mjolnir-qa 0.5.17 → 0.5.19

package/CHANGELOG.md

@@ -9,6 +9,18 @@ Rule behavior changes (new rules, FP-rate changes against the corpus,
 severity changes) are first-class entries here — rule IDs are immutable
 once shipped, so this file is the record of what changed between versions.
 
+## [0.5.19] — 2026-09-07
+
+### Changes since 0.5.18
+
+- Detector revision integrity: manifest, doctor check, CI WARN base-diff (D8v2, G4) (#54)
+
+## [0.5.18] — 2026-09-07
+
+### Changes since 0.5.17
+
+- README: add npm downloads badge
+
 ## [0.5.17] — 2026-09-07
 
 ### Changes since 0.5.16

package/README.md

@@ -8,6 +8,7 @@
 pipelines, reports a worthiness score, and shows exactly where trust breaks.
 
 [![npm](https://img.shields.io/npm/v/mjolnir-qa.svg?style=flat-square&color=C9A227&labelColor=0B0F17)](https://www.npmjs.com/package/mjolnir-qa)
+[![downloads](https://img.shields.io/npm/dm/mjolnir-qa.svg?style=flat-square&color=C9A227&labelColor=0B0F17)](https://www.npmjs.com/package/mjolnir-qa)
 [![ci](https://img.shields.io/github/actions/workflow/status/Sergey-Bar/Mjolnir/ci.yml?branch=main&style=flat-square&label=ci&labelColor=0B0F17)](https://github.com/Sergey-Bar/Mjolnir/actions/workflows/ci.yml)
 [![license](https://img.shields.io/badge/license-MIT-C9A227.svg?style=flat-square&labelColor=0B0F17)](LICENSE)
 [![node](https://img.shields.io/badge/node-%E2%89%A5%2022.18-2E8C7F.svg?style=flat-square&labelColor=0B0F17)](https://nodejs.org)

package/dist/cli.d.mts

@@ -699,7 +699,7 @@ declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniver
  * `scripts/sync-sarif-version.cjs` on release and guarded by
  * `tests/version-consistency.spec.ts` locally.
  */
-declare const CLI_VERSION = "0.5.17";
+declare const CLI_VERSION = "0.5.19";
 /** A usage-error detail: the offending token, when one exists. */
 interface UsageErrorDetail {
   /** The unknown flag or rejected value (e.g. `--nope`, `loud`). */

package/dist/cli.mjs

@@ -13264,7 +13264,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.17",
+			version: "0.5.19",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -13707,7 +13707,7 @@ function renderPrComment(result, options = {}) {
 * from here.
 */
 /** Human message for any thrown value — never "undefined"/"[object Object]". */
-function errorText(err) {
+function errorText$1(err) {
 	if (err instanceof Error) return err.message;
 	if (typeof err === "string") return err;
 	if (typeof err === "object" && err !== null) return JSON.stringify(err);
@@ -13723,7 +13723,7 @@ function validateReportJson(text) {
 	try {
 		parsed = JSON.parse(text);
 	} catch (err) {
-		throw new Error(`not valid JSON (${errorText(err)})`, { cause: err });
+		throw new Error(`not valid JSON (${errorText$1(err)})`, { cause: err });
 	}
 	if (typeof parsed !== "object" || parsed === null) throw new Error("the file is a JSON value but not an object");
 	const doc = parsed;
@@ -13900,7 +13900,7 @@ function runSummaryCommand(argv, io = {
 	try {
 		result = loadSavedReport(reportPath);
 	} catch (err) {
-		io.err(`mjolnir summary: cannot read ${reportPath}: ${errorText(err)}`);
+		io.err(`mjolnir summary: cannot read ${reportPath}: ${errorText$1(err)}`);
 		return 2;
 	}
 	const env = process.env;
@@ -13919,7 +13919,7 @@ function runSummaryCommand(argv, io = {
 	if (stepSummaryPath) try {
 		appendFileSync(stepSummaryPath, `${summary}\n`);
 	} catch (err) {
-		io.err(`mjolnir summary: could not write $GITHUB_STEP_SUMMARY (${errorText(err)}); printing to stdout instead.`);
+		io.err(`mjolnir summary: could not write $GITHUB_STEP_SUMMARY (${errorText$1(err)}); printing to stdout instead.`);
 		io.out(summary);
 	}
 	else io.out(summary);
@@ -14050,7 +14050,7 @@ async function runWhyCommand(argv, io = {
 		try {
 			result = loadSavedReport(reportPath);
 		} catch (err) {
-			io.err(`mjolnir why: cannot read ${reportPath}: ${errorText(err)}`);
+			io.err(`mjolnir why: cannot read ${reportPath}: ${errorText$1(err)}`);
 			return 2;
 		}
 	} else {
@@ -14069,7 +14069,7 @@ async function runWhyCommand(argv, io = {
 				strict: argv.includes("--strict")
 			});
 		} catch (err) {
-			io.err(`mjolnir why: scan failed: ${errorText(err)}`);
+			io.err(`mjolnir why: scan failed: ${errorText$1(err)}`);
 			return 20;
 		}
 	}
@@ -14351,7 +14351,7 @@ function runHandoffCommand(argv, io = {
 	try {
 		result = loadSavedReport(reportPath);
 	} catch (err) {
-		io.err(`mjolnir handoff: cannot read ${reportPath}: ${errorText(err)}`);
+		io.err(`mjolnir handoff: cannot read ${reportPath}: ${errorText$1(err)}`);
 		return 2;
 	}
 	io.out(renderHandoff(result, {
@@ -17630,6 +17630,192 @@ function renderFixReport(results, dryRun) {
 	return lines.join("\n");
 }
 //#endregion
+//#region src/engine/detector-hash.ts
+/**
+* Detector revision integrity engine (certification-audit Phase 3,
+* G4/D8v2/D17).
+*
+* The manifest records, per rule, a `logicHash` = source-identity hash
+* over the rule's DECLARED METADATA (the gating/participation surface)
+* plus the FULL TOKEN STREAM of its defining module (the detection
+* surface). It is deliberately NOT a behavior-equivalence hash (D17):
+* behavior-neutral edits that touch source tokens (renames, unrelated
+* imports) DO churn it — that errs in the safe direction. What it
+* mechanically guarantees: no source-token change can pass without
+* either a declared revision bump or an explicit, review-visible
+* manifest regeneration.
+*
+* Token-stream contract (G4): every non-trivia token of the module with
+* regex/string/template-literal token texts preserved EXACTLY (whitespace
+* inside a literal is semantic); comments and inter-token whitespace
+* excluded (a prettier reformat or comment edit cannot churn the hash).
+* Module-scope detection constants, control-flow edits, and metadata
+* edits all change the token stream → detected. `String(rule.run)` is
+* proven insufficient for exactly this (module-scope constants live in
+* ≥7 rule files).
+*
+* Implementation note: tokenization goes through ts-morph's bundled
+* TypeScript compiler (ts-morph is a runtime dependency — the doctor
+* computes current hashes at runtime; `typescript` itself is dev-only
+* and must not leak into the runtime surface).
+*/
+/** The record separator between the metadata JSON and the token stream. */
+const SECTION_SEP = "␞";
+/** The unit separator between consecutive tokens (length-agnostic, unambiguous). */
+const TOKEN_SEP = "␟";
+/**
+* A context-aware, trivia-free token walk over `moduleText`. Yields
+* {kind, text} for every non-trivia token with regex/template resolution
+* identical to the compiler:
+*   - A SlashToken is re-scanned as RegularExpressionLiteral exactly when
+*     the previous token cannot end an expression (the lexer's own
+*     context rule); a division operator stays SlashToken.
+*   - A CloseBraceToken inside a template continuation is re-scanned via
+*     reScanTemplateToken (TemplateHead opens; TemplateMiddle/Tail close
+*     a level). A brace outside a template is plain punctuation —
+*     re-scanning it would swallow the rest of the file (proven).
+* Regex/string/template bodies keep their exact internal text; comments
+* and whitespace are trivia and never yielded.
+*/
+function* walkTokens(moduleText) {
+	const scanner = ts.createScanner(ts.ScriptTarget.ES2022, true, ts.LanguageVariant.Standard, moduleText);
+	let templateDepth = 0;
+	let prevKind;
+	const endsExpression = (kind) => {
+		if (kind === void 0) return false;
+		return kind === ts.SyntaxKind.Identifier || kind === ts.SyntaxKind.StringLiteral || kind === ts.SyntaxKind.NumericLiteral || kind === ts.SyntaxKind.RegularExpressionLiteral || kind === ts.SyntaxKind.NoSubstitutionTemplateLiteral || kind === ts.SyntaxKind.LastTemplateToken || kind === ts.SyntaxKind.CloseParenToken || kind === ts.SyntaxKind.CloseBracketToken || kind === ts.SyntaxKind.CloseBraceToken || kind === ts.SyntaxKind.PlusPlusToken || kind === ts.SyntaxKind.MinusMinusToken || kind === ts.SyntaxKind.ThisKeyword || kind === ts.SyntaxKind.SuperKeyword || kind === ts.SyntaxKind.TrueKeyword || kind === ts.SyntaxKind.FalseKeyword || kind === ts.SyntaxKind.NullKeyword;
+	};
+	let tok = scanner.scan();
+	while (tok !== ts.SyntaxKind.EndOfFileToken) {
+		if (tok === ts.SyntaxKind.SlashToken && !endsExpression(prevKind)) tok = scanner.reScanSlashToken();
+		else if (tok === ts.SyntaxKind.CloseBraceToken && templateDepth > 0) tok = scanner.reScanTemplateToken(false);
+		const text = scanner.getTokenText();
+		yield {
+			kind: tok,
+			text
+		};
+		if (tok === ts.SyntaxKind.TemplateHead) templateDepth++;
+		else if (tok === ts.SyntaxKind.LastTemplateToken) templateDepth = Math.max(0, templateDepth - 1);
+		prevKind = tok;
+		tok = scanner.scan();
+	}
+}
+/**
+* The deterministic token stream consumed by the logic hash: token texts
+* joined with the unit separator.
+*/
+function moduleTokenStream(moduleText) {
+	const parts = [];
+	for (const { text } of walkTokens(moduleText)) parts.push(text);
+	return parts.join(TOKEN_SEP);
+}
+/** The canonical logic hash for one rule: metadata JSON ‖ module token stream. */
+function computeRuleLogicHash(metadata, moduleText) {
+	return createHash("sha256").update(JSON.stringify(metadata)).update(SECTION_SEP).update(moduleTokenStream(moduleText)).digest("hex");
+}
+/**
+* The metadata surface a hash covers, extracted from a live rule object.
+* Field order must stay in sync with RuleHashMetadata (the object literal
+* order defines the JSON serialization).
+*/
+function metadataForRule(rule) {
+	return {
+		appliesTo: rule.appliesTo,
+		configRule: rule.configRule,
+		configFiles: rule.configFiles,
+		frameworks: rule.frameworks,
+		tier: rule.tier,
+		severity: rule.severity,
+		confidence: rule.confidence,
+		findingType: rule.findingType,
+		evidenceLevel: rule.evidenceLevel,
+		overlapWith: rule.overlapWith
+	};
+}
+function declaredRevision(rule) {
+	return rule.detectorRevision ?? 1;
+}
+/**
+* Walks the rule source tree and maps every rule to its defining module —
+* STATICALLY. A module claims a rule when its tokens contain the property
+* sequence `id` `:` `<QA-rule-id string literal>` (defineRule options and
+* family variants both have exactly this shape). No dynamic import: the
+* doctor computes current hashes at runtime (also from dist, where .ts
+* imports are neither available nor needed — only file text is hashed),
+* so a runtime import of rule sources would break the installed case and
+* tie the integrity check to the module loader.
+*
+* Each rule id must be claimed exactly once — a double claim means the
+* module layout drifted and the manifest would be ambiguous.
+*/
+function collectRuleModules(rulesDir) {
+	const claimed = /* @__PURE__ */ new Map();
+	const files = listRuleModules(rulesDir).sort();
+	const RULE_ID_LIT = /^QA-[A-Z]{1,6}-\d{3}$/;
+	for (const file of files) {
+		const moduleText = readFileSync(file, "utf8");
+		let pendingIdKey = false;
+		let prevTok;
+		for (const { kind: tok, text: raw } of walkTokens(moduleText)) {
+			const isStringLit = tok === ts.SyntaxKind.StringLiteral;
+			const literalValue = isStringLit && raw.length >= 2 ? raw.slice(1, -1) : raw;
+			if (isStringLit && RULE_ID_LIT.exec(literalValue) !== null && (prevTok === ts.SyntaxKind.ColonToken && pendingIdKey || prevTok === ts.SyntaxKind.OpenParenToken)) {
+				const prev = claimed.get(literalValue);
+				if (prev && prev !== file) throw new Error(`rule ${literalValue} is claimed by both ${prev} and ${file} — the manifest needs exactly one defining module per rule`);
+				claimed.set(literalValue, file);
+				pendingIdKey = false;
+			} else if (tok === ts.SyntaxKind.Identifier && raw === "id") pendingIdKey = true;
+			else if (tok !== ts.SyntaxKind.ColonToken) pendingIdKey = false;
+			prevTok = tok;
+		}
+	}
+	return [...claimed.entries()].map(([ruleId, modulePath]) => ({
+		ruleId,
+		modulePath
+	}));
+}
+function listRuleModules(rulesDir) {
+	const out = [];
+	const visit = (dir) => {
+		for (const entry of readdirSync(dir, { withFileTypes: true })) {
+			const full = join(dir, entry.name);
+			if (entry.isDirectory()) visit(full);
+			else if (entry.name.endsWith(".ts") && !entry.name.endsWith(".d.ts")) {
+				if (entry.name === "index.ts" || entry.name.endsWith(".generated.ts")) continue;
+				out.push(full);
+			}
+		}
+	};
+	visit(rulesDir);
+	return out;
+}
+/**
+* Computes the full manifest from the live source tree. `rules` supplies
+* the registry (for detectorRevision + metadata of every registered rule);
+* `rulesDir` supplies the defining modules. Rules present in one but not
+* the other fail loudly — the manifest must cover exactly the registry.
+*/
+function computeDetectorHashes(rules, rulesDir) {
+	const modules = collectRuleModules(rulesDir);
+	const byId = new Map(modules.map((m) => [m.ruleId, m]));
+	const registryIds = new Set(rules.map((r) => r.id));
+	const manifest = {};
+	for (const rule of rules) {
+		const module = byId.get(rule.id);
+		if (!module) throw new Error(`rule ${rule.id} is registered but has no defining module under ${rulesDir}`);
+		const moduleText = readFileSync(module.modulePath, "utf8");
+		manifest[rule.id] = {
+			logicHash: computeRuleLogicHash(metadataForRule(rule), moduleText),
+			detectorRevision: declaredRevision(rule)
+		};
+	}
+	for (const id of byId.keys()) if (!registryIds.has(id)) throw new Error(`rule ${id} defines a module under ${rulesDir} but is not in the registry — the manifest must cover exactly the registry`);
+	return manifest;
+}
+function loadManifest(path) {
+	return JSON.parse(readFileSync(path, "utf8"));
+}
+//#endregion
 //#region src/commands/doctor.ts
 /**
 * `mjolnir doctor` — self-audit of Mjolnir's own rule base.
@@ -17646,6 +17832,10 @@ function renderFixReport(results, dryRun) {
 *
 * Exit codes reuse the frozen set: 0 healthy · 1 violations · 20 crash.
 */
+/** Uniform error rendering for doctor details (Error or thrown-as-string). */
+function errorText(e) {
+	return e instanceof Error ? e.message : String(e);
+}
 const ui$1 = plainContext();
 const VALID_ID = RULE_ID_RE;
 function nonHiddenFiles(dir) {
@@ -17883,6 +18073,85 @@ function checkFixtureIntegrity(fixturesRoot, rules = RULES) {
 		details
 	};
 }
+/**
+* Check 9 (certification-audit Phase 3.3, G4/D8v2 — HARD-BLOCKING):
+* revision-integrity. The manifest tests/corpus/detector-hashes.json
+* attests each rule's source identity (logicHash = sha256 of the rule's
+* metadata ‖ its defining module's token stream) against the declared
+* detectorRevision:
+*   check A — current logicHash ≠ manifest logicHash → FAIL ("bump +
+*             re-measure + regen, or regen with stated behavior-neutrality");
+*   check B — declared revision ≠ manifest revision → FAIL (stale manifest);
+*   manifest missing/unreadable, or the source tree unavailable (the
+*             installed-package case) → the check CANNOT be evaluated
+*             honestly → reported as INCONCLUSIVE and ok=false — a
+*             certification-critical INCONCLUSIVE never renders as pass
+*             (G2); Phase 5's status migration carries the same rule.
+*
+* Where the check runs: the doctor self-audits THIS repo, so `repoRoot`
+* must be the Mjölnir checkout (src/ present). On an installed package
+* the src tree does not exist → honest INCONCLUSIVE, same as above.
+*/
+function checkRevisionIntegrity(repoRoot, rules = RULES) {
+	const details = [];
+	const manifestPath = join(repoRoot, "tests", "corpus", "detector-hashes.json");
+	const rulesDir = join(repoRoot, "src", "rules");
+	if (!existsSync(manifestPath)) return {
+		name: "revision-integrity",
+		ok: false,
+		details: ["INCONCLUSIVE: tests/corpus/detector-hashes.json is missing — run `npm run detector-hashes:update` (certification-critical: an unevaluable check never renders as pass)"]
+	};
+	if (!existsSync(rulesDir)) return {
+		name: "revision-integrity",
+		ok: false,
+		details: ["INCONCLUSIVE: src/rules is not present (installed package) — detector source identity cannot be verified here"]
+	};
+	let manifest;
+	try {
+		manifest = loadManifest(manifestPath);
+	} catch {
+		return {
+			name: "revision-integrity",
+			ok: false,
+			details: ["INCONCLUSIVE: tests/corpus/detector-hashes.json is unreadable/malformed — regenerate with `npm run detector-hashes:update`"]
+		};
+	}
+	let current;
+	try {
+		current = computeDetectorHashes(rules, rulesDir);
+	} catch (e) {
+		return {
+			name: "revision-integrity",
+			ok: false,
+			details: [`INCONCLUSIVE: detector hash computation failed — ${errorText(e)}`]
+		};
+	}
+	const failures = [];
+	for (const rule of rules) {
+		const attested = manifest[rule.id];
+		if (!attested) {
+			failures.push(`${rule.id}: not attested in the manifest (stale manifest — regenerate)`);
+			continue;
+		}
+		if (attested.logicHash !== current[rule.id]?.logicHash) failures.push(`${rule.id}: source identity changed since manifest attestation — bump detectorRevision + re-measure + regen, or regen with stated behavior-neutrality (G4)`);
+		if (attested.detectorRevision !== declaredDetectorRevision(rule)) failures.push(`${rule.id}: manifest revision ${attested.detectorRevision} ≠ declared ${declaredDetectorRevision(rule)} (stale manifest — regenerate)`);
+	}
+	for (const id of Object.keys(manifest)) if (!rules.some((r) => r.id === id)) failures.push(`${id}: attested in the manifest but not in the registry`);
+	if (failures.length > 0) {
+		details.push(...failures);
+		return {
+			name: "revision-integrity",
+			ok: false,
+			details
+		};
+	}
+	details.push(`${rules.length} rules attested: source identity and declared revision match the manifest (check A + check B, G4)`);
+	return {
+		name: "revision-integrity",
+		ok: true,
+		details
+	};
+}
 function runDoctorSelfAudit(fixturesRoot) {
 	const verdictsDir = join(fixturesRoot, "..", "corpus", "verdicts");
 	const checks = [
@@ -17893,7 +18162,8 @@ function runDoctorSelfAudit(fixturesRoot) {
 		checkTierEnforcement(verdictsDir),
 		checkAntiCreep(),
 		checkQuarantineEnforcement(),
-		checkFixtureIntegrity(fixturesRoot)
+		checkFixtureIntegrity(fixturesRoot),
+		checkRevisionIntegrity(join(fixturesRoot, "..", ".."))
 	];
 	return {
 		checks,
@@ -18132,7 +18402,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.17";
+const CLI_VERSION = "0.5.19";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",

package/dist/mcp/stdio.mjs

@@ -13263,7 +13263,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.17",
+			version: "0.5.19",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -13706,7 +13706,7 @@ function renderPrComment(result, options = {}) {
 * from here.
 */
 /** Human message for any thrown value — never "undefined"/"[object Object]". */
-function errorText(err) {
+function errorText$1(err) {
 	if (err instanceof Error) return err.message;
 	if (typeof err === "string") return err;
 	if (typeof err === "object" && err !== null) return JSON.stringify(err);
@@ -13722,7 +13722,7 @@ function validateReportJson(text) {
 	try {
 		parsed = JSON.parse(text);
 	} catch (err) {
-		throw new Error(`not valid JSON (${errorText(err)})`, { cause: err });
+		throw new Error(`not valid JSON (${errorText$1(err)})`, { cause: err });
 	}
 	if (typeof parsed !== "object" || parsed === null) throw new Error("the file is a JSON value but not an object");
 	const doc = parsed;
@@ -13899,7 +13899,7 @@ function runSummaryCommand(argv, io = {
 	try {
 		result = loadSavedReport(reportPath);
 	} catch (err) {
-		io.err(`mjolnir summary: cannot read ${reportPath}: ${errorText(err)}`);
+		io.err(`mjolnir summary: cannot read ${reportPath}: ${errorText$1(err)}`);
 		return 2;
 	}
 	const env = process.env;
@@ -13918,7 +13918,7 @@ function runSummaryCommand(argv, io = {
 	if (stepSummaryPath) try {
 		appendFileSync(stepSummaryPath, `${summary}\n`);
 	} catch (err) {
-		io.err(`mjolnir summary: could not write $GITHUB_STEP_SUMMARY (${errorText(err)}); printing to stdout instead.`);
+		io.err(`mjolnir summary: could not write $GITHUB_STEP_SUMMARY (${errorText$1(err)}); printing to stdout instead.`);
 		io.out(summary);
 	}
 	else io.out(summary);
@@ -14049,7 +14049,7 @@ async function runWhyCommand(argv, io = {
 		try {
 			result = loadSavedReport(reportPath);
 		} catch (err) {
-			io.err(`mjolnir why: cannot read ${reportPath}: ${errorText(err)}`);
+			io.err(`mjolnir why: cannot read ${reportPath}: ${errorText$1(err)}`);
 			return 2;
 		}
 	} else {
@@ -14068,7 +14068,7 @@ async function runWhyCommand(argv, io = {
 				strict: argv.includes("--strict")
 			});
 		} catch (err) {
-			io.err(`mjolnir why: scan failed: ${errorText(err)}`);
+			io.err(`mjolnir why: scan failed: ${errorText$1(err)}`);
 			return 20;
 		}
 	}
@@ -14350,7 +14350,7 @@ function runHandoffCommand(argv, io = {
 	try {
 		result = loadSavedReport(reportPath);
 	} catch (err) {
-		io.err(`mjolnir handoff: cannot read ${reportPath}: ${errorText(err)}`);
+		io.err(`mjolnir handoff: cannot read ${reportPath}: ${errorText$1(err)}`);
 		return 2;
 	}
 	io.out(renderHandoff(result, {
@@ -17112,6 +17112,192 @@ function isProvisional(rule) {
 	return effectiveTier(rule) === "extended" && !hasValidMeasurement(rule);
 }
 //#endregion
+//#region src/engine/detector-hash.ts
+/**
+* Detector revision integrity engine (certification-audit Phase 3,
+* G4/D8v2/D17).
+*
+* The manifest records, per rule, a `logicHash` = source-identity hash
+* over the rule's DECLARED METADATA (the gating/participation surface)
+* plus the FULL TOKEN STREAM of its defining module (the detection
+* surface). It is deliberately NOT a behavior-equivalence hash (D17):
+* behavior-neutral edits that touch source tokens (renames, unrelated
+* imports) DO churn it — that errs in the safe direction. What it
+* mechanically guarantees: no source-token change can pass without
+* either a declared revision bump or an explicit, review-visible
+* manifest regeneration.
+*
+* Token-stream contract (G4): every non-trivia token of the module with
+* regex/string/template-literal token texts preserved EXACTLY (whitespace
+* inside a literal is semantic); comments and inter-token whitespace
+* excluded (a prettier reformat or comment edit cannot churn the hash).
+* Module-scope detection constants, control-flow edits, and metadata
+* edits all change the token stream → detected. `String(rule.run)` is
+* proven insufficient for exactly this (module-scope constants live in
+* ≥7 rule files).
+*
+* Implementation note: tokenization goes through ts-morph's bundled
+* TypeScript compiler (ts-morph is a runtime dependency — the doctor
+* computes current hashes at runtime; `typescript` itself is dev-only
+* and must not leak into the runtime surface).
+*/
+/** The record separator between the metadata JSON and the token stream. */
+const SECTION_SEP = "␞";
+/** The unit separator between consecutive tokens (length-agnostic, unambiguous). */
+const TOKEN_SEP = "␟";
+/**
+* A context-aware, trivia-free token walk over `moduleText`. Yields
+* {kind, text} for every non-trivia token with regex/template resolution
+* identical to the compiler:
+*   - A SlashToken is re-scanned as RegularExpressionLiteral exactly when
+*     the previous token cannot end an expression (the lexer's own
+*     context rule); a division operator stays SlashToken.
+*   - A CloseBraceToken inside a template continuation is re-scanned via
+*     reScanTemplateToken (TemplateHead opens; TemplateMiddle/Tail close
+*     a level). A brace outside a template is plain punctuation —
+*     re-scanning it would swallow the rest of the file (proven).
+* Regex/string/template bodies keep their exact internal text; comments
+* and whitespace are trivia and never yielded.
+*/
+function* walkTokens(moduleText) {
+	const scanner = ts.createScanner(ts.ScriptTarget.ES2022, true, ts.LanguageVariant.Standard, moduleText);
+	let templateDepth = 0;
+	let prevKind;
+	const endsExpression = (kind) => {
+		if (kind === void 0) return false;
+		return kind === ts.SyntaxKind.Identifier || kind === ts.SyntaxKind.StringLiteral || kind === ts.SyntaxKind.NumericLiteral || kind === ts.SyntaxKind.RegularExpressionLiteral || kind === ts.SyntaxKind.NoSubstitutionTemplateLiteral || kind === ts.SyntaxKind.LastTemplateToken || kind === ts.SyntaxKind.CloseParenToken || kind === ts.SyntaxKind.CloseBracketToken || kind === ts.SyntaxKind.CloseBraceToken || kind === ts.SyntaxKind.PlusPlusToken || kind === ts.SyntaxKind.MinusMinusToken || kind === ts.SyntaxKind.ThisKeyword || kind === ts.SyntaxKind.SuperKeyword || kind === ts.SyntaxKind.TrueKeyword || kind === ts.SyntaxKind.FalseKeyword || kind === ts.SyntaxKind.NullKeyword;
+	};
+	let tok = scanner.scan();
+	while (tok !== ts.SyntaxKind.EndOfFileToken) {
+		if (tok === ts.SyntaxKind.SlashToken && !endsExpression(prevKind)) tok = scanner.reScanSlashToken();
+		else if (tok === ts.SyntaxKind.CloseBraceToken && templateDepth > 0) tok = scanner.reScanTemplateToken(false);
+		const text = scanner.getTokenText();
+		yield {
+			kind: tok,
+			text
+		};
+		if (tok === ts.SyntaxKind.TemplateHead) templateDepth++;
+		else if (tok === ts.SyntaxKind.LastTemplateToken) templateDepth = Math.max(0, templateDepth - 1);
+		prevKind = tok;
+		tok = scanner.scan();
+	}
+}
+/**
+* The deterministic token stream consumed by the logic hash: token texts
+* joined with the unit separator.
+*/
+function moduleTokenStream(moduleText) {
+	const parts = [];
+	for (const { text } of walkTokens(moduleText)) parts.push(text);
+	return parts.join(TOKEN_SEP);
+}
+/** The canonical logic hash for one rule: metadata JSON ‖ module token stream. */
+function computeRuleLogicHash(metadata, moduleText) {
+	return createHash("sha256").update(JSON.stringify(metadata)).update(SECTION_SEP).update(moduleTokenStream(moduleText)).digest("hex");
+}
+/**
+* The metadata surface a hash covers, extracted from a live rule object.
+* Field order must stay in sync with RuleHashMetadata (the object literal
+* order defines the JSON serialization).
+*/
+function metadataForRule(rule) {
+	return {
+		appliesTo: rule.appliesTo,
+		configRule: rule.configRule,
+		configFiles: rule.configFiles,
+		frameworks: rule.frameworks,
+		tier: rule.tier,
+		severity: rule.severity,
+		confidence: rule.confidence,
+		findingType: rule.findingType,
+		evidenceLevel: rule.evidenceLevel,
+		overlapWith: rule.overlapWith
+	};
+}
+function declaredRevision(rule) {
+	return rule.detectorRevision ?? 1;
+}
+/**
+* Walks the rule source tree and maps every rule to its defining module —
+* STATICALLY. A module claims a rule when its tokens contain the property
+* sequence `id` `:` `<QA-rule-id string literal>` (defineRule options and
+* family variants both have exactly this shape). No dynamic import: the
+* doctor computes current hashes at runtime (also from dist, where .ts
+* imports are neither available nor needed — only file text is hashed),
+* so a runtime import of rule sources would break the installed case and
+* tie the integrity check to the module loader.
+*
+* Each rule id must be claimed exactly once — a double claim means the
+* module layout drifted and the manifest would be ambiguous.
+*/
+function collectRuleModules(rulesDir) {
+	const claimed = /* @__PURE__ */ new Map();
+	const files = listRuleModules(rulesDir).sort();
+	const RULE_ID_LIT = /^QA-[A-Z]{1,6}-\d{3}$/;
+	for (const file of files) {
+		const moduleText = readFileSync(file, "utf8");
+		let pendingIdKey = false;
+		let prevTok;
+		for (const { kind: tok, text: raw } of walkTokens(moduleText)) {
+			const isStringLit = tok === ts.SyntaxKind.StringLiteral;
+			const literalValue = isStringLit && raw.length >= 2 ? raw.slice(1, -1) : raw;
+			if (isStringLit && RULE_ID_LIT.exec(literalValue) !== null && (prevTok === ts.SyntaxKind.ColonToken && pendingIdKey || prevTok === ts.SyntaxKind.OpenParenToken)) {
+				const prev = claimed.get(literalValue);
+				if (prev && prev !== file) throw new Error(`rule ${literalValue} is claimed by both ${prev} and ${file} — the manifest needs exactly one defining module per rule`);
+				claimed.set(literalValue, file);
+				pendingIdKey = false;
+			} else if (tok === ts.SyntaxKind.Identifier && raw === "id") pendingIdKey = true;
+			else if (tok !== ts.SyntaxKind.ColonToken) pendingIdKey = false;
+			prevTok = tok;
+		}
+	}
+	return [...claimed.entries()].map(([ruleId, modulePath]) => ({
+		ruleId,
+		modulePath
+	}));
+}
+function listRuleModules(rulesDir) {
+	const out = [];
+	const visit = (dir) => {
+		for (const entry of readdirSync(dir, { withFileTypes: true })) {
+			const full = join(dir, entry.name);
+			if (entry.isDirectory()) visit(full);
+			else if (entry.name.endsWith(".ts") && !entry.name.endsWith(".d.ts")) {
+				if (entry.name === "index.ts" || entry.name.endsWith(".generated.ts")) continue;
+				out.push(full);
+			}
+		}
+	};
+	visit(rulesDir);
+	return out;
+}
+/**
+* Computes the full manifest from the live source tree. `rules` supplies
+* the registry (for detectorRevision + metadata of every registered rule);
+* `rulesDir` supplies the defining modules. Rules present in one but not
+* the other fail loudly — the manifest must cover exactly the registry.
+*/
+function computeDetectorHashes(rules, rulesDir) {
+	const modules = collectRuleModules(rulesDir);
+	const byId = new Map(modules.map((m) => [m.ruleId, m]));
+	const registryIds = new Set(rules.map((r) => r.id));
+	const manifest = {};
+	for (const rule of rules) {
+		const module = byId.get(rule.id);
+		if (!module) throw new Error(`rule ${rule.id} is registered but has no defining module under ${rulesDir}`);
+		const moduleText = readFileSync(module.modulePath, "utf8");
+		manifest[rule.id] = {
+			logicHash: computeRuleLogicHash(metadataForRule(rule), moduleText),
+			detectorRevision: declaredRevision(rule)
+		};
+	}
+	for (const id of byId.keys()) if (!registryIds.has(id)) throw new Error(`rule ${id} defines a module under ${rulesDir} but is not in the registry — the manifest must cover exactly the registry`);
+	return manifest;
+}
+function loadManifest(path) {
+	return JSON.parse(readFileSync(path, "utf8"));
+}
+//#endregion
 //#region src/commands/doctor.ts
 /**
 * `mjolnir doctor` — self-audit of Mjolnir's own rule base.
@@ -17128,6 +17314,10 @@ function isProvisional(rule) {
 *
 * Exit codes reuse the frozen set: 0 healthy · 1 violations · 20 crash.
 */
+/** Uniform error rendering for doctor details (Error or thrown-as-string). */
+function errorText(e) {
+	return e instanceof Error ? e.message : String(e);
+}
 const ui$2 = plainContext();
 const VALID_ID = RULE_ID_RE;
 function nonHiddenFiles(dir) {
@@ -17365,6 +17555,85 @@ function checkFixtureIntegrity(fixturesRoot, rules = RULES) {
 		details
 	};
 }
+/**
+* Check 9 (certification-audit Phase 3.3, G4/D8v2 — HARD-BLOCKING):
+* revision-integrity. The manifest tests/corpus/detector-hashes.json
+* attests each rule's source identity (logicHash = sha256 of the rule's
+* metadata ‖ its defining module's token stream) against the declared
+* detectorRevision:
+*   check A — current logicHash ≠ manifest logicHash → FAIL ("bump +
+*             re-measure + regen, or regen with stated behavior-neutrality");
+*   check B — declared revision ≠ manifest revision → FAIL (stale manifest);
+*   manifest missing/unreadable, or the source tree unavailable (the
+*             installed-package case) → the check CANNOT be evaluated
+*             honestly → reported as INCONCLUSIVE and ok=false — a
+*             certification-critical INCONCLUSIVE never renders as pass
+*             (G2); Phase 5's status migration carries the same rule.
+*
+* Where the check runs: the doctor self-audits THIS repo, so `repoRoot`
+* must be the Mjölnir checkout (src/ present). On an installed package
+* the src tree does not exist → honest INCONCLUSIVE, same as above.
+*/
+function checkRevisionIntegrity(repoRoot, rules = RULES) {
+	const details = [];
+	const manifestPath = join(repoRoot, "tests", "corpus", "detector-hashes.json");
+	const rulesDir = join(repoRoot, "src", "rules");
+	if (!existsSync(manifestPath)) return {
+		name: "revision-integrity",
+		ok: false,
+		details: ["INCONCLUSIVE: tests/corpus/detector-hashes.json is missing — run `npm run detector-hashes:update` (certification-critical: an unevaluable check never renders as pass)"]
+	};
+	if (!existsSync(rulesDir)) return {
+		name: "revision-integrity",
+		ok: false,
+		details: ["INCONCLUSIVE: src/rules is not present (installed package) — detector source identity cannot be verified here"]
+	};
+	let manifest;
+	try {
+		manifest = loadManifest(manifestPath);
+	} catch {
+		return {
+			name: "revision-integrity",
+			ok: false,
+			details: ["INCONCLUSIVE: tests/corpus/detector-hashes.json is unreadable/malformed — regenerate with `npm run detector-hashes:update`"]
+		};
+	}
+	let current;
+	try {
+		current = computeDetectorHashes(rules, rulesDir);
+	} catch (e) {
+		return {
+			name: "revision-integrity",
+			ok: false,
+			details: [`INCONCLUSIVE: detector hash computation failed — ${errorText(e)}`]
+		};
+	}
+	const failures = [];
+	for (const rule of rules) {
+		const attested = manifest[rule.id];
+		if (!attested) {
+			failures.push(`${rule.id}: not attested in the manifest (stale manifest — regenerate)`);
+			continue;
+		}
+		if (attested.logicHash !== current[rule.id]?.logicHash) failures.push(`${rule.id}: source identity changed since manifest attestation — bump detectorRevision + re-measure + regen, or regen with stated behavior-neutrality (G4)`);
+		if (attested.detectorRevision !== declaredDetectorRevision(rule)) failures.push(`${rule.id}: manifest revision ${attested.detectorRevision} ≠ declared ${declaredDetectorRevision(rule)} (stale manifest — regenerate)`);
+	}
+	for (const id of Object.keys(manifest)) if (!rules.some((r) => r.id === id)) failures.push(`${id}: attested in the manifest but not in the registry`);
+	if (failures.length > 0) {
+		details.push(...failures);
+		return {
+			name: "revision-integrity",
+			ok: false,
+			details
+		};
+	}
+	details.push(`${rules.length} rules attested: source identity and declared revision match the manifest (check A + check B, G4)`);
+	return {
+		name: "revision-integrity",
+		ok: true,
+		details
+	};
+}
 function runDoctorSelfAudit(fixturesRoot) {
 	const verdictsDir = join(fixturesRoot, "..", "corpus", "verdicts");
 	const checks = [
@@ -17375,7 +17644,8 @@ function runDoctorSelfAudit(fixturesRoot) {
 		checkTierEnforcement(verdictsDir),
 		checkAntiCreep(),
 		checkQuarantineEnforcement(),
-		checkFixtureIntegrity(fixturesRoot)
+		checkFixtureIntegrity(fixturesRoot),
+		checkRevisionIntegrity(join(fixturesRoot, "..", ".."))
 	];
 	return {
 		checks,
@@ -17768,7 +18038,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.17";
+const CLI_VERSION = "0.5.19";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mjolnir-qa",
-  "version": "0.5.17",
+  "version": "0.5.19",
   "description": "Mjölnir — the Verification Trust Engine for QA. Audits test suites and CI pipelines, reports a worthiness score and prioritized findings.",
   "type": "module",
   "engines": {
@@ -30,6 +30,7 @@
     "format": "prettier --write .",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json && tsx scripts/typecheck-fixtures.ts",
     "golden:update": "tsx tests/golden/gen.ts",
+    "detector-hashes:update": "tsx scripts/generate-detector-hashes.ts",
     "corpus:regression": "tsx tests/corpus/audit.ts",
     "corpus:regression:update": "tsx tests/corpus/audit.ts --update",
     "corpus:sample": "tsx scripts/corpus-sample.ts",