@cejel/cejel 0.6.3 → 0.6.5

package/README.md

@@ -92,7 +92,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.6.3 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.6.5 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM (the packages
@@ -116,7 +116,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.6.3` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.6.5` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry. A GitLab CI
 > template and Code Quality export live in [`docs/gitlab-ci.md`](./docs/gitlab-ci.md).
 
@@ -187,16 +187,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.6.3`:
+**Docker / OCI.** The current container release is `0.6.5`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.6.3
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.6.5
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.6.3 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.6.5 .
 ```
 
 The OCI image carries an SBOM of its base-image packages, maximum-mode build provenance, and a
@@ -299,8 +299,12 @@ prints that boundary on every successful verification.
 - `--rubric-pin <version>` — Explicit opt-in only: pin an alternate rubric instead of the
   calibrated public default. It
   accepts the calibrated version or any published prospective rubric
-  (`witan-rubric-v18-prospective-*` through `v23`) and fails closed, naming what was accepted, on
-  anything else. `v23` is prospective and uncalibrated, like every rubric after v17: the public
+  (`witan-rubric-v18-prospective-*` through `v26`) and fails closed, naming what was accepted, on
+  anything else. `v26` (`witan-rubric-v26-prospective-2026-10-14`) is prospective and uncalibrated:
+  it is the next calibration candidate, inherits v25 complete, inherits neither v23 nor v24, and
+  today scores exactly as v25 does. `v25` is prospective and uncalibrated: it inherits v22 and adds only credit for a
+  health or readiness route declared inline in an application file (see "What counts as a health or
+  readiness signal" below). `v23` is prospective and uncalibrated, like every rubric after v17: the public
   default (`WITAN_LAST_CALIBRATED_RUBRIC_VERSION`) is still `witan-rubric-v17-2026-07-24`, and v23
   inherits none of v17's precision, recall, or false-positive-rate figures. It inherits v22
   detector/scoring behavior and adds bounded A1 coverage-flag recognition (#276) plus per-signal
@@ -567,7 +571,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.6.3"]}'
+npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.6.5"]}'
 npx -y openclaw@latest mcp doctor cejel-oci --probe
 ```
 
@@ -635,6 +639,27 @@ belongs to:
   `test` script's content against known test-runner invocations rather than crediting it by key
   presence alone, so no separate disclosure line is needed for it.
 
+### What counts as a health or readiness signal
+
+The "health or readiness signal" component of A3's production-readiness checks is filename-based
+by design under the calibrated rubric (and every prospective rubric before `v25`). It is credited
+for exactly these forms:
+
+- a dedicated health or readiness file, such as `health.ts`, `healthcheck.js`, `readiness.py`
+  (the file must mention health or readiness);
+- a `HEALTHCHECK` instruction in a root `Dockerfile`;
+- Kubernetes liveness or readiness probes in a `k8s/`, `kubernetes/` or `helm/` manifest.
+
+**A route declared inline in an application file does not count under the calibrated rubric**,
+whatever its content: `app.get("/health", ...)` in `server.ts` or `app.ts` earns nothing there,
+because the component never reads route text. The certificate states this next to the component.
+Prospective `witan-rubric-v25-prospective-2026-10-12`, and `witan-rubric-v26-prospective-2026-10-14`
+which inherits it, are the only rubrics that also credit an inline route, in the files the separate info-level "no health or readiness route" finding already reads
+(under `src/`, `app/`, `lib/`, `packages/`, `functions/`, a repo-root `server`/`index`/`app`/`main`
+file, or a `server/`, `backend/` or `api/` tree), with comments stripped and tests, docs, examples
+and scripts excluded. Both are explicit opt-in (`--rubric-pin`), carry no precision or recall
+claim, and have had no public paired rescore.
+
 ## Help validate Cejel
 
 Cejel does not collect telemetry. External validation is therefore opt-in and inspectable:

package/dist/calibration/llm-detector.js

@@ -5,7 +5,7 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-FA72HEWJ.js";
+} from "../chunk-7XQVE76B.js";
 import {
   listCejelLlmPackFiles
 } from "../chunk-M6YYPJSN.js";

package/dist/{chunk-KAMWXGY7.js → chunk-35TRRAEC.js}

@@ -5,7 +5,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "./chunk-FA72HEWJ.js";
+} from "./chunk-7XQVE76B.js";
 import {
   ZodFirstPartyTypeKind,
   ZodOptional,