@cejel/cejel 0.4.7 → 0.4.8

package/README.md

@@ -93,7 +93,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.4.7 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.4.8 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM and an
@@ -116,7 +116,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.4.7` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.4.8` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry.
 
 `npx` can reuse a stale cached package. Force the current npm release with the `@latest`
@@ -178,16 +178,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.4.7`:
+**Docker / OCI.** The current container release is `0.4.8`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.7
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.8
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.7 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.8 .
 ```
 
 The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
@@ -519,7 +519,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.7"]}'
+npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.8"]}'
 npx -y openclaw@latest mcp doctor cejel-oci --probe
 ```
 

package/dist/calibration/llm-detector.js

@@ -5,20 +5,20 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-QTLLASOO.js";
+} from "../chunk-6R3VJGJ2.js";
 import {
   listCejelLlmPackFiles
-} from "../chunk-EP7YYWEP.js";
-import "../chunk-OIGCYULH.js";
+} from "../chunk-ERNYMFH4.js";
+import "../chunk-KNQBI3IX.js";
 import {
   external_exports
-} from "../chunk-UYJBSQCV.js";
+} from "../chunk-J6R5OHN7.js";
 import {
   init_esm_shims,
   readRepoText,
   recordContentSkip,
   recordFilesystemSkip
-} from "../chunk-ZNVILRHK.js";
+} from "../chunk-V3B2V4WA.js";
 
 // src/calibration/llm-detector.ts
 init_esm_shims();

package/dist/{chunk-QTLLASOO.js → chunk-6R3VJGJ2.js}

@@ -5,24 +5,24 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-OIGCYULH.js";
+} from "./chunk-KNQBI3IX.js";
 import {
   external_exports
-} from "./chunk-UYJBSQCV.js";
+} from "./chunk-J6R5OHN7.js";
 import {
   MAX_REPOSITORY_CONTENT_BYTES,
+  classifyAbstentionReason,
   contentReadSignalKey,
   init_esm_shims,
   readRepoText,
   readRepoTextPrefix,
   recordContentSkip,
-  recordContentSkipForCriteria,
   recordFilesystemSkip,
   trackContentReads,
   withContentReadCriterion,
   withContentReadSignal,
   withContentReadSignals
-} from "./chunk-ZNVILRHK.js";
+} from "./chunk-V3B2V4WA.js";
 
 // src/witan/schemas.ts
 init_esm_shims();
@@ -162,6 +162,13 @@ var WitanCriterionMetricSchema = external_exports.object({
     condition: external_exports.string().min(1).max(240).optional()
   }).strict().optional()
 }).strict();
+var WitanContentReadSkipReasonSchema = external_exports.enum([
+  "unreadable",
+  "too_large",
+  "excluded_by_extension",
+  "denied_path",
+  "non_regular_file"
+]);
 var WitanCriterionSignalSchema = external_exports.object({
   criterionId: WitanCriterionIdSchema,
   positiveEvidence: external_exports.array(WitanEvidencePointerSchema).default([]),
@@ -171,9 +178,19 @@ var WitanCriterionSignalSchema = external_exports.object({
   notApplicable: external_exports.literal(true).optional(),
   // A collector reached relevant files but could not read their contents. This is a
   // measurement gap, never negative evidence: scoreCriterion maps it to insufficient_data.
-  insufficientData: external_exports.literal(true).optional()
+  insufficientData: external_exports.literal(true).optional(),
+  // Why insufficientData is true. Omitted (or 'unreadable'/'denied_path') means an
+  // environmental read failure — evidence Cejel expected to see and could not; that stays in
+  // the composite denominator at score 0 so losing evidence never flatters the certificate
+  // (ADR-0001 does not cover this case — it is genuine evidence loss). 'too_large',
+  // 'excluded_by_extension', and 'non_regular_file' are self-imposed coverage limits Cejel
+  // chose itself: those are excluded from the composite exactly like ordinary
+  // insufficient_data (ADR-0001: coverage is disclosed, never discounts a score).
+  insufficientDataReason: WitanContentReadSkipReasonSchema.optional()
 }).strict().refine((signal) => !(signal.notApplicable && signal.insufficientData), {
   message: "A criterion cannot be both not applicable and insufficient data."
+}).refine((signal) => signal.insufficientDataReason === void 0 || signal.insufficientData === true, {
+  message: "insufficientDataReason may only be set alongside insufficientData: true."
 });
 var WitanContentReadSummarySchema = external_exports.object({
   skipped: external_exports.number().int().nonnegative(),
@@ -301,7 +318,14 @@ var WitanReportCommonSchema = external_exports.object({
   consumedSignals: external_exports.array(WitanConsumedSignalSummarySchema).optional(),
   archetype: WitanRepoArchetypeSchema.optional(),
   scanLimitations: external_exports.array(external_exports.string().min(1).max(1e3)).max(16).optional(),
-  contentReadSummary: WitanContentReadSummarySchema.optional()
+  contentReadSummary: WitanContentReadSummarySchema.optional(),
+  // The @cejel/cejel version that produced this report. Absent on reports from before this
+  // field existed and on any caller that does not supply one (createWitanReport never defaults
+  // it). Constant within an installed version, so re-running the same version on the same
+  // commit stays byte-stable (the exact property v0.3.1 removed generatedAt to protect); it
+  // differs across versions, which lets a consumer key incremental reuse on it
+  // (goal_cejel_0_4_8_abstention_scoring_fix_2026-09-08).
+  toolVersion: external_exports.string().min(1).max(80).optional()
 });
 var WitanScoredReportSchema = WitanReportCommonSchema.extend({
   verdict: WitanScoredVerdictSchema,
@@ -342,7 +366,7 @@ var WitanReportSchema = external_exports.preprocess((value) => {
 }, StrictWitanReportSchema);
 var WITAN_ATTESTATION_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
 var WITAN_ATTESTATION_PREDICATE_TYPE = "https://cejel.dev/attestations/scan/v1";
-var WITAN_REPORT_FORMAT_VERSION = "1.0";
+var WITAN_REPORT_FORMAT_VERSION = "1.1";
 var WitanAttestationOutcomeSchema = external_exports.discriminatedUnion("status", [
   external_exports.object({
     status: external_exports.literal("scored"),
@@ -2007,29 +2031,56 @@ function inventoryAbsenceFinding(options) {
     } : {}
   };
 }
-function wholesaleCriterionAbstention(signal) {
+function wholesaleCriterionAbstention(signal, reasons) {
+  const { insufficientDataReason } = classifyAbstentionReason(reasons);
   return {
     criterionId: signal.criterionId,
     positiveEvidence: [],
     findings: [],
     metrics: [],
     insufficientData: true,
-    notes: "Cejel abstained on this criterion because one or more relevant repository files could not be read. Resolve the content-read limitations and re-scan."
+    ...insufficientDataReason !== void 0 ? { insufficientDataReason } : {},
+    notes: insufficientDataReason !== void 0 ? "Cejel abstained on this criterion because relevant repository content was declined under the repository content size limit or excluded from scanning by policy. This is a disclosed coverage limit, not a read failure, and does not affect the composite score." : "Cejel abstained on this criterion because one or more relevant repository files could not be read. Resolve the content-read limitations and re-scan."
   };
 }
+function skipReasonsForCriterion(criterionId, tracked) {
+  const combined = new Set(tracked.criterionSkipReasons.get(criterionId) ?? []);
+  const prefix = contentReadSignalKey(criterionId, "");
+  for (const [key, reasons] of tracked.signalSkipReasons) {
+    if (!key.startsWith(prefix)) continue;
+    for (const reason of reasons) combined.add(reason);
+  }
+  return combined;
+}
+function skipReasonsForSignal(criterionId, signalName, tracked) {
+  const reasons = tracked.signalSkipReasons.get(contentReadSignalKey(criterionId, signalName));
+  return reasons ? new Set(reasons) : void 0;
+}
 function buildWitanInputFromRepo(options) {
   const tracked = trackContentReads(options.repoPath, () => buildWitanInputFromRepoUntracked(options));
   const affectedCriteria = tracked.affectedCriteria;
   const rubricVersion = options.rubricVersion ?? WITAN_RUBRIC_VERSION;
   if (rubricVersion !== WITAN_RUBRIC_VERSION_V23) {
-    const signals2 = (tracked.value.signals ?? []).map(
-      (signal) => affectedCriteria.has(signal.criterionId) ? wholesaleCriterionAbstention(signal) : signal
-    );
-    const affectedCount = affectedCriteria.size;
+    const readFailureCriteria = [];
+    const coverageLimitedCriteria = [];
+    const signals2 = (tracked.value.signals ?? []).map((signal) => {
+      if (!affectedCriteria.has(signal.criterionId)) return signal;
+      const reasons = skipReasonsForCriterion(signal.criterionId, tracked);
+      const { insufficientDataReason } = classifyAbstentionReason(reasons);
+      (insufficientDataReason !== void 0 ? coverageLimitedCriteria : readFailureCriteria).push(
+        signal.criterionId
+      );
+      return wholesaleCriterionAbstention(signal, reasons);
+    });
     const scanLimitations2 = [...tracked.value.scanLimitations ?? []];
-    if (affectedCount > 0 && scanLimitations2.length < 16) {
+    if (readFailureCriteria.length > 0 && scanLimitations2.length < 16) {
+      scanLimitations2.push(
+        `${readFailureCriteria.length} ${readFailureCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+      );
+    }
+    if (coverageLimitedCriteria.length > 0 && scanLimitations2.length < 16) {
       scanLimitations2.push(
-        `${affectedCount} ${affectedCount === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+        `${coverageLimitedCriteria.length} ${coverageLimitedCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content was declined under the repository content size limit or excluded from scanning by policy \u2014 a disclosed coverage limit, not a read failure. This does not affect the composite score.`
       );
     }
     return {
@@ -2039,45 +2090,68 @@ function buildWitanInputFromRepo(options) {
       contentReadSummary: tracked.summary
     };
   }
-  const wholesaleAbstainedCriteria = [];
-  const partiallyAbstainedSignals = [];
+  const wholesaleAbstainedReadFailureCriteria = [];
+  const wholesaleAbstainedCoverageLimitedCriteria = [];
+  const partiallyAbstainedReadFailureSignals = [];
+  const partiallyAbstainedCoverageLimitedSignals = [];
   const signals = (tracked.value.signals ?? []).map((signal) => {
     if (!affectedCriteria.has(signal.criterionId)) return signal;
     if (tracked.unattributedCriteria.has(signal.criterionId)) {
-      wholesaleAbstainedCriteria.push(signal.criterionId);
-      return wholesaleCriterionAbstention(signal);
+      const reasons = tracked.criterionSkipReasons.get(signal.criterionId);
+      const { insufficientDataReason: insufficientDataReason2 } = classifyAbstentionReason(reasons);
+      (insufficientDataReason2 !== void 0 ? wholesaleAbstainedCoverageLimitedCriteria : wholesaleAbstainedReadFailureCriteria).push(signal.criterionId);
+      return wholesaleCriterionAbstention(signal, reasons);
     }
     const prefix = contentReadSignalKey(signal.criterionId, "");
     const affectedNames = [...tracked.affectedSignals].filter((key) => key.startsWith(prefix)).map((key) => key.slice(prefix.length));
     if (affectedNames.length === 0) {
-      wholesaleAbstainedCriteria.push(signal.criterionId);
+      wholesaleAbstainedReadFailureCriteria.push(signal.criterionId);
       return wholesaleCriterionAbstention(signal);
     }
     const affectedNameSet = new Set(affectedNames);
     const metrics = (signal.metrics ?? []).filter((metric2) => !affectedNameSet.has(metric2.name));
     const anythingSurvives = metrics.length > 0 || (signal.positiveEvidence?.length ?? 0) > 0 || (signal.findings?.length ?? 0) > 0;
+    const droppedReasons = /* @__PURE__ */ new Set();
+    for (const name of affectedNames) {
+      for (const reason of skipReasonsForSignal(signal.criterionId, name, tracked) ?? []) {
+        droppedReasons.add(reason);
+      }
+    }
     if (!anythingSurvives) {
-      wholesaleAbstainedCriteria.push(signal.criterionId);
-      return wholesaleCriterionAbstention(signal);
+      const { insufficientDataReason: insufficientDataReason2 } = classifyAbstentionReason(droppedReasons);
+      (insufficientDataReason2 !== void 0 ? wholesaleAbstainedCoverageLimitedCriteria : wholesaleAbstainedReadFailureCriteria).push(signal.criterionId);
+      return wholesaleCriterionAbstention(signal, droppedReasons);
     }
+    const { insufficientDataReason } = classifyAbstentionReason(droppedReasons);
+    const isReadFailure = insufficientDataReason === void 0;
     for (const name of affectedNames) {
-      partiallyAbstainedSignals.push(`${signal.criterionId}.${name}`);
+      (isReadFailure ? partiallyAbstainedReadFailureSignals : partiallyAbstainedCoverageLimitedSignals).push(`${signal.criterionId}.${name}`);
     }
     return {
       ...signal,
       metrics,
-      notes: `Cejel abstained on ${[...affectedNames].sort().join(", ")} in this criterion because that content could not be read; other signals in this criterion were computed from readable files and are unaffected.`
+      notes: isReadFailure ? `Cejel abstained on ${[...affectedNames].sort().join(", ")} in this criterion because that content could not be read; other signals in this criterion were computed from readable files and are unaffected.` : `Cejel declined ${[...affectedNames].sort().join(", ")} in this criterion under the repository content size limit or an extension exclusion; other signals in this criterion were computed from readable files and are unaffected. This is a disclosed coverage limit, not a read failure.`
     };
   });
   const scanLimitations = [...tracked.value.scanLimitations ?? []];
-  if (wholesaleAbstainedCriteria.length > 0 && scanLimitations.length < 16) {
+  if (wholesaleAbstainedReadFailureCriteria.length > 0 && scanLimitations.length < 16) {
+    scanLimitations.push(
+      `${wholesaleAbstainedReadFailureCriteria.length} ${wholesaleAbstainedReadFailureCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read and the affected signal could not be isolated. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+    );
+  }
+  if (wholesaleAbstainedCoverageLimitedCriteria.length > 0 && scanLimitations.length < 16) {
+    scanLimitations.push(
+      `${wholesaleAbstainedCoverageLimitedCriteria.length} ${wholesaleAbstainedCoverageLimitedCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content was declined under the repository content size limit or excluded from scanning by policy, and the affected signal could not be isolated. This is a disclosed coverage limit, not a read failure, and does not affect the composite score.`
+    );
+  }
+  if (partiallyAbstainedReadFailureSignals.length > 0 && scanLimitations.length < 16) {
     scanLimitations.push(
-      `${wholesaleAbstainedCriteria.length} ${wholesaleAbstainedCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read and the affected signal could not be isolated. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+      `${partiallyAbstainedReadFailureSignals.length} ${partiallyAbstainedReadFailureSignals.length === 1 ? "signal" : "signals"} abstained because its own repository content could not be read, while other signals in the same criterion were unaffected: ${[...partiallyAbstainedReadFailureSignals].sort().join(", ")}.`
     );
   }
-  if (partiallyAbstainedSignals.length > 0 && scanLimitations.length < 16) {
+  if (partiallyAbstainedCoverageLimitedSignals.length > 0 && scanLimitations.length < 16) {
     scanLimitations.push(
-      `${partiallyAbstainedSignals.length} ${partiallyAbstainedSignals.length === 1 ? "signal" : "signals"} abstained because its own repository content could not be read, while other signals in the same criterion were unaffected: ${[...partiallyAbstainedSignals].sort().join(", ")}.`
+      `${partiallyAbstainedCoverageLimitedSignals.length} ${partiallyAbstainedCoverageLimitedSignals.length === 1 ? "signal" : "signals"} declined under the repository content size limit or an extension exclusion, while other signals in the same criterion were unaffected: ${[...partiallyAbstainedCoverageLimitedSignals].sort().join(", ")}. This is a disclosed coverage limit, not a read failure.`
     );
   }
   return {
@@ -2107,6 +2181,7 @@ function buildWitanInputFromRepoUntracked(options) {
   const usesV21ExecutedEscalations = rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const usesV22PackageStartEntrypoint = rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const usesV23CommandCoverage = rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV23PemPrivateKeyGrammar = rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const structuralArchetype = classifyRepoArchetype(inventoryFiles, rubricVersion);
   const readableArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion) ? applyReadableSourceRepresentationGate(
     options.repoPath,
@@ -2143,6 +2218,7 @@ function buildWitanInputFromRepoUntracked(options) {
     usesV21ExecutedEscalations,
     usesV22PackageStartEntrypoint,
     usesV23CommandCoverage,
+    usesV23PemPrivateKeyGrammar,
     reviewableSourceProof,
     inventoryAbsenceContext,
     scanLimitations
@@ -2754,7 +2830,7 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, useV23CommandCoverage, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, useV23CommandCoverage, useV23PemPrivateKeyGrammar, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
   const signals = [];
   const mono = resolveMonorepoContext(repoPath, scanLimitations);
   const collectCriterion = (criterionId, collect) => withContentReadCriterion(criterionId, collect);
@@ -2781,6 +2857,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV36Detectors,
       useV39Detectors,
       useV47Detectors,
+      useV23PemPrivateKeyGrammar,
       useV18NativeRls,
       inventoryAbsenceContext,
       scanLimitations
@@ -3196,7 +3273,7 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inve
     notes: `V17 authenticated absence: ${proof.eligibleSourceFileCount} criterion-ratable of ${proof.sourceShapedFileCount} source-shaped files; sampled ${proof.sampledFileCount}; ${proof.readableSampledFileCount} representative-text files.`
   };
 }
-function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, inventoryAbsenceContext, scanLimitations) {
+function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV23PemPrivateKeyGrammar, useV18NativeRls, inventoryAbsenceContext, scanLimitations) {
   const evidence = [];
   const findings = [];
   const gitignore = repoFiles.find((file) => basename(file) === ".gitignore");
@@ -3219,7 +3296,8 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
           path,
           useV36Detectors,
           useV39Detectors,
-          useV47Detectors
+          useV47Detectors,
+          useV23PemPrivateKeyGrammar
         );
         if (!found) continue;
         match_ = { path, match: found };
@@ -3227,7 +3305,9 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       }
       const fingerprintsByPath = /* @__PURE__ */ new Map();
       if (useV27Detectors) {
-        for (const path of repoFiles.filter((candidate) => isCredentialHistoryPath(candidate))) {
+        for (const path of repoFiles.filter(
+          (candidate) => isCredentialHistoryPath(candidate, useV36Detectors, useV23PemPrivateKeyGrammar)
+        )) {
           fingerprintsByPath.set(
             path,
             new Set(
@@ -3236,7 +3316,8 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
                 path,
                 useV36Detectors,
                 useV39Detectors,
-                useV47Detectors
+                useV47Detectors,
+                useV23PemPrivateKeyGrammar
               )
             )
           );
@@ -3253,7 +3334,8 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
     useV33Detectors,
     useV36Detectors,
     useV39Detectors,
-    useV47Detectors
+    useV47Detectors,
+    useV23PemPrivateKeyGrammar
   );
   const hasConfirmedSecretFinding = committedSecret != null || historySecretScan?.evidence != null;
   const cryptoHygiene = withContentReadSignal(
@@ -3380,15 +3462,16 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   if (committedSecret) {
     const isTestPath = isTestOrFixturePath(committedSecret.path);
     const isDefaultAdmin = committedSecret.match.kind === "default_admin";
+    const isPemPrivateKey = committedSecret.match.kind === "pem_private_key";
     findings.push({
       severity: isTestPath ? "info" : "critical",
-      summary: isDefaultAdmin ? isTestPath ? `Default administrative credential in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production deployment default; verify.` : "An explicit default administrative credential appears committed in production configuration." : isTestPath ? `Secret-shaped value in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production leak; verify.` : "Secret-shaped value appears committed in the scanned repository.",
+      summary: isDefaultAdmin ? isTestPath ? `Default administrative credential in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production deployment default; verify.` : "An explicit default administrative credential appears committed in production configuration." : isPemPrivateKey ? isTestPath ? `PEM-formatted private key in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production leak; verify.` : "A PEM-formatted private key appears committed in the scanned repository." : isTestPath ? `Secret-shaped value in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production leak; verify.` : "Secret-shaped value appears committed in the scanned repository.",
       evidence: evidenceForRelativeAtLine(
         repoPath,
         committedSecret.path,
         "secret_scan",
         secretEvidenceLabel(
-          isDefaultAdmin ? "Committed default administrative credential" : "Committed secret-shaped value",
+          isDefaultAdmin ? "Committed default administrative credential" : isPemPrivateKey ? "Committed PEM-formatted private key" : "Committed secret-shaped value",
           committedSecret.match
         ),
         committedSecret.match.line
@@ -3419,9 +3502,10 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   if (historySecretScan?.evidence) {
     const historyPath = historySecretScan.evidence.path ?? "";
     const isTestPath = isTestOrFixturePath(historyPath);
+    const isPemPrivateKey = historySecretScan.secretKind === "pem_private_key";
     findings.push({
       severity: isTestPath ? "info" : "critical",
-      summary: isTestPath ? `Secret-shaped value in git history for a test/fixture file (${historyPath}) \u2014 likely fixture data, not a production leak; verify.` : "Secret-shaped value appears in recent git history.",
+      summary: isPemPrivateKey ? isTestPath ? `PEM-formatted private key in git history for a test/fixture file (${historyPath}) \u2014 likely fixture data, not a production leak; verify.` : "A PEM-formatted private key appears in recent git history." : isTestPath ? `Secret-shaped value in git history for a test/fixture file (${historyPath}) \u2014 likely fixture data, not a production leak; verify.` : "Secret-shaped value appears in recent git history.",
       evidence: historySecretScan.evidence
     });
   } else if (historySecretScan?.truncated) {
@@ -4803,6 +4887,7 @@ var GATED_PRIVILEGE_CHECK_PATTERN = /pg_has_role\s*\(|has_role\s*\(|is not a mem
 var SET_ROLE_PATTERN = /\bset\s+(local\s+)?role\b/i;
 var REQUIRED_REVIEW_PATTERN = /required review|branch protection|protected branch/i;
 var HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT = 5e3;
+var V23_PEM_WIDENED_HISTORY_BLOB_LIMIT = 500;
 var SECRET_IDENTIFIER_KEYWORD_PATTERN = /secret|token|api[_-]?key|password|access[_-]?key/gi;
 var SINGLE_WHITESPACE_PATTERN = /\s/u;
 var SECRET_VALUE_BRANDED_PATTERN = /^(?:sk-[A-Za-z0-9_-]{24,}|sk-ant-api\d{2}-[A-Za-z0-9_-]{80,}|ghp_[A-Za-z0-9_]{30,}|xox[baprs]-[A-Za-z0-9-]{24,}|AKIA[0-9A-Z]{16}|vcp_[A-Za-z0-9_:-]{24,})$/;
@@ -4962,12 +5047,7 @@ function parseGitTrackedFiles(repoPath, output, includeHardExcluded) {
         continue;
       }
       if (stat.size > MAX_REPOSITORY_CONTENT_BYTES) {
-        const affectedCriteria = affectedCriteriaForUnavailablePath(file);
-        if (affectedCriteria.length > 0) {
-          recordContentSkipForCriteria(fullPath, "too_large", affectedCriteria, true);
-        } else {
-          recordContentSkip(fullPath, "too_large", true);
-        }
+        recordContentSkip(fullPath, "too_large", true);
         continue;
       }
     } catch (error) {
@@ -4981,39 +5061,6 @@ function parseGitTrackedFiles(repoPath, output, includeHardExcluded) {
   }
   return files.sort();
 }
-function affectedCriteriaForUnavailablePath(file) {
-  const affected = /* @__PURE__ */ new Set();
-  if (isDependencyManifest(file) || isLockfile(file)) affected.add("A4");
-  if (isCiWorkflow(file)) {
-    affected.add("A1");
-    affected.add("A3");
-    affected.add("B2");
-    affected.add("B3");
-  }
-  if (isDeployConfig(file)) {
-    affected.add("A3");
-    affected.add("B2");
-  }
-  if (isTestFile(file)) {
-    affected.add("A1");
-    affected.add("A2");
-  }
-  if (isImplementationFile(file)) {
-    affected.add("A1");
-    affected.add("A2");
-    affected.add("A3");
-    affected.add("B1");
-    affected.add("B6");
-  }
-  if (/\.(?:md|mdx|rst|txt)$/i.test(file)) {
-    affected.add("A5");
-    affected.add("B4");
-    affected.add("B5");
-    affected.add("B6");
-  }
-  if (isAuditFile(file)) affected.add("B5");
-  return [...affected];
-}
 function directoryInventory(repoPath) {
   const files = [];
   const rootDevice = statSync(repoPath).dev;
@@ -5135,12 +5182,7 @@ function visitRepoDir(repoPath, dirPath, files, rootDevice) {
     }
     const repoRelativePath = relative(repoPath, fullPath);
     if (size > MAX_REPOSITORY_CONTENT_BYTES) {
-      const affectedCriteria = affectedCriteriaForUnavailablePath(repoRelativePath);
-      if (affectedCriteria.length > 0) {
-        recordContentSkipForCriteria(fullPath, "too_large", affectedCriteria);
-      } else {
-        recordContentSkip(fullPath, "too_large");
-      }
+      recordContentSkip(fullPath, "too_large");
       continue;
     }
     if (!isPotentialContentPath(repoRelativePath)) {
@@ -7066,7 +7108,69 @@ function fileContains(repoPath, file, pattern) {
   if (!isRegularFile(fullPath)) return false;
   return pattern.test(readRepoText(fullPath, "utf8"));
 }
-function findCommittedSecretInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
+var PEM_PRIVATE_KEY_ASSIGNMENT_PATTERN = /(?:["'])?([A-Za-z_$][\w$.-]*)(?:["'])?\s*[:=]\s*(?:\|[-+0-9]*\s*\r?\n[ \t]*)?["'`]?-----BEGIN((?: (?:RSA|DSA|EC|OPENSSH|ENCRYPTED))? PRIVATE KEY)-----([\s\S]{0,32768}?)-----END\2-----/g;
+var BARE_PEM_PRIVATE_KEY_PATTERN = /["'`]?-----BEGIN((?: (?:RSA|DSA|EC|OPENSSH|ENCRYPTED))? PRIVATE KEY)-----([\s\S]{0,32768}?)-----END\1-----/g;
+var BARE_PEM_KEY_FILE_PATTERN = /(?:^|\/)id_(?:rsa|dsa|ecdsa|ed25519)$|\.(?:pem|key)$/i;
+function isBarePemKeyFile(file) {
+  return BARE_PEM_KEY_FILE_PATTERN.test(file);
+}
+var DEV_OR_SELF_SIGNED_KEY_CONTEXT_PATTERN = /(?<![A-Za-z0-9])(?:dev|development|local|localhost|self[-_]?signed|snakeoil|insecure|dummy|sample|demo|placeholder|fixture|generated)(?![A-Za-z0-9])/i;
+var ROTATED_OR_REVOKED_KEY_CONTEXT_PATTERN = /(?<![A-Za-z0-9])(?:rotated|revoked|expired|deprecated|compromised|invalidated|superseded)(?![A-Za-z0-9])|do[-_ ]not[-_ ]use|no longer valid/i;
+function isPlausiblePemKeyBody(rawBody) {
+  const normalized = rawBody.replace(/\\[nr]|[\r\n\s]/g, "");
+  if (normalized.length < 40) return false;
+  if (!/^[A-Za-z0-9+/=]+$/.test(normalized)) return false;
+  return !isPlaceholderSecretValue(normalized);
+}
+function scanForPemPrivateKeyMatch(pattern, contents, lines, hasIdentifierGroup) {
+  pattern.lastIndex = 0;
+  let match;
+  while ((match = pattern.exec(contents)) !== null) {
+    const full = match[0];
+    const identifier = hasIdentifierGroup ? match[1] ?? "" : "";
+    const body = (hasIdentifierGroup ? match[3] : match[2]) ?? "";
+    const line = contents.slice(0, match.index).split("\n").length;
+    const contextLines = lines.slice(Math.max(0, line - 5), line + 4).join("\n");
+    const isDevOrSelfSigned = DEV_OR_SELF_SIGNED_KEY_CONTEXT_PATTERN.test(
+      `${identifier}
+${contextLines}`
+    );
+    const isRotatedOrRevoked = ROTATED_OR_REVOKED_KEY_CONTEXT_PATTERN.test(contextLines);
+    if (isPlausiblePemKeyBody(body) && !isDevOrSelfSigned && !isRotatedOrRevoked) {
+      const value = full.slice(full.indexOf("-----BEGIN"));
+      const characterClasses = [
+        /[a-z]/.test(value) ? "lower" : "",
+        /[A-Z]/.test(value) ? "upper" : "",
+        /\d/.test(value) ? "digit" : "",
+        /[^A-Za-z0-9]/.test(value) ? "symbol" : ""
+      ].filter(Boolean).join("+");
+      return {
+        identifier,
+        line,
+        valueLength: value.length,
+        characterClasses: characterClasses || "other",
+        valueFingerprint: createHash2("sha256").update(value).digest("hex"),
+        kind: "pem_private_key"
+      };
+    }
+  }
+  return null;
+}
+function findPemPrivateKeyAssignment(contents, file) {
+  if (!contents.includes("-----BEGIN")) return null;
+  if (DEV_OR_SELF_SIGNED_KEY_CONTEXT_PATTERN.test(file)) return null;
+  const lines = contents.split("\n");
+  const assignmentMatch = scanForPemPrivateKeyMatch(
+    PEM_PRIVATE_KEY_ASSIGNMENT_PATTERN,
+    contents,
+    lines,
+    true
+  );
+  if (assignmentMatch) return assignmentMatch;
+  if (!isBarePemKeyFile(file)) return null;
+  return scanForPemPrivateKeyMatch(BARE_PEM_PRIVATE_KEY_PATTERN, contents, lines, false);
+}
+function findCommittedSecretInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return null;
   const contents = readRepoText(fullPath, "utf8");
@@ -7082,6 +7186,10 @@ function findCommittedSecretInFile(repoPath, file, useV36Detectors = false, useV
     allowCredentialNamedDigest: useV36Detectors
   });
   if (secret) return secret;
+  if (useV23PemPrivateKeyGrammar) {
+    const pemSecret = findPemPrivateKeyAssignment(secretScanContents, file);
+    if (pemSecret) return pemSecret;
+  }
   if (useV39Detectors && isEnvHistoryPath(file, useV36Detectors)) {
     const weakCredential = findWeakExplicitEnvCredential(secretScanContents);
     if (weakCredential) return weakCredential;
@@ -7174,7 +7282,7 @@ function hasTemplateOnlyEnvContent(repoPath, file) {
     return value.length === 0 || isPlaceholderSecretValue(value);
   });
 }
-function findSecretFingerprintsInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
+function findSecretFingerprintsInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return [];
   const contents = readRepoText(fullPath, "utf8");
@@ -7191,6 +7299,10 @@ function findSecretFingerprintsInFile(repoPath, file, useV36Detectors = false, u
     Number.POSITIVE_INFINITY,
     { allowCredentialNamedDigest: useV36Detectors }
   ).map(({ valueFingerprint }) => valueFingerprint);
+  if (useV23PemPrivateKeyGrammar) {
+    const pemSecret = findPemPrivateKeyAssignment(scanContents, file);
+    if (pemSecret) fingerprints.push(pemSecret.valueFingerprint);
+  }
   if (useV39Detectors && isEnvHistoryPath(file, useV36Detectors)) {
     const weakCredential = findWeakExplicitEnvCredential(scanContents);
     if (weakCredential) fingerprints.push(weakCredential.valueFingerprint);
@@ -7334,24 +7446,32 @@ function declareHistoryFailure(scanLimitations, reason, operation, maxBufferByte
     `${describeGitFailure(reason, operation, maxBufferBytes)} Cejel continued with reduced Git history evidence.`
   );
 }
-function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFingerprintsByPath, scanLimitations, authoredProductionOnly = false, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
+function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFingerprintsByPath, scanLimitations, authoredProductionOnly = false, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const historyEntries = readCredentialHistoryEntries(
     repoPath,
     scanLimitations,
-    useV36Detectors
+    useV36Detectors,
+    useV23PemPrivateKeyGrammar
   );
   const head = excludeHead ? readGitHead(repoPath) : null;
   let scannedFiles = 0;
+  let v23WidenedOnlyScanned = 0;
   let envPathEvidence = null;
   for (const entry of historyEntries) {
     if (head && entry.commit === head) continue;
     if (authoredProductionOnly && !(useV47Detectors ? isV47AuthoredProductionPath(entry.path) : useV39Detectors ? isV39AuthoredProductionPath(entry.path) : isAuthoredProductionPath(entry.path))) {
       continue;
     }
-    if (scannedFiles >= HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT) {
-      return { evidence: null, envPathEvidence, truncated: true };
+    const isV23WidenedOnly = useV23PemPrivateKeyGrammar && isV23PemCredentialHistoryPath(historyPathBasename(entry.path.toLowerCase())) && !isCredentialHistoryPath(entry.path, useV36Detectors, false);
+    if (isV23WidenedOnly) {
+      if (v23WidenedOnlyScanned >= V23_PEM_WIDENED_HISTORY_BLOB_LIMIT) continue;
+      v23WidenedOnlyScanned += 1;
+    } else {
+      if (scannedFiles >= HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT) {
+        return { evidence: null, secretKind: null, envPathEvidence, truncated: true };
+      }
+      scannedFiles += 1;
     }
-    scannedFiles += 1;
     const contents = readGitBlob(repoPath, entry.commit, entry.path, scanLimitations);
     if (!contents) continue;
     const scanContents = prepareCredentialScanContents(
@@ -7365,6 +7485,12 @@ function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFinger
     let secretMatch = findRealSecretAssignment(scanContents, currentFingerprints, {
       allowCredentialNamedDigest: useV36Detectors
     });
+    if (!secretMatch && useV23PemPrivateKeyGrammar) {
+      const pemMatch = findPemPrivateKeyAssignment(scanContents, entry.path);
+      if (pemMatch && !currentFingerprints.has(pemMatch.valueFingerprint)) {
+        secretMatch = pemMatch;
+      }
+    }
     if (!secretMatch && useV39Detectors && isEnvHistoryPath(entry.path, useV36Detectors, useV47Detectors)) {
       const weakCredential = findWeakExplicitEnvCredential(scanContents);
       if (weakCredential && !currentFingerprints.has(weakCredential.valueFingerprint)) {
@@ -7375,11 +7501,15 @@ function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFinger
       return {
         evidence: {
           kind: "secret_scan",
-          label: secretEvidenceLabel("Committed secret in recent git history", secretMatch),
+          label: secretEvidenceLabel(
+            secretMatch.kind === "pem_private_key" ? "Committed PEM-formatted private key in recent git history" : "Committed secret in recent git history",
+            secretMatch
+          ),
           path: entry.path,
           line: secretMatch.line,
           contentHash: entry.commit
         },
+        secretKind: secretMatch.kind ?? null,
         envPathEvidence,
         truncated: false
       };
@@ -7393,9 +7523,9 @@ function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFinger
       };
     }
   }
-  return { evidence: null, envPathEvidence, truncated: false };
+  return { evidence: null, secretKind: null, envPathEvidence, truncated: false };
 }
-function readCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors = false) {
+function readCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
   const appendEntry = (entry) => {
@@ -7440,7 +7570,7 @@ function readCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors
           scanLimitations.add(CONTROL_CHARACTER_HISTORY_PATH_LIMITATION);
           continue;
         }
-        if (!isCredentialHistoryPath(path, useV36Detectors)) continue;
+        if (!isCredentialHistoryPath(path, useV36Detectors, useV23PemPrivateKeyGrammar)) continue;
         appendEntry({ commit: currentCommit, path });
       }
     }
@@ -7448,17 +7578,19 @@ function readCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors
   for (const entry of readDeletedCredentialHistoryEntries(
     repoPath,
     scanLimitations,
-    useV36Detectors
+    useV36Detectors,
+    useV23PemPrivateKeyGrammar
   )) {
     appendEntry(entry);
   }
   return entries;
 }
-function readDeletedCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors = false) {
+function readDeletedCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const deletedPaths = readDeletedCredentialHistoryPaths(
     repoPath,
     scanLimitations,
-    useV36Detectors
+    useV36Detectors,
+    useV23PemPrivateKeyGrammar
   );
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
@@ -7472,7 +7604,7 @@ function readDeletedCredentialHistoryEntries(repoPath, scanLimitations, useV36De
   }
   return entries;
 }
-function readDeletedCredentialHistoryPaths(repoPath, scanLimitations, useV36Detectors = false) {
+function readDeletedCredentialHistoryPaths(repoPath, scanLimitations, useV36Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const historyResult = execGit(
     [
       "log",
@@ -7500,7 +7632,7 @@ function readDeletedCredentialHistoryPaths(repoPath, scanLimitations, useV36Dete
       continue;
     }
     if (!path || seen.has(path)) continue;
-    if (!isCredentialHistoryPath(path, useV36Detectors)) continue;
+    if (!isCredentialHistoryPath(path, useV36Detectors, useV23PemPrivateKeyGrammar)) continue;
     seen.add(path);
     paths.push(path);
   }
@@ -7518,14 +7650,24 @@ function readHistoryCommitsForPath(repoPath, path, scanLimitations) {
   }
   return historyResult.stdout.split("\n").map((line) => line.trim()).filter((line) => /^[0-9a-f]{40}$/i.test(line));
 }
-function isCredentialHistoryPath(path, _useV36Detectors = false) {
+var V23_KEY_SHAPED_JSON_PATH_PATTERN = /(?<![A-Za-z0-9])(?:service[-_]?account|private[-_]?key|creds?|key)(?![A-Za-z0-9])/i;
+function historyPathBasename(lowerPath) {
+  return lowerPath.split("/").at(-1) ?? lowerPath;
+}
+function isV23PemCredentialHistoryPath(basename3) {
+  return basename3.endsWith(".json") && V23_KEY_SHAPED_JSON_PATH_PATTERN.test(basename3);
+}
+function isCredentialHistoryPath(path, _useV36Detectors = false, useV23PemPrivateKeyGrammar = false) {
   if (isHardExcludedPath(path)) return false;
   const lowerPath = path.toLowerCase();
-  const basename3 = lowerPath.split("/").at(-1) ?? lowerPath;
+  const basename3 = historyPathBasename(lowerPath);
   if (/\.env(?:\.|$)/.test(basename3)) {
     return true;
   }
-  return lowerPath.includes("secret") || lowerPath.includes("credential") || basename3.endsWith(".pem") || basename3.endsWith(".key") || basename3 === "id_rsa" || basename3.endsWith(".p12") || basename3.endsWith(".pfx");
+  if (lowerPath.includes("secret") || lowerPath.includes("credential") || basename3.endsWith(".pem") || basename3.endsWith(".key") || basename3 === "id_rsa" || basename3.endsWith(".p12") || basename3.endsWith(".pfx")) {
+    return true;
+  }
+  return useV23PemPrivateKeyGrammar && isV23PemCredentialHistoryPath(basename3);
 }
 function isEnvHistoryPath(path, useV36Detectors = false, useV47Detectors = false) {
   if (isEnvTemplatePath(path, useV47Detectors)) return false;
@@ -8300,11 +8442,11 @@ function usesV17DetectorClosure2(rubricVersion) {
   return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
 }
 var MAX_SIGNAL_ADJUSTMENT = 0.8;
-function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
+function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC, toolVersion) {
   const parsedInput = WitanReportInputSchema.parse(input);
   const signalsByCriterion = mergeSignalsByCriterion(parsedInput.signals);
   const readFailureAbstentions = new Set(
-    [...signalsByCriterion.values()].filter((signal) => signal.insufficientData === true).map((signal) => signal.criterionId)
+    [...signalsByCriterion.values()].filter((signal) => signal.insufficientData === true && !isSelfImposedAbstention(signal)).map((signal) => signal.criterionId)
   );
   const hasInputSignals = inputSignals != null && inputSignals.length > 0;
   const inputSignalsByDimension = /* @__PURE__ */ new Map();
@@ -8409,7 +8551,8 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
     // alter it (see classifyRepoArchetype in repo-signals.ts); per-criterion scoring above is
     // unaffected by archetype, only presentation layers (badge/terminal/verdict) key off it.
     ...parsedInput.archetype ? { archetype: parsedInput.archetype } : {},
-    ...insufficientSourceReason ? { insufficientSourceReason } : {}
+    ...insufficientSourceReason ? { insufficientSourceReason } : {},
+    ...toolVersion ? { toolVersion } : {}
   });
 }
 function applySignalAdjustment(nativeScore, dimension, signals) {
@@ -8479,6 +8622,14 @@ function statusAfterInputAdjustment(nativeStatus, nativeScore, adjustment, rubri
   );
   return (severity[adjustedSemanticStatus] ?? nativeSeverity) > nativeSeverity ? adjustedSemanticStatus : nativeStatus;
 }
+var SELF_IMPOSED_ABSTENTION_REASONS = /* @__PURE__ */ new Set([
+  "too_large",
+  "excluded_by_extension",
+  "non_regular_file"
+]);
+function isSelfImposedAbstention(signal) {
+  return signal.insufficientDataReason !== void 0 && SELF_IMPOSED_ABSTENTION_REASONS.has(signal.insufficientDataReason);
+}
 function mergeSignalsByCriterion(signals) {
   const merged = /* @__PURE__ */ new Map();
   for (const signal of signals) {
@@ -8487,15 +8638,19 @@ function mergeSignalsByCriterion(signals) {
       merged.set(signal.criterionId, signal);
       continue;
     }
+    const existingAbstains = existing.insufficientData === true;
+    const signalAbstains = signal.insufficientData === true;
+    const abstentionReason = !existingAbstains && !signalAbstains ? void 0 : [existing, signal].filter((candidate) => candidate.insufficientData === true).some((candidate) => !isSelfImposedAbstention(candidate)) ? void 0 : signal.insufficientDataReason ?? existing.insufficientDataReason;
     merged.set(signal.criterionId, {
       criterionId: signal.criterionId,
       positiveEvidence: [...existing.positiveEvidence, ...signal.positiveEvidence],
       findings: [...existing.findings, ...signal.findings],
       metrics: [...existing.metrics ?? [], ...signal.metrics ?? []],
       notes: signal.notes ?? existing.notes,
-      // Read-failure abstention wins on merge: partial sibling evidence cannot turn an
-      // incomplete criterion into a score. Otherwise N/A retains its historical precedence.
-      ...existing.insufficientData === true || signal.insufficientData === true ? { insufficientData: true } : existing.notApplicable === true || signal.notApplicable === true ? { notApplicable: true } : {}
+      ...existingAbstains || signalAbstains ? {
+        insufficientData: true,
+        ...abstentionReason !== void 0 ? { insufficientDataReason: abstentionReason } : {}
+      } : existing.notApplicable === true || signal.notApplicable === true ? { notApplicable: true } : {}
     });
   }
   return merged;
@@ -8931,7 +9086,12 @@ function scoreRepoWithPublicCejel(options) {
     ...options.rubricVersion ? { rubricVersion: options.rubricVersion } : {}
   });
   const inputSignals = resolvePublicIngestSignals(options);
-  const report = createWitanReport(input, inputSignals.length > 0 ? inputSignals : void 0);
+  const report = createWitanReport(
+    input,
+    inputSignals.length > 0 ? inputSignals : void 0,
+    void 0,
+    options.toolVersion
+  );
   if (report.verdict !== "insufficient_source" || !isWitanNoMeasurementAbstention(report)) {
     return report;
   }
@@ -9189,7 +9349,8 @@ function runCejelScan(options) {
     // the repository. Direct public/leaderboard scans default this off because their targets
     // are third-party repositories and must opt in explicitly.
     autoDiscoverIngest: true,
-    warnOnEmptyIngestMatch: options.warnOnEmptyIngestMatch
+    warnOnEmptyIngestMatch: options.warnOnEmptyIngestMatch,
+    ...options.toolVersion ? { toolVersion: options.toolVersion } : {}
   });
   const summary = buildWitanCliSummary(report);
   return { report, summary, generatedAt };

package/dist/{chunk-EP7YYWEP.js → chunk-ERNYMFH4.js}

@@ -5,10 +5,10 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-OIGCYULH.js";
+} from "./chunk-KNQBI3IX.js";
 import {
   init_esm_shims
-} from "./chunk-ZNVILRHK.js";
+} from "./chunk-V3B2V4WA.js";
 
 // src/packs/llm/files.ts
 init_esm_shims();

package/dist/{chunk-UYJBSQCV.js → chunk-J6R5OHN7.js}

@@ -4,7 +4,7 @@ const require = __cejelCreateRequire(import.meta.url);
 import {
   __export,
   init_esm_shims
-} from "./chunk-ZNVILRHK.js";
+} from "./chunk-V3B2V4WA.js";
 
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};

package/dist/{chunk-OIGCYULH.js → chunk-KNQBI3IX.js}

@@ -3,7 +3,7 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-ZNVILRHK.js";
+} from "./chunk-V3B2V4WA.js";
 
 // src/witan/git-exec.ts
 init_esm_shims();

package/dist/{chunk-ZNVILRHK.js → chunk-V3B2V4WA.js}

@@ -62,10 +62,35 @@ var MAX_REPOSITORY_CONTENT_BYTES = 512e3;
 init_esm_shims();
 import { closeSync, lstatSync, openSync, readFileSync, readSync } from "fs";
 import { resolve } from "path";
+var READ_FAILURE_REASONS = /* @__PURE__ */ new Set(["unreadable", "denied_path"]);
+function isReadFailureReason(reason) {
+  return READ_FAILURE_REASONS.has(reason);
+}
+function classifyAbstentionReason(reasons) {
+  if (!reasons || reasons.size === 0) return {};
+  for (const reason of reasons) {
+    if (isReadFailureReason(reason)) return {};
+  }
+  const priority = [
+    "too_large",
+    "excluded_by_extension",
+    "non_regular_file"
+  ];
+  const chosen = priority.find((reason) => reasons.has(reason));
+  return chosen ? { insufficientDataReason: chosen } : {};
+}
 function contentReadSignalKey(criterionId, signalId) {
   return [criterionId, signalId].join(":");
 }
 var activeSession;
+function addSkipReason(map, key, reason) {
+  const existing = map.get(key);
+  if (existing) {
+    existing.add(reason);
+  } else {
+    map.set(key, /* @__PURE__ */ new Set([reason]));
+  }
+}
 function errnoClass(error) {
   if (typeof error !== "object" || error === null || !("code" in error)) return null;
   const code = error.code;
@@ -79,10 +104,13 @@ function recordSkip(path2, reason, errno, affectsCurrentCriterion = false, dedup
     const signals = session.signals;
     if (signals && signals.length > 0) {
       for (const signal of signals) {
-        session.affectedSignals.add(contentReadSignalKey(session.criterion, signal));
+        const key = contentReadSignalKey(session.criterion, signal);
+        session.affectedSignals.add(key);
+        addSkipReason(session.signalSkipReasons, key, reason);
       }
     } else {
       session.unattributedCriteria.add(session.criterion);
+      addSkipReason(session.criterionSkipReasons, session.criterion, reason);
     }
   }
   if (deduplicate) {
@@ -121,7 +149,9 @@ function trackContentReads(_repoPath, collect) {
       summary: summaryFor(existing),
       affectedCriteria: existing.affectedCriteria,
       affectedSignals: existing.affectedSignals,
-      unattributedCriteria: existing.unattributedCriteria
+      unattributedCriteria: existing.unattributedCriteria,
+      criterionSkipReasons: existing.criterionSkipReasons,
+      signalSkipReasons: existing.signalSkipReasons
     };
   }
   const session = {
@@ -136,7 +166,9 @@ function trackContentReads(_repoPath, collect) {
     deduplicatedSkips: /* @__PURE__ */ new Set(),
     affectedCriteria: /* @__PURE__ */ new Set(),
     affectedSignals: /* @__PURE__ */ new Set(),
-    unattributedCriteria: /* @__PURE__ */ new Set()
+    unattributedCriteria: /* @__PURE__ */ new Set(),
+    criterionSkipReasons: /* @__PURE__ */ new Map(),
+    signalSkipReasons: /* @__PURE__ */ new Map()
   };
   activeSession = session;
   try {
@@ -146,7 +178,9 @@ function trackContentReads(_repoPath, collect) {
       summary: summaryFor(session),
       affectedCriteria: session.affectedCriteria,
       affectedSignals: session.affectedSignals,
-      unattributedCriteria: session.unattributedCriteria
+      unattributedCriteria: session.unattributedCriteria,
+      criterionSkipReasons: session.criterionSkipReasons,
+      signalSkipReasons: session.signalSkipReasons
     };
   } finally {
     activeSession = void 0;
@@ -183,16 +217,6 @@ function withContentReadSignals(criterionId, signalIds, collect) {
 function recordContentSkip(path2, reason, deduplicate = false) {
   recordSkip(path2, reason, void 0, false, deduplicate);
 }
-function recordContentSkipForCriteria(path2, reason, criteria, deduplicate = false) {
-  const session = activeSession;
-  if (session) {
-    for (const criterion of criteria) {
-      session.affectedCriteria.add(criterion);
-      session.unattributedCriteria.add(criterion);
-    }
-  }
-  recordSkip(path2, reason, void 0, false, deduplicate);
-}
 function recordFilesystemSkip(path2, error, deniedContext = false, deduplicate = true) {
   const errno = errnoClass(error);
   if (!errno) throw error;
@@ -264,13 +288,13 @@ export {
   __filename,
   init_esm_shims,
   MAX_REPOSITORY_CONTENT_BYTES,
+  classifyAbstentionReason,
   contentReadSignalKey,
   trackContentReads,
   withContentReadCriterion,
   withContentReadSignal,
   withContentReadSignals,
   recordContentSkip,
-  recordContentSkipForCriteria,
   recordFilesystemSkip,
   readRepoText,
   readRepoTextPrefix

package/dist/{chunk-XHAETB7N.js → chunk-ZPQOZLB7.js}

@@ -7,7 +7,7 @@ import {
   __filename,
   __require,
   init_esm_shims
-} from "./chunk-ZNVILRHK.js";
+} from "./chunk-V3B2V4WA.js";
 
 // node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/typescript.js
 var require_typescript = __commonJS({

package/dist/index.js

@@ -21,12 +21,12 @@ import {
   runCejelScan,
   serializeWitanReport,
   verifyWitanAttestationBinding
-} from "./chunk-QTLLASOO.js";
-import "./chunk-OIGCYULH.js";
-import "./chunk-UYJBSQCV.js";
+} from "./chunk-6R3VJGJ2.js";
+import "./chunk-KNQBI3IX.js";
+import "./chunk-J6R5OHN7.js";
 import {
   init_esm_shims
-} from "./chunk-ZNVILRHK.js";
+} from "./chunk-V3B2V4WA.js";
 
 // src/index.ts
 init_esm_shims();
@@ -324,7 +324,8 @@ async function runWitanCli(args, rubricVersion) {
     ...options.productDisplayName ? { productDisplayName: options.productDisplayName } : {},
     ...effectiveRubricVersion ? { rubricVersion: effectiveRubricVersion } : {},
     ingestPatterns: options.ingestPatterns,
-    warnOnEmptyIngestMatch: !options.quiet
+    warnOnEmptyIngestMatch: !options.quiet,
+    toolVersion: cliVersion()
   });
   const attestation = createWitanAttestation(report, {
     toolVersion: cliVersion(),

package/dist/mcp/index.js

@@ -5,20 +5,20 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "../chunk-QTLLASOO.js";
-import "../chunk-OIGCYULH.js";
+} from "../chunk-6R3VJGJ2.js";
+import "../chunk-KNQBI3IX.js";
 import {
   ZodFirstPartyTypeKind,
   ZodOptional,
   external_exports,
   objectType
-} from "../chunk-UYJBSQCV.js";
+} from "../chunk-J6R5OHN7.js";
 import {
   __commonJS,
   __export,
   __toESM,
   init_esm_shims
-} from "../chunk-ZNVILRHK.js";
+} from "../chunk-V3B2V4WA.js";
 
 // node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({
@@ -17280,7 +17280,7 @@ function createCejelMcpServer(identity) {
     async ({ path, format }) => {
       let result;
       try {
-        result = runCejelScan({ repoPath: resolve(path) });
+        result = runCejelScan({ repoPath: resolve(path), toolVersion: identity.version });
       } catch (error2) {
         const message = error2 instanceof Error ? error2.message : String(error2);
         return {

package/dist/packs/d-series/index.js

@@ -3,18 +3,18 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   listCejelLlmPackFiles
-} from "../../chunk-EP7YYWEP.js";
+} from "../../chunk-ERNYMFH4.js";
 import {
   execGit
-} from "../../chunk-OIGCYULH.js";
+} from "../../chunk-KNQBI3IX.js";
 import {
   require_typescript
-} from "../../chunk-XHAETB7N.js";
+} from "../../chunk-ZPQOZLB7.js";
 import {
   __toESM,
   init_esm_shims,
   readRepoText
-} from "../../chunk-ZNVILRHK.js";
+} from "../../chunk-V3B2V4WA.js";
 
 // src/packs/d-series/index.ts
 init_esm_shims();

package/dist/packs/decision-contracts/index.js

@@ -3,15 +3,15 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   external_exports
-} from "../../chunk-UYJBSQCV.js";
+} from "../../chunk-J6R5OHN7.js";
 import {
   require_typescript
-} from "../../chunk-XHAETB7N.js";
+} from "../../chunk-ZPQOZLB7.js";
 import {
   __toESM,
   init_esm_shims,
   readRepoText
-} from "../../chunk-ZNVILRHK.js";
+} from "../../chunk-V3B2V4WA.js";
 
 // src/packs/decision-contracts/index.ts
 init_esm_shims();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {