@cejel/cejel 0.7.0-rc.2 → 0.7.0-rc.3

package/dist/calibration/llm-detector.js

@@ -5,7 +5,7 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-G6AN4EDL.js";
+} from "../chunk-73XAL26O.js";
 import {
   listCejelLlmPackFiles
 } from "../chunk-RRPQHEBU.js";

package/dist/{chunk-G6AN4EDL.js → chunk-73XAL26O.js}

@@ -5274,6 +5274,8 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono, useV27FalseAss
   const rootPublishingDetails = /* @__PURE__ */ new Map();
   const checkedPublishingDetails = /* @__PURE__ */ new Map();
   const rootCheckedPublishingDetails = /* @__PURE__ */ new Map();
+  const uncreditedLines = /* @__PURE__ */ new Map();
+  const rootUncreditedLines = /* @__PURE__ */ new Map();
   const uncreditedWorkflows = useV27FalseAssuranceClosure ? withContentReadSignals("B3", ["ci_script_depth", "default_branch_ci_depth"], () => {
     const inventory = ownPublishOnlyInventory(repoFiles);
     return publishingWorkflowReasons(
@@ -5284,7 +5286,8 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono, useV27FalseAss
       checkedPublishingDetails,
       // Eighth pass (#659): v17's test-file list, the one A1 counts, read only when a runner is
       // given a positional word (testPathReader reads it once).
-      checkReading(repoPath, inventory, () => findConcreteTestFiles(repoPath, repoFiles, WITAN_RUBRIC_VERSION_V17))
+      checkReading(repoPath, inventory, () => findConcreteTestFiles(repoPath, repoFiles, WITAN_RUBRIC_VERSION_V17)),
+      uncreditedLines
     );
   }) : /* @__PURE__ */ new Map();
   const uncreditedRootWorkflows = useV27FalseAssuranceClosure && mono ? withContentReadSignals(
@@ -5299,7 +5302,8 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono, useV27FalseAss
       // The monorepo root's package.json and package-manager configuration are outside this
       // scan's inventory, so none is read: the npm-family test script is not a check there
       // (item E), and no npm, pnpm, yarn or bun command is a check or a setup step (third pass).
-      UNREAD_CHECK_READING
+      UNREAD_CHECK_READING,
+      rootUncreditedLines
     )
   ) : /* @__PURE__ */ new Map();
   const countsAsCi = (uncredited) => (file) => !uncredited.has(file);
@@ -5317,7 +5321,7 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono, useV27FalseAss
     ...checkedPublishingDetails,
     ...[...rootCheckedPublishingDetails].map(([file, detail]) => [`${file} at the monorepo root`, detail])
   ]);
-  const b3Note = b3NoteWithCheckedPublishing(
+  const b3NoteBeforeUnreadCi = b3NoteWithCheckedPublishing(
     b3Uncredited.size > 0 ? (budget) => b3UncreditedWorkflowsNote(b3Uncredited, b3PublishingDetails, budget) : void 0,
     b3CheckedPublishing
   );
@@ -5342,6 +5346,17 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono, useV27FalseAss
       (file) => `${file} at the monorepo root`
     ) : { printOnly: [] }
   );
+  const unreadCiConfigurations = useV27FalseAssuranceClosure && defaultBranchCiCount === 0 ? repoFiles.filter(isUnreadCiConfiguration).sort() : [];
+  const publishingRuleEmptiedCount = unreadCiConfigurations.length > 0 && withContentReadSignal(
+    "B3",
+    "default_branch_ci_depth",
+    () => [...uncreditedWorkflows].some(
+      ([file, reason]) => reason === "publishes" && workflowTargetsDefaultBranch(repoPath, file)
+    ) || (mono ? [...uncreditedRootWorkflows].some(
+      ([file, reason]) => reason === "publishes" && workflowTargetsDefaultBranch(mono.root, file)
+    ) : false)
+  );
+  const b3Note = publishingRuleEmptiedCount ? b3NoteWithUnreadCiConfigurations(b3NoteBeforeUnreadCi, unreadCiConfigurations) : b3NoteBeforeUnreadCi;
   if (packageJson && scripts.has("test")) {
     evidence.push(evidenceForRelative(repoPath, packageJson, "test_run", "Test script"));
   }
@@ -5400,6 +5415,22 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono, useV27FalseAss
       )
     );
   }
+  if (useV27FalseAssuranceClosure) {
+    withContentReadSignals("B3", ["ci_script_depth", "default_branch_ci_depth"], () => {
+      for (const [file, reason] of uncreditedWorkflows) {
+        evidence.push(
+          evidenceForRelativeAtLine(repoPath, file, "ci_run", b3UncreditedWorkflowLabel(reason, false), uncreditedLines.get(file) ?? null)
+        );
+      }
+      if (mono) {
+        for (const [file, reason] of uncreditedRootWorkflows) {
+          evidence.push(
+            evidenceForRelativeAtLine(mono.root, file, "ci_run", b3UncreditedWorkflowLabel(reason, true), rootUncreditedLines.get(file) ?? null)
+          );
+        }
+      }
+    });
+  }
   if (evidence.length === 0) return null;
   const CI_BUILD_COMMAND_PATTERN = /\b(cargo\s+build|cmake|ninja|make\s+(build|all))\b/i;
   const CI_COMMAND_CATEGORIES = [
@@ -5484,14 +5515,21 @@ function b3NoteWithCheckedPublishing(uncreditedNote, checked) {
   const entries = [...checked];
   const lintClause = (lint) => lint ? LINT_CONFIGURATION_CLAUSE : "";
   const lintFrom = (index) => entries.slice(index).some(([, { lint }]) => lint);
-  const countSentence = (rest, more, lint) => `${rest}${more ? " more" : ""} publishing workflow${rest === 1 ? " is" : "s are"} counted as CI verification because a check runs before ${rest === 1 ? "it publishes" : "they publish"}${lint ? rest === 1 ? LINT_CONFIGURATION_CLAUSE : LINT_CONFIGURATION_SOME_CLAUSE : ""}.`;
-  let note = uncreditedNote === void 0 ? "" : uncreditedNote(entries.length === 0 ? void 0 : CRITERION_NOTES_MAX_LENGTH - 1 - countSentence(entries.length, true, lintFrom(0)).length);
+  const gatedFrom = (index) => entries.slice(index).filter(([, { gated }]) => gated === true).length;
+  const countSentence = (rest, more, lint, gated = 0) => {
+    const workflows = `${rest}${more ? " more" : ""} publishing workflow${rest === 1 ? " is" : "s are"} counted as CI verification because`;
+    const lintClause2 = lint ? rest - gated === 1 ? LINT_CONFIGURATION_CLAUSE : LINT_CONFIGURATION_SOME_CLAUSE : "";
+    if (gated === 0) return `${workflows} a check runs before ${rest === 1 ? "it publishes" : "they publish"}${lintClause2}.`;
+    if (gated === rest) return `${workflows} ${rest === 1 ? GATED_PUBLISHING_REASON : GATED_PUBLISHING_PLURAL_REASON}.`;
+    return `${workflows}, in each, a check runs before it publishes${lintClause2}, or ${GATED_PUBLISHING_REASON}.`;
+  };
+  let note = uncreditedNote === void 0 ? "" : uncreditedNote(entries.length === 0 ? void 0 : CRITERION_NOTES_MAX_LENGTH - 1 - countSentence(entries.length, true, lintFrom(0), gatedFrom(0)).length);
   const joined = (base, sentence) => base === "" ? sentence : `${base} ${sentence}`;
   const fits = (text) => text.length <= CRITERION_NOTES_MAX_LENGTH;
-  for (const [index, [name, { detail, lint }]] of entries.entries()) {
+  for (const [index, [name, { detail, lint, gated }]] of entries.entries()) {
     const rest = entries.length - index - 1;
-    const leavesRoom = (text) => fits(text) && (rest === 0 || fits(joined(text, countSentence(rest, true, lintFrom(index + 1)))));
-    const counted = `${name} is counted as CI verification because a check runs before it publishes${lintClause(lint)}`;
+    const leavesRoom = (text) => fits(text) && (rest === 0 || fits(joined(text, countSentence(rest, true, lintFrom(index + 1), gatedFrom(index + 1)))));
+    const counted = gated === true ? `${name} is counted as CI verification because ${GATED_PUBLISHING_REASON}` : `${name} is counted as CI verification because a check runs before it publishes${lintClause(lint)}`;
     const full = joined(note, `${counted}; it ${detail}`);
     if (leavesRoom(full)) {
       note = full;
@@ -5502,11 +5540,34 @@ function b3NoteWithCheckedPublishing(uncreditedNote, checked) {
       note = short;
       continue;
     }
-    note = joined(note, countSentence(rest + 1, index > 0, lintFrom(index)));
+    note = joined(note, countSentence(rest + 1, index > 0, lintFrom(index), gatedFrom(index)));
     break;
   }
   return note === "" ? void 0 : note;
 }
+function isUnreadCiConfiguration(file) {
+  return /^(?:\.travis\.yml|\.drone\.yml|bitbucket-pipelines\.yml|appveyor\.yml|\.buildkite\/.+)$/u.test(file);
+}
+var UNREAD_CI_CONFIGURATION_LEAD = "With the publishing workflows not counted, no workflow B3 counts targets pull requests or the default branch;";
+function b3NoteWithUnreadCiConfigurations(note, files) {
+  const plural2 = files.length !== 1;
+  const sentence = (shown) => {
+    const names = shown === 0 ? `${files.length} file${plural2 ? "s" : ""}` : shown === files.length ? shown === 1 ? files[0] : `${files.slice(0, shown - 1).join(", ")} and ${files[shown - 1]}` : `${files.slice(0, shown).join(", ")} and ${files.length - shown} more`;
+    return `${UNREAD_CI_CONFIGURATION_LEAD} ${names} ${plural2 ? "are each" : "is"} a CI configuration Cejel does not read, matched by path alone with ${plural2 ? "their" : "its"} contents not read, so whether ${plural2 ? "they check" : "it checks"} pull requests or the default branch is not known.`;
+  };
+  const joined = (text) => note === void 0 || note === "" ? text : `${note} ${text}`;
+  for (let shown = Math.min(files.length, CRITERION_NOTES_MAX_LENGTH); shown >= 0; shown -= 1) {
+    const candidate = joined(sentence(shown));
+    if (candidate.length <= CRITERION_NOTES_MAX_LENGTH) return candidate;
+  }
+  return note;
+}
+function b3UncreditedWorkflowLabel(reason, monorepoRoot) {
+  const subject = monorepoRoot ? "Monorepo-root CI workflow not counted" : "CI workflow not counted";
+  return reason === "publishes" ? `${subject}: publishes, releases or deploys with no pull-request trigger (cited at the publishing step, or the job calling the workflow that holds it)` : `${subject}: not shown to run a check, it ${UNCREDITED_CI_WORKFLOW_REASON_TEXT[reason]} (cited at its on: trigger)`;
+}
+var GATED_PUBLISHING_REASON = "every job that publishes, releases or deploys on every run declares an environment, a deployment gate whose protection rules Cejel cannot read offline";
+var GATED_PUBLISHING_PLURAL_REASON = "every job in each that publishes, releases or deploys on every run declares an environment, a deployment gate whose protection rules Cejel cannot read offline";
 var LINT_CONFIGURATION_CLAUSE = " (a lint or format check, whose configuration Cejel does not read)";
 var LINT_CONFIGURATION_SOME_CLAUSE = " (some on a lint or format check, whose configuration Cejel does not read)";
 function b3Disclosures(unshown, ...uncredited) {
@@ -5599,12 +5660,13 @@ function isPublishingCommand(input) {
       return false;
   }
 }
-function publishingWorkflowReasons(root, workflows, uncredited, details, checkedDetails, reading) {
+function publishingWorkflowReasons(root, workflows, uncredited, details, checkedDetails, reading, lines) {
   const reasons = /* @__PURE__ */ new Map();
   for (const file of workflows) {
     const known = uncredited.get(file);
     if (known) {
       reasons.set(file, known);
+      lines.set(file, workflowTriggerLine(root, file));
       continue;
     }
     const read = publishingWorkflowDetail(root, file, reading);
@@ -5613,11 +5675,24 @@ function publishingWorkflowReasons(root, workflows, uncredited, details, checked
       checkedDetails.set(file, { detail: read.detail, lint: read.lint });
       continue;
     }
+    if (read.gated) {
+      checkedDetails.set(file, { detail: read.detail, lint: false, gated: true });
+      continue;
+    }
     reasons.set(file, "publishes");
     details.set(file, read.detail);
+    lines.set(file, read.line > 0 ? read.line : workflowTriggerLine(root, file));
   }
   return reasons;
 }
+function workflowTriggerLine(root, file) {
+  if (!isGitHubActionsWorkflow(file)) return null;
+  const fullPath = join2(root, file);
+  if (!isRegularFile(fullPath)) return null;
+  const lines = readRepoText(fullPath, "utf8").split(/\r?\n/);
+  const at = lines.flatMap((line, index) => WORKFLOW_ON_KEY_PATTERN.test(line) ? [index + 1] : []);
+  return at.length === 1 ? at[0] ?? null : null;
+}
 var RUNS_ON_KEY_PATTERN = /^[ \t]*runs-on:[ \t]*(.*)$/;
 var SHELL_KEY_PATTERN = /^[ \t]*(?:-[ \t]+)?shell:[ \t]*(.*)$/;
 var ONE_LABEL_LIST_PATTERN = /^\[[ \t]*([^,[\]]+?)[ \t]*\]$/;
@@ -5856,66 +5931,114 @@ function workflowJobs(contents, isGuardLine) {
   return jobs;
 }
 function publishingJobsOnEveryRun(root, contents, context, depth, reading) {
-  const none = { environments: [], checkedBeforePublish: false, notCredited: [], lintCredited: false };
+  const none = { environments: [], checkedBeforePublish: false, notCredited: [], lintCredited: false, line: 0 };
   const notCredited = [];
   const credit = { lint: false };
   if (YAML_LINE_BREAK_NOT_SPLIT_PATTERN.test(contents)) return none;
+  const { isGuardLine, jobs, publishingStepsKeys, publishes, firstPublishLine } = publishingStepsOnEveryRun(contents, context);
+  if (publishingStepsKeys.size > 0) {
+    return {
+      environments: publishingJobEnvironments(contents, jobs, publishingStepsKeys),
+      checkedBeforePublish: depth === 0 && checksBeforeEveryPublish(contents, jobs, publishes, isGuardLine, reading, notCredited, credit),
+      notCredited,
+      lintCredited: credit.lint,
+      line: firstPublishLine
+    };
+  }
+  if (depth >= REUSABLE_WORKFLOW_MAX_DEPTH) return none;
+  for (const job of jobs) {
+    const { target, conditional } = job;
+    if (target === void 0 || conditional) continue;
+    const local = LOCAL_REUSABLE_WORKFLOW_PATTERN.exec(target);
+    if (!local) continue;
+    const calledPath = join2(root, local[1] ?? "");
+    if (!isRegularFile(calledPath)) continue;
+    const called = publishingJobsOnEveryRun(root, readRepoText(calledPath, "utf8"), context, depth + 1, reading);
+    if (called.environments.length > 0) {
+      return {
+        environments: called.environments,
+        checkedBeforePublish: depth === 0 && checksBeforeEveryPublish(contents, jobs, publishes, isGuardLine, reading, notCredited, credit),
+        notCredited,
+        lintCredited: credit.lint,
+        // Item B: the calling job's `uses:` line in this file.
+        line: jobUsesLine(contents, job)
+      };
+    }
+  }
+  return none;
+}
+function publishingStepsOnEveryRun(contents, context) {
   const isGuardLine = (line) => isStepOrJobGuard(line) && !isAlwaysTrueIfLine(line, context);
   const jobs = workflowJobs(contents, isGuardLine);
   const mayRun = (step) => !step.conditional && step.job !== -1;
   const readsRunLines = runsOnlyOnHostedBashRunners(contents);
   const publishingStepsKeys = /* @__PURE__ */ new Set();
   const publishes = [];
+  let firstPublishLine = 0;
+  const onEveryRun = (stepsKey, line) => {
+    publishingStepsKeys.add(stepsKey);
+    if (line > 0 && (firstPublishLine === 0 || line < firstPublishLine)) firstPublishLine = line;
+  };
   for (const step of githubActionsUsesSteps(contents, isGuardLine)) {
     const value = unquoteYamlScalar(beforeShellComment(step.lines[0]?.text ?? ""));
     const at = value.indexOf("@");
     if (!(at > 0 && PUBLISHING_ACTIONS.has(value.slice(0, at).toLowerCase()))) continue;
     if (step.job !== -1) publishes.push({ job: step.job, line: step.lines[0]?.line ?? 0, command: 0 });
-    if (mayRun(step)) publishingStepsKeys.add(step.job);
+    if (mayRun(step)) onEveryRun(step.job, step.lines[0]?.line ?? 0);
   }
   for (const step of githubActionsRunSteps(contents, isGuardLine)) {
     const commands = joinShellContinuationLines(step.lines.map(({ text }) => text)).flatMap(
       (text) => shellCommands(text).map((words) => ({ words }))
     );
     if (!commands.some(({ words }) => isPublishingCommand(words))) continue;
+    const line = step.lines.find(({ text }) => shellCommands(text).some(isPublishingCommand)) ?? step.lines[0];
     if (step.job !== -1) {
-      const line = step.lines.find(({ text }) => shellCommands(text).some(isPublishingCommand)) ?? step.lines[0];
       publishes.push({ job: step.job, line: line?.line ?? 0, command: Math.max(0, shellCommands(line?.text ?? "").findIndex(isPublishingCommand)) });
     }
-    if (readsRunLines && mayRun(step) && !stepShellIsConditional(step, commands)) publishingStepsKeys.add(step.job);
+    if (readsRunLines && mayRun(step) && !stepShellIsConditional(step, commands)) onEveryRun(step.job, line?.line ?? 0);
   }
-  if (publishingStepsKeys.size > 0) {
-    const lines = contents.split(/\r?\n/);
-    const indents = lines.map(lineIndent);
-    const inBlockScalar = blockScalarBodyLines(lines, indents);
-    return {
-      environments: [...publishingStepsKeys].sort((left, right) => left - right).map((stepsKey) => {
-        const job = jobs.find(({ start, end }) => start < stepsKey && stepsKey < end);
-        return job ? jobEnvironment(lines, indents, inBlockScalar, job) : { kind: "unread" };
-      }),
-      checkedBeforePublish: depth === 0 && checksBeforeEveryPublish(contents, jobs, publishes, isGuardLine, reading, notCredited, credit),
-      notCredited,
-      lintCredited: credit.lint
-    };
+  return { isGuardLine, jobs, publishingStepsKeys, publishes, firstPublishLine };
+}
+function publishingJobEnvironments(contents, jobs, publishingStepsKeys) {
+  const lines = contents.split(/\r?\n/);
+  const indents = lines.map(lineIndent);
+  const inBlockScalar = blockScalarBodyLines(lines, indents);
+  return [...publishingStepsKeys].sort((left, right) => left - right).map((stepsKey) => {
+    const job = jobs.find(({ start, end }) => start < stepsKey && stepsKey < end);
+    return job ? jobEnvironment(lines, indents, inBlockScalar, job) : { kind: "unread" };
+  });
+}
+function jobUsesLine(contents, job) {
+  const lines = contents.split(/\r?\n/);
+  for (let index = job.start + 1; index < job.end; index += 1) {
+    if (JOB_USES_KEY_PATTERN.test(stripYamlComment(lines[index] ?? ""))) return index + 1;
   }
-  if (depth >= REUSABLE_WORKFLOW_MAX_DEPTH) return none;
+  return job.start + 1;
+}
+function everyPublishingJobEnvironment(root, contents, context, depth) {
+  if (YAML_LINE_BREAK_NOT_SPLIT_PATTERN.test(contents)) return { environments: [], complete: false };
+  const { jobs, publishingStepsKeys } = publishingStepsOnEveryRun(contents, context);
+  const environments = publishingJobEnvironments(contents, jobs, publishingStepsKeys);
+  let complete = true;
   for (const { target, conditional } of jobs) {
     if (target === void 0 || conditional) continue;
     const local = LOCAL_REUSABLE_WORKFLOW_PATTERN.exec(target);
-    if (!local) continue;
-    const calledPath = join2(root, local[1] ?? "");
-    if (!isRegularFile(calledPath)) continue;
-    const called = publishingJobsOnEveryRun(root, readRepoText(calledPath, "utf8"), context, depth + 1, reading);
-    if (called.environments.length > 0) {
-      return {
-        environments: called.environments,
-        checkedBeforePublish: depth === 0 && checksBeforeEveryPublish(contents, jobs, publishes, isGuardLine, reading, notCredited, credit),
-        notCredited,
-        lintCredited: credit.lint
-      };
+    const calledPath = local ? join2(root, local[1] ?? "") : "";
+    if (!local || depth >= REUSABLE_WORKFLOW_MAX_DEPTH || !isRegularFile(calledPath)) {
+      complete = false;
+      continue;
     }
+    const called = everyPublishingJobEnvironment(root, readRepoText(calledPath, "utf8"), context, depth + 1);
+    environments.push(...called.environments);
+    complete &&= called.complete;
   }
-  return none;
+  return { environments, complete };
+}
+function publishingGate(reading) {
+  const { environments, complete } = reading;
+  if (environments.some(({ kind }) => kind === "none")) return "ungated";
+  const declared = (entry) => entry.kind === "named" || entry.kind === "unnamed" && entry.expression !== true;
+  return complete && environments.length > 0 && environments.every(declared) ? "gated" : "unknown";
 }
 var STATUS_FUNCTION_NOT_SUCCESS_PATTERN = /\b(?:always|cancelled|failure)[ \t]*\(/i;
 var SUCCESS_CALL_PATTERN = /\bsuccess[ \t]*\(/gi;
@@ -7058,7 +7181,7 @@ function publishingWorkflowDetail(root, file, reading) {
   if (!isRegularFile(fullPath)) return void 0;
   const contents = readRepoText(fullPath, "utf8");
   if (YAML_LINE_BREAK_NOT_SPLIT_PATTERN.test(contents)) return void 0;
-  if (contents.split(/\r?\n/).filter((line) => WORKFLOW_ON_KEY_PATTERN.test(line)).length !== 1) return void 0;
+  if (contents.split(/\r?\n/).filter((line2) => WORKFLOW_ON_KEY_PATTERN.test(line2)).length !== 1) return void 0;
   const triggers = githubWorkflowTriggers(contents);
   if (triggers === null || triggers.size === 0 || triggers.has("workflow_call")) return void 0;
   if ([...triggers].some((name) => PULL_REQUEST_TRIGGER_NAMES.has(name))) return void 0;
@@ -7066,15 +7189,31 @@ function publishingWorkflowDetail(root, file, reading) {
     triggers,
     pushBranches: triggers.has("push") ? githubPushBranchFilter(contents) : null
   };
-  const { environments, checkedBeforePublish, notCredited, lintCredited } = publishingJobsOnEveryRun(root, contents, context, 0, reading);
+  const { environments, checkedBeforePublish, notCredited, lintCredited, line } = publishingJobsOnEveryRun(root, contents, context, 0, reading);
   if (environments.length === 0) return void 0;
-  const detail = `is triggered by ${publishingTriggerText(contents, triggers)}, and ${publishingEnvironmentText(environments)}.`;
+  const triggerText = publishingTriggerText(contents, triggers);
+  const detail = `is triggered by ${triggerText}, and ${publishingEnvironmentText(environments)}.`;
+  if (checkedBeforePublish) return { detail, checked: true, lint: lintCredited, gated: false, line };
+  const everyJob = everyPublishingJobEnvironment(root, contents, context, 0);
+  const gate = publishingGate(everyJob);
+  if (gate === "gated") {
+    return {
+      detail: `is triggered by ${triggerText}, and ${publishingEnvironmentText(everyJob.environments)}.`,
+      checked: false,
+      lint: false,
+      gated: true,
+      line
+    };
+  }
   return {
-    detail: checkedBeforePublish ? detail : `${detail}${notCreditedSentence(notCredited)}`,
-    checked: checkedBeforePublish,
-    lint: checkedBeforePublish && lintCredited
+    detail: `${detail}${gate === "unknown" ? PUBLISHING_GATE_NOT_READ_SENTENCE : ""}${notCreditedSentence(notCredited)}`,
+    checked: false,
+    lint: false,
+    gated: false,
+    line
   };
 }
+var PUBLISHING_GATE_NOT_READ_SENTENCE = " Cejel could not read whether every job that publishes on every run declares an environment, so no deployment gate is credited.";
 var NOT_CREDITED_MAX_REASONS = 3;
 function notCreditedSentence(reasons) {
   const distinct = [...new Set(reasons)];
@@ -7096,7 +7235,8 @@ function joinWords(items, last) {
 function environmentNamed(written) {
   const name = unquoteYamlScalar(written);
   if (name === "") return { kind: "unread" };
-  return PUBLISHING_NOTE_NAME_PATTERN.test(name) ? { kind: "named", name } : { kind: "unnamed" };
+  if (PUBLISHING_NOTE_NAME_PATTERN.test(name)) return { kind: "named", name };
+  return name.includes("${{") ? { kind: "unnamed", expression: true } : { kind: "unnamed" };
 }
 function jobEnvironment(lines, indents, inBlockScalar, job) {
   const structural = (index) => {
@@ -20679,7 +20819,7 @@ var CERTIFICATE_GLOSSARY = [
     metricNames: ["protected_path_review_gate"]
   }
 ];
-var V27_PR_GATE_CI_WORKFLOW_COUNT_DEFINITION = "The number of detected CI workflow files configured for pull requests or the main or master branch, including a covering monorepo-root workflow, capped at four for scoring. Under the prospective witan-rubric-v27, a workflow file is not counted when Cejel reads every step as only checking out, printing text or doing nothing, or, for a workflow with no pull-request trigger, as only uploading an already-built artifact. Cejel makes either reading only when the runs-on value of every job names a documented GitHub-hosted Ubuntu or macOS runner label. Such a file was not shown to run a check, which is not a finding that it runs none. Under the same rubric, a workflow file with no pull-request trigger is also not counted, by this metric or by CI verification depth, when a step publishes, releases or deploys (a registry publish or upload, a release, an image push or a deploy command or action) on every run its triggers start, including through a job that calls a reusable workflow in the same repository, unless a check (a test, lint, type-check or verifying-build command whose failure stops the job) runs before every publish step, in the publishing job or in a job it needs. Cejel reads that only when it can read every step, the file holds no YAML escape and writes every other key and value plainly, nothing but setup runs before the check, no if condition uses a status-check function other than a plain success(), and no job needs itself or is part of a needs cycle. It also requires that the check command is not written as a path (such as ./ruff), that a test script, make target, justfile recipe, tox environment, or pdm, hatch or pipenv script the check runs reaches a test runner from a fixed list (no other task runner, such as nox, pre-commit, turbo, gradle, mvn, bazel or ctest, is read) with no project installed first by tox or hatch, that the runner or check carries only flags, and flag values, from a fixed list known to keep it failing, and no argument file, that a runner run as a Python module (python -m) has no module of its name, or of a module it or the standard library imports, in the repository where Python would import it first, that a Makefile it runs assigns no variable, that a tsc build before it writes only into a new directory outside node_modules, that a lint or format command is written in a form that fails on a finding, that every environment key it reads on the check's path (in env: mappings, in an assignment on a command's line, or written to GITHUB_ENV) is one from a fixed list of keys that do not choose what runs, that no earlier step writes to GITHUB_PATH, and that the job runs in no container and has no service container that sets env:. That is what Cejel reads, not a proof that the check can fail: it does not read a test runner's or linter's own configuration. An if condition is a gate only when it can be false under the workflow's own triggers in the repository itself (a check of the repository's own name or owner guards forks, not runs), and a continue-on-error setting keeps the file counted. Cejel reads a publishing action on any runner, and a publish command only on the same runner labels, with no shell setting other than bash.";
+var V27_PR_GATE_CI_WORKFLOW_COUNT_DEFINITION = "The number of detected CI workflow files configured for pull requests or the main or master branch, including a covering monorepo-root workflow, capped at four for scoring. Under the prospective witan-rubric-v27, a workflow file is not counted when Cejel reads every step as only checking out, printing text or doing nothing, or, for a workflow with no pull-request trigger, as only uploading an already-built artifact. Cejel makes either reading only when the runs-on value of every job names a documented GitHub-hosted Ubuntu or macOS runner label. Such a file was not shown to run a check, which is not a finding that it runs none. Under the same rubric, a workflow file with no pull-request trigger is also not counted, by this metric or by CI verification depth, when a step publishes, releases or deploys (a registry publish or upload, a release, an image push or a deploy command or action) on every run its triggers start, including through a job that calls a reusable workflow in the same repository, unless a check (a test, lint, type-check or verifying-build command whose failure stops the job) runs before every publish step, in the publishing job or in a job it needs. It is counted too when every job that publishes on every run, in the workflow or in a reusable workflow in the same repository that it calls, declares a job-level environment whose name is not an expression: Cejel credits that declaration as a deployment gate, and cannot read offline the protection rules the environment sets. Each workflow file not counted is cited in the criterion's evidence at the line that decided it. Cejel reads a check before a publish only when it can read every step, the file holds no YAML escape and writes every other key and value plainly, nothing but setup runs before the check, no if condition uses a status-check function other than a plain success(), and no job needs itself or is part of a needs cycle. It also requires that the check command is not written as a path (such as ./ruff), that a test script, make target, justfile recipe, tox environment, or pdm, hatch or pipenv script the check runs reaches a test runner from a fixed list (no other task runner, such as nox, pre-commit, turbo, gradle, mvn, bazel or ctest, is read) with no project installed first by tox or hatch, that the runner or check carries only flags, and flag values, from a fixed list known to keep it failing, and no argument file, that a runner run as a Python module (python -m) has no module of its name, or of a module it or the standard library imports, in the repository where Python would import it first, that a Makefile it runs assigns no variable, that a tsc build before it writes only into a new directory outside node_modules, that a lint or format command is written in a form that fails on a finding, that every environment key it reads on the check's path (in env: mappings, in an assignment on a command's line, or written to GITHUB_ENV) is one from a fixed list of keys that do not choose what runs, that no earlier step writes to GITHUB_PATH, and that the job runs in no container and has no service container that sets env:. That is what Cejel reads, not a proof that the check can fail: it does not read a test runner's or linter's own configuration. An if condition is a gate only when it can be false under the workflow's own triggers in the repository itself (a check of the repository's own name or owner guards forks, not runs), and a continue-on-error setting keeps the file counted. Cejel reads a publishing action on any runner, and a publish command only on the same runner labels, with no shell setting other than bash.";
 var V27_NON_HOLLOW_TEST_SHARE_DEFINITION = `test files that actually assert something rather than being empty or skipped. Under the prospective witan-rubric-v27, A1's note names each file a v27 rule rates hollow, and each pytest collection hook it did not read (as "hook not read", with the reason and the conftest.py's path: it could prove neither that the hook leaves no test to run nor that it puts the collected tests back, so no file was rated hollow for it), and each pytest run whose arguments or directory it could not read from the repository (as "pytest run not read", with the reason and the file: any option may be in force for it, so no file it may collect is rated hollow). A collection hook that removes or skips every test is applied to every test file a pytest run that loads it collects, inside its directory and outside it, since pytest calls it with every collected test. A path that holds a comma or semicolon followed by a space, a space followed by an opening parenthesis, a backtick or a double quote is written in double quotes, with each backslash and double quote in it preceded by a backslash; any other path is written as it is. The evidence cites the first eight files rated hollow, and the first eight hooks, pytest settings and runs the note names where a rule was not applied (each at the line that holds it), and the note says how many it names beyond those carry no evidence pointer.`;
 function glossaryEntryForRubric(entry, rubricVersion) {
   if (entry.key !== "pr-gate-ci-workflow-count" && entry.key !== "non-hollow" || rubricVersion === void 0) return entry;

package/dist/{chunk-IJYGVKYU.js → chunk-QIBLNTZB.js}

@@ -5,7 +5,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "./chunk-G6AN4EDL.js";
+} from "./chunk-73XAL26O.js";
 import {
   ZodFirstPartyTypeKind,
   ZodOptional,

package/dist/index.js

@@ -3,7 +3,7 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   serveCejelMcpOverStdio
-} from "./chunk-IJYGVKYU.js";
+} from "./chunk-QIBLNTZB.js";
 import {
   CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE,
   CERTIFICATE_GLOSSARY,
@@ -45,7 +45,7 @@ import {
   verifyRecordedInputDigests,
   verifyWitanAttestationBinding,
   witanHistoryAbstentionInstruction
-} from "./chunk-G6AN4EDL.js";
+} from "./chunk-73XAL26O.js";
 import "./chunk-2UMHJ23V.js";
 import {
   external_exports

package/dist/mcp/index.js

@@ -3,8 +3,8 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   serveCejelMcpOverStdio
-} from "../chunk-IJYGVKYU.js";
-import "../chunk-G6AN4EDL.js";
+} from "../chunk-QIBLNTZB.js";
+import "../chunk-73XAL26O.js";
 import "../chunk-2UMHJ23V.js";
 import "../chunk-AMVP7L26.js";
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.7.0-rc.2",
+  "version": "0.7.0-rc.3",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {