@cejel/cejel 0.6.2 → 0.6.4

package/README.md

@@ -92,7 +92,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.6.2 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.6.4 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM (the packages
@@ -116,7 +116,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.6.2` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.6.4` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry. A GitLab CI
 > template and Code Quality export live in [`docs/gitlab-ci.md`](./docs/gitlab-ci.md).
 
@@ -187,16 +187,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.6.2`:
+**Docker / OCI.** The current container release is `0.6.4`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.6.2
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.6.4
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.6.2 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.6.4 .
 ```
 
 The OCI image carries an SBOM of its base-image packages, maximum-mode build provenance, and a
@@ -299,8 +299,10 @@ prints that boundary on every successful verification.
 - `--rubric-pin <version>` — Explicit opt-in only: pin an alternate rubric instead of the
   calibrated public default. It
   accepts the calibrated version or any published prospective rubric
-  (`witan-rubric-v18-prospective-*` through `v23`) and fails closed, naming what was accepted, on
-  anything else. `v23` is prospective and uncalibrated, like every rubric after v17: the public
+  (`witan-rubric-v18-prospective-*` through `v25`) and fails closed, naming what was accepted, on
+  anything else. `v25` is prospective and uncalibrated: it inherits v22 and adds only credit for a
+  health or readiness route declared inline in an application file (see "What counts as a health or
+  readiness signal" below). `v23` is prospective and uncalibrated, like every rubric after v17: the public
   default (`WITAN_LAST_CALIBRATED_RUBRIC_VERSION`) is still `witan-rubric-v17-2026-07-24`, and v23
   inherits none of v17's precision, recall, or false-positive-rate figures. It inherits v22
   detector/scoring behavior and adds bounded A1 coverage-flag recognition (#276) plus per-signal
@@ -567,7 +569,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.6.2"]}'
+npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.6.4"]}'
 npx -y openclaw@latest mcp doctor cejel-oci --probe
 ```
 
@@ -635,6 +637,27 @@ belongs to:
   `test` script's content against known test-runner invocations rather than crediting it by key
   presence alone, so no separate disclosure line is needed for it.
 
+### What counts as a health or readiness signal
+
+The "health or readiness signal" component of A3's production-readiness checks is filename-based
+by design under the calibrated rubric (and every prospective rubric before `v25`). It is credited
+for exactly these forms:
+
+- a dedicated health or readiness file, such as `health.ts`, `healthcheck.js`, `readiness.py`
+  (the file must mention health or readiness);
+- a `HEALTHCHECK` instruction in a root `Dockerfile`;
+- Kubernetes liveness or readiness probes in a `k8s/`, `kubernetes/` or `helm/` manifest.
+
+**A route declared inline in an application file does not count under the calibrated rubric**,
+whatever its content: `app.get("/health", ...)` in `server.ts` or `app.ts` earns nothing there,
+because the component never reads route text. The certificate states this next to the component.
+Prospective `witan-rubric-v25-prospective-2026-10-12` is the one rubric that also credits an inline
+route, in the files the separate info-level "no health or readiness route" finding already reads
+(under `src/`, `app/`, `lib/`, `packages/`, `functions/`, a repo-root `server`/`index`/`app`/`main`
+file, or a `server/`, `backend/` or `api/` tree), with comments stripped and tests, docs, examples
+and scripts excluded. It is explicit opt-in (`--rubric-pin`), carries no precision or recall claim,
+and its public paired rescore has not run.
+
 ## Help validate Cejel
 
 Cejel does not collect telemetry. External validation is therefore opt-in and inspectable:

package/dist/calibration/llm-detector.js

@@ -5,7 +5,7 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-KG62JCJZ.js";
+} from "../chunk-4YK23CST.js";
 import {
   listCejelLlmPackFiles
 } from "../chunk-M6YYPJSN.js";

package/dist/{chunk-KG62JCJZ.js → chunk-4YK23CST.js}

@@ -532,6 +532,7 @@ var WITAN_RUBRIC_VERSION_V21 = "witan-rubric-v21-prospective-2026-08-10";
 var WITAN_RUBRIC_VERSION_V22 = "witan-rubric-v22-prospective-2026-08-10";
 var WITAN_RUBRIC_VERSION_V23 = "witan-rubric-v23-prospective-2026-09-06";
 var WITAN_RUBRIC_VERSION_V24 = "witan-rubric-v24-prospective-2026-09-15";
+var WITAN_RUBRIC_VERSION_V25 = "witan-rubric-v25-prospective-2026-10-12";
 var WITAN_LAST_CALIBRATED_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V17;
 var WITAN_PROSPECTIVE_RUBRIC_VERSIONS = Object.freeze([
   WITAN_RUBRIC_VERSION_V18,
@@ -540,7 +541,8 @@ var WITAN_PROSPECTIVE_RUBRIC_VERSIONS = Object.freeze([
   WITAN_RUBRIC_VERSION_V21,
   WITAN_RUBRIC_VERSION_V22,
   WITAN_RUBRIC_VERSION_V23,
-  WITAN_RUBRIC_VERSION_V24
+  WITAN_RUBRIC_VERSION_V24,
+  WITAN_RUBRIC_VERSION_V25
 ]);
 var WITAN_SELECTABLE_RUBRIC_VERSIONS = Object.freeze([
   WITAN_LAST_CALIBRATED_RUBRIC_VERSION,
@@ -642,14 +644,15 @@ init_esm_shims();
 init_esm_shims();
 import { createHash } from "crypto";
 var WITAN_RUBRIC_BEHAVIOUR_FINGERPRINTS = Object.freeze({
-  [WITAN_RUBRIC_VERSION_V17]: "sha256:eabdc78425373baf23f50c23b0b025bae4116461f3bc5ddc7d5b8496df03f653",
-  [WITAN_RUBRIC_VERSION_V18]: "sha256:23cde3839b54875cf78eb8b4295779bc66327f7f5b331628a17839c2fb9562f1",
-  [WITAN_RUBRIC_VERSION_V19]: "sha256:07e06ce68ba5ca365242f099e8860e1e466fa503dbcdac99986aab1e65c7c867",
-  [WITAN_RUBRIC_VERSION_V20]: "sha256:4fb83b8972b76fb28cc6b59796f18ecfa16a37be52997c139f5cb14f60fd3717",
-  [WITAN_RUBRIC_VERSION_V21]: "sha256:009f82a0ccaae4e9efcb1bb33776bf6cff2f268ddb21db0fb43f4b505563f645",
-  [WITAN_RUBRIC_VERSION_V22]: "sha256:df8fcacf9a6f0d57c0ff00cafc51149e1bebafd3bec03f13316803b4ae27f0cc",
-  [WITAN_RUBRIC_VERSION_V23]: "sha256:01ec9f9057f649f4bc737dc2f972bcec227237416cda5a4255db2c23d874ec5c",
-  [WITAN_RUBRIC_VERSION_V24]: "sha256:4452f3b033552b7feb205048a07d6d851d1dc459a06f39befa86d22281e201fb"
+  [WITAN_RUBRIC_VERSION_V17]: "sha256:6a31f7cb96ebf17046ba0620d74b1fadb66582c4b4ae5cb0b5af04480df6dbf2",
+  [WITAN_RUBRIC_VERSION_V18]: "sha256:9c54aa1493ff42b001ae2d1828f4bda92b3ebff500551eb36ef8a2b9d2fc391f",
+  [WITAN_RUBRIC_VERSION_V19]: "sha256:ed3fa7ff11aa0c0ecf7fc23fccab2c40337c55c5b06abae14eb10e9d73bbcffa",
+  [WITAN_RUBRIC_VERSION_V20]: "sha256:eb6ed39afd0e3f3d73e6a85df90787a3490087eaa34aad19fb5fbb31b4502ce5",
+  [WITAN_RUBRIC_VERSION_V21]: "sha256:7a890ac663793f807e240e38047ff9fbc069853d118ebf9a765cc103a8bed2a3",
+  [WITAN_RUBRIC_VERSION_V22]: "sha256:ac4db093dc7c37369579b49ccd7855d36eec49d9f52136964251ee7bbd69e101",
+  [WITAN_RUBRIC_VERSION_V23]: "sha256:7d48de4ac8ef3233e7ef8f4d4312830bf76294485e9766a47a671cd5440676aa",
+  [WITAN_RUBRIC_VERSION_V24]: "sha256:0af37b616891a1940f7ba43c86ef2134d6e40f235feef17bf1774cae951afee2",
+  [WITAN_RUBRIC_VERSION_V25]: "sha256:31a751882d02c8f053dcc8f3e90b3e4ecd57279f3250e420e95a3af875b9f019"
 });
 function rubricBehaviourFingerprint(rubricVersion) {
   return WITAN_RUBRIC_BEHAVIOUR_FINGERPRINTS[rubricVersion];
@@ -717,7 +720,7 @@ var WITAN_RUBRIC = [
 
 // src/witan/scoring.ts
 function usesV17DetectorClosure(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
 }
 var MAX_SIGNAL_ADJUSTMENT = 0.8;
 function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC, toolVersion) {
@@ -888,7 +891,7 @@ function statusForScore(score) {
 }
 function statusAfterInputAdjustment(nativeStatus, nativeScore, adjustment, rubricVersion) {
   if (adjustment === 0) return nativeStatus;
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V24 && rubricVersion !== WITAN_RUBRIC_VERSION_V23) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V25 && rubricVersion !== WITAN_RUBRIC_VERSION_V24 && rubricVersion !== WITAN_RUBRIC_VERSION_V23) {
     return statusForScore(roundScore(Math.max(0, nativeScore - adjustment)));
   }
   const statusFloor = {
@@ -945,7 +948,7 @@ function mergeSignalsByCriterion(signals) {
   return merged;
 }
 function usesMetricScoring(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
 }
 function unmeasuredStatus(rubricVersion) {
   return rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0 ? "unverified" : "insufficient_data";
@@ -1333,7 +1336,7 @@ function calibratedCriterionStateV11(criterionId, metrics) {
   return void 0;
 }
 function ensureFindingsExplainStatus(criterionId, score, status, findings, evidence, rubricVersion) {
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V24 && rubricVersion !== WITAN_RUBRIC_VERSION_V23 && findings.length > 0) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V25 && rubricVersion !== WITAN_RUBRIC_VERSION_V24 && rubricVersion !== WITAN_RUBRIC_VERSION_V23 && findings.length > 0) {
     return [...findings];
   }
   if (status !== "critical" && status !== "warning") return [...findings];
@@ -1479,7 +1482,7 @@ var CERTIFICATE_GLOSSARY = [
   {
     key: "production-readiness-basic-checks",
     term: "Production-readiness basic checks",
-    definition: "A count of six named checks: a build or type-check command, a CI workflow, deployment configuration, an environment template, a health or readiness signal, and an error boundary.",
+    definition: "A count of six named checks: a build or type-check command, a CI workflow, deployment configuration, an environment template, a health or readiness signal, and an error boundary. In the calibrated rubric the health or readiness signal is credited only for a dedicated health or readiness file (such as health.ts or readiness.ts), a Dockerfile HEALTHCHECK, or Kubernetes liveness or readiness probes. A health route declared inline in an application file does not count there. The prospective witan-rubric-v25 also credits such an inline route.",
     metricNames: ["prod_readiness_primitives"]
   },
   {
@@ -1611,7 +1614,7 @@ var CERTIFICATE_GLOSSARY = [
   {
     key: "protected-path-review-gate",
     term: "Protected-path review gate",
-    definition: "A binary check for a CODEOWNERS file or documentation of required review or branch protection. This is the repository-visible proxy for human review of sensitive-path changes.",
+    definition: "A binary check for a CODEOWNERS file in a location GitHub reads (the repository root, .github/ or docs/), or a document stating a required-review or branch-protection policy. A changelog, an experiment or calibration record, a review note or a report does not count. This is the repository-visible proxy for human review of sensitive-path changes.",
     metricNames: ["protected_path_review_gate"]
   }
 ];
@@ -1710,7 +1713,7 @@ var BINARY_METRIC_COPY = {
   },
   protected_path_review_gate: {
     positive: "present \u2014 CODEOWNERS or a documented required-review policy was detected",
-    negative: "missing \u2014 no CODEOWNERS or documented required-review policy detected"
+    negative: "missing \u2014 no CODEOWNERS file in a location GitHub reads, and no documented required-review or branch-protection policy detected"
   }
 };
 var CONDITIONAL_METRIC_COPY = {
@@ -2902,7 +2905,7 @@ function stripBom(text) {
 
 // src/witan/repo-signals.ts
 function usesV17DetectorClosure2(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V25;
 }
 var LEGACY_INVENTORY_ABSENCE_CONTEXT = {
   rubricGeneration: "legacy",
@@ -3149,15 +3152,16 @@ function buildWitanInputFromRepoUntracked(options) {
     rubricGeneration: usesV17Detectors ? "current" : "legacy",
     inventoryProvenance: fileInventory.repoFileInventoryScope === "tracked-scan-eligible" ? "tracked-scan-eligible" : "directory-walk"
   };
-  const usesV18NativeRls = rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24;
-  const usesV19CommitYear = rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24;
-  const usesV20A3ExplicitGaps = rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24;
-  const usesV21ExecutedEscalations = rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24;
-  const usesV22PackageStartEntrypoint = rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24;
+  const usesV18NativeRls = rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V25;
+  const usesV19CommitYear = rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V25;
+  const usesV20A3ExplicitGaps = rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V25;
+  const usesV21ExecutedEscalations = rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V25;
+  const usesV22PackageStartEntrypoint = rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V25;
   const usesV23CommandCoverage = rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const usesV23PemPrivateKeyGrammar = rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const usesV23WithheldPathAbstention = rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const usesV24SecretContentContext = rubricVersion === WITAN_RUBRIC_VERSION_V24;
+  const usesV25InlineHealthRoute = rubricVersion === WITAN_RUBRIC_VERSION_V25;
   const structuralArchetype = classifyRepoArchetype(inventoryFiles, rubricVersion);
   const readableArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure2(rubricVersion) ? applyReadableSourceRepresentationGate(
     options.repoPath,
@@ -3197,6 +3201,7 @@ function buildWitanInputFromRepoUntracked(options) {
     usesV23PemPrivateKeyGrammar,
     usesV23WithheldPathAbstention,
     usesV24SecretContentContext,
+    usesV25InlineHealthRoute,
     reviewableSourceProof,
     inventoryAbsenceContext,
     scanLimitations
@@ -3811,7 +3816,7 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, useV23CommandCoverage, useV23PemPrivateKeyGrammar, useV23WithheldPathAbstention, useV24SecretContentContext, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, useV23CommandCoverage, useV23PemPrivateKeyGrammar, useV23WithheldPathAbstention, useV24SecretContentContext, useV25InlineHealthRoute, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
   const signals = [];
   const mono = resolveMonorepoContext(repoPath, scanLimitations);
   const collectCriterion = (criterionId, collect) => withContentReadCriterion(criterionId, collect);
@@ -3854,7 +3859,8 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV20A3ExplicitGaps,
       useV22PackageStartEntrypoint,
       useV23WithheldPathAbstention,
-      inventoryAbsenceContext
+      inventoryAbsenceContext,
+      useV25InlineHealthRoute
     )
   );
   const a4Signal = collectCriterion(
@@ -4752,7 +4758,7 @@ function collectCryptoHygieneEvidence(repoPath, implFiles, useV39Detectors = fal
   }
   return { evidence, findings, hasSurface, clean: hasSurface && !insecureFound };
 }
-function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, useV20ExplicitGaps = false, useV22PackageStartEntrypoint = false, useV23WithheldPathAbstention = false, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
+function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, useV20ExplicitGaps = false, useV22PackageStartEntrypoint = false, useV23WithheldPathAbstention = false, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, useV25InlineHealthRoute = false) {
   const v20DirectHttpEntrypoint = useV20ExplicitGaps ? findV20DirectHttpServerEntrypointFile(repoPath, repoFiles) : null;
   const v22PackageStartHttpEntrypoint = useV22PackageStartEntrypoint ? findV22PackageStartHttpServerEntrypointFile(repoPath, repoFiles) : null;
   const v20RuntimeContainer = useV20ExplicitGaps ? findRuntimeContainerEntrypointFile(repoPath, repoFiles, true) : null;
@@ -4790,8 +4796,16 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
     )
   );
   const healthCheck = healthChecks[0];
-  const healthReadinessRouteReads = (file) => isAuthoredProductionPath(file) && (isImplementationFile(file) || HEALTH_ROUTE_FUNCTIONS_DIR_PATTERN.test(file));
+  const healthReadinessRouteReads = (file) => isAuthoredProductionPath(file) && (isImplementationFile(file) || HEALTH_ROUTE_FUNCTIONS_DIR_PATTERN.test(file) || HEALTH_ROUTE_ENTRYPOINT_HOME_PATTERN.test(file));
   const observabilityDepthReads = (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isImplementationFile(file);
+  const inlineHealthRouteFile = useV25InlineHealthRoute && healthChecks.length === 0 ? withContentReadSignal(
+    "A3",
+    "prod_readiness_primitives",
+    () => repoFiles.find(
+      (file) => healthReadinessRouteReads(file) && fileMatchesOutsideComments(repoPath, file, V20_HEALTH_OR_READINESS_ROUTE_PATTERN)
+    )
+  ) : void 0;
+  const hasHealthOrReadinessSignal = healthChecks.length > 0 || inlineHealthRouteFile !== void 0;
   const { hasV20HealthOrReadinessRoute, hasV22PackageStartHealthOrReadinessRoute } = withContentReadSignal("A3", "health_readiness_route", () => ({
     hasV20HealthOrReadinessRoute: useV20ExplicitGaps && repoFiles.some(
       (file) => healthReadinessRouteReads(file) && fileContains(repoPath, file, V20_HEALTH_OR_READINESS_ROUTE_PATTERN)
@@ -4811,14 +4825,14 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
   const serverEntrypoint = v22PackageStartHttpEntrypoint ?? findServerEntrypointFile(repoPath, repoFiles, useV27Detectors) ?? v20DirectHttpEntrypoint ?? null;
   const runtimeContainer = useV27Detectors ? findRuntimeContainerEntrypointFile(repoPath, repoFiles, useV20ExplicitGaps) : null;
   const errorBoundaries = repoFiles.filter(
-    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && /error-boundary|error\.(tsx|jsx|ts|js)$/.test(file)
+    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isImplementationEvidencePath(file) && ERROR_BOUNDARY_FILENAME_PATTERN.test(file)
   );
-  const errorBoundaryFileReads = (file) => observabilityDepthReads(file) || (!useV27Detectors || isAuthoredProductionPath(file)) && /(^|\/)server\//.test(file) && /\.(?:mjs|cjs)$/.test(file);
+  const errorBoundaryFileReads = (file) => isImplementationEvidencePath(file) && (observabilityDepthReads(file) || (!useV27Detectors || isAuthoredProductionPath(file)) && /(^|\/)server\//.test(file) && /\.(?:mjs|cjs)$/.test(file));
   const expressErrorMiddlewareFile = errorBoundaries.length > 0 ? void 0 : withContentReadSignal(
     "A3",
     "prod_readiness_primitives",
     () => repoFiles.find(
-      (file) => errorBoundaryFileReads(file) && fileContains(repoPath, file, EXPRESS_ERROR_MIDDLEWARE_PATTERN) && fileMatchesOutsideLineComments(repoPath, file, EXPRESS_MIDDLEWARE_REACHABLE_PATTERN)
+      (file) => errorBoundaryFileReads(file) && fileMatchesOutsideComments(repoPath, file, EXPRESS_ERROR_MIDDLEWARE_PATTERN) && fileMatchesOutsideComments(repoPath, file, EXPRESS_MIDDLEWARE_REACHABLE_PATTERN)
     )
   );
   const errorBoundary = errorBoundaries[0] ?? expressErrorMiddlewareFile;
@@ -4855,12 +4869,28 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
       /rollback|roll back|migration safety|down migration|reversible|undo migration/i
     )
   );
+  const rootOnlyScriptsNote = rootOnlyPackageScriptsDisclosure(repoFiles, packageJson);
   if (packageJson && (scripts.has("build") || scripts.has("typecheck"))) {
     evidence.push(
       evidenceForRelative(repoPath, packageJson, "prod_check", "Build or typecheck script")
     );
   }
-  if (workflow) evidence.push(evidenceForRelative(repoPath, workflow, "ci_run", "CI workflow"));
+  if (workflow) {
+    evidence.push(
+      evidenceForRelative(
+        repoPath,
+        workflow,
+        "ci_run",
+        ciWorkflowCitationLabel(
+          "CI workflow",
+          "counted",
+          workflows.length,
+          1,
+          unreadCiWorkflowReasons((file) => !useV27Detectors || isAuthoredProductionPath(file))
+        )
+      )
+    );
+  }
   if (releaseDeployConfig)
     evidence.push(
       evidenceForRelative(
@@ -4889,6 +4919,24 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
         evidenceForRelative(repoPath, healthCheck, "prod_check", "Health/readiness signal")
       )
     );
+  } else if (inlineHealthRouteFile) {
+    withContentReadSignal(
+      "A3",
+      "prod_readiness_primitives",
+      () => evidence.push(
+        evidenceForRelativeAtLine(
+          repoPath,
+          inlineHealthRouteFile,
+          "prod_check",
+          "Health/readiness route",
+          findFirstMatchingLineOutsideComments(
+            repoPath,
+            inlineHealthRouteFile,
+            V20_HEALTH_OR_READINESS_ROUTE_PATTERN
+          )
+        )
+      )
+    );
   }
   if (errorBoundary) {
     evidence.push(
@@ -4897,7 +4945,11 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
         errorBoundary,
         "prod_check",
         "Error boundary",
-        findFirstMatchingLine(repoPath, errorBoundary, EXPRESS_ERROR_MIDDLEWARE_PATTERN)
+        findFirstMatchingLineOutsideComments(
+          repoPath,
+          errorBoundary,
+          EXPRESS_ERROR_MIDDLEWARE_PATTERN
+        )
       ) : evidenceForRelative(repoPath, errorBoundary, "prod_check", "Error boundary")
     );
   }
@@ -5012,7 +5064,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
           workflows.length > 0,
           deployConfigs.length > 0,
           envTemplate,
-          healthChecks.length > 0,
+          hasHealthOrReadinessSignal,
           errorBoundary !== void 0
         ].filter(Boolean).length,
         6,
@@ -5029,9 +5081,10 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
             { label: "CI workflow", count: workflows.length > 0 ? 1 : 0 },
             { label: "deployment configuration", count: deployConfigs.length > 0 ? 1 : 0 },
             { label: "environment template", count: envTemplate ? 1 : 0 },
-            { label: "health or readiness signal", count: healthChecks.length > 0 ? 1 : 0 },
+            { label: "health or readiness signal", count: hasHealthOrReadinessSignal ? 1 : 0 },
             { label: "error boundary", count: errorBoundary !== void 0 ? 1 : 0 }
-          ]
+          ],
+          ...rootOnlyScriptsNote ? { condition: rootOnlyScriptsNote } : {}
         }
       ),
       metric(
@@ -5436,10 +5489,18 @@ function collectB2PrTraceEvidence(repoPath, repoFiles) {
     (file) => /(^|\/)(pull_request_template|PULL_REQUEST_TEMPLATE)(\.md$|\/[^/]+\.md$)/.test(file)
   );
   const branchProtectionDoc = repoFiles.find(
-    (file) => /branch.*protection|review.*gate|CODEOWNERS/i.test(file)
+    (file) => /branch.*protection|review.*gate/i.test(file) || GITHUB_CODEOWNERS_PATH_PATTERN.test(file)
+  );
+  const citedWorkflows = workflows.slice(0, 3);
+  const workflowLabel = ciWorkflowCitationLabel(
+    "Pull-request CI workflow",
+    "counted",
+    workflows.length,
+    citedWorkflows.length,
+    unreadCiWorkflowReasons(() => true)
   );
   const evidence = [
-    ...workflows.slice(0, 3).map((file) => evidenceForRelative(repoPath, file, "ci_run", "Pull-request CI workflow")),
+    ...citedWorkflows.map((file) => evidenceForRelative(repoPath, file, "ci_run", workflowLabel)),
     ...prTemplate ? [evidenceForRelative(repoPath, prTemplate, "pull_request", "Pull request template")] : [],
     ...branchProtectionDoc ? [
       evidenceForRelative(
@@ -5512,11 +5573,20 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
   if (packageJson && scripts.has("lint")) {
     evidence.push(evidenceForRelative(repoPath, packageJson, "ci_run", "Lint script"));
   }
+  const unreadWorkflows = unreadCiWorkflowReasons(() => true);
+  const workflowsRead = workflows.length + rootWorkflows.length;
   if (workflow) {
     withContentReadSignals(
       "B3",
       ["ci_script_depth", "default_branch_ci_depth"],
-      () => evidence.push(evidenceForRelative(repoPath, workflow, "ci_run", "CI workflow"))
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          workflow,
+          "ci_run",
+          ciWorkflowCitationLabel("CI workflow", "read", workflowsRead, 1, unreadWorkflows)
+        )
+      )
     );
   } else if (rootWorkflows[0] && mono) {
     const rootWorkflow = rootWorkflows[0];
@@ -5524,7 +5594,18 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
       "B3",
       ["ci_script_depth", "default_branch_ci_depth"],
       () => evidence.push(
-        evidenceForRelative(mono.root, rootWorkflow, "ci_run", "CI workflow (monorepo root)")
+        evidenceForRelative(
+          mono.root,
+          rootWorkflow,
+          "ci_run",
+          ciWorkflowCitationLabel(
+            "CI workflow (monorepo root)",
+            "read",
+            workflowsRead,
+            1,
+            unreadWorkflows
+          )
+        )
       )
     );
   }
@@ -5536,6 +5617,7 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
     CI_TYPECHECK_COMMAND_PATTERN,
     CI_BUILD_COMMAND_PATTERN
   ];
+  const rootOnlyScriptsNote = rootOnlyPackageScriptsDisclosure(repoFiles, packageJson);
   const scriptDepth = ["test", "lint", "typecheck", "build"].filter(
     (s) => s === "test" ? hasCredibleTestScript(scripts) : scripts.has(s)
   ).length;
@@ -5581,7 +5663,8 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
               label: `monorepo-root CI command: ${["test", "lint", "type-check", "build"][index]}`,
               count: rootCategoryHits[index] ? 1 : 0
             })) : []
-          ]
+          ],
+          ...rootOnlyScriptsNote ? { condition: rootOnlyScriptsNote } : {}
         }
       ),
       metric(
@@ -5689,32 +5772,36 @@ function collectB4AuditEvidence(repoPath, repoFiles, generatedAt, useV19CommitYe
 function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detectors = false, useV21ExecutedEscalations = false) {
   const evidence = [];
   const findings = [];
-  const docFiles = repoFiles.filter((file) => /\.(md|mdx)$/i.test(file));
+  const policyDocFiles = repoFiles.filter(
+    (file) => /\.(md|mdx)$/i.test(file) && isPolicyDocumentEvidencePath(file)
+  );
+  const isPolicyDocMatching = (file, pattern) => fileContains(repoPath, file, pattern) && !isCejelCertificateText(repoPath, file);
   const humanGateDoc = withContentReadSignal(
     "B6",
     "human_gate_documented",
-    () => docFiles.find((file) => fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN))
+    () => policyDocFiles.find((file) => isPolicyDocMatching(file, HUMAN_GATE_MARKER_PATTERN))
   );
   const implFiles = repoFiles.filter(isImplementationFile);
+  const implementationEvidenceFiles = implFiles.filter(isImplementationEvidencePath);
   const gatedPrivilegeCheckFile = withContentReadSignal(
     "B6",
     "fail_closed_privilege_check",
-    () => implFiles.find(
-      (file) => fileContains(repoPath, file, GATED_PRIVILEGE_CHECK_PATTERN) && fileContains(repoPath, file, SET_ROLE_PATTERN)
+    () => implementationEvidenceFiles.find(
+      (file) => fileMatchesOutsideComments(repoPath, file, GATED_PRIVILEGE_CHECK_PATTERN) && fileMatchesOutsideComments(repoPath, file, SET_ROLE_PATTERN)
     )
   );
   const killSwitchFile = withContentReadSignal(
     "B6",
     "kill_switch_fail_safe_present",
-    () => implFiles.find(
-      (file) => fileContains(repoPath, file, KILL_SWITCH_NAME_PATTERN) && fileContains(repoPath, file, KILL_SWITCH_FAIL_CLOSED_PATTERN)
+    () => implementationEvidenceFiles.find(
+      (file) => fileMatchesOutsideComments(repoPath, file, KILL_SWITCH_NAME_PATTERN) && fileMatchesOutsideComments(repoPath, file, KILL_SWITCH_FAIL_CLOSED_PATTERN)
     )
   );
-  const codeownersFile = repoFiles.find((file) => /(^|\/)CODEOWNERS$/.test(file));
+  const codeownersFile = repoFiles.find((file) => GITHUB_CODEOWNERS_PATH_PATTERN.test(file));
   const reviewGateDoc = withContentReadSignal(
     "B6",
     "protected_path_review_gate",
-    () => docFiles.find((file) => fileContains(repoPath, file, REQUIRED_REVIEW_PATTERN))
+    () => policyDocFiles.find((file) => isPolicyDocMatching(file, REQUIRED_REVIEW_PATTERN))
   );
   const protectedPathReviewGate = codeownersFile ?? reviewGateDoc;
   const { executableFiles, v21ExecutedEscalationFileSet, productionUngatedEscalationFiles } = withContentReadSignal("B6", "privilege_escalation_cleanliness", () => {
@@ -5792,7 +5879,7 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detecto
           repoPath,
           protectedPathReviewGate,
           "artifact",
-          "CODEOWNERS/required-review gate on protected paths"
+          protectedPathReviewGate === codeownersFile ? "CODEOWNERS file in a location GitHub reads (protected-path review gate)" : "Documented required-review/branch-protection policy"
         )
       )
     );
@@ -5883,7 +5970,7 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detecto
         1,
         hasPrivilegedOpsSurface ? 0.2 : 0.6,
         "present",
-        "Credits a CODEOWNERS file or documented required-review/branch-protection policy \u2014 the general OSS-observable analogue of human-gating changes to sensitive paths."
+        "Credits a CODEOWNERS file where GitHub reads it (root, .github/ or docs/) or a documented required-review/branch-protection policy (not a changelog, record, review note or report) \u2014 the general OSS-observable analogue of human-gating changes to sensitive paths."
       ),
       ...killSwitchMetrics
     ],
@@ -5929,6 +6016,19 @@ function isTestFile(file, rubricVersion = WITAN_RUBRIC_VERSION) {
 }
 var NAME_SHAPED_TEST_FILE_PATTERN = /^test(?:-[^/]+)?\.[cm]?[jt]sx?$|\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)__tests__\/|(^|\/)test_[^/]*\.py$|(^|\/)tests?\.py$|_test\.go$|(^|\/)test_[^/]*\.(cpp|cc|cxx)$|_(test|tests)\.(cpp|cc|cxx)$|Tests?\.(java|kt)$|(_test|_spec)\.(rs|rb|php|swift|kt)$/;
 var NAME_SHAPED_TEST_FILE_PATTERN_V17 = /\.tftest\.hcl$|\.bats$|(^|\/)test[^/]*\.m$|_test\.m$/i;
+var CALIBRATION_RECORD_DIR_PATTERN = /(^|\/)calibrations?(\/|$)/i;
+function isImplementationEvidencePath(path) {
+  return isProductionSourcePath(path) && !CALIBRATION_RECORD_DIR_PATTERN.test(path);
+}
+var CHANGELOG_FILE_PATTERN = /(^|\/)(?:CHANGELOG|CHANGES|HISTORY|NEWS|RELEASE[-_]?NOTES|RELEASES)(?:\.[^/]*)?$/i;
+var NON_POLICY_RECORD_DIR_PATTERN = /(^|\/)(?:\.changesets?|changelogs?|changelog\.d|experiments?|calibrations?|reviews|review[-_]notes?|reports)(\/|$)/i;
+function isPolicyDocumentEvidencePath(path) {
+  return isProductionSourcePath(path) && !CHANGELOG_FILE_PATTERN.test(path) && !NON_POLICY_RECORD_DIR_PATTERN.test(path);
+}
+var CEJEL_CERTIFICATE_TEXT_PATTERN = /^# Cejel Trust Report\b[\s\S]*?^- Rubric: /m;
+function isCejelCertificateText(repoPath, file) {
+  return fileContains(repoPath, file, CEJEL_CERTIFICATE_TEXT_PATTERN);
+}
 var TEST_RUNNER_PATTERN = /\b(vitest|jest|mocha|ava|tap|pytest|go test|cargo test|rspec|phpunit|gradle test|mvn test|node\s+--test|node:test)\b/i;
 function hasCredibleTestScript(scripts) {
   const script = scripts.get("test");
@@ -5980,6 +6080,7 @@ function fileHasV21RawSqlEscalation(repoPath, file) {
 var GATED_PRIVILEGE_CHECK_PATTERN = /pg_has_role\s*\(|has_role\s*\(|is not a member of/i;
 var SET_ROLE_PATTERN = /\bset\s+(local\s+)?role\b/i;
 var REQUIRED_REVIEW_PATTERN = /required review|branch protection|protected branch/i;
+var GITHUB_CODEOWNERS_PATH_PATTERN = /^(?:\.github\/|docs\/)?CODEOWNERS$/;
 var HISTORY_SECRET_SCAN_CREDENTIAL_BLOB_LIMIT = 5e3;
 var V23_PEM_WIDENED_HISTORY_BLOB_LIMIT = 500;
 var SECRET_IDENTIFIER_KEYWORD_PATTERN = /secret|token|api[_-]?key|password|access[_-]?key/gi;
@@ -5996,7 +6097,7 @@ var HEAVY_TEST_DEPENDENCY_NAME_PATTERN = /^(?:(?:jest|mocha|ava|tape|jasmine|kar
 var TIMING_SAFE_COMPARE_PATTERN = /\btiming[-_]?safe[-_]?(?:equal|compare)\b|crypto\.timingSafeEqual\s*\(/i;
 var CANONICAL_SERIALIZE_PATTERN = /\bcanonicalize\s*\(|\bcanonicalJson\b|\bstableStringify\s*\(|json-stable-stringify|safe-stable-stringify|\bsortKeys\s*\(/i;
 var SIGN_OR_HMAC_CALL_PATTERN = /\bcreateHmac\s*\(|\bcreateSign\s*\(|\.sign\s*\(/;
-var INSECURE_SECRET_COMPARE_LINE_PATTERN = /\b\w*(?:hmac|signature|\bmac|digest)\w*\s*(===|!==)\s*(?!['"`]|undefined\b|null\b)([\w.]+(?:\s*[-+]\s*\d+)?)/i;
+var INSECURE_SECRET_COMPARE_LINE_PATTERN = /\b\w*(?:hmac|signature|\bmac)\w*\s*(===|!==)\s*(?!['"`]|undefined\b|null\b)([\w.]+(?:\s*[-+]\s*\d+)?)/i;
 var DEFAULT_SECRET_SENTINEL_COMPARE_LINE_PATTERN = /\b(?:secret|token|password|apiKey)\w*\s*(?:===|!==|==|!=)\s*[\w.]*default(?:Secret|Token|Password|ApiKey)\b/i;
 var NUMERIC_SHAPED_OPERAND_PATTERN = /^-?\d+$|\.(?:length|len|size|count)\b|(?:length|index|idx|offset|count|size|len)$/i;
 function lineHasInsecureSecretCompare(line, useV39Detectors = false) {
@@ -6390,6 +6491,81 @@ var JS_TEST_ASSERTION_PATTERN = /(expect\(|assert\.|should\.|toEqual\(|toBe\(|as
 var CPP_TEST_ASSERTION_PATTERN = /\bEXPECT_|ASSERT_EQ\b|ASSERT_TRUE\b|ASSERT_FALSE\b|\bREQUIRE\s*\(|\bCHECK\s*\(|\bTEST\s*\(|\bTEST_F\s*\(|\bTEST_CASE\s*\(|\bSECTION\s*\(/;
 var MULTI_ECOSYSTEM_TEST_ASSERTION_PATTERN = /\.assert[A-Z_]\w*\s*\(|\bassert[A-Z]\w*\s*\(|\bpytest\.raises\b|\bself\.fail\s*\(|\bt\.(?:Error|Errorf|Fatal|Fatalf|Fail|FailNow)\b|\brequire\.[A-Z]\w*\s*\(|\b(?:debug_)?assert(?:_eq|_ne)?!\s*\(|\bassert_\w+\b|\$this->assert\w+\s*\(/;
 var SUITE_LEVEL_SKIP_PATTERN = /\b(?:describe|suite|context)\.skip\s*\(/;
+function hasLiveAvaAssertion(contents) {
+  const uncommented = stripJavaScriptComments(contents);
+  const imports = [...uncommented.matchAll(/\bimport\s+([A-Za-z_$][\w$]*)\s+from\s*['"]ava['"]|\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\s*\(\s*['"]ava['"]\s*\)/g)];
+  if (!imports.length) return false;
+  let quote = "";
+  let escaped = false;
+  const characters = uncommented.split("");
+  for (let i = 0; i < characters.length; i += 1) {
+    const ch = characters[i];
+    if (quote) {
+      characters[i] = ch === "\n" ? "\n" : " ";
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === quote) quote = "";
+    } else if (ch === "'" || ch === '"' || ch === "`") {
+      quote = ch;
+      characters[i] = " ";
+    }
+  }
+  const code = characters.join("");
+  const imported = imports.find((candidate) => code[candidate.index] === uncommented[candidate.index]);
+  const runner = imported?.[1] ?? imported?.[2];
+  if (!runner) return false;
+  const escape = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const calls = new RegExp(`\\b${escape(runner)}((?:\\.\\w+)*)\\s*\\(`, "g");
+  const closeAt = (open, left, right) => {
+    let depth = 1;
+    for (let i = open + 1; i < code.length; i += 1) {
+      if (code[i] === left) depth += 1;
+      else if (code[i] === right && --depth === 0) return i;
+    }
+    return -1;
+  };
+  for (const call of code.matchAll(calls)) {
+    const modifiers = call[1].split(".").filter(Boolean);
+    if (modifiers.some((modifier) => !["serial", "only", "failing"].includes(modifier))) continue;
+    const open = call.index + call[0].length - 1;
+    const close = closeAt(open, "(", ")");
+    if (close < 0) continue;
+    const args = code.slice(open + 1, close);
+    const callback = /(?:\basync\s+)?(?:\(\s*([A-Za-z_$][\w$]*)\s*\)|(?<![\w$])([A-Za-z_$][\w$]*))\s*=>|\bfunction(?:\s+\w+)?\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/.exec(args);
+    const parameter = callback?.[1] ?? callback?.[2] ?? callback?.[3];
+    if (!callback || !parameter) continue;
+    let start = open + 1 + callback.index + callback[0].length;
+    while (/\s/.test(code[start] ?? "") && start < close) start += 1;
+    const end = code[start] === "{" ? closeAt(start, "{", "}") : close;
+    if (end < 0 || end > close) continue;
+    const assertion = new RegExp(`\\b${escape(parameter)}\\.(?:assert|pass|fail|truthy|falsy|true|false|is|not|deepEqual|notDeepEqual|throws|throwsAsync|notThrows|notThrowsAsync|regex|notRegex|snapshot|like)\\s*\\(`);
+    const body = code.slice(start, end);
+    const active = body.split("");
+    let maskedThrough = -1;
+    for (const nested of body.matchAll(/=>\s*|\bfunction(?:\s+\w+)?\s*\([^)]*\)\s*/g)) {
+      if (nested.index < maskedThrough) continue;
+      const begin = nested.index + nested[0].length;
+      let stop = begin;
+      if (body[begin] === "{") {
+        stop = closeAt(start + begin, "{", "}") - start + 1;
+      } else {
+        let depth = 0;
+        while (stop < body.length) {
+          const ch = body[stop];
+          if (depth === 0 && /[;,)]/.test(ch)) break;
+          if (ch === "(" || ch === "[") depth += 1;
+          else if (ch === ")" || ch === "]") depth -= 1;
+          stop += 1;
+        }
+      }
+      if (stop <= begin) continue;
+      for (let i = nested.index; i < Math.min(stop, active.length); i += 1) active[i] = " ";
+      maskedThrough = stop;
+    }
+    if (assertion.test(active.join(""))) return true;
+  }
+  return false;
+}
 function measureNonHollowTestShare(repoPath, files, useV17Detectors = false) {
   let nonHollowCount = 0;
   let ratedCount = 0;
@@ -6397,7 +6573,7 @@ function measureNonHollowTestShare(repoPath, files, useV17Detectors = false) {
     const fullPath = join(repoPath, file);
     if (!isRegularFile(fullPath)) continue;
     const contents = readRepoText(fullPath, "utf8");
-    const nonHollow = (JS_TEST_ASSERTION_PATTERN.test(contents) || CPP_TEST_ASSERTION_PATTERN.test(contents) || MULTI_ECOSYSTEM_TEST_ASSERTION_PATTERN.test(contents)) && !SUITE_LEVEL_SKIP_PATTERN.test(contents);
+    const nonHollow = (JS_TEST_ASSERTION_PATTERN.test(contents) || CPP_TEST_ASSERTION_PATTERN.test(contents) || MULTI_ECOSYSTEM_TEST_ASSERTION_PATTERN.test(contents) || hasLiveAvaAssertion(contents)) && !SUITE_LEVEL_SKIP_PATTERN.test(contents);
     if (nonHollow) {
       nonHollowCount += 1;
       ratedCount += 1;
@@ -8035,9 +8211,11 @@ var RACK_ENTRYPOINT_FILE_PATTERN = /(^|\/)(?:config\.ru|(?:main|server|app|start
 var SERVER_ENTRYPOINT_PATTERN = /\bapp\.listen\s*\(|\bserver\.listen\s*\(\s*(?:PORT|port|\d+)|http\.ListenAndServe\s*\(|http\.ListenAndServeTLS\s*\(|axum::Server(?:::|\.)|actix_web::HttpServer(?:::|\.)|uvicorn\.run\s*\(/;
 var V20_DIRECT_HTTP_SERVER_PATTERN = /\b(?:http|https)\.createServer\s*\([\s\S]{0,1500}?\)\.listen\s*\(\s*(?:PORT|port|\d+)/;
 var HEALTH_ROUTE_FUNCTIONS_DIR_PATTERN = /(^|\/)functions\/.*\.(?:ts|tsx|js|jsx|py|go|rs|java|rb|cpp|cc|cxx|c|h|hpp|kt|swift|php)$/;
+var HEALTH_ROUTE_ENTRYPOINT_HOME_PATTERN = /^(?:(?:server|index|app|main)\.(?:ts|tsx|js|jsx|mjs|cjs)|(?:server|backend|api)\/.*\.(?:ts|tsx|js|jsx|mjs|cjs|py|go|rs|java|rb|php))$/;
 var V20_HEALTH_OR_READINESS_ROUTE_PATTERN = /["'`](?:[\w${}./-]{0,60}\/[_-]?(?:(?:health|ready|live)z?|readiness|liveness|up)(?=["'`/])|(?:healthz|readiness|liveness)(?=["'`]))|@Get\s*\(\s*(["'`])health\1\s*\)/i;
-var EXPRESS_ERROR_MIDDLEWARE_PATTERN = /\(\s*(?:_?err|_?error)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*(?:req|request)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*(?:res|response)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*_?next(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*\)\s*(?:=>|\{)/i;
+var EXPRESS_ERROR_MIDDLEWARE_PATTERN = /\(\s*(?:_?err|_?error)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*_?(?:req|request)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*_?(?:res|response)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*_?next(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,?\s*\)\s*(?:=>|\{)/i;
 var EXPRESS_MIDDLEWARE_REACHABLE_PATTERN = /\.use\s*\(|\bmodule\.exports\b|\bexport\s+(?:default\b|function\b|const\b|class\b)/;
+var ERROR_BOUNDARY_FILENAME_PATTERN = /(^|\/)(?:error-boundary|error)\.(?:tsx|jsx|ts|js)$/;
 var RACK_SERVER_ENTRYPOINT_PATTERN = /Rack::(?:Server|Handler(?:::\w+)?)\.(?:start|run)\s*\(/;
 var RACK_CONFIG_RUN_PATTERN = /^\s*run\s+(?:(?:[A-Z]\w*(?:::\w+)*(?:\.new)?|lambda)\b|->)/m;
 var RUNTIME_CONTAINER_COMMAND_PATTERN = /^\s*(?:CMD|ENTRYPOINT)\s+.*(?:\b(?:start|serve|server|qgis|nginx|apache|gunicorn|uvicorn)\b|manage\.py\s+runserver).*$/im;
@@ -8220,6 +8398,36 @@ function isV24IgnoredScanFile(file) {
 function findRootPackageJson(repoFiles) {
   return repoFiles.includes("package.json") ? "package.json" : null;
 }
+function ciWorkflowCitationLabel(baseLabel, verb, considered, cited, unread) {
+  const unreadTotal = [...unread.values()].reduce((sum, count) => sum + count, 0);
+  if (considered <= cited && unreadTotal === 0) return baseLabel;
+  const parts = [
+    `${considered} workflow file${considered === 1 ? "" : "s"} ${verb}`,
+    `${cited} cited`
+  ];
+  if (unreadTotal > 0) {
+    const reasons = [...unread.keys()].sort().join(", ");
+    parts.push(`${unreadTotal} not read (${reasons})`);
+  }
+  return `${baseLabel} (${parts.join("; ")})`;
+}
+function unreadCiWorkflowReasons(includes) {
+  const unread = /* @__PURE__ */ new Map();
+  for (const { path, reasons } of withheldRepoPaths()) {
+    if (!isCiWorkflow(path) || !includes(path)) continue;
+    const reason = [...reasons].sort()[0];
+    if (reason !== void 0) unread.set(reason, (unread.get(reason) ?? 0) + 1);
+  }
+  return unread;
+}
+function rootOnlyPackageScriptsDisclosure(repoFiles, rootPackageJson) {
+  const others = repoFiles.filter(
+    (file) => file !== rootPackageJson && /(^|\/)package\.json$/.test(file) && isAuthoredProductionPath(file)
+  ).length;
+  if (others === 0) return null;
+  const present = `${others}${rootPackageJson ? " other" : ""} package.json file${others === 1 ? "" : "s"} present`;
+  return `${rootPackageJson ? "" : "no root package.json found; "}package scripts for this metric are read from the root package.json only; ${present}`;
+}
 function isRegularFile(path) {
   try {
     return lstatSync(path).isFile();
@@ -8232,11 +8440,22 @@ function fileContains(repoPath, file, pattern) {
   if (!isRegularFile(fullPath)) return false;
   return pattern.test(readRepoText(fullPath, "utf8"));
 }
-function fileMatchesOutsideLineComments(repoPath, file, pattern) {
+var HASH_COMMENT_SOURCE_PATTERN = /\.(?:py|rb)$/i;
+function stripCodeComments(file, contents) {
+  const withoutComments = contents.replace(/\/\*[\s\S]*?\*\//g, (block) => block.replace(/[^\n]/g, "")).replace(/(?<!:)\/\/.*$/gm, "");
+  return HASH_COMMENT_SOURCE_PATTERN.test(file) ? withoutComments.replace(/^[ \t]*#.*$/gm, "") : withoutComments;
+}
+function fileMatchesOutsideComments(repoPath, file, pattern) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return false;
-  const withoutLineComments = readRepoText(fullPath, "utf8").replace(/(?<!:)\/\/.*$/gm, "");
-  return pattern.test(withoutLineComments);
+  return pattern.test(stripCodeComments(file, readRepoText(fullPath, "utf8")));
+}
+function findFirstMatchingLineOutsideComments(repoPath, file, pattern) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return null;
+  const lines = stripCodeComments(file, readRepoText(fullPath, "utf8")).split("\n");
+  const index = lines.findIndex((line) => pattern.test(line));
+  return index === -1 ? null : index + 1;
 }
 var PEM_PRIVATE_KEY_ASSIGNMENT_PATTERN = /(?:["'])?([A-Za-z_$][\w$.-]*)(?:["'])?\s*[:=]\s*(?:\|[-+0-9]*\s*\r?\n[ \t]*)?["'`]?-----BEGIN((?: (?:RSA|DSA|EC|OPENSSH|ENCRYPTED))? PRIVATE KEY)-----([\s\S]{0,32768}?)-----END\2-----/g;
 var BARE_PEM_PRIVATE_KEY_PATTERN = /["'`]?-----BEGIN((?: (?:RSA|DSA|EC|OPENSSH|ENCRYPTED))? PRIVATE KEY)-----([\s\S]{0,32768}?)-----END\1-----/g;

package/dist/{chunk-QDP7QWA7.js → chunk-HC2WASRS.js}

@@ -5,7 +5,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "./chunk-KG62JCJZ.js";
+} from "./chunk-4YK23CST.js";
 import {
   ZodFirstPartyTypeKind,
   ZodOptional,

package/dist/index.js

@@ -3,7 +3,7 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   serveCejelMcpOverStdio
-} from "./chunk-QDP7QWA7.js";
+} from "./chunk-HC2WASRS.js";
 import {
   CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE,
   CERTIFICATE_GLOSSARY,
@@ -29,7 +29,7 @@ import {
   runCejelScan,
   serializeWitanReport,
   verifyWitanAttestationBinding
-} from "./chunk-KG62JCJZ.js";
+} from "./chunk-4YK23CST.js";
 import "./chunk-63XQDYQ5.js";
 import {
   external_exports
@@ -42,7 +42,7 @@ import {
 init_esm_shims();
 import { createHash as createHash3 } from "crypto";
 import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "fs";
-import { dirname, join, resolve } from "path";
+import { dirname, join, resolve as resolve2 } from "path";
 import { fileURLToPath, pathToFileURL } from "url";
 
 // src/issuance/index.ts
@@ -541,6 +541,43 @@ function renderGitLabCodeQualityFooter(result) {
 `;
 }
 
+// src/npx-version-guard.ts
+init_esm_shims();
+import { delimiter, resolve } from "path";
+var EXACT_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+function npxVersionMismatchWarning(context) {
+  const { env, packageName, runningVersion, runningPath } = context;
+  if (env.npm_lifecycle_event !== "npx") return void 0;
+  if (env.npm_config_call) return void 0;
+  const pinned = exactPackageSpecVersion(env.npm_config_package, packageName);
+  if (pinned !== void 0) {
+    if (pinned === runningVersion) return void 0;
+    return `warning: npx was asked for ${packageName}@${pinned}, but cejel ${runningVersion} is running from ${runningPath}. Inside a ${packageName} checkout, npx can run the cejel on PATH; run it from another directory (#436).`;
+  }
+  const requested = env.npm_package_version;
+  if (env.npm_package_name !== packageName || !requested) return void 0;
+  if (!resolvedToLocalTree(env, context.cwd)) return void 0;
+  if (requested === runningVersion) return void 0;
+  const checkout = env.npm_config_local_prefix || context.cwd;
+  return `warning: npx resolved ${packageName} to the ${requested} checkout at ${checkout} and ran the cejel on PATH instead: cejel ${runningVersion} from ${runningPath}. Run npx from another directory to get the version you asked for (#436).`;
+}
+function exactPackageSpecVersion(packageSpecs, packageName) {
+  if (!packageSpecs) return void 0;
+  const prefix = `${packageName}@`;
+  for (const spec of packageSpecs.split(/\n+/)) {
+    const trimmed = spec.trim();
+    if (!trimmed.startsWith(prefix)) continue;
+    const version = trimmed.slice(prefix.length);
+    if (EXACT_VERSION_PATTERN.test(version)) return version;
+  }
+  return void 0;
+}
+function resolvedToLocalTree(env, cwd) {
+  const pathKey = Object.keys(env).find((key) => /^path$/i.test(key) && env[key]);
+  const first = pathKey ? env[pathKey]?.split(delimiter)[0] : void 0;
+  return first !== void 0 && first === resolve(cwd, "node_modules", ".bin");
+}
+
 // src/terminal.ts
 init_esm_shims();
 function renderMinScoreAbstentionFailure(summary, minScore) {
@@ -862,8 +899,29 @@ async function main() {
   process.exitCode = exitCode;
 }
 async function runWitanFreeCli(args) {
+  warnIfNpxRanAnotherVersion();
   return runWitanCli(args);
 }
+function warnIfNpxRanAnotherVersion() {
+  const warning = npxVersionMismatchWarning({
+    env: process.env,
+    cwd: process.cwd(),
+    packageName: NPX_PACKAGE_NAME,
+    runningVersion: cliVersion(),
+    runningPath: runningEntryPath()
+  });
+  if (warning) process.stderr.write(`${warning}
+`);
+}
+function runningEntryPath() {
+  const invokedPath = process.argv[1];
+  if (!invokedPath) return process.execPath;
+  try {
+    return realpathSync(invokedPath);
+  } catch {
+    return invokedPath;
+  }
+}
 async function runWitanV22CalibrationCli(args) {
   return runWitanCli(args, WITAN_RUBRIC_VERSION_V22);
 }
@@ -1039,8 +1097,8 @@ function parseExportArgs(args) {
   return {
     command: "export",
     format,
-    reportPath: resolve(reportPath),
-    outPath: resolve(outPath)
+    reportPath: resolve2(reportPath),
+    outPath: resolve2(outPath)
   };
 }
 function runExport(invocation) {
@@ -1074,8 +1132,8 @@ function parseVerifyArgs(args) {
     if (arg === "--signers" || arg === "--revocations") {
       const value = args[index + 1];
       if (!value) throw new Error(`Missing value for ${arg}`);
-      if (arg === "--signers") signersPath = resolve(value);
-      else revocationsPath = resolve(value);
+      if (arg === "--signers") signersPath = resolve2(value);
+      else revocationsPath = resolve2(value);
       index += 1;
       continue;
     }
@@ -1087,10 +1145,10 @@ function parseVerifyArgs(args) {
   if (!reportPath || !attestationPath) throw new Error(VERIFY_USAGE());
   return {
     command: "verify",
-    reportPath: resolve(reportPath),
-    attestationPath: resolve(attestationPath),
-    ...issuancePath ? { issuancePath: resolve(issuancePath) } : {},
-    ...issuanceSignaturePath ? { issuanceSignaturePath: resolve(issuanceSignaturePath) } : {},
+    reportPath: resolve2(reportPath),
+    attestationPath: resolve2(attestationPath),
+    ...issuancePath ? { issuancePath: resolve2(issuancePath) } : {},
+    ...issuanceSignaturePath ? { issuanceSignaturePath: resolve2(issuanceSignaturePath) } : {},
     ...signersPath ? { signersPath } : {},
     ...revocationsPath ? { revocationsPath } : {}
   };
@@ -1116,15 +1174,15 @@ function parseIssueArgs(args) {
     if (arg === void 0) continue;
     switch (arg) {
       case "--report":
-        reportPath = resolve(takeValue(arg, index + 1));
+        reportPath = resolve2(takeValue(arg, index + 1));
         index += 1;
         continue;
       case "--attestation":
-        attestationPath = resolve(takeValue(arg, index + 1));
+        attestationPath = resolve2(takeValue(arg, index + 1));
         index += 1;
         continue;
       case "--key":
-        keyPath = resolve(takeValue(arg, index + 1));
+        keyPath = resolve2(takeValue(arg, index + 1));
         index += 1;
         continue;
       case "--engagement-ref":
@@ -1133,7 +1191,7 @@ function parseIssueArgs(args) {
         continue;
       case "--out":
       case "--out-dir":
-        outDir = resolve(takeValue(arg, index + 1));
+        outDir = resolve2(takeValue(arg, index + 1));
         index += 1;
         continue;
       case "--product-name":
@@ -1177,7 +1235,7 @@ function parseIssueArgs(args) {
     throw new Error("--product-name and --name cannot be used together");
   }
   return {
-    repoPath: resolve(repoPath ?? "."),
+    repoPath: resolve2(repoPath ?? "."),
     reportPath,
     attestationPath,
     keyPath,
@@ -1530,7 +1588,7 @@ function parseArgs(args) {
     throw new Error("--product-name and --name cannot be used together");
   }
   return {
-    repoPath: resolve(repoPath ?? "."),
+    repoPath: resolve2(repoPath ?? "."),
     outDir,
     ...minScore != null ? { minScore } : {},
     ...productName ? { productName } : {},

package/dist/mcp/index.js

@@ -3,8 +3,8 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   serveCejelMcpOverStdio
-} from "../chunk-QDP7QWA7.js";
-import "../chunk-KG62JCJZ.js";
+} from "../chunk-HC2WASRS.js";
+import "../chunk-4YK23CST.js";
 import "../chunk-63XQDYQ5.js";
 import "../chunk-FSMZV3Y6.js";
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.6.2",
+  "version": "0.6.4",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {