@scalequality/check 0.3.1 → 0.5.0

package/README.md

@@ -21,6 +21,8 @@ and **Turn on continuous measurement**. Store the token as a CI secret named
 | `--host` | `SQ_HOST` | `https://app.scalequality.io` | API host |
 | `--timeout` | — | `600` | Max seconds to wait for the measurement |
 | `--json` | — | off | Print the raw result as JSON |
+| `--exclude <path>` | — | — | Exclude a generated file/directory by literal checkout-relative path; repeatable |
+| `--dry-run` | — | off | Measure locally and validate the package without uploading; no token needed |
 
 Exit codes: `0` passed (or track-only), `1` below the cutoff, `2` error.
 
@@ -45,3 +47,88 @@ scalequality:
 
 Any other CI: run the same `npx @scalequality/check` command, with `SQ_TOKEN`
 exposed as a secret/variable.
+
+## Measured coverage
+
+Coverage is only real once the tests have run. If this job produces a coverage
+report, the check finds it and ScaleQuality shows **measured line coverage**
+instead of a directional estimate. Nothing to configure: run your tests with
+coverage before this step.
+
+```yaml
+- run: mvn verify                     # writes target/site/jacoco/jacoco.xml
+- run: npx @scalequality/check --token "$SQ_TOKEN" --project <projectId>
+```
+
+Recognised out of the box: JaCoCo (`jacoco.xml`), LCOV (`lcov.info`), Cobertura
+(`coverage.xml`, `coverage.cobertura.xml`), Istanbul (`coverage-summary.json`),
+Clover (`clover.xml`) and Go (`coverage.out`). Multi-module builds are summed.
+
+The reports are copied outside your checkout into temporary staging, then stored
+as `.sqreports/` entries in the upload. Build-output exclusions do not discard
+these measured reports, and your working tree is not modified.
+
+Report somewhere unusual? Point at it in `scalequality.properties` at the repo
+root:
+
+```properties
+sq.coverage.reportPaths=ops/reports/jacoco-aggregate.xml
+```
+
+Full guide: https://scalequality.io/docs/continuous-measurement
+
+## Fixed history window and large repositories (0.5.0)
+
+Durability is calculated **on the CI runner**, against its existing Git history,
+using the same native engine as ScaleQuality: a fixed **90-day** window, with
+**14 days** for introduced code to settle before survival is measured. The source
+engine revision and report time travel with the result. The CLI sends current
+source, coverage, and a bounded durability report (at most 1 MiB); it never uploads
+the raw `.git` object database. Years of old binary history therefore do not add
+to the archive size. It does not truncate or change your repository.
+
+Use a complete checkout for that measurement. Shallow history is reported as
+unavailable; it is not treated as a full 90-day measurement.
+
+```yaml
+# GitHub Actions
+- uses: actions/checkout@v4
+  with:
+    fetch-depth: 0
+- run: npx @scalequality/check@0.5.0 --project <projectId>
+  env:
+    SQ_TOKEN: ${{ secrets.SQ_TOKEN }}
+```
+
+For GitLab set `GIT_DEPTH: "0"`. For Bitbucket Pipelines set:
+
+```yaml
+clone:
+  depth: full
+```
+
+The current-code scanners still run on the server. Historical secret scanning and
+commit-convention analysis are not included in this report; the result shows those
+limits and identifies durability as reported by CI. CPU, time, malformed Git or
+report-size limits yield unavailable history, never a fabricated clean result.
+
+Version 0.5.0 needs the compatible ScaleQuality server release. The CLI checks the
+server's acknowledgement of this exact report before declaring a passing gate.
+
+The compressed **source-and-reports archive** remains limited to 60 MiB. A time
+window cannot guarantee that arbitrary source assets fit: one current binary can
+exceed the limit. Generated dependency/output directories (`node_modules`,
+`dist`, `build`, `.next`, `out`, `target`, `.venv`, `venv`, `coverage`,
+`.turbo`) are excluded at every depth, while lockfiles are retained.
+Use `--exclude generated/assets` for other generated content. Paths are literal,
+relative to the checkout, and do not use shell wildcards. Do not exclude source
+that you expect to measure.
+
+```bash
+# Local verification; does not need a token and sends nothing to ScaleQuality.
+npx @scalequality/check@0.5.0 --dry-run
+```
+
+The CLI checks compressed size before allocating the upload buffer or sending a
+request. If current source alone cannot fit, it lists the largest included files
+and exits with an actionable error. No oversized upload is sent.

package/bin/archive.mjs

@@ -0,0 +1,109 @@
+import { spawnSync } from "node:child_process"
+import { mkdtempSync, mkdirSync, readdirSync, lstatSync, existsSync, statSync, writeFileSync, rmSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join, resolve, posix } from "node:path"
+
+export const ARCHIVE_LIMIT_BYTES = 60 * 1024 * 1024
+const MAX_DURABILITY_REPORT_BYTES = 1024 * 1024
+// Directory names, at every depth. Explicit file manifests avoid GNU/BSD tar
+// differences in matching nested output/dependency directories.
+const SKIP = new Set(["node_modules", "dist", "build", ".next", "out", "target", ".venv", "venv", "coverage", ".turbo"])
+const mib = (bytes) => (bytes / 1024 / 1024).toFixed(1)
+
+export function normalizeExcludes(excludes = []) {
+  return excludes.map((value) => {
+    if (typeof value !== "string" || !value || value.startsWith("-") || value.includes("\0") || value.includes("\\") || /[*?\[\]]/.test(value)) {
+      throw new Error("--exclude needs a literal path relative to the checkout (no wildcards).")
+    }
+    const path = posix.normalize(value.replace(/^\.\//, "")).replace(/\/$/, "")
+    if (!path || path === "." || path.startsWith("/") || path === ".." || path.startsWith("../") || /^[A-Za-z]:/.test(path) || [".git", ".sqreports"].includes(path.split("/")[0])) {
+      throw new Error("--exclude must stay inside the checkout and cannot exclude .git or .sqreports.")
+    }
+    return path
+  })
+}
+
+function inventory(root, { reports = false, excludes = [] } = {}) {
+  const paths = [], largest = []
+  const walk = (rel) => {
+    const abs = join(root, rel)
+    const st = lstatSync(abs)
+    paths.push(`./${rel}`)
+    if (st.isDirectory()) {
+      for (const entry of readdirSync(abs).sort()) visit(rel ? `${rel}/${entry}` : entry, entry)
+    } else if (st.isFile()) {
+      largest.push({ path: rel, bytes: st.size })
+    }
+  }
+  const visit = (rel, name) => {
+    if (!reports && (name === ".git" || rel === ".sqreports" || excludes.some((p) => rel === p || rel.startsWith(`${p}/`)))) return
+    if (!reports && SKIP.has(name) && lstatSync(join(root, rel)).isDirectory()) return
+    walk(rel)
+  }
+  for (const entry of readdirSync(root).sort()) visit(entry, entry)
+  return { paths, largest: largest.sort((a, b) => b.bytes - a.bytes).slice(0, 5) }
+}
+
+/**
+ * Upload current source plus bounded measurement reports, never raw Git objects.
+ * The 90-day durability calculation happens against the original local history;
+ * no shallow clone, artificial root commit or changes to the customer's checkout.
+ */
+export function prepareCheckoutArchive({ root, coverageRoot, durabilityReport, log = () => {}, maxBytes = ARCHIVE_LIMIT_BYTES, excludes = [] }) {
+  root = resolve(root)
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0 || maxBytes > ARCHIVE_LIMIT_BYTES) throw new Error("Invalid archive size limit.")
+  excludes = normalizeExcludes(excludes)
+  const temp = mkdtempSync(join(tmpdir(), "sq-checkout-"))
+  const onExit = () => { try { rmSync(temp, { recursive: true, force: true }) } catch { /* best effort on process exit */ } }
+  process.once("exit", onExit)
+  const cleanup = () => { process.removeListener("exit", onExit); rmSync(temp, { recursive: true, force: true }) }
+  try {
+    const source = inventory(root, { excludes })
+    const sourceList = join(temp, "source.list")
+    writeFileSync(sourceList, source.paths.length ? `${source.paths.join("\0")}\0` : "")
+    const metadataRoot = join(temp, "metadata")
+    mkdirSync(join(metadataRoot, ".sqreports"), { recursive: true })
+    const hasGit = existsSync(join(root, ".git"))
+    const history = { mode: hasGit ? "omitted" : "unavailable", reason: durabilityReport ? "ci_report" : hasGit ? "invalid_git" : "missing_git" }
+    writeFileSync(join(metadataRoot, ".sqreports/checkout.json"), JSON.stringify({ version: 1, history, archiveLimitBytes: ARCHIVE_LIMIT_BYTES }))
+    if (durabilityReport) {
+      const json = JSON.stringify(durabilityReport)
+      if (Buffer.byteLength(json) > MAX_DURABILITY_REPORT_BYTES) throw new Error("Durability report exceeds the 1 MiB report limit. No upload was sent.")
+      writeFileSync(join(metadataRoot, ".sqreports/durability.json"), json)
+    }
+    const metadataList = join(temp, "metadata.list")
+    writeFileSync(metadataList, `${inventory(metadataRoot, { reports: true }).paths.join("\0")}\0`)
+    const tarPath = join(temp, "checkout.tar")
+    const archivePath = `${tarPath}.gz`
+    // BSD tar uses only the last -T list. Build/append one directory and list
+    // per invocation, then stream compression through Node (no extra dependency).
+    const archivePart = (operation, directory, list) => {
+      const tar = spawnSync("tar", [operation, tarPath, "--no-recursion", "--null", "-C", directory, "-T", list], { encoding: "utf8", timeout: 180000, maxBuffer: 1024 * 1024, env: { ...process.env, COPYFILE_DISABLE: "1" } })
+      if (tar.error || tar.status !== 0) throw new Error("Could not archive the checkout. Ensure GNU/BSD tar is installed, files are readable, and the build has finished changing files.")
+    }
+    archivePart("-cf", root, sourceList)
+    if (coverageRoot) {
+      const coverageList = join(temp, "coverage.list")
+      const entries = inventory(coverageRoot, { reports: true }).paths
+      writeFileSync(coverageList, entries.length ? `${entries.join("\0")}\0` : "")
+      if (entries.length) archivePart("-rf", coverageRoot, coverageList)
+    }
+    archivePart("-rf", metadataRoot, metadataList)
+    const compression = spawnSync(process.execPath, ["--input-type=module", "-e", "import {createReadStream,createWriteStream} from 'node:fs';import{createGzip}from'node:zlib';import{pipeline}from'node:stream/promises';await pipeline(createReadStream(process.argv[1]),createGzip(),createWriteStream(process.argv[2]));", tarPath, archivePath], { encoding: "utf8", timeout: 180000, maxBuffer: 1024 * 1024 })
+    // A nonempty file can still be truncated. Never upload an archive produced
+    // by failed tar or a checkout that changed while it was being archived.
+    if (compression.error || compression.status !== 0 || !existsSync(archivePath) || statSync(archivePath).size === 0) {
+      throw new Error("Could not archive the checkout. Ensure GNU/BSD tar is installed, files are readable, and the build has finished changing files.")
+    }
+    const bytes = statSync(archivePath).size
+    if (bytes > maxBytes) {
+      const files = source.largest.map((f) => `${JSON.stringify(f.path)} (${mib(f.bytes)} MiB uncompressed)`).join(", ")
+      throw new Error(`source archive alone is ${mib(bytes)} MiB, above the ${mib(maxBytes)} MiB limit even without Git history. No upload was sent. Exclude generated assets with --exclude <relative-path>. Largest included files: ${files || "none"}`)
+    }
+    log(`ScaleQuality: checkout archive ${mib(bytes)} MiB / ${mib(maxBytes)} MiB; raw Git history stays on this runner.`)
+    return { archivePath, bytes, history, cleanup }
+  } catch (error) {
+    cleanup()
+    throw error
+  }
+}

package/bin/check.mjs

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
 // ScaleQuality continuous check. Uploads THIS CI checkout to ScaleQuality (re-measures
-// the code the runner already has, including .git so durability still runs) and exits
+// the code the runner already has, with a local 90-day durability report) and exits
 // non-zero when maturity is below the configured cutoff, so a CI step can fail the
 // build. Pure Node 18+ (global fetch/FormData/Blob), no npm dependencies.
 
 import { tmpdir } from "node:os"
-import { join } from "node:path"
+import { join, dirname, relative, sep } from "node:path"
 import { spawnSync } from "node:child_process"
-import { readFileSync, existsSync, statSync, rmSync } from "node:fs"
+import { readFileSync, writeFileSync, statSync, rmSync, readdirSync, mkdirSync, mkdtempSync, copyFileSync } from "node:fs"
+import { prepareCheckoutArchive, normalizeExcludes } from "./archive.mjs"
+import { measureDurability } from "./durability.mjs"
 
 const args = process.argv.slice(2)
 const flag = (name) => {
@@ -30,6 +32,8 @@ Options:
                    myapp:\${{ github.sha }}. Needs trivy on PATH; skipped with a
                    note if it is missing, never fails the build for it.
   --timeout <s>    Max seconds to wait for the measurement (default 600)
+  --exclude <p>    Exclude a generated path relative to the checkout; repeatable
+  --dry-run        Measure locally and check the package; do not upload (no token needed)
   --json           Print the raw result as JSON
   -h, --help       Show this help
 
@@ -41,6 +45,7 @@ const token = flag("--token") || process.env.SQ_TOKEN
 const project = flag("--project") || process.env.SQ_PROJECT
 const host = (flag("--host") || process.env.SQ_HOST || "https://app.scalequality.io").replace(/\/+$/, "")
 const jsonOut = has("--json")
+const dryRun = has("--dry-run")
 const image = flag("--image") || process.env.SQ_IMAGE
 const timeoutMs = Math.max(30, Number(flag("--timeout") || 600)) * 1000
 
@@ -49,7 +54,7 @@ const log = (m) => { if (!jsonOut) console.log(m) }
 const fail = (m) => { console.error(`ScaleQuality: ${m}`); process.exit(2) }
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
 
-if (!token || !project) {
+if (!dryRun && (!token || !project)) {
   fail("--token and --project are required (or env SQ_TOKEN / SQ_PROJECT). See --help.")
 }
 
@@ -123,34 +128,119 @@ function slimReport(stdout, ref) {
   return json
 }
 
+// Coverage reports live in exactly the directories the archive excludes: JaCoCo
+// writes to target/ and build/, Istanbul to coverage/. So the one moment where a
+// REAL coverage number is sitting on disk — right after this job ran the tests —
+// was also the one moment we threw it away, and every Maven project came back
+// with no measured coverage even with a green suite behind it.
+//
+// The reports are copied into .sqreports/ under FLAT, indexed names, with an
+// index.json holding each one's original path. Mirroring the original directory
+// tree looked tidier and did not work: bsdtar does not anchor `--exclude=./target`
+// to the root, so a staged copy at `.scalequality/coverage/target/...` was dropped
+// on macOS while surviving under GNU tar. Measured, not assumed — and a layout
+// whose behaviour depends on which tar the runner ships is not a layout.
+// Every staged name here is `<n>-<basename>`, which no exclude pattern can match.
+const COVERAGE_NAMES = [
+  { re: /^jacoco(TestReport)?\.xml$/i, format: "jacoco" },
+  { re: /^lcov\.info$/i, format: "lcov" },
+  { re: /^coverage-summary\.json$/i, format: "istanbul" },
+  { re: /^coverage\.cobertura\.xml$/i, format: "cobertura" },
+  { re: /^cobertura(-coverage)?\.xml$/i, format: "cobertura" },
+  { re: /^coverage\.xml$/i, format: "cobertura" },
+  { re: /^clover\.xml$/i, format: "clover" },
+  { re: /^(coverage|cover)\.out$/i, format: "go" },
+]
+const COVERAGE_SKIP = new Set(["node_modules", ".git", ".venv", "venv", "vendor", "__pycache__", ".sqreports"])
+const COVERAGE_STAGE = ".sqreports"
+const MAX_REPORT_BYTES = 25 * 1024 * 1024
+const MAX_REPORTS = 40
+
+function stageCoverageReports() {
+  const root = process.cwd()
+  const stagingRoot = mkdtempSync(join(tmpdir(), "sq-coverage-"))
+  const stage = join(stagingRoot, COVERAGE_STAGE)
+  // The staged copies must not outlive this process under ANY exit path. A
+  // cancelled job or a network failure that left them behind would show up as
+  // untracked files in the customer's checkout, and a pipeline that runs
+  // `git diff --exit-code` after the gate would fail because of us.
+  const clean = () => { try { rmSync(stagingRoot, { recursive: true, force: true }) } catch { /* best effort */ } }
+  process.on("exit", clean)
+  for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+    process.on(sig, () => { clean(); process.exit(130) })
+  }
+
+  const index = []
+  let bytes = 0
+  const walk = (dir, depth) => {
+    if (depth > 7 || index.length >= MAX_REPORTS || bytes >= MAX_REPORT_BYTES) return
+    let entries
+    try { entries = readdirSync(dir, { withFileTypes: true }) } catch { return }
+    for (const e of entries) {
+      if (index.length >= MAX_REPORTS || bytes >= MAX_REPORT_BYTES) return
+      const abs = join(dir, e.name)
+      if (e.isDirectory()) {
+        if (!COVERAGE_SKIP.has(e.name)) walk(abs, depth + 1)
+        continue
+      }
+      if (!e.isFile()) continue
+      const hit = COVERAGE_NAMES.find((c) => c.re.test(e.name))
+      if (!hit) continue
+      let size = 0
+      try { size = statSync(abs).size } catch { continue }
+      if (size === 0 || bytes + size > MAX_REPORT_BYTES) continue
+      const staged = `${index.length}-${e.name}`
+      try {
+        mkdirSync(stage, { recursive: true })
+        copyFileSync(abs, join(stage, staged))
+      } catch { continue }
+      bytes += size
+      index.push({ file: staged, path: relative(root, abs).split(sep).join("/"), format: hit.format })
+    }
+  }
+  walk(root, 0)
+
+  if (index.length) {
+    try {
+      writeFileSync(join(stage, "index.json"), JSON.stringify({ version: 1, reports: index }))
+    } catch { /* the archive just goes without them */ }
+    const shown = index.slice(0, 3).map((r) => r.path).join(", ")
+    log(`ScaleQuality: found ${index.length} coverage report(s) — ${shown}${index.length > 3 ? " …" : ""}`)
+  } else {
+    log("ScaleQuality: no coverage report found in this job. Run your tests with coverage before this step to get a measured %.")
+  }
+  return { stage, root: stagingRoot, count: index.length, cleanup: clean }
+}
+
 async function main() {
   const auth = { Authorization: `Bearer ${token}` }
-
-  // Upload THIS checkout (the runner already has the code) instead of asking the server
-  // to clone the repo from outside — that needed a stored provider credential and failed
-  // with no_repo_reachable on private repos. Keep .git so the durability domain (git blame)
-  // still runs; node_modules + build output are excluded to stay small.
-  const archivePath = join(tmpdir(), `sq-checkout-${process.pid}.tar.gz`)
-  // Portable flags only (GNU/BSD/busybox tar all accept -czf, --exclude, -C). We do NOT
-  // rely on tar's exit code (some tars exit 1 on a benign "file changed as we read it"
-  // during a build); instead we require the archive to exist and be non-empty.
-  const tr = spawnSync("tar", [
-    "-czf", archivePath,
-    "--exclude=./node_modules", "--exclude=./dist", "--exclude=./build",
-    "--exclude=./.next", "--exclude=./out", "--exclude=./target",
-    "--exclude=./.venv", "--exclude=./venv", "--exclude=./coverage", "--exclude=./.turbo",
-    "-C", process.cwd(), ".",
-  ], { encoding: "utf8" })
-  if (!(existsSync(archivePath) && statSync(archivePath).size > 0)) {
-    fail(`could not archive the checkout (tar unavailable or failed). ${tr.error?.message || (tr.stderr || "").trim()}`)
+  const excludes = normalizeExcludes(args.flatMap((arg, i) => arg === "--exclude" ? [args[i + 1]] : []))
+  const durabilityReport = await measureDurability({ root: process.cwd(), log: jsonOut ? (message) => console.error(message) : log })
+  const coverage = stageCoverageReports()
+  let packed, buf
+  try {
+    packed = prepareCheckoutArchive({ root: process.cwd(), coverageRoot: coverage.root, durabilityReport, excludes, log })
+    if (durabilityReport) {
+      const head = spawnSync("git", ["--no-optional-locks", "-C", process.cwd(), "rev-parse", "--verify", "HEAD"], { encoding: "utf8", timeout: 10000 })
+      if (head.error || head.status !== 0 || head.stdout.trim() !== durabilityReport.headSha) throw new Error("Git HEAD changed during measurement or packaging. No upload was sent; rerun after the checkout is stable.")
+    }
+    if (!dryRun) buf = readFileSync(packed.archivePath)
+  } finally {
+    packed?.cleanup()
+    coverage.cleanup()
+  }
+  const localCheckout = { version: 1, history: packed.history, archiveBytes: packed.bytes, durability: durabilityReport ? { source: "ci", windowDays: 90, settleDays: 14, headSha: durabilityReport.headSha, measuredAt: durabilityReport.measuredAt, engineCommit: durabilityReport.engineCommit } : undefined }
+  const limitation = "ScaleQuality: historical secret scanning and commit-convention signals are not included in this checkout report."
+  console.error(limitation)
+  if (dryRun) {
+    if (jsonOut) console.log(JSON.stringify({ dryRun: true, checkout: localCheckout, coverageReports: coverage.count }))
+    else log("ScaleQuality: local package verified; no upload sent.")
+    return
   }
-  const buf = readFileSync(archivePath)
-  rmSync(archivePath, { force: true })
-  const sizeMB = buf.length / (1024 * 1024)
-  if (sizeMB > 60) fail(`checkout archive too large (${sizeMB.toFixed(0)}MB > 60MB limit). Reduce clone depth or exclude build output.`)
 
   const form = new FormData()
   form.append("project", project)
+  form.append("reportProtocol", "durability-ci-v1")
   form.append("file", new Blob([buf]), "checkout.tar.gz")
   const containerReport = scanImage()
   if (containerReport) form.append("containerReport", containerReport)
@@ -163,7 +253,7 @@ async function main() {
     const body = await r.text().catch(() => "")
     if (r.status === 401) fail("invalid token.")
     if (r.status === 402) fail("continuous measurement needs an active subscription.")
-    if (r.status === 409) fail("continuous is not enabled for this project. Turn it on in ScaleQuality.")
+    if (r.status === 409) fail(body.includes("measurement_already_running") ? "another measurement is already running for this project. Wait for it to finish and rerun this step." : "continuous is not enabled for this project. Turn it on in ScaleQuality.")
     fail(`report failed (${r.status}) ${body}`)
   }
   const { runId } = await r.json()
@@ -197,6 +287,10 @@ async function main() {
 
   if (!last || (last.status !== "COMPLETED" && last.status !== "FAILED")) fail("timed out waiting for the measurement.")
   if (last.status === "FAILED") fail(`measurement failed: ${last.failureReason || "unknown"}`)
+  if (last.checkout?.version !== 1) fail("the server did not confirm the checkout report protocol. No passing gate is claimed; update to the compatible continuous-measurement server release.")
+  if (durabilityReport && (last.checkout?.durability?.source !== "ci" || last.checkout.durability.windowDays !== 90 || last.checkout.durability.settleDays !== 14 || last.checkout.durability.headSha !== durabilityReport.headSha || last.checkout.durability.measuredAt !== durabilityReport.measuredAt || last.checkout.durability.engineCommit !== durabilityReport.engineCommit)) {
+    fail("the server did not confirm this checkout's 90-day durability report. No passing gate is claimed; the server needs the compatible continuous-measurement release.")
+  }
 
   if (jsonOut) {
     console.log(JSON.stringify(last))

package/bin/durability/GitDurabilityEngine.mjs

@@ -0,0 +1,225 @@
+import { readCommits, listHeadFiles, blameFile } from "./GitReader.mjs";
+import { classifyCommit } from "./OriginClassifier.mjs";
+const DEFAULT_CHURN_DAYS = 14;
+const DEFAULT_MAX_BLAME_FILES = 500;
+const HIGH_VELOCITY_LOC_PER_WEEK = 1500; // "AI-like" cadence threshold
+const DAY_MS = 24 * 60 * 60 * 1000;
+const sum = (xs) => xs.reduce((a, b) => a + b, 0);
+function assembleSurvival(introduced, surviving) {
+    const out = {};
+    for (const key of new Set([...Object.keys(introduced), ...Object.keys(surviving)])) {
+        const intro = introduced[key] ?? 0;
+        const surv = surviving[key] ?? 0;
+        out[key] = {
+            linesIntroduced: intro,
+            linesSurviving: Math.min(surv, intro),
+            survivalRate: intro > 0 ? Math.min(1, Math.round((surv / intro) * 1000) / 1000) : 0,
+        };
+    }
+    return out;
+}
+const FIX_RE = /\b(fix|bug|hotfix|patch|revert|broke|regression)\b/i;
+const REVERT_RE = /\brevert(s|ed|ing)?\b|this reverts commit/i;
+function isRevert(c) {
+    return REVERT_RE.test(c.body);
+}
+/** Churn: a file touched again within churnDays of a prior touch. */
+function computeChurn(commits, churnDays) {
+    const fileTouches = new Map();
+    for (const c of commits) {
+        const t = Date.parse(c.date);
+        const perFile = c.files.length > 0 ? (c.additions + c.deletions) / c.files.length : 0;
+        for (const f of c.files) {
+            if (!fileTouches.has(f))
+                fileTouches.set(f, []);
+            fileTouches.get(f).push({ t, addDel: perFile });
+        }
+    }
+    let churnLinesAffected = 0;
+    let churnEvents = 0;
+    let filesWithNew = 0;
+    let filesReChurned2w = 0;
+    const TWO_WEEKS = 14 * DAY_MS;
+    for (const touches of fileTouches.values()) {
+        touches.sort((a, b) => a.t - b.t);
+        filesWithNew++;
+        let reChurned2w = false;
+        for (let i = 1; i < touches.length; i++) {
+            const gap = Math.abs(touches[i].t - touches[i - 1].t);
+            if (gap <= churnDays * DAY_MS) {
+                churnEvents++;
+                churnLinesAffected += Math.round(touches[i].addDel);
+            }
+            if (touches[i].t - touches[0].t <= TWO_WEEKS)
+                reChurned2w = true;
+        }
+        if (reChurned2w)
+            filesReChurned2w++;
+    }
+    const newCodeChurn2w = filesWithNew > 0 ? Math.round((filesReChurned2w / filesWithNew) * 1000) / 1000 : 0;
+    return { churnLinesAffected, churnEvents, newCodeChurn2w };
+}
+/** Cascade: fix-commits that closely follow a prior commit on shared files. */
+function computeCascadeRate(commits, churnDays) {
+    if (commits.length === 0)
+        return 0;
+    const sorted = [...commits].sort((a, b) => Date.parse(a.date) - Date.parse(b.date));
+    let cascades = 0;
+    for (let i = 0; i < sorted.length; i++) {
+        if (!FIX_RE.test(sorted[i].body))
+            continue;
+        const ti = Date.parse(sorted[i].date);
+        const fi = new Set(sorted[i].files);
+        for (let j = i - 1; j >= 0; j--) {
+            if (ti - Date.parse(sorted[j].date) > churnDays * DAY_MS)
+                break;
+            if (sorted[j].files.some((f) => fi.has(f))) {
+                cascades++;
+                break;
+            }
+        }
+    }
+    return Math.round((cascades / sorted.length) * 1000) / 1000;
+}
+/** Stabilization: share of touched files touched exactly once (settled). */
+function computeStabilization(commits) {
+    const counts = new Map();
+    for (const c of commits)
+        for (const f of c.files)
+            counts.set(f, (counts.get(f) ?? 0) + 1);
+    if (counts.size === 0)
+        return 0;
+    let stabilized = 0;
+    for (const n of counts.values())
+        if (n === 1)
+            stabilized++;
+    return Math.round((stabilized / counts.size) * 1000) / 1000;
+}
+/**
+ * Attribution gap (directional): authors writing at AI-like velocity
+ * (>threshold loc/week) but with low AI attribution → suspected
+ * unattributed AI. Never falsely re-classifies a commit; this is a flag.
+ */
+function computeAttributionGap(commits, windowDays) {
+    const weeks = Math.max(1, windowDays / 7);
+    const byAuthor = new Map();
+    for (const c of commits) {
+        if (c.origin === "BOT")
+            continue;
+        const a = byAuthor.get(c.email) ?? { total: 0, ai: 0, loc: 0 };
+        a.total++;
+        if (c.origin === "AI_ATTRIBUTED")
+            a.ai++;
+        a.loc += c.additions + c.deletions;
+        byAuthor.set(c.email, a);
+    }
+    let suspected = 0;
+    let total = 0;
+    for (const a of byAuthor.values()) {
+        total += a.total;
+        const aiPct = a.total > 0 ? a.ai / a.total : 0;
+        const locPerWeek = a.loc / weeks;
+        if (locPerWeek > HIGH_VELOCITY_LOC_PER_WEEK && aiPct < 0.5) {
+            suspected += a.total * (1 - aiPct); // the non-attributed share
+        }
+    }
+    const pct = total > 0 ? Math.round((suspected / total) * 100) : 0;
+    const confidence = "LOW";
+    return { suspectedAttributionGapPct: pct, attributionConfidence: confidence };
+}
+/**
+ * Native durability engine. Analyses a cloned repo's git history (log +
+ * blame) and returns durability/origin/churn/attribution metrics by
+ * origin and tool. Deterministic, no LLM, no external engine.
+ */
+export async function analyzeDurability(repoPath, opts) {
+    const churnDays = opts.churnDays ?? DEFAULT_CHURN_DAYS;
+    const maxBlame = opts.maxBlameFiles ?? DEFAULT_MAX_BLAME_FILES;
+    const log = opts.onLog ?? (() => { });
+    const endDaysAgo = opts.endDaysAgo ?? 0;
+    const settleDays = opts.settleDays ?? 0;
+    const raw = await readCommits(repoPath, opts.windowDays + endDaysAgo, endDaysAgo);
+    const commits = raw.map((c) => ({ ...c, ...classifyCommit(c) }));
+    log(`commits in window: ${commits.length}`);
+    // Survival is measured ONLY on commits old enough to have settled (older than
+    // settleDays). Code written in the last settleDays is right-censored — it
+    // hasn't had time to be reverted, so counting it would inflate survival.
+    // Churn, revert, cascade and attribution stay on the full window.
+    const settleCutoff = Date.now() - settleDays * DAY_MS;
+    const measureCommits = settleDays > 0
+        ? commits.filter((c) => Date.parse(c.date) <= settleCutoff)
+        : commits;
+    const measureShas = new Map(measureCommits.map((c) => [c.sha, c]));
+    const introducedByOrigin = {};
+    const introducedByTool = {};
+    for (const c of measureCommits) {
+        introducedByOrigin[c.origin] = (introducedByOrigin[c.origin] ?? 0) + c.additions;
+        if (c.tool)
+            introducedByTool[c.tool] = (introducedByTool[c.tool] ?? 0) + c.additions;
+    }
+    const headFiles = await listHeadFiles(repoPath);
+    const touched = new Set();
+    for (const c of commits)
+        for (const f of c.files)
+            if (headFiles.has(f))
+                touched.add(f);
+    let files = [...touched];
+    if (files.length > maxBlame) {
+        log(`blame capped: ${maxBlame}/${files.length} files (perf)`);
+        files = files.slice(0, maxBlame);
+    }
+    log(`blaming ${files.length} files...`);
+    const survivingByOrigin = {};
+    const survivingByTool = {};
+    for (const f of files) {
+        const counts = await blameFile(repoPath, f);
+        for (const [sha, n] of counts) {
+            const c = measureShas.get(sha);
+            if (!c)
+                continue; // line introduced outside the settled measurement window
+            survivingByOrigin[c.origin] = (survivingByOrigin[c.origin] ?? 0) + n;
+            if (c.tool)
+                survivingByTool[c.tool] = (survivingByTool[c.tool] ?? 0) + n;
+        }
+    }
+    const byOrigin = assembleSurvival(introducedByOrigin, survivingByOrigin);
+    const byTool = assembleSurvival(introducedByTool, survivingByTool);
+    const linesIntroduced = sum(Object.values(introducedByOrigin));
+    // Clamp: a surviving line was, by definition, introduced — survival
+    // can't exceed 100% (guards against any blame/window edge).
+    const linesSurviving = Math.min(sum(Object.values(survivingByOrigin)), linesIntroduced);
+    const survivalRate = linesIntroduced > 0 ? linesSurviving / linesIntroduced : 0;
+    const { churnLinesAffected, newCodeChurn2w } = computeChurn(commits, churnDays);
+    const cascadeRate = computeCascadeRate(commits, churnDays);
+    const stabilizationRatio = computeStabilization(commits);
+    const revertCount = commits.filter(isRevert).length;
+    const revertRate = commits.length > 0 ? revertCount / commits.length : 0;
+    const aiCommits = commits.filter((c) => c.origin === "AI_ATTRIBUTED").length;
+    const nonBot = commits.filter((c) => c.origin !== "BOT").length;
+    const aiDetectionCoveragePct = nonBot > 0 ? Math.round((aiCommits / nonBot) * 100) : 0;
+    const { suspectedAttributionGapPct, attributionConfidence } = computeAttributionGap(commits, opts.windowDays);
+    const durablePct = Math.round(survivalRate * 100);
+    const revertPct = Math.round(revertRate * 100);
+    const churnPct = Math.max(0, 100 - durablePct - revertPct);
+    const signalToNoise = churnLinesAffected > 0 ? Math.round((linesSurviving / churnLinesAffected) * 100) / 100 : null;
+    return {
+        commitsTotal: commits.length,
+        linesIntroduced,
+        linesSurviving,
+        survivalRate: Math.round(survivalRate * 1000) / 1000,
+        stabilizationRatio,
+        churnLinesAffected,
+        revertRate: Math.round(revertRate * 1000) / 1000,
+        newCodeChurn2w,
+        cascadeRate,
+        aiDetectionCoveragePct,
+        durablePct,
+        churnPct,
+        revertPct,
+        signalToNoise,
+        suspectedAttributionGapPct,
+        attributionConfidence,
+        byOrigin,
+        byTool,
+    };
+}

package/bin/durability/GitReader.mjs

@@ -0,0 +1,118 @@
+import { runGit as git, isFatalGitError } from "./runtime.mjs";
+const US = "\x1f"; // unit separator (field)
+const RS = "\x1e"; // record separator (commit)
+const CO_AUTHOR_RE = /co-authored-by:\s*(.*?)\s*<([^>]+)>/gi;
+function parseCoAuthors(body) {
+    const out = [];
+    let m;
+    CO_AUTHOR_RE.lastIndex = 0;
+    while ((m = CO_AUTHOR_RE.exec(body)) !== null) {
+        out.push({ name: m[1].trim(), email: m[2].trim().toLowerCase() });
+    }
+    return out;
+}
+/**
+ * Reads commits in the window (metadata + co-authors via one log call,
+ * file stats via a second --numstat call) and merges them. Two calls so
+ * the multi-line commit body can't corrupt numstat line parsing.
+ */
+export async function readCommits(repoPath, sinceDays, untilDays = 0) {
+    const since = `${sinceDays} days ago`;
+    // untilDays > 0 bounds the window's END in the past (point-in-time backfill).
+    const untilArgs = untilDays > 0 ? [`--until=${untilDays} days ago`] : [];
+    // Pass 1: metadata + body (for co-author trailers).
+    const metaFmt = ["%H", "%an", "%ae", "%cI", "%B"].join(US) + RS;
+    const metaOut = await git(repoPath, [
+        "log",
+        `--since=${since}`,
+        ...untilArgs,
+        "--no-merges",
+        `--pretty=format:${metaFmt}`,
+    ]);
+    const bySha = new Map();
+    for (const rec of metaOut.split(RS)) {
+        const trimmed = rec.replace(/^\n+/, "");
+        if (!trimmed.trim())
+            continue;
+        const parts = trimmed.split(US);
+        if (parts.length < 5)
+            continue;
+        const [sha, author, email, date, body] = parts;
+        bySha.set(sha, {
+            sha,
+            author,
+            email: email.toLowerCase(),
+            date,
+            body,
+            coAuthors: parseCoAuthors(body),
+            additions: 0,
+            deletions: 0,
+            files: [],
+        });
+    }
+    // Pass 2: per-commit numstat.
+    const statOut = await git(repoPath, [
+        "log",
+        `--since=${since}`,
+        ...untilArgs,
+        "--no-merges",
+        "--numstat",
+        `--pretty=format:${RS}%H`,
+    ]);
+    for (const block of statOut.split(RS)) {
+        if (!block.trim())
+            continue;
+        const lines = block.split("\n").filter((l) => l.length > 0);
+        const sha = lines.shift()?.trim();
+        if (!sha)
+            continue;
+        const rec = bySha.get(sha);
+        if (!rec)
+            continue;
+        for (const line of lines) {
+            const cols = line.split("\t");
+            if (cols.length < 3)
+                continue;
+            const add = Number.parseInt(cols[0], 10); // "-" (binary) → NaN
+            const del = Number.parseInt(cols[1], 10);
+            rec.additions += Number.isFinite(add) ? add : 0;
+            rec.deletions += Number.isFinite(del) ? del : 0;
+            rec.files.push(cols.slice(2).join("\t"));
+        }
+    }
+    return [...bySha.values()];
+}
+/** Files that currently exist at HEAD (tracked). */
+export async function listHeadFiles(repoPath) {
+    const out = await git(repoPath, ["ls-tree", "-r", "--name-only", "HEAD"]);
+    return new Set(out.split("\n").map((l) => l.trim()).filter(Boolean));
+}
+const SHA_LINE = /^([0-9a-f]{40}) /;
+/**
+ * Blames a file at HEAD and returns, per introducing commit sha, how many
+ * CURRENT lines it owns (--line-porcelain → one sha header per line). Used
+ * to compute "lines introduced in window that still survive". Returns an
+ * empty map on any blame failure (deleted/binary/huge file).
+ */
+export async function blameFile(repoPath, file) {
+    const counts = new Map();
+    try {
+        const out = await git(repoPath, [
+            "blame",
+            "--line-porcelain",
+            "HEAD",
+            "--",
+            file,
+        ]);
+        for (const line of out.split("\n")) {
+            const m = SHA_LINE.exec(line);
+            if (m)
+                counts.set(m[1], (counts.get(m[1]) ?? 0) + 1);
+        }
+    }
+    catch (error) {
+        if (isFatalGitError(error)) throw error;
+        // deleted at HEAD / binary / unreadable → no surviving lines counted
+    }
+    return counts;
+}

package/bin/durability/OriginClassifier.mjs

@@ -0,0 +1,48 @@
+/**
+ * Native origin classifier (our own). Deterministic, confidence-aware.
+ *
+ * Signals (high confidence): Co-Authored-By trailers + author identity
+ * matching known AI tools / bots. NO content analysis, NO false
+ * attribution — a commit without an AI signal is HUMAN. Unattributed-but-
+ * likely-AI is surfaced separately by AttributionGapAnalyzer (SUSPECTED),
+ * never silently classified here.
+ */
+const AI_TOOL_PATTERNS = [
+    [/copilot|github-copilot/i, "Copilot"],
+    [/claude|anthropic/i, "Claude"],
+    [/cursor/i, "Cursor"],
+    [/codeium/i, "Codeium"],
+    [/tabnine/i, "Tabnine"],
+    [/amazon[-\s]?q/i, "Amazon Q"],
+    [/gemini/i, "Gemini"],
+    [/windsurf/i, "Windsurf"],
+    [/devin/i, "Devin"],
+    [/aider/i, "Aider"],
+];
+const BOT_PATTERN = /\[bot\]|-bot\b|\bbot@|dependabot|renovate|github-actions|mergify|snyk-bot|copilot-autofix/i;
+function matchTool(haystack) {
+    for (const [re, tool] of AI_TOOL_PATTERNS) {
+        if (re.test(haystack))
+            return tool;
+    }
+    return null;
+}
+export function classifyCommit(c) {
+    // 1. Co-author trailers → strongest AI signal.
+    for (const ca of c.coAuthors) {
+        const tool = matchTool(`${ca.email} ${ca.name}`);
+        if (tool)
+            return { origin: "AI_ATTRIBUTED", tool, confidence: "HIGH" };
+    }
+    // 2. Author identity is itself an AI tool (e.g. copilot@github.com).
+    const authorTool = matchTool(`${c.email} ${c.author}`);
+    if (authorTool && !BOT_PATTERN.test(`${c.author} ${c.email}`)) {
+        return { origin: "AI_ATTRIBUTED", tool: authorTool, confidence: "HIGH" };
+    }
+    // 3. Bot.
+    if (BOT_PATTERN.test(`${c.author} ${c.email}`)) {
+        return { origin: "BOT", tool: null, confidence: "HIGH" };
+    }
+    // 4. Default human.
+    return { origin: "HUMAN", tool: null, confidence: "HIGH" };
+}

package/bin/durability/PROVENANCE.md

@@ -0,0 +1,36 @@
+# Bundled local Git measurement
+
+The four generated modules come from `scalequality-ai-governance-service` commit
+`35a9ac72e2a131c108b40c9d2477f58a90deb4c1`, under
+`src/application/services/durability/`. `provenance.json` records original SHA-256
+hashes, compiler settings, generated hashes, and the source-manifest digest exported
+by `../durability.mjs`.
+
+To regenerate, extract the four named TypeScript files from that exact Git commit
+into a temporary directory. Compile with TypeScript 5.9.3, target/module ES2022,
+moduleResolution node, strict true, esModuleInterop true, skipLibCheck true, and
+Node type declarations. No dependencies are needed by the resulting runtime.
+Rename the generated files to `.mjs` and give their relative imports `.mjs`
+extensions. The engine's calculations and classifier remain unchanged. In the
+reader, replace its promisified `execFile` wrapper with `runtime.mjs`'s `runGit`,
+and rethrow `isFatalGitError(error)` in its per-file blame catch. Retain native
+handling for other per-file errors. Recompute provenance hashes and run the
+parity and cancellation tests. The reference modules under
+`test/native-durability-reference/` preserve the original reader for small fixture
+comparisons only; they are excluded from the published package.
+
+The runtime keeps the native 90-day window, 14-day settlement and churn settings,
+and native maximum of 500 blamed files. A native cap warning is logged; this does
+not certify that every tracked file was blamed. Tracked dependency files remain
+part of native Git measurement even if archive exclusions omit those directories.
+
+No clone, fetch, checkout or Git write is performed. Shallow or partial histories,
+missing objects, changing HEAD and invalid reports produce no measurement.
+The separate worker has a 120-second total budget and 512 MiB V8 heap ceiling;
+each Git command has at most 30 seconds and 16 MiB of output. The complete HEAD
+object inventory uses this same limit, so sufficiently large object inventories
+can be unavailable even when the 90-day change window is small. Limit failures
+are reported as unavailable, never converted into successful zero measurements.
+Only the measurement worker's own process group and Git children are cleaned up
+on cancellation or parent IPC disconnection. Git command output, author details,
+credentials and customer environment tokens are not logged or sent to the worker.

package/bin/durability/provenance.json

@@ -0,0 +1,52 @@
+{
+  "engineCommit": "35a9ac72e2a131c108b40c9d2477f58a90deb4c1",
+  "sourceRepository": "scalequality-ai-governance-service",
+  "sourceFiles": [
+    {
+      "file": "src/application/services/durability/GitDurabilityEngine.ts",
+      "sha256": "4210aba0a7dbfa6ca62178ff434dcaef81b0ca77c72a8fa488ae48f03c734105"
+    },
+    {
+      "file": "src/application/services/durability/GitReader.ts",
+      "sha256": "bc6ca21db40bbdadebdccfbfb7f3dcab3125eeed96d2199a6bd309c949410e9b"
+    },
+    {
+      "file": "src/application/services/durability/OriginClassifier.ts",
+      "sha256": "ac58ba1684b63ee34c168b39574f777087fadebe9ce80e2c1da8948f7bb3bd62"
+    },
+    {
+      "file": "src/application/services/durability/types.ts",
+      "sha256": "f102fabbeb0a3eee09ca0be64bb7777f12c553c91ebd615340132e674ea66026"
+    }
+  ],
+  "sourceManifestSha256": "bc7a01ce93df3aad2f80da281934868ba7327a1a04fad840f35ecc8b422c74cf",
+  "compiler": {
+    "version": "5.9.3",
+    "target": "ES2022",
+    "module": "ES2022",
+    "strictTypecheckPassed": true
+  },
+  "runtimeChanges": [
+    "ESM relative import extensions only in engine/classifier",
+    "GitReader process wrapper replaced by bounded local-only runner",
+    "GitReader blame catch rethrows resource/incomplete-history failures; ordinary per-file errors retain native handling"
+  ],
+  "generatedFiles": [
+    {
+      "file": "GitDurabilityEngine.mjs",
+      "sha256": "7aee834f36a2737f1e7dd459ed067653c264a5d46ce5d602ed3fbba24ae1cc8a"
+    },
+    {
+      "file": "GitReader.mjs",
+      "sha256": "447ce620849adc44e3abdf153174ce485ef5391cb29a00fc2e1d9a3064197b96"
+    },
+    {
+      "file": "OriginClassifier.mjs",
+      "sha256": "f1da36019423b8e60ad9c9c69b690c55fde4333de27dd3ee08a95ec97f09d7b7"
+    },
+    {
+      "file": "types.mjs",
+      "sha256": "50401f50b011535140ddc298f3b532cc931a0039247b96e64e7352c04c022723"
+    }
+  ]
+}

package/bin/durability/runtime.mjs

@@ -0,0 +1,55 @@
+import { execFile } from 'node:child_process'
+
+export const MAX_GIT_BUFFER = 16 * 1024 * 1024
+export const MAX_GIT_TIME_MS = 30_000
+let deadline = 0
+const children = new Set()
+
+export class GitMeasurementError extends Error {
+  constructor(reason) { super(reason); this.reason = reason; this.fatalMeasurement = true }
+}
+export const isFatalGitError = (error) => error?.fatalMeasurement === true
+export function setDeadline(value) { deadline = value }
+export function remainingTime() {
+  const remaining = deadline - Date.now()
+  if (remaining <= 0) throw new GitMeasurementError('time budget exceeded')
+  return remaining
+}
+export function stopGitChildren() {
+  for (const child of children) { try { child.kill('SIGKILL') } catch {} }
+}
+
+export function localGitEnvironment() {
+  const env = {}
+  for (const name of ['PATH', 'HOME', 'USERPROFILE', 'SystemRoot', 'WINDIR', 'TMPDIR', 'TMP', 'TEMP']) {
+    if (process.env[name] !== undefined) env[name] = process.env[name]
+  }
+  return { ...env, LC_ALL: 'C', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: process.platform === 'win32' ? 'NUL' : '/dev/null', GIT_TERMINAL_PROMPT: '0', GIT_OPTIONAL_LOCKS: '0', GIT_NO_LAZY_FETCH: '1' }
+}
+
+export async function runGit(repoPath, args, { allowMissingConfig = false } = {}) {
+  const timeout = Math.min(MAX_GIT_TIME_MS, remainingTime())
+  return new Promise((resolve, reject) => {
+    const child = execFile('git', [
+      '--no-pager', '-c', 'core.fsmonitor=false', '-c', 'core.hooksPath=' + (process.platform === 'win32' ? 'NUL' : '/dev/null'),
+      '-c', 'credential.helper=', '-c', 'protocol.allow=never', '-c', 'protocol.file.allow=never',
+      '-C', repoPath, ...args,
+    ], { encoding: 'utf8', maxBuffer: MAX_GIT_BUFFER, timeout, killSignal: 'SIGKILL', windowsHide: true, env: localGitEnvironment() }, (error, stdout, stderr) => {
+      children.delete(child)
+      if (!error) { try { remainingTime(); resolve(stdout) } catch (e) { reject(e) }; return }
+      if (allowMissingConfig && error.code === 1) { resolve(''); return }
+      if (error.code === 'ENOENT') { reject(new GitMeasurementError('Git is unavailable')); return }
+      if (error.code === 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER' || error.code === 'ENOBUFS') { reject(new GitMeasurementError('Git output exceeded the 16 MiB resource limit')); return }
+      if (error.killed || error.signal || error.code === 'ETIMEDOUT') { reject(new GitMeasurementError('Git command exceeded the time budget')); return }
+      if (/missing (?:blob|tree|commit|object)|bad object|unable to read|could not read|object .*corrupt|object file .*empty|invalid object|promisor|transport .*not allowed/i.test(stderr || '')) {
+        reject(new GitMeasurementError('Git history is incomplete or unavailable locally')); return
+      }
+      // Preserve the native reader's handling of ordinary per-file blame errors.
+      // Never propagate command output, author identities or credentials to logs.
+      const safeError = new Error('Git command failed')
+      safeError.code = error.code
+      reject(safeError)
+    })
+    children.add(child)
+  })
+}

package/bin/durability/types.mjs

@@ -0,0 +1,5 @@
+/**
+ * Native durability engine — domain types. Our own reimplementation of
+ * git-history durability analysis (no external engine dependency).
+ */
+export {};

package/bin/durability/validate.mjs

@@ -0,0 +1,31 @@
+export const ENGINE_COMMIT = '35a9ac72e2a131c108b40c9d2477f58a90deb4c1'
+const COUNTS = ['commitsTotal', 'linesIntroduced', 'linesSurviving', 'churnLinesAffected']
+const RATIOS = ['survivalRate', 'stabilizationRatio', 'revertRate', 'newCodeChurn2w', 'cascadeRate']
+const PCTS = ['aiDetectionCoveragePct', 'durablePct', 'churnPct', 'revertPct', 'suspectedAttributionGapPct']
+const TOOLS = ['Copilot', 'Claude', 'Cursor', 'Codeium', 'Tabnine', 'Amazon Q', 'Gemini', 'Windsurf', 'Devin', 'Aider']
+const object = (v) => v !== null && typeof v === 'object' && !Array.isArray(v)
+const keys = (v, names) => object(v) && Object.keys(v).length === names.length && Object.keys(v).every(k => names.includes(k))
+const count = (v) => Number.isSafeInteger(v) && v >= 0
+const ratio = (v) => Number.isFinite(v) && v >= 0 && v <= 1
+const roundedRatio = (surviving, introduced) => introduced > 0 ? Math.round(surviving / introduced * 1000) / 1000 : 0
+function survivalMap(map, allowed) {
+  return object(map) && Object.entries(map).every(([key, v]) => allowed.includes(key) && keys(v, ['linesIntroduced', 'linesSurviving', 'survivalRate']) && count(v.linesIntroduced) && count(v.linesSurviving) && ratio(v.survivalRate) && v.linesSurviving <= v.linesIntroduced && v.survivalRate === roundedRatio(v.linesSurviving, v.linesIntroduced))
+}
+export function validateReport(report, now = Date.now()) {
+  try {
+    if (!keys(report, ['version', 'source', 'engineCommit', 'windowDays', 'settleDays', 'headSha', 'measuredAt', 'result'])) return false
+    if (report.version !== 1 || report.source !== 'ci' || report.engineCommit !== ENGINE_COMMIT || report.windowDays !== 90 || report.settleDays !== 14 || !/^[0-9a-f]{40}$/.test(report.headSha)) return false
+    if (typeof report.measuredAt !== 'string' || !Number.isFinite(Date.parse(report.measuredAt)) || Math.abs(now - Date.parse(report.measuredAt)) > 86_400_000) return false
+    const r = report.result
+    if (!keys(r, [...COUNTS, ...RATIOS, ...PCTS, 'signalToNoise', 'attributionConfidence', 'byOrigin', 'byTool'])) return false
+    if (!COUNTS.every(k => count(r[k])) || !RATIOS.every(k => ratio(r[k])) || !PCTS.every(k => count(r[k]) && r[k] <= 100)) return false
+    if (!(r.signalToNoise === null || (Number.isFinite(r.signalToNoise) && r.signalToNoise >= 0)) || r.attributionConfidence !== 'LOW') return false
+    if (!survivalMap(r.byOrigin, ['AI_ATTRIBUTED', 'BOT', 'HUMAN']) || !survivalMap(r.byTool, TOOLS)) return false
+    const sum = (map, key) => Object.values(map).reduce((n, v) => n + v[key], 0)
+    if (sum(r.byOrigin, 'linesIntroduced') !== r.linesIntroduced || sum(r.byOrigin, 'linesSurviving') > r.linesSurviving || r.linesSurviving > r.linesIntroduced || r.survivalRate !== roundedRatio(r.linesSurviving, r.linesIntroduced)) return false
+    if (r.durablePct !== (r.linesIntroduced > 0 ? Math.round(r.linesSurviving / r.linesIntroduced * 100) : 0) || Math.abs(r.revertPct - r.revertRate * 100) > 0.55 || r.churnPct !== Math.max(0, 100 - r.durablePct - r.revertPct)) return false
+    if (sum(r.byTool, 'linesIntroduced') !== (r.byOrigin.AI_ATTRIBUTED?.linesIntroduced ?? 0) || sum(r.byTool, 'linesSurviving') > (r.byOrigin.AI_ATTRIBUTED?.linesSurviving ?? 0)) return false
+    if (r.signalToNoise !== (r.churnLinesAffected > 0 ? Math.round(r.linesSurviving / r.churnLinesAffected * 100) / 100 : null)) return false
+    return Buffer.byteLength(JSON.stringify(report)) <= 1024 * 1024
+  } catch { return false }
+}

package/bin/durability/worker.mjs

@@ -0,0 +1,44 @@
+import { realpath } from 'node:fs/promises'
+import { analyzeDurability } from './GitDurabilityEngine.mjs'
+import { ENGINE_COMMIT, validateReport } from './validate.mjs'
+import { runGit, setDeadline, remainingTime, stopGitChildren, GitMeasurementError } from './runtime.mjs'
+
+process.on('SIGTERM', () => { stopGitChildren(); process.exit(2) })
+let completed = false
+process.once('disconnect', () => {
+  if (!completed) { stopGitChildren(); process.exit(2) }
+})
+const send = (message) => { if (process.connected) process.send(message) }
+process.once('message', async ({ root, deadline }) => {
+  try {
+    setDeadline(deadline)
+    if ((await runGit(root, ['rev-parse', '--is-inside-work-tree'])).trim() !== 'true') throw new GitMeasurementError('checkout has no working Git history')
+    const top = (await runGit(root, ['rev-parse', '--show-toplevel'])).trim()
+    if (await realpath(top) !== await realpath(root)) throw new GitMeasurementError('run the check from the repository root to measure Git history')
+    if ((await runGit(root, ['rev-parse', '--is-shallow-repository'])).trim() !== 'false') throw new GitMeasurementError('shallow Git history cannot provide the full 90-day measurement')
+    const partial = await runGit(root, ['config', '--get-regexp', '^(extensions\.partialclone|remote\..*\.promisor)$'], { allowMissingConfig: true })
+    if (partial.split('\n').some(line => /^extensions\.partialclone\s+\S/i.test(line) || /^remote\..*\.promisor\s+(true|yes|on|1)\s*$/i.test(line))) throw new GitMeasurementError('partial Git history cannot be measured without fetching objects')
+    const headSha = (await runGit(root, ['rev-parse', '--verify', 'HEAD'])).trim()
+    if (!/^[0-9a-f]{40}$/.test(headSha)) throw new GitMeasurementError('a valid SHA-1 Git HEAD is required')
+    const objects = await runGit(root, ['rev-list', '--objects', '--no-object-names', '--missing=print', 'HEAD'])
+    if (objects.split('\n').some(line => /^\?[0-9a-f]+$/.test(line))) throw new GitMeasurementError('Git history is missing local objects')
+    const measuredAt = new Date().toISOString()
+    const result = await analyzeDurability(root, {
+      windowDays: 90, settleDays: 14,
+      onLog: message => { remainingTime(); send({ type: 'log', message }) },
+    })
+    remainingTime()
+    if ((await runGit(root, ['rev-parse', '--verify', 'HEAD'])).trim() !== headSha) throw new GitMeasurementError('Git HEAD changed during measurement')
+    const report = { version: 1, source: 'ci', engineCommit: ENGINE_COMMIT, windowDays: 90, settleDays: 14, headSha, measuredAt, result }
+    if (!validateReport(report)) throw new GitMeasurementError('native measurement did not pass report validation')
+    send({ type: 'result', report })
+    completed = true
+    process.disconnect()
+  } catch (error) {
+    send({ type: 'failure', reason: error instanceof GitMeasurementError ? error.reason : 'local Git measurement failed' })
+    stopGitChildren()
+    process.exitCode = 2
+    completed = true
+    if (process.connected) process.disconnect()
+  }
+})

package/bin/durability.mjs

@@ -0,0 +1,65 @@
+import { fork } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import { resolve } from 'node:path'
+import { validateReport } from './durability/validate.mjs'
+import { localGitEnvironment } from './durability/runtime.mjs'
+export { ENGINE_COMMIT } from './durability/validate.mjs'
+export const MAX_MEASUREMENT_MS = 120_000
+
+/** Measure committed local history; never clone, fetch, checkout or upload it. */
+export async function measureDurability({ root, log = () => {} }) {
+  const notify = message => { try { log(message) } catch {} }
+  return new Promise(resolveResult => {
+    let worker
+    let result = null
+    let reason = 'local Git measurement failed'
+    let done = false
+    const started = Date.now()
+    const killOwnedGroup = () => {
+      if (!worker?.pid) return
+      try {
+        if (process.platform !== 'win32') process.kill(-worker.pid, 'SIGKILL')
+        else worker.kill('SIGTERM')
+      } catch {}
+    }
+    const finish = value => {
+      if (done) return
+      done = true
+      clearTimeout(timer)
+      process.removeListener('SIGINT', onInterrupt)
+      process.removeListener('SIGTERM', onTerminate)
+      process.removeListener('exit', killOwnedGroup)
+      if (!value) { killOwnedGroup(); notify(`ScaleQuality: Git durability not measured — ${reason}. No Git history was uploaded.`) }
+      resolveResult(value)
+    }
+    const cancel = signal => {
+      const hasOtherHandler = process.listenerCount(signal) > 1
+      reason = 'measurement was cancelled'
+      finish(null)
+      // Preserve the caller's signal handling, including Node's default exit.
+      if (!hasOtherHandler) process.kill(process.pid, signal)
+    }
+    const onInterrupt = () => cancel('SIGINT')
+    const onTerminate = () => cancel('SIGTERM')
+    const timer = setTimeout(() => { reason = 'the 120-second measurement budget was exceeded'; finish(null) }, MAX_MEASUREMENT_MS)
+    process.on('SIGINT', onInterrupt)
+    process.on('SIGTERM', onTerminate)
+    process.on('exit', killOwnedGroup)
+    try {
+      worker = fork(fileURLToPath(new URL('./durability/worker.mjs', import.meta.url)), [], {
+        stdio: ['ignore', 'ignore', 'ignore', 'ipc'], env: localGitEnvironment(),
+        execArgv: ['--max-old-space-size=512'], detached: process.platform !== 'win32',
+      })
+      worker.on('message', message => {
+        if (message?.type === 'log' && typeof message.message === 'string' && /^(commits in window: \d+|blame capped: \d+\/\d+ files \(perf\)|blaming \d+ files\.\.\.)$/.test(message.message)) notify(`ScaleQuality: durability — ${message.message}`)
+        else if (message?.type === 'result' && validateReport(message.report)) result = message.report
+        else if (message?.type === 'failure') reason = typeof message.reason === 'string' ? message.reason : reason
+      })
+      worker.on('error', () => finish(null))
+      worker.on('exit', code => finish(code === 0 && result && validateReport(result) ? result : null))
+      worker.send({ root: resolve(root), deadline: started + MAX_MEASUREMENT_MS - 1000 })
+    } catch { finish(null) }
+  })
+}
+
+export const ENGINE_SOURCE_DIGEST = "bc7a01ce93df3aad2f80da281934868ba7327a1a04fad840f35ecc8b422c74cf"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalequality/check",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "ScaleQuality continuous code-maturity check for CI. Re-measures your repo on every build and fails the pipeline below your maturity line.",
   "type": "module",
   "bin": {
@@ -26,5 +26,8 @@
   "homepage": "https://scalequality.io",
   "publishConfig": {
     "access": "public"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs"
   }
 }