@cejel/cejel 0.4.8 → 0.4.10

package/README.md

@@ -20,12 +20,8 @@ portable, offline trust certificate that aggregates them. Pipe in SARIF-compatib
 (MunaTrust, Snyk, Semgrep, CodeQL, Codex) plus OpenSSF Scorecard, and get one shareable
 certificate + badge over all of them. See "Aggregate your scanners" below.
 
-> Dogfooded in production. Cejel is run continuously on Barg Labs' own multi-product
-> monorepo — the ten-product studio it was built inside — which it currently scores
-> 3.3/4.0 on its rubric-native certificate. That transparency snapshot opts into prospective
-> v18; the public CLI default remains calibrated v17. On the comparative board, our code sits
-> outside the ranked population and receives no verdict band. We score ourselves before
-> asking you to score yourself.
+> Cejel is used on Barg Labs’ own code. The [public board](https://cejel.dev/leaderboard/)
+> labels publisher-owned snapshots separately from the ranked public repositories.
 
 ### Rubric calibration policy
 
@@ -40,7 +36,10 @@ untouched holdout, every preregistered gate to pass, and a separately recorded p
 
 ### Measured recall (bounded)
 
-> **Measured recall (bounded).** Cejel publishes no general detection-recall figure. On a frozen,
+> **Measured recall (bounded).** Cejel publishes one cohort-level in-scope detection-recall
+> figure, for the prospective v22 rubric, in `docs/calibration/v22-detection-recall/`; no general
+> figure exists, and the three quantities called recall are set side by side on
+> cejel.dev/methodology. On a frozen,
 > preregistered, in-scope held-out fixture set of 30 named defects, the released public default
 > (v17, tree `a857f0b3`) cited **16/30**, two-sided 95% Wilson interval **[36.1%, 69.8%]**; the
 > prospective v22 detector (commit `8a289ea`, tree `10960a03`) cited **24/30**, two-sided 95%
@@ -93,7 +92,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.4.8 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.4.10 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM and an
@@ -116,7 +115,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.4.8` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.4.10` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry.
 
 `npx` can reuse a stale cached package. Force the current npm release with the `@latest`
@@ -178,16 +177,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.4.8`:
+**Docker / OCI.** The current container release is `0.4.10`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.8
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.10
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.8 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.10 .
 ```
 
 The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
@@ -195,17 +194,15 @@ attestation.
 
 ## Leaderboard
 
-This repo ships the [Cejel OSS trust leaderboard](./leaderboard/leaderboard.md): elite OSS
-projects, the public Cejel repository itself, and one explicitly labeled transparency
-snapshot from the private studio monorepo where Cejel was built, with a per-repository
-evidence report for every row under [`leaderboard/reports/`](./leaderboard/reports/). The
-board is also hosted at [cejel.dev](https://cejel.dev). Every score is produced by the same
-sealed public scorer used by `npx @cejel/cejel@latest .`; no private domain collector contributes.
-For each public-repository row, check out the immutable source commit printed in its report
-and run the public scorer to reproduce the score, verdict, measured coverage, and evidence.
-The private Alfred snapshot discloses its limitation instead: its source commit and withheld
-locations are not publicly available, so that row is not independently reproducible and is
-not presented as a public-repository self-score.
+The [Cejel OSS trust leaderboard](https://cejel.dev/leaderboard/) is hosted on cejel.dev,
+which is the single current board. This repository no longer distributes a second copy of
+its scores or certificates. The board records its producing package version, rubric,
+run date, pinned public revisions, and reproduction instructions for that particular run.
+The private Alfred transparency snapshot is not independently reproducible.
+
+The site's History section preserves the **2026-08-18 withdrawal**: the earlier
+sealed-public-scorer reproducibility claim was false. The stale prospective-rubric copy
+previously linked here has been removed; it must not be treated as current evidence.
 
 ### Redaction policy
 
@@ -519,7 +516,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.8"]}'
+npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.10"]}'
 npx -y openclaw@latest mcp doctor cejel-oci --probe
 ```
 
@@ -546,6 +543,47 @@ part of the scoring guarantee. If the tracked-file inventory fails unexpectedly,
 HTML, and markdown certificates declare that the scanner used its bounded directory fallback
 instead of silently presenting the two inventories as equivalent.
 
+## What a certificate's scope means
+
+A certificate scores the repository tree at one pinned revision, and only that tree. That
+boundary is deliberate: a certificate that reached outside the pinned tree could not be
+reproduced by whoever receives it, and reproducibility is the entire product. Scoring only the
+pinned tree is correct — the gap was that nothing on the certificate itself told a reader which
+kind of statement they were holding. A repository whose regression suite lives in a separate
+repository, checked out and run by its own CI, is correctly reported as having zero test files
+against its source files. That statement is true about the tree and false about the system, and a
+reader with no other context cannot tell the difference.
+
+Every certificate now carries a standing scope line, in the "How to read this certificate"
+section on every surface (HTML, Markdown, terminal), regardless of verdict: the certificate is a
+statement about the repository tree at the pinned revision, not about the system that tree
+belongs to, and evidence outside that tree is neither seen nor claimed to be absent. This is
+additive, not a hedge — a finding that says evidence was not found in this tree stays exactly as
+stated.
+
+Four specific situations can make the tree's own conclusion misleading about the system it
+belongs to:
+
+- **A test suite kept in a separate repository.** Not detectable from inside the pinned tree —
+  there is no reliable signal that a sibling repository exists. Covered by the standing scope
+  line above, not a conditional disclosure.
+- **CI configuration that changes into a different working directory before running its checks.**
+  Also not detectable without executing the CI job itself, which the offline scanner does not do.
+  Covered by the standing scope line above.
+- **A large implementation file that exceeds the read limit.** This one is detectable, and
+  disclosed conditionally when it happens: when a file above the size ceiling is the reason a
+  specific signal has nothing to measure, the certificate's scan-limitations section names it —
+  "declined a large implementation file that exceeded the repository content size limit" — rather
+  than folding it into the generic coverage-limit sentence used for an extension exclusion or a
+  non-regular file. Today this fires for two A3 signals (health/readiness route detection and
+  observability-marker counting); it extends to more signals as they adopt the same per-signal
+  attribution.
+- **A recognized-but-nonfunctional package script**, such as npm's auto-generated
+  `"test": "echo \"Error: no test specified\" && exit 1"` placeholder being credited the same as a
+  real test runner. This was a detector defect, not a scope-disclosure gap — Cejel now checks the
+  `test` script's content against known test-runner invocations rather than crediting it by key
+  presence alone, so no separate disclosure line is needed for it.
+
 ## Help validate Cejel
 
 Cejel does not collect telemetry. External validation is therefore opt-in and inspectable:
@@ -680,7 +718,7 @@ published in public.
 
 **No rubric change re-scores you silently.** Every change to scoring behavior requires a
 `WITAN_RUBRIC_VERSION` bump and a corpus-wide before/after delta published in
-[`docs/leaderboard/RUBRIC_CHANGELOG.md`](../../docs/leaderboard/RUBRIC_CHANGELOG.md) — score,
+[`leaderboard/RUBRIC_CHANGELOG.md`](./leaderboard/RUBRIC_CHANGELOG.md) — score,
 verdict, and rank for every repository, "no repository moved" stated explicitly when that is
 the result. A build that changes scoring without both fails; see that file's `v2` entry for
 the home-field fix above as the first rubric change recorded this way.

package/dist/calibration/llm-detector.js

@@ -5,20 +5,20 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-6R3VJGJ2.js";
+} from "../chunk-TUUNJP27.js";
 import {
   listCejelLlmPackFiles
-} from "../chunk-ERNYMFH4.js";
-import "../chunk-KNQBI3IX.js";
+} from "../chunk-IN2LPGGU.js";
+import "../chunk-IHT7B6L7.js";
 import {
   external_exports
-} from "../chunk-J6R5OHN7.js";
+} from "../chunk-GKYTLWQK.js";
 import {
   init_esm_shims,
   readRepoText,
   recordContentSkip,
   recordFilesystemSkip
-} from "../chunk-V3B2V4WA.js";
+} from "../chunk-PTZU6G4E.js";
 
 // src/calibration/llm-detector.ts
 init_esm_shims();

package/dist/{chunk-J6R5OHN7.js → chunk-GKYTLWQK.js}

@@ -4,7 +4,7 @@ const require = __cejelCreateRequire(import.meta.url);
 import {
   __export,
   init_esm_shims
-} from "./chunk-V3B2V4WA.js";
+} from "./chunk-PTZU6G4E.js";
 
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};

package/dist/{chunk-KNQBI3IX.js → chunk-IHT7B6L7.js}

@@ -3,7 +3,7 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-V3B2V4WA.js";
+} from "./chunk-PTZU6G4E.js";
 
 // src/witan/git-exec.ts
 init_esm_shims();

package/dist/{chunk-ERNYMFH4.js → chunk-IN2LPGGU.js}

@@ -5,10 +5,10 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-KNQBI3IX.js";
+} from "./chunk-IHT7B6L7.js";
 import {
   init_esm_shims
-} from "./chunk-V3B2V4WA.js";
+} from "./chunk-PTZU6G4E.js";
 
 // src/packs/llm/files.ts
 init_esm_shims();

package/dist/{chunk-ZPQOZLB7.js → chunk-IQ42TE5H.js}

@@ -7,7 +7,7 @@ import {
   __filename,
   __require,
   init_esm_shims
-} from "./chunk-V3B2V4WA.js";
+} from "./chunk-PTZU6G4E.js";
 
 // node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/typescript.js
 var require_typescript = __commonJS({

package/dist/{chunk-V3B2V4WA.js → chunk-PTZU6G4E.js}

@@ -96,22 +96,24 @@ function errnoClass(error) {
   const code = error.code;
   return typeof code === "string" && /^E[A-Z0-9_]+$/.test(code) ? code : null;
 }
+function attributeSkip(session, criterion, signals, reason) {
+  session.affectedCriteria.add(criterion);
+  if (signals && signals.length > 0) {
+    for (const signal of signals) {
+      const key = contentReadSignalKey(criterion, signal);
+      session.affectedSignals.add(key);
+      addSkipReason(session.signalSkipReasons, key, reason);
+    }
+  } else {
+    session.unattributedCriteria.add(criterion);
+    addSkipReason(session.criterionSkipReasons, criterion, reason);
+  }
+}
 function recordSkip(path2, reason, errno, affectsCurrentCriterion = false, deduplicate = false) {
   const session = activeSession;
   if (!session) return;
   if (affectsCurrentCriterion && session.criterion) {
-    session.affectedCriteria.add(session.criterion);
-    const signals = session.signals;
-    if (signals && signals.length > 0) {
-      for (const signal of signals) {
-        const key = contentReadSignalKey(session.criterion, signal);
-        session.affectedSignals.add(key);
-        addSkipReason(session.signalSkipReasons, key, reason);
-      }
-    } else {
-      session.unattributedCriteria.add(session.criterion);
-      addSkipReason(session.criterionSkipReasons, session.criterion, reason);
-    }
+    attributeSkip(session, session.criterion, session.signals, reason);
   }
   if (deduplicate) {
     const key = `${resolve(path2)}\0${reason}\0${errno ?? ""}`;
@@ -168,7 +170,8 @@ function trackContentReads(_repoPath, collect) {
     affectedSignals: /* @__PURE__ */ new Set(),
     unattributedCriteria: /* @__PURE__ */ new Set(),
     criterionSkipReasons: /* @__PURE__ */ new Map(),
-    signalSkipReasons: /* @__PURE__ */ new Map()
+    signalSkipReasons: /* @__PURE__ */ new Map(),
+    withheldPaths: /* @__PURE__ */ new Map()
   };
   activeSession = session;
   try {
@@ -217,6 +220,22 @@ function withContentReadSignals(criterionId, signalIds, collect) {
 function recordContentSkip(path2, reason, deduplicate = false) {
   recordSkip(path2, reason, void 0, false, deduplicate);
 }
+function registerWithheldRepoPath(relativePath, reason) {
+  const session = activeSession;
+  if (!session) return;
+  addSkipReason(session.withheldPaths, relativePath, reason);
+}
+function abstainSignalOnWithheldPaths(criterionId, signalId, wouldHaveRead) {
+  const session = activeSession;
+  if (!session) return false;
+  let abstained = false;
+  for (const [path2, reasons] of session.withheldPaths) {
+    if (!wouldHaveRead(path2)) continue;
+    abstained = true;
+    for (const reason of reasons) attributeSkip(session, criterionId, [signalId], reason);
+  }
+  return abstained;
+}
 function recordFilesystemSkip(path2, error, deniedContext = false, deduplicate = true) {
   const errno = errnoClass(error);
   if (!errno) throw error;
@@ -295,6 +314,8 @@ export {
   withContentReadSignal,
   withContentReadSignals,
   recordContentSkip,
+  registerWithheldRepoPath,
+  abstainSignalOnWithheldPaths,
   recordFilesystemSkip,
   readRepoText,
   readRepoTextPrefix

package/dist/{chunk-6R3VJGJ2.js → chunk-TUUNJP27.js}

@@ -5,12 +5,13 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-KNQBI3IX.js";
+} from "./chunk-IHT7B6L7.js";
 import {
   external_exports
-} from "./chunk-J6R5OHN7.js";
+} from "./chunk-GKYTLWQK.js";
 import {
   MAX_REPOSITORY_CONTENT_BYTES,
+  abstainSignalOnWithheldPaths,
   classifyAbstentionReason,
   contentReadSignalKey,
   init_esm_shims,
@@ -18,11 +19,12 @@ import {
   readRepoTextPrefix,
   recordContentSkip,
   recordFilesystemSkip,
+  registerWithheldRepoPath,
   trackContentReads,
   withContentReadCriterion,
   withContentReadSignal,
   withContentReadSignals
-} from "./chunk-V3B2V4WA.js";
+} from "./chunk-PTZU6G4E.js";
 
 // src/witan/schemas.ts
 init_esm_shims();
@@ -313,6 +315,16 @@ var WitanReportCommonSchema = external_exports.object({
   productDisplayName: external_exports.string().min(1).max(120),
   repo: WitanRepoRefSchema,
   rubricVersion: external_exports.string().min(1).max(120),
+  // The BEHAVIOURAL identity of the rubric named above, beside its NAME. `rubricVersion` is an
+  // identifier the tool's author controls and can leave unchanged across a scoring change (this
+  // happened under witan-rubric-v17-2026-07-24 in 0.4.9 — see leaderboard/RUBRIC_CHANGELOG.md).
+  // This field is the sha256 of the scoring-relevant output of a fixed committed fixture corpus
+  // under that rubric, so two certificates naming the same rubric can be checked for behavioural
+  // agreement rather than assumed into it. See src/witan/rubric-fingerprint.ts for exactly what
+  // the digest covers, what it excludes, and what it does not claim. Optional and absent —
+  // never fabricated — for any rubric this build has no measurement for, and absent on every
+  // report emitted before report format 1.2; those artifacts' attestations remain valid.
+  rubricBehaviourFingerprint: external_exports.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
   // Rubric-driven: length matches whatever rubric produced this report, not a fixed enum.
   criteria: external_exports.array(WitanCriterionScoreSchema).min(1),
   consumedSignals: external_exports.array(WitanConsumedSignalSummarySchema).optional(),
@@ -366,7 +378,7 @@ var WitanReportSchema = external_exports.preprocess((value) => {
 }, StrictWitanReportSchema);
 var WITAN_ATTESTATION_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
 var WITAN_ATTESTATION_PREDICATE_TYPE = "https://cejel.dev/attestations/scan/v1";
-var WITAN_REPORT_FORMAT_VERSION = "1.1";
+var WITAN_REPORT_FORMAT_VERSION = "1.2";
 var WitanAttestationOutcomeSchema = external_exports.discriminatedUnion("status", [
   external_exports.object({
     status: external_exports.literal("scored"),
@@ -584,6 +596,7 @@ init_esm_shims();
 // src/witan/certificate-presentation.ts
 init_esm_shims();
 var CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE = "Product name and slug are caller context and are excluded from certificate byte-comparison claims.";
+var CERTIFICATE_SCOPE_NOTICE = "This certificate is a statement about the repository tree at the revision pinned above, not about the system that tree is part of. Evidence outside that tree \u2014 for example, a test suite kept in a separate repository, or CI configuration that changes into a different working directory before running its checks \u2014 is neither seen by this scan nor claimed to be absent.";
 var CERTIFICATE_METRIC_REGISTRY = {
   test_to_source_ratio: { displayLabel: "Test-to-source file ratio" },
   coverage_percent: { displayLabel: "Static coverage percentage" },
@@ -1097,6 +1110,7 @@ function buildRelyingPartySummary(report) {
     "Anything absent from the measured evidence was not established: no measurement and no finding are not clearance."
   );
   return {
+    scope: CERTIFICATE_SCOPE_NOTICE,
     examined: `Cejel examined the repository evidence recorded for ${report.productDisplayName}${revision} under ${report.rubricVersion}.`,
     established: `The report established measured results for ${measured.length} of ${applicable.length} applicable rubric dimensions and recorded ${findings} evidence-backed finding${findings === 1 ? "" : "s"}.`,
     notEstablished: gaps.join(" "),
@@ -1309,6 +1323,7 @@ function renderRelyingPartySummary(summary) {
   return `<section class="relying-party-summary" aria-labelledby="relying-party-heading">
       <h2 id="relying-party-heading">How to read this certificate</h2>
       <dl>
+        <div><dt>Scope</dt><dd>${escapeHtml(summary.scope)}</dd></div>
         <div><dt>What was examined</dt><dd>${escapeHtml(summary.examined)}</dd></div>
         <div><dt>What was established</dt><dd>${escapeHtml(summary.established)}</dd></div>
         <div><dt>What was not established</dt><dd>${escapeHtml(summary.notEstablished)}</dd></div>
@@ -2093,13 +2108,14 @@ function buildWitanInputFromRepo(options) {
   const wholesaleAbstainedReadFailureCriteria = [];
   const wholesaleAbstainedCoverageLimitedCriteria = [];
   const partiallyAbstainedReadFailureSignals = [];
-  const partiallyAbstainedCoverageLimitedSignals = [];
+  const partiallyAbstainedLargeFileSignals = [];
+  const partiallyAbstainedOtherCoverageLimitedSignals = [];
   const signals = (tracked.value.signals ?? []).map((signal) => {
     if (!affectedCriteria.has(signal.criterionId)) return signal;
     if (tracked.unattributedCriteria.has(signal.criterionId)) {
       const reasons = tracked.criterionSkipReasons.get(signal.criterionId);
-      const { insufficientDataReason: insufficientDataReason2 } = classifyAbstentionReason(reasons);
-      (insufficientDataReason2 !== void 0 ? wholesaleAbstainedCoverageLimitedCriteria : wholesaleAbstainedReadFailureCriteria).push(signal.criterionId);
+      const { insufficientDataReason } = classifyAbstentionReason(reasons);
+      (insufficientDataReason !== void 0 ? wholesaleAbstainedCoverageLimitedCriteria : wholesaleAbstainedReadFailureCriteria).push(signal.criterionId);
       return wholesaleCriterionAbstention(signal, reasons);
     }
     const prefix = contentReadSignalKey(signal.criterionId, "");
@@ -2118,40 +2134,63 @@ function buildWitanInputFromRepo(options) {
       }
     }
     if (!anythingSurvives) {
-      const { insufficientDataReason: insufficientDataReason2 } = classifyAbstentionReason(droppedReasons);
-      (insufficientDataReason2 !== void 0 ? wholesaleAbstainedCoverageLimitedCriteria : wholesaleAbstainedReadFailureCriteria).push(signal.criterionId);
+      const { insufficientDataReason } = classifyAbstentionReason(droppedReasons);
+      (insufficientDataReason !== void 0 ? wholesaleAbstainedCoverageLimitedCriteria : wholesaleAbstainedReadFailureCriteria).push(signal.criterionId);
       return wholesaleCriterionAbstention(signal, droppedReasons);
     }
-    const { insufficientDataReason } = classifyAbstentionReason(droppedReasons);
-    const isReadFailure = insufficientDataReason === void 0;
+    const nameBuckets = /* @__PURE__ */ new Map();
     for (const name of affectedNames) {
-      (isReadFailure ? partiallyAbstainedReadFailureSignals : partiallyAbstainedCoverageLimitedSignals).push(`${signal.criterionId}.${name}`);
-    }
+      const nameReasons = skipReasonsForSignal(signal.criterionId, name, tracked);
+      const { insufficientDataReason: nameReason } = classifyAbstentionReason(nameReasons);
+      const bucket = nameReason === void 0 ? "read-failure" : nameReason === "too_large" ? "too-large" : "other-coverage";
+      nameBuckets.set(name, bucket);
+      (bucket === "read-failure" ? partiallyAbstainedReadFailureSignals : bucket === "too-large" ? partiallyAbstainedLargeFileSignals : partiallyAbstainedOtherCoverageLimitedSignals).push(`${signal.criterionId}.${name}`);
+    }
+    const distinctBuckets = new Set(nameBuckets.values());
+    const uniformBucket = distinctBuckets.size === 1 ? [...distinctBuckets][0] : void 0;
+    const affectedList = [...affectedNames].sort().join(", ");
+    const notes = uniformBucket === "read-failure" ? `Cejel abstained on ${affectedList} in this criterion because that content could not be read; other signals in this criterion were computed from readable files and are unaffected.` : uniformBucket === "too-large" ? `Cejel declined ${affectedList} in this criterion under the repository content size limit; other signals in this criterion were computed from readable files and are unaffected. This is a disclosed coverage limit, not a read failure.` : uniformBucket === "other-coverage" ? `Cejel declined ${affectedList} in this criterion under an extension exclusion or a non-regular-file skip; other signals in this criterion were computed from readable files and are unaffected. This is a disclosed coverage limit, not a read failure.` : `Cejel abstained on ${affectedList} in this criterion for a mix of reasons \u2014 some content could not be read, some was declined under the repository content size limit or an extension exclusion; other signals in this criterion were computed from readable files and are unaffected.`;
     return {
       ...signal,
       metrics,
-      notes: isReadFailure ? `Cejel abstained on ${[...affectedNames].sort().join(", ")} in this criterion because that content could not be read; other signals in this criterion were computed from readable files and are unaffected.` : `Cejel declined ${[...affectedNames].sort().join(", ")} in this criterion under the repository content size limit or an extension exclusion; other signals in this criterion were computed from readable files and are unaffected. This is a disclosed coverage limit, not a read failure.`
+      notes
     };
   });
   const scanLimitations = [...tracked.value.scanLimitations ?? []];
-  if (wholesaleAbstainedReadFailureCriteria.length > 0 && scanLimitations.length < 16) {
-    scanLimitations.push(
+  const candidateScanLimitations = [];
+  if (wholesaleAbstainedReadFailureCriteria.length > 0) {
+    candidateScanLimitations.push(
       `${wholesaleAbstainedReadFailureCriteria.length} ${wholesaleAbstainedReadFailureCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read and the affected signal could not be isolated. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
     );
   }
-  if (wholesaleAbstainedCoverageLimitedCriteria.length > 0 && scanLimitations.length < 16) {
-    scanLimitations.push(
+  if (wholesaleAbstainedCoverageLimitedCriteria.length > 0) {
+    candidateScanLimitations.push(
       `${wholesaleAbstainedCoverageLimitedCriteria.length} ${wholesaleAbstainedCoverageLimitedCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content was declined under the repository content size limit or excluded from scanning by policy, and the affected signal could not be isolated. This is a disclosed coverage limit, not a read failure, and does not affect the composite score.`
     );
   }
-  if (partiallyAbstainedReadFailureSignals.length > 0 && scanLimitations.length < 16) {
-    scanLimitations.push(
+  if (partiallyAbstainedReadFailureSignals.length > 0) {
+    candidateScanLimitations.push(
       `${partiallyAbstainedReadFailureSignals.length} ${partiallyAbstainedReadFailureSignals.length === 1 ? "signal" : "signals"} abstained because its own repository content could not be read, while other signals in the same criterion were unaffected: ${[...partiallyAbstainedReadFailureSignals].sort().join(", ")}.`
     );
   }
-  if (partiallyAbstainedCoverageLimitedSignals.length > 0 && scanLimitations.length < 16) {
+  if (partiallyAbstainedLargeFileSignals.length > 0) {
+    candidateScanLimitations.push(
+      `${partiallyAbstainedLargeFileSignals.length} ${partiallyAbstainedLargeFileSignals.length === 1 ? "signal" : "signals"} declined a large implementation file that exceeded the repository content size limit, while other signals in the same criterion were unaffected: ${[...partiallyAbstainedLargeFileSignals].sort().join(", ")}. That file is undercounted, not scored as clean or absent \u2014 this is a disclosed coverage limit, not a read failure.`
+    );
+  }
+  if (partiallyAbstainedOtherCoverageLimitedSignals.length > 0) {
+    candidateScanLimitations.push(
+      `${partiallyAbstainedOtherCoverageLimitedSignals.length} ${partiallyAbstainedOtherCoverageLimitedSignals.length === 1 ? "signal" : "signals"} declined under an extension exclusion or a non-regular-file skip, while other signals in the same criterion were unaffected: ${[...partiallyAbstainedOtherCoverageLimitedSignals].sort().join(", ")}. This is a disclosed coverage limit, not a read failure.`
+    );
+  }
+  const availableSlots = Math.max(0, 16 - scanLimitations.length);
+  if (candidateScanLimitations.length <= availableSlots) {
+    scanLimitations.push(...candidateScanLimitations);
+  } else if (availableSlots > 0) {
+    const keep = availableSlots - 1;
+    scanLimitations.push(...candidateScanLimitations.slice(0, keep));
     scanLimitations.push(
-      `${partiallyAbstainedCoverageLimitedSignals.length} ${partiallyAbstainedCoverageLimitedSignals.length === 1 ? "signal" : "signals"} declined under the repository content size limit or an extension exclusion, while other signals in the same criterion were unaffected: ${[...partiallyAbstainedCoverageLimitedSignals].sort().join(", ")}. This is a disclosed coverage limit, not a read failure.`
+      `${candidateScanLimitations.length - keep} additional disclosed scan limitation(s) omitted at the 16-entry cap \u2014 see contentReadSummary for full counts.`
     );
   }
   return {
@@ -2182,6 +2221,7 @@ function buildWitanInputFromRepoUntracked(options) {
   const usesV22PackageStartEntrypoint = rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const usesV23CommandCoverage = rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const usesV23PemPrivateKeyGrammar = rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV23WithheldPathAbstention = rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const structuralArchetype = classifyRepoArchetype(inventoryFiles, rubricVersion);
   const readableArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion) ? applyReadableSourceRepresentationGate(
     options.repoPath,
@@ -2219,6 +2259,7 @@ function buildWitanInputFromRepoUntracked(options) {
     usesV22PackageStartEntrypoint,
     usesV23CommandCoverage,
     usesV23PemPrivateKeyGrammar,
+    usesV23WithheldPathAbstention,
     reviewableSourceProof,
     inventoryAbsenceContext,
     scanLimitations
@@ -2830,7 +2871,7 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, useV23CommandCoverage, useV23PemPrivateKeyGrammar, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, useV23CommandCoverage, useV23PemPrivateKeyGrammar, useV23WithheldPathAbstention, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
   const signals = [];
   const mono = resolveMonorepoContext(repoPath, scanLimitations);
   const collectCriterion = (criterionId, collect) => withContentReadCriterion(criterionId, collect);
@@ -2871,6 +2912,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV27Detectors,
       useV20A3ExplicitGaps,
       useV22PackageStartEntrypoint,
+      useV23WithheldPathAbstention,
       inventoryAbsenceContext
     )
   );
@@ -2891,6 +2933,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       repoPath,
       repoFiles,
       useV27Detectors,
+      useV23WithheldPathAbstention,
       inventoryAbsenceContext
     )
   );
@@ -2993,12 +3036,16 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
   const ciHasTypecheckCommand = ciWorkflows.some(
     (file) => fileContains(repoPath, file, CI_TYPECHECK_COMMAND_PATTERN)
   );
-  const verificationScriptCount = [
-    packageScripts.has("test") || Boolean(ciTestWorkflow),
-    coverageAnalysis.hasCoverageCommand,
-    packageScripts.has("lint") || ciHasLintCommand,
-    packageScripts.has("typecheck") || ciHasTypecheckCommand
-  ].filter(Boolean).length;
+  const verificationScriptComponents = [
+    { label: "test command", count: hasCredibleTestScript(packageScripts) || Boolean(ciTestWorkflow) ? 1 : 0 },
+    { label: "coverage command", count: coverageAnalysis.hasCoverageCommand ? 1 : 0 },
+    { label: "lint command", count: packageScripts.has("lint") || ciHasLintCommand ? 1 : 0 },
+    {
+      label: "type-check command",
+      count: packageScripts.has("typecheck") || ciHasTypecheckCommand ? 1 : 0
+    }
+  ];
+  const verificationScriptCount = verificationScriptComponents.filter((c) => c.count > 0).length;
   const usesLeanBuiltInTestRunner = packageJson != null && [...packageScripts.values()].some(
     (script) => LEAN_TEST_RUNNER_SCRIPT_PATTERN.test(script)
   ) || testFiles.some((file) => fileContains(repoPath, file, LEAN_TEST_RUNNER_IMPORT_PATTERN));
@@ -3062,7 +3109,9 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
       repoPath,
       reviewableSourceProof,
       repoFiles.length,
-      inventoryAbsenceContext
+      inventoryAbsenceContext,
+      verificationScriptComponents,
+      runnerFiles.length
     ) : null;
   }
   if (testFiles.length === 0) {
@@ -3162,19 +3211,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
         "saturating_count",
         {
           components: [
-            {
-              label: "test command",
-              count: packageScripts.has("test") || Boolean(ciTestWorkflow) ? 1 : 0
-            },
-            { label: "coverage command", count: coverageAnalysis.hasCoverageCommand ? 1 : 0 },
-            {
-              label: "lint command",
-              count: packageScripts.has("lint") || ciHasLintCommand ? 1 : 0
-            },
-            {
-              label: "type-check command",
-              count: packageScripts.has("typecheck") || ciHasTypecheckCommand ? 1 : 0
-            },
+            ...verificationScriptComponents,
             { label: "test-runner configuration", count: runnerFiles.length }
           ]
         }
@@ -3192,7 +3229,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
     notes: coverageFiles.length === 0 && coverageAnalysis.unresolvedFiles.length > 0 ? `A1 is detected from real test files, test runner configuration, and optional coverage configuration. Coverage command reachability or flag ownership was unresolved in ${coverageAnalysis.unresolvedFiles.slice(0, 4).join(", ")}; the no-coverage absence claim was withheld.` : "A1 is detected from real test files, test runner configuration, and optional coverage configuration."
   };
 }
-function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inventoryAbsenceContext) {
+function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inventoryAbsenceContext, verificationScriptComponents, runnerFileCount) {
   const sourcePath = proof.firstReadablePath;
   if (!sourcePath) {
     throw new Error("Cejel invariant: a passing reviewable-source proof must have a readable path");
@@ -3244,7 +3281,12 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inve
       metric(
         "verification_script_ratio",
         "Verification script ratio",
-        0,
+        // Zero test FILES does not mean zero verification signal: a lint/typecheck/coverage
+        // script or CI command is a real, independently-observable fact from package.json/CI
+        // content and must be credited here the same way B3 credits it, or A1 flatly
+        // contradicts B3 on the same repository fact (goal_cejel_detector_false_assertions_
+        // 0_4_9_2026-09-14 finding 3).
+        verificationScriptComponents.filter((c) => c.count > 0).length + runnerFileCount,
         4,
         0.25,
         "ratio",
@@ -3252,11 +3294,8 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inve
         "saturating_count",
         {
           components: [
-            { label: "test command", count: 0 },
-            { label: "coverage command", count: 0 },
-            { label: "lint command", count: 0 },
-            { label: "type-check command", count: 0 },
-            { label: "test-runner configuration", count: 0 }
+            ...verificationScriptComponents,
+            { label: "test-runner configuration", count: runnerFileCount }
           ]
         }
       ),
@@ -3270,7 +3309,7 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inve
         "No concrete test files were present to establish non-hollow test behavior."
       )
     ],
-    notes: `V17 authenticated absence: ${proof.eligibleSourceFileCount} criterion-ratable of ${proof.sourceShapedFileCount} source-shaped files; sampled ${proof.sampledFileCount}; ${proof.readableSampledFileCount} representative-text files.`
+    notes: `V17 authenticated absence: ${proof.eligibleSourceFileCount} criterion-ratable of ${proof.sourceShapedFileCount} source-shaped files; sampled ${proof.sampledFileCount}; ${proof.readableSampledFileCount} representative-text files. Verification-script signals (lint/typecheck/coverage/CI commands) are independent of test-file presence and are still credited above where detected.`
   };
 }
 function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV23PemPrivateKeyGrammar, useV18NativeRls, inventoryAbsenceContext, scanLimitations) {
@@ -3730,7 +3769,7 @@ function collectCryptoHygieneEvidence(repoPath, implFiles, useV39Detectors = fal
   }
   return { evidence, findings, hasSurface, clean: hasSurface && !insecureFound };
 }
-function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, useV20ExplicitGaps = false, useV22PackageStartEntrypoint = false, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
+function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, useV20ExplicitGaps = false, useV22PackageStartEntrypoint = false, useV23WithheldPathAbstention = false, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const v20DirectHttpEntrypoint = useV20ExplicitGaps ? findV20DirectHttpServerEntrypointFile(repoPath, repoFiles) : null;
   const v22PackageStartHttpEntrypoint = useV22PackageStartEntrypoint ? findV22PackageStartHttpServerEntrypointFile(repoPath, repoFiles) : null;
   const v20RuntimeContainer = useV20ExplicitGaps ? findRuntimeContainerEntrypointFile(repoPath, repoFiles, true) : null;
@@ -3768,9 +3807,11 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
     )
   );
   const healthCheck = healthChecks[0];
+  const healthReadinessRouteReads = (file) => isAuthoredProductionPath(file) && isImplementationFile(file);
+  const observabilityDepthReads = (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isImplementationFile(file);
   const { hasV20HealthOrReadinessRoute, hasV22PackageStartHealthOrReadinessRoute } = withContentReadSignal("A3", "health_readiness_route", () => ({
     hasV20HealthOrReadinessRoute: useV20ExplicitGaps && repoFiles.some(
-      (file) => isAuthoredProductionPath(file) && isImplementationFile(file) && fileContains(repoPath, file, V20_HEALTH_OR_READINESS_ROUTE_PATTERN)
+      (file) => healthReadinessRouteReads(file) && fileContains(repoPath, file, V20_HEALTH_OR_READINESS_ROUTE_PATTERN)
     ),
     hasV22PackageStartHealthOrReadinessRoute: v22PackageStartHttpEntrypoint !== null && fileContains(
       repoPath,
@@ -3778,23 +3819,34 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
       V20_HEALTH_OR_READINESS_ROUTE_PATTERN
     )
   }));
+  const healthReadinessRouteWithheld = useV23WithheldPathAbstention && useV20ExplicitGaps && abstainSignalOnWithheldPaths("A3", "health_readiness_route", healthReadinessRouteReads);
   const serverEntrypoint = v22PackageStartHttpEntrypoint ?? findServerEntrypointFile(repoPath, repoFiles, useV27Detectors) ?? v20DirectHttpEntrypoint ?? null;
   const runtimeContainer = useV27Detectors ? findRuntimeContainerEntrypointFile(repoPath, repoFiles, useV20ExplicitGaps) : null;
   const errorBoundaries = repoFiles.filter(
     (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && /error-boundary|error\.(tsx|jsx|ts|js)$/.test(file)
   );
-  const errorBoundary = errorBoundaries[0];
+  const expressErrorMiddlewareFile = errorBoundaries.length > 0 ? void 0 : withContentReadSignal(
+    "A3",
+    "prod_readiness_primitives",
+    () => repoFiles.find(
+      (file) => observabilityDepthReads(file) && fileContains(repoPath, file, EXPRESS_ERROR_MIDDLEWARE_PATTERN) && fileContains(repoPath, file, EXPRESS_MIDDLEWARE_REACHABLE_PATTERN)
+    )
+  );
+  const errorBoundary = errorBoundaries[0] ?? expressErrorMiddlewareFile;
+  if (useV23WithheldPathAbstention && errorBoundaries.length === 0) {
+    abstainSignalOnWithheldPaths("A3", "prod_readiness_primitives", observabilityDepthReads);
+  }
   const observabilityCount = withContentReadSignal(
     "A3",
     "observability_depth",
-    () => countFilesContaining(
-      repoPath,
-      repoFiles.filter(
-        (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isImplementationFile(file)
-      ),
-      /sentry|otel|opentelemetry|datadog|prometheus|metrics|logger|logtail/i
-    )
+    () => countFilesMatchingAny(repoPath, repoFiles.filter(observabilityDepthReads), [
+      /sentry|otel|opentelemetry|datadog|prometheus|metrics|logger|logtail|\b(?:correlation|request|trace)[-_]?id\b|\basynclocalstorage\b/i,
+      /\b(?:pino|winston|bunyan|morgan)\b/
+    ])
   );
+  if (useV23WithheldPathAbstention) {
+    abstainSignalOnWithheldPaths("A3", "observability_depth", observabilityDepthReads);
+  }
   const rollbackSafetyCount = withContentReadSignal(
     "A3",
     "rollback_safety_depth",
@@ -3841,8 +3893,17 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
       )
     );
   }
-  if (errorBoundary)
-    evidence.push(evidenceForRelative(repoPath, errorBoundary, "prod_check", "Error boundary"));
+  if (errorBoundary) {
+    evidence.push(
+      errorBoundary === expressErrorMiddlewareFile ? evidenceForRelativeAtLine(
+        repoPath,
+        errorBoundary,
+        "prod_check",
+        "Error boundary",
+        findFirstMatchingLine(repoPath, errorBoundary, EXPRESS_ERROR_MIDDLEWARE_PATTERN)
+      ) : evidenceForRelative(repoPath, errorBoundary, "prod_check", "Error boundary")
+    );
+  }
   if (evidence.length === 0) {
     if (serverEntrypoint) {
       evidence.push(
@@ -3896,7 +3957,12 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
           )
         });
       }
-    } else if (serverEntrypoint && withContentReadSignal(
+    } else if (serverEntrypoint && // An absence finding is an assertion that Cejel looked and found nothing. When a file this
+    // signal would have read was withheld, Cejel did not look at everything it selected, so the
+    // honest output is the recorded abstention above and no finding — never "declares no health
+    // or readiness route". This is the whole defect: insufficient_data must not be emitted as a
+    // finding of absence.
+    !healthReadinessRouteWithheld && withContentReadSignal(
       "A3",
       "health_readiness_route",
       () => fileContains(
@@ -3950,7 +4016,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
           deployConfigs.length > 0,
           envTemplate,
           healthChecks.length > 0,
-          errorBoundaries.length > 0
+          errorBoundary !== void 0
         ].filter(Boolean).length,
         6,
         0.55,
@@ -3967,7 +4033,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
             { label: "deployment configuration", count: deployConfigs.length > 0 ? 1 : 0 },
             { label: "environment template", count: envTemplate ? 1 : 0 },
             { label: "health or readiness signal", count: healthChecks.length > 0 ? 1 : 0 },
-            { label: "error boundary", count: errorBoundaries.length > 0 ? 1 : 0 }
+            { label: "error boundary", count: errorBoundary !== void 0 ? 1 : 0 }
           ]
         }
       ),
@@ -4211,7 +4277,26 @@ function hasDeclaredVersionConstraint(dependency) {
   if (/[~^<>=!]/.test(trimmed)) return true;
   return /^v?\d/.test(trimmed);
 }
-function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
+function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, useV23WithheldPathAbstention, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
+  const claimImplementationReads = claimImplementationFileReads(useV27Detectors);
+  if (useV23WithheldPathAbstention) {
+    abstainSignalOnWithheldPaths(
+      "A5",
+      "claim_match_rate",
+      (file) => claimImplementationReads(file) || isClaimSourceFile(file)
+    );
+    abstainSignalOnWithheldPaths("A5", "claim_source_depth", isClaimSourceFile);
+    abstainSignalOnWithheldPaths(
+      "A5",
+      "reconciliation_artifact_depth",
+      isClaimRealityReconciliationPath
+    );
+    abstainSignalOnWithheldPaths(
+      "A5",
+      "negative_space_documentation",
+      isNegativeSpaceDocCandidate
+    );
+  }
   const reconciliationArtifacts = useV27Detectors ? findClaimRealityReconciliationArtifacts(repoPath, repoFiles) : [];
   const claimSourceFiles = useV27Detectors ? findClaimSourceFiles(repoFiles) : repoFiles.filter(
     (file) => /^(?:README|readme)\.md$/.test(file) || /^docs\/[^/]+\.(?:md|mdx)$/.test(file)
@@ -4257,7 +4342,7 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, inv
   const negativeSpaceCandidates = /* @__PURE__ */ new Set([
     claimDoc,
     ...allDocFiles,
-    ...repoFiles.filter((file) => /(^|\/)(SECURITY|THREAT[_-]?MODEL)\.md$/i.test(file))
+    ...repoFiles.filter(isSecurityOrThreatModelDoc)
   ]);
   const negativeSpaceDoc = withContentReadSignal(
     "A5",
@@ -4345,7 +4430,7 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, inv
 function collectB2PrTraceEvidence(repoPath, repoFiles) {
   const workflows = repoFiles.filter(isCiWorkflow);
   const prTemplate = repoFiles.find(
-    (file) => /(^|\/)(pull_request_template|PULL_REQUEST_TEMPLATE)\.md$/.test(file)
+    (file) => /(^|\/)(pull_request_template|PULL_REQUEST_TEMPLATE)(\.md$|\/[^/]+\.md$)/.test(file)
   );
   const branchProtectionDoc = repoFiles.find(
     (file) => /branch.*protection|review.*gate|CODEOWNERS/i.test(file)
@@ -4448,7 +4533,9 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
     CI_TYPECHECK_COMMAND_PATTERN,
     CI_BUILD_COMMAND_PATTERN
   ];
-  const scriptDepth = ["test", "lint", "typecheck", "build"].filter((s) => scripts.has(s)).length;
+  const scriptDepth = ["test", "lint", "typecheck", "build"].filter(
+    (s) => s === "test" ? hasCredibleTestScript(scripts) : scripts.has(s)
+  ).length;
   const { repoCategoryHits, rootCategoryHits } = withContentReadSignal(
     "B3",
     "ci_script_depth",
@@ -4481,7 +4568,7 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
           components: [
             ...["test", "lint", "typecheck", "build"].map((name) => ({
               label: `package script: ${name === "typecheck" ? "type-check" : name}`,
-              count: scripts.has(name) ? 1 : 0
+              count: (name === "test" ? hasCredibleTestScript(scripts) : scripts.has(name)) ? 1 : 0
             })),
             ...CI_COMMAND_CATEGORIES.map((_pattern, index) => ({
               label: `repository CI command: ${["test", "lint", "type-check", "build"][index]}`,
@@ -4840,6 +4927,10 @@ function isTestFile(file, rubricVersion = WITAN_RUBRIC_VERSION) {
 var NAME_SHAPED_TEST_FILE_PATTERN = /^test(?:-[^/]+)?\.[cm]?[jt]sx?$|\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)__tests__\/|(^|\/)test_[^/]*\.py$|(^|\/)tests?\.py$|_test\.go$|(^|\/)test_[^/]*\.(cpp|cc|cxx)$|_(test|tests)\.(cpp|cc|cxx)$|Tests?\.(java|kt)$|(_test|_spec)\.(rs|rb|php|swift|kt)$/;
 var NAME_SHAPED_TEST_FILE_PATTERN_V17 = /\.tftest\.hcl$|\.bats$|(^|\/)test[^/]*\.m$|_test\.m$/i;
 var TEST_RUNNER_PATTERN = /\b(vitest|jest|mocha|ava|tap|pytest|go test|cargo test|rspec|phpunit|gradle test|mvn test|node\s+--test|node:test)\b/i;
+function hasCredibleTestScript(scripts) {
+  const script = scripts.get("test");
+  return script != null && TEST_RUNNER_PATTERN.test(script);
+}
 var CI_TEST_COMMAND_PATTERN = /\b(pytest|go\s+test|cargo\s+test|mvn\s+test|gradle\s+test|dotnet\s+test|ctest|make\s+test|jest|vitest|mocha|rspec|phpunit|pnpm\s+(?:run\s+)?test|npm\s+(?:run\s+)?test|yarn\s+(?:run\s+)?test|node\s+--test|node:test)\b|--target[=\s]+test\b/i;
 var CI_LINT_COMMAND_PATTERN = /\b(eslint|pylint|flake8|black|ruff)\b/i;
 var CI_TYPECHECK_COMMAND_PATTERN = /\b(tsc|mypy|pyright)\b/i;
@@ -5013,8 +5104,8 @@ function looksLikeSecretValue(value) {
   return SECRET_VALUE_BRANDED_PATTERN.test(value) || isGenericSecretValue(value);
 }
 var PLACEHOLDER_SECRET_PATTERN = /(?:^|[-_])(?:your|example|sample|placeholder|dummy|changeme|replace(?:-?me)?|redacted)(?:$|[-_])|^x{3,}$|^\.\.\.|^\$\{[^}]+}$|^<[^>]+>$/i;
-var ENV_TEMPLATE_PATTERN = /(^|\/)\.env(?:\.[^/]+)*\.(?:example|sample|template|dist)$/i;
-var ENV_TEMPLATE_PATTERN_V47 = /(^|\/)\.env(?:\.[^/]+)*\.(?:example|sample|template|dist|exemplo|ejemplo|exemple|esempio|beispiel|voorbeeld)$/i;
+var ENV_TEMPLATE_PATTERN = /(^|\/)\.env(?:\.[^/]+)?\.(?:example|sample|template|dist)$/i;
+var ENV_TEMPLATE_PATTERN_V47 = /(^|\/)\.env(?:\.[^/]+)?\.(?:example|sample|template|dist|exemplo|ejemplo|exemple|esempio|beispiel|voorbeeld)$/i;
 function isEnvTemplatePath(path, useV47Detectors = false) {
   return (useV47Detectors ? ENV_TEMPLATE_PATTERN_V47 : ENV_TEMPLATE_PATTERN).test(path);
 }
@@ -5031,27 +5122,34 @@ function readGitTrackedFileOutput(repoPath) {
   if (workTree.stdout.trim() !== "true") return { ok: false, reason: "not_a_repo" };
   return execGit(["ls-files", "--cached"], { cwd: repoPath });
 }
-function parseGitTrackedFiles(repoPath, output, includeHardExcluded) {
+function parseGitTrackedFiles(repoPath, output, includeHardExcluded, registerWithheld = false) {
   const files = [];
+  const withhold = (file, reason) => {
+    if (registerWithheld) registerWithheldRepoPath(file, reason);
+  };
   for (const file of output.trim().split("\n")) {
     if (file.length === 0) continue;
     const fullPath = join(repoPath, file);
     if (!includeHardExcluded && isHardExcludedPath(file)) {
       recordContentSkip(fullPath, "denied_path", true);
+      withhold(file, "denied_path");
       continue;
     }
     try {
       const stat = lstatSync(fullPath);
       if (!stat.isFile()) {
         recordContentSkip(fullPath, "non_regular_file", true);
+        withhold(file, "non_regular_file");
         continue;
       }
       if (stat.size > MAX_REPOSITORY_CONTENT_BYTES) {
         recordContentSkip(fullPath, "too_large", true);
+        withhold(file, "too_large");
         continue;
       }
     } catch (error) {
       recordFilesystemSkip(fullPath, error, false, true);
+      withhold(file, "unreadable");
       continue;
     }
     if (!isPotentialContentPath(file)) {
@@ -5071,7 +5169,7 @@ function collectRepoFileInventory(repoPath) {
   const tracked = readGitTrackedFileOutput(repoPath);
   if (tracked.ok) {
     return {
-      repoFiles: parseGitTrackedFiles(repoPath, tracked.stdout, false),
+      repoFiles: parseGitTrackedFiles(repoPath, tracked.stdout, false, true),
       inventoryFiles: parseGitTrackedFiles(repoPath, tracked.stdout, true),
       repoFileInventoryScope: "tracked-scan-eligible",
       scanLimitations: []
@@ -5169,8 +5267,10 @@ function visitRepoDir(repoPath, dirPath, files, rootDevice) {
       visitRepoDir(repoPath, fullPath, files, rootDevice);
       continue;
     }
+    const repoRelativePath = relative(repoPath, fullPath);
     if (!entry.isFile()) {
       recordContentSkip(fullPath, "non_regular_file");
+      registerWithheldRepoPath(repoRelativePath, "non_regular_file");
       continue;
     }
     let size;
@@ -5178,11 +5278,12 @@ function visitRepoDir(repoPath, dirPath, files, rootDevice) {
       size = statSync(fullPath).size;
     } catch (error) {
       recordFilesystemSkip(fullPath, error);
+      registerWithheldRepoPath(repoRelativePath, "unreadable");
       continue;
     }
-    const repoRelativePath = relative(repoPath, fullPath);
     if (size > MAX_REPOSITORY_CONTENT_BYTES) {
       recordContentSkip(fullPath, "too_large");
+      registerWithheldRepoPath(repoRelativePath, "too_large");
       continue;
     }
     if (!isPotentialContentPath(repoRelativePath)) {
@@ -5306,6 +5407,9 @@ function measureNonHollowTestShare(repoPath, files, useV17Detectors = false) {
 function countFilesContaining(repoPath, files, pattern) {
   return files.filter((file) => fileContains(repoPath, file, pattern)).length;
 }
+function countFilesMatchingAny(repoPath, files, patterns) {
+  return files.filter((file) => patterns.some((pattern) => fileContains(repoPath, file, pattern))).length;
+}
 function countPatternMatches(repoPath, files, pattern) {
   const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
   const matcher = new RegExp(pattern.source, flags);
@@ -5845,22 +5949,33 @@ function isDocumentationOnlyDeployWorkflow(repoPath, file) {
 function findPackagedApplicationPremiseFiles(repoPath, repoFiles) {
   return repoFiles.filter((file) => /(^|\/)package\.json$/.test(file) && isAuthoredProductionPath(file)).filter((file) => packageJsonDescribesPackagedApplication(repoPath, file, repoFiles));
 }
+function isClaimSourceFile(file) {
+  return /^(?:README|readme)\.md$/.test(file) || /^docs\/[^/]+\.(?:md|mdx)$/.test(file);
+}
+function isClaimRealityReconciliationPath(file) {
+  return /(^|\/)claim[-_]reality[-_]reconciliation\.(?:md|mdx|json)$/i.test(file);
+}
+function isSecurityOrThreatModelDoc(file) {
+  return /(^|\/)(SECURITY|THREAT[_-]?MODEL)\.md$/i.test(file);
+}
+function isNegativeSpaceDocCandidate(file) {
+  return isClaimSourceFile(file) || isSecurityOrThreatModelDoc(file);
+}
+function claimImplementationFileReads(authoredOnly) {
+  return (file) => isImplementationFile(file) && (!authoredOnly || isAuthoredProductionPath(file));
+}
 function findClaimSourceFiles(repoFiles) {
-  return repoFiles.filter(
-    (file) => /^(?:README|readme)\.md$/.test(file) || /^docs\/[^/]+\.(?:md|mdx)$/.test(file)
-  ).sort((left, right) => {
+  return repoFiles.filter(isClaimSourceFile).sort((left, right) => {
     const leftRootReadme = /^(?:README|readme)\.md$/.test(left);
     const rightRootReadme = /^(?:README|readme)\.md$/.test(right);
     return Number(rightRootReadme) - Number(leftRootReadme) || left.localeCompare(right);
   });
 }
 function findClaimImplementationFiles(repoFiles, authoredOnly = false) {
-  return repoFiles.filter(
-    (file) => isImplementationFile(file) && (!authoredOnly || isAuthoredProductionPath(file))
-  );
+  return repoFiles.filter(claimImplementationFileReads(authoredOnly));
 }
 function findClaimRealityReconciliationArtifacts(repoPath, repoFiles) {
-  return repoFiles.filter((file) => /(^|\/)claim[-_]reality[-_]reconciliation\.(?:md|mdx|json)$/i.test(file)).filter((file) => isAuthenticatedClaimRealityArtifact(repoPath, file));
+  return repoFiles.filter(isClaimRealityReconciliationPath).filter((file) => isAuthenticatedClaimRealityArtifact(repoPath, file));
 }
 function isAuthenticatedClaimRealityArtifact(repoPath, file) {
   const fullPath = join(repoPath, file);
@@ -6916,7 +7031,9 @@ var MAIN_ENTRYPOINT_FILE_PATTERN = /(^|\/)(main|server|app|wsgi|asgi|index|entry
 var RACK_ENTRYPOINT_FILE_PATTERN = /(^|\/)(?:config\.ru|(?:main|server|app|start|run)\.rb)$/i;
 var SERVER_ENTRYPOINT_PATTERN = /\bapp\.listen\s*\(|\bserver\.listen\s*\(\s*(?:PORT|port|\d+)|http\.ListenAndServe\s*\(|http\.ListenAndServeTLS\s*\(|axum::Server(?:::|\.)|actix_web::HttpServer(?:::|\.)|uvicorn\.run\s*\(/;
 var V20_DIRECT_HTTP_SERVER_PATTERN = /\b(?:http|https)\.createServer\s*\([\s\S]{0,1500}?\)\.listen\s*\(\s*(?:PORT|port|\d+)/;
-var V20_HEALTH_OR_READINESS_ROUTE_PATTERN = /["'`]\/(?:health|ready|readiness|live|liveness)["'`]/i;
+var V20_HEALTH_OR_READINESS_ROUTE_PATTERN = /["'`][\w${}./-]{0,60}\/(?:(?:health|ready|live)z?|readiness|liveness)(?=["'`/])/i;
+var EXPRESS_ERROR_MIDDLEWARE_PATTERN = /\(\s*(?:err|error)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*(?:req|request)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*(?:res|response)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*next(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*\)\s*(?:=>|\{)/i;
+var EXPRESS_MIDDLEWARE_REACHABLE_PATTERN = /\.use\s*\(|\bmodule\.exports\b|\bexport\s+(?:default\b|function\b|const\b)/;
 var RACK_SERVER_ENTRYPOINT_PATTERN = /Rack::(?:Server|Handler(?:::\w+)?)\.(?:start|run)\s*\(/;
 var RACK_CONFIG_RUN_PATTERN = /^\s*run\s+(?:(?:[A-Z]\w*(?:::\w+)*(?:\.new)?|lambda)\b|->)/m;
 var RUNTIME_CONTAINER_COMMAND_PATTERN = /^\s*(?:CMD|ENTRYPOINT)\s+.*(?:\b(?:start|serve|server|qgis|nginx|apache|gunicorn|uvicorn)\b|manage\.py\s+runserver).*$/im;
@@ -8377,6 +8494,22 @@ function discoverIngestInputs(repoPath, maxMatches = Number.POSITIVE_INFINITY) {
 // src/witan/scoring.ts
 init_esm_shims();
 
+// src/witan/rubric-fingerprint.ts
+init_esm_shims();
+import { createHash as createHash3 } from "crypto";
+var WITAN_RUBRIC_BEHAVIOUR_FINGERPRINTS = Object.freeze({
+  [WITAN_RUBRIC_VERSION_V17]: "sha256:ff0f01abe8c12daa60375d0e18c1aca4a1135a55ab2a80b15f4c037bfc18b4b1",
+  [WITAN_RUBRIC_VERSION_V18]: "sha256:abc35df0fdc0749aa941f47b295059d06c96dd9800af7f79cfef2bc8dae917da",
+  [WITAN_RUBRIC_VERSION_V19]: "sha256:f670fa2cc44beef066fa38767bd587e1a16fb28b03bc904756daaea5a6465e96",
+  [WITAN_RUBRIC_VERSION_V20]: "sha256:9276ce2ce865c2d50c52882ee45bbf1df5fe3c8b6038858b4a147f7a4cedfa98",
+  [WITAN_RUBRIC_VERSION_V21]: "sha256:d86411a7fe108bba4d2b8fe7ff9d4f7f69a60f11ca0c5c3fef8e88f66a9af53a",
+  [WITAN_RUBRIC_VERSION_V22]: "sha256:1bb57dd98d29b43b170f3a4f1c8b3b379b433a2aa9df0821ab9d5115f48cfb2f",
+  [WITAN_RUBRIC_VERSION_V23]: "sha256:b558c0aa4b2f85b734bed2e077298fd55851a1086234d678f10a71cf913ec3cf"
+});
+function rubricBehaviourFingerprint(rubricVersion) {
+  return WITAN_RUBRIC_BEHAVIOUR_FINGERPRINTS[rubricVersion];
+}
+
 // src/witan/rubric.ts
 init_esm_shims();
 var WITAN_RUBRIC = [
@@ -8536,6 +8669,13 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC, toolVersi
     productDisplayName: parsedInput.productDisplayName,
     repo: parsedInput.repo,
     rubricVersion: parsedInput.rubricVersion,
+    // Behavioural identity beside the rubric's name, so a reader holding two certificates can
+    // check whether the scoring that produced them agrees instead of inferring it from a string
+    // the tool's author controls. Derived only from parsedInput.rubricVersion, so it is a
+    // property of the (build, rubric) pair and not of this invocation: two runs of the same
+    // installed version at the same revision stay byte-identical. Absent, never fabricated, for
+    // a rubric this build carries no measurement for.
+    ...rubricBehaviourFingerprint(parsedInput.rubricVersion) ? { rubricBehaviourFingerprint: rubricBehaviourFingerprint(parsedInput.rubricVersion) } : {},
     verdict: abstained ? "insufficient_source" : witanVerdictForScore(overallScore),
     codeTrustScore: abstained ? null : codeTrustScore,
     processTrustScore: abstained ? null : processTrustScore,

package/dist/index.js

@@ -21,12 +21,12 @@ import {
   runCejelScan,
   serializeWitanReport,
   verifyWitanAttestationBinding
-} from "./chunk-6R3VJGJ2.js";
-import "./chunk-KNQBI3IX.js";
-import "./chunk-J6R5OHN7.js";
+} from "./chunk-TUUNJP27.js";
+import "./chunk-IHT7B6L7.js";
+import "./chunk-GKYTLWQK.js";
 import {
   init_esm_shims
-} from "./chunk-V3B2V4WA.js";
+} from "./chunk-PTZU6G4E.js";
 
 // src/index.ts
 init_esm_shims();
@@ -76,6 +76,7 @@ function renderTerminalCertificate(summary, report) {
     lines.splice(
       3,
       0,
+      `Scope: ${relyingPartySummary.scope}`,
       `What was examined: ${relyingPartySummary.examined}`,
       `What was established: ${relyingPartySummary.established}`,
       `What was not established: ${relyingPartySummary.notEstablished}`,

package/dist/mcp/index.js

@@ -5,20 +5,20 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "../chunk-6R3VJGJ2.js";
-import "../chunk-KNQBI3IX.js";
+} from "../chunk-TUUNJP27.js";
+import "../chunk-IHT7B6L7.js";
 import {
   ZodFirstPartyTypeKind,
   ZodOptional,
   external_exports,
   objectType
-} from "../chunk-J6R5OHN7.js";
+} from "../chunk-GKYTLWQK.js";
 import {
   __commonJS,
   __export,
   __toESM,
   init_esm_shims
-} from "../chunk-V3B2V4WA.js";
+} from "../chunk-PTZU6G4E.js";
 
 // node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({

package/dist/packs/d-series/index.js

@@ -3,18 +3,18 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   listCejelLlmPackFiles
-} from "../../chunk-ERNYMFH4.js";
+} from "../../chunk-IN2LPGGU.js";
 import {
   execGit
-} from "../../chunk-KNQBI3IX.js";
+} from "../../chunk-IHT7B6L7.js";
 import {
   require_typescript
-} from "../../chunk-ZPQOZLB7.js";
+} from "../../chunk-IQ42TE5H.js";
 import {
   __toESM,
   init_esm_shims,
   readRepoText
-} from "../../chunk-V3B2V4WA.js";
+} from "../../chunk-PTZU6G4E.js";
 
 // src/packs/d-series/index.ts
 init_esm_shims();

package/dist/packs/decision-contracts/index.js

@@ -3,15 +3,15 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   external_exports
-} from "../../chunk-J6R5OHN7.js";
+} from "../../chunk-GKYTLWQK.js";
 import {
   require_typescript
-} from "../../chunk-ZPQOZLB7.js";
+} from "../../chunk-IQ42TE5H.js";
 import {
   __toESM,
   init_esm_shims,
   readRepoText
-} from "../../chunk-V3B2V4WA.js";
+} from "../../chunk-PTZU6G4E.js";
 
 // src/packs/decision-contracts/index.ts
 init_esm_shims();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.4.8",
+  "version": "0.4.10",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {