@cejel/cejel 0.6.7 → 0.6.8

package/dist/{chunk-ZZHQZW26.js → chunk-KJVFCZZ3.js}

@@ -5,16 +5,17 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-VGBFZBZQ.js";
+} from "./chunk-NIWSYJ6N.js";
 import {
   external_exports
-} from "./chunk-FSMZV3Y6.js";
+} from "./chunk-AMVP7L26.js";
 import {
   MAX_REPOSITORY_CONTENT_BYTES,
   abstainSignalOnWithheldPaths,
   classifyAbstentionReason,
   contentReadSignalKey,
   init_esm_shims,
+  isGitLfsPointerText,
   readRepoText,
   readRepoTextPrefix,
   recordContentSkip,
@@ -24,8 +25,9 @@ import {
   withContentReadCriterion,
   withContentReadSignal,
   withContentReadSignals,
-  withheldRepoPaths
-} from "./chunk-O3MHSK25.js";
+  withheldRepoPaths,
+  withoutContentReadAttribution
+} from "./chunk-AWLKQUI4.js";
 
 // src/witan/schemas.ts
 init_esm_shims();
@@ -174,14 +176,18 @@ var WitanContentReadSkipReasonSchema = external_exports.enum([
   "too_large",
   "excluded_by_extension",
   "denied_path",
-  "non_regular_file"
+  "non_regular_file",
+  // Additive, report format 1.6 (#519): the checkout held a Git LFS pointer in place of content.
+  "lfs_pointer"
 ]);
+var WitanCriterionDisclosuresSchema = external_exports.array(external_exports.string().min(1).max(1e3)).min(1).max(4);
 var WitanCriterionSignalSchema = external_exports.object({
   criterionId: WitanCriterionIdSchema,
   positiveEvidence: external_exports.array(WitanEvidencePointerSchema).default([]),
   findings: external_exports.array(WitanFindingSchema).default([]),
   metrics: external_exports.array(WitanCriterionMetricSchema).default([]),
   notes: external_exports.string().min(1).max(1e3).optional(),
+  disclosures: WitanCriterionDisclosuresSchema.optional(),
   notApplicable: external_exports.literal(true).optional(),
   // A collector reached relevant files but could not read their contents. This is a
   // measurement gap, never negative evidence: scoreCriterion maps it to insufficient_data.
@@ -206,12 +212,18 @@ var WitanContentReadSummarySchema = external_exports.object({
     tooLarge: external_exports.number().int().nonnegative(),
     excludedByExtension: external_exports.number().int().nonnegative(),
     deniedPath: external_exports.number().int().nonnegative(),
-    nonRegularFile: external_exports.number().int().nonnegative()
+    nonRegularFile: external_exports.number().int().nonnegative(),
+    // Additive-optional, report format 1.6 (#519): files whose checkout held a Git LFS pointer
+    // in place of their content. Present only when non-zero.
+    lfsPointer: external_exports.number().int().positive().optional()
   }).strict(),
   unreadableByErrno: external_exports.record(external_exports.string().min(1).max(32), external_exports.number().int().positive()),
   affectedCriteria: external_exports.array(WitanCriterionIdSchema)
 }).strict().superRefine((summary, context) => {
-  const reasonTotal = Object.values(summary.byReason).reduce((sum, count) => sum + count, 0);
+  const reasonTotal = Object.values(summary.byReason).reduce(
+    (sum, count) => sum + (count ?? 0),
+    0
+  );
   if (reasonTotal !== summary.skipped) {
     context.addIssue({
       code: external_exports.ZodIssueCode.custom,
@@ -266,11 +278,17 @@ var WitanCriterionScoreSchema = external_exports.object({
   category: WitanCriterionCategorySchema,
   score: external_exports.number().min(0).max(4),
   nativeScore: external_exports.number().min(0).max(4).optional(),
+  // Additive-optional (report format 1.7): the status the native evidence alone produced, set
+  // beside nativeScore whenever ingested signals adjusted this criterion. When it differs from
+  // `status`, imported evidence moved the status; a reader must not take the moved status as a
+  // native Cejel finding. Absent when no ingested signal adjusted the criterion.
+  nativeStatus: WitanCriterionStatusSchema.optional(),
   status: WitanCriterionStatusSchema,
   evidence: external_exports.array(WitanEvidencePointerSchema),
   findings: external_exports.array(WitanFindingSchema),
   metrics: external_exports.array(WitanCriterionMetricSchema).default([]),
-  notes: external_exports.string().min(1).max(1e3).optional()
+  notes: external_exports.string().min(1).max(1e3).optional(),
+  disclosures: WitanCriterionDisclosuresSchema.optional()
 }).strict();
 var WitanInputSignalFindingSchema = external_exports.object({
   ruleId: external_exports.string().min(1).max(200),
@@ -309,6 +327,62 @@ var WitanConsumedSignalSummarySchema = external_exports.object({
   // this field always carries every finding.
   findings: external_exports.array(WitanInputSignalFindingSchema).default([])
 }).strict();
+var WitanInputBindingStatusSchema = external_exports.enum([
+  "matched",
+  "mismatched-repository",
+  "mismatched-commit",
+  "stale",
+  "unbound",
+  "unverifiable"
+]);
+var WitanInputBindingCheckSchema = external_exports.enum(["matched", "mismatched", "absent", "unverifiable"]);
+var WitanInputBindingRecordSchema = external_exports.object({
+  sha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
+  format: external_exports.enum(["sarif", "scorecard", "generic"]),
+  provenance: WitanIngestProvenanceSchema,
+  producers: external_exports.array(
+    external_exports.object({
+      name: external_exports.string().min(1).max(120),
+      version: external_exports.string().min(1).max(80).optional(),
+      commit: external_exports.string().min(1).max(80).optional()
+    }).strict()
+  ).max(8),
+  subjects: external_exports.array(
+    external_exports.object({
+      repository: external_exports.string().min(1).max(300).optional(),
+      // Additive-optional (1.7, #525 follow-up): the input declared a repository Cejel could
+      // not normalize to host/path. The declared text is withheld, never recorded, because
+      // it may carry URL credentials. Never treated as the named subject repository.
+      repositoryWithheld: external_exports.literal(true).optional(),
+      commit: external_exports.string().min(1).max(80).optional()
+    }).strict()
+  ).max(8),
+  // Additive-optional (1.7, #525 follow-up): distinct declared subjects beyond the 8 recorded.
+  // Every declared subject is checked; only the record is capped. Absent when none were omitted.
+  // Bounded by the 8 MiB ingest document budget: each distinct subject takes at least one byte.
+  subjectsOmitted: external_exports.number().int().min(1).max(8 * 1024 * 1024).optional(),
+  observedAt: external_exports.string().datetime().optional(),
+  status: WitanInputBindingStatusSchema,
+  checks: external_exports.object({
+    repository: WitanInputBindingCheckSchema,
+    commit: WitanInputBindingCheckSchema,
+    freshness: external_exports.enum(["within-window", "stale", "absent", "unverifiable"])
+  }).strict(),
+  duplicate: external_exports.enum(["same-path", "same-content"]).optional(),
+  // False only for a same-path duplicate, which the ingest funnel has always skipped. A
+  // same-content duplicate at a different path is scored, exactly as before binding existed.
+  scored: external_exports.boolean()
+}).strict();
+var WitanInputBindingSchema = external_exports.object({
+  policy: external_exports.enum(["record-only", "strict"]),
+  freshnessWindowSeconds: external_exports.number().int().min(0),
+  scannedSubject: external_exports.object({
+    repository: external_exports.string().min(1).max(300).optional(),
+    commit: external_exports.string().min(7).max(64).optional(),
+    commitTime: external_exports.string().datetime().optional()
+  }).strict(),
+  inputs: external_exports.array(WitanInputBindingRecordSchema).max(256)
+}).strict();
 var WitanScoredVerdictSchema = external_exports.enum([
   "verified",
   "conditional",
@@ -343,6 +417,9 @@ var WitanReportCommonSchema = external_exports.object({
   // Rubric-driven: length matches whatever rubric produced this report, not a fixed enum.
   criteria: external_exports.array(WitanCriterionScoreSchema).min(1),
   consumedSignals: external_exports.array(WitanConsumedSignalSummarySchema).optional(),
+  // Additive-optional (report format 1.7): present only when at least one document was ingested,
+  // so a no-ingest report stays byte-identical. See WitanInputBindingSchema.
+  inputBinding: WitanInputBindingSchema.optional(),
   archetype: WitanRepoArchetypeSchema.optional(),
   scanLimitations: external_exports.array(external_exports.string().min(1).max(1e3)).max(16).optional(),
   // Additive-optional (report format 1.5, issue #428): disclosures about the commit history the
@@ -401,7 +478,7 @@ var WitanReportSchema = external_exports.preprocess((value) => {
 }, StrictWitanReportSchema);
 var WITAN_ATTESTATION_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
 var WITAN_ATTESTATION_PREDICATE_TYPE = "https://cejel.dev/attestations/scan/v1";
-var WITAN_REPORT_FORMAT_VERSION = "1.5";
+var WITAN_REPORT_FORMAT_VERSION = "1.8";
 var WitanAttestationOutcomeSchema = external_exports.discriminatedUnion("status", [
   external_exports.object({
     status: external_exports.literal("scored"),
@@ -534,6 +611,7 @@ var WITAN_RUBRIC_VERSION_V23 = "witan-rubric-v23-prospective-2026-09-06";
 var WITAN_RUBRIC_VERSION_V24 = "witan-rubric-v24-prospective-2026-09-15";
 var WITAN_RUBRIC_VERSION_V25 = "witan-rubric-v25-prospective-2026-10-12";
 var WITAN_RUBRIC_VERSION_V26 = "witan-rubric-v26-prospective-2026-10-14";
+var WITAN_RUBRIC_VERSION_V27 = "witan-rubric-v27-prospective-2026-10-19";
 var WITAN_LAST_CALIBRATED_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V17;
 var WITAN_PROSPECTIVE_RUBRIC_VERSIONS = Object.freeze([
   WITAN_RUBRIC_VERSION_V18,
@@ -544,7 +622,8 @@ var WITAN_PROSPECTIVE_RUBRIC_VERSIONS = Object.freeze([
   WITAN_RUBRIC_VERSION_V23,
   WITAN_RUBRIC_VERSION_V24,
   WITAN_RUBRIC_VERSION_V25,
-  WITAN_RUBRIC_VERSION_V26
+  WITAN_RUBRIC_VERSION_V26,
+  WITAN_RUBRIC_VERSION_V27
 ]);
 var WITAN_SELECTABLE_RUBRIC_VERSIONS = Object.freeze([
   WITAN_LAST_CALIBRATED_RUBRIC_VERSION,
@@ -573,6 +652,8 @@ var WITAN_LEGACY_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is presen
 var WITAN_A5_RECONCILIATION_UNSETTLED_DISCLOSURE = "Whether this repository's claims are reconciled against its implementation cannot be settled from static evidence; Cejel makes no finding on it.";
 var WITAN_A2_TENANT_ISOLATION_UNSETTLED_DISCLOSURE = "Whether tenant isolation is enforced outside the database cannot be settled from static evidence; Cejel makes no finding on it.";
 var WITAN_A3_BUILD_STEP_UNSETTLED_DISCLOSURE = "Whether this package has a build or type-check step outside the files read cannot be settled from static evidence; Cejel makes no finding on it.";
+var WITAN_A2_PLACEHOLDER_SET_ASIDE_PREFIX = "Cejel read and set aside ";
+var WITAN_B3_UNSHOWN_CHECK_PREFIX = "B3 counted workflows Cejel did not see run a check: ";
 function isWitanNoMeasurementAbstention(report) {
   return report.verdict === "insufficient_source" && report.insufficientSourceReason.startsWith(WITAN_NO_MEASUREMENT_REASON) && report.criteria.every(
     ({ status }) => status === "not_applicable" || status === "insufficient_data"
@@ -636,6 +717,76 @@ function collectExternalFindings(consumedSignals) {
   });
 }
 
+// src/witan/input-binding-presentation.ts
+init_esm_shims();
+var INHERITED_FINDING_NOTES = Object.freeze({
+  "scorecard:Dependency-Update-Tool": "Restates evidence Cejel reads natively: A4 dependency_automation_ratio credits the same Dependabot or Renovate configuration. Not independent corroboration; for the same absence this adjusts A4 a second time.",
+  "scorecard:Security-Policy": "Restates evidence Cejel reads natively: B4 counts SECURITY.md as an audit-trail file. Not independent corroboration.",
+  "scorecard:SAST": "Scorecard SAST reports whether a static-analysis tool runs on commits. It is not a secrets or data-layer finding; the current ingest mapping folds it into A2."
+});
+function inheritedFindingNote(ruleId) {
+  return Object.hasOwn(INHERITED_FINDING_NOTES, ruleId) ? INHERITED_FINDING_NOTES[ruleId] : void 0;
+}
+function formatScore(score) {
+  return score.toFixed(1);
+}
+function importedAdjustmentSentence(criterion) {
+  if (criterion.nativeScore === void 0) return void 0;
+  if (criterion.status === "not_applicable" || criterion.status === "insufficient_data") {
+    return `Ingested findings were folded into this dimension, but it is ${criterion.status}, so they moved no score.`;
+  }
+  const statusMoved = criterion.nativeStatus !== void 0 && criterion.nativeStatus !== criterion.status;
+  if (criterion.nativeScore === criterion.score) {
+    return statusMoved ? `Imported evidence moved this status: Cejel's own evidence gave ${criterion.nativeStatus} at ${formatScore(criterion.nativeScore)}/4.0; ingested findings did not move the score but moved the status to ${criterion.status}. The move is not a native Cejel finding.` : `Ingested findings were folded into this dimension but did not move its score from Cejel's own ${formatScore(criterion.nativeScore)}/4.0; the status is the native one.`;
+  }
+  const difference = Math.abs(criterion.nativeScore - criterion.score);
+  const delta = difference < 0.05 ? "less than 0.1" : formatScore(difference);
+  if (statusMoved) {
+    return `Imported evidence moved this status: Cejel's own evidence gave ${criterion.nativeStatus} at ${formatScore(criterion.nativeScore)}/4.0; ingested findings lowered the score by ${delta} to ${formatScore(criterion.score)}, which moved the status to ${criterion.status}. The move is not a native Cejel finding.`;
+  }
+  return `Ingested findings lowered this score by ${delta} from Cejel's own ${formatScore(criterion.nativeScore)}/4.0; the status is the native one.`;
+}
+var STATUS_ORDER = [
+  "matched",
+  "unbound",
+  "unverifiable",
+  "stale",
+  "mismatched-commit",
+  "mismatched-repository"
+];
+function inputBindingHeadline(binding) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const input of binding.inputs) counts.set(input.status, (counts.get(input.status) ?? 0) + 1);
+  const parts = STATUS_ORDER.filter((status) => counts.has(status)).map(
+    (status) => `${counts.get(status)} ${status}`
+  );
+  const duplicates = binding.inputs.filter((input) => input.duplicate !== void 0).length;
+  if (duplicates > 0) parts.push(`${duplicates} duplicate`);
+  const n = binding.inputs.length;
+  const policy = binding.policy === "strict" ? "strict: mismatched, stale and duplicate inputs were refused" : "record only: binding status did not affect any score";
+  return `${n} ingested input${n === 1 ? "" : "s"}: ${parts.join(", ")} (${policy}).`;
+}
+function describeSubject(record) {
+  if (record.subjects.length === 0) return "no declared subject";
+  const listed = record.subjects.map((subject) => {
+    const repository = subject.repository ?? (subject.repositoryWithheld ? "repository withheld (declared, not normalizable)" : "repository not declared");
+    return `${repository} @ ${subject.commit ?? "commit not declared"}`;
+  }).join("; ");
+  return record.subjectsOmitted ? `${listed}; and ${record.subjectsOmitted} more declared subject${record.subjectsOmitted === 1 ? "" : "s"}, all checked, not recorded` : listed;
+}
+function describeProducer(record) {
+  if (record.producers.length === 0) return record.format;
+  return record.producers.map((producer) => producer.version ? `${producer.name} ${producer.version}` : producer.name).join(", ");
+}
+function describeInputBindingRecord(record) {
+  const duplicate = record.duplicate ? `; duplicate (${record.duplicate}${record.scored ? ", scored again as before" : ", not scored again"})` : "";
+  return `${record.status}: ${describeProducer(record)} (${record.format}, ${record.provenance}); subject ${describeSubject(record)}; observed ${record.observedAt ?? "not declared"}; sha256:${record.sha256}${duplicate}`;
+}
+function describeScannedSubject(binding) {
+  const subject = binding.scannedSubject;
+  return `Compared with: ${subject.repository ?? "repository not named (pass --subject-repository)"} @ ${subject.commit ?? "no git HEAD"}${subject.commitTime ? `, committed ${subject.commitTime}` : ""}; stale means observed more than ${binding.freshnessWindowSeconds} seconds before that commit time.`;
+}
+
 // src/witan/finding-presentation.ts
 init_esm_shims();
 
@@ -663,7 +814,11 @@ var WITAN_RUBRIC_BEHAVIOUR_FINGERPRINTS = Object.freeze({
   // fires on it and, by amendment 1, A5 is scored without reconciliation_artifact_depth. The A5
   // component and the report components of the specimens whose code-trust score that moves differ
   // from v25's. A2 does not move on this corpus.
-  [WITAN_RUBRIC_VERSION_V26]: "sha256:4530317d56fc73eb89287e344ad626e2b9a96908ef12eb9e9c13b839bd599dae"
+  [WITAN_RUBRIC_VERSION_V26]: "sha256:4530317d56fc73eb89287e344ad626e2b9a96908ef12eb9e9c13b839bd599dae",
+  // v17's closure plus the v27 false-assurance gate (#517-#520, #442). On this corpus only A4
+  // moves against v17: specimens whose CI runs `npm ci` with no committed lockfile score
+  // lockfile_coverage 0 under library norms. No report-level component differs from v17's.
+  [WITAN_RUBRIC_VERSION_V27]: "sha256:fb4edfa0bdf0d8153af3f84a4b72d4eab6da3fd6e0b2e3e494cea9542ded45a0"
 });
 function rubricBehaviourFingerprint(rubricVersion) {
   return WITAN_RUBRIC_BEHAVIOUR_FINGERPRINTS[rubricVersion];
@@ -731,7 +886,7 @@ var WITAN_RUBRIC = [
 
 // src/witan/scoring.ts
 function usesV17DetectorClosure(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V26 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V27 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V26 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
 }
 var MAX_SIGNAL_ADJUSTMENT = 0.8;
 function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC, toolVersion) {
@@ -765,7 +920,8 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC, toolVersi
         evidence: scored.evidence,
         findings: scored.findings,
         metrics: scored.metrics,
-        ...signal?.notes ? { notes: signal.notes } : {}
+        ...signal?.notes ? { notes: signal.notes } : {},
+        ...signal?.disclosures ? { disclosures: signal.disclosures } : {}
       };
     }
     const { adjustedScore, adjustment, summaries } = applySignalAdjustment(
@@ -787,11 +943,16 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC, toolVersi
       category: rubricCriterion.category,
       score: finalScore,
       ...adjustment !== 0 ? { nativeScore: scored.score } : {},
+      // Beside nativeScore, so a reader can tell a status that imported evidence moved from one
+      // the native evidence produced (report format 1.7). Presentation-only: finalStatus above is
+      // computed exactly as before.
+      ...adjustment !== 0 ? { nativeStatus: scored.status } : {},
       status: finalStatus,
       evidence: scored.evidence,
       findings: scored.findings,
       metrics: scored.metrics,
-      ...signal?.notes ? { notes: signal.notes } : {}
+      ...signal?.notes ? { notes: signal.notes } : {},
+      ...signal?.disclosures ? { disclosures: signal.disclosures } : {}
     };
   });
   const categoryOrder = [];
@@ -902,7 +1063,7 @@ function statusForScore(score) {
 }
 function statusAfterInputAdjustment(nativeStatus, nativeScore, adjustment, rubricVersion) {
   if (adjustment === 0) return nativeStatus;
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V25 && rubricVersion !== WITAN_RUBRIC_VERSION_V26 && rubricVersion !== WITAN_RUBRIC_VERSION_V24 && rubricVersion !== WITAN_RUBRIC_VERSION_V23) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V27 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V25 && rubricVersion !== WITAN_RUBRIC_VERSION_V26 && rubricVersion !== WITAN_RUBRIC_VERSION_V24 && rubricVersion !== WITAN_RUBRIC_VERSION_V23) {
     return statusForScore(roundScore(Math.max(0, nativeScore - adjustment)));
   }
   const statusFloor = {
@@ -950,6 +1111,7 @@ function mergeSignalsByCriterion(signals) {
       findings: [...existing.findings, ...signal.findings],
       metrics: [...existing.metrics ?? [], ...signal.metrics ?? []],
       notes: signal.notes ?? existing.notes,
+      ...mergedDisclosures(existing.disclosures, signal.disclosures),
       ...existingAbstains || signalAbstains ? {
         insufficientData: true,
         ...abstentionReason !== void 0 ? { insufficientDataReason: abstentionReason } : {}
@@ -958,8 +1120,12 @@ function mergeSignalsByCriterion(signals) {
   }
   return merged;
 }
+function mergedDisclosures(existing, incoming) {
+  const disclosures = [.../* @__PURE__ */ new Set([...existing ?? [], ...incoming ?? []])].slice(0, 4);
+  return disclosures.length > 0 ? { disclosures } : {};
+}
 function usesMetricScoring(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V26 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V27 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V26 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
 }
 function unmeasuredStatus(rubricVersion) {
   return rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0 ? "unverified" : "insufficient_data";
@@ -1347,7 +1513,7 @@ function calibratedCriterionStateV11(criterionId, metrics) {
   return void 0;
 }
 function ensureFindingsExplainStatus(criterionId, score, status, findings, evidence, rubricVersion) {
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V25 && rubricVersion !== WITAN_RUBRIC_VERSION_V26 && rubricVersion !== WITAN_RUBRIC_VERSION_V24 && rubricVersion !== WITAN_RUBRIC_VERSION_V23 && findings.length > 0) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V27 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V25 && rubricVersion !== WITAN_RUBRIC_VERSION_V26 && rubricVersion !== WITAN_RUBRIC_VERSION_V24 && rubricVersion !== WITAN_RUBRIC_VERSION_V23 && findings.length > 0) {
     return [...findings];
   }
   if (status !== "critical" && status !== "warning") return [...findings];
@@ -1857,6 +2023,12 @@ function buildNextSteps(report, unmeasured, notApplicable, a1, coverageMetric) {
       `Resolve the ${actionableSkips.count} content entr${actionableSkips.count === 1 ? "y" : "ies"} skipped as ${joinWithOr(actionableSkips.reasons)} (see the itemized reasons in the certificate), then reproduce the scan.`
     );
   }
+  const lfsPointers = report.contentReadSummary?.byReason.lfsPointer ?? 0;
+  if (lfsPointers > 0) {
+    steps.push(
+      `Fetch the Git LFS content for the ${lfsPointers} file${lfsPointers === 1 ? "" : "s"} whose checkout holds a pointer (git lfs pull), then reproduce the scan.`
+    );
+  }
   if (steps.length === 0) {
     steps.push(
       "No unresolved evidence gaps were identified across the categories Cejel tracks; reproduce the scan at the reported revision when one is available before relying on this certificate."
@@ -1943,7 +2115,9 @@ var WITHHELD_PATH_REASON_LABELS = {
   non_regular_file: "not a regular file",
   unreadable: "unreadable",
   denied_path: "denied path",
-  excluded_by_extension: "excluded by extension"
+  excluded_by_extension: "excluded by extension",
+  // Never a withheld-path reason today (an LFS pointer is read, not withheld); the map is total.
+  lfs_pointer: "a Git LFS pointer"
 };
 function describeWithheldReasons(entries) {
   return [...new Set(entries.map((entry) => WITHHELD_PATH_REASON_LABELS[entry.reason]))].sort().join(", ");
@@ -1984,6 +2158,18 @@ function settlingEvidenceDisclosures(report) {
     )
   ).map(({ sentence }) => sentence);
 }
+function placeholderSetAsideDisclosures(report) {
+  return criterionDisclosures(report, "A2", WITAN_A2_PLACEHOLDER_SET_ASIDE_PREFIX);
+}
+function unshownCheckWorkflowDisclosures(report) {
+  const b3 = report.criteria.find((criterion) => criterion.id === "B3");
+  if (!b3 || b3.status === "not_applicable" || b3.status === "insufficient_data") return [];
+  return criterionDisclosures(report, "B3", WITAN_B3_UNSHOWN_CHECK_PREFIX);
+}
+function criterionDisclosures(report, criterionId, prefix) {
+  const criterion = report.criteria.find((entry) => entry.id === criterionId);
+  return (criterion?.disclosures ?? []).filter((sentence) => sentence.startsWith(prefix));
+}
 function describeEstablishedDimensions(report, measured, applicable) {
   const total = report.criteria.length;
   const counts = formatMeasuredDimensionCounts(computeMeasuredCoverage(report));
@@ -2036,6 +2222,12 @@ function buildRelyingPartySummary(report) {
       `${contentEntries(actionableSkips, "was", "were")} skipped for the reasons itemized in the certificate.`
     );
   }
+  const lfsPointerCount = report.contentReadSummary?.byReason.lfsPointer ?? 0;
+  if (lfsPointerCount > 0) {
+    gaps.push(
+      `${lfsPointerCount} file${lfsPointerCount === 1 ? " is a Git LFS pointer" : "s are Git LFS pointers"} in this checkout, so ${lfsPointerCount === 1 ? "its" : "their"} content was not read. A criterion that read one either abstained (it is listed among the affected criteria) or scored the pointer's text.`
+    );
+  }
   const excludedByExtension = report.contentReadSummary?.byReason.excludedByExtension ?? 0;
   if (excludedByExtension > 0) {
     gaps.push(
@@ -2043,6 +2235,8 @@ function buildRelyingPartySummary(report) {
     );
   }
   gaps.push(...settlingEvidenceDisclosures(report));
+  gaps.push(...placeholderSetAsideDisclosures(report));
+  gaps.push(...unshownCheckWorkflowDisclosures(report));
   const withheldPathsSentence = buildWithheldPathsGapSentence(report);
   if (withheldPathsSentence !== void 0) {
     gaps.push(withheldPathsSentence);
@@ -2186,7 +2380,7 @@ function renderWitanHtmlReport(report, options = {}) {
         <aside class="score-panel" aria-label="Summary trust score">
           <div class="score-badge">Summary</div>
           ${report.verdict === "insufficient_source" ? `<div class="verdict">${escapeHtml(renderWitanAbstentionLabel(report))}</div>
-          <p class="insufficient-note">${escapeHtml(report.insufficientSourceReason)}</p>` : `<div class="score">${formatScore(report.overallScore)}</div>
+          <p class="insufficient-note">${escapeHtml(report.insufficientSourceReason)}</p>` : `<div class="score">${formatScore2(report.overallScore)}</div>
           <div class="score-unit">/ 4.0 overall</div>
           <div class="verdict">${escapeHtml(renderVerdict(report.overallScore))}</div>
           <div class="subscores">
@@ -2243,6 +2437,8 @@ function renderWitanHtmlReport(report, options = {}) {
       </article>
     </section>` : ""}
 
+    ${renderInputBindingSection(report)}
+
     ${renderGlossary(glossaryEntriesForReport(report))}
   </main>
 </body>
@@ -2307,7 +2503,8 @@ function renderContentReadSummary(report) {
         <li>Too large: ${summary.byReason.tooLarge}</li>
         <li>Excluded by extension: ${summary.byReason.excludedByExtension}</li>
         <li>Denied path: ${summary.byReason.deniedPath}</li>
-        <li>Non-regular file: ${summary.byReason.nonRegularFile}</li>
+        <li>Non-regular file: ${summary.byReason.nonRegularFile}</li>${summary.byReason.lfsPointer ? `
+        <li>Git LFS pointer (content not in this checkout): ${summary.byReason.lfsPointer}</li>` : ""}
       </ul>
       ${affected}
     </section>`;
@@ -2342,7 +2539,7 @@ function formatSourceProvenanceLine(summary) {
 function renderExternalFindingItems(findings) {
   const shown = findings.slice(0, EXTERNAL_FINDINGS_DISPLAY_LIMIT);
   const items = shown.map(
-    (f) => `<li><strong>${escapeHtml(f.label)} \u2192 ${escapeHtml(f.dimension)}</strong><span>${escapeHtml(f.severity)}: ${escapeHtml(f.ruleId)} \u2014 ${escapeHtml(f.message)}${f.location ? ` (${escapeHtml(f.location)})` : ""}</span></li>`
+    (f) => `<li><strong>${escapeHtml(f.label)} \u2192 ${escapeHtml(f.dimension)}</strong><span>${escapeHtml(f.severity)}: ${escapeHtml(f.ruleId)} \u2014 ${escapeHtml(f.message)}${f.location ? ` (${escapeHtml(f.location)})` : ""}</span>${renderInheritedFindingNote(f.ruleId)}</li>`
   );
   const remaining = findings.length - shown.length;
   if (remaining > 0) {
@@ -2350,6 +2547,21 @@ function renderExternalFindingItems(findings) {
   }
   return items;
 }
+function renderInheritedFindingNote(ruleId) {
+  const note = inheritedFindingNote(ruleId);
+  return note ? `<span class="external-note">${escapeHtml(note)}</span>` : "";
+}
+function renderInputBindingSection(report) {
+  const binding = report.inputBinding;
+  if (!binding) return "";
+  return `<section class="external-findings-section" aria-label="Ingested inputs">
+      <article class="evidence-section">
+        <h2>Ingested inputs</h2>
+        <p class="external-note">${escapeHtml(inputBindingHeadline(binding))} ${escapeHtml(describeScannedSubject(binding))}</p>
+        <ul>${binding.inputs.map((input) => `<li>${escapeHtml(describeInputBindingRecord(input))}</li>`).join("")}</ul>
+      </article>
+    </section>`;
+}
 function criteriaByCategory(report, category) {
   return report.criteria.filter((criterion) => criterion.category === category);
 }
@@ -2393,8 +2605,8 @@ function renderCriterionCard(criterion, gitHistoryUnavailable) {
               </div>
               ${renderStatusChip(criterion.id, criterion.status)}
             </div>
-            <div class="criterion-score">${criterion.status === "not_applicable" ? "N/A" : criterion.status === "insufficient_data" ? "No data" : formatScore(criterion.score)}</div>
-            ${statusReconciliation}
+            <div class="criterion-score">${criterion.status === "not_applicable" ? "N/A" : criterion.status === "insufficient_data" ? "No data" : formatScore2(criterion.score)}</div>
+            ${statusReconciliation}${renderImportedAdjustment(criterion)}
             ${historyWarning}
             <ul class="criterion-metrics">
               ${metrics.length > 0 ? metrics.map((item) => `<li>${item}</li>`).join("") : "<li>No measured depth metrics supplied.</li>"}
@@ -2404,6 +2616,11 @@ function renderCriterionCard(criterion, gitHistoryUnavailable) {
             </ul>
           </article>`;
 }
+function renderImportedAdjustment(criterion) {
+  const sentence = importedAdjustmentSentence(criterion);
+  return sentence ? `
+            <p class="status-explanation">${escapeHtml(sentence)}</p>` : "";
+}
 function renderStatusReconciliation(criterion) {
   if (criterion.status === "not_applicable") {
     return '<p class="status-explanation"><strong>Why no label comparison applies:</strong> this dimension is not applicable to this repository, so it has no weighted numeric score band to compare.</p>';
@@ -2416,14 +2633,14 @@ function renderStatusReconciliation(criterion) {
   }
   const numericBand = scoreBandForPresentation(criterion.score);
   if (numericBand === criterion.status) {
-    return `<p class="status-explanation"><strong>How the labels agree:</strong> the ${escapeHtml(criterion.status)} dimension band matches the ${formatScore(criterion.score)}/4.0 weighted score (the ${numericBand} numeric band).</p>`;
+    return `<p class="status-explanation"><strong>How the labels agree:</strong> the ${escapeHtml(criterion.status)} dimension band matches the ${formatScore2(criterion.score)}/4.0 weighted score (the ${numericBand} numeric band).</p>`;
   }
   if (criterion.status !== "verified" && criterion.status !== "info" && criterion.status !== "warning" && criterion.status !== "critical") {
     return `<p class="status-explanation"><strong>Why no label comparison applies:</strong> this report contains an unrecognized dimension state (${escapeHtml(String(criterion.status))}), so Cejel will not infer a comparison.</p>`;
   }
   const entry = CERTIFICATE_GLOSSARY.find((candidate) => candidate.key === "labels");
   const help = entry ? `<span class="term-help" tabindex="0" aria-describedby="tooltip-${criterion.id}-labels"><strong>Why the labels differ:</strong><span class="term-tooltip" id="tooltip-${criterion.id}-labels" role="tooltip">${escapeHtml(entry.definition)}</span></span>` : "<strong>Why the labels differ:</strong>";
-  return `<p class="status-explanation">${help} the ${escapeHtml(criterion.status)} dimension band is calibrated from criterion evidence thresholds and findings, independently of the ${formatScore(criterion.score)}/4.0 weighted score (which falls in the ${numericBand} numeric band).</p>`;
+  return `<p class="status-explanation">${help} the ${escapeHtml(criterion.status)} dimension band is calibrated from criterion evidence thresholds and findings, independently of the ${formatScore2(criterion.score)}/4.0 weighted score (which falls in the ${numericBand} numeric band).</p>`;
 }
 function scoreBandForPresentation(score) {
   if (score >= 3.5) return "verified";
@@ -2449,7 +2666,7 @@ function renderMetric(criterion, metric2) {
 }
 function renderCategoryScore(score, coverage, category) {
   const categoryCoverage = coverage.byCategory.find((entry) => entry.category === category);
-  return categoryCoverage !== void 0 && categoryCoverage.measured === 0 || score === null ? "not measured" : formatScore(score);
+  return categoryCoverage !== void 0 && categoryCoverage.measured === 0 || score === null ? "not measured" : formatScore2(score);
 }
 function renderStatusChip(criterionId, status) {
   const entry = CERTIFICATE_GLOSSARY.find((candidate) => candidate.key === "labels");
@@ -2515,7 +2732,7 @@ function renderMachineVerdict(verdict) {
       return "Insufficient source";
   }
 }
-function formatScore(score) {
+function formatScore2(score) {
   return score.toFixed(1);
 }
 function formatDate(value) {
@@ -2706,7 +2923,7 @@ function badgeMessage(report, verdict) {
   if ((report.scanLimitations?.length ?? 0) > 0) return "unrated: limited evidence";
   if (isWitanNoMeasurementAbstention(report)) return "unrated: no measurable evidence";
   if (report.verdict === "insufficient_source") return "unrated: no source";
-  return `${formatScore2(report.overallScore)}/4.0 ${verdict.toLowerCase()}`;
+  return `${formatScore3(report.overallScore)}/4.0 ${verdict.toLowerCase()}`;
 }
 function renderWitanBadgeEndpoint(report) {
   const verdict = renderReportVerdict(report);
@@ -2750,7 +2967,7 @@ function renderWitanBadgeSvg(report) {
 </svg>
 `;
 }
-function formatScore2(score) {
+function formatScore3(score) {
   return score.toFixed(1);
 }
 function escapeXml(value) {
@@ -2887,12 +3104,6 @@ function verifyWitanAttestationBinding(statement, report, options = {}) {
   return { valid: errors.length === 0, errors };
 }
 
-// src/witan/index.ts
-init_esm_shims();
-
-// src/witan/markdown.ts
-init_esm_shims();
-
 // src/presentation-safety.ts
 init_esm_shims();
 var PRESENTATION_CONTROL_PATTERN = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
@@ -2909,17 +3120,530 @@ function sanitizePresentationLine(value, options) {
   }
   return `${prefix}${ellipsis}`;
 }
+function stripTerminalControls(text) {
+  return text.replace(/[\t\n]/g, " ").replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
+}
 
-// src/witan/repo-signals.ts
+// src/witan/input-binding.ts
 init_esm_shims();
 import { createHash as createHash3 } from "crypto";
+
+// src/witan/linear-strips.ts
+init_esm_shims();
+var LINE_TERMINATOR_PATTERN = /[\n\r\u2028\u2029]/;
+var WHITESPACE_PATTERN = /\s/;
+function lastLineTerminator(text) {
+  for (let index = text.length - 1; index >= 0; index -= 1) {
+    if (LINE_TERMINATOR_PATTERN.test(text[index] ?? "")) return index;
+  }
+  return -1;
+}
+function stripTrailingHashComment(text) {
+  for (let index = text.indexOf("#", lastLineTerminator(text) + 1); index !== -1; index = text.indexOf("#", index + 1)) {
+    if (index === 0 || !WHITESPACE_PATTERN.test(text[index - 1] ?? "")) continue;
+    return text.slice(0, index).trimEnd();
+  }
+  return text;
+}
+function stripHashCommentAtStartOrAfterBlank(text) {
+  for (let index = text.indexOf("#", lastLineTerminator(text) + 1); index !== -1; index = text.indexOf("#", index + 1)) {
+    if (index === 0) return "";
+    if (WHITESPACE_PATTERN.test(text[index - 1] ?? "")) return text.slice(0, index - 1);
+  }
+  return text;
+}
+function stripFromQueryOrFragment(text) {
+  const from = lastLineTerminator(text) + 1;
+  for (let index = from; index < text.length; index += 1) {
+    const character = text[index];
+    if (character === "?" || character === "#") return text.slice(0, index);
+  }
+  return text;
+}
+function stripTrailingCloseParentheses(segment) {
+  let end = segment.length;
+  while (end > 0 && segment[end - 1] === ")") end -= 1;
+  if (end === segment.length) return segment;
+  return segment.slice(0, end).trimEnd();
+}
+function stripTrailingSlashes(text) {
+  let end = text.length;
+  while (end > 0 && text[end - 1] === "/") end -= 1;
+  return end === text.length ? text : text.slice(0, end);
+}
+function hasScheduleCronTrigger(text) {
+  const key = "schedule:";
+  for (let index = text.indexOf(key); index !== -1; index = text.indexOf(key, index + 1)) {
+    let before = index - 1;
+    let newlineBefore = false;
+    while (before >= 0 && WHITESPACE_PATTERN.test(text[before] ?? "")) {
+      if (text[before] === "\n") newlineBefore = true;
+      before -= 1;
+    }
+    if (before !== -1 && !newlineBefore) continue;
+    let after = index + key.length;
+    let newlineAfter = false;
+    while (after < text.length && WHITESPACE_PATTERN.test(text[after] ?? "")) {
+      if (text[after] === "\n") newlineAfter = true;
+      after += 1;
+    }
+    if (!newlineAfter || text[after] !== "-") continue;
+    after += 1;
+    while (after < text.length && WHITESPACE_PATTERN.test(text[after] ?? "")) after += 1;
+    if (text.startsWith("cron:", after)) return true;
+  }
+  return false;
+}
+function isShellScriptPath(text) {
+  if (!/\.sh$/i.test(text.slice(-3))) return false;
+  let start = text.length;
+  while (start > 0 && !WHITESPACE_PATTERN.test(text[start - 1] ?? "")) start -= 1;
+  if (start === 0) return true;
+  const slash = text.indexOf("/", start);
+  return slash !== -1 && text.length - (slash + 1) >= 3;
+}
+function execOnTerminatorFreeLine(pattern, line) {
+  return LINE_TERMINATOR_PATTERN.test(line) ? null : pattern.exec(line);
+}
+var VERSION_OPERATOR_CHARACTERS = /* @__PURE__ */ new Set([">", "<", "=", "~", "!", "^"]);
+var VERSION_DIGIT_PATTERN = /[\d.]/;
+function firstVersionConstraint(text) {
+  let index = 0;
+  while (index < text.length) {
+    if (!VERSION_OPERATOR_CHARACTERS.has(text[index] ?? "")) {
+      index += 1;
+      continue;
+    }
+    const start = index;
+    while (index < text.length && VERSION_OPERATOR_CHARACTERS.has(text[index] ?? "")) index += 1;
+    if (index < text.length && VERSION_DIGIT_PATTERN.test(text[index] ?? "")) {
+      let end = index;
+      while (end < text.length && VERSION_DIGIT_PATTERN.test(text[end] ?? "")) end += 1;
+      return text.slice(start, end);
+    }
+  }
+  return void 0;
+}
+
+// src/witan/input-binding.ts
+var INGEST_FRESHNESS_WINDOW_SECONDS = 86400;
+var MAX_IDENTITIES_PER_INPUT = 8;
+var MAX_PRODUCER_NAME_LENGTH = 120;
+var MAX_PRODUCER_VERSION_LENGTH = 80;
+var MAX_REPOSITORY_LENGTH = 300;
+var MAX_COMMIT_LENGTH = 80;
+var COMMIT_PATTERN = /^[0-9a-f]{7,64}$/;
+var FULL_COMMIT_LENGTHS = /* @__PURE__ */ new Set([40, 64]);
+function sha256OfBytes(bytes) {
+  return createHash3("sha256").update(bytes).digest("hex");
+}
+function normalizeRepositoryIdentity(value) {
+  let text = value.trim();
+  if (text.length === 0 || text.length > 2048) return void 0;
+  const scp = /^[^@/\s]+@([^:/\s]+):(.+)$/.exec(text);
+  if (scp) text = `${scp[1]}/${scp[2]}`;
+  else {
+    const scheme = /^[a-z][a-z0-9+.-]*:\/\/(.*)$/i.exec(text);
+    if (scheme) text = scheme[1] ?? "";
+    const at = text.indexOf("@");
+    const slash = text.indexOf("/");
+    if (at !== -1 && (slash === -1 || at < slash)) text = text.slice(at + 1);
+  }
+  text = stripFromQueryOrFragment(text);
+  const [hostWithPort, ...pathParts] = text.split("/");
+  const host = (hostWithPort ?? "").replace(/:\d+$/, "").toLowerCase();
+  const path = pathParts.filter((part) => part.length > 0).join("/").replace(/(?:\/|\.git)+$/i, "").toLowerCase();
+  if (!/^[a-z0-9.-]+\.[a-z]{2,}$|^localhost$/.test(host) || path.length === 0) return void 0;
+  if (/[\p{Cc}\p{Cf}\s]/u.test(path)) return void 0;
+  if (path.includes("@")) return void 0;
+  const normalized = `${host}/${path}`;
+  return normalized.length <= MAX_REPOSITORY_LENGTH ? normalized : void 0;
+}
+function normalizeCommit(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim().toLowerCase();
+  if (trimmed.length === 0) return void 0;
+  return sanitizePresentationLine(trimmed, { fallback: "unknown", maxLength: MAX_COMMIT_LENGTH });
+}
+function boundedText(value, maxLength) {
+  if (typeof value !== "string" || value.trim().length === 0) return void 0;
+  return sanitizePresentationLine(value, { fallback: "unknown", maxLength });
+}
+function parseObservedAt(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  const dateOnly = /^(\d{4})-(\d{2})-(\d{2})$/.exec(trimmed);
+  if (dateOnly) return plainIsoInstant(Date.parse(`${trimmed}T23:59:59Z`));
+  if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2})$/i.test(trimmed)) {
+    return void 0;
+  }
+  return plainIsoInstant(Date.parse(trimmed));
+}
+var PLAIN_ISO_INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+function plainIsoInstant(millis) {
+  if (!Number.isFinite(millis)) return void 0;
+  const date = new Date(millis);
+  if (Number.isNaN(date.getTime())) return void 0;
+  const iso = date.toISOString();
+  return PLAIN_ISO_INSTANT.test(iso) ? iso : void 0;
+}
+function earliest(values) {
+  let best;
+  let bestMillis = Number.POSITIVE_INFINITY;
+  for (const value of values) {
+    if (value === void 0) continue;
+    const millis = Date.parse(value);
+    if (Number.isNaN(millis)) continue;
+    if (millis < bestMillis) {
+      best = value;
+      bestMillis = millis;
+    }
+  }
+  return best;
+}
+var SubjectSet = class {
+  byKey = /* @__PURE__ */ new Map();
+  add(subject) {
+    const key = JSON.stringify([subject.repository ?? null, subject.repositoryWithheld ?? false, subject.commit ?? null]);
+    if (!this.byKey.has(key)) this.byKey.set(key, subject);
+  }
+  get size() {
+    return this.byKey.size;
+  }
+  values() {
+    return [...this.byKey.values()];
+  }
+};
+function pushUnique(items, item) {
+  if (items.length >= MAX_IDENTITIES_PER_INPUT) return;
+  const key = JSON.stringify(item);
+  if (!items.some((existing) => JSON.stringify(existing) === key)) items.push(item);
+}
+function subjectFrom(repository, commit) {
+  const declaredRepository = repository !== void 0 && repository !== null && !(typeof repository === "string" && repository.trim().length === 0);
+  const normalizedRepository = typeof repository === "string" && declaredRepository ? normalizeRepositoryIdentity(repository) : void 0;
+  const normalizedCommit = normalizeCommit(commit);
+  if (!declaredRepository && normalizedCommit === void 0) return void 0;
+  return {
+    ...normalizedRepository !== void 0 ? { repository: normalizedRepository } : declaredRepository ? { repositoryWithheld: true } : {},
+    ...normalizedCommit !== void 0 ? { commit: normalizedCommit } : {}
+  };
+}
+function asRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function extractScorecardIdentity(raw) {
+  const doc = asRecord(raw) ?? {};
+  const repo = asRecord(doc.repo) ?? {};
+  const scorecard = asRecord(doc.scorecard) ?? {};
+  const subject = subjectFrom(repo.name, repo.commit);
+  const version = boundedText(scorecard.version, MAX_PRODUCER_VERSION_LENGTH);
+  const commit = normalizeCommit(scorecard.commit);
+  const observedAt = parseObservedAt(doc.date);
+  return {
+    producers: [
+      {
+        name: "scorecard",
+        ...version !== void 0 ? { version } : {},
+        ...commit !== void 0 ? { commit } : {}
+      }
+    ],
+    subjects: subject ? [subject] : [],
+    ...observedAt !== void 0 ? { observedAt } : {}
+  };
+}
+function extractSarifIdentity(raw) {
+  const doc = asRecord(raw) ?? {};
+  const runs = Array.isArray(doc.runs) ? doc.runs : [];
+  const producers = [];
+  const subjects = new SubjectSet();
+  const times = [];
+  let runWithoutSubject = false;
+  for (const rawRun of runs) {
+    const run = asRecord(rawRun) ?? {};
+    const driver = asRecord(asRecord(run.tool)?.driver) ?? {};
+    const name = boundedText(driver.name, MAX_PRODUCER_NAME_LENGTH) ?? "unknown";
+    const version = boundedText(driver.semanticVersion ?? driver.version, MAX_PRODUCER_VERSION_LENGTH);
+    pushUnique(producers, { name, ...version !== void 0 ? { version } : {} });
+    const provenance = Array.isArray(run.versionControlProvenance) ? run.versionControlProvenance : [];
+    let runDeclaredSubject = false;
+    for (const rawEntry of provenance) {
+      const entry = asRecord(rawEntry) ?? {};
+      const subject = subjectFrom(entry.repositoryUri, entry.revisionId);
+      if (subject) {
+        subjects.add(subject);
+        runDeclaredSubject = true;
+      }
+    }
+    if (!runDeclaredSubject) runWithoutSubject = true;
+    const invocations = Array.isArray(run.invocations) ? run.invocations : [];
+    for (const rawInvocation of invocations) {
+      const invocation = asRecord(rawInvocation) ?? {};
+      times.push(parseObservedAt(invocation.startTimeUtc), parseObservedAt(invocation.endTimeUtc));
+    }
+  }
+  if (runWithoutSubject && subjects.size > 0) subjects.add({});
+  const observedAt = earliest(times);
+  return {
+    producers,
+    subjects: subjects.values(),
+    ...observedAt !== void 0 ? { observedAt } : {}
+  };
+}
+function genericIdentity(fields) {
+  const name = boundedText(fields.producer?.name ?? fields.tool, MAX_PRODUCER_NAME_LENGTH) ?? "unknown";
+  const version = boundedText(fields.producer?.version, MAX_PRODUCER_VERSION_LENGTH);
+  const subject = fields.subject ? subjectFrom(fields.subject.repository, fields.subject.commit) : void 0;
+  const observedAt = parseObservedAt(fields.observedAt);
+  return {
+    producers: [{ name, ...version !== void 0 ? { version } : {} }],
+    subjects: subject ? [subject] : [],
+    ...observedAt !== void 0 ? { observedAt } : {}
+  };
+}
+function declaresRepository(subject) {
+  return subject.repository !== void 0 || subject.repositoryWithheld === true;
+}
+function checkRepository(subjects, scanned) {
+  const declared = subjects.filter(declaresRepository);
+  if (declared.length === 0) return "absent";
+  if (scanned.repository === void 0) return "unverifiable";
+  return declared.every((subject) => subject.repository === scanned.repository) ? "matched" : "mismatched";
+}
+function subjectDisagrees(subject, scanned) {
+  if (scanned.repository !== void 0 && declaresRepository(subject)) {
+    if (subject.repository !== scanned.repository) return true;
+  }
+  if (scanned.commit !== void 0 && subject.commit !== void 0) {
+    if (!commitMatches(subject.commit, scanned.commit)) return true;
+  }
+  return false;
+}
+function commitMatches(inputCommit, headSha) {
+  if (!COMMIT_PATTERN.test(inputCommit)) return false;
+  const head = headSha.toLowerCase();
+  if (FULL_COMMIT_LENGTHS.has(inputCommit.length)) return inputCommit === head;
+  return head.startsWith(inputCommit);
+}
+function checkCommit(subjects, scanned) {
+  const commits = subjects.map((subject) => subject.commit).filter((commit) => commit !== void 0);
+  if (commits.length === 0) return "absent";
+  if (scanned.commit === void 0) return "unverifiable";
+  const head = scanned.commit;
+  return commits.every((commit) => commitMatches(commit, head)) ? "matched" : "mismatched";
+}
+function checkFreshness(observedAt, scanned, windowSeconds) {
+  if (observedAt === void 0) return "absent";
+  if (scanned.commitTime === void 0) return "unverifiable";
+  const observed = Date.parse(observedAt);
+  const committed = Date.parse(scanned.commitTime);
+  return observed < committed - windowSeconds * 1e3 ? "stale" : "within-window";
+}
+function bindingStatusForChecks(checks, everySubjectDeclaresCommit = true) {
+  if (checks.repository === "mismatched") return "mismatched-repository";
+  if (checks.commit === "mismatched") return "mismatched-commit";
+  if (checks.freshness === "stale") return "stale";
+  if (checks.commit === "matched" && !everySubjectDeclaresCommit) return "unbound";
+  if (checks.commit === "matched") return "matched";
+  if (checks.commit === "unverifiable") return "unverifiable";
+  return "unbound";
+}
+function recordedSubjects(subjects, scanned) {
+  if (subjects.length <= MAX_IDENTITIES_PER_INPUT) return { subjects: [...subjects], omitted: 0 };
+  const rank = (subject) => subjectDisagrees(subject, scanned) ? 0 : subject.commit === void 0 ? 1 : 2;
+  const ordered = subjects.map((subject, index) => ({ subject, index, rank: rank(subject) })).sort((a, b) => a.rank - b.rank || a.index - b.index).slice(0, MAX_IDENTITIES_PER_INPUT).map((entry) => entry.subject);
+  return { subjects: ordered, omitted: subjects.length - MAX_IDENTITIES_PER_INPUT };
+}
+function evaluateInputBindingRecord(document, scanned, windowSeconds = INGEST_FRESHNESS_WINDOW_SECONDS) {
+  const allSubjects = document.identity.subjects;
+  const checks = {
+    repository: checkRepository(allSubjects, scanned),
+    commit: checkCommit(allSubjects, scanned),
+    freshness: checkFreshness(document.identity.observedAt, scanned, windowSeconds)
+  };
+  const recorded = recordedSubjects(allSubjects, scanned);
+  return {
+    sha256: document.sha256,
+    format: document.format,
+    provenance: document.provenance,
+    producers: [...document.identity.producers],
+    subjects: recorded.subjects,
+    ...recorded.omitted > 0 ? { subjectsOmitted: recorded.omitted } : {},
+    ...document.identity.observedAt !== void 0 ? { observedAt: document.identity.observedAt } : {},
+    status: bindingStatusForChecks(
+      checks,
+      allSubjects.every((subject) => subject.commit !== void 0)
+    ),
+    checks,
+    ...document.duplicate !== void 0 ? { duplicate: document.duplicate } : {},
+    scored: document.duplicate !== "same-path"
+  };
+}
+function compareRecords(a, b) {
+  return a.sha256.localeCompare(b.sha256) || (a.duplicate ?? "").localeCompare(b.duplicate ?? "") || a.provenance.localeCompare(b.provenance);
+}
+function buildInputBinding(documents, scanned, policy, windowSeconds = INGEST_FRESHNESS_WINDOW_SECONDS) {
+  return {
+    policy,
+    freshnessWindowSeconds: windowSeconds,
+    scannedSubject: {
+      ...scanned.repository !== void 0 ? { repository: scanned.repository } : {},
+      ...scanned.commit !== void 0 ? { commit: scanned.commit } : {},
+      ...scanned.commitTime !== void 0 ? { commitTime: scanned.commitTime } : {}
+    },
+    inputs: documents.map((document) => evaluateInputBindingRecord(document, scanned, windowSeconds)).sort(compareRecords)
+  };
+}
+var STRICT_INGEST_REFUSED_STATUSES = /* @__PURE__ */ new Set([
+  "mismatched-repository",
+  "mismatched-commit",
+  "stale"
+]);
+function strictIngestRefusalReasons(record) {
+  const reasons = [];
+  if (STRICT_INGEST_REFUSED_STATUSES.has(record.status)) reasons.push(record.status);
+  if (record.duplicate !== void 0) reasons.push(`duplicate (${record.duplicate})`);
+  return reasons;
+}
+function describeSubjects(record) {
+  if (record.subjects.length === 0) return "no subject";
+  const listed = record.subjects.map(
+    (subject) => `${subject.repository ?? (subject.repositoryWithheld ? "(repository withheld: not normalizable)" : "?")}@${subject.commit ?? "?"}`
+  ).join(", ");
+  return record.subjectsOmitted ? `${listed} and ${record.subjectsOmitted} more` : listed;
+}
+function assertStrictIngestBinding(documents, binding) {
+  const problems = [];
+  for (const document of documents) {
+    const record = evaluateInputBindingRecord(
+      document,
+      binding.scannedSubject,
+      binding.freshnessWindowSeconds
+    );
+    const reasons = strictIngestRefusalReasons(record);
+    if (reasons.length === 0) continue;
+    problems.push(
+      // displayPath is the operator's or repository's own path text; a committed file name can
+      // carry terminal controls, and this message goes to stderr.
+      `  - ${stripTerminalControls(document.displayPath)} (sha256:${record.sha256.slice(0, 12)}, ${record.format}): ${reasons.join(", ")}; input subject ${describeSubjects(record)}${record.observedAt ? `, observed ${record.observedAt}` : ""}`
+    );
+  }
+  if (problems.length === 0) return;
+  const scanned = binding.scannedSubject;
+  throw new Error(
+    [
+      `Cejel: --strict-ingest refused ${problems.length} ingest input${problems.length === 1 ? "" : "s"}; no certificate was written.`,
+      ...problems,
+      `  scanned subject: ${scanned.repository ?? "(repository not named; pass --subject-repository to compare it)"}@${scanned.commit ?? "(no git HEAD)"}${scanned.commitTime ? `, committed ${scanned.commitTime}` : ""}; freshness window ${binding.freshnessWindowSeconds}s before that commit time.`,
+      "  Supply inputs produced for this repository at this commit, remove duplicates, or drop --strict-ingest to record the binding status without refusing."
+    ].join("\n")
+  );
+}
+function verifyRecordedInputDigests(report, inputPaths, readFile) {
+  const binding = report.inputBinding;
+  if (!binding) {
+    return {
+      valid: false,
+      lines: [
+        "Cejel: input digests not verified \u2014 report.json records no inputBinding (it ingested nothing, or predates report format 1.7)."
+      ]
+    };
+  }
+  const recorded = new Set(binding.inputs.filter((input) => input.scored).map((input) => input.sha256));
+  const supplied = /* @__PURE__ */ new Map();
+  for (const path of inputPaths) supplied.set(sha256OfBytes(readFile(path)), path);
+  const lines = [];
+  for (const [digest, path] of supplied) {
+    if (!recorded.has(digest)) {
+      lines.push(`Cejel: input ${path} (sha256:${digest}) is not an input report.json records.`);
+    }
+  }
+  for (const digest of recorded) {
+    if (!supplied.has(digest)) {
+      lines.push(`Cejel: report.json records input sha256:${digest}, which no supplied --input matches.`);
+    }
+  }
+  if (lines.length > 0) return { valid: false, lines };
+  return {
+    valid: true,
+    lines: [`Cejel: ${recorded.size} ingested input digest${recorded.size === 1 ? "" : "s"} verified against report.json.`]
+  };
+}
+
+// src/witan/ingest-files.ts
+init_esm_shims();
+import { lstatSync, realpathSync } from "fs";
+import { dirname, isAbsolute, relative, resolve, sep } from "path";
+var MAX_INGEST_DOCUMENT_BYTES = 8 * 1024 * 1024;
+function isContainedPath(candidate, directory) {
+  const relativePath = relative(directory, candidate);
+  return relativePath === "" || relativePath !== ".." && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath);
+}
+function isMissingIngestPath(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function resolveIngestFilePath(filePath, inputDirectory = dirname(filePath)) {
+  const lexicalDirectory = resolve(inputDirectory);
+  const lexicalCandidate = resolve(filePath);
+  const directoryStat = lstatSync(lexicalDirectory);
+  if (directoryStat.isSymbolicLink()) {
+    throw new Error(`Cejel: refusing symlinked ingest directory: ${inputDirectory}`);
+  }
+  if (!directoryStat.isDirectory()) {
+    throw new Error(`Cejel: refusing non-directory ingest boundary: ${inputDirectory}`);
+  }
+  const candidateStat = lstatSync(lexicalCandidate);
+  if (candidateStat.isSymbolicLink()) {
+    throw new Error(`Cejel: refusing symlinked ingest file: ${filePath}`);
+  }
+  if (!candidateStat.isFile()) {
+    throw new Error(`Cejel: refusing non-regular ingest file: ${filePath}`);
+  }
+  if (candidateStat.size > MAX_INGEST_DOCUMENT_BYTES) {
+    throw new Error(
+      `Cejel: ingest file exceeds the ${MAX_INGEST_DOCUMENT_BYTES.toLocaleString("en-US")} byte budget: ${filePath}`
+    );
+  }
+  const resolvedDirectory = realpathSync(lexicalDirectory);
+  const resolvedCandidate = realpathSync(lexicalCandidate);
+  if (!isContainedPath(resolvedCandidate, resolvedDirectory)) {
+    throw new Error(`Cejel: refusing ingest file outside its resolved input directory: ${filePath}`);
+  }
+  return resolvedCandidate;
+}
+function isResolvedIngestPathContained(candidate, directory) {
+  return isContainedPath(candidate, directory);
+}
+
+// src/witan/index.ts
+init_esm_shims();
+
+// src/witan/markdown.ts
+init_esm_shims();
+
+// src/witan/repo-signals.ts
+init_esm_shims();
+import { createHash as createHash4 } from "crypto";
 import {
-  lstatSync,
+  lstatSync as lstatSync2,
   readdirSync,
-  realpathSync,
+  realpathSync as realpathSync2,
   statSync
 } from "fs";
-import { basename, dirname, extname, join, posix, relative, resolve, sep } from "path";
+import { basename, dirname as dirname2, extname, join, posix, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
+
+// src/witan/history-depth.ts
+init_esm_shims();
+var SHALLOW_HISTORY_LIMITATION = "This repository is a shallow clone (git rev-parse --is-shallow-repository reports true), so its commit history is truncated. A2 (credentials and .env files in earlier commits) and B2 (pull-request merge ratio over recent commits) read history and saw only the commits present; on a full clone their results may differ. Scores are computed exactly as for any other scan. Re-scan a full clone (for actions/checkout, set fetch-depth: 0).";
+var SHALLOW_HISTORY_V27_ABSTENTION = "This repository is a shallow clone (git rev-parse --is-shallow-repository reports true), so its commit history is truncated. A2 (credentials and .env files in earlier commits) and B2 (pull-request merge ratio over recent commits) read history. Under this rubric, where either would be scored, A2 abstains unless a confirmed critical secret finding stands, and B2 abstains when fewer commits are visible than it reads; each abstention counts as 0 in the composite, as any evidence Cejel expected to read and could not does. A criterion that is not applicable stays not applicable. Re-scan a full clone (for actions/checkout, set fetch-depth: 0).";
+function isShallowRepository(repoPath) {
+  const result = execGit(["rev-parse", "--is-shallow-repository"], { cwd: repoPath });
+  return result.ok && result.stdout.trim() === "true";
+}
+function detectHistoryLimitations(repoPath, v27Abstains = false) {
+  if (!isShallowRepository(repoPath)) return void 0;
+  return [v27Abstains ? SHALLOW_HISTORY_V27_ABSTENTION : SHALLOW_HISTORY_LIMITATION];
+}
 
 // src/witan/json-safe.ts
 init_esm_shims();
@@ -2929,7 +3653,10 @@ function stripBom(text) {
 
 // src/witan/repo-signals.ts
 function usesV17DetectorClosure2(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V26;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V27 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V26;
+}
+function usesV27FalseAssuranceClosure(rubricVersion) {
+  return rubricVersion === WITAN_RUBRIC_VERSION_V27;
 }
 var LEGACY_INVENTORY_ABSENCE_CONTEXT = {
   rubricGeneration: "legacy",
@@ -3029,9 +3756,16 @@ function wholesaleCriterionAbstention(signal, reasons) {
     metrics: [],
     insufficientData: true,
     ...insufficientDataReason !== void 0 ? { insufficientDataReason } : {},
-    notes: insufficientDataReason !== void 0 ? "Cejel abstained on this criterion because relevant repository content was declined under the repository content size limit or excluded from scanning by policy. This is a disclosed coverage limit, not a read failure, and does not affect the composite score." : "Cejel abstained on this criterion because one or more relevant repository files could not be read. Resolve the content-read limitations and re-scan."
+    // What the collector read and set aside is still true of the content it did read. B3's names
+    // workflows in a count this abstention removes, so it goes with the count.
+    ...withoutCountDisclosures(signal.disclosures),
+    notes: insufficientDataReason !== void 0 ? "Cejel abstained on this criterion because relevant repository content was declined under the repository content size limit or excluded from scanning by policy. This is a disclosed coverage limit, not a read failure, and does not affect the composite score." : reasons?.size === 1 && reasons.has("lfs_pointer") ? "Cejel abstained on this criterion because relevant files in this checkout are Git LFS pointers, so their content was not read. Fetch the LFS content (git lfs pull) and re-scan." : "Cejel abstained on this criterion because one or more relevant repository files could not be read. Resolve the content-read limitations and re-scan."
   };
 }
+function withoutCountDisclosures(disclosures) {
+  const kept = (disclosures ?? []).filter((text) => !text.startsWith(WITAN_B3_UNSHOWN_CHECK_PREFIX));
+  return kept.length > 0 ? { disclosures: kept } : {};
+}
 function skipReasonsForCriterion(criterionId, tracked) {
   const combined = new Set(tracked.criterionSkipReasons.get(criterionId) ?? []);
   const prefix = contentReadSignalKey(criterionId, "");
@@ -3046,15 +3780,24 @@ function skipReasonsForSignal(criterionId, signalName, tracked) {
   return reasons ? new Set(reasons) : void 0;
 }
 function buildWitanInputFromRepo(options) {
-  const tracked = trackContentReads(options.repoPath, () => buildWitanInputFromRepoUntracked(options));
-  const affectedCriteria = tracked.affectedCriteria;
   const rubricVersion = options.rubricVersion ?? WITAN_RUBRIC_VERSION;
+  const tracked = trackContentReads(
+    options.repoPath,
+    () => buildWitanInputFromRepoUntracked(options),
+    { lfsPointerAbstention: usesV27FalseAssuranceClosure(rubricVersion) }
+  );
+  const affectedCriteria = tracked.affectedCriteria;
   if (rubricVersion !== WITAN_RUBRIC_VERSION_V23) {
     const readFailureCriteria = [];
     const coverageLimitedCriteria = [];
+    const lfsKept = /* @__PURE__ */ new Set();
     const signals2 = (tracked.value.signals ?? []).map((signal) => {
       if (!affectedCriteria.has(signal.criterionId)) return signal;
       const reasons = skipReasonsForCriterion(signal.criterionId, tracked);
+      if (usesV27FalseAssuranceClosure(rubricVersion) && reasons.size > 0 && [...reasons].every((reason) => reason === "lfs_pointer") && (signal.findings ?? []).some(({ severity }) => severity === "critical")) {
+        lfsKept.add(signal.criterionId);
+        return signal;
+      }
       const { insufficientDataReason } = classifyAbstentionReason(reasons);
       (insufficientDataReason !== void 0 ? coverageLimitedCriteria : readFailureCriteria).push(
         signal.criterionId
@@ -3076,7 +3819,10 @@ function buildWitanInputFromRepo(options) {
       ...tracked.value,
       signals: signals2,
       ...scanLimitations2.length > 0 ? { scanLimitations: scanLimitations2 } : {},
-      contentReadSummary: tracked.summary
+      contentReadSummary: lfsKept.size > 0 ? {
+        ...tracked.summary,
+        affectedCriteria: tracked.summary.affectedCriteria.filter((id) => !lfsKept.has(id))
+      } : tracked.summary
     };
   }
   const wholesaleAbstainedReadFailureCriteria = [];
@@ -3208,6 +3954,7 @@ function buildWitanInputFromRepoUntracked(options) {
   const usesV25InlineHealthRoute = rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V26;
   const usesV26SettlingEvidence = rubricVersion === WITAN_RUBRIC_VERSION_V26;
   const usesV26BuildStepEvidence = rubricVersion === WITAN_RUBRIC_VERSION_V26;
+  const usesV27Closure = usesV27FalseAssuranceClosure(rubricVersion);
   const structuralArchetype = classifyRepoArchetype(inventoryFiles, rubricVersion);
   const readableArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure2(rubricVersion) ? applyReadableSourceRepresentationGate(
     options.repoPath,
@@ -3250,6 +3997,7 @@ function buildWitanInputFromRepoUntracked(options) {
     usesV25InlineHealthRoute,
     usesV26SettlingEvidence,
     usesV26BuildStepEvidence,
+    usesV27Closure,
     reviewableSourceProof,
     inventoryAbsenceContext,
     scanLimitations
@@ -3587,7 +4335,7 @@ function isRepresentativeSourceText(contents) {
   return disallowedControls / contents.length <= 0.01;
 }
 function representativeSourceRank(rankKey, file) {
-  return createHash3("sha256").update(`${rankKey}:${file}`).digest("hex");
+  return createHash4("sha256").update(`${rankKey}:${file}`).digest("hex");
 }
 function explainNoMeasurementSourceCoverage(repoPath, rubricVersion) {
   if (!usesV17DetectorClosure2(rubricVersion)) return void 0;
@@ -3839,9 +4587,9 @@ function explainIgnoredScanTarget(repoPath) {
   }
   const top = topResult.stdout.trim();
   if (!top) return void 0;
-  const topResolved = realpathSync(top);
-  const targetResolved = realpathSync(repoPath);
-  const target = relative(topResolved, targetResolved).split(sep).join("/");
+  const topResolved = realpathSync2(top);
+  const targetResolved = realpathSync2(repoPath);
+  const target = relative2(topResolved, targetResolved).split(sep2).join("/");
   if (!target || target.startsWith("../")) return void 0;
   const ignored = execGit(["check-ignore", "--quiet", "--", `${target}/`], {
     cwd: topResolved
@@ -3864,7 +4612,7 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, useV23StrictCoverageAndRecipeRunners, useV23PemPrivateKeyGrammar, useV23WithheldPathAbstention, useV24SecretContentContext, useV25InlineHealthRoute, useV26SettlingEvidence, useV26BuildStepEvidence, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, useV23StrictCoverageAndRecipeRunners, useV23PemPrivateKeyGrammar, useV23WithheldPathAbstention, useV24SecretContentContext, useV25InlineHealthRoute, useV26SettlingEvidence, useV26BuildStepEvidence, useV27FalseAssuranceClosure, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
   const signals = [];
   const mono = resolveMonorepoContext(repoPath, scanLimitations);
   const collectCriterion = (criterionId, collect) => withContentReadCriterion(criterionId, collect);
@@ -3878,7 +4626,8 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV36Detectors,
       useV23StrictCoverageAndRecipeRunners,
       reviewableSourceProof,
-      inventoryAbsenceContext
+      inventoryAbsenceContext,
+      useV27FalseAssuranceClosure
     )
   );
   const a2Signal = collectCriterion(
@@ -3896,7 +4645,8 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV18NativeRls,
       inventoryAbsenceContext,
       scanLimitations,
-      useV26SettlingEvidence
+      useV26SettlingEvidence,
+      useV27FalseAssuranceClosure
     )
   );
   const a3Signal = collectCriterion(
@@ -3921,7 +4671,8 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       mono,
       useV27Detectors,
       useV47Detectors,
-      inventoryAbsenceContext
+      inventoryAbsenceContext,
+      useV27FalseAssuranceClosure
     )
   );
   const a5Signal = collectCriterion(
@@ -3939,10 +4690,13 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
     "B1",
     "Repository scans do not evaluate the dispatch-trace process dimension."
   );
-  const b2Signal = collectCriterion("B2", () => collectB2PrTraceEvidence(repoPath, repoFiles));
+  const b2Signal = collectCriterion(
+    "B2",
+    () => collectB2PrTraceEvidence(repoPath, repoFiles, useV27FalseAssuranceClosure)
+  );
   const b3Signal = collectCriterion(
     "B3",
-    () => collectB3CiDisciplineEvidence(repoPath, repoFiles, mono)
+    () => collectB3CiDisciplineEvidence(repoPath, repoFiles, mono, useV27FalseAssuranceClosure)
   );
   const b4Signal = collectCriterion(
     "B4",
@@ -3984,14 +4738,16 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
   }
   return signals;
 }
-function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV23StrictCoverageAndRecipeRunners, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
+function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV23StrictCoverageAndRecipeRunners, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, useV27FalseAssuranceClosure = false) {
   const evidence = [];
   const findings = [];
-  const allTestFiles = findConcreteTestFiles(
+  const v17TestFiles = findConcreteTestFiles(
     repoPath,
     repoFiles,
     reviewableSourceProof ? WITAN_RUBRIC_VERSION_V17 : void 0
   );
+  const allTestFiles = useV27FalseAssuranceClosure ? v17TestFiles.filter((file) => !PYTEST_CONFTEST_PATTERN.test(file)) : v17TestFiles;
+  const runWideSkips = useV27FalseAssuranceClosure ? findPytestRunWideSkips(repoPath, repoFiles) : [];
   const testFiles = allTestFiles.slice(0, 8);
   const sourceFiles = repoFiles.filter(isSourceFile);
   const runnerFiles = repoFiles.filter(
@@ -4047,13 +4803,31 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
   const verificationScriptCount = verificationScriptComponents.filter((c) => c.count > 0).length;
   const usesLeanBuiltInTestRunner = packageJson != null && [...packageScripts.values()].some(
     (script) => LEAN_TEST_RUNNER_SCRIPT_PATTERN.test(script)
-  ) || testFiles.some((file) => fileContains(repoPath, file, LEAN_TEST_RUNNER_IMPORT_PATTERN));
+  ) || // v17's first eight, under every rubric: v27's conftest exclusion must not move a file into
+  // this sample and change the finding below.
+  v17TestFiles.slice(0, 8).some((file) => fileContains(repoPath, file, LEAN_TEST_RUNNER_IMPORT_PATTERN));
   const hasHeavyTestDependency = packageJsonFiles.some(
     (manifest) => packageJsonHasHeavyTestDependency(repoPath, manifest)
   );
   const isLeanTestToolchain = usesLeanBuiltInTestRunner && !hasHeavyTestDependency;
   for (const file of testFiles) {
-    evidence.push(evidenceForRelative(repoPath, file, "test_run", "Detected test file"));
+    const testPath = join(repoPath, file);
+    const isLfsPointer = isRegularFile(testPath) && isGitLfsPointerText(readRepoText(testPath, "utf8"));
+    evidence.push(
+      evidenceForRelative(
+        repoPath,
+        file,
+        "test_run",
+        isLfsPointer ? "Detected test file (Git LFS pointer; its content is not in this checkout)" : "Detected test file"
+      )
+    );
+  }
+  if (useV27FalseAssuranceClosure && allTestFiles.length === 0) {
+    for (const file of v17TestFiles.slice(0, 8)) {
+      evidence.push(
+        evidenceForRelative(repoPath, file, "test_run", "pytest configuration (conftest.py), not a test file")
+      );
+    }
   }
   for (const file of runnerFiles) {
     evidence.push(evidenceForRelative(repoPath, file, "test_run", "Configured test runner"));
@@ -4072,7 +4846,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
     );
   }
   const scheduledHealthWorkflow = ciWorkflows.find(
-    (file) => fileContains(repoPath, file, SCHEDULE_TRIGGER_PATTERN) && fileContains(repoPath, file, CI_TEST_COMMAND_PATTERN) && (!useV36Detectors || SCHEDULED_HEALTH_PATH_PATTERN.test(file) || fileContains(repoPath, file, SCHEDULED_HEALTH_INTENT_PATTERN))
+    (file) => fileSatisfies(repoPath, file, hasScheduleCronTrigger) && fileContains(repoPath, file, CI_TEST_COMMAND_PATTERN) && (!useV36Detectors || SCHEDULED_HEALTH_PATH_PATTERN.test(file) || fileContains(repoPath, file, SCHEDULED_HEALTH_INTENT_PATTERN))
   );
   if (scheduledHealthWorkflow) {
     const isPublished = fileContains(
@@ -4173,8 +4947,30 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
   const nonHollowShare = withContentReadSignal(
     "A1",
     "non_hollow_test_share",
-    () => measureNonHollowTestShare(repoPath, allTestFiles, reviewableSourceProof !== void 0)
+    () => measureNonHollowTestShare(
+      repoPath,
+      v17TestFiles,
+      reviewableSourceProof !== void 0,
+      useV27FalseAssuranceClosure ? {
+        disabledByRunWideSkip: (file) => runWideSkips.some((skip) => isGovernedPytestFile(skip, file))
+      } : void 0
+    )
   );
+  for (const skip of runWideSkips.slice(0, 2)) {
+    const governed = allTestFiles.filter((file) => isGovernedPytestFile(skip, file)).length;
+    if (governed === 0) continue;
+    findings.push({
+      severity: "warning",
+      summary: `A pytest collection hook in ${skip.path} ${skip.kind === "skip" ? "marks every collected test skipped" : "removes every collected test"}, so the ${governed} pytest file${governed === 1 ? "" : "s"} under ${skip.scope === "" ? "the repository root" : `${skip.scope}/`} cannot run.`,
+      evidence: evidenceForRelativeAtLine(
+        repoPath,
+        skip.path,
+        "test_run",
+        "Run-wide pytest skip hook",
+        skip.line
+      )
+    });
+  }
   return {
     criterionId: "A1",
     positiveEvidence: evidence,
@@ -4311,7 +5107,7 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inve
     notes: `V17 authenticated absence: ${proof.eligibleSourceFileCount} criterion-ratable of ${proof.sourceShapedFileCount} source-shaped files; sampled ${proof.sampledFileCount}; ${proof.readableSampledFileCount} representative-text files. Verification-script signals (lint/typecheck/coverage/CI commands) are independent of test-file presence and are still credited above where detected.`
   };
 }
-function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV23PemPrivateKeyGrammar, useV24SecretContentContext, useV18NativeRls, inventoryAbsenceContext, scanLimitations, useV26SettlingEvidence = false) {
+function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV23PemPrivateKeyGrammar, useV24SecretContentContext, useV18NativeRls, inventoryAbsenceContext, scanLimitations, useV26SettlingEvidence = false, useV27FalseAssuranceClosure = false) {
   const evidence = [];
   const findings = [];
   const gitignore = repoFiles.find((file) => basename(file) === ".gitignore");
@@ -4319,22 +5115,26 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   const migrationFiles = repoFiles.filter(
     (file) => /(^|\/)(migrations?|drizzle|prisma)\//.test(file)
   );
-  const { committedSecret, ambiguousSecret, currentSecretFingerprintsByPath } = withContentReadSignal("A2", "secret_cleanliness", () => {
+  const { committedSecret, ambiguousSecret, currentSecretFingerprintsByPath, placeholderSetAside } = withContentReadSignal("A2", "secret_cleanliness", () => {
     let match_;
     let ambiguous_;
+    const setAsideFiles = [];
     for (const path of repoFiles) {
       const authoredProductionPath = useV24SecretContentContext ? isAuthoredProductionPath(path) : useV47Detectors ? isV47AuthoredProductionPath(path) : useV39Detectors ? isV39AuthoredProductionPath(path) : isAuthoredProductionPath(path);
       if ((useV24SecretContentContext ? isV24IgnoredScanFile(path) : isIgnoredScanFile(path, useV47Detectors)) || useV33Detectors && !authoredProductionPath) {
         continue;
       }
+      const setAside = { count: 0 };
       if (useV24SecretContentContext) {
         const classified = findV24ClassifiedSecretInFile(
           repoPath,
           path,
           useV36Detectors,
           useV39Detectors,
-          useV47Detectors
+          useV47Detectors,
+          setAside
         );
+        if (setAside.count > 0) setAsideFiles.push({ path, count: setAside.count });
         if (!classified) continue;
         if (classified.classification === "real") {
           match_ = { path, match: classified.match };
@@ -4349,8 +5149,10 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
         useV36Detectors,
         useV39Detectors,
         useV47Detectors,
-        useV23PemPrivateKeyGrammar
+        useV23PemPrivateKeyGrammar,
+        setAside
       );
+      if (setAside.count > 0) setAsideFiles.push({ path, count: setAside.count });
       if (!found) continue;
       match_ = { path, match: found };
       break;
@@ -4381,7 +5183,10 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       // abstention exists for repositories Cejel could not classify, not as a way for one
       // unclassifiable value to withhold a metric a confirmed leak already decided.
       ambiguousSecret: match_ ? void 0 : ambiguous_,
-      currentSecretFingerprintsByPath: fingerprintsByPath
+      currentSecretFingerprintsByPath: fingerprintsByPath,
+      // Only a scan that read every eligible file can say what it set aside; one that stopped at
+      // a confirmed secret did not, and the certificate already reports that secret.
+      placeholderSetAside: match_ ? [] : setAsideFiles
     };
   });
   const historySecretScan = committedSecret && !useV27Detectors ? null : collectHistorySecretEvidence(
@@ -4415,10 +5220,13 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   const hasDataLayer = migrationFiles.length > 0 || dbLayerImportFile !== void 0;
   const hasSecretsSurface = envExamples.length > 0 || committedEnvFilePath !== void 0 || gitignoreHasEnvRule || hasEnvInHistory;
   if (!hasDataLayer && !hasSecretsSurface && !hasConfirmedSecretFinding && !cryptoHygiene.hasSurface) {
-    return buildNotApplicableSignal(
-      "A2",
-      "No data layer (DB/ORM/migrations) or ratable secrets surface detected \u2014 A2 not applicable to this repo archetype. A ratable surface requires .env* files, .gitignore .env rule, committed/history .env path, or detected signing/HMAC/secret-comparison code; bare env reads (process.env / os.environ / std::env::) do not qualify."
-    );
+    return {
+      ...buildNotApplicableSignal(
+        "A2",
+        "No data layer (DB/ORM/migrations) or ratable secrets surface detected \u2014 A2 not applicable to this repo archetype. A ratable surface requires .env* files, .gitignore .env rule, committed/history .env path, or detected signing/HMAC/secret-comparison code; bare env reads (process.env / os.environ / std::env::) do not qualify."
+      ),
+      ...placeholderSetAsideDisclosures2(placeholderSetAside)
+    };
   }
   if (committedEnvFilePath) {
     evidence.push(
@@ -4485,7 +5293,12 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       "A2",
       "env_handling_depth",
       () => evidence.push(
-        evidenceForRelative(repoPath, gitignoreEnvFile, "secret_scan", ".env files are gitignored")
+        evidenceForRelative(
+          repoPath,
+          gitignoreEnvFile,
+          "secret_scan",
+          gitignoreEnvRuleLabel(repoFiles.filter(isCommittedEnvFormatPath))
+        )
       )
     );
   }
@@ -4649,6 +5462,9 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   findings.push(...cryptoHygiene.findings);
   if (evidence.length === 0 && findings.length === 0) return null;
   const hasCriticalFinding = findings.some((finding) => finding.severity === "critical");
+  if (useV27FalseAssuranceClosure && !hasCriticalFinding && isShallowRepository(repoPath)) {
+    return shallowHistoryAbstention("A2", V27_A2_SHALLOW_HISTORY_NOTE);
+  }
   const secretCleanliness = hasCriticalFinding ? 0 : 1;
   const abstainsSecretCleanliness = useV24SecretContentContext && ambiguousSecret != null && !hasCriticalFinding;
   const baseMetrics = [
@@ -4660,7 +5476,9 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
         1,
         isMultiTenant ? 0.25 : 0.7,
         "clean",
-        "Credits absence of committed or recent-history secret findings in the static scan."
+        "Credits absence of committed or recent-history secret findings in the static scan.",
+        void 0,
+        secretCleanliness === 1 && placeholderSetAside.length > 0 ? { condition: placeholderSetAsideCondition(placeholderSetAside) } : void 0
       )
     ],
     metric(
@@ -4734,9 +5552,25 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
         "Cejel abstained on secret cleanliness: the current-tree scan matched a secret-shaped value it could not classify from content as either a credential or an example. The metric is withheld rather than scored; every other A2 signal is unaffected."
       ] : [],
       ...tenantIsolationUnsettled ? [WITAN_A2_TENANT_ISOLATION_UNSETTLED_DISCLOSURE] : []
-    ].join(" ")
+    ].join(" "),
+    ...placeholderSetAsideDisclosures2(placeholderSetAside)
   };
 }
+function isCommittedEnvFormatPath(path) {
+  const name = basename(path);
+  return /^\.env(?:\..+)?$|.\.env$/i.test(name) && !isEnvTemplatePath(path, true) && !/(?:example|sample|template)/i.test(name);
+}
+function gitignoreEnvRuleLabel(committedEnvFiles) {
+  const count = committedEnvFiles.length;
+  if (count === 0) return ".env files are gitignored";
+  const lead = `.gitignore has an .env rule, but the scanned tree includes ${count} env file${count === 1 ? "" : "s"}`;
+  for (let shown = Math.min(count, 2); shown > 0; shown -= 1) {
+    const more = count - shown;
+    const label = `${lead}: ${committedEnvFiles.slice(0, shown).join(", ")}${more > 0 ? ` and ${more} more` : ""}`;
+    if (label.length <= EVIDENCE_LABEL_MAX_LENGTH) return label;
+  }
+  return lead;
+}
 function collectCryptoHygieneEvidence(repoPath, implFiles, useV39Detectors = false) {
   const evidence = [];
   const findings = [];
@@ -5210,7 +6044,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
     ...buildStepSettlement === "unsettled" ? { notes: WITAN_A3_BUILD_STEP_UNSETTLED_DISCLOSURE } : {}
   };
 }
-function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors, useV47Detectors, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
+function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors, useV47Detectors, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, useV27FalseAssuranceClosure = false) {
   const evidence = [];
   const findings = [];
   const manifests = repoFiles.filter(isDependencyManifest);
@@ -5323,6 +6157,62 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors,
       )
     });
   }
+  const checkoutPaths = [...repoFiles, ...withheldRepoPaths().map(({ path }) => path)];
+  const knownPaths = [...checkoutPaths, ...mono?.sharedFiles ?? []];
+  const knownBasenames = new Set(knownPaths.map((path) => basename(path)));
+  const findRequirement = () => findLockfileRequirement(
+    repoPath,
+    repoFiles.filter(isGitHubActionsWorkflow),
+    checkoutInventory(checkoutPaths),
+    (lockfiles2) => lockfiles2.some((name) => knownBasenames.has(name))
+  );
+  const lockfileRequirement = hasLockfile || !manifest ? void 0 : useV27FalseAssuranceClosure ? withContentReadSignal("A4", "lockfile_coverage", findRequirement) : withoutContentReadAttribution(findRequirement);
+  const leadingEvidence = [];
+  if (lockfileRequirement) {
+    const cite = () => evidenceForRelativeAtLine(
+      repoPath,
+      lockfileRequirement.file,
+      "dependency_report",
+      `CI step runs \`${lockfileRequirement.command}\`, which needs ${joinLockfileNames(lockfileRequirement.lockfiles)}; the scanned inventory holds none`,
+      lockfileRequirement.line
+    );
+    leadingEvidence.push(
+      useV27FalseAssuranceClosure ? withContentReadSignal("A4", "lockfile_coverage", cite) : withoutContentReadAttribution(cite)
+    );
+  }
+  if (!isAppOrService && manifest) {
+    const unconstrained = withContentReadSignals(
+      "A4",
+      ["pinned_dependency_ratio", "declared_version_range_ratio", "dependency_count_sanity"],
+      () => {
+        const unconstrainedCount = (file) => readDependencySpecs(repoPath, [file]).filter(
+          (dependency) => !hasDeclaredVersionConstraint(dependency)
+        ).length;
+        if (unconstrainedCount(manifest) > 0) return void 0;
+        for (const file of manifests) {
+          if (file === manifest) continue;
+          const count = unconstrainedCount(file);
+          if (count > 0) return { file, count };
+        }
+        return void 0;
+      }
+    );
+    if (unconstrained) {
+      leadingEvidence.push(
+        withContentReadSignals(
+          "A4",
+          ["pinned_dependency_ratio", "declared_version_range_ratio", "dependency_count_sanity"],
+          () => evidenceForRelative(
+            repoPath,
+            unconstrained.file,
+            "dependency_report",
+            `Dependency manifest with ${unconstrained.count} ${unconstrained.count === 1 ? "dependency" : "dependencies"} declared without a version constraint`
+          )
+        )
+      );
+    }
+  }
+  evidence.unshift(...leadingEvidence);
   const automationMetric = metric(
     "dependency_automation_ratio",
     "Dependency automation ratio",
@@ -5383,6 +6273,18 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors,
         "present",
         "Credited when present (reproducible dev/CI installs); a library without a committed lockfile is not penalized \u2014 consumers resolve their own trees."
       )
+    ] : useV27FalseAssuranceClosure && lockfileRequirement ? [
+      // v27 (#520): the repository's own CI requires a lockfile, so its absence is not the
+      // library norm. A zero term can only lower the weighted mean.
+      metric(
+        "lockfile_coverage",
+        "Lockfile coverage",
+        0,
+        1,
+        0.3,
+        "present",
+        "Scored 0: this repository's own CI requires a lockfile, and the scanned inventory holds no recognized lockfile."
+      )
     ] : [],
     automationMetric,
     metric(
@@ -5400,8 +6302,373 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors,
     positiveEvidence: evidence,
     findings,
     metrics: isAppOrService ? appMetrics : libraryMetrics,
-    notes: isAppOrService ? `A4 scored against app/service norms (${packagedApplicationFiles.length > 0 ? "packaged application" : "deploy surface"} detected): pinned dependencies and a lockfile are required for reproducible installs.` : "A4 scored against library/CLI norms (no deploy surface detected \u2014 same archetype line as A3): declared version ranges are correct library behavior; a committed lockfile is credited but not required."
+    notes: isAppOrService ? `A4 scored against app/service norms (${packagedApplicationFiles.length > 0 ? "packaged application" : "deploy surface"} detected): pinned dependencies and a lockfile are required for reproducible installs.` : lockfileRequirement ? `A4 scored against library/CLI norms (no deploy surface detected \u2014 same archetype line as A3): declared version ranges are correct library behavior. An unconditional step in this repository's CI runs \`${lockfileRequirement.command}\` (${lockfileRequirement.file} line ${lockfileRequirement.line}), which exits with an error without ${joinLockfileNames(lockfileRequirement.lockfiles)}, and the scanned inventory holds none.`.slice(0, 1e3) : "A4 scored against library/CLI norms (no deploy surface detected \u2014 same archetype line as A3): declared version ranges are correct library behavior; a committed lockfile is credited but not required."
+  };
+}
+var LOCKFILE_REQUIRING_COMMANDS = [
+  {
+    tool: "npm",
+    subcommands: ["ci"],
+    flags: null,
+    lockfiles: ["package-lock.json", "npm-shrinkwrap.json"],
+    generators: ["install", "i", "add", "update", "up"],
+    directoryFlags: ["--prefix", "-C"],
+    manifestFlags: []
+  },
+  {
+    tool: "pnpm",
+    subcommands: ["install", "i"],
+    flags: ["--frozen-lockfile"],
+    lockfiles: ["pnpm-lock.yaml"],
+    generators: ["install", "i", "add", "update", "up"],
+    directoryFlags: ["--dir", "-C"],
+    manifestFlags: []
+  },
+  {
+    tool: "uv",
+    subcommands: ["run", "sync"],
+    flags: ["--locked", "--frozen"],
+    lockfiles: ["uv.lock"],
+    generators: ["run", "sync", "lock", "add"],
+    directoryFlags: ["--directory", "--project"],
+    manifestFlags: []
+  },
+  {
+    tool: "cargo",
+    subcommands: ["build", "test", "check", "clippy", "doc", "run", "bench"],
+    flags: ["--locked", "--frozen"],
+    lockfiles: ["Cargo.lock"],
+    generators: ["build", "test", "check", "clippy", "doc", "run", "bench", "generate-lockfile", "update"],
+    directoryFlags: ["-C"],
+    manifestFlags: ["--manifest-path"]
+  },
+  {
+    tool: "poetry",
+    subcommands: ["check"],
+    flags: ["--lock"],
+    lockfiles: ["poetry.lock"],
+    generators: ["lock", "install", "add", "update"],
+    directoryFlags: ["--directory", "-C", "--project", "-P"],
+    manifestFlags: []
+  }
+];
+var CONDITIONAL_SHELL_WORDS = /* @__PURE__ */ new Set([
+  "if",
+  "then",
+  "else",
+  "elif",
+  "fi",
+  "case",
+  "esac",
+  "[",
+  "[[",
+  "test",
+  "while",
+  "until",
+  "for",
+  "do",
+  "done"
+]);
+var SHELL_COMMAND_SEPARATORS = /* @__PURE__ */ new Set(["&&", "||", ";", "|"]);
+var DIRECTORY_CHANGE_COMMANDS = /* @__PURE__ */ new Set(["cd", "pushd"]);
+function joinLockfileNames(names) {
+  return names.length === 1 ? names[0] ?? "" : `${names.slice(0, -1).join(", ")} or ${names[names.length - 1]}`;
+}
+function isGitHubActionsWorkflow(file) {
+  return /^\.github\/workflows\/[^/]+\.ya?ml$/.test(file);
+}
+function beforeShellComment(line) {
+  const trimmed = line.trimStart();
+  if (trimmed.startsWith("#")) return "";
+  const cut = [trimmed.indexOf(" #"), trimmed.indexOf("	#")].filter((index) => index !== -1);
+  return cut.length > 0 ? trimmed.slice(0, Math.min(...cut)) : trimmed;
+}
+function shellCommands(line) {
+  const commands = [[]];
+  for (const raw of beforeShellComment(line).split(/[ \t]+/)) {
+    const word = raw.endsWith(";") && raw.length > 1 ? raw.slice(0, -1) : raw;
+    if (word === "") continue;
+    if (SHELL_COMMAND_SEPARATORS.has(word)) {
+      commands.push([]);
+      continue;
+    }
+    commands[commands.length - 1]?.push(word);
+    if (raw.endsWith(";") && raw.length > 1) commands.push([]);
+  }
+  return commands.filter((command) => command.length > 0);
+}
+var OMITTED_COMMAND_WORDS_MARKER = "\u2026";
+function matchLockfileRequiringCommand(words, rule) {
+  if (words[0] !== rule.tool) return void 0;
+  const subcommand = rule.subcommands.find((candidate) => candidate === words[1]);
+  if (subcommand === void 0) return void 0;
+  if (rule.flags === null) return `${rule.tool} ${subcommand}`;
+  const flags = rule.flags;
+  const end = words.indexOf("--");
+  const own = end === -1 ? words.slice(2) : words.slice(2, end);
+  for (const [index, word] of own.entries()) {
+    const flag = flags.find((candidate) => candidate === (word.split("=")[0] ?? word));
+    if (flag === void 0) continue;
+    return `${rule.tool} ${subcommand}${index > 0 ? ` ${OMITTED_COMMAND_WORDS_MARKER}` : ""} ${flag}`;
+  }
+  return void 0;
+}
+function commandHead(words) {
+  let inverted = false;
+  for (let index = 0; index < words.length; index += 1) {
+    const raw = words[index] ?? "";
+    let lead = 0;
+    while (lead < raw.length && (raw[lead] === "(" || raw[lead] === "{" || raw[lead] === "!")) lead += 1;
+    const prefix = raw.slice(0, lead);
+    if (prefix.includes("!") || prefix.includes("((")) inverted = true;
+    if (lead < raw.length) return { word: raw.slice(lead), argsFrom: index + 1, inverted };
+  }
+  return { word: "", argsFrom: words.length, inverted };
+}
+function isConditionalShellCommand(words) {
+  const head = commandHead(words);
+  if (head.inverted || CONDITIONAL_SHELL_WORDS.has(head.word)) return true;
+  if (head.word !== "set") return false;
+  const args = words.slice(head.argsFrom);
+  return args.some(
+    (arg, index) => arg === "+o" && args[index + 1] === "errexit" || arg.length > 1 && arg.startsWith("+") && /^[A-Za-z]+$/.test(arg.slice(1)) && arg.includes("e")
+  );
+}
+var RUN_KEY_PATTERN = /^([ \t]*)(?:-[ \t]+)?run:[ \t]*(.*)$/;
+var IF_KEY_PATTERN = /^[ \t]*(?:-[ \t]+)?if:/;
+var CONTINUE_ON_ERROR_KEY_PATTERN = /^[ \t]*(?:-[ \t]+)?continue-on-error:[ \t]*(.*)$/;
+var STEPS_KEY_PATTERN = /^[ \t]*steps:[ \t]*$/;
+var LIST_ITEM_PATTERN = /^[ \t]*-[ \t]/;
+var BLOCK_SCALAR_KEY_PATTERN = /^[ \t]*(?:-[ \t]+)?[^\s:#'"-][^:]*:[ \t]*[|>][-+0-9]*(?:[ \t]+(?:#.*)?)?$/;
+var BLOCK_SCALAR_VALUE_PATTERN = /^[|>][-+0-9]*$/;
+function lineIndent(line) {
+  return line.length - line.trimStart().length;
+}
+function isStepOrJobGuard(line) {
+  if (IF_KEY_PATTERN.test(line)) return true;
+  const continueOnError = CONTINUE_ON_ERROR_KEY_PATTERN.exec(line);
+  if (!continueOnError) return false;
+  const value = beforeShellComment(continueOnError[1] ?? "").trim().replace(/^(['"])(.*)\1$/, "$2");
+  return value !== "false";
+}
+function workflowKeyIndent(line, indent) {
+  return indent + (line.trimStart().startsWith("-") ? 2 : 0);
+}
+function blockScalarBodyLines(lines, indents) {
+  const body = new Array(lines.length).fill(false);
+  for (let index = 0; index < lines.length; index += 1) {
+    const raw = lines[index] ?? "";
+    if (!BLOCK_SCALAR_KEY_PATTERN.test(raw)) continue;
+    const keyIndent = workflowKeyIndent(raw, indents[index] ?? 0);
+    let next = index + 1;
+    for (; next < lines.length; next += 1) {
+      if ((lines[next] ?? "").trim() !== "" && (indents[next] ?? 0) <= keyIndent) break;
+      body[next] = true;
+    }
+    index = next - 1;
+  }
+  return body;
+}
+function nextAtOrBelowIndexes(structural, indents) {
+  const next = new Array(structural.length).fill(structural.length);
+  const open = [];
+  for (let index = 0; index < structural.length; index += 1) {
+    if (!structural[index]) continue;
+    const indent = indents[index] ?? 0;
+    while (open.length > 0 && (indents[open[open.length - 1] ?? 0] ?? 0) >= indent) {
+      next[open.pop() ?? 0] = index;
+    }
+    open.push(index);
+  }
+  return next;
+}
+function leastGuardIndentWithin(structural, indents, isGuard) {
+  const least = new Array(structural.length).fill(Number.POSITIVE_INFINITY);
+  const open = [];
+  const close = () => {
+    const top = open.pop() ?? 0;
+    const below = open[open.length - 1];
+    if (below !== void 0) least[below] = Math.min(least[below] ?? 0, least[top] ?? 0);
   };
+  for (let index = 0; index < structural.length; index += 1) {
+    if (!structural[index]) continue;
+    const indent = indents[index] ?? 0;
+    while (open.length > 0 && (indents[open[open.length - 1] ?? 0] ?? 0) >= indent) close();
+    if (isGuard[index]) least[index] = indent;
+    open.push(index);
+  }
+  while (open.length > 0) close();
+  return least;
+}
+function githubActionsRunSteps(contents) {
+  const lines = contents.split(/\r?\n/);
+  const indents = lines.map(lineIndent);
+  const inBlockScalar = blockScalarBodyLines(lines, indents);
+  const structural = lines.map((raw, index) => !inBlockScalar[index] && raw.trim() !== "");
+  const isGuard = lines.map((raw, index) => (structural[index] ?? false) && isStepOrJobGuard(raw));
+  const itemAtOrAbove = new Array(lines.length);
+  const stepsKeyAbove = new Array(lines.length);
+  const lessIndentedAbove = new Array(lines.length);
+  {
+    let lastItem = -1;
+    let lastStepsKey = -1;
+    const open = [];
+    for (let index = 0; index < lines.length; index += 1) {
+      const raw = lines[index] ?? "";
+      if (structural[index] && LIST_ITEM_PATTERN.test(raw)) lastItem = index;
+      itemAtOrAbove[index] = lastItem;
+      stepsKeyAbove[index] = lastStepsKey;
+      if (!structural[index]) {
+        lessIndentedAbove[index] = -1;
+        continue;
+      }
+      if (STEPS_KEY_PATTERN.test(raw)) lastStepsKey = index;
+      const indent = indents[index] ?? 0;
+      while (open.length > 0 && (indents[open[open.length - 1] ?? 0] ?? 0) >= indent) open.pop();
+      lessIndentedAbove[index] = open.length > 0 ? open[open.length - 1] ?? -1 : -1;
+      open.push(index);
+    }
+  }
+  const nextAtOrBelow = nextAtOrBelowIndexes(structural, indents);
+  const leastGuardIndent = leastGuardIndentWithin(structural, indents, isGuard);
+  const guardedJobs = /* @__PURE__ */ new Set();
+  for (let index = 0; index < lines.length; index += 1) {
+    if (isGuard[index]) guardedJobs.add(`${lessIndentedAbove[index] ?? -1}:${indents[index] ?? 0}`);
+  }
+  const steps = [];
+  for (let index = 0; index < lines.length; index += 1) {
+    if (!structural[index]) continue;
+    const raw = lines[index] ?? "";
+    const match = execOnTerminatorFreeLine(RUN_KEY_PATTERN, raw);
+    if (!match) continue;
+    const keyIndent = workflowKeyIndent(raw, (match[1] ?? "").length);
+    const value = (match[2] ?? "").trim();
+    const body = [];
+    if (BLOCK_SCALAR_VALUE_PATTERN.test(beforeShellComment(value).trim())) {
+      for (let next = index + 1; next < lines.length && inBlockScalar[next]; next += 1) {
+        const text = lines[next] ?? "";
+        if (text.trim() !== "") body.push({ line: next + 1, text });
+      }
+    } else if (value !== "") {
+      body.push({ line: index + 1, text: value.replace(/^(['"])(.*)\1$/, "$2") });
+    }
+    const stepStart = itemAtOrAbove[index] ?? -1;
+    if (stepStart === -1) {
+      steps.push({ lines: body, conditional: true });
+      continue;
+    }
+    const placed = stepStart === index || (nextAtOrBelow[stepStart] ?? lines.length) > index;
+    const stepConditional = (leastGuardIndent[stepStart] ?? Number.POSITIVE_INFINITY) <= keyIndent;
+    const stepsKey = stepsKeyAbove[stepStart] ?? -1;
+    const jobConditional = stepsKey !== -1 && guardedJobs.has(`${lessIndentedAbove[stepsKey] ?? -1}:${indents[stepsKey] ?? 0}`);
+    steps.push({ lines: body, conditional: !placed || stepConditional || jobConditional });
+  }
+  return steps;
+}
+var WORKFLOW_OTHER_REPOSITORY_PATTERN = /^[ \t]*(?:-[ \t]+)?repository:[ \t]*\S/;
+var WORKFLOW_DOWNLOAD_ARTIFACT_PATTERN = /^[ \t]*(?:-[ \t]+)?uses:[ \t]*['"]?actions\/download-artifact@/;
+var WORKFLOW_WORKING_DIRECTORY_PATTERN = /^[ \t]*(?:-[ \t]+)?working-directory:[ \t]*(.*)$/;
+var EXPANDED_PATH_PATTERN = /[$~`*?[\]{}'"\\]/;
+function checkoutInventory(paths) {
+  const directories = /* @__PURE__ */ new Set();
+  for (const path of paths) {
+    for (let end = path.lastIndexOf("/"); end > 0; end = path.lastIndexOf("/", end - 1)) {
+      const directory = path.slice(0, end);
+      if (directories.has(directory)) break;
+      directories.add(directory);
+    }
+  }
+  return { files: new Set(paths), directories };
+}
+function literalCheckoutPath(written) {
+  let end = written.length;
+  while (end > 1 && written[end - 1] === "/") end -= 1;
+  let path = written.slice(0, end);
+  while (path.startsWith("./")) path = path.slice(2);
+  if (path === "" || path.startsWith("/") || EXPANDED_PATH_PATTERN.test(path)) return void 0;
+  return path;
+}
+function isCheckoutDirectory(inventory, written) {
+  const path = literalCheckoutPath(written);
+  return path !== void 0 && (path === "." || inventory.directories.has(path));
+}
+function isCheckoutFile(inventory, written) {
+  const path = literalCheckoutPath(written);
+  return path !== void 0 && inventory.files.has(path);
+}
+function commandStaysInCheckout(words, rule, inventory) {
+  const end = words.indexOf("--");
+  const own = end === -1 ? words.slice(2) : words.slice(2, end);
+  const checks = [
+    [rule.directoryFlags, isCheckoutDirectory],
+    [rule.manifestFlags, isCheckoutFile]
+  ];
+  for (const [index, word] of own.entries()) {
+    for (const [flags, holds] of checks) {
+      for (const flag of flags) {
+        let value;
+        if (word === flag) value = own[index + 1] ?? "";
+        else if (word.startsWith(`${flag}=`)) value = word.slice(flag.length + 1);
+        else if (!flag.startsWith("--") && word.startsWith(flag)) value = word.slice(flag.length);
+        else continue;
+        if (!holds(inventory, value)) return false;
+      }
+    }
+  }
+  return true;
+}
+function workflowReadsOnlyThisTree(inventory, contents) {
+  for (const raw of contents.split(/\r?\n/)) {
+    if (WORKFLOW_OTHER_REPOSITORY_PATTERN.test(raw)) return false;
+    if (WORKFLOW_DOWNLOAD_ARTIFACT_PATTERN.test(raw)) return false;
+    const workingDirectory = WORKFLOW_WORKING_DIRECTORY_PATTERN.exec(raw);
+    if (workingDirectory) {
+      const value = beforeShellComment(workingDirectory[1] ?? "").trim().replace(/^(['"])(.*)\1$/, "$2");
+      if (!isCheckoutDirectory(inventory, value)) return false;
+    }
+  }
+  return true;
+}
+function findLockfileRequirement(repoPath, workflows, inventory, isSatisfied) {
+  for (const file of workflows) {
+    const fullPath = join(repoPath, file);
+    if (!isRegularFile(fullPath)) continue;
+    const contents = readRepoText(fullPath, "utf8");
+    if (!workflowReadsOnlyThisTree(inventory, contents)) continue;
+    const steps = githubActionsRunSteps(contents);
+    const commandsOf = (step) => step.lines.flatMap(({ line, text }) => shellCommands(text).map((words) => ({ line, words })));
+    const stepCommands = steps.map(commandsOf);
+    const mayBeGenerated = /* @__PURE__ */ new Set();
+    for (const { words } of stepCommands.flat()) {
+      for (const rule of LOCKFILE_REQUIRING_COMMANDS) {
+        if (mayBeGenerated.has(rule)) continue;
+        const generates = words[0] === rule.tool && rule.generators.includes(words[1] ?? "") && matchLockfileRequiringCommand(words, rule) === void 0;
+        const names = words.some((word) => rule.lockfiles.some((lockfile) => word.includes(lockfile)));
+        if (generates || names) mayBeGenerated.add(rule);
+      }
+    }
+    for (const [stepIndex, step] of steps.entries()) {
+      if (step.conditional) continue;
+      const commands = stepCommands[stepIndex] ?? [];
+      const shellIsConditional = step.lines.some(({ text }) => beforeShellComment(text).includes("<<")) || commands.some(({ words }) => isConditionalShellCommand(words)) || step.lines.some(({ text }) => /(^|[ \t])\|\|([ \t]|$)/.test(beforeShellComment(text)));
+      if (shellIsConditional) continue;
+      const leavesCheckout = commands.some(({ words }) => {
+        const head = commandHead(words);
+        return DIRECTORY_CHANGE_COMMANDS.has(head.word) && !isCheckoutDirectory(inventory, words[head.argsFrom] ?? "");
+      });
+      if (leavesCheckout) continue;
+      for (const { line, words } of commands) {
+        for (const rule of LOCKFILE_REQUIRING_COMMANDS) {
+          const command = matchLockfileRequiringCommand(words, rule);
+          if (command === void 0 || isSatisfied(rule.lockfiles) || mayBeGenerated.has(rule) || !commandStaysInCheckout(words, rule, inventory)) {
+            continue;
+          }
+          return { file, line, command: command.slice(0, 80), lockfiles: rule.lockfiles };
+        }
+      }
+    }
+  }
+  return void 0;
 }
 var LIBRARY_DEPENDENCY_COUNT_SANE_MAX = 120;
 function libraryDependencyCountSanity(specCount) {
@@ -5606,7 +6873,20 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, use
     ...reconciliationUnsettled ? { notes: WITAN_A5_RECONCILIATION_UNSETTLED_DISCLOSURE } : {}
   };
 }
-function collectB2PrTraceEvidence(repoPath, repoFiles) {
+var RECENT_COMMIT_WINDOW = 12;
+var V27_A2_SHALLOW_HISTORY_NOTE = "A2 abstained: this repository is a shallow clone, so the scan for credentials and .env files in earlier commits read only the commits present, and no confirmed critical finding stands on what was read. Re-scan a full clone (for actions/checkout, set fetch-depth: 0).";
+var V27_B2_SHALLOW_HISTORY_NOTE = `B2 abstained: this repository is a shallow clone with fewer than ${RECENT_COMMIT_WINDOW} commits visible, so the pull-request merge ratio cannot be read over its window. Re-scan a full clone (for actions/checkout, set fetch-depth: 0).`;
+function shallowHistoryAbstention(criterionId, notes) {
+  return {
+    criterionId,
+    positiveEvidence: [],
+    findings: [],
+    metrics: [],
+    insufficientData: true,
+    notes
+  };
+}
+function collectB2PrTraceEvidence(repoPath, repoFiles, useV27FalseAssuranceClosure = false) {
   const workflows = repoFiles.filter(isCiWorkflow);
   const prTemplate = repoFiles.find(
     (file) => /(^|\/)(pull_request_template|PULL_REQUEST_TEMPLATE)(\.md$|\/[^/]+\.md$)/.test(file)
@@ -5615,15 +6895,21 @@ function collectB2PrTraceEvidence(repoPath, repoFiles) {
     (file) => /branch.*protection|review.*gate/i.test(file) || GITHUB_CODEOWNERS_PATH_PATTERN.test(file)
   );
   const citedWorkflows = workflows.slice(0, 3);
-  const workflowLabel = ciWorkflowCitationLabel(
-    "Pull-request CI workflow",
-    "counted",
-    workflows.length,
-    citedWorkflows.length,
-    unreadCiWorkflowReasons(() => true)
+  const unreadWorkflows = unreadCiWorkflowReasons(() => true);
+  const workflowLabel = (file) => fittedCiWorkflowCitationLabel(
+    b2WorkflowCitationBaseLabels(repoPath, file),
+    (baseLabel) => ciWorkflowCitationLabel(
+      baseLabel,
+      "counted",
+      workflows.length,
+      citedWorkflows.length,
+      unreadWorkflows
+    )
   );
   const evidence = [
-    ...citedWorkflows.map((file) => evidenceForRelative(repoPath, file, "ci_run", workflowLabel)),
+    ...citedWorkflows.map(
+      (file) => evidenceForRelative(repoPath, file, "ci_run", workflowLabel(file))
+    ),
     ...prTemplate ? [evidenceForRelative(repoPath, prTemplate, "pull_request", "Pull request template")] : [],
     ...branchProtectionDoc ? [
       evidenceForRelative(
@@ -5635,6 +6921,9 @@ function collectB2PrTraceEvidence(repoPath, repoFiles) {
     ] : []
   ];
   if (evidence.length === 0) return null;
+  if (useV27FalseAssuranceClosure && isShallowRepository(repoPath) && readRecentCommits(repoPath).length < RECENT_COMMIT_WINDOW) {
+    return shallowHistoryAbstention("B2", V27_B2_SHALLOW_HISTORY_NOTE);
+  }
   return {
     criterionId: "B2",
     positiveEvidence: evidence,
@@ -5678,18 +6967,46 @@ function collectB2PrTraceEvidence(repoPath, repoFiles) {
     ]
   };
 }
-function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
+function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono, useV27FalseAssuranceClosure = false) {
   const evidence = [];
   const packageJson = findRootPackageJson(repoFiles);
   const scripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
   const workflows = repoFiles.filter(isCiWorkflow);
   const workflow = workflows[0];
   const rootWorkflows = mono ? mono.sharedFiles.filter(isCiWorkflow) : [];
-  const defaultBranchCiCount = withContentReadSignal(
+  const knownPaths = [...repoFiles, ...withheldRepoPaths().map(({ path }) => path)];
+  const ownInventory = {
+    scanned: new Set(repoFiles),
+    known: new Set(knownPaths),
+    hasYarnPlugins: knownPaths.some((path) => path.startsWith(".yarn/plugins/"))
+  };
+  const countsAsCi = (root) => (file) => !useV27FalseAssuranceClosure || !isPublishOnlyWorkflow(root, file, root === repoPath ? ownInventory : null);
+  const { defaultBranchCiCount, defaultBranchCiWorkflows, rootDefaultBranchCiWorkflows } = withContentReadSignal(
     "B3",
     "default_branch_ci_depth",
-    () => workflows.filter((file) => workflowTargetsDefaultBranch(repoPath, file)).length + (mono ? rootWorkflows.filter((file) => workflowTargetsDefaultBranch(mono.root, file)).length : 0)
+    () => {
+      const counted = workflows.filter(countsAsCi(repoPath)).filter((file) => workflowTargetsDefaultBranch(repoPath, file));
+      const rootCounted = mono ? rootWorkflows.filter(countsAsCi(mono.root)).filter((file) => workflowTargetsDefaultBranch(mono.root, file)) : [];
+      return {
+        defaultBranchCiCount: counted.length + rootCounted.length,
+        defaultBranchCiWorkflows: counted,
+        rootDefaultBranchCiWorkflows: rootCounted
+      };
+    }
+  );
+  const unshownCheckWorkflows = mergeB3UnshownCheckWorkflows(
+    findB3UnshownCheckWorkflows(repoPath, defaultBranchCiWorkflows),
+    mono ? findB3UnshownCheckWorkflows(
+      mono.root,
+      rootDefaultBranchCiWorkflows,
+      (file) => `${file} at the monorepo root`
+    ) : { printOnly: [] }
   );
+  const publishOnlyWorkflows = useV27FalseAssuranceClosure ? withContentReadSignals(
+    "B3",
+    ["ci_script_depth", "default_branch_ci_depth"],
+    () => workflows.filter((file) => isPublishOnlyWorkflow(repoPath, file, ownInventory))
+  ) : [];
   if (packageJson && scripts.has("test")) {
     evidence.push(evidenceForRelative(repoPath, packageJson, "test_run", "Test script"));
   }
@@ -5771,10 +7088,10 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
     "ci_script_depth",
     () => ({
       repoCategoryHits: CI_COMMAND_CATEGORIES.map(
-        (pattern) => workflows.some((file) => fileContains(repoPath, file, pattern))
+        (pattern) => workflows.filter(countsAsCi(repoPath)).some((file) => fileContains(repoPath, file, pattern))
       ),
       rootCategoryHits: mono ? CI_COMMAND_CATEGORIES.map(
-        (pattern) => rootWorkflows.some((file) => fileContains(mono.root, file, pattern))
+        (pattern) => rootWorkflows.filter(countsAsCi(mono.root)).some((file) => fileContains(mono.root, file, pattern))
       ) : []
     })
   );
@@ -5820,10 +7137,655 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
         0.55,
         "workflows",
         "Counts CI workflows that target pull requests or the default branch, up to 4.",
-        "saturating_count"
+        "saturating_count",
+        b3UnshownCheckCount(unshownCheckWorkflows) > 0 ? { condition: b3UnshownCheckCondition(unshownCheckWorkflows) } : void 0
       )
-    ]
+    ],
+    ...publishOnlyWorkflows.length > 0 ? { notes: b3PublishOnlyNote(publishOnlyWorkflows) } : {},
+    ...b3UnshownCheckDisclosures(unshownCheckWorkflows)
+  };
+}
+function b3UnshownCheckDisclosures(unshown) {
+  const sentence = b3UnshownCheckDisclosure(unshown, CRITERION_DISCLOSURE_MAX_LENGTH);
+  return sentence ? { disclosures: [sentence] } : {};
+}
+function b3PublishOnlyNote(publishOnlyWorkflows) {
+  return `${publishOnlyWorkflows.length === 1 ? "1 workflow that only publishes, releases or deploys" : `${publishOnlyWorkflows.length} workflows that only publish, release or deploy`} (no pull-request trigger, and every step Cejel reads only checks out, sets up a toolchain, configures credentials or uploads an already-built artifact) ${publishOnlyWorkflows.length === 1 ? "is" : "are"} not counted as CI verification: ${publishOnlyWorkflows.slice(0, 4).join(", ")}${publishOnlyWorkflows.length > 4 ? ", ..." : ""}.`.slice(0, CRITERION_NOTES_MAX_LENGTH);
+}
+var PUBLISH_OR_DEPLOY_STEP_PATTERN = /\b(?:npm|pnpm|yarn|bun)[ \t]+(?:npm[ \t]+)?publish\b|\bpypa\/gh-action-pypi-publish\b|\btwine[ \t]+upload\b|\b(?:uv|poetry|flit|hatch|cargo)[ \t]+publish\b|\bgem[ \t]+push\b|\bgh[ \t]+release[ \t]+(?:create|upload)\b|\bsoftprops\/action-gh-release\b|\bgoreleaser\b|\bsemantic-release\b|\bchangesets\/action\b|\bdocker[ \t]+(?:image[ \t]+)?push\b|\bdocker\/build-push-action\b|\b(?:vercel|netlify|flyctl|fly|firebase|serverless|wrangler)[ \t]+deploy\b|\bkubectl[ \t]+apply\b|\bhelm[ \t]+upgrade\b|\bterraform[ \t]+apply\b/i;
+var PUBLISH_ONLY_EXTRA_VERIFICATION_PATTERN = /\b(?:tox|nox|pre-commit|bazel[ \t]+test|gradlew?[ \t]+(?:test|check|build)|mvnw?[ \t]+(?:verify|test|package)|make[ \t]+(?:check|test)|just[ \t]+test|cargo[ \t]+(?:clippy|check|nextest)|turbo[ \t]+(?:run[ \t]+)?test)\b|[ \t]-r[ \t]+test\b|\brun[ \t]+test\b/i;
+var PULL_REQUEST_TRIGGERS = ["pull_request", "pull_request_target", "merge_group"];
+var PULL_REQUEST_TRIGGER_PATTERN = /\b(?:pull_request|pull_request_target|merge_group)\b/;
+var REUSABLE_WORKFLOW_CALL_PATTERN = /^[ \t]*uses:[ \t]*\S*\.github\/workflows\//m;
+function isPublishOnlyWorkflow(repoPath, file, inventory) {
+  if (!isGitHubActionsWorkflow(file)) return false;
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return false;
+  const contents = readRepoText(fullPath, "utf8");
+  if (!PUBLISH_OR_DEPLOY_STEP_PATTERN.test(contents) || PULL_REQUEST_TRIGGER_PATTERN.test(contents) || REUSABLE_WORKFLOW_CALL_PATTERN.test(contents) || CI_TEST_COMMAND_PATTERN.test(contents) || CI_LINT_COMMAND_PATTERN.test(contents) || CI_TYPECHECK_COMMAND_PATTERN.test(contents) || PUBLISH_ONLY_EXTRA_VERIFICATION_PATTERN.test(contents) || YAML_LINE_BREAK_NOT_SPLIT_PATTERN.test(contents)) {
+    return false;
+  }
+  const steps = placedPublishWorkflowSteps(contents);
+  if (steps === null) return false;
+  let publishes = false;
+  const needs = /* @__PURE__ */ new Set();
+  for (const step of steps) {
+    const classified = step.uses !== void 0 ? { kind: classifyPublishOnlyUsesStep(step.uses, step.inputs) } : classifyPublishOnlyRunLines(step.run ?? []);
+    if (classified.kind === "other") return false;
+    if (classified.kind === "publish") publishes = true;
+    for (const need of classified.needs ?? []) needs.add(need);
+  }
+  if (!publishes) return false;
+  if (needs.size > 0 && inventory === null) return false;
+  if (needs.has("package") && !packageManifestRunsNoRepositoryCode(repoPath, inventory)) {
+    return false;
+  }
+  return true;
+}
+function classifyPublishOnlyRunLines(lines) {
+  let kind = "setup";
+  const needs = /* @__PURE__ */ new Set();
+  for (const text of joinShellContinuationLines(lines)) {
+    for (const words of shellCommands(text)) {
+      const command = classifyPublishOnlyRunCommand(words);
+      if (command.kind === "other") return { kind: "other" };
+      if (command.kind === "publish") kind = "publish";
+      for (const need of command.needs ?? []) needs.add(need);
+    }
+  }
+  return { kind, needs: [...needs] };
+}
+var PACKAGE_LIFECYCLE_SCRIPTS = [
+  "preinstall",
+  "install",
+  "postinstall",
+  "preprepare",
+  "prepare",
+  "postprepare",
+  "prepack",
+  "postpack",
+  "prepublish",
+  "prepublishOnly",
+  "publish",
+  "postpublish",
+  "dependencies"
+];
+var PACKAGE_MANAGER_CODE_CONFIG_FILES = [
+  ".npmrc",
+  ".yarnrc",
+  ".yarnrc.yml",
+  ".pnpmfile.cjs",
+  "pnpmfile.js",
+  "bunfig.toml",
+  "pnpm-workspace.yaml",
+  "lerna.json",
+  "binding.gyp"
+];
+var PACKAGE_DEPENDENCY_FIELDS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+function packageManifestRunsNoRepositoryCode(root, inventory) {
+  if (!inventory.scanned.has("package.json")) return false;
+  if (PACKAGE_MANAGER_CODE_CONFIG_FILES.some((file) => inventory.known.has(file))) return false;
+  if (inventory.hasYarnPlugins) return false;
+  const manifest = parseJsonObject(readRepoText(join(root, "package.json"), "utf8"));
+  if (!manifest || "workspaces" in manifest || "gypfile" in manifest) return false;
+  const scripts = manifest.scripts;
+  if (scripts !== void 0 && !isRecord(scripts)) return false;
+  if (isRecord(scripts) && PACKAGE_LIFECYCLE_SCRIPTS.some((name) => name in scripts)) return false;
+  for (const field of PACKAGE_DEPENDENCY_FIELDS) {
+    const dependencies = manifest[field];
+    if (dependencies === void 0) continue;
+    if (!isRecord(dependencies)) return false;
+    for (const spec of Object.values(dependencies)) {
+      if (typeof spec !== "string") return false;
+      if (/^(?:file|link|workspace|portal):|^\.{0,2}\//.test(spec.trim())) return false;
+    }
+  }
+  return true;
+}
+var PUBLISH_ONLY_JOB_KEYS = /* @__PURE__ */ new Set(["runs-on", "name", "timeout-minutes", "needs", "permissions", "environment", "steps"]);
+var PUBLISH_ONLY_JOB_MAPPING_KEYS = /* @__PURE__ */ new Set(["permissions", "environment"]);
+var PUBLISH_ONLY_STEP_KEYS = /* @__PURE__ */ new Set(["name", "id", "uses", "run", "with", "env"]);
+var PLAIN_MAPPING_ENTRY_PATTERN = /^([A-Za-z_][A-Za-z0-9_-]*):(?:[ \t]+([^]*))?$/;
+var NEEDS_FLOW_SEQUENCE_PATTERN = /^\[[ \t]*[A-Za-z0-9_-]+(?:[ \t]*,[ \t]*[A-Za-z0-9_-]+)*[ \t]*\]$/;
+function isPlainOneLineValue(value) {
+  return value !== "" && !/^[[{&*|>!]/.test(value) && isOneLineScalar(value);
+}
+function placedPublishWorkflowSteps(contents) {
+  if (YAML_LINE_BREAK_NOT_SPLIT_PATTERN.test(contents) || OTHER_LEADING_BLANK_PATTERN.test(contents)) return null;
+  const lines = contents.split(/\r?\n/);
+  const isContent = (line) => line.trim() !== "" && !line.trimStart().startsWith("#");
+  let jobsStart = -1;
+  for (let index = 0; index < lines.length; index += 1) {
+    const raw = lines[index] ?? "";
+    if (!isContent(raw) || /^[ \t]/.test(raw)) continue;
+    if (!PRINT_ONLY_TOP_LEVEL_KEY_PATTERN.test(raw)) return null;
+    if (/^jobs:[ \t]*$/.test(stripYamlComment(raw))) {
+      if (jobsStart !== -1) return null;
+      jobsStart = index;
+    }
+  }
+  if (jobsStart === -1) return null;
+  const steps = [];
+  let jobIndent = -1;
+  let keyIndent = -1;
+  let inSteps = false;
+  let stepKeyColumn = -1;
+  let step = null;
+  let body = null;
+  const openStep = () => step;
+  const closeStep = () => {
+    if (step === null) return true;
+    const placed = step;
+    step = null;
+    if (placed.uses === void 0 === (placed.run === void 0)) return false;
+    steps.push(placed);
+    return true;
+  };
+  for (let index = jobsStart + 1; index < lines.length; index += 1) {
+    const raw = lines[index] ?? "";
+    if (raw.trim() === "") continue;
+    const indent = lineIndent(raw);
+    if (body) {
+      if (indent > body.column) {
+        if (body.kind === "plain") return null;
+        if (body.kind === "run") {
+          openStep()?.run?.push(raw.trim());
+          continue;
+        }
+        if (body.textColumn !== -1 && indent > body.textColumn) continue;
+        body.textColumn = -1;
+        if (!isContent(raw)) continue;
+        if (body.entryColumn === -1) body.entryColumn = indent;
+        if (indent !== body.entryColumn) return null;
+        const entry = PLAIN_MAPPING_ENTRY_PATTERN.exec(stripYamlComment(raw).trim());
+        if (!entry) return null;
+        const name = entry[1] ?? "";
+        const value2 = (entry[2] ?? "").trim();
+        if (body.owner === "env" && isCodeLoadingEnvKey(name)) return null;
+        if (body.owner === "with") {
+          openStep()?.inputs.add(name);
+          if (BLOCK_SCALAR_INDICATOR_PATTERN.test(value2)) {
+            body.textColumn = indent;
+            continue;
+          }
+        }
+        if (!isPlainOneLineValue(value2)) return null;
+        continue;
+      }
+      body = null;
+    }
+    if (!isContent(raw)) continue;
+    const text = stripYamlComment(raw).trimEnd();
+    if (indent === 0) break;
+    if (jobIndent === -1) jobIndent = indent;
+    if (indent < jobIndent) return null;
+    if (indent === jobIndent) {
+      if (!closeStep()) return null;
+      if (!/^[ \t]*[A-Za-z_][A-Za-z0-9_-]*:[ \t]*$/.test(text)) return null;
+      keyIndent = -1;
+      inSteps = false;
+      continue;
+    }
+    if (keyIndent === -1) keyIndent = indent;
+    const isItem = /^[ \t]*-[ \t]+/.test(text);
+    if (indent < keyIndent) return null;
+    if (indent === keyIndent && !(inSteps && isItem)) {
+      if (!closeStep()) return null;
+      inSteps = false;
+      const key2 = UNQUOTED_KEY_PATTERN.exec(text.trim());
+      if (!key2 || !PUBLISH_ONLY_JOB_KEYS.has(key2[1] ?? "")) return null;
+      const value2 = (key2[2] ?? "").trim();
+      if (key2[1] === "steps") {
+        if (value2 !== "") return null;
+        inSteps = true;
+        continue;
+      }
+      if (value2 === "" && PUBLISH_ONLY_JOB_MAPPING_KEYS.has(key2[1] ?? "")) {
+        body = { kind: "mapping", column: indent, entryColumn: -1, textColumn: -1, owner: "job" };
+        continue;
+      }
+      if (key2[1] === "needs" && NEEDS_FLOW_SEQUENCE_PATTERN.test(value2)) continue;
+      if (!isPlainOneLineValue(value2)) return null;
+      body = { kind: "plain", column: indent };
+      continue;
+    }
+    if (!inSteps) return null;
+    let keyText = text;
+    let column = indent;
+    if (isItem) {
+      if (!closeStep()) return null;
+      const item = /^([ \t]*-[ \t]+)([^]*)$/.exec(text);
+      keyText = item?.[2] ?? "";
+      column = (item?.[1] ?? "").length;
+      stepKeyColumn = column;
+      step = { inputs: /* @__PURE__ */ new Set() };
+    } else if (indent !== stepKeyColumn || !step) {
+      return null;
+    }
+    const key = UNQUOTED_KEY_PATTERN.exec(keyText.trim());
+    if (!key || !PUBLISH_ONLY_STEP_KEYS.has(key[1] ?? "")) return null;
+    const value = (key[2] ?? "").trim();
+    const current = step ?? { inputs: /* @__PURE__ */ new Set() };
+    if (key[1] === "with" || key[1] === "env") {
+      if (value !== "") return null;
+      body = { kind: "mapping", column, entryColumn: -1, textColumn: -1, owner: key[1] };
+    } else if (key[1] === "uses") {
+      if (current.uses !== void 0 || !isPlainOneLineValue(value)) return null;
+      current.uses = value.replace(/^(['"])(.*)\1$/, "$2");
+      body = { kind: "plain", column };
+    } else if (key[1] === "run") {
+      if (current.run !== void 0) return null;
+      if (BLOCK_SCALAR_INDICATOR_PATTERN.test(value)) {
+        current.run = [];
+        body = { kind: "run", column };
+      } else {
+        if (!isPlainOneLineValue(value) || /^["']/.test(value)) return null;
+        current.run = [value];
+        body = { kind: "plain", column };
+      }
+    } else {
+      if (!isPlainOneLineValue(value)) return null;
+      body = { kind: "plain", column };
+    }
+  }
+  if (!closeStep()) return null;
+  return steps;
+}
+function joinShellContinuationLines(lines) {
+  const joined = [];
+  let pending = "";
+  for (const line of lines) {
+    const code = beforeShellComment(line).trimEnd();
+    if (code.endsWith("\\")) {
+      pending += `${code.slice(0, -1)} `;
+      continue;
+    }
+    joined.push(`${pending}${line}`);
+    pending = "";
+  }
+  if (pending !== "") joined.push(pending);
+  return joined;
+}
+var CODE_LOADING_ENV_KEYS = /* @__PURE__ */ new Set([
+  "BASH_ENV",
+  "ENV",
+  "NODE_OPTIONS",
+  "LD_PRELOAD",
+  "LD_AUDIT",
+  "LD_LIBRARY_PATH",
+  "PYTHONPATH",
+  "PYTHONSTARTUP",
+  "PERL5OPT",
+  "PERL5LIB",
+  "RUBYOPT",
+  "PATH",
+  "NPM_CONFIG_NODE_OPTIONS",
+  "NPM_CONFIG_SCRIPT_SHELL"
+]);
+function isCodeLoadingEnvKey(name) {
+  return CODE_LOADING_ENV_KEYS.has(name) || CODE_LOADING_ENV_KEYS.has(name.toUpperCase());
+}
+var PACKAGE_TARGET_FLAGS = /* @__PURE__ */ new Set([
+  "--prefix",
+  "-C",
+  "--dir",
+  "--cwd",
+  "--workspace",
+  "-w",
+  "--workspaces",
+  "-ws",
+  "--filter",
+  "-F",
+  "-r",
+  "--recursive",
+  "--global",
+  "-g"
+]);
+function flagName(word) {
+  const equals = word.indexOf("=");
+  return equals === -1 ? word : word.slice(0, equals);
+}
+function targetsRootPackageOnly(args) {
+  return args.every((word) => word.startsWith("-") && !PACKAGE_TARGET_FLAGS.has(flagName(word)));
+}
+function isRegistryConfigKey(key) {
+  return key.startsWith("//") || key === "registry" || key.endsWith(":registry");
+}
+function classifyPublishOnlyRunCommand(input) {
+  const other = { kind: "other" };
+  if (input.some((word) => /[`&|;<>]|\$\(/.test(word))) return other;
+  let start = 0;
+  while (start < input.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(input[start] ?? "")) {
+    if (isCodeLoadingEnvKey(flagName(input[start] ?? ""))) return other;
+    start += 1;
+  }
+  if (start === input.length) return other;
+  const words = input.slice(start);
+  const [first = "", second = "", third = ""] = words;
+  if (words.some((word) => word.startsWith("--dry-run"))) return other;
+  switch (first) {
+    case "npm":
+    case "pnpm":
+    case "yarn": {
+      if (second === "config") {
+        return third === "set" && isRegistryConfigKey(words[3] ?? "") && words.length <= 5 ? { kind: "setup" } : other;
+      }
+      const publishFrom = second === "publish" ? 2 : first === "yarn" && second === "npm" && third === "publish" ? 3 : -1;
+      if (publishFrom === -1) return other;
+      return targetsRootPackageOnly(words.slice(publishFrom)) ? { kind: "publish", needs: ["package"] } : other;
+    }
+    case "twine":
+      return second === "upload" ? { kind: "publish" } : other;
+    case "uv":
+      return second === "publish" && !words.some((word) => word.includes("build")) ? { kind: "publish" } : other;
+    case "poetry":
+      return second === "publish" && !words.some((word) => word.startsWith("--build")) ? { kind: "publish" } : other;
+    case "gh":
+      return second === "release" && (third === "create" || third === "upload") ? { kind: "publish" } : other;
+    case "cargo":
+      return second === "publish" && words.includes("--no-verify") && !words.includes("-n") ? { kind: "publish" } : other;
+    default:
+      return other;
+  }
+}
+var PUBLISH_ONLY_SETUP_ACTIONS = /* @__PURE__ */ new Map([
+  ["actions/checkout", ["fetch-depth", "token", "persist-credentials", "fetch-tags", "show-progress"]],
+  ["actions/cache", null],
+  ["actions/upload-artifact", null],
+  ["actions/download-artifact", ["name", "path", "pattern", "merge-multiple", "run-id", "github-token"]],
+  ["actions/setup-node", null],
+  ["actions/setup-python", null],
+  ["actions/setup-go", null],
+  ["actions/setup-java", null],
+  ["actions/setup-dotnet", null],
+  ["astral-sh/setup-uv", null],
+  ["oven-sh/setup-bun", null],
+  ["pnpm/action-setup", ["version", "package_json_file", "dest", "standalone"]],
+  ["docker/login-action", null]
+]);
+function classifyPublishOnlyUsesStep(uses, inputs) {
+  const at = uses.indexOf("@");
+  if (at === -1) return "other";
+  const action = uses.slice(0, at);
+  if (action === "pypa/gh-action-pypi-publish") return "publish";
+  if (action === "softprops/action-gh-release") return inputs.has("files") ? "publish" : "other";
+  if (!PUBLISH_ONLY_SETUP_ACTIONS.has(action)) return "other";
+  const allowed = PUBLISH_ONLY_SETUP_ACTIONS.get(action);
+  return allowed === null || [...inputs].every((input) => (allowed ?? []).includes(input)) ? "setup" : "other";
+}
+var WORKFLOW_ON_KEY_PATTERN = /^(?:on|"on"|'on'|true):(?:[ \t]|$)/;
+var WORKFLOW_TRIGGER_NAME_PATTERN = /^[a-z_]+$/;
+var YAML_LINE_BREAK_NOT_SPLIT_PATTERN = /\r(?!\n)|[\u0085\u2028\u2029]/;
+function stripYamlComment(text) {
+  return text.replace(/(?:^|[ \t])#[^]*$/, "");
+}
+function unquoteYamlScalar(text) {
+  return text.trim().replace(/^(['"])(.*)\1$/, "$2");
+}
+function yamlInlineList(text) {
+  const value = stripYamlComment(text).trim();
+  if (value === "") return [];
+  const flow = /^\[(.*)\]$/.exec(value);
+  if (flow) {
+    return (flow[1] ?? "").split(",").map(unquoteYamlScalar).filter((item) => item !== "");
+  }
+  return /^[{&*|>]/.test(value) ? null : [unquoteYamlScalar(value)];
+}
+function githubWorkflowTriggers(contents) {
+  if (YAML_LINE_BREAK_NOT_SPLIT_PATTERN.test(contents)) return null;
+  const lines = contents.split(/\r?\n/);
+  const onIndex = lines.findIndex((line) => WORKFLOW_ON_KEY_PATTERN.test(line));
+  if (onIndex === -1) return null;
+  const onLine = lines[onIndex] ?? "";
+  const inline = yamlInlineList(onLine.slice(onLine.indexOf(":") + 1));
+  if (inline === null) return null;
+  const triggers = /* @__PURE__ */ new Set();
+  if (inline.length > 0) {
+    for (const name of inline) {
+      if (!WORKFLOW_TRIGGER_NAME_PATTERN.test(name)) return null;
+      triggers.add(name);
+    }
+    return triggers;
+  }
+  const isContent = (line) => line.trim() !== "" && !line.trimStart().startsWith("#");
+  const firstIndex = lines.findIndex((line, index) => index > onIndex && isContent(line));
+  if (firstIndex !== -1 && /^-[ \t]/.test(lines[firstIndex] ?? "")) {
+    for (let index = firstIndex; index < lines.length; index += 1) {
+      const raw = lines[index] ?? "";
+      if (!isContent(raw)) continue;
+      const item = /^-[ \t]+([^]*)$/.exec(raw);
+      if (!item) break;
+      const name = unquoteYamlScalar(stripYamlComment(item[1] ?? ""));
+      if (!WORKFLOW_TRIGGER_NAME_PATTERN.test(name)) return null;
+      triggers.add(name);
+    }
+    return triggers.size > 0 ? triggers : null;
+  }
+  let triggerIndent = -1;
+  let mappingForm = null;
+  let inTrigger = false;
+  for (let index = onIndex + 1; index < lines.length; index += 1) {
+    const raw = lines[index] ?? "";
+    if (!isContent(raw)) continue;
+    const indent = lineIndent(raw);
+    if (indent === 0) break;
+    if (triggerIndent === -1) triggerIndent = indent;
+    if (indent < triggerIndent) return null;
+    if (indent > triggerIndent) {
+      if (!inTrigger) return null;
+      continue;
+    }
+    const item = /^[ \t]*-[ \t]+([^]*)$/.exec(raw);
+    if (item && mappingForm === true) continue;
+    if (item) {
+      mappingForm = false;
+      inTrigger = false;
+      const name = unquoteYamlScalar(stripYamlComment(item[1] ?? ""));
+      if (!WORKFLOW_TRIGGER_NAME_PATTERN.test(name)) return null;
+      triggers.add(name);
+      continue;
+    }
+    if (mappingForm === false) return null;
+    mappingForm = true;
+    const key = /^[ \t]*([A-Za-z_]+):([^]*)$/.exec(raw);
+    if (!key || !WORKFLOW_TRIGGER_NAME_PATTERN.test(key[1] ?? "")) return null;
+    const rest = stripYamlComment(key[2] ?? "").trim();
+    if (rest !== "" && rest !== "{}" && rest !== "null" && rest !== "~") return null;
+    triggers.add(key[1] ?? "");
+    inTrigger = true;
+  }
+  return triggers.size > 0 ? triggers : null;
+}
+var PULL_REQUEST_TRIGGER_NAMES = new Set(PULL_REQUEST_TRIGGERS);
+var PULL_REQUEST_CI_WORKFLOW_LABEL = "Pull-request CI workflow";
+var WORKFLOW_WITHOUT_PULL_REQUEST_TRIGGER_LABEL = "CI workflow with no pull-request trigger";
+var WORKFLOW_TRIGGER_NOT_READ_LABEL = "CI workflow (trigger not read)";
+function b2WorkflowCitationBaseLabels(repoPath, file) {
+  if (!/^\.github\/workflows\//.test(file)) return [WORKFLOW_TRIGGER_NOT_READ_LABEL];
+  const fullPath = join(repoPath, file);
+  const triggers = isRegularFile(fullPath) ? githubWorkflowTriggers(withoutContentReadAttribution(() => readRepoText(fullPath, "utf8"))) : null;
+  if (!triggers) return [WORKFLOW_TRIGGER_NOT_READ_LABEL];
+  const names = [...triggers.keys()];
+  if (names.some((name) => PULL_REQUEST_TRIGGER_NAMES.has(name))) {
+    return [PULL_REQUEST_CI_WORKFLOW_LABEL];
+  }
+  const named = [3, 2, 1].filter((shown) => shown <= names.length).map(
+    (shown) => `${WORKFLOW_WITHOUT_PULL_REQUEST_TRIGGER_LABEL} (on: ${names.slice(0, shown).join(", ")}${names.length > shown ? ", ..." : ""})`
+  );
+  return [...named, WORKFLOW_WITHOUT_PULL_REQUEST_TRIGGER_LABEL];
+}
+function fittedCiWorkflowCitationLabel(candidates, label) {
+  for (const candidate of candidates) {
+    const full = label(candidate);
+    if (full.length <= EVIDENCE_LABEL_MAX_LENGTH) return full;
+  }
+  return label(candidates[candidates.length - 1] ?? WORKFLOW_TRIGGER_NOT_READ_LABEL);
+}
+var PRINT_ONLY_RUN_LINE_PATTERN = /^(?:(?:echo|printf)(?:[ \t][^|&;`$()<>\\]*)?|true|:|exit[ \t]+0)$/;
+var BLOCK_SCALAR_INDICATOR_PATTERN = /^[|>][-+0-9]*$/;
+var PRINT_ONLY_JOB_KEYS = /* @__PURE__ */ new Set(["runs-on", "name", "timeout-minutes", "steps"]);
+var PRINT_ONLY_TOP_LEVEL_KEY_PATTERN = /^(?:name|run-name|on|true|permissions|concurrency|jobs)[ \t]*:/;
+var OTHER_LEADING_BLANK_PATTERN = /^[ \t]*[\v\f\u00a0\u1680\u2000-\u200a\u202f\u205f\u3000\ufeff]/m;
+var PRINT_ONLY_STEP_KEYS = /* @__PURE__ */ new Set(["name", "uses", "run"]);
+var UNQUOTED_KEY_PATTERN = /^([a-z][a-z-]*):(?:[ \t]+([^]*))?$/;
+var CHECKOUT_ACTION_PATTERN = /^actions\/checkout@[A-Za-z0-9._/-]+$/;
+function isPrintOnlyShellLine(text) {
+  const command = text.trim();
+  const doubles = command.split('"').length - 1;
+  const singles = command.split("'").length - 1;
+  const balanced = (doubles === 0 || singles === 0) && doubles % 2 === 0 && singles % 2 === 0;
+  return balanced && PRINT_ONLY_RUN_LINE_PATTERN.test(command);
+}
+function isOneLineScalar(value) {
+  const quote = value[0];
+  if (quote !== '"' && quote !== "'") return true;
+  return value.length > 1 && value.endsWith(quote);
+}
+function isPrintOnlyWorkflow(contents) {
+  if (YAML_LINE_BREAK_NOT_SPLIT_PATTERN.test(contents) || OTHER_LEADING_BLANK_PATTERN.test(contents)) return false;
+  const lines = contents.split(/\r?\n/);
+  const isContent = (line) => line.trim() !== "" && !line.trimStart().startsWith("#");
+  let jobsStart = -1;
+  for (let index = 0; index < lines.length; index += 1) {
+    const raw = lines[index] ?? "";
+    if (!isContent(raw) || /^[ \t]/.test(raw)) continue;
+    if (!PRINT_ONLY_TOP_LEVEL_KEY_PATTERN.test(raw)) return false;
+    if (/^jobs:[ \t]*$/.test(stripYamlComment(raw))) {
+      if (jobsStart !== -1) return false;
+      jobsStart = index;
+    }
+  }
+  if (jobsStart === -1) return false;
+  let jobIndent = -1;
+  let keyIndent = -1;
+  let inSteps = false;
+  let stepKeyColumn = -1;
+  let step = null;
+  let body = null;
+  let runSteps = 0;
+  const closeStep = () => {
+    if (step && step.run && step.uses) return false;
+    if (step?.run) runSteps += 1;
+    step = null;
+    return true;
   };
+  for (let index = jobsStart + 1; index < lines.length; index += 1) {
+    const raw = lines[index] ?? "";
+    if (raw.trim() === "") continue;
+    const indent = lineIndent(raw);
+    if (body) {
+      if (indent > body.column) {
+        if (!body.block) return false;
+        const text2 = raw.trim();
+        if (!text2.startsWith("#") && !isPrintOnlyShellLine(text2)) return false;
+        continue;
+      }
+      body = null;
+    }
+    if (!isContent(raw)) continue;
+    const text = stripYamlComment(raw).trimEnd();
+    if (indent === 0) break;
+    if (jobIndent === -1) jobIndent = indent;
+    if (indent < jobIndent) return false;
+    if (indent === jobIndent) {
+      if (!closeStep()) return false;
+      if (!/^[ \t]*[A-Za-z_][A-Za-z0-9_-]*:[ \t]*$/.test(text)) return false;
+      keyIndent = -1;
+      inSteps = false;
+      continue;
+    }
+    if (keyIndent === -1) keyIndent = indent;
+    const isItem = /^[ \t]*-[ \t]+/.test(text);
+    if (indent < keyIndent) return false;
+    if (indent === keyIndent && !(inSteps && isItem)) {
+      if (!closeStep()) return false;
+      inSteps = false;
+      const key2 = UNQUOTED_KEY_PATTERN.exec(text.trim());
+      if (!key2 || !PRINT_ONLY_JOB_KEYS.has(key2[1] ?? "")) return false;
+      const value2 = key2[2] ?? "";
+      if (key2[1] === "steps") {
+        if (value2 !== "") return false;
+        inSteps = true;
+        continue;
+      }
+      if (value2 === "" || /^[[{&*|>!]/.test(value2) || !isOneLineScalar(value2)) return false;
+      continue;
+    }
+    if (!inSteps) return false;
+    let keyText = text;
+    let column = indent;
+    if (isItem) {
+      if (!closeStep()) return false;
+      const item = /^([ \t]*-[ \t]+)([^]*)$/.exec(text);
+      keyText = item?.[2] ?? "";
+      column = (item?.[1] ?? "").length;
+      stepKeyColumn = column;
+      step = {};
+    } else if (indent !== stepKeyColumn || !step) {
+      return false;
+    }
+    const key = UNQUOTED_KEY_PATTERN.exec(keyText.trim());
+    if (!key || !PRINT_ONLY_STEP_KEYS.has(key[1] ?? "")) return false;
+    const value = key[2] ?? "";
+    const current = step ?? {};
+    if (key[1] === "name") {
+      if (value === "" || /^[[{&*|>!]/.test(value) || !isOneLineScalar(value)) return false;
+    } else if (key[1] === "uses") {
+      if (current.uses || !CHECKOUT_ACTION_PATTERN.test(value)) return false;
+      current.uses = true;
+    } else {
+      if (current.run) return false;
+      current.run = true;
+      if (BLOCK_SCALAR_INDICATOR_PATTERN.test(value)) {
+        body = { column, block: true };
+      } else {
+        if (value === "" || !isPrintOnlyShellLine(value) || /^["']/.test(value)) return false;
+        body = { column, block: false };
+      }
+    }
+  }
+  if (!closeStep()) return false;
+  return runSteps > 0;
+}
+function findB3UnshownCheckWorkflows(root, counted, describePath = (file) => file) {
+  const printOnly = [];
+  for (const file of counted.filter((path) => /^\.github\/workflows\//.test(path))) {
+    const fullPath = join(root, file);
+    if (!isRegularFile(fullPath)) continue;
+    const contents = withoutContentReadAttribution(() => readRepoText(fullPath, "utf8"));
+    if (isPrintOnlyWorkflow(contents)) printOnly.push(describePath(file));
+  }
+  return { printOnly };
+}
+function mergeB3UnshownCheckWorkflows(own, root) {
+  return { printOnly: [...own.printOnly, ...root.printOnly] };
+}
+function b3UnshownCheckCount(unshown) {
+  return new Set(unshown.printOnly).size;
+}
+function b3UnshownCheckDisclosure(unshown, budget = Number.POSITIVE_INFINITY) {
+  const count = b3UnshownCheckCount(unshown);
+  if (count === 0) return "";
+  const tail = ` The PR-gate CI workflow count still includes ${count === 1 ? "it" : "them"}.`;
+  const parts = (shown) => [
+    `${unshown.printOnly.slice(0, shown).join(", ")}${unshown.printOnly.length > shown ? ` and ${unshown.printOnly.length - shown} more` : ""} only print${unshown.printOnly.length === 1 ? "s" : ""} text`
+  ];
+  for (let shown = 3; shown > 0; shown -= 1) {
+    const sentence = `${WITAN_B3_UNSHOWN_CHECK_PREFIX}${parts(shown).join("; ")}.${tail}`;
+    if (sentence.length <= budget) return sentence;
+  }
+  const countOnly = `${WITAN_B3_UNSHOWN_CHECK_PREFIX}${count} workflow${count === 1 ? "" : "s"}.${tail}`;
+  return countOnly.length <= budget ? countOnly : "";
+}
+function b3UnshownCheckCondition(unshown) {
+  const count = b3UnshownCheckCount(unshown);
+  const files = unshown.printOnly.map((path) => `${basename(path)} only prints text`);
+  const lead = `includes ${count} not shown to run a check`;
+  for (let shown = Math.min(files.length, 3); shown > 0; shown -= 1) {
+    const condition = `${lead}: ${files.slice(0, shown).join("; ")}${files.length > shown ? "; ..." : ""}`;
+    if (condition.length <= METRIC_CONDITION_MAX_LENGTH) return condition;
+  }
+  return lead;
 }
 function auditFreshnessCommitterYearFromGitResult(result, scanLimitations) {
   if (!result.ok) {
@@ -6182,7 +8144,6 @@ function hasCredibleTestScript(scripts) {
 var CI_TEST_COMMAND_PATTERN = /\b(pytest|go\s+test|cargo\s+test|mvn\s+test|gradle\s+test|dotnet\s+test|ctest|make\s+test|jest|vitest|mocha|rspec|phpunit|pnpm\s+(?:run\s+)?test|npm\s+(?:run\s+)?test|yarn\s+(?:run\s+)?test|node\s+--test|node:test)\b|--target[=\s]+test\b/i;
 var CI_LINT_COMMAND_PATTERN = /\b(eslint|pylint|flake8|black|ruff)\b/i;
 var CI_TYPECHECK_COMMAND_PATTERN = /\b(tsc|mypy|pyright)\b/i;
-var SCHEDULE_TRIGGER_PATTERN = /(^|\n)\s*schedule:\s*\r?\n\s*-\s*cron:/;
 var PUBLISHED_RESULT_MARKER_PATTERN = /actions\/deploy-pages|actions\/upload-pages-artifact|peaceiris\/actions-gh-pages|git\s+push\b|create-or-update-comment/i;
 var EPHEMERAL_ARTIFACT_ONLY_PATTERN = /actions\/upload-artifact/i;
 var SCHEDULED_HEALTH_PATH_PATTERN = /(?:health|smoke|monitor|status|uptime|canary)/i;
@@ -6500,7 +8461,7 @@ function parseGitTrackedFiles(repoPath, output, includeHardExcluded, registerWit
       continue;
     }
     try {
-      const stat = lstatSync(fullPath);
+      const stat = lstatSync2(fullPath);
       if (!stat.isFile()) {
         recordContentSkip(fullPath, "non_regular_file", true);
         withhold(file, "non_regular_file");
@@ -6575,19 +8536,19 @@ function resolveMonorepoContext(repoPath, scanLimitations) {
   }
   const top = topResult.stdout.trim();
   if (!top) return null;
-  const rootResolved = resolve(top);
+  const rootResolved = resolve2(top);
   const repoResolved = (() => {
     try {
-      return realpathSync(repoPath);
+      return realpathSync2(repoPath);
     } catch {
-      return resolve(repoPath);
+      return resolve2(repoPath);
     }
   })();
   if (rootResolved === repoResolved) return null;
-  if (!repoResolved.startsWith(rootResolved + sep)) return null;
+  if (!repoResolved.startsWith(rootResolved + sep2)) return null;
   const rootFiles = listGitTrackedFiles(rootResolved, scanLimitations);
   if (!rootFiles || rootFiles.length === 0) return null;
-  const subRel = repoResolved.slice(rootResolved.length + 1).split(sep).join("/");
+  const subRel = repoResolved.slice(rootResolved.length + 1).split(sep2).join("/");
   const subPrefix = subRel ? `${subRel}/` : "";
   const sharedFiles = rootFiles.filter(
     (file) => (isLockfile(file) || isCiWorkflow(file) || isDependencyUpdateConfig(file)) && (subPrefix === "" || !file.startsWith(subPrefix))
@@ -6620,7 +8581,7 @@ function visitRepoDir(repoPath, dirPath, files, rootDevice) {
     }
     if (entry.isDirectory()) {
       try {
-        if (lstatSync(fullPath, { bigint: true }).dev !== BigInt(rootDevice)) {
+        if (lstatSync2(fullPath, { bigint: true }).dev !== BigInt(rootDevice)) {
           recordContentSkip(fullPath, "denied_path");
           continue;
         }
@@ -6631,7 +8592,7 @@ function visitRepoDir(repoPath, dirPath, files, rootDevice) {
       visitRepoDir(repoPath, fullPath, files, rootDevice);
       continue;
     }
-    const repoRelativePath = relative(repoPath, fullPath);
+    const repoRelativePath = relative2(repoPath, fullPath);
     if (!entry.isFile()) {
       recordContentSkip(fullPath, "non_regular_file");
       registerWithheldRepoPath(repoRelativePath, "non_regular_file");
@@ -6911,7 +8872,7 @@ function hasLiveFrameworkAssertion({ commentFree, code }) {
 function hasFrameworkSuiteLevelSkip({ code }) {
   return DOTNET_IGNORED_CLASS_PATTERN.test(code) || SCALATEST_IMPORT_PATTERN.test(code) && SCALATEST_IGNORED_CLASS_PATTERN.test(code) || KOTEST_IMPORT_PATTERN.test(code) && KOTEST_IGNORED_CLASS_PATTERN.test(code);
 }
-function measureNonHollowTestShare(repoPath, files, useV17Detectors = false) {
+function measureNonHollowTestShare(repoPath, files, useV17Detectors = false, runWideSkip) {
   let nonHollowCount = 0;
   let ratedCount = 0;
   for (const file of files) {
@@ -6921,16 +8882,193 @@ function measureNonHollowTestShare(repoPath, files, useV17Detectors = false) {
     let maskedSource;
     const masked = () => maskedSource ??= maskCommentsAndStrings(contents);
     const frameworkSuiteSkipped = /\bIgnored?\b/.test(contents) && hasFrameworkSuiteLevelSkip(masked());
-    const nonHollow = (JS_TEST_ASSERTION_PATTERN.test(contents) || CPP_TEST_ASSERTION_PATTERN.test(contents) || MULTI_ECOSYSTEM_TEST_ASSERTION_PATTERN.test(contents) || hasLiveAvaAssertion(contents) || hasLiveFrameworkAssertion(masked())) && !SUITE_LEVEL_SKIP_PATTERN.test(contents) && !frameworkSuiteSkipped;
+    const asserting = JS_TEST_ASSERTION_PATTERN.test(contents) || CPP_TEST_ASSERTION_PATTERN.test(contents) || MULTI_ECOSYSTEM_TEST_ASSERTION_PATTERN.test(contents) || hasLiveAvaAssertion(contents) || hasLiveFrameworkAssertion(masked());
+    const cannotRunAsTest = runWideSkip !== void 0 && (PYTEST_CONFTEST_PATTERN.test(file) || runWideSkip.disabledByRunWideSkip(file) || hasUnconditionalPytestModuleSkip(file, contents));
+    const nonHollow = asserting && !SUITE_LEVEL_SKIP_PATTERN.test(contents) && !frameworkSuiteSkipped && !cannotRunAsTest;
     if (nonHollow) {
       nonHollowCount += 1;
       ratedCount += 1;
-    } else if (NAME_SHAPED_TEST_FILE_PATTERN.test(file) || useV17Detectors && NAME_SHAPED_TEST_FILE_PATTERN_V17.test(file) || frameworkSuiteSkipped && SUITE_SKIP_NAME_SHAPED_TEST_FILE_PATTERN.test(file)) {
+    } else if (NAME_SHAPED_TEST_FILE_PATTERN.test(file) || useV17Detectors && NAME_SHAPED_TEST_FILE_PATTERN_V17.test(file) || frameworkSuiteSkipped && SUITE_SKIP_NAME_SHAPED_TEST_FILE_PATTERN.test(file) || cannotRunAsTest && asserting) {
       ratedCount += 1;
     }
   }
   return { nonHollowCount, ratedCount };
 }
+var PYTEST_CONFTEST_PATTERN = /(^|\/)conftest\.py$/;
+var PYTEST_MODULE_SKIP_MARK_PATTERN = /\bpytest\.mark\.skip\b(?!if)/;
+var PYTEST_MODULE_SKIP_ASSIGNMENT_PATTERN = /^pytestmark[ \t]*=(?!=)/;
+var PYTEST_MODULE_SKIP_MAX_STATEMENT_LINES = 20;
+function pythonCodeOutsideStrings(line) {
+  let code = "";
+  let quote = "";
+  for (let index = 0; index < line.length; index += 1) {
+    const character = line[index] ?? "";
+    if (quote !== "") {
+      if (character === "\\") index += 1;
+      else if (character === quote) {
+        code += character;
+        quote = "";
+      }
+      continue;
+    }
+    if (character === "#") break;
+    if (character === '"' || character === "'") quote = character;
+    code += character;
+  }
+  return code;
+}
+var PYTEST_MARK_NAME_GLOBAL_PATTERN = /\bpytestmark\b/g;
+function countPytestMarkMentions(text) {
+  return [...text.matchAll(PYTEST_MARK_NAME_GLOBAL_PATTERN)].length;
+}
+function pythonBracketDelta(code) {
+  let depth = 0;
+  for (const character of code) {
+    if (character === "(" || character === "[" || character === "{") depth += 1;
+    else if (character === ")" || character === "]" || character === "}") depth -= 1;
+  }
+  return depth;
+}
+function hasUnconditionalPytestModuleSkip(file, contents) {
+  if (!/\.py$/.test(file)) return false;
+  const lines = contents.split("\n");
+  let mentionCount = 0;
+  let start = -1;
+  for (const [index, line] of lines.entries()) {
+    const count = Math.max(
+      countPytestMarkMentions(stripPythonLineComment(line)),
+      countPytestMarkMentions(pythonCodeOutsideStrings(line))
+    );
+    if (count > 0 && start === -1) start = index;
+    mentionCount += count;
+  }
+  if (mentionCount !== 1) return false;
+  const first = lines[start] ?? "";
+  if (!PYTEST_MODULE_SKIP_ASSIGNMENT_PATTERN.test(first) || !PYTEST_MODULE_SKIP_MARK_PATTERN.test(pythonCodeOutsideStrings(first))) {
+    return false;
+  }
+  const statement = [];
+  let depth = 0;
+  for (let index = start; index < lines.length; index += 1) {
+    if (statement.length === PYTEST_MODULE_SKIP_MAX_STATEMENT_LINES) return false;
+    const raw = (lines[index] ?? "").replace(/\r$/, "");
+    const code = pythonCodeOutsideStrings(raw);
+    if (/\\[ \t]*$/.test(code) || /\\[ \t]*$/.test(raw)) return false;
+    statement.push(stripPythonLineComment(raw));
+    depth += pythonBracketDelta(code);
+    if (depth <= 0) break;
+  }
+  if (depth > 0) return false;
+  return !/\bif\b/.test(statement.join("\n"));
+}
+function stripPythonLineComment(line) {
+  const hash = line.indexOf("#");
+  return hash === -1 ? line : line.slice(0, hash);
+}
+function isGovernedPytestFile(skip, file) {
+  if (!/\.py$/.test(file) || PYTEST_CONFTEST_PATTERN.test(file)) return false;
+  return skip.scope === "" || file.startsWith(`${skip.scope}/`);
+}
+var PYTEST_COLLECTION_HOOK_PATTERN = /^def[ \t]+pytest_collection_modifyitems[ \t]*\(/;
+var PYTEST_COLLECTION_HOOK_NAME = "pytest_collection_modifyitems";
+var PYTEST_COLLECTION_HOOK_NAME_PATTERN = /\bpytest_collection_modifyitems\b/;
+var PYTEST_HOOK_CONDITIONAL_PATTERN = /^(?:if|elif|else|while|try|except|finally|with|match|case|return|break|continue|yield)\b|\bskipif\b|\bif\b/;
+var PYTEST_HOOK_FOR_EVERY_ITEM_PATTERN = /^for[ \t]+([A-Za-z_]\w*)[ \t]+in[ \t]+items[ \t]*:(.*)$/;
+var PYTEST_HOOK_REBIND_ITEMS_PATTERN = /^(?:del[ \t]+)?items[ \t]*(?:[-+*/%&|^@]?=(?!=)|,|$)|\bitems[ \t]*:=/;
+var PYTEST_HOOK_CLEAR_ITEMS_PATTERN = /^(?:items\.clear\(\s*\)|items\[\s*:\s*\][ \t]*=[ \t]*\[\s*\]|del[ \t]+items\[\s*:\s*\])/;
+var PYTEST_HOOK_REFILL_ITEMS_PATTERN = /^items(?:[ \t]*\.[ \t]*(?:extend|append|insert)[ \t]*\(|[ \t]*\+=|[ \t]*\[[^\]]*\][ \t]*=(?!=))/;
+var PYTEST_HOOK_EMPTY_REFILL_PATTERN = /^items(?:[ \t]*\.[ \t]*extend[ \t]*\([ \t]*|[ \t]*\+=[ \t]*)(?:\[[ \t]*\]|\([ \t]*\))[ \t]*(?:\)[ \t]*)?$/;
+function pythonLineStatements(line) {
+  if (!line.includes(";") || /['"]/.test(line)) return [line];
+  return line.split(";").map((statement) => statement.trim()).filter((statement) => statement !== "");
+}
+var PYTEST_HOOK_SKIP_MARKER_PATTERN = /^([A-Za-z_]\w*)[ \t]*\.[ \t]*add_marker[ \t]*\([ \t]*pytest\.mark\.skip\b(?!if)/;
+var PYTHON_ASSIGNMENT_TARGET_PATTERN = /^(?:del[ \t]+)?([A-Za-z_]\w*)[ \t]*(?:[-+*/%&|^@]?=(?!=)|,)/;
+var PYTHON_IDENTIFIER_PATTERN = /[A-Za-z_]\w*/g;
+function containsPythonIdentifier(text, name) {
+  for (const match of text.matchAll(PYTHON_IDENTIFIER_PATTERN)) if (match[0] === name) return true;
+  return false;
+}
+function mayRebindPythonName(text, name) {
+  if (PYTHON_ASSIGNMENT_TARGET_PATTERN.exec(text)?.[1] === name) return true;
+  const code = pythonCodeOutsideStrings(text);
+  return /\bfor\b|\bas\b|:=/.test(code) && containsPythonIdentifier(code, name);
+}
+function hookSkipsEveryItem(body) {
+  if (body.some(({ text }) => PYTEST_HOOK_REBIND_ITEMS_PATTERN.test(text))) return false;
+  const hookIndent = body[0]?.indent;
+  const skips = (text, name) => PYTEST_HOOK_SKIP_MARKER_PATTERN.exec(text)?.[1] === name;
+  for (let index = 0; index < body.length; index += 1) {
+    const statement = body[index];
+    if (statement.indent !== hookIndent) continue;
+    const loop = PYTEST_HOOK_FOR_EVERY_ITEM_PATTERN.exec(statement.text);
+    if (!loop) continue;
+    const name = loop[1] ?? "";
+    const inline = (loop[2] ?? "").trim();
+    if (inline !== "") {
+      if (skips(inline, name)) return true;
+      continue;
+    }
+    const childIndent = body[index + 1]?.indent;
+    if (childIndent === void 0 || childIndent <= statement.indent) continue;
+    let skipped = false;
+    let rebound = false;
+    for (let inner = index + 1; inner < body.length; inner += 1) {
+      const { indent, text } = body[inner];
+      if (indent <= statement.indent) break;
+      if (mayRebindPythonName(text, name)) rebound = true;
+      if (indent === childIndent && skips(text, name)) skipped = true;
+    }
+    if (skipped && !rebound) return true;
+  }
+  return false;
+}
+function findPytestRunWideSkips(repoPath, repoFiles) {
+  const found = [];
+  for (const file of repoFiles) {
+    if (!PYTEST_CONFTEST_PATTERN.test(file) || GENERATED_OR_VENDOR_PATH_PATTERN.test(file)) continue;
+    const fullPath = join(repoPath, file);
+    if (!isRegularFile(fullPath)) continue;
+    const lines = readRepoText(fullPath, "utf8").split("\n");
+    let last = -1;
+    for (let index = 0; index < lines.length; index += 1) {
+      const line = lines[index] ?? "";
+      if (PYTEST_COLLECTION_HOOK_PATTERN.test(line)) {
+        last = index;
+      } else if (line.includes(PYTEST_COLLECTION_HOOK_NAME) && !line.trimStart().startsWith("#") && PYTEST_COLLECTION_HOOK_NAME_PATTERN.test(line)) {
+        last = -1;
+        break;
+      }
+    }
+    for (let index = last; index !== -1; index = -1) {
+      const indented = [];
+      for (let next = index + 1; next < lines.length; next += 1) {
+        const raw = lines[next] ?? "";
+        const trimmed = raw.trim();
+        if (trimmed === "" || trimmed.startsWith("#")) continue;
+        const indent = raw.length - raw.trimStart().length;
+        if (indent === 0) break;
+        for (const text of pythonLineStatements(stripPythonLineComment(trimmed).trim())) {
+          indented.push({ indent, text });
+        }
+      }
+      const body = indented.map(({ text }) => text);
+      if (body.some((statement) => PYTEST_HOOK_CONDITIONAL_PATTERN.test(statement))) continue;
+      const hookIndent = indented[0]?.indent;
+      const clears = indented.some(
+        ({ indent, text }) => indent === hookIndent && PYTEST_HOOK_CLEAR_ITEMS_PATTERN.test(text)
+      );
+      const refills = body.some(
+        (statement) => !PYTEST_HOOK_CLEAR_ITEMS_PATTERN.test(statement) && !PYTEST_HOOK_EMPTY_REFILL_PATTERN.test(statement) && PYTEST_HOOK_REFILL_ITEMS_PATTERN.test(statement)
+      );
+      const kind = clears && !refills ? "clear" : hookSkipsEveryItem(indented) ? "skip" : void 0;
+      if (!kind) continue;
+      const scope = dirname2(file);
+      found.push({ path: file, line: index + 1, scope: scope === "." ? "" : scope, kind });
+    }
+  }
+  return found;
+}
 function countFilesContaining(repoPath, files, pattern) {
   return files.filter((file) => fileContains(repoPath, file, pattern)).length;
 }
@@ -7107,10 +9245,10 @@ function readPyprojectDependencySpecs(path) {
         const dep = rawDep.replace(/["'\s]/g, "");
         if (!dep) continue;
         const nameMatch = /^([A-Za-z0-9][\w.-]*)/.exec(dep);
-        const versionMatch = /([><=~!^]+[\d.]+)/.exec(dep);
+        const versionConstraint = firstVersionConstraint(dep);
         const depName = nameMatch?.[1];
         if (depName) {
-          specs.push({ name: depName, version: versionMatch?.[1] ?? dep });
+          specs.push({ name: depName, version: versionConstraint ?? dep });
         }
       }
     }
@@ -7884,7 +10022,7 @@ function isClaimArtifactDeclaringWorkflow(file) {
 function normaliseDeclaredClaimArtifactPath(candidate, baseDir) {
   if (!DECLARED_CLAIM_ARTIFACT_PATH_PATTERN.test(candidate)) return null;
   const joined = candidate.startsWith("/") ? posix.normalize(candidate.slice(1)) : posix.normalize(posix.join(baseDir, candidate));
-  const path = joined.replace(/\/+$/, "");
+  const path = stripTrailingSlashes(joined);
   if (path === "" || path === "." || path === ".." || path.startsWith("../") || path.startsWith("/")) {
     return null;
   }
@@ -7894,7 +10032,7 @@ function markdownLinkTarget(target) {
   if (/^[a-z][a-z0-9+.-]*:/i.test(target) || target.startsWith("//") || target.startsWith("#")) {
     return null;
   }
-  const withoutSuffix = target.replace(/[?#].*$/, "");
+  const withoutSuffix = stripFromQueryOrFragment(target);
   try {
     return decodeURIComponent(withoutSuffix);
   } catch {
@@ -7969,7 +10107,7 @@ function workflowClaimArtifactDeclarations(contents) {
     writeContinues = false;
   };
   contents.split(/\r?\n/).forEach((rawLine, index) => {
-    const line = rawLine.replace(/(^|\s)#.*$/, "");
+    const line = stripHashCommentAtStartOrAfterBlank(rawLine);
     if (line.trim() === "") return;
     const indent = line.length - line.trimStart().length;
     if (stepsIndent !== null && (indent < stepsIndent || indent === stepsIndent && !line.trimStart().startsWith("- "))) {
@@ -8093,7 +10231,7 @@ function vitestCoveragePropertyCollects(contents) {
   return true;
 }
 function viteConfigCollectsCoverage(repoPath, file) {
-  const directory = dirname(file);
+  const directory = dirname2(file);
   for (const extension of ["ts", "mts", "cts", "js", "mjs", "cjs"]) {
     const sibling = join(repoPath, directory, `vitest.config.${extension}`);
     if (!isRegularFile(sibling)) continue;
@@ -8793,7 +10931,7 @@ function containsPotentialCoverageFlag(command) {
 function reachableShellWrapper(words, repoFiles) {
   const executable = basename(words[0] ?? "").toLowerCase();
   const candidate = /^(?:ba|da|k|z)?sh$/u.test(executable) ? words[1] : words[0];
-  if (!candidate || !/(?:^|\/)\.?[^\s]*\.sh$/i.test(candidate)) return void 0;
+  if (!candidate || !isShellScriptPath(candidate)) return void 0;
   const normalized = candidate.replace(/^\.\//u, "");
   if (normalized.startsWith("/") || normalized.split("/").includes("..")) return void 0;
   return repoFiles.has(normalized) ? normalized : void 0;
@@ -9361,7 +11499,7 @@ function packageJsonDescribesPackagedApplication(repoPath, manifest, repoFiles)
   return hasDesktopRuntime && hasPackagingCommand && hasApplicationMetadata;
 }
 function findTauriApplicationMetadata(repoPath, manifest, repoFiles) {
-  const manifestDirectory = dirname(manifest);
+  const manifestDirectory = dirname2(manifest);
   const prefix = manifestDirectory === "." ? "" : `${manifestDirectory}/`;
   const candidates = [`${prefix}src-tauri/tauri.conf.json`, `${prefix}tauri.conf.json`];
   return candidates.some((file) => {
@@ -9504,7 +11642,7 @@ function readPnpmWorkspacePatterns(yamlPath) {
   return patterns;
 }
 function stripYamlLineComment(text) {
-  return /^\s*#/.test(text) ? "" : text.replace(/\s+#.*$/, "");
+  return /^\s*#/.test(text) ? "" : stripTrailingHashComment(text);
 }
 function yamlScalar(raw) {
   const single = /^'((?:[^']|'')*)'\s*(?:#.*)?$/.exec(raw);
@@ -9518,7 +11656,7 @@ var WORKSPACE_GLOB_MAX_LENGTH = 256;
 var WORKSPACE_GLOB_MAX_SEGMENTS = 32;
 function workspaceGlobMatcher(pattern) {
   if (pattern.length > WORKSPACE_GLOB_MAX_LENGTH) return null;
-  const normalised = pattern.trim().replace(/^\.\//, "").replace(/\/+$/, "");
+  const normalised = stripTrailingSlashes(pattern.trim().replace(/^\.\//, ""));
   if (normalised === "" || normalised.startsWith("/") || /(^|\/)\.\.?(\/|$)/.test(normalised) || /[[\]{}()!+@\\]/.test(normalised)) {
     return null;
   }
@@ -9627,7 +11765,7 @@ function countDelegatedCiSteps(root, workflows) {
         continue;
       }
       if (!uses.startsWith("./") || /^\.\/\.github\/workflows\//.test(uses)) continue;
-      const directory = uses.slice(2).replace(/\/+$/u, "");
+      const directory = stripTrailingSlashes(uses.slice(2));
       if (directory.length === 0 || directory.split("/").includes("..")) continue;
       if (isRegularFile(join(root, directory, "action.yml")) || isRegularFile(join(root, directory, "action.yaml"))) {
         compositeActions += 1;
@@ -9647,7 +11785,7 @@ function extractWorkflowUsesValues(contents) {
     }
     const match = /^\s*(?:-\s*)?uses\s*:\s*(.*)$/u.exec(line);
     if (match) {
-      const value = (match[1] ?? "").replace(/\s+#.*$/u, "").trim();
+      const value = stripTrailingHashComment(match[1] ?? "").trim();
       const quoted = /^(?:"(.*)"|'(.*)')$/u.exec(value);
       values.push(quoted ? quoted[1] ?? quoted[2] ?? "" : value);
       continue;
@@ -9907,7 +12045,7 @@ function stripUnbalancedShellParentheses(segment) {
   const opens = segment.split("(").length - 1;
   const closes = segment.split(")").length - 1;
   if (opens > closes) return segment.replace(/^\(+\s*/u, "");
-  if (closes > opens) return segment.replace(/\s*\)+$/u, "");
+  if (closes > opens) return stripTrailingCloseParentheses(segment);
   return segment;
 }
 function strictShellWords(segment) {
@@ -9945,7 +12083,7 @@ function workspacePackageScriptsDisclosure(repoFiles, rootPackageJson, workspace
 }
 function isRegularFile(path) {
   try {
-    return lstatSync(path).isFile();
+    return lstatSync2(path).isFile();
   } catch {
     return false;
   }
@@ -9955,6 +12093,11 @@ function fileContains(repoPath, file, pattern) {
   if (!isRegularFile(fullPath)) return false;
   return pattern.test(readRepoText(fullPath, "utf8"));
 }
+function fileSatisfies(repoPath, file, test) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return false;
+  return test(readRepoText(fullPath, "utf8"));
+}
 var HASH_COMMENT_SOURCE_PATTERN = /\.(?:py|rb)$/i;
 function stripCodeComments(file, contents) {
   const withoutComments = contents.replace(/\/\*[\s\S]*?\*\//g, (block) => block.replace(/[^\n]/g, "")).replace(/(?<!:)\/\/.*$/gm, "");
@@ -10013,7 +12156,7 @@ ${contextLines}`
         line,
         valueLength: value.length,
         characterClasses: characterClasses || "other",
-        valueFingerprint: createHash3("sha256").update(value).digest("hex"),
+        valueFingerprint: createHash4("sha256").update(value).digest("hex"),
         kind: "pem_private_key"
       };
     }
@@ -10034,7 +12177,7 @@ function findPemPrivateKeyAssignment(contents, file) {
   if (!isBarePemKeyFile(file)) return null;
   return scanForPemPrivateKeyMatch(BARE_PEM_PRIVATE_KEY_PATTERN, contents, lines, false);
 }
-function findCommittedSecretInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false, useV23PemPrivateKeyGrammar = false) {
+function findCommittedSecretInFile(repoPath, file, useV36Detectors = false, useV39Detectors = false, useV47Detectors = false, useV23PemPrivateKeyGrammar = false, setAside) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return null;
   const contents = readRepoText(fullPath, "utf8");
@@ -10047,7 +12190,12 @@ function findCommittedSecretInFile(repoPath, file, useV36Detectors = false, useV
     useV47Detectors
   );
   const secret = findRealSecretAssignment(secretScanContents, /* @__PURE__ */ new Set(), {
-    allowCredentialNamedDigest: useV36Detectors
+    allowCredentialNamedDigest: useV36Detectors,
+    ...setAside ? {
+      observeValue: (value, outcome) => {
+        if (isPlaceholderSetAsideSecret(value, outcome)) setAside.count += 1;
+      }
+    } : {}
   });
   if (secret) return secret;
   if (useV23PemPrivateKeyGrammar) {
@@ -10062,7 +12210,7 @@ function findCommittedSecretInFile(repoPath, file, useV36Detectors = false, useV
   }
   return useV36Detectors && !isTestCredentialConfiguration ? findDefaultAdministrativeCredential(secretScanContents) : null;
 }
-function findV24ClassifiedSecretInFile(repoPath, file, useV36Detectors, useV39Detectors, useV47Detectors) {
+function findV24ClassifiedSecretInFile(repoPath, file, useV36Detectors, useV39Detectors, useV47Detectors, setAside) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return null;
   const contents = readRepoText(fullPath, "utf8");
@@ -10076,7 +12224,7 @@ function findV24ClassifiedSecretInFile(repoPath, file, useV36Detectors, useV39De
     true
   );
   const rawLines = contents.split(/\r?\n/);
-  const classifyFor = (wanted) => (value, identifier, line) => {
+  const classifyFor = (wanted, countSetAside = false) => (value, identifier, line) => {
     const outcome = classifyV24SecretShapedValue(
       value,
       identifier,
@@ -10084,11 +12232,14 @@ function findV24ClassifiedSecretInFile(repoPath, file, useV36Detectors, useV39De
       rawLines,
       useV36Detectors
     );
+    if (countSetAside && setAside && isPlaceholderSetAsideSecret(value, outcome)) {
+      setAside.count += 1;
+    }
     return outcome.classification === wanted ? outcome : V24_NO_FINDING;
   };
   const real = findRealSecretAssignment(secretScanContents, /* @__PURE__ */ new Set(), {
     allowCredentialNamedDigest: useV36Detectors,
-    classifyValue: classifyFor("real")
+    classifyValue: classifyFor("real", true)
   });
   if (real) return { match: real, classification: "real" };
   if (useV39Detectors && isEnvHistoryPath(file, useV36Detectors)) {
@@ -10280,8 +12431,9 @@ function findRealSecretAssignments(contents, excludedValueFingerprints = /* @__P
         const value = contents.slice(valueStart, cursor).replace(/[,;)]$/, "");
         nextSearchIndex = cursor;
         const outcome = options.classifyValue ? options.classifyValue(value, identifier, line) : !isPlaceholderSecretValue(value) && (looksLikeSecretValue(value) || options.allowCredentialNamedDigest === true && isLikelyDigestOrHash(value) && isExplicitCredentialIdentifier(identifier)) ? V24_REAL : V24_NO_FINDING;
+        options.observeValue?.(value, outcome);
         if (outcome.classification !== "no_finding") {
-          const valueFingerprint = createHash3("sha256").update(value).digest("hex");
+          const valueFingerprint = createHash4("sha256").update(value).digest("hex");
           const characterClasses = [
             /[a-z]/.test(value) ? "lower" : "",
             /[A-Z]/.test(value) ? "upper" : "",
@@ -10338,7 +12490,7 @@ function findWeakExplicitEnvCredential(contents) {
       line: index + 1,
       valueLength: value.length,
       characterClasses: characterClasses || "other",
-      valueFingerprint: createHash3("sha256").update(value).digest("hex")
+      valueFingerprint: createHash4("sha256").update(value).digest("hex")
     };
   }
   return null;
@@ -10378,7 +12530,7 @@ function findDatabaseUrlUserinfoCredential(contents) {
       line: index + 1,
       valueLength: password.length,
       characterClasses: characterClasses || "other",
-      valueFingerprint: createHash3("sha256").update(password).digest("hex")
+      valueFingerprint: createHash4("sha256").update(password).digest("hex")
     };
   }
   return null;
@@ -10397,7 +12549,7 @@ function findDefaultAdministrativeCredential(contents) {
       line: index + 1,
       valueLength: value.length,
       characterClasses: "lower",
-      valueFingerprint: createHash3("sha256").update(value).digest("hex"),
+      valueFingerprint: createHash4("sha256").update(value).digest("hex"),
       kind: "default_admin"
     };
   }
@@ -10673,6 +12825,45 @@ function isPlaceholderSecretValue(value) {
   const normalized = value.trim().toLowerCase();
   return PLACEHOLDER_SECRET_PATTERN.test(normalized) || normalized.includes("your-") || normalized.includes("example") || ALL_CAPS_SNAKE_PLACEHOLDER_PATTERN.test(value.trim()) || isSyntheticFixtureSecretValue(normalized) || isFillerRunSecretValue(normalized);
 }
+function isPlaceholderSetAsideSecret(value, outcome) {
+  return outcome.classification === "no_finding" && isPlaceholderSecretValue(value) && looksLikeSecretValue(value);
+}
+var PLACEHOLDER_SET_ASIDE_PATHS_SHOWN = 3;
+function placeholderSetAsidePathList(files, shown) {
+  const named = files.slice(0, shown).map((file) => file.path);
+  const more = files.length - named.length;
+  return more > 0 ? `${named.join(", ")} and ${more} more file${more === 1 ? "" : "s"}` : named.join(", ");
+}
+function placeholderSetAsideValues(files) {
+  const total = files.reduce((sum, file) => sum + file.count, 0);
+  return `${total} credential-shaped value${total === 1 ? "" : "s"}`;
+}
+function placeholderSetAsideDisclosure(files, budget = Number.POSITIVE_INFINITY) {
+  const total = files.reduce((sum, file) => sum + file.count, 0);
+  const lead = `${WITAN_A2_PLACEHOLDER_SET_ASIDE_PREFIX}${placeholderSetAsideValues(files)} as ${total === 1 ? "a documentation placeholder because it contains" : "documentation placeholders because they contain"} a placeholder marker such as "example", so ${total === 1 ? "it was" : "they were"} not counted against secret cleanliness or checked further`;
+  for (let shown = Math.min(files.length, PLACEHOLDER_SET_ASIDE_PATHS_SHOWN); shown > 0; shown -= 1) {
+    const sentence = `${lead}: ${placeholderSetAsidePathList(files, shown)}.`;
+    if (sentence.length <= budget) return sentence;
+  }
+  const countOnly = `${lead}, in ${files.length} file${files.length === 1 ? "" : "s"}.`;
+  return countOnly.length <= budget ? countOnly : "";
+}
+function placeholderSetAsideCondition(files) {
+  const lead = `${placeholderSetAsideValues(files)} set aside as documentation placeholders, not counted`;
+  for (let shown = Math.min(files.length, PLACEHOLDER_SET_ASIDE_PATHS_SHOWN); shown > 0; shown -= 1) {
+    const condition = `${lead}: ${placeholderSetAsidePathList(files, shown)}`;
+    if (condition.length <= METRIC_CONDITION_MAX_LENGTH) return condition;
+  }
+  return `${lead} (${files.length} file${files.length === 1 ? "" : "s"})`;
+}
+var METRIC_CONDITION_MAX_LENGTH = 240;
+var CRITERION_NOTES_MAX_LENGTH = 1e3;
+var CRITERION_DISCLOSURE_MAX_LENGTH = 1e3;
+function placeholderSetAsideDisclosures2(files) {
+  if (files.length === 0) return {};
+  const sentence = placeholderSetAsideDisclosure(files, CRITERION_DISCLOSURE_MAX_LENGTH);
+  return sentence ? { disclosures: [sentence] } : {};
+}
 function isFillerRunSecretValue(value) {
   const candidates = [value];
   const sepIdx = Math.max(value.lastIndexOf("_"), value.lastIndexOf("-"));
@@ -10849,7 +13040,7 @@ function hasSuspiciousDependencies(repoPath, manifest, useV47Detectors = false)
 }
 function readRecentCommits(repoPath) {
   const historyResult = execGit(
-    ["log", "--no-show-signature", "--max-count=12", "--format=%H%x00%s"],
+    ["log", "--no-show-signature", `--max-count=${RECENT_COMMIT_WINDOW}`, "--format=%H%x00%s"],
     {
       cwd: repoPath
     }
@@ -10885,7 +13076,7 @@ function evidenceForRelative(repoPath, path, kind, label) {
     path,
     ...contents ? {
       line: firstMeaningfulLine(contents),
-      contentHash: createHash3("sha256").update(contents).digest("hex")
+      contentHash: createHash4("sha256").update(contents).digest("hex")
     } : {}
   };
 }
@@ -10897,7 +13088,7 @@ function evidenceForRelativeAtLine(repoPath, path, kind, label, line) {
     label,
     path,
     line,
-    ...contents ? { contentHash: createHash3("sha256").update(contents).digest("hex") } : {}
+    ...contents ? { contentHash: createHash4("sha256").update(contents).digest("hex") } : {}
   };
 }
 function metric(name, label, value, max, weight, unit, description, kind, presentation) {
@@ -10963,15 +13154,6 @@ function hasEnvPathInGitHistory(repoPath, scanLimitations) {
 // src/witan/public-scan.ts
 init_esm_shims();
 
-// src/witan/history-depth.ts
-init_esm_shims();
-var SHALLOW_HISTORY_LIMITATION = "This repository is a shallow clone (git rev-parse --is-shallow-repository reports true), so its commit history is truncated. A2 (credentials and .env files in earlier commits) and B2 (pull-request merge ratio over recent commits) read history and saw only the commits present; on a full clone their results may differ. Scores are computed exactly as for any other scan. Re-scan a full clone (for actions/checkout, set fetch-depth: 0).";
-function detectHistoryLimitations(repoPath) {
-  const result = execGit(["rev-parse", "--is-shallow-repository"], { cwd: repoPath });
-  if (!result.ok || result.stdout.trim() !== "true") return void 0;
-  return [SHALLOW_HISTORY_LIMITATION];
-}
-
 // src/witan/ingest.ts
 init_esm_shims();
 import { lstatSync as lstatSync3, opendirSync, readFileSync as readFileSync4, realpathSync as realpathSync3 } from "fs";
@@ -10999,54 +13181,7 @@ function clampFinding(finding) {
 // src/witan/generic-adapter.ts
 init_esm_shims();
 import { readFileSync } from "fs";
-
-// src/witan/ingest-files.ts
-init_esm_shims();
-import { lstatSync as lstatSync2, realpathSync as realpathSync2 } from "fs";
-import { dirname as dirname2, isAbsolute, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
-var MAX_INGEST_DOCUMENT_BYTES = 8 * 1024 * 1024;
-function isContainedPath(candidate, directory) {
-  const relativePath = relative2(directory, candidate);
-  return relativePath === "" || relativePath !== ".." && !relativePath.startsWith(`..${sep2}`) && !isAbsolute(relativePath);
-}
-function isMissingIngestPath(error) {
-  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
-}
-function resolveIngestFilePath(filePath, inputDirectory = dirname2(filePath)) {
-  const lexicalDirectory = resolve2(inputDirectory);
-  const lexicalCandidate = resolve2(filePath);
-  const directoryStat = lstatSync2(lexicalDirectory);
-  if (directoryStat.isSymbolicLink()) {
-    throw new Error(`Cejel: refusing symlinked ingest directory: ${inputDirectory}`);
-  }
-  if (!directoryStat.isDirectory()) {
-    throw new Error(`Cejel: refusing non-directory ingest boundary: ${inputDirectory}`);
-  }
-  const candidateStat = lstatSync2(lexicalCandidate);
-  if (candidateStat.isSymbolicLink()) {
-    throw new Error(`Cejel: refusing symlinked ingest file: ${filePath}`);
-  }
-  if (!candidateStat.isFile()) {
-    throw new Error(`Cejel: refusing non-regular ingest file: ${filePath}`);
-  }
-  if (candidateStat.size > MAX_INGEST_DOCUMENT_BYTES) {
-    throw new Error(
-      `Cejel: ingest file exceeds the ${MAX_INGEST_DOCUMENT_BYTES.toLocaleString("en-US")} byte budget: ${filePath}`
-    );
-  }
-  const resolvedDirectory = realpathSync2(lexicalDirectory);
-  const resolvedCandidate = realpathSync2(lexicalCandidate);
-  if (!isContainedPath(resolvedCandidate, resolvedDirectory)) {
-    throw new Error(`Cejel: refusing ingest file outside its resolved input directory: ${filePath}`);
-  }
-  return resolvedCandidate;
-}
-function isResolvedIngestPathContained(candidate, directory) {
-  return isContainedPath(candidate, directory);
-}
-
-// src/witan/generic-adapter.ts
-var CEJEL_GENERIC_INGEST_CONTRACT_VERSION = "1.0";
+var CEJEL_GENERIC_INGEST_CONTRACT_VERSION = "1.1";
 var CEJEL_GENERIC_INGEST_CONTRACT_MAJOR = 1;
 var GenericFindingV1Schema = external_exports.object({
   ruleId: external_exports.string().min(1),
@@ -11064,6 +13199,17 @@ var GenericSignalDocumentV1Schema = external_exports.object({
   tool: external_exports.string().trim().min(1),
   signals: external_exports.array(GenericSignalV1Schema)
 }).passthrough();
+var GenericIdentityV1_1Schema = external_exports.object({
+  subject: external_exports.object({
+    repository: external_exports.string().trim().min(1).max(2048).optional(),
+    commit: external_exports.string().regex(/^[0-9a-fA-F]{7,64}$/, "expected a 7-64 character hexadecimal commit id").optional()
+  }).passthrough().optional(),
+  producer: external_exports.object({
+    name: external_exports.string().trim().min(1).max(200).optional(),
+    version: external_exports.string().trim().min(1).max(200).optional()
+  }).passthrough().optional(),
+  observedAt: external_exports.string().datetime({ offset: true }).optional()
+}).passthrough();
 function isGenericSignalDocument(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
   const doc = raw;
@@ -11091,8 +13237,10 @@ function assertSupportedContractVersion(version) {
 function formatValidationIssues(error) {
   return error.issues.map((issue) => `${issue.path.length > 0 ? issue.path.join(".") : "<document>"}: ${issue.message}`).join("; ");
 }
-function parseGenericJson(raw) {
-  if (!isGenericSignalDocument(raw)) return [];
+function parseGenericDocument(raw) {
+  if (!isGenericSignalDocument(raw)) {
+    return { signals: [], identity: { producers: [], subjects: [] } };
+  }
   assertSupportedContractVersion(raw.version);
   const parsed = GenericSignalDocumentV1Schema.safeParse(raw);
   if (!parsed.success) {
@@ -11100,7 +13248,23 @@ function parseGenericJson(raw) {
       `Cejel: invalid generic ingest contract v${raw.version}: ${formatValidationIssues(parsed.error)}`
     );
   }
-  return parsed.data.signals.map((signal) => ({
+  const minor = Number(/^\d+\.(\d+)$/.exec(parsed.data.version)?.[1] ?? "0");
+  let identity = genericIdentity({ tool: parsed.data.tool });
+  if (minor >= 1) {
+    const identityFields = GenericIdentityV1_1Schema.safeParse(raw);
+    if (!identityFields.success) {
+      throw new Error(
+        `Cejel: invalid generic ingest contract v${parsed.data.version}: ${formatValidationIssues(identityFields.error)}`
+      );
+    }
+    identity = genericIdentity({
+      tool: parsed.data.tool,
+      ...identityFields.data.subject ? { subject: identityFields.data.subject } : {},
+      ...identityFields.data.producer ? { producer: identityFields.data.producer } : {},
+      ...identityFields.data.observedAt ? { observedAt: identityFields.data.observedAt } : {}
+    });
+  }
+  const signals = parsed.data.signals.map((signal) => ({
     source: parsed.data.tool,
     dimension: signal.dimension,
     weight: signal.weight,
@@ -11111,6 +13275,7 @@ function parseGenericJson(raw) {
       ...finding.location ? { location: finding.location } : {}
     }))
   }));
+  return { signals, identity };
 }
 
 // src/witan/sarif-adapter.ts
@@ -11377,11 +13542,13 @@ function sanitizeIngestSource(source) {
     maxLength: MAX_INGEST_SOURCE_LENGTH
   });
 }
-function parseIngestFile(filePath, options = {}) {
+function readIngestDocument(filePath, options = {}) {
   const resolvedFilePath = resolveIngestFilePath(filePath);
+  const bytes = readFileSync4(resolvedFilePath);
+  const sha256 = sha256OfBytes(bytes);
   let raw;
   try {
-    raw = JSON.parse(stripBom(readFileSync4(resolvedFilePath, "utf8")));
+    raw = JSON.parse(stripBom(bytes.toString("utf8")));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Cejel: could not parse ingest file as JSON: ${filePath} (${message})`);
@@ -11393,10 +13560,23 @@ function parseIngestFile(filePath, options = {}) {
     );
   }
   let signals;
-  if (looksLikeSarif(raw)) signals = parseSarifJson(raw, options.extraSarifDimensionRules);
-  else if (looksLikeScorecard(raw)) signals = parseScorecardJson(raw);
-  else if (isGenericSignalDocument(raw)) signals = parseGenericJson(raw);
-  if (!signals) {
+  let format;
+  let identity = { producers: [], subjects: [] };
+  if (looksLikeSarif(raw)) {
+    signals = parseSarifJson(raw, options.extraSarifDimensionRules);
+    format = "sarif";
+    identity = extractSarifIdentity(raw);
+  } else if (looksLikeScorecard(raw)) {
+    signals = parseScorecardJson(raw);
+    format = "scorecard";
+    identity = extractScorecardIdentity(raw);
+  } else if (isGenericSignalDocument(raw)) {
+    const generic = parseGenericDocument(raw);
+    signals = generic.signals;
+    format = "generic";
+    identity = generic.identity;
+  }
+  if (!signals || !format) {
     throw new Error(
       `Cejel: unrecognized ingest file format: ${filePath} \u2014 expected SARIF (a "runs" array), OpenSSF Scorecard JSON (a "checks" array), or the versioned generic Cejel external-signal shape (a "version" string + "tool" string + "signals" array). See the cejel README "Aggregate your scanners".`
     );
@@ -11408,12 +13588,17 @@ function parseIngestFile(filePath, options = {}) {
 `
     );
   }
-  return signals.map((signal) => ({
-    ...signal,
-    source: sanitizeIngestSource(signal.source),
-    provenance: options.provenance ?? "operator_supplied",
-    findings: signal.findings.map(clampFinding)
-  }));
+  return {
+    signals: signals.map((signal) => ({
+      ...signal,
+      source: sanitizeIngestSource(signal.source),
+      provenance: options.provenance ?? "operator_supplied",
+      findings: signal.findings.map(clampFinding)
+    })),
+    sha256,
+    format,
+    identity
+  };
 }
 function expandIngestPattern(pattern, maxMatches = Number.POSITIVE_INFINITY) {
   if (!pattern.includes("*")) return [pattern];
@@ -11497,6 +13682,7 @@ function discoverIngestInputs(repoPath, maxMatches = Number.POSITIVE_INFINITY) {
 // src/witan/public-scan.ts
 var MAX_INGEST_DOCUMENTS = 128;
 var MAX_RETAINED_INGEST_FINDINGS = 1e4;
+var MAX_INPUT_BINDING_RECORDS = 2 * MAX_INGEST_DOCUMENTS;
 function scoreRepoWithPublicCejel(options) {
   if (options.rubricVersion !== void 0) {
     assertSelectableRubricVersion(options.rubricVersion);
@@ -11508,35 +13694,90 @@ function scoreRepoWithPublicCejel(options) {
     ...options.generatedAt ? { generatedAt: options.generatedAt } : {},
     ...options.rubricVersion ? { rubricVersion: options.rubricVersion } : {}
   });
-  const inputSignals = resolvePublicIngestSignals(options);
+  const scannedSubject = readScannedSubject(
+    options.repoPath,
+    input.repo.headSha,
+    options.subjectRepository
+  );
+  const { signals: inputSignals, documents } = resolvePublicIngestInputs(options);
+  const inputBinding = documents.length > 0 ? buildInputBinding(documents, scannedSubject, options.strictIngest ? "strict" : "record-only") : void 0;
+  if (options.strictIngest && inputBinding) assertStrictIngestBinding(documents, inputBinding);
   const scored = createWitanReport(
     input,
     inputSignals.length > 0 ? inputSignals : void 0,
     void 0,
     options.toolVersion
   );
-  const historyLimitations = detectHistoryLimitations(options.repoPath);
-  const report = historyLimitations ? { ...scored, historyLimitations } : scored;
+  const historyLimitations = detectHistoryLimitations(
+    options.repoPath,
+    usesV27FalseAssuranceClosure(scored.rubricVersion)
+  );
+  const withHistory = historyLimitations ? { ...scored, historyLimitations } : scored;
+  const report = inputBinding ? { ...withHistory, inputBinding } : withHistory;
   if (report.verdict !== "insufficient_source" || !isWitanNoMeasurementAbstention(report)) {
-    return report;
+    return assertReportVerifiable(report);
   }
   const contextualReason = explainNoMeasurementSourceCoverage(
     options.repoPath,
     report.rubricVersion
   );
-  return contextualReason ? {
-    ...report,
-    insufficientSourceReason: contextualReason
-  } : report;
+  return assertReportVerifiable(
+    contextualReason ? {
+      ...report,
+      insufficientSourceReason: contextualReason
+    } : report
+  );
+}
+function assertReportVerifiable(report) {
+  const result = WitanReportSchema.safeParse(report);
+  if (result.success) return report;
+  const issues = result.error.issues.slice(0, 8).map((issue) => `  - ${issue.path.join(".") || "<root>"}: ${issue.message}`);
+  throw new Error(
+    [
+      "Cejel: the assembled report does not satisfy the report schema `cejel verify` applies; no certificate was written.",
+      ...issues,
+      ...result.error.issues.length > issues.length ? [`  ...and ${result.error.issues.length - issues.length} more.`] : []
+    ].join("\n")
+  );
+}
+function readScannedSubject(repoPath, headSha, subjectRepository) {
+  let repository;
+  if (subjectRepository !== void 0) {
+    repository = normalizeRepositoryIdentity(subjectRepository);
+    if (repository === void 0) {
+      throw new Error(
+        `Cejel: --subject-repository value (${subjectRepository.length} characters, not echoed) is not a repository identity Cejel can compare. Expected a form such as github.com/owner/repo or https://github.com/owner/repo.git, with a DNS host name and a path.`
+      );
+    }
+  }
+  let commitTime;
+  if (headSha) {
+    const result = execGit(["show", "-s", "--format=%ct", "HEAD"], { cwd: repoPath });
+    const seconds = result.ok ? Number(result.stdout.trim()) : Number.NaN;
+    if (Number.isSafeInteger(seconds) && seconds >= 0) {
+      commitTime = plainIsoInstant(seconds * 1e3);
+    }
+  }
+  return {
+    ...repository !== void 0 ? { repository } : {},
+    ...headSha ? { commit: headSha.toLowerCase() } : {},
+    ...commitTime !== void 0 ? { commitTime } : {}
+  };
 }
-function resolvePublicIngestSignals(options) {
+function resolvePublicIngestInputs(options) {
   const seen = /* @__PURE__ */ new Set();
   const documents = [];
+  const samePathRepeats = /* @__PURE__ */ new Map();
   const addDocument = (file, provenance) => {
     const resolved = resolveIngestFilePath(file);
-    if (seen.has(resolved)) return;
+    if (seen.has(resolved)) {
+      if (!samePathRepeats.has(resolved)) {
+        samePathRepeats.set(resolved, { file: resolved, displayPath: file, provenance });
+      }
+      return;
+    }
     seen.add(resolved);
-    documents.push({ file: resolved, provenance });
+    documents.push({ file: resolved, displayPath: file, provenance });
     if (documents.length > MAX_INGEST_DOCUMENTS) {
       throw new Error(
         `Cejel: ${documents.length} unique ingest documents exceed the ${MAX_INGEST_DOCUMENTS} ingest document budget; refusing to produce a partial certificate.`
@@ -11562,12 +13803,16 @@ function resolvePublicIngestSignals(options) {
     }
   }
   const signals = [];
+  const records = [];
+  const readByPath = /* @__PURE__ */ new Map();
+  const scoredDigests = /* @__PURE__ */ new Set();
   let retainedFindings = 0;
   for (const document of documents) {
-    const parsed = parseIngestFile(document.file, {
+    const read = readIngestDocument(document.file, {
       maxFindingCandidates: MAX_RETAINED_INGEST_FINDINGS - retainedFindings,
       provenance: document.provenance
     });
+    const parsed = read.signals;
     const documentFindings = parsed.reduce((count, signal) => count + signal.findings.length, 0);
     retainedFindings += documentFindings;
     if (retainedFindings > MAX_RETAINED_INGEST_FINDINGS) {
@@ -11576,8 +13821,30 @@ function resolvePublicIngestSignals(options) {
       );
     }
     signals.push(...parsed);
+    readByPath.set(document.file, read);
+    records.push({
+      sha256: read.sha256,
+      format: read.format,
+      provenance: document.provenance,
+      identity: read.identity,
+      displayPath: document.displayPath,
+      ...scoredDigests.has(read.sha256) ? { duplicate: "same-content" } : {}
+    });
+    scoredDigests.add(read.sha256);
+  }
+  for (const repeat of samePathRepeats.values()) {
+    const read = readByPath.get(repeat.file);
+    if (!read) continue;
+    records.push({
+      sha256: read.sha256,
+      format: read.format,
+      provenance: repeat.provenance,
+      identity: read.identity,
+      displayPath: repeat.displayPath,
+      duplicate: "same-path"
+    });
   }
-  return signals;
+  return { signals, documents: records };
 }
 
 // src/product-identity.ts
@@ -11776,6 +14043,8 @@ function runCejelScan(options) {
     // are third-party repositories and must opt in explicitly.
     autoDiscoverIngest: true,
     warnOnEmptyIngestMatch: options.warnOnEmptyIngestMatch,
+    ...options.strictIngest ? { strictIngest: true } : {},
+    ...options.subjectRepository ? { subjectRepository: options.subjectRepository } : {},
     ...options.toolVersion ? { toolVersion: options.toolVersion } : {}
   });
   const summary = buildWitanCliSummary(report);
@@ -11786,7 +14055,13 @@ export {
   WitanReportSchema,
   computeApplicableMeasuredCoverage,
   formatCoverageSummary,
+  EXTERNAL_FINDINGS_DISPLAY_LIMIT,
   formatExternalSourceLine,
+  inheritedFindingNote,
+  importedAdjustmentSentence,
+  inputBindingHeadline,
+  describeInputBindingRecord,
+  describeScannedSubject,
   WITAN_RUBRIC_VERSION_V22,
   assertSelectableRubricVersion,
   isProspectiveRubricVersion,
@@ -11806,6 +14081,9 @@ export {
   serializeWitanReport,
   createWitanAttestation,
   verifyWitanAttestationBinding,
+  stripTerminalControls,
+  verifyRecordedInputDigests,
+  resolveIngestFilePath,
   deriveProductIdentity,
   runCejelScan
 };