@cejel/cejel 0.6.4 → 0.6.5

package/README.md

@@ -92,7 +92,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.6.4 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.6.5 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM (the packages
@@ -116,7 +116,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.6.4` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.6.5` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry. A GitLab CI
 > template and Code Quality export live in [`docs/gitlab-ci.md`](./docs/gitlab-ci.md).
 
@@ -187,16 +187,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.6.4`:
+**Docker / OCI.** The current container release is `0.6.5`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.6.4
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.6.5
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.6.4 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.6.5 .
 ```
 
 The OCI image carries an SBOM of its base-image packages, maximum-mode build provenance, and a
@@ -299,8 +299,10 @@ prints that boundary on every successful verification.
 - `--rubric-pin <version>` — Explicit opt-in only: pin an alternate rubric instead of the
   calibrated public default. It
   accepts the calibrated version or any published prospective rubric
-  (`witan-rubric-v18-prospective-*` through `v25`) and fails closed, naming what was accepted, on
-  anything else. `v25` is prospective and uncalibrated: it inherits v22 and adds only credit for a
+  (`witan-rubric-v18-prospective-*` through `v26`) and fails closed, naming what was accepted, on
+  anything else. `v26` (`witan-rubric-v26-prospective-2026-10-14`) is prospective and uncalibrated:
+  it is the next calibration candidate, inherits v25 complete, inherits neither v23 nor v24, and
+  today scores exactly as v25 does. `v25` is prospective and uncalibrated: it inherits v22 and adds only credit for a
   health or readiness route declared inline in an application file (see "What counts as a health or
   readiness signal" below). `v23` is prospective and uncalibrated, like every rubric after v17: the public
   default (`WITAN_LAST_CALIBRATED_RUBRIC_VERSION`) is still `witan-rubric-v17-2026-07-24`, and v23
@@ -569,7 +571,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.6.4"]}'
+npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.6.5"]}'
 npx -y openclaw@latest mcp doctor cejel-oci --probe
 ```
 
@@ -651,12 +653,12 @@ for exactly these forms:
 **A route declared inline in an application file does not count under the calibrated rubric**,
 whatever its content: `app.get("/health", ...)` in `server.ts` or `app.ts` earns nothing there,
 because the component never reads route text. The certificate states this next to the component.
-Prospective `witan-rubric-v25-prospective-2026-10-12` is the one rubric that also credits an inline
-route, in the files the separate info-level "no health or readiness route" finding already reads
+Prospective `witan-rubric-v25-prospective-2026-10-12`, and `witan-rubric-v26-prospective-2026-10-14`
+which inherits it, are the only rubrics that also credit an inline route, in the files the separate info-level "no health or readiness route" finding already reads
 (under `src/`, `app/`, `lib/`, `packages/`, `functions/`, a repo-root `server`/`index`/`app`/`main`
 file, or a `server/`, `backend/` or `api/` tree), with comments stripped and tests, docs, examples
-and scripts excluded. It is explicit opt-in (`--rubric-pin`), carries no precision or recall claim,
-and its public paired rescore has not run.
+and scripts excluded. Both are explicit opt-in (`--rubric-pin`), carry no precision or recall
+claim, and have had no public paired rescore.
 
 ## Help validate Cejel
 

package/dist/calibration/llm-detector.js

@@ -5,7 +5,7 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-4YK23CST.js";
+} from "../chunk-7XQVE76B.js";
 import {
   listCejelLlmPackFiles
 } from "../chunk-M6YYPJSN.js";

package/dist/{chunk-HC2WASRS.js → chunk-35TRRAEC.js}

@@ -5,7 +5,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "./chunk-4YK23CST.js";
+} from "./chunk-7XQVE76B.js";
 import {
   ZodFirstPartyTypeKind,
   ZodOptional,