circle-ir-ai 2.48.0 → 2.55.0

package/dist/trust/reachability.d.ts

@@ -0,0 +1,37 @@
+/**
+ * cognium-ai#234 (L4) — reachability factor.
+ *
+ * `reachability_factor` shipped as a hardcoded `1.0` since the trust score's
+ * inception (T9 vuln-reachability was deferred as "complex call-graph
+ * analysis"); the #234 critical review flagged it as a dead leg. circle-ir now
+ * emits taint flows during `analyze()`, so reachability is cheap to measure:
+ *
+ * A dangerous **sink** that terminates at least one *unsanitized* taint
+ * **flow** from an untrusted source is *confirmed reachable* — a real,
+ * exploitable path, not a dormant pattern. A sink with no flow reaching it is
+ * not confirmed reachable. Two repos with identical sink patterns are not
+ * equally risky: the one where untrusted input actually reaches those sinks is
+ * worse, and the composite should reflect that.
+ *
+ * The factor is a bounded penalty multiplier on the composite:
+ *
+ *   factor = 1 - MAX_PENALTY × (reachable dangerous sinks / all dangerous sinks)
+ *
+ * so a repo where every dangerous sink is reachable-and-unsanitized takes the
+ * full `MAX_PENALTY` haircut, and one where sinks exist but nothing reaches
+ * them stays neutral at 1.0. `measured: false` (⇒ neutral 1.0) when circle-ir
+ * did not run or there are no dangerous sinks — coverage-honest, never a fake
+ * penalty for something we couldn't see.
+ */
+import type { CircleIR } from 'circle-ir';
+import type { ReachabilityDetail } from './types.js';
+/** Max fraction the composite can be reduced by reachability (15% haircut). */
+export declare const REACHABILITY_MAX_PENALTY = 0.15;
+export type { ReachabilityDetail };
+/**
+ * Compute the reachability factor from circle-ir results. Neutral (1.0,
+ * `measured:false`) when `circleIRResults` is absent/empty or no file has a
+ * dangerous sink.
+ */
+export declare function computeReachabilityFactor(circleIRResults?: CircleIR[]): ReachabilityDetail;
+//# sourceMappingURL=reachability.d.ts.map

package/dist/trust/reachability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reachability.d.ts","sourceRoot":"","sources":["../../src/trust/reachability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C,YAAY,EAAE,kBAAkB,EAAE,CAAC;AAoBnC;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,eAAe,CAAC,EAAE,QAAQ,EAAE,GAC3B,kBAAkB,CA8CpB"}

package/dist/trust/reachability.js

@@ -0,0 +1,63 @@
+/** Max fraction the composite can be reduced by reachability (15% haircut). */
+export const REACHABILITY_MAX_PENALTY = 0.15;
+const NEUTRAL = (over = {}) => ({
+    factor: 1.0,
+    measured: false,
+    dangerousSinks: 0,
+    reachableSinks: 0,
+    unsanitizedFlows: 0,
+    reachableRatio: 0,
+    maxPenalty: REACHABILITY_MAX_PENALTY,
+    ...over,
+});
+const sinkKey = (line, type) => `${line ?? -1}:${type ?? ''}`;
+/**
+ * Compute the reachability factor from circle-ir results. Neutral (1.0,
+ * `measured:false`) when `circleIRResults` is absent/empty or no file has a
+ * dangerous sink.
+ */
+export function computeReachabilityFactor(circleIRResults) {
+    if (!circleIRResults || circleIRResults.length === 0)
+        return NEUTRAL();
+    let dangerousSinks = 0;
+    let reachableSinks = 0;
+    let unsanitizedFlows = 0;
+    for (const ir of circleIRResults) {
+        const taint = ir.taint;
+        const sinks = taint?.sinks ?? [];
+        const flows = taint?.flows ?? [];
+        dangerousSinks += sinks.length;
+        // Keys of sinks reached by an unsanitized flow (per-file, so line numbers
+        // don't collide across files). `sanitized !== true` is conservative:
+        // an undefined/absent flag counts as unsanitized.
+        const reachedKeys = new Set();
+        for (const f of flows) {
+            if (f.sanitized === true)
+                continue;
+            unsanitizedFlows++;
+            reachedKeys.add(sinkKey(f.sink_line, f.sink_type));
+        }
+        if (reachedKeys.size === 0)
+            continue;
+        for (const s of sinks) {
+            if (reachedKeys.has(sinkKey(s.line, s.type)))
+                reachableSinks++;
+        }
+    }
+    // No dangerous sinks anywhere → nothing to be reachable → neutral.
+    if (dangerousSinks === 0) {
+        return NEUTRAL({ measured: false, unsanitizedFlows });
+    }
+    const reachableRatio = Math.min(1, reachableSinks / dangerousSinks);
+    const factor = Math.round((1 - REACHABILITY_MAX_PENALTY * reachableRatio) * 1000) / 1000;
+    return {
+        factor,
+        measured: true,
+        dangerousSinks,
+        reachableSinks,
+        unsanitizedFlows,
+        reachableRatio: Math.round(reachableRatio * 1000) / 1000,
+        maxPenalty: REACHABILITY_MAX_PENALTY,
+    };
+}
+//# sourceMappingURL=reachability.js.map

package/dist/trust/reachability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reachability.js","sourceRoot":"","sources":["../../src/trust/reachability.ts"],"names":[],"mappings":"AA4BA,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAQ7C,MAAM,OAAO,GAAG,CAAC,OAAoC,EAAE,EAAsB,EAAE,CAAC,CAAC;IAC/E,MAAM,EAAE,GAAG;IACX,QAAQ,EAAE,KAAK;IACf,cAAc,EAAE,CAAC;IACjB,cAAc,EAAE,CAAC;IACjB,gBAAgB,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;IACjB,UAAU,EAAE,wBAAwB;IACpC,GAAG,IAAI;CACR,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,CAAC,IAAwB,EAAE,IAAwB,EAAU,EAAE,CAC7E,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;AAEhC;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,eAA4B;IAE5B,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;IAEvE,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IAEzB,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,KAAK,GAAI,EAAkF,CAAC,KAAK,CAAC;QACxG,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;QACjC,cAAc,IAAI,KAAK,CAAC,MAAM,CAAC;QAE/B,0EAA0E;QAC1E,qEAAqE;QACrE,kDAAkD;QAClD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;gBAAE,SAAS;YACnC,gBAAgB,EAAE,CAAC;YACnB,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC;YAAE,SAAS;QAErC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBAAE,cAAc,EAAE,CAAC;QACjE,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,cAAc,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,wBAAwB,GAAG,cAAc,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAEzF,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,IAAI;QACd,cAAc;QACd,cAAc;QACd,gBAAgB;QAChB,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,IAAI;QACxD,UAAU,EAAE,wBAAwB;KACrC,CAAC;AACJ,CAAC"}

package/dist/trust/scoring.d.ts

@@ -5,7 +5,17 @@
  * Each pass maps to a category with a configurable weight, and to one
  * of the 13 TrustScoreResult component fields.
  */
+import type { CircleIR } from 'circle-ir';
 import { type TrustPassResult, type TrustScoreResult } from './types.js';
+/**
+ * cognium-ai#234 (L4) — optional analysis context for the scoring engine.
+ * Carries circle-ir results so the reachability factor can be measured. Absent
+ * ⇒ neutral factor 1.0 (byte-identical to pre-L4 scoring for every caller that
+ * doesn't pass it).
+ */
+export interface TrustScoringContext {
+    circleIRResults?: CircleIR[];
+}
 export type TrustCategory = 'supply_chain' | 'code_security' | 'ai_safety' | 'compliance' | 'artifacts';
 export interface TrustScoringConfig {
     weights: Record<TrustCategory, number>;
@@ -40,6 +50,6 @@ export declare function validateScoringConfig(config: TrustScoringConfig): void;
  * 4. Populate 13 component scores via {@link PASS_COMPONENT_MAP}.
  * 5. Derive tier via {@link getTierForScore}; check for critical findings.
  */
-export declare function computeTrustScore(passResults: TrustPassResult[], config?: TrustScoringConfig): TrustScoreResult;
+export declare function computeTrustScore(passResults: TrustPassResult[], config?: TrustScoringConfig, context?: TrustScoringContext): TrustScoreResult;
 export {};
 //# sourceMappingURL=scoring.d.ts.map

package/dist/trust/scoring.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAItB,MAAM,YAAY,CAAC;AAMpB,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,eAAe,GACf,WAAW,GACX,YAAY,GACZ,WAAW,CAAC;AAMhB,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,sBAAsB,EAAE,kBAQpC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAE7D,CAAC;AAUF,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CA0D3D,CAAC;AAMF,iEAAiE;AACjE,KAAK,cAAc,GACf,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,eAAe,GACf,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,CAAC;AAExB,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAmC7D,CAAC;AAMF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAUtE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,eAAe,EAAE,EAC9B,MAAM,GAAE,kBAA2C,GAClD,gBAAgB,CAwIlB"}
+{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAKtB,MAAM,YAAY,CAAC;AAGpB;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC9B;AAMD,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,eAAe,GACf,WAAW,GACX,YAAY,GACZ,WAAW,CAAC;AAMhB,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,sBAAsB,EAAE,kBAQpC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAE7D,CAAC;AAUF,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CA0E3D,CAAC;AAMF,iEAAiE;AACjE,KAAK,cAAc,GACf,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,eAAe,GACf,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,CAAC;AAExB,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAsC7D,CAAC;AAMF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAUtE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,eAAe,EAAE,EAC9B,MAAM,GAAE,kBAA2C,EACnD,OAAO,GAAE,mBAAwB,GAChC,gBAAgB,CAgMlB"}

package/dist/trust/scoring.js

@@ -6,6 +6,7 @@
  * of the 13 TrustScoreResult component fields.
  */
 import { getTierForScore, } from './types.js';
+import { computeReachabilityFactor } from './reachability.js';
 export const DEFAULT_SCORING_CONFIG = {
     weights: {
         supply_chain: 0.3,
@@ -40,6 +41,9 @@ export const PASS_CATEGORY_MAP = {
     'typosquat-detection': 'supply_chain',
     'dependency-staleness': 'supply_chain',
     'dependency-audit': 'supply_chain',
+    // cognium-ai#234 (L2) — ecosystem-agnostic CVE audit (Maven/PyPI/Go/Cargo)
+    // via OSV.dev; makes supply_chain a real signal on non-npm repos.
+    'osv-dependency-audit': 'supply_chain',
     // code_security
     'data-exfiltration': 'code_security',
     'input-validation': 'code_security',
@@ -50,13 +54,25 @@ export const PASS_CATEGORY_MAP = {
     // skipped it entirely and the aggregate ignored LLM-discovered vulns.
     // Mapped to code_security + weighted (see PASS_INTRA_CATEGORY_WEIGHT).
     'llm-security-scan': 'code_security',
-    // ai_safety
+    // cognium-ai#234 (L3) — cryptographic-weakness pass (weak hash/cipher/PRNG/
+    // key), consuming circle-ir's crypto SAST findings.
+    'crypto-weakness': 'code_security',
+    // ai_safety — AI-agent/skill THREAT passes (all AI-surface-gated, so on a
+    // non-AI repo they're all applicable:false and L1 drops the category +
+    // re-normalizes its 20% away — cognium-ai#234 L6).
     'prompt-injection': 'ai_safety',
     'excessive-permissions': 'ai_safety',
     'agent-inventory': 'ai_safety',
     'eu-ai-act-flags': 'ai_safety',
     'tool-poisoning': 'ai_safety',
-    'ai-generated-fingerprint': 'ai_safety',
+    // cognium-ai#234 (L6) — ai-generated-fingerprint measures code *provenance*
+    // (was this AI-written), not an AI-safety threat. It runs on any source and
+    // is legitimately clean-100 on human-written code, so leaving it in ai_safety
+    // kept that 20% category permanently "validated" on non-AI repos — exactly
+    // the constant the #234 review flagged. Moved to artifacts (informational,
+    // weight 0): still reported (provenance_score + findings), no longer anchors
+    // a security category. It CANNOT be gated on findings — "no AI patterns" is a
+    // real clean result, not "couldn't look".
     // compliance
     'license-compliance': 'compliance',
     'malicious-install': 'compliance',
@@ -79,16 +95,18 @@ export const PASS_CATEGORY_MAP = {
     'naming-convention': 'code_security',
     // code_security (Sprint 10 — Semantic Understanding)
     'spec-gap-report': 'code_security',
-    // artifacts
+    // artifacts (informational, weight 0)
     'sbom-generation': 'artifacts',
     'vex-generation': 'artifacts',
     'audit-trail': 'artifacts',
+    'ai-generated-fingerprint': 'artifacts', // #234 L6 — provenance, not a threat
 };
 export const PASS_COMPONENT_MAP = {
     'input-validation': 'vulnerability_score',
     'typosquat-detection': 'supply_chain_score',
     'dependency-staleness': 'supply_chain_score',
     'dependency-audit': 'supply_chain_score',
+    'osv-dependency-audit': 'supply_chain_score',
     'data-exfiltration': 'exfiltration_score',
     'prompt-injection': 'instruction_score',
     'excessive-permissions': 'permission_score',
@@ -118,7 +136,9 @@ export const PASS_COMPONENT_MAP = {
     'god-class': 'hygiene_score',
     'naming-convention': 'hygiene_score',
     'spec-gap-report': 'hygiene_score',
-    // crypto_score has no pass yet — defaults to 100
+    // cognium-ai#234 (L3) — crypto_score is now fed by the crypto-weakness pass
+    // (was a permanent 100 with no pass mapped here).
+    'crypto-weakness': 'crypto_score',
 };
 // ---------------------------------------------------------------------------
 // Validation
@@ -147,19 +167,31 @@ export function validateScoringConfig(config) {
  * 4. Populate 13 component scores via {@link PASS_COMPONENT_MAP}.
  * 5. Derive tier via {@link getTierForScore}; check for critical findings.
  */
-export function computeTrustScore(passResults, config = DEFAULT_SCORING_CONFIG) {
+export function computeTrustScore(passResults, config = DEFAULT_SCORING_CONFIG, context = {}) {
     validateScoringConfig(config);
-    // -- Step 1 & 2: Category averages ----------------------------------------
+    // -- Step 1 & 2: Category averages (cognium-ai#234 L1 — coverage-aware) ----
     // cognium-ai#119 — weighted accumulation per category (weight from
-    // PASS_INTRA_CATEGORY_WEIGHT, default 1). With all weights 1 this is
-    // byte-identical to the previous simple average.
+    // PASS_INTRA_CATEGORY_WEIGHT, default 1).
+    // cognium-ai#234 (L1) — a pass with `applicable === false` couldn't look
+    // (wrong ecosystem, no relevant files), so its 100 is NOT evidence of
+    // cleanliness — exclude it from its category average, and remember it as
+    // inapplicable for the coverage report.
     const categoryScores = new Map();
+    const inapplicableByCategory = new Map();
     for (const pr of passResults) {
         const category = PASS_CATEGORY_MAP[pr.pass];
         if (category === undefined) {
             // Unknown pass — skip silently so future passes don't break scoring
             continue;
         }
+        if (pr.applicable === false) {
+            const list = inapplicableByCategory.get(category);
+            if (list)
+                list.push(pr.pass);
+            else
+                inapplicableByCategory.set(category, [pr.pass]);
+            continue;
+        }
         const w = passWeight(pr.pass);
         const bucket = categoryScores.get(category);
         if (bucket) {
@@ -170,32 +202,71 @@ export function computeTrustScore(passResults, config = DEFAULT_SCORING_CONFIG)
             categoryScores.set(category, { weightedSum: pr.score * w, weightSum: w });
         }
     }
+    // A category is VALIDATED only if ≥1 applicable pass contributed.
     const categoryAverages = new Map();
     for (const [cat, { weightedSum, weightSum }] of categoryScores) {
-        categoryAverages.set(cat, weightSum > 0 ? weightedSum / weightSum : 100);
+        if (weightSum > 0)
+            categoryAverages.set(cat, weightedSum / weightSum);
     }
-    // -- Step 3: Weighted composite score -------------------------------------
-    let compositeScore = 0;
-    const categories = [
+    // -- Step 3: Coverage-aware weighted composite ----------------------------
+    //
+    // cognium-ai#234 (L1) — the composite is the weighted mean of ONLY the
+    // validated categories, with weights RE-NORMALIZED across them. An
+    // unvalidated category is excluded rather than treated as a clean 100, so a
+    // score can no longer be inflated by legs that never looked (npm-only
+    // dependency audit on a Maven repo, AI-safety on a non-agent repo, …). The
+    // `coverageWeight` (sum of validated default weights) tells consumers how
+    // much of the score rests on real signal.
+    const scoredCategories = [
         'supply_chain',
         'code_security',
         'ai_safety',
         'compliance',
-        'artifacts',
-    ];
-    for (const cat of categories) {
+    ]; // artifacts is weight 0 / informational — never in the composite
+    let weightedSum = 0;
+    let validatedWeight = 0;
+    for (const cat of scoredCategories) {
         const weight = config.weights[cat];
         if (weight === 0)
             continue;
-        // If no passes ran for this category, treat it as 100 (clean)
-        const avg = categoryAverages.get(cat) ?? 100;
-        compositeScore += avg * weight;
+        const avg = categoryAverages.get(cat);
+        if (avg === undefined)
+            continue; // unvalidated — excluded + re-normalized
+        weightedSum += avg * weight;
+        validatedWeight += weight;
     }
-    // Clamp to 0-100
+    // Re-normalize over validated weight. If NOTHING validated (pathological —
+    // no pass applied at all), fall back to 100 but flag coverageWeight 0.
+    let compositeScore = validatedWeight > 0 ? weightedSum / validatedWeight : 100;
     compositeScore = Math.max(0, Math.min(100, Math.round(compositeScore * 100) / 100));
+    // cognium-ai#234 (L4) — apply the reachability factor. A dangerous sink that
+    // an unsanitized taint flow actually reaches is a confirmed exploitable path;
+    // the composite is discounted in proportion to how much of the sink surface
+    // is reachable. Neutral 1.0 (no change) when circle-ir didn't run or there
+    // are no dangerous sinks — so every caller that omits `context` is
+    // byte-identical to pre-L4 scoring.
+    const reachability = computeReachabilityFactor(context.circleIRResults);
+    compositeScore = Math.max(0, Math.min(100, Math.round(compositeScore * reachability.factor * 100) / 100));
+    // Coverage report (additive output).
+    const categoryCoverage = scoredCategories.map((cat) => {
+        const avg = categoryAverages.get(cat);
+        return {
+            category: cat,
+            validated: avg !== undefined,
+            score: avg !== undefined ? Math.round(avg * 100) / 100 : null,
+            inapplicablePasses: inapplicableByCategory.get(cat) ?? [],
+            weight: config.weights[cat],
+        };
+    });
+    const coverageWeight = Math.round(validatedWeight * 1000) / 1000;
     // -- Step 4: Component scores ---------------------------------------------
     const componentBuckets = new Map();
     for (const pr of passResults) {
+        // cognium-ai#234 (L1) — an inapplicable pass never looked; excluding it
+        // here keeps the display component honest too (a bucket shared by an
+        // applicable low score and an inapplicable 100 must not be inflated).
+        if (pr.applicable === false)
+            continue;
         const component = PASS_COMPONENT_MAP[pr.pass];
         if (component === undefined)
             continue;
@@ -210,7 +281,7 @@ export function computeTrustScore(passResults, config = DEFAULT_SCORING_CONFIG)
     const componentAvg = (key) => {
         const scores = componentBuckets.get(key);
         if (!scores || scores.length === 0)
-            return 100; // default clean
+            return 100; // default clean / unvalidated
         return scores.reduce((s, v) => s + v, 0) / scores.length;
     };
     // -- Step 5: Critical findings → BLOCKED ----------------------------------
@@ -246,6 +317,9 @@ export function computeTrustScore(passResults, config = DEFAULT_SCORING_CONFIG)
         tierReason,
         baseTier,
         blockingFindings,
+        // cognium-ai#234 (L1) — coverage transparency
+        categoryCoverage,
+        coverageWeight,
         // 12 component scores
         vulnerability_score: componentAvg('vulnerability_score'),
         supply_chain_score: componentAvg('supply_chain_score'),
@@ -253,17 +327,19 @@ export function computeTrustScore(passResults, config = DEFAULT_SCORING_CONFIG)
         instruction_score: componentAvg('instruction_score'),
         permission_score: componentAvg('permission_score'),
         secrets_score: componentAvg('secrets_score'),
-        crypto_score: componentAvg('crypto_score'), // no pass yet → 100
+        crypto_score: componentAvg('crypto_score'), // #234 L3 → crypto-weakness pass
         license_score: componentAvg('license_score'),
         compliance_score: componentAvg('compliance_score'),
         hygiene_score: componentAvg('hygiene_score'),
         poisoning_score: componentAvg('poisoning_score'),
         provenance_score: componentAvg('provenance_score'),
         performance_score: componentAvg('performance_score'),
-        // 3 multiplicative factors — neutral for now
-        reachability_factor: 1.0,
+        // 3 multiplicative factors. reachability is LIVE (#234 L4); drift +
+        // freshness remain neutral pending L-series follow-ups.
+        reachability_factor: reachability.factor,
         drift_factor: 1.0,
         freshness_factor: 1.0,
+        reachabilityDetail: reachability,
         passResults,
         timestamp: new Date().toISOString(),
     };

package/dist/trust/scoring.js.map

@@ -1 +1 @@
-{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAKL,eAAe,GAChB,MAAM,YAAY,CAAC;AAqBpB,MAAM,CAAC,MAAM,sBAAsB,GAAuB;IACxD,OAAO,EAAE;QACP,YAAY,EAAE,GAAG;QACjB,aAAa,EAAE,GAAG;QAClB,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,GAAG;KACf;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B;IAChE,mBAAmB,EAAE,EAAE;CACxB,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAkC;IAC9D,eAAe;IACf,mBAAmB,EAAE,cAAc;IACnC,qBAAqB,EAAE,cAAc;IACrC,sBAAsB,EAAE,cAAc;IACtC,kBAAkB,EAAE,cAAc;IAElC,gBAAgB;IAChB,mBAAmB,EAAE,eAAe;IACpC,kBAAkB,EAAE,eAAe;IACnC,iBAAiB,EAAE,eAAe;IAClC,gEAAgE;IAChE,kEAAkE;IAClE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,mBAAmB,EAAE,eAAe;IAEpC,YAAY;IACZ,kBAAkB,EAAE,WAAW;IAC/B,uBAAuB,EAAE,WAAW;IACpC,iBAAiB,EAAE,WAAW;IAC9B,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,0BAA0B,EAAE,WAAW;IAEvC,aAAa;IACb,oBAAoB,EAAE,YAAY;IAClC,mBAAmB,EAAE,YAAY;IAEjC,yCAAyC;IACzC,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAEhC,qCAAqC;IACrC,sBAAsB,EAAE,eAAe;IACvC,sBAAsB,EAAE,eAAe;IACvC,gBAAgB,EAAE,eAAe;IACjC,oBAAoB,EAAE,eAAe;IAErC,kEAAkE;IAClE,mBAAmB,EAAE,eAAe;IACpC,cAAc,EAAE,eAAe;IAE/B,gEAAgE;IAChE,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IAEpC,qDAAqD;IACrD,iBAAiB,EAAE,eAAe;IAElC,YAAY;IACZ,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,aAAa,EAAE,WAAW;CAC3B,CAAC;AAsBF,MAAM,CAAC,MAAM,kBAAkB,GAAmC;IAChE,kBAAkB,EAAE,qBAAqB;IACzC,qBAAqB,EAAE,oBAAoB;IAC3C,sBAAsB,EAAE,oBAAoB;IAC5C,kBAAkB,EAAE,oBAAoB;IACxC,mBAAmB,EAAE,oBAAoB;IACzC,kBAAkB,EAAE,mBAAmB;IACvC,uBAAuB,EAAE,kBAAkB;IAC3C,iBAAiB,EAAE,kBAAkB;IACrC,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,oBAAoB,EAAE,eAAe;IACrC,mBAAmB,EAAE,kBAAkB;IACvC,iBAAiB,EAAE,kBAAkB;IACrC,gBAAgB,EAAE,iBAAiB;IACnC,0BAA0B,EAAE,kBAAkB;IAC9C,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAChC,sBAAsB,EAAE,mBAAmB;IAC3C,sBAAsB,EAAE,mBAAmB;IAC3C,gBAAgB,EAAE,mBAAmB;IACrC,oBAAoB,EAAE,mBAAmB;IACzC,mBAAmB,EAAE,qBAAqB;IAC1C,0EAA0E;IAC1E,gEAAgE;IAChE,4DAA4D;IAC5D,mBAAmB,EAAE,qBAAqB;IAC1C,cAAc,EAAE,eAAe;IAC/B,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,iDAAiD;CAClD,CAAC;AAEF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAElC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAA8B,EAC9B,SAA6B,sBAAsB;IAEnD,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAE9B,4EAA4E;IAE5E,mEAAmE;IACnE,qEAAqE;IACrE,iDAAiD;IACjD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA6D,CAAC;IAE5F,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,oEAAoE;YACpE,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;YACnC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/D,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3E,CAAC;IAED,4EAA4E;IAE5E,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,UAAU,GAAoB;QAClC,cAAc;QACd,eAAe;QACf,WAAW;QACX,YAAY;QACZ,WAAW;KACZ,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,CAAC;YAAE,SAAS;QAC3B,8DAA8D;QAC9D,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;QAC7C,cAAc,IAAI,GAAG,GAAG,MAAM,CAAC;IACjC,CAAC;IAED,iBAAiB;IACjB,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEpF,4EAA4E;IAE5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE7D,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAmB,EAAU,EAAE;QACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,gBAAgB;QAChE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,CAAC,CAAC;IAEF,4EAA4E;IAE5E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAC/C,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;oBACtB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;oBACtB,OAAO,EAAE,CAAC,CAAC,OAAO;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhD,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACxD,uEAAuE;IACvE,MAAM,IAAI,GAAG,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAe,WAAW;QACxC,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,OAAO,CAAC;IAEZ,4EAA4E;IAE5E,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,IAAI;QAEJ,qCAAqC;QACrC,UAAU;QACV,QAAQ;QACR,gBAAgB;QAEhB,sBAAsB;QACtB,mBAAmB,EAAE,YAAY,CAAC,qBAAqB,CAAC;QACxD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QACpD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,YAAY,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,oBAAoB;QAChE,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,eAAe,EAAE,YAAY,CAAC,iBAAiB,CAAC;QAChD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QAEpD,6CAA6C;QAC7C,mBAAmB,EAAE,GAAG;QACxB,YAAY,EAAE,GAAG;QACjB,gBAAgB,EAAE,GAAG;QAErB,WAAW;QACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAML,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AA+B9D,MAAM,CAAC,MAAM,sBAAsB,GAAuB;IACxD,OAAO,EAAE;QACP,YAAY,EAAE,GAAG;QACjB,aAAa,EAAE,GAAG;QAClB,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,GAAG;KACf;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B;IAChE,mBAAmB,EAAE,EAAE;CACxB,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAkC;IAC9D,eAAe;IACf,mBAAmB,EAAE,cAAc;IACnC,qBAAqB,EAAE,cAAc;IACrC,sBAAsB,EAAE,cAAc;IACtC,kBAAkB,EAAE,cAAc;IAClC,2EAA2E;IAC3E,kEAAkE;IAClE,sBAAsB,EAAE,cAAc;IAEtC,gBAAgB;IAChB,mBAAmB,EAAE,eAAe;IACpC,kBAAkB,EAAE,eAAe;IACnC,iBAAiB,EAAE,eAAe;IAClC,gEAAgE;IAChE,kEAAkE;IAClE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,mBAAmB,EAAE,eAAe;IACpC,4EAA4E;IAC5E,oDAAoD;IACpD,iBAAiB,EAAE,eAAe;IAElC,0EAA0E;IAC1E,uEAAuE;IACvE,mDAAmD;IACnD,kBAAkB,EAAE,WAAW;IAC/B,uBAAuB,EAAE,WAAW;IACpC,iBAAiB,EAAE,WAAW;IAC9B,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,0CAA0C;IAE1C,aAAa;IACb,oBAAoB,EAAE,YAAY;IAClC,mBAAmB,EAAE,YAAY;IAEjC,yCAAyC;IACzC,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAEhC,qCAAqC;IACrC,sBAAsB,EAAE,eAAe;IACvC,sBAAsB,EAAE,eAAe;IACvC,gBAAgB,EAAE,eAAe;IACjC,oBAAoB,EAAE,eAAe;IAErC,kEAAkE;IAClE,mBAAmB,EAAE,eAAe;IACpC,cAAc,EAAE,eAAe;IAE/B,gEAAgE;IAChE,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IAEpC,qDAAqD;IACrD,iBAAiB,EAAE,eAAe;IAElC,sCAAsC;IACtC,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,aAAa,EAAE,WAAW;IAC1B,0BAA0B,EAAE,WAAW,EAAE,qCAAqC;CAC/E,CAAC;AAsBF,MAAM,CAAC,MAAM,kBAAkB,GAAmC;IAChE,kBAAkB,EAAE,qBAAqB;IACzC,qBAAqB,EAAE,oBAAoB;IAC3C,sBAAsB,EAAE,oBAAoB;IAC5C,kBAAkB,EAAE,oBAAoB;IACxC,sBAAsB,EAAE,oBAAoB;IAC5C,mBAAmB,EAAE,oBAAoB;IACzC,kBAAkB,EAAE,mBAAmB;IACvC,uBAAuB,EAAE,kBAAkB;IAC3C,iBAAiB,EAAE,kBAAkB;IACrC,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,oBAAoB,EAAE,eAAe;IACrC,mBAAmB,EAAE,kBAAkB;IACvC,iBAAiB,EAAE,kBAAkB;IACrC,gBAAgB,EAAE,iBAAiB;IACnC,0BAA0B,EAAE,kBAAkB;IAC9C,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAChC,sBAAsB,EAAE,mBAAmB;IAC3C,sBAAsB,EAAE,mBAAmB;IAC3C,gBAAgB,EAAE,mBAAmB;IACrC,oBAAoB,EAAE,mBAAmB;IACzC,mBAAmB,EAAE,qBAAqB;IAC1C,0EAA0E;IAC1E,gEAAgE;IAChE,4DAA4D;IAC5D,mBAAmB,EAAE,qBAAqB;IAC1C,cAAc,EAAE,eAAe;IAC/B,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,4EAA4E;IAC5E,kDAAkD;IAClD,iBAAiB,EAAE,cAAc;CAClC,CAAC;AAEF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAElC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAA8B,EAC9B,SAA6B,sBAAsB,EACnD,UAA+B,EAAE;IAEjC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAE9B,6EAA6E;IAE7E,mEAAmE;IACnE,0CAA0C;IAC1C,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA6D,CAAC;IAC5F,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAElE,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,oEAAoE;YACpE,SAAS;QACX,CAAC;QACD,IAAI,EAAE,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;;gBACxB,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;YACnC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/D,IAAI,SAAS,GAAG,CAAC;YAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,4EAA4E;IAC5E,EAAE;IACF,uEAAuE;IACvE,mEAAmE;IACnE,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,0CAA0C;IAE1C,MAAM,gBAAgB,GAAoB;QACxC,cAAc;QACd,eAAe;QACf,WAAW;QACX,YAAY;KACb,CAAC,CAAC,iEAAiE;IAEpE,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,CAAC;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS,CAAC,yCAAyC;QAC1E,WAAW,IAAI,GAAG,GAAG,MAAM,CAAC;QAC5B,eAAe,IAAI,MAAM,CAAC;IAC5B,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,cAAc,GAChB,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5D,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEpF,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,mEAAmE;IACnE,oCAAoC;IACpC,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACxE,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EACvC,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,YAAY,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEjE,qCAAqC;IACrC,MAAM,gBAAgB,GAAuB,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACxE,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,GAAG,KAAK,SAAS;YAC5B,KAAK,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI;YAC7D,kBAAkB,EAAE,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;YACzD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAEjE,4EAA4E;IAE5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE7D,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,IAAI,EAAE,CAAC,UAAU,KAAK,KAAK;YAAE,SAAS;QACtC,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAmB,EAAU,EAAE;QACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,8BAA8B;QAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,CAAC,CAAC;IAEF,4EAA4E;IAE5E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAC/C,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;oBACtB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;oBACtB,OAAO,EAAE,CAAC,CAAC,OAAO;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhD,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACxD,uEAAuE;IACvE,MAAM,IAAI,GAAG,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAe,WAAW;QACxC,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,OAAO,CAAC;IAEZ,4EAA4E;IAE5E,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,IAAI;QAEJ,qCAAqC;QACrC,UAAU;QACV,QAAQ;QACR,gBAAgB;QAEhB,8CAA8C;QAC9C,gBAAgB;QAChB,cAAc;QAEd,sBAAsB;QACtB,mBAAmB,EAAE,YAAY,CAAC,qBAAqB,CAAC;QACxD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QACpD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,YAAY,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,iCAAiC;QAC7E,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,eAAe,EAAE,YAAY,CAAC,iBAAiB,CAAC;QAChD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QAEpD,oEAAoE;QACpE,wDAAwD;QACxD,mBAAmB,EAAE,YAAY,CAAC,MAAM;QACxC,YAAY,EAAE,GAAG;QACjB,gBAAgB,EAAE,GAAG;QACrB,kBAAkB,EAAE,YAAY;QAEhC,WAAW;QACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC"}

package/dist/trust/security-score.d.ts

@@ -0,0 +1,48 @@
+/**
+ * cognium-ai#234 (L5) — de-saturate code_security.
+ *
+ * The synthetic `llm-security-scan` pass (weight 10 in code_security) scored
+ * findings with a linear penalty clamped to [0,100]:
+ *
+ *   score = 100 - (crit×25 + high×10 + med×3 + low×1)
+ *
+ * That pins to 0 the moment the load crosses 100 — i.e. ~4 criticals. On a
+ * large repo (the #234 review saw 28,300 raw findings) 3 vulns and 3,000 both
+ * score ≈0: the pass carries a heavy weight but conveys no signal beyond
+ * "something fired". It saturates instead of discriminating.
+ *
+ * This replaces the linear clamp with a **rational (reciprocal) decay** on the
+ * same severity-weighted load:
+ *
+ *   score = 100 × SCALE / (SCALE + load)
+ *
+ * Properties: 100 at load 0; 50 at load = SCALE; monotonic decreasing;
+ * asymptotic to 0 but never pinned there, so it keeps ranking across the whole
+ * range (3 findings ≠ 3,000). The severity weights are unchanged, so the
+ * ordering of "which repo is worse" is preserved — only the saturation is
+ * removed. Numeric leniency at moderate counts is intentional and safe: the
+ * BLOCKED tier override still fires on ANY critical finding regardless of this
+ * number, so a repo with real criticals cannot pass on score alone.
+ */
+/** Severity → penalty weight (unchanged from the legacy linear formula). */
+export declare const SECURITY_SEVERITY_PENALTY: Record<'critical' | 'high' | 'medium' | 'low', number>;
+/**
+ * Half-life load: the severity-weighted load at which the score is 50.
+ * 90 ≈ 3–4 criticals, ~9 highs, or ~30 mediums. Tunable.
+ */
+export declare const SECURITY_SCORE_SCALE = 90;
+export interface SecurityFindingCounts {
+    critical?: number;
+    high?: number;
+    medium?: number;
+    low?: number;
+}
+/** Severity-weighted load (higher = worse). */
+export declare function securityLoad(counts: SecurityFindingCounts): number;
+/**
+ * Discriminating 0–100 security score via rational decay. Never pins to 0, so
+ * a handful of findings and thousands remain distinguishable. `scale` is the
+ * load at which the score is 50 (defaults to {@link SECURITY_SCORE_SCALE}).
+ */
+export declare function discriminatingSecurityScore(counts: SecurityFindingCounts, scale?: number): number;
+//# sourceMappingURL=security-score.d.ts.map

package/dist/trust/security-score.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-score.d.ts","sourceRoot":"","sources":["../../src/trust/security-score.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,EAAE,MAAM,CAK5F,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CAOlE;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,qBAAqB,EAC7B,KAAK,GAAE,MAA6B,GACnC,MAAM,CAOR"}

package/dist/trust/security-score.js

@@ -0,0 +1,60 @@
+/**
+ * cognium-ai#234 (L5) — de-saturate code_security.
+ *
+ * The synthetic `llm-security-scan` pass (weight 10 in code_security) scored
+ * findings with a linear penalty clamped to [0,100]:
+ *
+ *   score = 100 - (crit×25 + high×10 + med×3 + low×1)
+ *
+ * That pins to 0 the moment the load crosses 100 — i.e. ~4 criticals. On a
+ * large repo (the #234 review saw 28,300 raw findings) 3 vulns and 3,000 both
+ * score ≈0: the pass carries a heavy weight but conveys no signal beyond
+ * "something fired". It saturates instead of discriminating.
+ *
+ * This replaces the linear clamp with a **rational (reciprocal) decay** on the
+ * same severity-weighted load:
+ *
+ *   score = 100 × SCALE / (SCALE + load)
+ *
+ * Properties: 100 at load 0; 50 at load = SCALE; monotonic decreasing;
+ * asymptotic to 0 but never pinned there, so it keeps ranking across the whole
+ * range (3 findings ≠ 3,000). The severity weights are unchanged, so the
+ * ordering of "which repo is worse" is preserved — only the saturation is
+ * removed. Numeric leniency at moderate counts is intentional and safe: the
+ * BLOCKED tier override still fires on ANY critical finding regardless of this
+ * number, so a repo with real criticals cannot pass on score alone.
+ */
+/** Severity → penalty weight (unchanged from the legacy linear formula). */
+export const SECURITY_SEVERITY_PENALTY = {
+    critical: 25,
+    high: 10,
+    medium: 3,
+    low: 1,
+};
+/**
+ * Half-life load: the severity-weighted load at which the score is 50.
+ * 90 ≈ 3–4 criticals, ~9 highs, or ~30 mediums. Tunable.
+ */
+export const SECURITY_SCORE_SCALE = 90;
+/** Severity-weighted load (higher = worse). */
+export function securityLoad(counts) {
+    return ((counts.critical ?? 0) * SECURITY_SEVERITY_PENALTY.critical +
+        (counts.high ?? 0) * SECURITY_SEVERITY_PENALTY.high +
+        (counts.medium ?? 0) * SECURITY_SEVERITY_PENALTY.medium +
+        (counts.low ?? 0) * SECURITY_SEVERITY_PENALTY.low);
+}
+/**
+ * Discriminating 0–100 security score via rational decay. Never pins to 0, so
+ * a handful of findings and thousands remain distinguishable. `scale` is the
+ * load at which the score is 50 (defaults to {@link SECURITY_SCORE_SCALE}).
+ */
+export function discriminatingSecurityScore(counts, scale = SECURITY_SCORE_SCALE) {
+    const load = securityLoad(counts);
+    if (load <= 0)
+        return 100;
+    const s = scale > 0 ? scale : SECURITY_SCORE_SCALE;
+    const raw = (100 * s) / (s + load);
+    // 2 decimals so the high end still ranks (0.12 vs 0.06) instead of both → 0.
+    return Math.round(raw * 100) / 100;
+}
+//# sourceMappingURL=security-score.js.map

package/dist/trust/security-score.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-score.js","sourceRoot":"","sources":["../../src/trust/security-score.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,yBAAyB,GAA2D;IAC/F,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,EAAE;IACR,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;CACP,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AASvC,+CAA+C;AAC/C,MAAM,UAAU,YAAY,CAAC,MAA6B;IACxD,OAAO,CACL,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,yBAAyB,CAAC,QAAQ;QAC3D,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,yBAAyB,CAAC,IAAI;QACnD,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,yBAAyB,CAAC,MAAM;QACvD,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,yBAAyB,CAAC,GAAG,CAClD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAA6B,EAC7B,QAAgB,oBAAoB;IAEpC,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1B,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACnD,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACnC,6EAA6E;IAC7E,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;AACrC,CAAC"}

package/dist/trust/types.d.ts

@@ -59,6 +59,50 @@ export interface TrustPassResult {
     durationMs: number;
     /** Optional generated artifacts (SBOM, VEX, audit log) */
     artifacts?: Record<string, unknown>;
+    /**
+     * cognium-ai#234 (L1) — did this pass have anything to analyze?
+     *
+     * `true` (default) — the pass ran against applicable input and its `score`
+     * is a real signal (clean or not).
+     * `false` — the pass could NOT apply: no relevant files, wrong ecosystem,
+     * or a hard skip (e.g. `dependency-audit` with no `package-lock.json`,
+     * an AI-safety pass on a repo with no agent manifests). Its `score` of 100
+     * is *not* evidence of cleanliness and must be excluded from scoring so a
+     * category isn't inflated to 100 by passes that never looked.
+     *
+     * Absent ⇒ treated as `true` (byte-identical to pre-L1 scoring).
+     */
+    applicable?: boolean;
+}
+/** cognium-ai#234 (L4) — reachability breakdown behind `reachability_factor`. */
+export interface ReachabilityDetail {
+    /** The multiplier applied to the composite (0.85–1.0). */
+    factor: number;
+    /** True only when circle-ir ran AND there was ≥1 dangerous sink to assess. */
+    measured: boolean;
+    /** Total dangerous taint sinks across all analyzed files. */
+    dangerousSinks: number;
+    /** Sinks that terminate ≥1 unsanitized flow (confirmed reachable). */
+    reachableSinks: number;
+    /** Count of unsanitized source→sink flows. */
+    unsanitizedFlows: number;
+    /** reachableSinks / dangerousSinks, clamped to [0,1]. */
+    reachableRatio: number;
+    /** MAX_PENALTY in effect (for transparency / reproducibility). */
+    maxPenalty: number;
+}
+/** cognium-ai#234 (L1) — per-category coverage in the composite. */
+export interface CategoryCoverage {
+    /** Category name (supply_chain | code_security | ai_safety | compliance). */
+    category: string;
+    /** True if ≥1 applicable pass contributed a real signal. */
+    validated: boolean;
+    /** Category score (0-100) when validated; null when unvalidated. */
+    score: number | null;
+    /** Passes that ran but couldn't apply (excluded), for transparency. */
+    inapplicablePasses: string[];
+    /** Default weight of this category (before re-normalization). */
+    weight: number;
 }
 export interface TrustScoreResult {
     /** Weighted composite score 0-100 */
@@ -71,6 +115,17 @@ export interface TrustScoreResult {
     baseTier?: TrustTier;
     /** Critical findings that forced BLOCKED; empty when tierReason==='score'. */
     blockingFindings?: BlockingFinding[];
+    /**
+     * Per-category coverage: which categories actually had an applicable pass
+     * vs. were `unvalidated` (no pass could look — excluded from the composite
+     * and its weight re-normalized across validated categories). Lets consumers
+     * see "supply_chain: unvalidated" instead of a fake 100, and understand
+     * which fraction of the score is real signal.
+     */
+    categoryCoverage?: CategoryCoverage[];
+    /** Sum of the DEFAULT weights of categories that were validated (0..1).
+     *  A low value means most of the score rests on few real legs. */
+    coverageWeight?: number;
     vulnerability_score: number;
     supply_chain_score: number;
     exfiltration_score: number;
@@ -84,9 +139,21 @@ export interface TrustScoreResult {
     poisoning_score: number;
     provenance_score: number;
     performance_score: number;
+    /**
+     * cognium-ai#234 (L4) — LIVE. A bounded penalty multiplier applied to the
+     * composite: `1 - MAX_PENALTY × (reachable dangerous sinks / all dangerous
+     * sinks)`, from circle-ir's taint flows. 1.0 = neutral (no dangerous sinks,
+     * nothing reachable, or circle-ir did not run). See {@link reachabilityDetail}.
+     */
     reachability_factor: number;
     drift_factor: number;
     freshness_factor: number;
+    /**
+     * cognium-ai#234 (L4) — reachability breakdown behind `reachability_factor`
+     * (additive/optional). `measured: false` means the factor is a neutral 1.0
+     * because there was nothing to assess, not because everything is safe.
+     */
+    reachabilityDetail?: ReachabilityDetail;
     /** Individual pass results */
     passResults: TrustPassResult[];
     /** ISO timestamp */