      });
+    }
+  });
   if (evidence.length === 0 && findings.length === 0) {
     return buildNotApplicableSignal(
       "B6",
@@ -4264,7 +4743,7 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detecto
       }
     )
   ] : [];
-  const hasPrivilegedOpsSurface = humanGateDoc != null || gatedPrivilegeCheckFile != null || executableFiles.length > 0 || v21ExecutedEscalationFiles.length > 0;
+  const hasPrivilegedOpsSurface = humanGateDoc != null || gatedPrivilegeCheckFile != null || executableFiles.length > 0 || v21ExecutedEscalationFileSet.size > 0;
   return {
     criterionId: "B6",
     positiveEvidence: evidence,
@@ -4408,6 +4887,7 @@ var GATED_PRIVILEGE_CHECK_PATTERN = /pg_has_role\s*\(|has_role\s*\(|is not a mem
 var SET_ROLE_PATTERN = /\bset\s+(local\s+)?role\b/i;
 var REQUIRED_REVIEW_PATTERN = /required review|branch protection|protected branch/i;
 var HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT = 5e3;
+var V23_PEM_WIDENED_HISTORY_BLOB_LIMIT = 500;
 var SECRET_IDENTIFIER_KEYWORD_PATTERN = /secret|token|api[_-]?key|password|access[_-]?key/gi;
 var SINGLE_WHITESPACE_PATTERN = /\s/u;
 var SECRET_VALUE_BRANDED_PATTERN = /^(?:sk-[A-Za-z0-9_-]{24,}|sk-ant-api\d{2}-[A-Za-z0-9_-]{80,}|ghp_[A-Za-z0-9_]{30,}|xox[baprs]-[A-Za-z0-9-]{24,}|AKIA[0-9A-Z]{16}|vcp_[A-Za-z0-9_:-]{24,})$/;
@@ -4567,12 +5047,7 @@ function parseGitTrackedFiles(repoPath, output, includeHardExcluded) {
         continue;
       }
       if (stat.size > MAX_REPOSITORY_CONTENT_BYTES) {
-        const affectedCriteria = affectedCriteriaForUnavailablePath(file);
-        if (affectedCriteria.length > 0) {
-          recordContentSkipForCriteria(fullPath, "too_large", affectedCriteria, true);
-        } else {
-          recordContentSkip(fullPath, "too_large", true);
-        }
+        recordContentSkip(fullPath, "too_large", true);
         continue;
       }
     } catch (error) {
@@ -4586,39 +5061,6 @@ function parseGitTrackedFiles(repoPath, output, includeHardExcluded) {
   }
   return files.sort();
 }
-function affectedCriteriaForUnavailablePath(file) {
-  const affected = /* @__PURE__ */ new Set();
-  if (isDependencyManifest(file) || isLockfile(file)) affected.add("A4");
-  if (isCiWorkflow(file)) {
-    affected.add("A1");
-    affected.add("A3");
-    affected.add("B2");
-    affected.add("B3");
-  }
-  if (isDeployConfig(file)) {
-    affected.add("A3");
-    affected.add("B2");
-  }
-  if (isTestFile(file)) {
-    affected.add("A1");
-    affected.add("A2");
-  }
-  if (isImplementationFile(file)) {
-    affected.add("A1");
-    affected.add("A2");
-    affected.add("A3");
-    affected.add("B1");
-    affected.add("B6");
-  }
-  if (/\.(?:md|mdx|rst|txt)$/i.test(file)) {
-    affected.add("A5");
-    affected.add("B4");
-    affected.add("B5");
-    affected.add("B6");
-  }
-  if (isAuditFile(file)) affected.add("B5");
-  return [...affected];
-}
 function directoryInventory(repoPath) {
   const files = [];
   const rootDevice = statSync(repoPath).dev;
@@ -4740,12 +5182,7 @@ function visitRepoDir(repoPath, dirPath, files, rootDevice) {
     }
     const repoRelativePath = relative(repoPath, fullPath);
     if (size > MAX_REPOSITORY_CONTENT_BYTES) {
-      const affectedCriteria = affectedCriteriaForUnavailablePath(repoRelativePath);
-      if (affectedCriteria.length > 0) {
-        recordContentSkipForCriteria(fullPath, "too_large", affectedCriteria);
-      } else {
-        recordContentSkip(fullPath, "too_large");
-      }
+      recordContentSkip(fullPath, "too_large");
       continue;
     }
     if (!isPotentialContentPath(repoRelativePath)) {
@@ -5187,6 +5624,9 @@ function isRecord(value) {
 function isTestRunnerConfig(repoPath, file) {
   return /(^|\/)(vitest|jest|pytest|playwright|cypress|mocha)\.config\.[cm]?[jt]s$/.test(file) || /(^|\/)(pytest\.ini|tox\.ini)$/.test(file) || /(^|\/)phpunit\.xml(\.dist)?$/.test(file) || /(^|\/)pyproject\.toml$/.test(file) && fileContains(repoPath, file, /^\[tool\.pytest(?:\.|\])/m) || /(^|\/)CMakeLists\.txt$/.test(file) && fileContains(repoPath, file, /\b(?:enable_testing|add_test|ctest_add_tests)\s*\(/i) || /(^|\/)Makefile$/.test(file) && fileContains(repoPath, file, /^\s*(?:test|tests|check)\s*:/m);
 }
+function isRecipeTestEntry(repoPath, file) {
+  return isRecipeFile(file) && fileContains(repoPath, file, /^\s*(?:test|tests|check)\s*:/m);
+}
 function findCoverageConfigFiles(repoPath, repoFiles, authoredOnly = false) {
   return repoFiles.filter(
     (file) => (!authoredOnly || isAuthoredProductionPath(file)) && isCoverageConfig(repoPath, file)
@@ -5480,6 +5920,580 @@ function packageJsonHasCoverageTooling(repoPath, file) {
   }
   return false;
 }
+function isV23CoverageConfig(repoPath, file) {
+  if (/(^|\/)vitest\.config\.[cm]?[jt]s$/.test(file)) {
+    const contents = stripJavaScriptComments(readRepoText(join(repoPath, file), "utf8"));
+    const property = /(?:^|[{,])\s*["']?coverage["']?\s*:\s*([^,\r\n}]*)/im.exec(contents)?.[1]?.trim();
+    if (!property || /^(?:false\b|null\b|undefined\b)/i.test(property)) return false;
+    if (/^\{/.test(property) && /\benabled\s*:\s*false\b/i.test(contents)) return false;
+    return true;
+  }
+  if (/(^|\/)jest\.config\.[cm]?[jt]s$/.test(file)) {
+    const contents = stripJavaScriptComments(readRepoText(join(repoPath, file), "utf8"));
+    return /(?:^|[{,])\s*["']?collectCoverage["']?\s*:\s*true\b/m.test(contents) || /(?:^|[{,])\s*["']?(?:coverageThreshold|coverageProvider|coverageDirectory)["']?\s*:/m.test(
+      contents
+    );
+  }
+  if (/(^|\/)package\.json$/.test(file)) {
+    return packageJsonHasStaticCoverageTooling(repoPath, file);
+  }
+  return isCoverageConfig(repoPath, file);
+}
+function coverageConfigurationDecision(repoPath, file) {
+  const detectorState = isV23CoverageConfig(repoPath, file) ? "collects" : "none";
+  if (/(^|\/)vitest\.config\.[cm]?[jt]s$/.test(file)) {
+    const rawContents = readRepoText(join(repoPath, file), "utf8");
+    const contents = stripJavaScriptComments(rawContents);
+    const match = /(?:^|[{,])\s*["']?coverage["']?\s*:\s*([^,\r\n}]*)/im.exec(contents);
+    if (!match) return null;
+    return {
+      path: file,
+      source: "runner-configuration",
+      locator: "coverage",
+      evidence: rawContents.slice(match.index, match.index + match[0].length).trim(),
+      detectorRecognized: true,
+      detectorState
+    };
+  }
+  if (/(^|\/)jest\.config\.[cm]?[jt]s$/.test(file)) {
+    const rawContents = readRepoText(join(repoPath, file), "utf8");
+    const contents = stripJavaScriptComments(rawContents);
+    const match = /(?:^|[{,])\s*["']?(collectCoverage|coverageThreshold|coverageProvider|coverageDirectory)["']?\s*:\s*([^,\r\n}]*)/m.exec(
+      contents
+    );
+    if (!match) return null;
+    return {
+      path: file,
+      source: "runner-configuration",
+      locator: match[1] ?? "coverage",
+      evidence: rawContents.slice(match.index, match.index + match[0].length).trim(),
+      detectorRecognized: true,
+      detectorState
+    };
+  }
+  if (detectorState === "none") return null;
+  return {
+    path: file,
+    source: "runner-configuration",
+    locator: "coverage",
+    evidence: file,
+    detectorRecognized: true,
+    detectorState
+  };
+}
+function packageJsonHasStaticCoverageTooling(repoPath, file) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return false;
+  const parsed = parseJsonObject(readRepoText(fullPath, "utf8"));
+  if (!parsed) return false;
+  return ["nyc", "c8", "istanbul"].some((key) => {
+    const config = parsed[key];
+    return typeof config === "object" && config !== null && !Array.isArray(config);
+  });
+}
+function analyzeCoverageConfiguration(repoPath, repoFiles, authoredOnly = false) {
+  const eligibleFiles = repoFiles.filter(
+    (file) => !authoredOnly || isAuthoredProductionPath(file)
+  );
+  const eligibleSet = new Set(eligibleFiles);
+  const coverageFiles = /* @__PURE__ */ new Set();
+  const unresolvedFiles = /* @__PURE__ */ new Set();
+  const ciCommandsByFile = /* @__PURE__ */ new Map();
+  const detectorDecisions = [];
+  let hasCoverageCommand = false;
+  for (const file of eligibleFiles.filter(isCiWorkflow)) {
+    const commands = extractCiRunCommands(readRepoText(join(repoPath, file), "utf8"));
+    ciCommandsByFile.set(file, commands);
+    const commandDecisions = commands.map(
+      (command, index) => coverageDetectorDecision(repoPath, eligibleSet, {
+        path: file,
+        source: "ci-run",
+        locator: String(index),
+        command
+      })
+    );
+    detectorDecisions.push(...commandDecisions);
+    const state = combineCoverageCommandStates(
+      commandDecisions.map((decision) => decision.detectorState)
+    );
+    if (state === "collects") {
+      coverageFiles.add(file);
+      hasCoverageCommand = true;
+    }
+    if (state === "unresolved") unresolvedFiles.add(file);
+  }
+  const ciCommands = [...ciCommandsByFile.values()].flat();
+  for (const file of eligibleFiles) {
+    if (isCiWorkflow(file) || isRecipeFile(file)) continue;
+    if (/(^|\/)package\.json$/.test(file)) {
+      if (packageJsonHasStaticCoverageTooling(repoPath, file)) coverageFiles.add(file);
+      const packageState = packageScriptCoverageState(
+        repoPath,
+        eligibleSet,
+        file,
+        file === "package.json" ? ciCommands : [],
+        detectorDecisions
+      );
+      if (packageState === "collects") {
+        coverageFiles.add(file);
+        hasCoverageCommand = true;
+      }
+      if (packageState === "unresolved") unresolvedFiles.add(file);
+      continue;
+    }
+    const configurationDecision = coverageConfigurationDecision(repoPath, file);
+    if (configurationDecision) detectorDecisions.push(configurationDecision);
+    if (configurationDecision?.detectorState === "collects") coverageFiles.add(file);
+  }
+  for (const file of eligibleFiles.filter(isRecipeFile)) {
+    const state = recipeCoverageState(
+      repoPath,
+      eligibleSet,
+      file,
+      ciCommands,
+      detectorDecisions
+    );
+    if (state === "collects") {
+      coverageFiles.add(file);
+      hasCoverageCommand = true;
+    }
+    if (state === "unresolved") unresolvedFiles.add(file);
+  }
+  for (const file of coverageFiles) unresolvedFiles.delete(file);
+  return {
+    coverageFiles: [...coverageFiles].sort(),
+    unresolvedFiles: [...unresolvedFiles].sort(),
+    hasCoverageCommand,
+    detectorDecisions
+  };
+}
+function stripJavaScriptComments(contents) {
+  let output = "";
+  let quote = null;
+  let escaped = false;
+  let lineComment = false;
+  let blockComment = false;
+  for (let index = 0; index < contents.length; index += 1) {
+    const character = contents[index] ?? "";
+    const next = contents[index + 1] ?? "";
+    if (lineComment) {
+      if (character === "\n") {
+        lineComment = false;
+        output += "\n";
+      } else {
+        output += " ";
+      }
+      continue;
+    }
+    if (blockComment) {
+      if (character === "*" && next === "/") {
+        output += "  ";
+        index += 1;
+        blockComment = false;
+      } else {
+        output += character === "\n" ? "\n" : " ";
+      }
+      continue;
+    }
+    if (escaped) {
+      output += character;
+      escaped = false;
+      continue;
+    }
+    if (quote) {
+      output += character;
+      if (character === "\\") escaped = true;
+      else if (character === quote) quote = null;
+      continue;
+    }
+    if (character === "'" || character === '"' || character === "`") {
+      quote = character;
+      output += character;
+      continue;
+    }
+    if (character === "/" && next === "/") {
+      output += "  ";
+      index += 1;
+      lineComment = true;
+      continue;
+    }
+    if (character === "/" && next === "*") {
+      output += "  ";
+      index += 1;
+      blockComment = true;
+      continue;
+    }
+    output += character;
+  }
+  return output;
+}
+function packageScriptCoverageState(repoPath, repoFiles, packageJson, ciCommands, detectorDecisions) {
+  const scripts = readPackageScripts(join(repoPath, packageJson));
+  if (scripts.size === 0) return "none";
+  const roots = /* @__PURE__ */ new Set();
+  let unresolved = false;
+  if (scripts.has("test")) roots.add("test");
+  for (const command of ciCommands) {
+    const references = packageScriptReferences(command, scripts);
+    for (const name of references.names) roots.add(name);
+    if (references.dynamic && [...scripts.values()].some(
+      (candidate) => commandInvokesCoverageTool(candidate) || containsPotentialCoverageFlag(candidate)
+    )) {
+      unresolved = true;
+    }
+  }
+  const queue = [...roots];
+  const visited = /* @__PURE__ */ new Set();
+  while (queue.length > 0) {
+    const name = queue.shift();
+    if (!name || visited.has(name)) continue;
+    const command = scripts.get(name);
+    if (command === void 0) continue;
+    visited.add(name);
+    const decision = coverageDetectorDecision(repoPath, repoFiles, {
+      path: packageJson,
+      source: "package-script",
+      locator: name,
+      command
+    });
+    detectorDecisions.push(decision);
+    const state = decision.detectorState;
+    if (state === "collects") return "collects";
+    if (state === "unresolved") unresolved = true;
+    const references = packageScriptReferences(command, scripts);
+    for (const referenced of references.names) {
+      if (!visited.has(referenced)) queue.push(referenced);
+    }
+    for (const lifecycle of [`pre${name}`, `post${name}`]) {
+      if (scripts.has(lifecycle) && !visited.has(lifecycle)) queue.push(lifecycle);
+    }
+    if (references.dynamic && [...scripts.values()].some(
+      (candidate) => commandInvokesCoverageTool(candidate) || containsPotentialCoverageFlag(candidate)
+    )) {
+      unresolved = true;
+    }
+  }
+  return unresolved ? "unresolved" : "none";
+}
+function packageScriptReferences(command, scripts) {
+  const names = /* @__PURE__ */ new Set();
+  let dynamic = false;
+  for (const segment of splitShellCommandSegments(command)) {
+    for (const match of segment.matchAll(
+      /\bpnpm\s+run\s+\/((?:\\.|[^/])+)\/([dgimsuvy]*)/giu
+    )) {
+      const source = match[1];
+      if (!source) continue;
+      try {
+        const flags = (match[2] ?? "").replace(/[dgy]/g, "");
+        const selector = new RegExp(source, flags);
+        for (const name of scripts.keys()) {
+          if (selector.test(name)) names.add(name);
+          selector.lastIndex = 0;
+        }
+      } catch {
+        dynamic = true;
+      }
+    }
+    for (const match of segment.matchAll(
+      /\b(?:npm|pnpm|yarn)\s+(?:run\s+)?([A-Za-z0-9][A-Za-z0-9:._-]*)/giu
+    )) {
+      const name = match[1];
+      if (name && scripts.has(name)) names.add(name);
+    }
+    if (/\b(?:npm|pnpm|yarn)\s+run\s+(?:\$|["']\$|`)/u.test(segment)) dynamic = true;
+  }
+  return { names: [...names], dynamic };
+}
+function extractCiRunCommands(contents) {
+  const lines = contents.split(/\r?\n/);
+  const commands = [];
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index] ?? "";
+    const match = /^(\s*)(?:-\s*)?run\s*:\s*(.*)$/u.exec(line);
+    if (!match) continue;
+    const indentation = match[1]?.length ?? 0;
+    const value = match[2]?.trim() ?? "";
+    if (value === "|" || value === ">" || value.startsWith("|-") || value.startsWith(">-")) {
+      const block = [];
+      for (index += 1; index < lines.length; index += 1) {
+        const nested = lines[index] ?? "";
+        if (nested.trim().length === 0) {
+          block.push("");
+          continue;
+        }
+        const nestedIndentation = /^\s*/u.exec(nested)?.[0].length ?? 0;
+        if (nestedIndentation <= indentation) {
+          index -= 1;
+          break;
+        }
+        block.push(nested.slice(Math.min(nested.length, indentation + 2)));
+      }
+      commands.push(block.join(value.startsWith(">") ? " " : "\n"));
+      continue;
+    }
+    if (value.length === 0) continue;
+    const quoted = /^(?:"([\s\S]*)"|'([\s\S]*)')$/u.exec(value);
+    commands.push(quoted ? quoted[1] ?? quoted[2] ?? "" : value);
+  }
+  return commands;
+}
+function isRecipeFile(file) {
+  return /(^|\/)(?:Makefile|makefile|GNUmakefile|[Jj]ustfile)$/.test(file);
+}
+function recipeCoverageState(repoPath, repoFiles, file, ciCommands, detectorDecisions) {
+  const targets = readRecipeTargets(readRepoText(join(repoPath, file), "utf8"));
+  const roots = new Set(["test", "tests", "check"].filter((target) => targets.has(target)));
+  const runner = /[Jj]ustfile$/.test(file) ? "just" : "make";
+  for (const command of ciCommands) {
+    for (const match of command.matchAll(new RegExp(`\\b${runner}\\s+([A-Za-z0-9._-]+)`, "gu"))) {
+      const target = match[1];
+      if (target && targets.has(target)) roots.add(target);
+    }
+  }
+  const queue = [...roots];
+  const visited = /* @__PURE__ */ new Set();
+  let unresolved = false;
+  while (queue.length > 0) {
+    const name = queue.shift();
+    if (!name || visited.has(name)) continue;
+    const target = targets.get(name);
+    if (!target) continue;
+    visited.add(name);
+    const commandDecisions = target.commands.map(
+      (command, index) => coverageDetectorDecision(repoPath, repoFiles, {
+        path: file,
+        source: "recipe-command",
+        locator: `${name}:${index}`,
+        command
+      })
+    );
+    detectorDecisions.push(...commandDecisions);
+    const state = combineCoverageCommandStates(
+      commandDecisions.map((decision) => decision.detectorState)
+    );
+    if (state === "collects") return "collects";
+    if (state === "unresolved") unresolved = true;
+    for (const dependency of target.dependencies) {
+      if (targets.has(dependency) && !visited.has(dependency)) queue.push(dependency);
+    }
+    for (const command of target.commands) {
+      const pattern = new RegExp(`(?:\\$\\(MAKE\\)|\\b${runner})\\s+([A-Za-z0-9._-]+)`, "gu");
+      for (const match of command.matchAll(pattern)) {
+        const referenced = match[1];
+        if (referenced && targets.has(referenced) && !visited.has(referenced)) queue.push(referenced);
+      }
+    }
+  }
+  return unresolved ? "unresolved" : "none";
+}
+function readRecipeTargets(contents) {
+  const targets = /* @__PURE__ */ new Map();
+  let active = null;
+  for (const line of contents.split(/\r?\n/)) {
+    const header = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*:\s*([^#]*)/u.exec(line);
+    if (header) {
+      const name = header[1];
+      if (!name) continue;
+      active = {
+        dependencies: (header[2] ?? "").trim().split(/\s+/u).filter(Boolean),
+        commands: []
+      };
+      targets.set(name, active);
+      continue;
+    }
+    if (active && /^\s+/u.test(line) && line.trim().length > 0) {
+      active.commands.push(line.trim().replace(/^[@+-]+/u, ""));
+      continue;
+    }
+    if (line.trim().length > 0 && !line.trimStart().startsWith("#")) active = null;
+  }
+  return targets;
+}
+function coverageCommandEvaluation(repoPath, repoFiles, command, depth = 0) {
+  if (depth > 4) {
+    const recognized = containsPotentialCoverageFlag(command);
+    return { recognized, state: recognized ? "unresolved" : "none" };
+  }
+  const normalized = normalizeCoverageCommandPrefixes(command);
+  const segments = normalized.splitShellOperators ? splitShellCommandSegments(normalized.segment) : [normalized.segment];
+  const evaluations = segments.map((rawSegment) => {
+    const candidate = normalizeCoverageCommandPrefixes(rawSegment);
+    if (commandInvokesCoverageTool(candidate.segment)) {
+      return { recognized: true, state: "collects" };
+    }
+    const words = shellWords(candidate.segment);
+    if (words.length === 0) return { recognized: false, state: "none" };
+    const direct = coverageFlagCommandState(words);
+    if (direct !== "none") return { recognized: true, state: direct };
+    const hasCoverageSyntax = containsPotentialCoverageFlag(candidate.segment);
+    if (isRecognizedCoverageFlagRunner(words)) {
+      return { recognized: hasCoverageSyntax, state: "none" };
+    }
+    const wrapper = reachableShellWrapper(words, repoFiles);
+    if (wrapper) {
+      return coverageCommandEvaluation(
+        repoPath,
+        repoFiles,
+        readRepoText(join(repoPath, wrapper), "utf8"),
+        depth + 1
+      );
+    }
+    const executable = commandExecutable(words);
+    const potentialFlagState = flagState(
+      words.slice(1),
+      ["--experimental-test-coverage", "--collectcoverage", "--collect-coverage", "--coverage", "--cov"],
+      [
+        "--no-experimental-test-coverage",
+        "--no-collectcoverage",
+        "--no-collect-coverage",
+        "--no-coverage",
+        "--no-cov"
+      ]
+    );
+    if (hasCoverageSyntax && potentialFlagState !== "none" && executable && /(?:test|spec|runner)/i.test(executable) && !/(?:docs?|map|report|upload|codecov|coveralls)/i.test(executable)) {
+      return { recognized: true, state: "unresolved" };
+    }
+    return { recognized: false, state: "none" };
+  });
+  return {
+    recognized: evaluations.some((evaluation) => evaluation.recognized),
+    state: combineCoverageCommandStates(
+      evaluations.map((evaluation) => evaluation.state)
+    )
+  };
+}
+function coverageDetectorDecision(repoPath, repoFiles, input) {
+  const evaluation = coverageCommandEvaluation(repoPath, repoFiles, input.command);
+  return {
+    path: input.path,
+    source: input.source,
+    locator: input.locator,
+    evidence: input.command,
+    detectorRecognized: evaluation.recognized,
+    detectorState: evaluation.state
+  };
+}
+function combineCoverageCommandStates(states) {
+  if (states.includes("collects")) return "collects";
+  return states.includes("unresolved") ? "unresolved" : "none";
+}
+function shellWords(segment) {
+  const words = [];
+  let offset = 0;
+  while (offset < segment.length) {
+    const scanned = scanShellWord(segment, offset);
+    if (!scanned) break;
+    words.push(scanned.word);
+    if (scanned.end <= offset) break;
+    offset = scanned.end;
+  }
+  return words;
+}
+function commandExecutable(words) {
+  const normalized = unwrapPackageManagerExecutable(words);
+  const executable = normalized[0];
+  return executable ? basename(executable).replace(/\.cmd$/i, "").toLowerCase() : void 0;
+}
+function unwrapPackageManagerExecutable(words) {
+  if (words.length === 0) return [];
+  const first = basename(words[0] ?? "").toLowerCase();
+  if (first === "pnpm" || first === "yarn") {
+    const second = words[1]?.toLowerCase();
+    return words.slice(second === "exec" || second === "dlx" ? 2 : 1);
+  }
+  if (first === "npx") return words.slice(1).filter((word) => !/^--(?:yes|no-install)$/u.test(word));
+  if (first === "npm" && words[1]?.toLowerCase() === "exec") {
+    let offset = 2;
+    while (/^--(?:yes|no-install)$/u.test(words[offset] ?? "")) offset += 1;
+    if (words[offset] === "--") offset += 1;
+    return words.slice(offset);
+  }
+  return [...words];
+}
+function coverageFlagCommandState(words) {
+  const command = unwrapPackageManagerExecutable(words);
+  const executable = basename(command[0] ?? "").replace(/\.cmd$/i, "").toLowerCase();
+  const args = command.slice(1);
+  if (!executable) return "none";
+  if (executable === "node") {
+    if (!args.includes("--test")) return "none";
+    return flagState(args, ["--experimental-test-coverage"], ["--no-experimental-test-coverage"]);
+  }
+  if (executable === "pytest" || executable === "py.test") {
+    return flagState(args, ["--cov"], ["--no-cov"]);
+  }
+  if (executable === "bun" || executable === "deno") {
+    if (args[0]?.toLowerCase() !== "test") return "none";
+    return flagState(args.slice(1), ["--coverage"], ["--no-coverage"]);
+  }
+  if (executable === "jest") {
+    return flagState(
+      args,
+      ["--coverage", "--collectcoverage", "--collect-coverage"],
+      ["--no-coverage", "--no-collectcoverage", "--no-collect-coverage"]
+    );
+  }
+  if (executable === "vitest" || executable === "bnt") {
+    return flagState(args, ["--coverage"], ["--no-coverage"]);
+  }
+  return "none";
+}
+function isRecognizedCoverageFlagRunner(words) {
+  const command = unwrapPackageManagerExecutable(words);
+  const executable = basename(command[0] ?? "").replace(/\.cmd$/i, "").toLowerCase();
+  if (["bnt", "vitest", "jest", "pytest", "py.test"].includes(executable)) return true;
+  if (executable === "node") return command.slice(1).includes("--test");
+  return (executable === "bun" || executable === "deno") && command[1]?.toLowerCase() === "test";
+}
+function flagState(args, enablingNames, disablingNames) {
+  let enabled = false;
+  let disabled = false;
+  let unresolved = false;
+  const enabling = new Set(enablingNames.map((name) => name.toLowerCase()));
+  const disabling = new Set(disablingNames.map((name) => name.toLowerCase()));
+  for (let index = 0; index < args.length; index += 1) {
+    const raw = args[index] ?? "";
+    const lower = raw.toLowerCase();
+    if (disabling.has(lower)) {
+      disabled = true;
+      continue;
+    }
+    const [name, assigned] = lower.split("=", 2);
+    if (!name || !enabling.has(name)) continue;
+    if (assigned !== void 0) {
+      if (assigned === "false" || assigned === "0" || assigned === "off") disabled = true;
+      else if (/\$|\{|\}/u.test(assigned)) unresolved = true;
+      else enabled = true;
+      continue;
+    }
+    const next = args[index + 1]?.toLowerCase();
+    if (next === "false" || next === "0" || next === "off") {
+      disabled = true;
+      index += 1;
+    } else if (next && /\$|\{|\}/u.test(next)) {
+      unresolved = true;
+      index += 1;
+    } else {
+      enabled = true;
+    }
+  }
+  if (unresolved || enabled && disabled) return "unresolved";
+  return enabled && !disabled ? "collects" : "none";
+}
+function containsPotentialCoverageFlag(command) {
+  return /(?:^|\s)--(?:experimental-test-coverage|collect-?coverage|no-coverage|coverage|no-cov|cov)(?:[=\s]|$)/iu.test(
+    command
+  );
+}
+function reachableShellWrapper(words, repoFiles) {
+  const executable = basename(words[0] ?? "").toLowerCase();
+  const candidate = /^(?:ba|da|k|z)?sh$/u.test(executable) ? words[1] : words[0];
+  if (!candidate || !/(?:^|\/)\.?[^\s]*\.sh$/i.test(candidate)) return void 0;
+  const normalized = candidate.replace(/^\.\//u, "");
+  if (normalized.startsWith("/") || normalized.split("/").includes("..")) return void 0;
+  return repoFiles.has(normalized) ? normalized : void 0;
+}
 function commandInvokesCoverageTool(command) {
   return normalizedCommandInvokesCoverageTool(normalizeCoverageCommandPrefixes(command), 0);
 }
@@ -6094,7 +7108,69 @@ function fileContains(repoPath, file, pattern) {
   if (!isRegularFile(fullPath)) return false;
   return pattern.test(readRepoText(fullPath, "utf8"));
 }
-function findCommittedSecretInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
+var PEM_PRIVATE_KEY_ASSIGNMENT_PATTERN = /(?:["'])?([A-Za-z_$][\w$.-]*)(?:["'])?\s*[:=]\s*(?:\|[-+0-9]*\s*\r?\n[ \t]*)?["'`]?-----BEGIN((?: (?:RSA|DSA|EC|OPENSSH|ENCRYPTED))? PRIVATE KEY)-----([\s\S]{0,32768}?)-----END\2-----/g;
+var BARE_PEM_PRIVATE_KEY_PATTERN = /["'`]?-----BEGIN((?: (?:RSA|DSA|EC|OPENSSH|ENCRYPTED))? PRIVATE KEY)-----([\s\S]{0,32768}?)-----END\1-----/g;
+var BARE_PEM_KEY_FILE_PATTERN = /(?:^|\/)id_(?:rsa|dsa|ecdsa|ed25519)$|\.(?:pem|key)$/i;
+function isBarePemKeyFile(file) {
+  return BARE_PEM_KEY_FILE_PATTERN.test(file);
+}
+var DEV_OR_SELF_SIGNED_KEY_CONTEXT_PATTERN = /(?<![A-Za-z0-9])(?:dev|development|local|localhost|self[-_]?signed|snakeoil|insecure|dummy|sample|demo|placeholder|fixture|generated)(?![A-Za-z0-9])/i;
+var ROTATED_OR_REVOKED_KEY_CONTEXT_PATTERN = /(?<![A-Za-z0-9])(?:rotated|revoked|expired|deprecated|compromised|invalidated|superseded)(?![A-Za-z0-9])|do[-_ ]not[-_ ]use|no longer valid/i;
+function isPlausiblePemKeyBody(rawBody) {
+  const normalized = rawBody.replace(/\\[nr]|[\r\n\s]/g, "");
+  if (normalized.length < 40) return false;
+  if (!/^[A-Za-z0-9+/=]+$/.test(normalized)) return false;
+  return !isPlaceholderSecretValue(normalized);
+}
+function scanForPemPrivateKeyMatch(pattern, contents, lines, hasIdentifierGroup) {
+  pattern.lastIndex = 0;
+  let match;
+  while ((match = pattern.exec(contents)) !== null) {
+    const full = match[0];
+    const identifier = hasIdentifierGroup ? match[1] ?? "" : "";
+    const body = (hasIdentifierGroup ? match[3] : match[2]) ?? "";
+    const line = contents.slice(0, match.index).split("\n").length;
+    const contextLines = lines.slice(Math.max(0, line - 5), line + 4).join("\n");
+    const isDevOrSelfSigned = DEV_OR_SELF_SIGNED_KEY_CONTEXT_PATTERN.test(
+      `${identifier}
+${contextLines}`
+    );
+    const isRotatedOrRevoked = ROTATED_OR_REVOKED_KEY_CONTEXT_PATTERN.test(contextLines);
+    if (isPlausiblePemKeyBody(body) && !isDevOrSelfSigned && !isRotatedOrRevoked) {
+      const value = full.slice(full.indexOf("-----BEGIN"));
+      const characterClasses = [
+        /[a-z]/.test(value) ? "lower" : "",
+        /[A-Z]/.test(value) ? "upper" : "",
+        /\d/.test(value) ? "digit" : "",
+        /[^A-Za-z0-9]/.test(value) ? "symbol" : ""
+      ].filter(Boolean).join("+");
+      return {
+        identifier,
+        line,
+        valueLength: value.length,
+        characterClasses: characterClasses || "other",
+        valueFingerprint: createHash2("sha256").update(value).digest("hex"),
+        kind: "pem_private_key"
+      };
+    }
+  }
+  return null;
+}
+function findPemPrivateKeyAssignment(contents, file) {
+  if (!contents.includes("-----BEGIN")) return null;
+  if (DEV_OR_SELF_SIGNED_KEY_CONTEXT_PATTERN.test(file)) return null;
+  const lines = contents.split("\n");
+  const assignmentMatch = scanForPemPrivateKeyMatch(
+    PEM_PRIVATE_KEY_ASSIGNMENT_PATTERN,
+    contents,
+    lines,
+    true
+  );
+  if (assignmentMatch) return assignmentMatch;
+  if (!isBarePemKeyFile(file)) return null;
+  return scanForPemPrivateKeyMatch(BARE_PEM_PRIVATE_KEY_PATTERN, contents, lines, false);
+}
+function findCommittedSecretInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return null;
   const contents = readRepoText(fullPath, "utf8");
@@ -6110,6 +7186,10 @@ function findCommittedSecretInFile(repoPath, file, useV36Detectors = false, useV
     allowCredentialNamedDigest: useV36Detectors
   });
   if (secret) return secret;
+  if (useV23PemPrivateKeyGrammar) {
+    const pemSecret = findPemPrivateKeyAssignment(secretScanContents, file);
+    if (pemSecret) return pemSecret;
+  }
   if (useV39Detectors && isEnvHistoryPath(file, useV36Detectors)) {
     const weakCredential = findWeakExplicitEnvCredential(secretScanContents);
     if (weakCredential) return weakCredential;
@@ -6202,7 +7282,7 @@ function hasTemplateOnlyEnvContent(repoPath, file) {
     return value.length === 0 || isPlaceholderSecretValue(value);
   });
 }
-function findSecretFingerprintsInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
+function findSecretFingerprintsInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return [];
   const contents = readRepoText(fullPath, "utf8");
@@ -6219,6 +7299,10 @@ function findSecretFingerprintsInFile(repoPath, file, useV36Detectors = false, u
     Number.POSITIVE_INFINITY,
     { allowCredentialNamedDigest: useV36Detectors }
   ).map(({ valueFingerprint }) => valueFingerprint);
+  if (useV23PemPrivateKeyGrammar) {
+    const pemSecret = findPemPrivateKeyAssignment(scanContents, file);
+    if (pemSecret) fingerprints.push(pemSecret.valueFingerprint);
+  }
   if (useV39Detectors && isEnvHistoryPath(file, useV36Detectors)) {
     const weakCredential = findWeakExplicitEnvCredential(scanContents);
     if (weakCredential) fingerprints.push(weakCredential.valueFingerprint);
@@ -6362,24 +7446,32 @@ function declareHistoryFailure(scanLimitations, reason, operation, maxBufferByte
     `${describeGitFailure(reason, operation, maxBufferBytes)} Cejel continued with reduced Git history evidence.`
   );
 }
-function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFingerprintsByPath, scanLimitations, authoredProductionOnly = false, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
+function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFingerprintsByPath, scanLimitations, authoredProductionOnly = false, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const historyEntries = readCredentialHistoryEntries(
     repoPath,
     scanLimitations,
-    useV36Detectors
+    useV36Detectors,
+    useV23PemPrivateKeyGrammar
   );
   const head = excludeHead ? readGitHead(repoPath) : null;
   let scannedFiles = 0;
+  let v23WidenedOnlyScanned = 0;
   let envPathEvidence = null;
   for (const entry of historyEntries) {
     if (head && entry.commit === head) continue;
     if (authoredProductionOnly && !(useV47Detectors ? isV47AuthoredProductionPath(entry.path) : useV39Detectors ? isV39AuthoredProductionPath(entry.path) : isAuthoredProductionPath(entry.path))) {
       continue;
     }
-    if (scannedFiles >= HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT) {
-      return { evidence: null, envPathEvidence, truncated: true };
+    const isV23WidenedOnly = useV23PemPrivateKeyGrammar && isV23PemCredentialHistoryPath(historyPathBasename(entry.path.toLowerCase())) && !isCredentialHistoryPath(entry.path, useV36Detectors, false);
+    if (isV23WidenedOnly) {
+      if (v23WidenedOnlyScanned >= V23_PEM_WIDENED_HISTORY_BLOB_LIMIT) continue;
+      v23WidenedOnlyScanned += 1;
+    } else {
+      if (scannedFiles >= HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT) {
+        return { evidence: null, secretKind: null, envPathEvidence, truncated: true };
+      }
+      scannedFiles += 1;
     }
-    scannedFiles += 1;
     const contents = readGitBlob(repoPath, entry.commit, entry.path, scanLimitations);
     if (!contents) continue;
     const scanContents = prepareCredentialScanContents(
@@ -6393,6 +7485,12 @@ function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFinger
     let secretMatch = findRealSecretAssignment(scanContents, currentFingerprints, {
       allowCredentialNamedDigest: useV36Detectors
     });
+    if (!secretMatch && useV23PemPrivateKeyGrammar) {
+      const pemMatch = findPemPrivateKeyAssignment(scanContents, entry.path);
+      if (pemMatch && !currentFingerprints.has(pemMatch.valueFingerprint)) {
+        secretMatch = pemMatch;
+      }
+    }
     if (!secretMatch && useV39Detectors && isEnvHistoryPath(entry.path, useV36Detectors, useV47Detectors)) {
       const weakCredential = findWeakExplicitEnvCredential(scanContents);
       if (weakCredential && !currentFingerprints.has(weakCredential.valueFingerprint)) {
@@ -6403,11 +7501,15 @@ function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFinger
       return {
         evidence: {
           kind: "secret_scan",
-          label: secretEvidenceLabel("Committed secret in recent git history", secretMatch),
+          label: secretEvidenceLabel(
+            secretMatch.kind === "pem_private_key" ? "Committed PEM-formatted private key in recent git history" : "Committed secret in recent git history",
+            secretMatch
+          ),
           path: entry.path,
           line: secretMatch.line,
           contentHash: entry.commit
         },
+        secretKind: secretMatch.kind ?? null,
         envPathEvidence,
         truncated: false
       };
@@ -6421,9 +7523,9 @@ function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFinger
       };
     }
   }
-  return { evidence: null, envPathEvidence, truncated: false };
+  return { evidence: null, secretKind: null, envPathEvidence, truncated: false };
 }
-function readCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors = false) {
+function readCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
   const appendEntry = (entry) => {
@@ -6468,7 +7570,7 @@ function readCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors
           scanLimitations.add(CONTROL_CHARACTER_HISTORY_PATH_LIMITATION);
           continue;
         }
-        if (!isCredentialHistoryPath(path, useV36Detectors)) continue;
+        if (!isCredentialHistoryPath(path, useV36Detectors, useV23PemPrivateKeyGrammar)) continue;
         appendEntry({ commit: currentCommit, path });
       }
     }
@@ -6476,17 +7578,19 @@ function readCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors
   for (const entry of readDeletedCredentialHistoryEntries(
     repoPath,
     scanLimitations,
-    useV36Detectors
+    useV36Detectors,
+    useV23PemPrivateKeyGrammar
   )) {
     appendEntry(entry);
   }
   return entries;
 }
-function readDeletedCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors = false) {
+function readDeletedCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const deletedPaths = readDeletedCredentialHistoryPaths(
     repoPath,
     scanLimitations,
-    useV36Detectors
+    useV36Detectors,
+    useV23PemPrivateKeyGrammar
   );
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
@@ -6500,7 +7604,7 @@ function readDeletedCredentialHistoryEntries(repoPath, scanLimitations, useV36De
   }
   return entries;
 }
-function readDeletedCredentialHistoryPaths(repoPath, scanLimitations, useV36Detectors = false) {
+function readDeletedCredentialHistoryPaths(repoPath, scanLimitations, useV36Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const historyResult = execGit(
     [
       "log",
@@ -6528,7 +7632,7 @@ function readDeletedCredentialHistoryPaths(repoPath, scanLimitations, useV36Dete
       continue;
     }
     if (!path || seen.has(path)) continue;
-    if (!isCredentialHistoryPath(path, useV36Detectors)) continue;
+    if (!isCredentialHistoryPath(path, useV36Detectors, useV23PemPrivateKeyGrammar)) continue;
     seen.add(path);
     paths.push(path);
   }
@@ -6546,14 +7650,24 @@ function readHistoryCommitsForPath(repoPath, path, scanLimitations) {
   }
   return historyResult.stdout.split("\n").map((line) => line.trim()).filter((line) => /^[0-9a-f]{40}$/i.test(line));
 }
-function isCredentialHistoryPath(path, _useV36Detectors = false) {
+var V23_KEY_SHAPED_JSON_PATH_PATTERN = /(?<![A-Za-z0-9])(?:service[-_]?account|private[-_]?key|creds?|key)(?![A-Za-z0-9])/i;
+function historyPathBasename(lowerPath) {
+  return lowerPath.split("/").at(-1) ?? lowerPath;
+}
+function isV23PemCredentialHistoryPath(basename3) {
+  return basename3.endsWith(".json") && V23_KEY_SHAPED_JSON_PATH_PATTERN.test(basename3);
+}
+function isCredentialHistoryPath(path, _useV36Detectors = false, useV23PemPrivateKeyGrammar = false) {
   if (isHardExcludedPath(path)) return false;
   const lowerPath = path.toLowerCase();
-  const basename3 = lowerPath.split("/").at(-1) ?? lowerPath;
+  const basename3 = historyPathBasename(lowerPath);
   if (/\.env(?:\.|$)/.test(basename3)) {
     return true;
   }
-  return lowerPath.includes("secret") || lowerPath.includes("credential") || basename3.endsWith(".pem") || basename3.endsWith(".key") || basename3 === "id_rsa" || basename3.endsWith(".p12") || basename3.endsWith(".pfx");
+  if (lowerPath.includes("secret") || lowerPath.includes("credential") || basename3.endsWith(".pem") || basename3.endsWith(".key") || basename3 === "id_rsa" || basename3.endsWith(".p12") || basename3.endsWith(".pfx")) {
+    return true;
+  }
+  return useV23PemPrivateKeyGrammar && isV23PemCredentialHistoryPath(basename3);
 }
 function isEnvHistoryPath(path, useV36Detectors = false, useV47Detectors = false) {
   if (isEnvTemplatePath(path, useV47Detectors)) return false;
@@ -7325,14 +8439,14 @@ var WITAN_RUBRIC = [
 
 // src/witan/scoring.ts
 function usesV17DetectorClosure2(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
 }
 var MAX_SIGNAL_ADJUSTMENT = 0.8;
-function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
+function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC, toolVersion) {
   const parsedInput = WitanReportInputSchema.parse(input);
   const signalsByCriterion = mergeSignalsByCriterion(parsedInput.signals);
   const readFailureAbstentions = new Set(
-    [...signalsByCriterion.values()].filter((signal) => signal.insufficientData === true).map((signal) => signal.criterionId)
+    [...signalsByCriterion.values()].filter((signal) => signal.insufficientData === true && !isSelfImposedAbstention(signal)).map((signal) => signal.criterionId)
   );
   const hasInputSignals = inputSignals != null && inputSignals.length > 0;
   const inputSignalsByDimension = /* @__PURE__ */ new Map();
@@ -7437,7 +8551,8 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
     // alter it (see classifyRepoArchetype in repo-signals.ts); per-criterion scoring above is
     // unaffected by archetype, only presentation layers (badge/terminal/verdict) key off it.
     ...parsedInput.archetype ? { archetype: parsedInput.archetype } : {},
-    ...insufficientSourceReason ? { insufficientSourceReason } : {}
+    ...insufficientSourceReason ? { insufficientSourceReason } : {},
+    ...toolVersion ? { toolVersion } : {}
   });
 }
 function applySignalAdjustment(nativeScore, dimension, signals) {
@@ -7484,7 +8599,7 @@ function statusForScore(score) {
 }
 function statusAfterInputAdjustment(nativeStatus, nativeScore, adjustment, rubricVersion) {
   if (adjustment === 0) return nativeStatus;
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V23) {
     return statusForScore(roundScore(Math.max(0, nativeScore - adjustment)));
   }
   const statusFloor = {
@@ -7507,6 +8622,14 @@ function statusAfterInputAdjustment(nativeStatus, nativeScore, adjustment, rubri
   );
   return (severity[adjustedSemanticStatus] ?? nativeSeverity) > nativeSeverity ? adjustedSemanticStatus : nativeStatus;
 }
+var SELF_IMPOSED_ABSTENTION_REASONS = /* @__PURE__ */ new Set([
+  "too_large",
+  "excluded_by_extension",
+  "non_regular_file"
+]);
+function isSelfImposedAbstention(signal) {
+  return signal.insufficientDataReason !== void 0 && SELF_IMPOSED_ABSTENTION_REASONS.has(signal.insufficientDataReason);
+}
 function mergeSignalsByCriterion(signals) {
   const merged = /* @__PURE__ */ new Map();
   for (const signal of signals) {
@@ -7515,21 +8638,25 @@ function mergeSignalsByCriterion(signals) {
       merged.set(signal.criterionId, signal);
       continue;
     }
+    const existingAbstains = existing.insufficientData === true;
+    const signalAbstains = signal.insufficientData === true;
+    const abstentionReason = !existingAbstains && !signalAbstains ? void 0 : [existing, signal].filter((candidate) => candidate.insufficientData === true).some((candidate) => !isSelfImposedAbstention(candidate)) ? void 0 : signal.insufficientDataReason ?? existing.insufficientDataReason;
     merged.set(signal.criterionId, {
       criterionId: signal.criterionId,
       positiveEvidence: [...existing.positiveEvidence, ...signal.positiveEvidence],
       findings: [...existing.findings, ...signal.findings],
       metrics: [...existing.metrics ?? [], ...signal.metrics ?? []],
       notes: signal.notes ?? existing.notes,
-      // Read-failure abstention wins on merge: partial sibling evidence cannot turn an
-      // incomplete criterion into a score. Otherwise N/A retains its historical precedence.
-      ...existing.insufficientData === true || signal.insufficientData === true ? { insufficientData: true } : existing.notApplicable === true || signal.notApplicable === true ? { notApplicable: true } : {}
+      ...existingAbstains || signalAbstains ? {
+        insufficientData: true,
+        ...abstentionReason !== void 0 ? { insufficientDataReason: abstentionReason } : {}
+      } : existing.notApplicable === true || signal.notApplicable === true ? { notApplicable: true } : {}
     });
   }
   return merged;
 }
 function usesMetricScoring(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
 }
 function unmeasuredStatus(rubricVersion) {
   return rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0 ? "unverified" : "insufficient_data";
@@ -7909,7 +9036,7 @@ function calibratedCriterionStateV11(criterionId, metrics) {
   return void 0;
 }
 function ensureFindingsExplainStatus(criterionId, score, status, findings, evidence, rubricVersion) {
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && findings.length > 0) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V23 && findings.length > 0) {
     return [...findings];
   }
   if (status !== "critical" && status !== "warning") return [...findings];
@@ -7959,7 +9086,12 @@ function scoreRepoWithPublicCejel(options) {
     ...options.rubricVersion ? { rubricVersion: options.rubricVersion } : {}
   });
   const inputSignals = resolvePublicIngestSignals(options);
-  const report = createWitanReport(input, inputSignals.length > 0 ? inputSignals : void 0);
+  const report = createWitanReport(
+    input,
+    inputSignals.length > 0 ? inputSignals : void 0,
+    void 0,
+    options.toolVersion
+  );
   if (report.verdict !== "insufficient_source" || !isWitanNoMeasurementAbstention(report)) {
     return report;
   }
@@ -8217,7 +9349,8 @@ function runCejelScan(options) {
     // the repository. Direct public/leaderboard scans default this off because their targets
     // are third-party repositories and must opt in explicitly.
     autoDiscoverIngest: true,
-    warnOnEmptyIngestMatch: options.warnOnEmptyIngestMatch
+    warnOnEmptyIngestMatch: options.warnOnEmptyIngestMatch,
+    ...options.toolVersion ? { toolVersion: options.toolVersion } : {}
   });
   const summary = buildWitanCliSummary(report);
   return { report, summary, generatedAt };
@@ -8229,6 +9362,7 @@ export {
   CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE,
   CERTIFICATE_GLOSSARY,
   formatCertificateMetricLabel,
+  formatCertificateMetricAppliedWeightPercent,
   formatCertificateMetricValue,
   buildRelyingPartySummary,
   WITAN_RUBRIC_VERSION_V22,