@cejel/cejel 0.6.8 → 0.7.0-rc.1

package/README.md

@@ -3,6 +3,30 @@
 [![release](https://img.shields.io/github/v/release/BargLabs/cejel)](https://github.com/BargLabs/cejel/releases/latest)
 [![license: AGPL-3.0-only](https://img.shields.io/badge/license-AGPL--3.0--only-blue.svg)](./LICENSE)
 
+<p align="left"><img src="brand/cejel-icon.png" alt="Cejel logo" width="96"></p>
+
+**Evidence about a repository that anyone can rerun.** Cejel reads a repository's own evidence
+(tests that really assert something, committed secrets, CI gating) and writes a certificate
+pinned to one commit. Whoever receives it, a customer, a buyer or an acquirer, can run the same
+Cejel version on the same commit themselves, offline, and get the same result. No LLM, no signup.
+
+Add it to a workflow; the result is posted to the job summary:
+
+```yaml
+on: [pull_request]
+jobs:
+  cejel:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # full history: A2 and B2 read commit history
+      - uses: BargLabs/cejel/action@v1
+```
+
+Or run it once from a shell: `npx @cejel/cejel@latest .` More on the Action under
+[GitHub Action](#github-action).
+
 Cejel (*"SEH-jel"*) — a trust certificate for your codebase.
 
 Free, offline, no-signup CLI that scores the engineering signals that tell you whether to
@@ -157,12 +181,24 @@ The npm package is scoped as `@cejel/cejel`; its executable remains the short co
     min-score: "2.5"   # optional: fail the build below this
 ```
 
-`actions/checkout` fetches one commit by default. On a shallow clone, A2 and B2 see only that
-commit, and the certificate says so under "History limitations".
-Under the prospective v27 rubric (`--rubric-pin witan-rubric-v27-prospective-2026-10-19`), a
-shallow clone goes further. A2 abstains unless a confirmed critical secret finding stands or A2
-does not apply. B2 abstains, where it would be scored, when fewer than 12 commits are visible. Each
-abstention counts as 0 in the composite, so a shallow checkout can lower the v27 score.
+`actions/checkout` fetches one commit by default, so clone in full with `fetch-depth: 0`. On a
+shallow clone the criteria that read commit history see only the commits it holds: A2's scans of
+earlier commits for `.env` files and credentials read only those, and B2 withholds its
+pull-request merge ratio, or abstains where nothing else is left to score it on, saying why in its
+note. The certificate says so under "History limitations".
+Under the opt-in prospective v27 rubric (`--rubric-pin witan-rubric-v27-prospective-2026-10-19`;
+v17 remains the default), A2 abstains on a shallow clone unless a confirmed critical secret finding
+stands, including where it would otherwise be marked not applicable, since that decision also rests
+on earlier commits. That abstention is left out of the composite, but the verdict is capped at the
+band the composite reaches with it counted as 0.
+A2 also abstains under v27 on any clone where one of its reads of earlier commits failed:
+for example on a partial clone made with `--filter`, which `fetch-depth: 0` and no `filter` avoid,
+or where a read stops at one of Cejel's own limits: an output limit or the history secret scan's
+cap of 5,000 historical files, which happen on some large complete histories and which a re-scan
+of the same repository does not lift (#567), or the 30-second timeout, which a re-scan may lift.
+It also abstains when it leaves a credential-shaped path in history unread because the path's name
+contains control characters, and when git itself cannot be run on the scanning host. Each of these
+abstentions counts as 0 in the composite, so they can lower the v27 score.
 
 For an executed public example that binds a release artifact to the same commit named by its
 Cejel certificate, see [Certified releases with GitHub build provenance](./docs/certified-release-example.md).
@@ -213,7 +249,7 @@ The [Cejel OSS trust leaderboard](https://cejel.dev/leaderboard/) is hosted on c
 which is the single current board. This repository no longer distributes a second copy of
 its scores or certificates. The board records its producing package version, rubric,
 run date, pinned public revisions, and reproduction instructions for that particular run.
-The private Alfred transparency snapshot is not independently reproducible.
+The board's row for Barg Labs' own private codebase is a transparency snapshot and is not independently reproducible.
 
 The site's History section preserves the **2026-08-18 withdrawal**: the earlier
 sealed-public-scorer reproducibility claim was false. The stale prospective-rubric copy
@@ -392,7 +428,7 @@ Three ways a scanner's output gets ingested:
    `--ingest scorecard.json`; auto-detected by its `checks` array.
 3. **Generic JSON** — for a tool that emits neither, map its output into the minimal shape
    below (or write a small adapter mirroring
-   [`scorecard-adapter.ts`](../witan/src/scorecard-adapter.ts) if the format needs real
+   [`scorecard-adapter.ts`](./src/witan/scorecard-adapter.ts) if the format needs real
    parsing):
 
    ```json
@@ -416,7 +452,7 @@ Three ways a scanner's output gets ingested:
    }
    ```
 
-   `dimension` is one of the Witan rubric criterion ids (`A1`-`A5`, `B1`-`B6`); `weight`
+   `dimension` is one of the rubric criterion ids (`A1`-`A5`, `B1`-`B6`); `weight`
    (0–1, default `0.5`) bounds how much this signal can move that dimension; `severity` is
    `critical` | `warning` | `info`; `location` is optional.
 
@@ -468,7 +504,10 @@ secrets.
 ```
 
 Check out with `fetch-depth: 0`: the default depth of 1 truncates the history A2 and B2 read, and
-the certificate then lists a history limitation.
+the certificate then lists a history limitation. On a shallow clone A2's scans of earlier commits
+read only the commits present and B2 withholds its pull-request merge ratio, each with its reason;
+under the opt-in `witan-rubric-v27-prospective-2026-10-19` rubric, A2 abstains and the verdict is
+capped where A2 could not be read.
 
 ## Use with Claude
 
@@ -754,7 +793,7 @@ scoring tool that has not been checked:
   the invariant it claimed to be. Rubric v3 removes that second path: every corpus row now
   passes through the same sealed public scorer, every external source is pinned to a commit,
   and a required guard re-scores every row and compares score, verdict, coverage, and
-  evidence. The honest correction moved Alfred's Code score from 2.5 to 2.4 and A5 from 2.9
+  evidence. The honest correction moved our own private codebase's Code score from 2.5 to 2.4 and A5 from 2.9
   to 2.4. It is less flattering and more trustworthy.
 - **A tracked symlink could make evidence depend on files outside the checkout.** Repository
   discovery used a regular-file check that followed symlinks, so a tracked link could escape

package/dist/calibration/llm-detector.js

@@ -5,11 +5,11 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-KJVFCZZ3.js";
+} from "../chunk-SNRQAKKE.js";
 import {
   listCejelLlmPackFiles
-} from "../chunk-WXPGEQBE.js";
-import "../chunk-NIWSYJ6N.js";
+} from "../chunk-UMGZWGOI.js";
+import "../chunk-D7MWEPPX.js";
 import {
   external_exports
 } from "../chunk-AMVP7L26.js";

package/dist/{chunk-NIWSYJ6N.js → chunk-D7MWEPPX.js}

@@ -8,8 +8,8 @@ import {
 // src/witan/git-exec.ts
 init_esm_shims();
 import { execFileSync } from "child_process";
-import { realpathSync } from "fs";
-import { dirname, resolve } from "path";
+import { closeSync, lstatSync, openSync, readSync, realpathSync } from "fs";
+import { dirname, join, resolve } from "path";
 var GIT_EXEC_MAX_BUFFER_BYTES = 8 * 1024 * 1024;
 var GIT_EXEC_TIMEOUT_MS = 3e4;
 var HARDENED_GIT_ARGUMENTS = [
@@ -54,6 +54,55 @@ var HARDENED_GIT_ARGUMENTS = [
   "protocol.ssh.allow=never"
 ];
 var discoveryCeiling;
+var GIT_FILE_PREFIX_BYTES = 4096;
+function fsErrorCode(error) {
+  return typeof error === "object" && error !== null ? error.code : void 0;
+}
+var isDefinitelyAbsent = (error) => fsErrorCode(error) === "ENOENT" || fsErrorCode(error) === "ENOTDIR";
+function isGitMetadataEntry(path) {
+  let link;
+  try {
+    link = lstatSync(path);
+  } catch (error) {
+    return !isDefinitelyAbsent(error);
+  }
+  if (link.isSymbolicLink()) return true;
+  if (link.isDirectory()) {
+    try {
+      lstatSync(join(path, "HEAD"));
+      return true;
+    } catch (error) {
+      return !isDefinitelyAbsent(error);
+    }
+  }
+  if (!link.isFile()) return false;
+  let descriptor;
+  try {
+    descriptor = openSync(path, "r");
+    const buffer = Buffer.alloc(GIT_FILE_PREFIX_BYTES);
+    const length = readSync(descriptor, buffer, 0, GIT_FILE_PREFIX_BYTES, 0);
+    return /^gitdir:/m.test(buffer.subarray(0, length).toString("utf8"));
+  } catch {
+    return true;
+  } finally {
+    if (descriptor !== void 0) closeSync(descriptor);
+  }
+}
+function hasVisibleGitMetadata(repoPath) {
+  let current;
+  try {
+    current = realpathSync(repoPath);
+  } catch {
+    return false;
+  }
+  for (; ; ) {
+    if (discoveryCeiling !== void 0 && current === discoveryCeiling) return false;
+    if (isGitMetadataEntry(join(current, ".git"))) return true;
+    const parent = dirname(current);
+    if (parent === current) return false;
+    current = parent;
+  }
+}
 function hardenedGitEnvironment(cwd) {
   const environment = {};
   for (const key of ["PATH", "HOME", "TZ"]) {
@@ -88,27 +137,32 @@ function errorField(error, key) {
   if (typeof error !== "object" || error === null) return void 0;
   return error[key];
 }
-function errorText(error) {
+function stderrText(error) {
   const stderr = errorField(error, "stderr");
-  const stderrText = typeof stderr === "string" ? stderr : Buffer.isBuffer(stderr) ? stderr.toString("utf8") : "";
-  const message = error instanceof Error ? error.message : "";
-  return `${stderrText}
-${message}`;
+  return typeof stderr === "string" ? stderr : Buffer.isBuffer(stderr) ? stderr.toString("utf8") : "";
+}
+var GIT_NO_REPOSITORY_DIAGNOSTICS = [
+  /^fatal: not a git repository\b/i,
+  /^fatal: gitfile does not point to a valid repository: /,
+  /^fatal: not in a git directory$/,
+  /^fatal: this operation must be run in a work tree$/,
+  /^fatal: ambiguous argument 'HEAD': unknown revision or path not in the working tree\.$/,
+  /^fatal: needed a single revision$/i
+];
+var GIT_UNBORN_BRANCH_DIAGNOSTIC = /^fatal: your current branch '' does not have any commits yet$/;
+function isNoRepositoryDiagnostic(stderr) {
+  const line = stderr.split("\n").find((candidate) => candidate.startsWith("fatal: "))?.trimEnd();
+  if (line === void 0) return false;
+  if (GIT_NO_REPOSITORY_DIAGNOSTICS.some((pattern) => pattern.test(line))) return true;
+  const branchEmptied = line.replace(/^(fatal: your current branch )'[^'\n]*'/, "$1''");
+  return GIT_UNBORN_BRANCH_DIAGNOSTIC.test(branchEmptied);
 }
 function classifyGitFailure(error) {
   const code = errorField(error, "code");
-  const signal = errorField(error, "signal");
-  const text = errorText(error);
   if (code === "ENOENT") return "git_absent";
-  if (code === "ENOBUFS" || /maxBuffer|ENOBUFS/i.test(text)) return "buffer_exceeded";
-  if (code === "ETIMEDOUT" || signal === "SIGTERM" || /timed?\s*out|ETIMEDOUT/i.test(text)) {
-    return "timeout";
-  }
-  if (/not a git repository|not inside a work tree|not in a git directory|unknown revision.*HEAD|ambiguous argument ['"]?HEAD|does not have any commits yet|needed a single revision/i.test(
-    text
-  )) {
-    return "not_a_repo";
-  }
+  if (code === "ENOBUFS" || code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") return "buffer_exceeded";
+  if (code === "ETIMEDOUT") return "timeout";
+  if (isNoRepositoryDiagnostic(stderrText(error))) return "not_a_repo";
   return "exec_failed";
 }
 function execGit(argv, options) {
@@ -154,6 +208,9 @@ function describeGitFailure(reason, operation, maxBufferBytes = GIT_EXEC_MAX_BUF
 }
 
 export {
+  GIT_EXEC_MAX_BUFFER_BYTES,
+  GIT_EXEC_TIMEOUT_MS,
+  hasVisibleGitMetadata,
   execGit,
   isExpectedGitAbsence,
   describeGitFailure

package/dist/{chunk-KNTBED5T.js → chunk-LBJFDK4R.js}

@@ -5,7 +5,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "./chunk-KJVFCZZ3.js";
+} from "./chunk-SNRQAKKE.js";
 import {
   ZodFirstPartyTypeKind,
   ZodOptional,