@cejel/cejel 0.4.7 → 0.4.9

package/dist/{chunk-QTLLASOO.js → chunk-TUUNJP27.js}

@@ -5,24 +5,26 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-OIGCYULH.js";
+} from "./chunk-IHT7B6L7.js";
 import {
   external_exports
-} from "./chunk-UYJBSQCV.js";
+} from "./chunk-GKYTLWQK.js";
 import {
   MAX_REPOSITORY_CONTENT_BYTES,
+  abstainSignalOnWithheldPaths,
+  classifyAbstentionReason,
   contentReadSignalKey,
   init_esm_shims,
   readRepoText,
   readRepoTextPrefix,
   recordContentSkip,
-  recordContentSkipForCriteria,
   recordFilesystemSkip,
+  registerWithheldRepoPath,
   trackContentReads,
   withContentReadCriterion,
   withContentReadSignal,
   withContentReadSignals
-} from "./chunk-ZNVILRHK.js";
+} from "./chunk-PTZU6G4E.js";
 
 // src/witan/schemas.ts
 init_esm_shims();
@@ -162,6 +164,13 @@ var WitanCriterionMetricSchema = external_exports.object({
     condition: external_exports.string().min(1).max(240).optional()
   }).strict().optional()
 }).strict();
+var WitanContentReadSkipReasonSchema = external_exports.enum([
+  "unreadable",
+  "too_large",
+  "excluded_by_extension",
+  "denied_path",
+  "non_regular_file"
+]);
 var WitanCriterionSignalSchema = external_exports.object({
   criterionId: WitanCriterionIdSchema,
   positiveEvidence: external_exports.array(WitanEvidencePointerSchema).default([]),
@@ -171,9 +180,19 @@ var WitanCriterionSignalSchema = external_exports.object({
   notApplicable: external_exports.literal(true).optional(),
   // A collector reached relevant files but could not read their contents. This is a
   // measurement gap, never negative evidence: scoreCriterion maps it to insufficient_data.
-  insufficientData: external_exports.literal(true).optional()
+  insufficientData: external_exports.literal(true).optional(),
+  // Why insufficientData is true. Omitted (or 'unreadable'/'denied_path') means an
+  // environmental read failure — evidence Cejel expected to see and could not; that stays in
+  // the composite denominator at score 0 so losing evidence never flatters the certificate
+  // (ADR-0001 does not cover this case — it is genuine evidence loss). 'too_large',
+  // 'excluded_by_extension', and 'non_regular_file' are self-imposed coverage limits Cejel
+  // chose itself: those are excluded from the composite exactly like ordinary
+  // insufficient_data (ADR-0001: coverage is disclosed, never discounts a score).
+  insufficientDataReason: WitanContentReadSkipReasonSchema.optional()
 }).strict().refine((signal) => !(signal.notApplicable && signal.insufficientData), {
   message: "A criterion cannot be both not applicable and insufficient data."
+}).refine((signal) => signal.insufficientDataReason === void 0 || signal.insufficientData === true, {
+  message: "insufficientDataReason may only be set alongside insufficientData: true."
 });
 var WitanContentReadSummarySchema = external_exports.object({
   skipped: external_exports.number().int().nonnegative(),
@@ -296,12 +315,29 @@ var WitanReportCommonSchema = external_exports.object({
   productDisplayName: external_exports.string().min(1).max(120),
   repo: WitanRepoRefSchema,
   rubricVersion: external_exports.string().min(1).max(120),
+  // The BEHAVIOURAL identity of the rubric named above, beside its NAME. `rubricVersion` is an
+  // identifier the tool's author controls and can leave unchanged across a scoring change (this
+  // happened under witan-rubric-v17-2026-07-24 in 0.4.9 — see leaderboard/RUBRIC_CHANGELOG.md).
+  // This field is the sha256 of the scoring-relevant output of a fixed committed fixture corpus
+  // under that rubric, so two certificates naming the same rubric can be checked for behavioural
+  // agreement rather than assumed into it. See src/witan/rubric-fingerprint.ts for exactly what
+  // the digest covers, what it excludes, and what it does not claim. Optional and absent —
+  // never fabricated — for any rubric this build has no measurement for, and absent on every
+  // report emitted before report format 1.2; those artifacts' attestations remain valid.
+  rubricBehaviourFingerprint: external_exports.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
   // Rubric-driven: length matches whatever rubric produced this report, not a fixed enum.
   criteria: external_exports.array(WitanCriterionScoreSchema).min(1),
   consumedSignals: external_exports.array(WitanConsumedSignalSummarySchema).optional(),
   archetype: WitanRepoArchetypeSchema.optional(),
   scanLimitations: external_exports.array(external_exports.string().min(1).max(1e3)).max(16).optional(),
-  contentReadSummary: WitanContentReadSummarySchema.optional()
+  contentReadSummary: WitanContentReadSummarySchema.optional(),
+  // The @cejel/cejel version that produced this report. Absent on reports from before this
+  // field existed and on any caller that does not supply one (createWitanReport never defaults
+  // it). Constant within an installed version, so re-running the same version on the same
+  // commit stays byte-stable (the exact property v0.3.1 removed generatedAt to protect); it
+  // differs across versions, which lets a consumer key incremental reuse on it
+  // (goal_cejel_0_4_8_abstention_scoring_fix_2026-09-08).
+  toolVersion: external_exports.string().min(1).max(80).optional()
 });
 var WitanScoredReportSchema = WitanReportCommonSchema.extend({
   verdict: WitanScoredVerdictSchema,
@@ -342,7 +378,7 @@ var WitanReportSchema = external_exports.preprocess((value) => {
 }, StrictWitanReportSchema);
 var WITAN_ATTESTATION_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
 var WITAN_ATTESTATION_PREDICATE_TYPE = "https://cejel.dev/attestations/scan/v1";
-var WITAN_REPORT_FORMAT_VERSION = "1.0";
+var WITAN_REPORT_FORMAT_VERSION = "1.2";
 var WitanAttestationOutcomeSchema = external_exports.discriminatedUnion("status", [
   external_exports.object({
     status: external_exports.literal("scored"),
@@ -560,6 +596,7 @@ init_esm_shims();
 // src/witan/certificate-presentation.ts
 init_esm_shims();
 var CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE = "Product name and slug are caller context and are excluded from certificate byte-comparison claims.";
+var CERTIFICATE_SCOPE_NOTICE = "This certificate is a statement about the repository tree at the revision pinned above, not about the system that tree is part of. Evidence outside that tree \u2014 for example, a test suite kept in a separate repository, or CI configuration that changes into a different working directory before running its checks \u2014 is neither seen by this scan nor claimed to be absent.";
 var CERTIFICATE_METRIC_REGISTRY = {
   test_to_source_ratio: { displayLabel: "Test-to-source file ratio" },
   coverage_percent: { displayLabel: "Static coverage percentage" },
@@ -1073,6 +1110,7 @@ function buildRelyingPartySummary(report) {
     "Anything absent from the measured evidence was not established: no measurement and no finding are not clearance."
   );
   return {
+    scope: CERTIFICATE_SCOPE_NOTICE,
     examined: `Cejel examined the repository evidence recorded for ${report.productDisplayName}${revision} under ${report.rubricVersion}.`,
     established: `The report established measured results for ${measured.length} of ${applicable.length} applicable rubric dimensions and recorded ${findings} evidence-backed finding${findings === 1 ? "" : "s"}.`,
     notEstablished: gaps.join(" "),
@@ -1285,6 +1323,7 @@ function renderRelyingPartySummary(summary) {
   return `<section class="relying-party-summary" aria-labelledby="relying-party-heading">
       <h2 id="relying-party-heading">How to read this certificate</h2>
       <dl>
+        <div><dt>Scope</dt><dd>${escapeHtml(summary.scope)}</dd></div>
         <div><dt>What was examined</dt><dd>${escapeHtml(summary.examined)}</dd></div>
         <div><dt>What was established</dt><dd>${escapeHtml(summary.established)}</dd></div>
         <div><dt>What was not established</dt><dd>${escapeHtml(summary.notEstablished)}</dd></div>
@@ -2007,29 +2046,56 @@ function inventoryAbsenceFinding(options) {
     } : {}
   };
 }
-function wholesaleCriterionAbstention(signal) {
+function wholesaleCriterionAbstention(signal, reasons) {
+  const { insufficientDataReason } = classifyAbstentionReason(reasons);
   return {
     criterionId: signal.criterionId,
     positiveEvidence: [],
     findings: [],
     metrics: [],
     insufficientData: true,
-    notes: "Cejel abstained on this criterion because one or more relevant repository files could not be read. Resolve the content-read limitations and re-scan."
+    ...insufficientDataReason !== void 0 ? { insufficientDataReason } : {},
+    notes: insufficientDataReason !== void 0 ? "Cejel abstained on this criterion because relevant repository content was declined under the repository content size limit or excluded from scanning by policy. This is a disclosed coverage limit, not a read failure, and does not affect the composite score." : "Cejel abstained on this criterion because one or more relevant repository files could not be read. Resolve the content-read limitations and re-scan."
   };
 }
+function skipReasonsForCriterion(criterionId, tracked) {
+  const combined = new Set(tracked.criterionSkipReasons.get(criterionId) ?? []);
+  const prefix = contentReadSignalKey(criterionId, "");
+  for (const [key, reasons] of tracked.signalSkipReasons) {
+    if (!key.startsWith(prefix)) continue;
+    for (const reason of reasons) combined.add(reason);
+  }
+  return combined;
+}
+function skipReasonsForSignal(criterionId, signalName, tracked) {
+  const reasons = tracked.signalSkipReasons.get(contentReadSignalKey(criterionId, signalName));
+  return reasons ? new Set(reasons) : void 0;
+}
 function buildWitanInputFromRepo(options) {
   const tracked = trackContentReads(options.repoPath, () => buildWitanInputFromRepoUntracked(options));
   const affectedCriteria = tracked.affectedCriteria;
   const rubricVersion = options.rubricVersion ?? WITAN_RUBRIC_VERSION;
   if (rubricVersion !== WITAN_RUBRIC_VERSION_V23) {
-    const signals2 = (tracked.value.signals ?? []).map(
-      (signal) => affectedCriteria.has(signal.criterionId) ? wholesaleCriterionAbstention(signal) : signal
-    );
-    const affectedCount = affectedCriteria.size;
+    const readFailureCriteria = [];
+    const coverageLimitedCriteria = [];
+    const signals2 = (tracked.value.signals ?? []).map((signal) => {
+      if (!affectedCriteria.has(signal.criterionId)) return signal;
+      const reasons = skipReasonsForCriterion(signal.criterionId, tracked);
+      const { insufficientDataReason } = classifyAbstentionReason(reasons);
+      (insufficientDataReason !== void 0 ? coverageLimitedCriteria : readFailureCriteria).push(
+        signal.criterionId
+      );
+      return wholesaleCriterionAbstention(signal, reasons);
+    });
     const scanLimitations2 = [...tracked.value.scanLimitations ?? []];
-    if (affectedCount > 0 && scanLimitations2.length < 16) {
+    if (readFailureCriteria.length > 0 && scanLimitations2.length < 16) {
       scanLimitations2.push(
-        `${affectedCount} ${affectedCount === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+        `${readFailureCriteria.length} ${readFailureCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+      );
+    }
+    if (coverageLimitedCriteria.length > 0 && scanLimitations2.length < 16) {
+      scanLimitations2.push(
+        `${coverageLimitedCriteria.length} ${coverageLimitedCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content was declined under the repository content size limit or excluded from scanning by policy \u2014 a disclosed coverage limit, not a read failure. This does not affect the composite score.`
       );
     }
     return {
@@ -2039,45 +2105,92 @@ function buildWitanInputFromRepo(options) {
       contentReadSummary: tracked.summary
     };
   }
-  const wholesaleAbstainedCriteria = [];
-  const partiallyAbstainedSignals = [];
+  const wholesaleAbstainedReadFailureCriteria = [];
+  const wholesaleAbstainedCoverageLimitedCriteria = [];
+  const partiallyAbstainedReadFailureSignals = [];
+  const partiallyAbstainedLargeFileSignals = [];
+  const partiallyAbstainedOtherCoverageLimitedSignals = [];
   const signals = (tracked.value.signals ?? []).map((signal) => {
     if (!affectedCriteria.has(signal.criterionId)) return signal;
     if (tracked.unattributedCriteria.has(signal.criterionId)) {
-      wholesaleAbstainedCriteria.push(signal.criterionId);
-      return wholesaleCriterionAbstention(signal);
+      const reasons = tracked.criterionSkipReasons.get(signal.criterionId);
+      const { insufficientDataReason } = classifyAbstentionReason(reasons);
+      (insufficientDataReason !== void 0 ? wholesaleAbstainedCoverageLimitedCriteria : wholesaleAbstainedReadFailureCriteria).push(signal.criterionId);
+      return wholesaleCriterionAbstention(signal, reasons);
     }
     const prefix = contentReadSignalKey(signal.criterionId, "");
     const affectedNames = [...tracked.affectedSignals].filter((key) => key.startsWith(prefix)).map((key) => key.slice(prefix.length));
     if (affectedNames.length === 0) {
-      wholesaleAbstainedCriteria.push(signal.criterionId);
+      wholesaleAbstainedReadFailureCriteria.push(signal.criterionId);
       return wholesaleCriterionAbstention(signal);
     }
     const affectedNameSet = new Set(affectedNames);
     const metrics = (signal.metrics ?? []).filter((metric2) => !affectedNameSet.has(metric2.name));
     const anythingSurvives = metrics.length > 0 || (signal.positiveEvidence?.length ?? 0) > 0 || (signal.findings?.length ?? 0) > 0;
+    const droppedReasons = /* @__PURE__ */ new Set();
+    for (const name of affectedNames) {
+      for (const reason of skipReasonsForSignal(signal.criterionId, name, tracked) ?? []) {
+        droppedReasons.add(reason);
+      }
+    }
     if (!anythingSurvives) {
-      wholesaleAbstainedCriteria.push(signal.criterionId);
-      return wholesaleCriterionAbstention(signal);
+      const { insufficientDataReason } = classifyAbstentionReason(droppedReasons);
+      (insufficientDataReason !== void 0 ? wholesaleAbstainedCoverageLimitedCriteria : wholesaleAbstainedReadFailureCriteria).push(signal.criterionId);
+      return wholesaleCriterionAbstention(signal, droppedReasons);
     }
+    const nameBuckets = /* @__PURE__ */ new Map();
     for (const name of affectedNames) {
-      partiallyAbstainedSignals.push(`${signal.criterionId}.${name}`);
-    }
+      const nameReasons = skipReasonsForSignal(signal.criterionId, name, tracked);
+      const { insufficientDataReason: nameReason } = classifyAbstentionReason(nameReasons);
+      const bucket = nameReason === void 0 ? "read-failure" : nameReason === "too_large" ? "too-large" : "other-coverage";
+      nameBuckets.set(name, bucket);
+      (bucket === "read-failure" ? partiallyAbstainedReadFailureSignals : bucket === "too-large" ? partiallyAbstainedLargeFileSignals : partiallyAbstainedOtherCoverageLimitedSignals).push(`${signal.criterionId}.${name}`);
+    }
+    const distinctBuckets = new Set(nameBuckets.values());
+    const uniformBucket = distinctBuckets.size === 1 ? [...distinctBuckets][0] : void 0;
+    const affectedList = [...affectedNames].sort().join(", ");
+    const notes = uniformBucket === "read-failure" ? `Cejel abstained on ${affectedList} in this criterion because that content could not be read; other signals in this criterion were computed from readable files and are unaffected.` : uniformBucket === "too-large" ? `Cejel declined ${affectedList} in this criterion under the repository content size limit; other signals in this criterion were computed from readable files and are unaffected. This is a disclosed coverage limit, not a read failure.` : uniformBucket === "other-coverage" ? `Cejel declined ${affectedList} in this criterion under an extension exclusion or a non-regular-file skip; other signals in this criterion were computed from readable files and are unaffected. This is a disclosed coverage limit, not a read failure.` : `Cejel abstained on ${affectedList} in this criterion for a mix of reasons \u2014 some content could not be read, some was declined under the repository content size limit or an extension exclusion; other signals in this criterion were computed from readable files and are unaffected.`;
     return {
       ...signal,
       metrics,
-      notes: `Cejel abstained on ${[...affectedNames].sort().join(", ")} in this criterion because that content could not be read; other signals in this criterion were computed from readable files and are unaffected.`
+      notes
     };
   });
   const scanLimitations = [...tracked.value.scanLimitations ?? []];
-  if (wholesaleAbstainedCriteria.length > 0 && scanLimitations.length < 16) {
-    scanLimitations.push(
-      `${wholesaleAbstainedCriteria.length} ${wholesaleAbstainedCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read and the affected signal could not be isolated. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+  const candidateScanLimitations = [];
+  if (wholesaleAbstainedReadFailureCriteria.length > 0) {
+    candidateScanLimitations.push(
+      `${wholesaleAbstainedReadFailureCriteria.length} ${wholesaleAbstainedReadFailureCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read and the affected signal could not be isolated. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+    );
+  }
+  if (wholesaleAbstainedCoverageLimitedCriteria.length > 0) {
+    candidateScanLimitations.push(
+      `${wholesaleAbstainedCoverageLimitedCriteria.length} ${wholesaleAbstainedCoverageLimitedCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content was declined under the repository content size limit or excluded from scanning by policy, and the affected signal could not be isolated. This is a disclosed coverage limit, not a read failure, and does not affect the composite score.`
+    );
+  }
+  if (partiallyAbstainedReadFailureSignals.length > 0) {
+    candidateScanLimitations.push(
+      `${partiallyAbstainedReadFailureSignals.length} ${partiallyAbstainedReadFailureSignals.length === 1 ? "signal" : "signals"} abstained because its own repository content could not be read, while other signals in the same criterion were unaffected: ${[...partiallyAbstainedReadFailureSignals].sort().join(", ")}.`
     );
   }
-  if (partiallyAbstainedSignals.length > 0 && scanLimitations.length < 16) {
+  if (partiallyAbstainedLargeFileSignals.length > 0) {
+    candidateScanLimitations.push(
+      `${partiallyAbstainedLargeFileSignals.length} ${partiallyAbstainedLargeFileSignals.length === 1 ? "signal" : "signals"} declined a large implementation file that exceeded the repository content size limit, while other signals in the same criterion were unaffected: ${[...partiallyAbstainedLargeFileSignals].sort().join(", ")}. That file is undercounted, not scored as clean or absent \u2014 this is a disclosed coverage limit, not a read failure.`
+    );
+  }
+  if (partiallyAbstainedOtherCoverageLimitedSignals.length > 0) {
+    candidateScanLimitations.push(
+      `${partiallyAbstainedOtherCoverageLimitedSignals.length} ${partiallyAbstainedOtherCoverageLimitedSignals.length === 1 ? "signal" : "signals"} declined under an extension exclusion or a non-regular-file skip, while other signals in the same criterion were unaffected: ${[...partiallyAbstainedOtherCoverageLimitedSignals].sort().join(", ")}. This is a disclosed coverage limit, not a read failure.`
+    );
+  }
+  const availableSlots = Math.max(0, 16 - scanLimitations.length);
+  if (candidateScanLimitations.length <= availableSlots) {
+    scanLimitations.push(...candidateScanLimitations);
+  } else if (availableSlots > 0) {
+    const keep = availableSlots - 1;
+    scanLimitations.push(...candidateScanLimitations.slice(0, keep));
     scanLimitations.push(
-      `${partiallyAbstainedSignals.length} ${partiallyAbstainedSignals.length === 1 ? "signal" : "signals"} abstained because its own repository content could not be read, while other signals in the same criterion were unaffected: ${[...partiallyAbstainedSignals].sort().join(", ")}.`
+      `${candidateScanLimitations.length - keep} additional disclosed scan limitation(s) omitted at the 16-entry cap \u2014 see contentReadSummary for full counts.`
     );
   }
   return {
@@ -2107,6 +2220,8 @@ function buildWitanInputFromRepoUntracked(options) {
   const usesV21ExecutedEscalations = rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const usesV22PackageStartEntrypoint = rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const usesV23CommandCoverage = rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV23PemPrivateKeyGrammar = rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV23WithheldPathAbstention = rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const structuralArchetype = classifyRepoArchetype(inventoryFiles, rubricVersion);
   const readableArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion) ? applyReadableSourceRepresentationGate(
     options.repoPath,
@@ -2143,6 +2258,8 @@ function buildWitanInputFromRepoUntracked(options) {
     usesV21ExecutedEscalations,
     usesV22PackageStartEntrypoint,
     usesV23CommandCoverage,
+    usesV23PemPrivateKeyGrammar,
+    usesV23WithheldPathAbstention,
     reviewableSourceProof,
     inventoryAbsenceContext,
     scanLimitations
@@ -2754,7 +2871,7 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, useV23CommandCoverage, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, useV23CommandCoverage, useV23PemPrivateKeyGrammar, useV23WithheldPathAbstention, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
   const signals = [];
   const mono = resolveMonorepoContext(repoPath, scanLimitations);
   const collectCriterion = (criterionId, collect) => withContentReadCriterion(criterionId, collect);
@@ -2781,6 +2898,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV36Detectors,
       useV39Detectors,
       useV47Detectors,
+      useV23PemPrivateKeyGrammar,
       useV18NativeRls,
       inventoryAbsenceContext,
       scanLimitations
@@ -2794,6 +2912,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV27Detectors,
       useV20A3ExplicitGaps,
       useV22PackageStartEntrypoint,
+      useV23WithheldPathAbstention,
       inventoryAbsenceContext
     )
   );
@@ -2814,6 +2933,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       repoPath,
       repoFiles,
       useV27Detectors,
+      useV23WithheldPathAbstention,
       inventoryAbsenceContext
     )
   );
@@ -2916,12 +3036,16 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
   const ciHasTypecheckCommand = ciWorkflows.some(
     (file) => fileContains(repoPath, file, CI_TYPECHECK_COMMAND_PATTERN)
   );
-  const verificationScriptCount = [
-    packageScripts.has("test") || Boolean(ciTestWorkflow),
-    coverageAnalysis.hasCoverageCommand,
-    packageScripts.has("lint") || ciHasLintCommand,
-    packageScripts.has("typecheck") || ciHasTypecheckCommand
-  ].filter(Boolean).length;
+  const verificationScriptComponents = [
+    { label: "test command", count: hasCredibleTestScript(packageScripts) || Boolean(ciTestWorkflow) ? 1 : 0 },
+    { label: "coverage command", count: coverageAnalysis.hasCoverageCommand ? 1 : 0 },
+    { label: "lint command", count: packageScripts.has("lint") || ciHasLintCommand ? 1 : 0 },
+    {
+      label: "type-check command",
+      count: packageScripts.has("typecheck") || ciHasTypecheckCommand ? 1 : 0
+    }
+  ];
+  const verificationScriptCount = verificationScriptComponents.filter((c) => c.count > 0).length;
   const usesLeanBuiltInTestRunner = packageJson != null && [...packageScripts.values()].some(
     (script) => LEAN_TEST_RUNNER_SCRIPT_PATTERN.test(script)
   ) || testFiles.some((file) => fileContains(repoPath, file, LEAN_TEST_RUNNER_IMPORT_PATTERN));
@@ -2985,7 +3109,9 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
       repoPath,
       reviewableSourceProof,
       repoFiles.length,
-      inventoryAbsenceContext
+      inventoryAbsenceContext,
+      verificationScriptComponents,
+      runnerFiles.length
     ) : null;
   }
   if (testFiles.length === 0) {
@@ -3085,19 +3211,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
         "saturating_count",
         {
           components: [
-            {
-              label: "test command",
-              count: packageScripts.has("test") || Boolean(ciTestWorkflow) ? 1 : 0
-            },
-            { label: "coverage command", count: coverageAnalysis.hasCoverageCommand ? 1 : 0 },
-            {
-              label: "lint command",
-              count: packageScripts.has("lint") || ciHasLintCommand ? 1 : 0
-            },
-            {
-              label: "type-check command",
-              count: packageScripts.has("typecheck") || ciHasTypecheckCommand ? 1 : 0
-            },
+            ...verificationScriptComponents,
             { label: "test-runner configuration", count: runnerFiles.length }
           ]
         }
@@ -3115,7 +3229,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
     notes: coverageFiles.length === 0 && coverageAnalysis.unresolvedFiles.length > 0 ? `A1 is detected from real test files, test runner configuration, and optional coverage configuration. Coverage command reachability or flag ownership was unresolved in ${coverageAnalysis.unresolvedFiles.slice(0, 4).join(", ")}; the no-coverage absence claim was withheld.` : "A1 is detected from real test files, test runner configuration, and optional coverage configuration."
   };
 }
-function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inventoryAbsenceContext) {
+function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inventoryAbsenceContext, verificationScriptComponents, runnerFileCount) {
   const sourcePath = proof.firstReadablePath;
   if (!sourcePath) {
     throw new Error("Cejel invariant: a passing reviewable-source proof must have a readable path");
@@ -3167,7 +3281,12 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inve
       metric(
         "verification_script_ratio",
         "Verification script ratio",
-        0,
+        // Zero test FILES does not mean zero verification signal: a lint/typecheck/coverage
+        // script or CI command is a real, independently-observable fact from package.json/CI
+        // content and must be credited here the same way B3 credits it, or A1 flatly
+        // contradicts B3 on the same repository fact (goal_cejel_detector_false_assertions_
+        // 0_4_9_2026-09-14 finding 3).
+        verificationScriptComponents.filter((c) => c.count > 0).length + runnerFileCount,
         4,
         0.25,
         "ratio",
@@ -3175,11 +3294,8 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inve
         "saturating_count",
         {
           components: [
-            { label: "test command", count: 0 },
-            { label: "coverage command", count: 0 },
-            { label: "lint command", count: 0 },
-            { label: "type-check command", count: 0 },
-            { label: "test-runner configuration", count: 0 }
+            ...verificationScriptComponents,
+            { label: "test-runner configuration", count: runnerFileCount }
           ]
         }
       ),
@@ -3193,10 +3309,10 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inve
         "No concrete test files were present to establish non-hollow test behavior."
       )
     ],
-    notes: `V17 authenticated absence: ${proof.eligibleSourceFileCount} criterion-ratable of ${proof.sourceShapedFileCount} source-shaped files; sampled ${proof.sampledFileCount}; ${proof.readableSampledFileCount} representative-text files.`
+    notes: `V17 authenticated absence: ${proof.eligibleSourceFileCount} criterion-ratable of ${proof.sourceShapedFileCount} source-shaped files; sampled ${proof.sampledFileCount}; ${proof.readableSampledFileCount} representative-text files. Verification-script signals (lint/typecheck/coverage/CI commands) are independent of test-file presence and are still credited above where detected.`
   };
 }
-function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, inventoryAbsenceContext, scanLimitations) {
+function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV23PemPrivateKeyGrammar, useV18NativeRls, inventoryAbsenceContext, scanLimitations) {
   const evidence = [];
   const findings = [];
   const gitignore = repoFiles.find((file) => basename(file) === ".gitignore");
@@ -3219,7 +3335,8 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
           path,
           useV36Detectors,
           useV39Detectors,
-          useV47Detectors
+          useV47Detectors,
+          useV23PemPrivateKeyGrammar
         );
         if (!found) continue;
         match_ = { path, match: found };
@@ -3227,7 +3344,9 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       }
       const fingerprintsByPath = /* @__PURE__ */ new Map();
       if (useV27Detectors) {
-        for (const path of repoFiles.filter((candidate) => isCredentialHistoryPath(candidate))) {
+        for (const path of repoFiles.filter(
+          (candidate) => isCredentialHistoryPath(candidate, useV36Detectors, useV23PemPrivateKeyGrammar)
+        )) {
           fingerprintsByPath.set(
             path,
             new Set(
@@ -3236,7 +3355,8 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
                 path,
                 useV36Detectors,
                 useV39Detectors,
-                useV47Detectors
+                useV47Detectors,
+                useV23PemPrivateKeyGrammar
               )
             )
           );
@@ -3253,7 +3373,8 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
     useV33Detectors,
     useV36Detectors,
     useV39Detectors,
-    useV47Detectors
+    useV47Detectors,
+    useV23PemPrivateKeyGrammar
   );
   const hasConfirmedSecretFinding = committedSecret != null || historySecretScan?.evidence != null;
   const cryptoHygiene = withContentReadSignal(
@@ -3380,15 +3501,16 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   if (committedSecret) {
     const isTestPath = isTestOrFixturePath(committedSecret.path);
     const isDefaultAdmin = committedSecret.match.kind === "default_admin";
+    const isPemPrivateKey = committedSecret.match.kind === "pem_private_key";
     findings.push({
       severity: isTestPath ? "info" : "critical",
-      summary: isDefaultAdmin ? isTestPath ? `Default administrative credential in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production deployment default; verify.` : "An explicit default administrative credential appears committed in production configuration." : isTestPath ? `Secret-shaped value in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production leak; verify.` : "Secret-shaped value appears committed in the scanned repository.",
+      summary: isDefaultAdmin ? isTestPath ? `Default administrative credential in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production deployment default; verify.` : "An explicit default administrative credential appears committed in production configuration." : isPemPrivateKey ? isTestPath ? `PEM-formatted private key in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production leak; verify.` : "A PEM-formatted private key appears committed in the scanned repository." : isTestPath ? `Secret-shaped value in a test/fixture file (${committedSecret.path}) \u2014 likely fixture data, not a production leak; verify.` : "Secret-shaped value appears committed in the scanned repository.",
       evidence: evidenceForRelativeAtLine(
         repoPath,
         committedSecret.path,
         "secret_scan",
         secretEvidenceLabel(
-          isDefaultAdmin ? "Committed default administrative credential" : "Committed secret-shaped value",
+          isDefaultAdmin ? "Committed default administrative credential" : isPemPrivateKey ? "Committed PEM-formatted private key" : "Committed secret-shaped value",
           committedSecret.match
         ),
         committedSecret.match.line
@@ -3419,9 +3541,10 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   if (historySecretScan?.evidence) {
     const historyPath = historySecretScan.evidence.path ?? "";
     const isTestPath = isTestOrFixturePath(historyPath);
+    const isPemPrivateKey = historySecretScan.secretKind === "pem_private_key";
     findings.push({
       severity: isTestPath ? "info" : "critical",
-      summary: isTestPath ? `Secret-shaped value in git history for a test/fixture file (${historyPath}) \u2014 likely fixture data, not a production leak; verify.` : "Secret-shaped value appears in recent git history.",
+      summary: isPemPrivateKey ? isTestPath ? `PEM-formatted private key in git history for a test/fixture file (${historyPath}) \u2014 likely fixture data, not a production leak; verify.` : "A PEM-formatted private key appears in recent git history." : isTestPath ? `Secret-shaped value in git history for a test/fixture file (${historyPath}) \u2014 likely fixture data, not a production leak; verify.` : "Secret-shaped value appears in recent git history.",
       evidence: historySecretScan.evidence
     });
   } else if (historySecretScan?.truncated) {
@@ -3646,7 +3769,7 @@ function collectCryptoHygieneEvidence(repoPath, implFiles, useV39Detectors = fal
   }
   return { evidence, findings, hasSurface, clean: hasSurface && !insecureFound };
 }
-function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, useV20ExplicitGaps = false, useV22PackageStartEntrypoint = false, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
+function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, useV20ExplicitGaps = false, useV22PackageStartEntrypoint = false, useV23WithheldPathAbstention = false, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const v20DirectHttpEntrypoint = useV20ExplicitGaps ? findV20DirectHttpServerEntrypointFile(repoPath, repoFiles) : null;
   const v22PackageStartHttpEntrypoint = useV22PackageStartEntrypoint ? findV22PackageStartHttpServerEntrypointFile(repoPath, repoFiles) : null;
   const v20RuntimeContainer = useV20ExplicitGaps ? findRuntimeContainerEntrypointFile(repoPath, repoFiles, true) : null;
@@ -3684,9 +3807,11 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
     )
   );
   const healthCheck = healthChecks[0];
+  const healthReadinessRouteReads = (file) => isAuthoredProductionPath(file) && isImplementationFile(file);
+  const observabilityDepthReads = (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isImplementationFile(file);
   const { hasV20HealthOrReadinessRoute, hasV22PackageStartHealthOrReadinessRoute } = withContentReadSignal("A3", "health_readiness_route", () => ({
     hasV20HealthOrReadinessRoute: useV20ExplicitGaps && repoFiles.some(
-      (file) => isAuthoredProductionPath(file) && isImplementationFile(file) && fileContains(repoPath, file, V20_HEALTH_OR_READINESS_ROUTE_PATTERN)
+      (file) => healthReadinessRouteReads(file) && fileContains(repoPath, file, V20_HEALTH_OR_READINESS_ROUTE_PATTERN)
     ),
     hasV22PackageStartHealthOrReadinessRoute: v22PackageStartHttpEntrypoint !== null && fileContains(
       repoPath,
@@ -3694,23 +3819,34 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
       V20_HEALTH_OR_READINESS_ROUTE_PATTERN
     )
   }));
+  const healthReadinessRouteWithheld = useV23WithheldPathAbstention && useV20ExplicitGaps && abstainSignalOnWithheldPaths("A3", "health_readiness_route", healthReadinessRouteReads);
   const serverEntrypoint = v22PackageStartHttpEntrypoint ?? findServerEntrypointFile(repoPath, repoFiles, useV27Detectors) ?? v20DirectHttpEntrypoint ?? null;
   const runtimeContainer = useV27Detectors ? findRuntimeContainerEntrypointFile(repoPath, repoFiles, useV20ExplicitGaps) : null;
   const errorBoundaries = repoFiles.filter(
     (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && /error-boundary|error\.(tsx|jsx|ts|js)$/.test(file)
   );
-  const errorBoundary = errorBoundaries[0];
+  const expressErrorMiddlewareFile = errorBoundaries.length > 0 ? void 0 : withContentReadSignal(
+    "A3",
+    "prod_readiness_primitives",
+    () => repoFiles.find(
+      (file) => observabilityDepthReads(file) && fileContains(repoPath, file, EXPRESS_ERROR_MIDDLEWARE_PATTERN) && fileContains(repoPath, file, EXPRESS_MIDDLEWARE_REACHABLE_PATTERN)
+    )
+  );
+  const errorBoundary = errorBoundaries[0] ?? expressErrorMiddlewareFile;
+  if (useV23WithheldPathAbstention && errorBoundaries.length === 0) {
+    abstainSignalOnWithheldPaths("A3", "prod_readiness_primitives", observabilityDepthReads);
+  }
   const observabilityCount = withContentReadSignal(
     "A3",
     "observability_depth",
-    () => countFilesContaining(
-      repoPath,
-      repoFiles.filter(
-        (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isImplementationFile(file)
-      ),
-      /sentry|otel|opentelemetry|datadog|prometheus|metrics|logger|logtail/i
-    )
+    () => countFilesMatchingAny(repoPath, repoFiles.filter(observabilityDepthReads), [
+      /sentry|otel|opentelemetry|datadog|prometheus|metrics|logger|logtail|\b(?:correlation|request|trace)[-_]?id\b|\basynclocalstorage\b/i,
+      /\b(?:pino|winston|bunyan|morgan)\b/
+    ])
   );
+  if (useV23WithheldPathAbstention) {
+    abstainSignalOnWithheldPaths("A3", "observability_depth", observabilityDepthReads);
+  }
   const rollbackSafetyCount = withContentReadSignal(
     "A3",
     "rollback_safety_depth",
@@ -3757,8 +3893,17 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
       )
     );
   }
-  if (errorBoundary)
-    evidence.push(evidenceForRelative(repoPath, errorBoundary, "prod_check", "Error boundary"));
+  if (errorBoundary) {
+    evidence.push(
+      errorBoundary === expressErrorMiddlewareFile ? evidenceForRelativeAtLine(
+        repoPath,
+        errorBoundary,
+        "prod_check",
+        "Error boundary",
+        findFirstMatchingLine(repoPath, errorBoundary, EXPRESS_ERROR_MIDDLEWARE_PATTERN)
+      ) : evidenceForRelative(repoPath, errorBoundary, "prod_check", "Error boundary")
+    );
+  }
   if (evidence.length === 0) {
     if (serverEntrypoint) {
       evidence.push(
@@ -3812,7 +3957,12 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
           )
         });
       }
-    } else if (serverEntrypoint && withContentReadSignal(
+    } else if (serverEntrypoint && // An absence finding is an assertion that Cejel looked and found nothing. When a file this
+    // signal would have read was withheld, Cejel did not look at everything it selected, so the
+    // honest output is the recorded abstention above and no finding — never "declares no health
+    // or readiness route". This is the whole defect: insufficient_data must not be emitted as a
+    // finding of absence.
+    !healthReadinessRouteWithheld && withContentReadSignal(
       "A3",
       "health_readiness_route",
       () => fileContains(
@@ -3866,7 +4016,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
           deployConfigs.length > 0,
           envTemplate,
           healthChecks.length > 0,
-          errorBoundaries.length > 0
+          errorBoundary !== void 0
         ].filter(Boolean).length,
         6,
         0.55,
@@ -3883,7 +4033,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
             { label: "deployment configuration", count: deployConfigs.length > 0 ? 1 : 0 },
             { label: "environment template", count: envTemplate ? 1 : 0 },
             { label: "health or readiness signal", count: healthChecks.length > 0 ? 1 : 0 },
-            { label: "error boundary", count: errorBoundaries.length > 0 ? 1 : 0 }
+            { label: "error boundary", count: errorBoundary !== void 0 ? 1 : 0 }
           ]
         }
       ),
@@ -4127,7 +4277,26 @@ function hasDeclaredVersionConstraint(dependency) {
   if (/[~^<>=!]/.test(trimmed)) return true;
   return /^v?\d/.test(trimmed);
 }
-function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
+function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, useV23WithheldPathAbstention, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
+  const claimImplementationReads = claimImplementationFileReads(useV27Detectors);
+  if (useV23WithheldPathAbstention) {
+    abstainSignalOnWithheldPaths(
+      "A5",
+      "claim_match_rate",
+      (file) => claimImplementationReads(file) || isClaimSourceFile(file)
+    );
+    abstainSignalOnWithheldPaths("A5", "claim_source_depth", isClaimSourceFile);
+    abstainSignalOnWithheldPaths(
+      "A5",
+      "reconciliation_artifact_depth",
+      isClaimRealityReconciliationPath
+    );
+    abstainSignalOnWithheldPaths(
+      "A5",
+      "negative_space_documentation",
+      isNegativeSpaceDocCandidate
+    );
+  }
   const reconciliationArtifacts = useV27Detectors ? findClaimRealityReconciliationArtifacts(repoPath, repoFiles) : [];
   const claimSourceFiles = useV27Detectors ? findClaimSourceFiles(repoFiles) : repoFiles.filter(
     (file) => /^(?:README|readme)\.md$/.test(file) || /^docs\/[^/]+\.(?:md|mdx)$/.test(file)
@@ -4173,7 +4342,7 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, inv
   const negativeSpaceCandidates = /* @__PURE__ */ new Set([
     claimDoc,
     ...allDocFiles,
-    ...repoFiles.filter((file) => /(^|\/)(SECURITY|THREAT[_-]?MODEL)\.md$/i.test(file))
+    ...repoFiles.filter(isSecurityOrThreatModelDoc)
   ]);
   const negativeSpaceDoc = withContentReadSignal(
     "A5",
@@ -4261,7 +4430,7 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, inv
 function collectB2PrTraceEvidence(repoPath, repoFiles) {
   const workflows = repoFiles.filter(isCiWorkflow);
   const prTemplate = repoFiles.find(
-    (file) => /(^|\/)(pull_request_template|PULL_REQUEST_TEMPLATE)\.md$/.test(file)
+    (file) => /(^|\/)(pull_request_template|PULL_REQUEST_TEMPLATE)(\.md$|\/[^/]+\.md$)/.test(file)
   );
   const branchProtectionDoc = repoFiles.find(
     (file) => /branch.*protection|review.*gate|CODEOWNERS/i.test(file)
@@ -4364,7 +4533,9 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
     CI_TYPECHECK_COMMAND_PATTERN,
     CI_BUILD_COMMAND_PATTERN
   ];
-  const scriptDepth = ["test", "lint", "typecheck", "build"].filter((s) => scripts.has(s)).length;
+  const scriptDepth = ["test", "lint", "typecheck", "build"].filter(
+    (s) => s === "test" ? hasCredibleTestScript(scripts) : scripts.has(s)
+  ).length;
   const { repoCategoryHits, rootCategoryHits } = withContentReadSignal(
     "B3",
     "ci_script_depth",
@@ -4397,7 +4568,7 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
           components: [
             ...["test", "lint", "typecheck", "build"].map((name) => ({
               label: `package script: ${name === "typecheck" ? "type-check" : name}`,
-              count: scripts.has(name) ? 1 : 0
+              count: (name === "test" ? hasCredibleTestScript(scripts) : scripts.has(name)) ? 1 : 0
             })),
             ...CI_COMMAND_CATEGORIES.map((_pattern, index) => ({
               label: `repository CI command: ${["test", "lint", "type-check", "build"][index]}`,
@@ -4756,6 +4927,10 @@ function isTestFile(file, rubricVersion = WITAN_RUBRIC_VERSION) {
 var NAME_SHAPED_TEST_FILE_PATTERN = /^test(?:-[^/]+)?\.[cm]?[jt]sx?$|\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)__tests__\/|(^|\/)test_[^/]*\.py$|(^|\/)tests?\.py$|_test\.go$|(^|\/)test_[^/]*\.(cpp|cc|cxx)$|_(test|tests)\.(cpp|cc|cxx)$|Tests?\.(java|kt)$|(_test|_spec)\.(rs|rb|php|swift|kt)$/;
 var NAME_SHAPED_TEST_FILE_PATTERN_V17 = /\.tftest\.hcl$|\.bats$|(^|\/)test[^/]*\.m$|_test\.m$/i;
 var TEST_RUNNER_PATTERN = /\b(vitest|jest|mocha|ava|tap|pytest|go test|cargo test|rspec|phpunit|gradle test|mvn test|node\s+--test|node:test)\b/i;
+function hasCredibleTestScript(scripts) {
+  const script = scripts.get("test");
+  return script != null && TEST_RUNNER_PATTERN.test(script);
+}
 var CI_TEST_COMMAND_PATTERN = /\b(pytest|go\s+test|cargo\s+test|mvn\s+test|gradle\s+test|dotnet\s+test|ctest|make\s+test|jest|vitest|mocha|rspec|phpunit|pnpm\s+(?:run\s+)?test|npm\s+(?:run\s+)?test|yarn\s+(?:run\s+)?test|node\s+--test|node:test)\b|--target[=\s]+test\b/i;
 var CI_LINT_COMMAND_PATTERN = /\b(eslint|pylint|flake8|black|ruff)\b/i;
 var CI_TYPECHECK_COMMAND_PATTERN = /\b(tsc|mypy|pyright)\b/i;
@@ -4803,6 +4978,7 @@ var GATED_PRIVILEGE_CHECK_PATTERN = /pg_has_role\s*\(|has_role\s*\(|is not a mem
 var SET_ROLE_PATTERN = /\bset\s+(local\s+)?role\b/i;
 var REQUIRED_REVIEW_PATTERN = /required review|branch protection|protected branch/i;
 var HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT = 5e3;
+var V23_PEM_WIDENED_HISTORY_BLOB_LIMIT = 500;
 var SECRET_IDENTIFIER_KEYWORD_PATTERN = /secret|token|api[_-]?key|password|access[_-]?key/gi;
 var SINGLE_WHITESPACE_PATTERN = /\s/u;
 var SECRET_VALUE_BRANDED_PATTERN = /^(?:sk-[A-Za-z0-9_-]{24,}|sk-ant-api\d{2}-[A-Za-z0-9_-]{80,}|ghp_[A-Za-z0-9_]{30,}|xox[baprs]-[A-Za-z0-9-]{24,}|AKIA[0-9A-Z]{16}|vcp_[A-Za-z0-9_:-]{24,})$/;
@@ -4928,8 +5104,8 @@ function looksLikeSecretValue(value) {
   return SECRET_VALUE_BRANDED_PATTERN.test(value) || isGenericSecretValue(value);
 }
 var PLACEHOLDER_SECRET_PATTERN = /(?:^|[-_])(?:your|example|sample|placeholder|dummy|changeme|replace(?:-?me)?|redacted)(?:$|[-_])|^x{3,}$|^\.\.\.|^\$\{[^}]+}$|^<[^>]+>$/i;
-var ENV_TEMPLATE_PATTERN = /(^|\/)\.env(?:\.[^/]+)*\.(?:example|sample|template|dist)$/i;
-var ENV_TEMPLATE_PATTERN_V47 = /(^|\/)\.env(?:\.[^/]+)*\.(?:example|sample|template|dist|exemplo|ejemplo|exemple|esempio|beispiel|voorbeeld)$/i;
+var ENV_TEMPLATE_PATTERN = /(^|\/)\.env(?:\.[^/]+)?\.(?:example|sample|template|dist)$/i;
+var ENV_TEMPLATE_PATTERN_V47 = /(^|\/)\.env(?:\.[^/]+)?\.(?:example|sample|template|dist|exemplo|ejemplo|exemple|esempio|beispiel|voorbeeld)$/i;
 function isEnvTemplatePath(path, useV47Detectors = false) {
   return (useV47Detectors ? ENV_TEMPLATE_PATTERN_V47 : ENV_TEMPLATE_PATTERN).test(path);
 }
@@ -4946,32 +5122,34 @@ function readGitTrackedFileOutput(repoPath) {
   if (workTree.stdout.trim() !== "true") return { ok: false, reason: "not_a_repo" };
   return execGit(["ls-files", "--cached"], { cwd: repoPath });
 }
-function parseGitTrackedFiles(repoPath, output, includeHardExcluded) {
+function parseGitTrackedFiles(repoPath, output, includeHardExcluded, registerWithheld = false) {
   const files = [];
+  const withhold = (file, reason) => {
+    if (registerWithheld) registerWithheldRepoPath(file, reason);
+  };
   for (const file of output.trim().split("\n")) {
     if (file.length === 0) continue;
     const fullPath = join(repoPath, file);
     if (!includeHardExcluded && isHardExcludedPath(file)) {
       recordContentSkip(fullPath, "denied_path", true);
+      withhold(file, "denied_path");
       continue;
     }
     try {
       const stat = lstatSync(fullPath);
       if (!stat.isFile()) {
         recordContentSkip(fullPath, "non_regular_file", true);
+        withhold(file, "non_regular_file");
         continue;
       }
       if (stat.size > MAX_REPOSITORY_CONTENT_BYTES) {
-        const affectedCriteria = affectedCriteriaForUnavailablePath(file);
-        if (affectedCriteria.length > 0) {
-          recordContentSkipForCriteria(fullPath, "too_large", affectedCriteria, true);
-        } else {
-          recordContentSkip(fullPath, "too_large", true);
-        }
+        recordContentSkip(fullPath, "too_large", true);
+        withhold(file, "too_large");
         continue;
       }
     } catch (error) {
       recordFilesystemSkip(fullPath, error, false, true);
+      withhold(file, "unreadable");
       continue;
     }
     if (!isPotentialContentPath(file)) {
@@ -4981,39 +5159,6 @@ function parseGitTrackedFiles(repoPath, output, includeHardExcluded) {
   }
   return files.sort();
 }
-function affectedCriteriaForUnavailablePath(file) {
-  const affected = /* @__PURE__ */ new Set();
-  if (isDependencyManifest(file) || isLockfile(file)) affected.add("A4");
-  if (isCiWorkflow(file)) {
-    affected.add("A1");
-    affected.add("A3");
-    affected.add("B2");
-    affected.add("B3");
-  }
-  if (isDeployConfig(file)) {
-    affected.add("A3");
-    affected.add("B2");
-  }
-  if (isTestFile(file)) {
-    affected.add("A1");
-    affected.add("A2");
-  }
-  if (isImplementationFile(file)) {
-    affected.add("A1");
-    affected.add("A2");
-    affected.add("A3");
-    affected.add("B1");
-    affected.add("B6");
-  }
-  if (/\.(?:md|mdx|rst|txt)$/i.test(file)) {
-    affected.add("A5");
-    affected.add("B4");
-    affected.add("B5");
-    affected.add("B6");
-  }
-  if (isAuditFile(file)) affected.add("B5");
-  return [...affected];
-}
 function directoryInventory(repoPath) {
   const files = [];
   const rootDevice = statSync(repoPath).dev;
@@ -5024,7 +5169,7 @@ function collectRepoFileInventory(repoPath) {
   const tracked = readGitTrackedFileOutput(repoPath);
   if (tracked.ok) {
     return {
-      repoFiles: parseGitTrackedFiles(repoPath, tracked.stdout, false),
+      repoFiles: parseGitTrackedFiles(repoPath, tracked.stdout, false, true),
       inventoryFiles: parseGitTrackedFiles(repoPath, tracked.stdout, true),
       repoFileInventoryScope: "tracked-scan-eligible",
       scanLimitations: []
@@ -5122,8 +5267,10 @@ function visitRepoDir(repoPath, dirPath, files, rootDevice) {
       visitRepoDir(repoPath, fullPath, files, rootDevice);
       continue;
     }
+    const repoRelativePath = relative(repoPath, fullPath);
     if (!entry.isFile()) {
       recordContentSkip(fullPath, "non_regular_file");
+      registerWithheldRepoPath(repoRelativePath, "non_regular_file");
       continue;
     }
     let size;
@@ -5131,16 +5278,12 @@ function visitRepoDir(repoPath, dirPath, files, rootDevice) {
       size = statSync(fullPath).size;
     } catch (error) {
       recordFilesystemSkip(fullPath, error);
+      registerWithheldRepoPath(repoRelativePath, "unreadable");
       continue;
     }
-    const repoRelativePath = relative(repoPath, fullPath);
     if (size > MAX_REPOSITORY_CONTENT_BYTES) {
-      const affectedCriteria = affectedCriteriaForUnavailablePath(repoRelativePath);
-      if (affectedCriteria.length > 0) {
-        recordContentSkipForCriteria(fullPath, "too_large", affectedCriteria);
-      } else {
-        recordContentSkip(fullPath, "too_large");
-      }
+      recordContentSkip(fullPath, "too_large");
+      registerWithheldRepoPath(repoRelativePath, "too_large");
       continue;
     }
     if (!isPotentialContentPath(repoRelativePath)) {
@@ -5264,6 +5407,9 @@ function measureNonHollowTestShare(repoPath, files, useV17Detectors = false) {
 function countFilesContaining(repoPath, files, pattern) {
   return files.filter((file) => fileContains(repoPath, file, pattern)).length;
 }
+function countFilesMatchingAny(repoPath, files, patterns) {
+  return files.filter((file) => patterns.some((pattern) => fileContains(repoPath, file, pattern))).length;
+}
 function countPatternMatches(repoPath, files, pattern) {
   const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
   const matcher = new RegExp(pattern.source, flags);
@@ -5803,22 +5949,33 @@ function isDocumentationOnlyDeployWorkflow(repoPath, file) {
 function findPackagedApplicationPremiseFiles(repoPath, repoFiles) {
   return repoFiles.filter((file) => /(^|\/)package\.json$/.test(file) && isAuthoredProductionPath(file)).filter((file) => packageJsonDescribesPackagedApplication(repoPath, file, repoFiles));
 }
+function isClaimSourceFile(file) {
+  return /^(?:README|readme)\.md$/.test(file) || /^docs\/[^/]+\.(?:md|mdx)$/.test(file);
+}
+function isClaimRealityReconciliationPath(file) {
+  return /(^|\/)claim[-_]reality[-_]reconciliation\.(?:md|mdx|json)$/i.test(file);
+}
+function isSecurityOrThreatModelDoc(file) {
+  return /(^|\/)(SECURITY|THREAT[_-]?MODEL)\.md$/i.test(file);
+}
+function isNegativeSpaceDocCandidate(file) {
+  return isClaimSourceFile(file) || isSecurityOrThreatModelDoc(file);
+}
+function claimImplementationFileReads(authoredOnly) {
+  return (file) => isImplementationFile(file) && (!authoredOnly || isAuthoredProductionPath(file));
+}
 function findClaimSourceFiles(repoFiles) {
-  return repoFiles.filter(
-    (file) => /^(?:README|readme)\.md$/.test(file) || /^docs\/[^/]+\.(?:md|mdx)$/.test(file)
-  ).sort((left, right) => {
+  return repoFiles.filter(isClaimSourceFile).sort((left, right) => {
     const leftRootReadme = /^(?:README|readme)\.md$/.test(left);
     const rightRootReadme = /^(?:README|readme)\.md$/.test(right);
     return Number(rightRootReadme) - Number(leftRootReadme) || left.localeCompare(right);
   });
 }
 function findClaimImplementationFiles(repoFiles, authoredOnly = false) {
-  return repoFiles.filter(
-    (file) => isImplementationFile(file) && (!authoredOnly || isAuthoredProductionPath(file))
-  );
+  return repoFiles.filter(claimImplementationFileReads(authoredOnly));
 }
 function findClaimRealityReconciliationArtifacts(repoPath, repoFiles) {
-  return repoFiles.filter((file) => /(^|\/)claim[-_]reality[-_]reconciliation\.(?:md|mdx|json)$/i.test(file)).filter((file) => isAuthenticatedClaimRealityArtifact(repoPath, file));
+  return repoFiles.filter(isClaimRealityReconciliationPath).filter((file) => isAuthenticatedClaimRealityArtifact(repoPath, file));
 }
 function isAuthenticatedClaimRealityArtifact(repoPath, file) {
   const fullPath = join(repoPath, file);
@@ -6874,7 +7031,9 @@ var MAIN_ENTRYPOINT_FILE_PATTERN = /(^|\/)(main|server|app|wsgi|asgi|index|entry
 var RACK_ENTRYPOINT_FILE_PATTERN = /(^|\/)(?:config\.ru|(?:main|server|app|start|run)\.rb)$/i;
 var SERVER_ENTRYPOINT_PATTERN = /\bapp\.listen\s*\(|\bserver\.listen\s*\(\s*(?:PORT|port|\d+)|http\.ListenAndServe\s*\(|http\.ListenAndServeTLS\s*\(|axum::Server(?:::|\.)|actix_web::HttpServer(?:::|\.)|uvicorn\.run\s*\(/;
 var V20_DIRECT_HTTP_SERVER_PATTERN = /\b(?:http|https)\.createServer\s*\([\s\S]{0,1500}?\)\.listen\s*\(\s*(?:PORT|port|\d+)/;
-var V20_HEALTH_OR_READINESS_ROUTE_PATTERN = /["'`]\/(?:health|ready|readiness|live|liveness)["'`]/i;
+var V20_HEALTH_OR_READINESS_ROUTE_PATTERN = /["'`][\w${}./-]{0,60}\/(?:(?:health|ready|live)z?|readiness|liveness)(?=["'`/])/i;
+var EXPRESS_ERROR_MIDDLEWARE_PATTERN = /\(\s*(?:err|error)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*(?:req|request)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*(?:res|response)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*next(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*\)\s*(?:=>|\{)/i;
+var EXPRESS_MIDDLEWARE_REACHABLE_PATTERN = /\.use\s*\(|\bmodule\.exports\b|\bexport\s+(?:default\b|function\b|const\b)/;
 var RACK_SERVER_ENTRYPOINT_PATTERN = /Rack::(?:Server|Handler(?:::\w+)?)\.(?:start|run)\s*\(/;
 var RACK_CONFIG_RUN_PATTERN = /^\s*run\s+(?:(?:[A-Z]\w*(?:::\w+)*(?:\.new)?|lambda)\b|->)/m;
 var RUNTIME_CONTAINER_COMMAND_PATTERN = /^\s*(?:CMD|ENTRYPOINT)\s+.*(?:\b(?:start|serve|server|qgis|nginx|apache|gunicorn|uvicorn)\b|manage\.py\s+runserver).*$/im;
@@ -7066,7 +7225,69 @@ function fileContains(repoPath, file, pattern) {
   if (!isRegularFile(fullPath)) return false;
   return pattern.test(readRepoText(fullPath, "utf8"));
 }
-function findCommittedSecretInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
+var PEM_PRIVATE_KEY_ASSIGNMENT_PATTERN = /(?:["'])?([A-Za-z_$][\w$.-]*)(?:["'])?\s*[:=]\s*(?:\|[-+0-9]*\s*\r?\n[ \t]*)?["'`]?-----BEGIN((?: (?:RSA|DSA|EC|OPENSSH|ENCRYPTED))? PRIVATE KEY)-----([\s\S]{0,32768}?)-----END\2-----/g;
+var BARE_PEM_PRIVATE_KEY_PATTERN = /["'`]?-----BEGIN((?: (?:RSA|DSA|EC|OPENSSH|ENCRYPTED))? PRIVATE KEY)-----([\s\S]{0,32768}?)-----END\1-----/g;
+var BARE_PEM_KEY_FILE_PATTERN = /(?:^|\/)id_(?:rsa|dsa|ecdsa|ed25519)$|\.(?:pem|key)$/i;
+function isBarePemKeyFile(file) {
+  return BARE_PEM_KEY_FILE_PATTERN.test(file);
+}
+var DEV_OR_SELF_SIGNED_KEY_CONTEXT_PATTERN = /(?<![A-Za-z0-9])(?:dev|development|local|localhost|self[-_]?signed|snakeoil|insecure|dummy|sample|demo|placeholder|fixture|generated)(?![A-Za-z0-9])/i;
+var ROTATED_OR_REVOKED_KEY_CONTEXT_PATTERN = /(?<![A-Za-z0-9])(?:rotated|revoked|expired|deprecated|compromised|invalidated|superseded)(?![A-Za-z0-9])|do[-_ ]not[-_ ]use|no longer valid/i;
+function isPlausiblePemKeyBody(rawBody) {
+  const normalized = rawBody.replace(/\\[nr]|[\r\n\s]/g, "");
+  if (normalized.length < 40) return false;
+  if (!/^[A-Za-z0-9+/=]+$/.test(normalized)) return false;
+  return !isPlaceholderSecretValue(normalized);
+}
+function scanForPemPrivateKeyMatch(pattern, contents, lines, hasIdentifierGroup) {
+  pattern.lastIndex = 0;
+  let match;
+  while ((match = pattern.exec(contents)) !== null) {
+    const full = match[0];
+    const identifier = hasIdentifierGroup ? match[1] ?? "" : "";
+    const body = (hasIdentifierGroup ? match[3] : match[2]) ?? "";
+    const line = contents.slice(0, match.index).split("\n").length;
+    const contextLines = lines.slice(Math.max(0, line - 5), line + 4).join("\n");
+    const isDevOrSelfSigned = DEV_OR_SELF_SIGNED_KEY_CONTEXT_PATTERN.test(
+      `${identifier}
+${contextLines}`
+    );
+    const isRotatedOrRevoked = ROTATED_OR_REVOKED_KEY_CONTEXT_PATTERN.test(contextLines);
+    if (isPlausiblePemKeyBody(body) && !isDevOrSelfSigned && !isRotatedOrRevoked) {
+      const value = full.slice(full.indexOf("-----BEGIN"));
+      const characterClasses = [
+        /[a-z]/.test(value) ? "lower" : "",
+        /[A-Z]/.test(value) ? "upper" : "",
+        /\d/.test(value) ? "digit" : "",
+        /[^A-Za-z0-9]/.test(value) ? "symbol" : ""
+      ].filter(Boolean).join("+");
+      return {
+        identifier,
+        line,
+        valueLength: value.length,
+        characterClasses: characterClasses || "other",
+        valueFingerprint: createHash2("sha256").update(value).digest("hex"),
+        kind: "pem_private_key"
+      };
+    }
+  }
+  return null;
+}
+function findPemPrivateKeyAssignment(contents, file) {
+  if (!contents.includes("-----BEGIN")) return null;
+  if (DEV_OR_SELF_SIGNED_KEY_CONTEXT_PATTERN.test(file)) return null;
+  const lines = contents.split("\n");
+  const assignmentMatch = scanForPemPrivateKeyMatch(
+    PEM_PRIVATE_KEY_ASSIGNMENT_PATTERN,
+    contents,
+    lines,
+    true
+  );
+  if (assignmentMatch) return assignmentMatch;
+  if (!isBarePemKeyFile(file)) return null;
+  return scanForPemPrivateKeyMatch(BARE_PEM_PRIVATE_KEY_PATTERN, contents, lines, false);
+}
+function findCommittedSecretInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return null;
   const contents = readRepoText(fullPath, "utf8");
@@ -7082,6 +7303,10 @@ function findCommittedSecretInFile(repoPath, file, useV36Detectors = false, useV
     allowCredentialNamedDigest: useV36Detectors
   });
   if (secret) return secret;
+  if (useV23PemPrivateKeyGrammar) {
+    const pemSecret = findPemPrivateKeyAssignment(secretScanContents, file);
+    if (pemSecret) return pemSecret;
+  }
   if (useV39Detectors && isEnvHistoryPath(file, useV36Detectors)) {
     const weakCredential = findWeakExplicitEnvCredential(secretScanContents);
     if (weakCredential) return weakCredential;
@@ -7174,7 +7399,7 @@ function hasTemplateOnlyEnvContent(repoPath, file) {
     return value.length === 0 || isPlaceholderSecretValue(value);
   });
 }
-function findSecretFingerprintsInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
+function findSecretFingerprintsInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return [];
   const contents = readRepoText(fullPath, "utf8");
@@ -7191,6 +7416,10 @@ function findSecretFingerprintsInFile(repoPath, file, useV36Detectors = false, u
     Number.POSITIVE_INFINITY,
     { allowCredentialNamedDigest: useV36Detectors }
   ).map(({ valueFingerprint }) => valueFingerprint);
+  if (useV23PemPrivateKeyGrammar) {
+    const pemSecret = findPemPrivateKeyAssignment(scanContents, file);
+    if (pemSecret) fingerprints.push(pemSecret.valueFingerprint);
+  }
   if (useV39Detectors && isEnvHistoryPath(file, useV36Detectors)) {
     const weakCredential = findWeakExplicitEnvCredential(scanContents);
     if (weakCredential) fingerprints.push(weakCredential.valueFingerprint);
@@ -7334,24 +7563,32 @@ function declareHistoryFailure(scanLimitations, reason, operation, maxBufferByte
     `${describeGitFailure(reason, operation, maxBufferBytes)} Cejel continued with reduced Git history evidence.`
   );
 }
-function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFingerprintsByPath, scanLimitations, authoredProductionOnly = false, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false) {
+function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFingerprintsByPath, scanLimitations, authoredProductionOnly = false, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const historyEntries = readCredentialHistoryEntries(
     repoPath,
     scanLimitations,
-    useV36Detectors
+    useV36Detectors,
+    useV23PemPrivateKeyGrammar
   );
   const head = excludeHead ? readGitHead(repoPath) : null;
   let scannedFiles = 0;
+  let v23WidenedOnlyScanned = 0;
   let envPathEvidence = null;
   for (const entry of historyEntries) {
     if (head && entry.commit === head) continue;
     if (authoredProductionOnly && !(useV47Detectors ? isV47AuthoredProductionPath(entry.path) : useV39Detectors ? isV39AuthoredProductionPath(entry.path) : isAuthoredProductionPath(entry.path))) {
       continue;
     }
-    if (scannedFiles >= HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT) {
-      return { evidence: null, envPathEvidence, truncated: true };
+    const isV23WidenedOnly = useV23PemPrivateKeyGrammar && isV23PemCredentialHistoryPath(historyPathBasename(entry.path.toLowerCase())) && !isCredentialHistoryPath(entry.path, useV36Detectors, false);
+    if (isV23WidenedOnly) {
+      if (v23WidenedOnlyScanned >= V23_PEM_WIDENED_HISTORY_BLOB_LIMIT) continue;
+      v23WidenedOnlyScanned += 1;
+    } else {
+      if (scannedFiles >= HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT) {
+        return { evidence: null, secretKind: null, envPathEvidence, truncated: true };
+      }
+      scannedFiles += 1;
     }
-    scannedFiles += 1;
     const contents = readGitBlob(repoPath, entry.commit, entry.path, scanLimitations);
     if (!contents) continue;
     const scanContents = prepareCredentialScanContents(
@@ -7365,6 +7602,12 @@ function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFinger
     let secretMatch = findRealSecretAssignment(scanContents, currentFingerprints, {
       allowCredentialNamedDigest: useV36Detectors
     });
+    if (!secretMatch && useV23PemPrivateKeyGrammar) {
+      const pemMatch = findPemPrivateKeyAssignment(scanContents, entry.path);
+      if (pemMatch && !currentFingerprints.has(pemMatch.valueFingerprint)) {
+        secretMatch = pemMatch;
+      }
+    }
     if (!secretMatch && useV39Detectors && isEnvHistoryPath(entry.path, useV36Detectors, useV47Detectors)) {
       const weakCredential = findWeakExplicitEnvCredential(scanContents);
       if (weakCredential && !currentFingerprints.has(weakCredential.valueFingerprint)) {
@@ -7375,11 +7618,15 @@ function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFinger
       return {
         evidence: {
           kind: "secret_scan",
-          label: secretEvidenceLabel("Committed secret in recent git history", secretMatch),
+          label: secretEvidenceLabel(
+            secretMatch.kind === "pem_private_key" ? "Committed PEM-formatted private key in recent git history" : "Committed secret in recent git history",
+            secretMatch
+          ),
           path: entry.path,
           line: secretMatch.line,
           contentHash: entry.commit
         },
+        secretKind: secretMatch.kind ?? null,
         envPathEvidence,
         truncated: false
       };
@@ -7393,9 +7640,9 @@ function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFinger
       };
     }
   }
-  return { evidence: null, envPathEvidence, truncated: false };
+  return { evidence: null, secretKind: null, envPathEvidence, truncated: false };
 }
-function readCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors = false) {
+function readCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
   const appendEntry = (entry) => {
@@ -7440,7 +7687,7 @@ function readCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors
           scanLimitations.add(CONTROL_CHARACTER_HISTORY_PATH_LIMITATION);
           continue;
         }
-        if (!isCredentialHistoryPath(path, useV36Detectors)) continue;
+        if (!isCredentialHistoryPath(path, useV36Detectors, useV23PemPrivateKeyGrammar)) continue;
         appendEntry({ commit: currentCommit, path });
       }
     }
@@ -7448,17 +7695,19 @@ function readCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors
   for (const entry of readDeletedCredentialHistoryEntries(
     repoPath,
     scanLimitations,
-    useV36Detectors
+    useV36Detectors,
+    useV23PemPrivateKeyGrammar
   )) {
     appendEntry(entry);
   }
   return entries;
 }
-function readDeletedCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors = false) {
+function readDeletedCredentialHistoryEntries(repoPath, scanLimitations, useV36Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const deletedPaths = readDeletedCredentialHistoryPaths(
     repoPath,
     scanLimitations,
-    useV36Detectors
+    useV36Detectors,
+    useV23PemPrivateKeyGrammar
   );
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
@@ -7472,7 +7721,7 @@ function readDeletedCredentialHistoryEntries(repoPath, scanLimitations, useV36De
   }
   return entries;
 }
-function readDeletedCredentialHistoryPaths(repoPath, scanLimitations, useV36Detectors = false) {
+function readDeletedCredentialHistoryPaths(repoPath, scanLimitations, useV36Detectors = false, useV23PemPrivateKeyGrammar = false) {
   const historyResult = execGit(
     [
       "log",
@@ -7500,7 +7749,7 @@ function readDeletedCredentialHistoryPaths(repoPath, scanLimitations, useV36Dete
       continue;
     }
     if (!path || seen.has(path)) continue;
-    if (!isCredentialHistoryPath(path, useV36Detectors)) continue;
+    if (!isCredentialHistoryPath(path, useV36Detectors, useV23PemPrivateKeyGrammar)) continue;
     seen.add(path);
     paths.push(path);
   }
@@ -7518,14 +7767,24 @@ function readHistoryCommitsForPath(repoPath, path, scanLimitations) {
   }
   return historyResult.stdout.split("\n").map((line) => line.trim()).filter((line) => /^[0-9a-f]{40}$/i.test(line));
 }
-function isCredentialHistoryPath(path, _useV36Detectors = false) {
+var V23_KEY_SHAPED_JSON_PATH_PATTERN = /(?<![A-Za-z0-9])(?:service[-_]?account|private[-_]?key|creds?|key)(?![A-Za-z0-9])/i;
+function historyPathBasename(lowerPath) {
+  return lowerPath.split("/").at(-1) ?? lowerPath;
+}
+function isV23PemCredentialHistoryPath(basename3) {
+  return basename3.endsWith(".json") && V23_KEY_SHAPED_JSON_PATH_PATTERN.test(basename3);
+}
+function isCredentialHistoryPath(path, _useV36Detectors = false, useV23PemPrivateKeyGrammar = false) {
   if (isHardExcludedPath(path)) return false;
   const lowerPath = path.toLowerCase();
-  const basename3 = lowerPath.split("/").at(-1) ?? lowerPath;
+  const basename3 = historyPathBasename(lowerPath);
   if (/\.env(?:\.|$)/.test(basename3)) {
     return true;
   }
-  return lowerPath.includes("secret") || lowerPath.includes("credential") || basename3.endsWith(".pem") || basename3.endsWith(".key") || basename3 === "id_rsa" || basename3.endsWith(".p12") || basename3.endsWith(".pfx");
+  if (lowerPath.includes("secret") || lowerPath.includes("credential") || basename3.endsWith(".pem") || basename3.endsWith(".key") || basename3 === "id_rsa" || basename3.endsWith(".p12") || basename3.endsWith(".pfx")) {
+    return true;
+  }
+  return useV23PemPrivateKeyGrammar && isV23PemCredentialHistoryPath(basename3);
 }
 function isEnvHistoryPath(path, useV36Detectors = false, useV47Detectors = false) {
   if (isEnvTemplatePath(path, useV47Detectors)) return false;
@@ -8235,6 +8494,22 @@ function discoverIngestInputs(repoPath, maxMatches = Number.POSITIVE_INFINITY) {
 // src/witan/scoring.ts
 init_esm_shims();
 
+// src/witan/rubric-fingerprint.ts
+init_esm_shims();
+import { createHash as createHash3 } from "crypto";
+var WITAN_RUBRIC_BEHAVIOUR_FINGERPRINTS = Object.freeze({
+  [WITAN_RUBRIC_VERSION_V17]: "sha256:ff0f01abe8c12daa60375d0e18c1aca4a1135a55ab2a80b15f4c037bfc18b4b1",
+  [WITAN_RUBRIC_VERSION_V18]: "sha256:abc35df0fdc0749aa941f47b295059d06c96dd9800af7f79cfef2bc8dae917da",
+  [WITAN_RUBRIC_VERSION_V19]: "sha256:f670fa2cc44beef066fa38767bd587e1a16fb28b03bc904756daaea5a6465e96",
+  [WITAN_RUBRIC_VERSION_V20]: "sha256:9276ce2ce865c2d50c52882ee45bbf1df5fe3c8b6038858b4a147f7a4cedfa98",
+  [WITAN_RUBRIC_VERSION_V21]: "sha256:d86411a7fe108bba4d2b8fe7ff9d4f7f69a60f11ca0c5c3fef8e88f66a9af53a",
+  [WITAN_RUBRIC_VERSION_V22]: "sha256:1bb57dd98d29b43b170f3a4f1c8b3b379b433a2aa9df0821ab9d5115f48cfb2f",
+  [WITAN_RUBRIC_VERSION_V23]: "sha256:b558c0aa4b2f85b734bed2e077298fd55851a1086234d678f10a71cf913ec3cf"
+});
+function rubricBehaviourFingerprint(rubricVersion) {
+  return WITAN_RUBRIC_BEHAVIOUR_FINGERPRINTS[rubricVersion];
+}
+
 // src/witan/rubric.ts
 init_esm_shims();
 var WITAN_RUBRIC = [
@@ -8300,11 +8575,11 @@ function usesV17DetectorClosure2(rubricVersion) {
   return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
 }
 var MAX_SIGNAL_ADJUSTMENT = 0.8;
-function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
+function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC, toolVersion) {
   const parsedInput = WitanReportInputSchema.parse(input);
   const signalsByCriterion = mergeSignalsByCriterion(parsedInput.signals);
   const readFailureAbstentions = new Set(
-    [...signalsByCriterion.values()].filter((signal) => signal.insufficientData === true).map((signal) => signal.criterionId)
+    [...signalsByCriterion.values()].filter((signal) => signal.insufficientData === true && !isSelfImposedAbstention(signal)).map((signal) => signal.criterionId)
   );
   const hasInputSignals = inputSignals != null && inputSignals.length > 0;
   const inputSignalsByDimension = /* @__PURE__ */ new Map();
@@ -8394,6 +8669,13 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
     productDisplayName: parsedInput.productDisplayName,
     repo: parsedInput.repo,
     rubricVersion: parsedInput.rubricVersion,
+    // Behavioural identity beside the rubric's name, so a reader holding two certificates can
+    // check whether the scoring that produced them agrees instead of inferring it from a string
+    // the tool's author controls. Derived only from parsedInput.rubricVersion, so it is a
+    // property of the (build, rubric) pair and not of this invocation: two runs of the same
+    // installed version at the same revision stay byte-identical. Absent, never fabricated, for
+    // a rubric this build carries no measurement for.
+    ...rubricBehaviourFingerprint(parsedInput.rubricVersion) ? { rubricBehaviourFingerprint: rubricBehaviourFingerprint(parsedInput.rubricVersion) } : {},
     verdict: abstained ? "insufficient_source" : witanVerdictForScore(overallScore),
     codeTrustScore: abstained ? null : codeTrustScore,
     processTrustScore: abstained ? null : processTrustScore,
@@ -8409,7 +8691,8 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
     // alter it (see classifyRepoArchetype in repo-signals.ts); per-criterion scoring above is
     // unaffected by archetype, only presentation layers (badge/terminal/verdict) key off it.
     ...parsedInput.archetype ? { archetype: parsedInput.archetype } : {},
-    ...insufficientSourceReason ? { insufficientSourceReason } : {}
+    ...insufficientSourceReason ? { insufficientSourceReason } : {},
+    ...toolVersion ? { toolVersion } : {}
   });
 }
 function applySignalAdjustment(nativeScore, dimension, signals) {
@@ -8479,6 +8762,14 @@ function statusAfterInputAdjustment(nativeStatus, nativeScore, adjustment, rubri
   );
   return (severity[adjustedSemanticStatus] ?? nativeSeverity) > nativeSeverity ? adjustedSemanticStatus : nativeStatus;
 }
+var SELF_IMPOSED_ABSTENTION_REASONS = /* @__PURE__ */ new Set([
+  "too_large",
+  "excluded_by_extension",
+  "non_regular_file"
+]);
+function isSelfImposedAbstention(signal) {
+  return signal.insufficientDataReason !== void 0 && SELF_IMPOSED_ABSTENTION_REASONS.has(signal.insufficientDataReason);
+}
 function mergeSignalsByCriterion(signals) {
   const merged = /* @__PURE__ */ new Map();
   for (const signal of signals) {
@@ -8487,15 +8778,19 @@ function mergeSignalsByCriterion(signals) {
       merged.set(signal.criterionId, signal);
       continue;
     }
+    const existingAbstains = existing.insufficientData === true;
+    const signalAbstains = signal.insufficientData === true;
+    const abstentionReason = !existingAbstains && !signalAbstains ? void 0 : [existing, signal].filter((candidate) => candidate.insufficientData === true).some((candidate) => !isSelfImposedAbstention(candidate)) ? void 0 : signal.insufficientDataReason ?? existing.insufficientDataReason;
     merged.set(signal.criterionId, {
       criterionId: signal.criterionId,
       positiveEvidence: [...existing.positiveEvidence, ...signal.positiveEvidence],
       findings: [...existing.findings, ...signal.findings],
       metrics: [...existing.metrics ?? [], ...signal.metrics ?? []],
       notes: signal.notes ?? existing.notes,
-      // Read-failure abstention wins on merge: partial sibling evidence cannot turn an
-      // incomplete criterion into a score. Otherwise N/A retains its historical precedence.
-      ...existing.insufficientData === true || signal.insufficientData === true ? { insufficientData: true } : existing.notApplicable === true || signal.notApplicable === true ? { notApplicable: true } : {}
+      ...existingAbstains || signalAbstains ? {
+        insufficientData: true,
+        ...abstentionReason !== void 0 ? { insufficientDataReason: abstentionReason } : {}
+      } : existing.notApplicable === true || signal.notApplicable === true ? { notApplicable: true } : {}
     });
   }
   return merged;
@@ -8931,7 +9226,12 @@ function scoreRepoWithPublicCejel(options) {
     ...options.rubricVersion ? { rubricVersion: options.rubricVersion } : {}
   });
   const inputSignals = resolvePublicIngestSignals(options);
-  const report = createWitanReport(input, inputSignals.length > 0 ? inputSignals : void 0);
+  const report = createWitanReport(
+    input,
+    inputSignals.length > 0 ? inputSignals : void 0,
+    void 0,
+    options.toolVersion
+  );
   if (report.verdict !== "insufficient_source" || !isWitanNoMeasurementAbstention(report)) {
     return report;
   }
@@ -9189,7 +9489,8 @@ function runCejelScan(options) {
     // the repository. Direct public/leaderboard scans default this off because their targets
     // are third-party repositories and must opt in explicitly.
     autoDiscoverIngest: true,
-    warnOnEmptyIngestMatch: options.warnOnEmptyIngestMatch
+    warnOnEmptyIngestMatch: options.warnOnEmptyIngestMatch,
+    ...options.toolVersion ? { toolVersion: options.toolVersion } : {}
   });
   const summary = buildWitanCliSummary(report);
   return { report, summary, generatedAt };