mjolnir-qa 0.5.16 → 0.5.18

package/CHANGELOG.md

@@ -9,6 +9,18 @@ Rule behavior changes (new rules, FP-rate changes against the corpus,
 severity changes) are first-class entries here — rule IDs are immutable
 once shipped, so this file is the record of what changed between versions.
 
+## [0.5.18] — 2026-09-07
+
+### Changes since 0.5.17
+
+- README: add npm downloads badge
+
+## [0.5.17] — 2026-09-07
+
+### Changes since 0.5.16
+
+- Fixture integrity gate: Layer A structural typecheck, doctor fixture-integrity, Python tier (F1, D9, G3) (#53)
+
 ## [0.5.16] — 2026-09-07
 
 ### Changes since 0.5.15

package/README.md

@@ -8,6 +8,7 @@
 pipelines, reports a worthiness score, and shows exactly where trust breaks.
 
 [![npm](https://img.shields.io/npm/v/mjolnir-qa.svg?style=flat-square&color=C9A227&labelColor=0B0F17)](https://www.npmjs.com/package/mjolnir-qa)
+[![downloads](https://img.shields.io/npm/dm/mjolnir-qa.svg?style=flat-square&color=C9A227&labelColor=0B0F17)](https://www.npmjs.com/package/mjolnir-qa)
 [![ci](https://img.shields.io/github/actions/workflow/status/Sergey-Bar/Mjolnir/ci.yml?branch=main&style=flat-square&label=ci&labelColor=0B0F17)](https://github.com/Sergey-Bar/Mjolnir/actions/workflows/ci.yml)
 [![license](https://img.shields.io/badge/license-MIT-C9A227.svg?style=flat-square&labelColor=0B0F17)](LICENSE)
 [![node](https://img.shields.io/badge/node-%E2%89%A5%2022.18-2E8C7F.svg?style=flat-square&labelColor=0B0F17)](https://nodejs.org)

package/dist/cli.d.mts

@@ -699,7 +699,7 @@ declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniver
  * `scripts/sync-sarif-version.cjs` on release and guarded by
  * `tests/version-consistency.spec.ts` locally.
  */
-declare const CLI_VERSION = "0.5.16";
+declare const CLI_VERSION = "0.5.18";
 /** A usage-error detail: the offending token, when one exists. */
 interface UsageErrorDetail {
   /** The unknown flag or rejected value (e.g. `--nope`, `loud`). */

package/dist/cli.mjs

@@ -13264,7 +13264,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.16",
+			version: "0.5.18",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -17826,6 +17826,63 @@ function checkQuarantineEnforcement(rules = RULES) {
 		details
 	};
 }
+/**
+* Check 8 (certification-audit Phase 2.5, plan G3 Layer A support):
+* fixture-integrity — deterministic structural census of the fixture
+* trees. Complements the fixture firewall (which proves must-fire /
+* must-not-fire PRESENCE per rule) with: orphaned fixture dirs (no
+* registered rule), empty dirs, and the Layer A typecheck allowlist
+* census. Blocking: an orphaned dir or an empty fixture dir means the
+* structural layer has silently drifted.
+*/
+function checkFixtureIntegrity(fixturesRoot, rules = RULES) {
+	const details = [];
+	let ok = true;
+	const registeredIds = new Set(rules.map((r) => r.id));
+	const fixtureRoots = [fixturesRoot, join(fixturesRoot, "..", "corpus", "positive-fixtures")];
+	let fixtureFiles = 0;
+	let fixtureDirs = 0;
+	for (const root of fixtureRoots) {
+		if (!existsSync(root)) continue;
+		for (const entry of readdirSync(root, { withFileTypes: true })) {
+			if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
+			fixtureDirs++;
+			const ruleId = entry.name;
+			if (!registeredIds.has(ruleId)) {
+				ok = false;
+				details.push(`orphaned fixture dir (no registered rule): ${ruleId}`);
+				continue;
+			}
+			const sub = join(root, ruleId);
+			for (const child of readdirSync(sub, { withFileTypes: true })) if (child.isDirectory()) {
+				const files = nonHiddenFiles(join(sub, child.name));
+				fixtureFiles += files.length;
+				if (files.length === 0) {
+					ok = false;
+					details.push(`empty fixture dir: ${ruleId}/${child.name}`);
+				}
+			} else if (!child.name.startsWith(".")) fixtureFiles++;
+		}
+	}
+	const allowlistPath = join(fixturesRoot, "typecheck-allowlist.json");
+	if (existsSync(allowlistPath)) try {
+		const parsed = JSON.parse(readFileSync(allowlistPath, "utf8"));
+		if (Array.isArray(parsed.entries)) details.push(`Layer A typecheck allowlist: ${parsed.entries.length} justified entr(ies)`);
+		else {
+			ok = false;
+			details.push("typecheck-allowlist.json entries is not an array");
+		}
+	} catch {
+		ok = false;
+		details.push("typecheck-allowlist.json is unreadable/malformed");
+	}
+	details.unshift(`fixture trees: ${fixtureDirs} rule dirs, ${fixtureFiles} fixture files — orphaned dirs and empty dirs are blocking`);
+	return {
+		name: "fixture-integrity",
+		ok,
+		details
+	};
+}
 function runDoctorSelfAudit(fixturesRoot) {
 	const verdictsDir = join(fixturesRoot, "..", "corpus", "verdicts");
 	const checks = [
@@ -17835,7 +17892,8 @@ function runDoctorSelfAudit(fixturesRoot) {
 		checkEvidenceHonesty(),
 		checkTierEnforcement(verdictsDir),
 		checkAntiCreep(),
-		checkQuarantineEnforcement()
+		checkQuarantineEnforcement(),
+		checkFixtureIntegrity(fixturesRoot)
 	];
 	return {
 		checks,
@@ -18074,7 +18132,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.16";
+const CLI_VERSION = "0.5.18";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",

package/dist/mcp/stdio.mjs

@@ -13263,7 +13263,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.16",
+			version: "0.5.18",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -17308,6 +17308,63 @@ function checkQuarantineEnforcement(rules = RULES) {
 		details
 	};
 }
+/**
+* Check 8 (certification-audit Phase 2.5, plan G3 Layer A support):
+* fixture-integrity — deterministic structural census of the fixture
+* trees. Complements the fixture firewall (which proves must-fire /
+* must-not-fire PRESENCE per rule) with: orphaned fixture dirs (no
+* registered rule), empty dirs, and the Layer A typecheck allowlist
+* census. Blocking: an orphaned dir or an empty fixture dir means the
+* structural layer has silently drifted.
+*/
+function checkFixtureIntegrity(fixturesRoot, rules = RULES) {
+	const details = [];
+	let ok = true;
+	const registeredIds = new Set(rules.map((r) => r.id));
+	const fixtureRoots = [fixturesRoot, join(fixturesRoot, "..", "corpus", "positive-fixtures")];
+	let fixtureFiles = 0;
+	let fixtureDirs = 0;
+	for (const root of fixtureRoots) {
+		if (!existsSync(root)) continue;
+		for (const entry of readdirSync(root, { withFileTypes: true })) {
+			if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
+			fixtureDirs++;
+			const ruleId = entry.name;
+			if (!registeredIds.has(ruleId)) {
+				ok = false;
+				details.push(`orphaned fixture dir (no registered rule): ${ruleId}`);
+				continue;
+			}
+			const sub = join(root, ruleId);
+			for (const child of readdirSync(sub, { withFileTypes: true })) if (child.isDirectory()) {
+				const files = nonHiddenFiles(join(sub, child.name));
+				fixtureFiles += files.length;
+				if (files.length === 0) {
+					ok = false;
+					details.push(`empty fixture dir: ${ruleId}/${child.name}`);
+				}
+			} else if (!child.name.startsWith(".")) fixtureFiles++;
+		}
+	}
+	const allowlistPath = join(fixturesRoot, "typecheck-allowlist.json");
+	if (existsSync(allowlistPath)) try {
+		const parsed = JSON.parse(readFileSync(allowlistPath, "utf8"));
+		if (Array.isArray(parsed.entries)) details.push(`Layer A typecheck allowlist: ${parsed.entries.length} justified entr(ies)`);
+		else {
+			ok = false;
+			details.push("typecheck-allowlist.json entries is not an array");
+		}
+	} catch {
+		ok = false;
+		details.push("typecheck-allowlist.json is unreadable/malformed");
+	}
+	details.unshift(`fixture trees: ${fixtureDirs} rule dirs, ${fixtureFiles} fixture files — orphaned dirs and empty dirs are blocking`);
+	return {
+		name: "fixture-integrity",
+		ok,
+		details
+	};
+}
 function runDoctorSelfAudit(fixturesRoot) {
 	const verdictsDir = join(fixturesRoot, "..", "corpus", "verdicts");
 	const checks = [
@@ -17317,7 +17374,8 @@ function runDoctorSelfAudit(fixturesRoot) {
 		checkEvidenceHonesty(),
 		checkTierEnforcement(verdictsDir),
 		checkAntiCreep(),
-		checkQuarantineEnforcement()
+		checkQuarantineEnforcement(),
+		checkFixtureIntegrity(fixturesRoot)
 	];
 	return {
 		checks,
@@ -17710,7 +17768,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.16";
+const CLI_VERSION = "0.5.18";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mjolnir-qa",
-  "version": "0.5.16",
+  "version": "0.5.18",
   "description": "Mjölnir — the Verification Trust Engine for QA. Audits test suites and CI pipelines, reports a worthiness score and prioritized findings.",
   "type": "module",
   "engines": {
@@ -28,7 +28,7 @@
     "test:watch": "vitest",
     "lint": "eslint . --max-warnings=0 && prettier --check .",
     "format": "prettier --write .",
-    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json && tsx scripts/typecheck-fixtures.ts",
     "golden:update": "tsx tests/golden/gen.ts",
     "corpus:regression": "tsx tests/corpus/audit.ts",
     "corpus:regression:update": "tsx tests/corpus/audit.ts --update",