@cejel/cejel 0.4.9 → 0.4.11

package/dist/mcp/index.js

@@ -5,20 +5,20 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "../chunk-TUUNJP27.js";
-import "../chunk-IHT7B6L7.js";
+} from "../chunk-UBCIGOIP.js";
+import "../chunk-63XQDYQ5.js";
 import {
   ZodFirstPartyTypeKind,
   ZodOptional,
   external_exports,
   objectType
-} from "../chunk-GKYTLWQK.js";
+} from "../chunk-FSMZV3Y6.js";
 import {
   __commonJS,
   __export,
   __toESM,
   init_esm_shims
-} from "../chunk-PTZU6G4E.js";
+} from "../chunk-O3MHSK25.js";
 
 // node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({

package/dist/packs/d-series/index.js

@@ -3,18 +3,18 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   listCejelLlmPackFiles
-} from "../../chunk-IN2LPGGU.js";
+} from "../../chunk-M6YYPJSN.js";
 import {
   execGit
-} from "../../chunk-IHT7B6L7.js";
+} from "../../chunk-63XQDYQ5.js";
 import {
   require_typescript
-} from "../../chunk-IQ42TE5H.js";
+} from "../../chunk-RH6FKREX.js";
 import {
   __toESM,
   init_esm_shims,
   readRepoText
-} from "../../chunk-PTZU6G4E.js";
+} from "../../chunk-O3MHSK25.js";
 
 // src/packs/d-series/index.ts
 init_esm_shims();

package/dist/packs/decision-contracts/index.js

@@ -3,15 +3,15 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   external_exports
-} from "../../chunk-GKYTLWQK.js";
+} from "../../chunk-FSMZV3Y6.js";
 import {
   require_typescript
-} from "../../chunk-IQ42TE5H.js";
+} from "../../chunk-RH6FKREX.js";
 import {
   __toESM,
   init_esm_shims,
   readRepoText
-} from "../../chunk-PTZU6G4E.js";
+} from "../../chunk-O3MHSK25.js";
 
 // src/packs/decision-contracts/index.ts
 init_esm_shims();

package/docs/security/README.md

@@ -0,0 +1,78 @@
+# Calibration record authority in this repository
+
+`docs/calibration/**` is treated as an authority path: B10, the cycle-13 freeze and the
+disclosure boundary all rest on records kept there. Until 2026-09-16 nothing in this repository
+could establish that authority. This page says what changed, and what did not.
+
+## What was measured, 2026-09-16
+
+Every commit that has ever touched `docs/calibration/` in this repository, with its git signature
+status (`%G?`: `G` good signature from a listed key, `E` signed by a key this repository does not
+list, `N` unsigned):
+
+| commit | `%G?` | subject |
+|---|---|---|
+| `209a058` | E | calibration: publish the v22 detection-recall measurement record (#315) |
+| `ebf4a33` | E | docs(calibration): v17 holdout reveal + hash-conventions doc (#222) |
+| `787b218` | N | docs: record orphaned v0.3.0 provenance |
+| `5afebfe` | N | docs: clarify v0.3.0 tag fast-forward |
+| `bce29c1` | N | docs: record v0.3.0 tag correction |
+| `307330e` | N | docs: preserve terminal GO binding |
+| `f085908` | N | docs: disclose npm provenance gap |
+| `2515814` | E | docs(evidence): free-core v50 multiple-comparisons disclosure (#41) |
+
+**Five unsigned, three signed by an unlisted key, none verifiable.** The repository shipped no
+allowed-signers file and no check read a signature, so the `--merge`-not-`--squash` discipline
+that protects a calibration signature preserved something no reader could confirm: `209a058`,
+merged carefully to keep its signature, reads exactly as `ebf4a33`, which was squashed.
+
+This is not degradation from a working state. cejel has never produced a verifiable calibration
+signature. Stating it plainly matters because "signed" and "unverifiable" look identical to anyone
+who does not run `%G?` by hand, and a record whose authority cannot be checked is a record, not an
+attestation.
+
+## What the gate does
+
+`scripts/check-calibration-signatures.mjs`, run on every pull request that touches a guarded path,
+requires each commit touching `docs/calibration/**` or root `FREEZE.md` to carry a signature from a key in
+`docs/security/allowed-signers`. It fails closed: a missing or key-less allowed-signers file is a
+failure rather than a skip, because "nobody may sign" must never read the same as "anybody may".
+`E` fails exactly as `N` does — accepting `E` would have passed the whole history above and
+reported success.
+
+A squash merge substitutes GitHub's web-flow key and produces `E`. Merge calibration pull requests
+with `--merge`.
+
+## What the gate does not do
+
+It does not reach backwards, and no amount of later signing can make the eight commits above
+verifiable. Records that predate the gate carry the authority of the process that produced them
+and of this disclosure — not of a signature anyone can check. A document citing one of them as an
+attestation is overstating it, and should cite this page alongside.
+
+The gate also says nothing about *content*. It establishes that a listed key signed the commit, and
+nothing about whether the measurement in it is sound. Provenance is not correctness.
+
+Marker supersession uses the same verifier; see [measurement freeze](../measurement-freeze.md) for the chain, parent-pinned allowlist, and operator transition commands.
+
+## Allowlist bootstrap provenance — reverified 2026-09-16
+
+The initial `docs/security/allowed-signers` file was introduced by
+`77fd3d27850fa928bcea70ba5fae622e8bda4465`, the squash merge of #318. With the
+repository's SSH allowlist explicitly configured, local Git reports `%G?=E` and
+key id `B5690EEEBB952194` (GitHub web-flow). This is not an operator SSH signature
+verifiable under that allowlist. `E` describes this verification environment;
+it does not claim that no one can cryptographically verify GitHub's signature.
+
+The forward transition check trusts the parent commit's allowlist. That blocks a
+transition from adding its own key in the same commit, but it does not independently
+establish the identity or authorization of the initial enrolled key. Initial key
+admission remains a bootstrap trust decision, separate from the eight historical
+calibration records listed above.
+
+The operator may re-establish that decision with an explicitly reviewed enrollment
+acknowledgement, recording how the key was independently authenticated and preserving
+an operator-signed commit without squashing. A later signature proves possession
+of the signing key; it does not by itself establish the signer's identity or
+retroactively turn `77fd3d2` into an operator-signed admission. This proposal only
+discloses the boundary. It neither changes the allowlist nor signs an acknowledgement.

package/docs/security/issuer-revocations

@@ -0,0 +1,18 @@
+# Withdrawn Cejel issuances. One line per withdrawal:
+#
+#   <report-sha256> <YYYY-MM-DD> <one sentence saying why>
+#
+# The digest is the sha256 of the exact report.json bytes the withdrawn issuance countersigned —
+# the same value `cejel verify` prints and the same value the issuance carries as its report.json
+# subject. `cejel verify` reports a listed digest as REVOKED and exits nonzero.
+#
+# APPEND-ONLY. A line here is never removed, edited, or reordered: a withdrawal that could be
+# quietly reversed is not a withdrawal. Correcting a mistaken entry means appending a second line
+# that says so, not deleting the first. This is enforced by
+# src/__tests__/issuance-revocations-append-only.test.ts, which pins the exact bytes below.
+#
+# This file is EMPTY of entries, and it ships empty on purpose. The absence of revocations is a
+# statement a reader can check, not an omission they have to infer. It ships in the npm package and
+# in every release tarball, so the check needs no network call.
+#
+# ---- entries below this line ----

package/docs/security/issuer-signers

@@ -0,0 +1,34 @@
+# The allowed-signers file for Cejel ISSUANCE countersignatures. One line per signer:
+# <principal> <keytype> <base64-key> [comment], the format `ssh-keygen -Y verify -f` reads.
+#
+# This is a DIFFERENT authority from docs/security/allowed-signers, which governs calibration
+# records. Issuance signatures carry the namespace `cejel-issuance`; calibration authority uses its
+# own. A key listed in one file is not thereby listed in the other, and a signature made under one
+# namespace does not verify under the other.
+#
+# Principal: issuance@barglabs.ai
+#
+# This file names no key on purpose. Admitting one is an authority decision and belongs to the
+# operator, not to an agent: the key listed here is what a relying party will thereafter accept as
+# Barg Labs' issuing hand. `cejel verify` fails closed while this file is empty — a signature made
+# by an unlisted key is reported as "signed by an unlisted key", never as valid.
+#
+# An agent must not write a key into this file.
+#
+# SUPPORTED KEY TYPES: `cejel verify` verifies `ssh-ed25519` only. Any other key type — including
+# the FIDO/hardware-backed `sk-ssh-ed25519@openssh.com` — is reported as NOT VERIFIED rather than
+# valid, and must be checked with OpenSSH directly (see docs/issuance.md). Before enrolling a key
+# here, confirm its type: enrolling one cejel cannot verify ships a certificate whose signature
+# most readers cannot check with the tool they were handed.
+#
+# To verify an issuance with OpenSSH alone, no Cejel involved:
+#
+#   ssh-keygen -Y verify -f docs/security/issuer-signers -I issuance@barglabs.ai \
+#     -n cejel-issuance -s issuance.json.sig < issuance.json
+#
+# Key rotation is recorded here, in place, with dates: a retired key keeps its line with a comment
+# giving the date it stopped being used, so a reader can still check an issuance made while it was
+# current. A line is never silently deleted.
+#
+# This file ships in the npm package and in every release tarball, so a relying party holds the
+# list without a network call.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.4.9",
+  "version": "0.4.11",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {
@@ -31,6 +31,7 @@
     "type": "git",
     "url": "git+https://github.com/BargLabs/cejel.git"
   },
+  "packageManager": "pnpm@9.0.0",
   "type": "module",
   "bin": {
     "cejel": "dist/index.js",
@@ -43,21 +44,13 @@
   "files": [
     "dist",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "docs/security/issuer-signers",
+    "docs/security/issuer-revocations"
   ],
   "engines": {
     "node": ">=18"
   },
-  "devDependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
-    "@types/node": "^25.9.1",
-    "postject": "^1.0.0-alpha.6",
-    "tsup": "^8.0.0",
-    "tsx": "^4.0.0",
-    "typescript": "^5.5.0",
-    "vitest": "^2.0.0",
-    "zod": "^3.23.0"
-  },
   "scripts": {
     "build": "tsup",
     "build:sea-js": "tsup --config tsup.public-sea.config.ts",
@@ -71,9 +64,21 @@
     "gate:d6": "pnpm run build && node scripts/d6-precision-gate.mjs",
     "validate:distribution": "node scripts/validate-distribution-metadata.mjs",
     "pnpm:devPreinstall": "node scripts/assert-dev-environment.mjs --phase=preinstall",
+    "prepublishOnly": "pnpm run build",
+    "prepack": "pnpm run build",
     "pretest": "node scripts/assert-dev-environment.mjs --phase=verify",
     "dev": "tsx src/index.ts",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "test": "vitest run"
+  },
+  "devDependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@types/node": "^25.9.1",
+    "postject": "^1.0.0-alpha.6",
+    "tsup": "^8.0.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.5.0",
+    "vitest": "^2.0.0",
+    "zod": "^3.23.0"
   }
-}
+}