mjolnir-qa 0.5.19 → 0.5.20

package/CHANGELOG.md

@@ -9,6 +9,12 @@ Rule behavior changes (new rules, FP-rate changes against the corpus,
 severity changes) are first-class entries here — rule IDs are immutable
 once shipped, so this file is the record of what changed between versions.
 
+## [0.5.20] — 2026-09-07
+
+### Changes since 0.5.19
+
+- Doctor status model + --json contract + certification CI gate (Phase 5, G2/G5/G6) (#55)
+
 ## [0.5.19] — 2026-09-07
 
 ### Changes since 0.5.18

package/dist/cli.d.mts

@@ -687,6 +687,26 @@ declare function isValidFindingRecord$1(f: unknown): f is Omit<Finding, "ruleId"
  */
 declare function runScan$1(args: CliArgs, hooks?: ScanHooks): Promise<ScanResult>;
 //#endregion
+//#region src/cli-io.d.ts
+/**
+ * Shared process IO sinks (certification-audit Phase 5, G6): the variadic
+ * console sinks and the internal-error reporter lived in cli.ts, which
+ * made every command module that wanted honest IO depend on the dispatch
+ * table (or duplicate it). Extracted so command modules (doctor-run et
+ * al.) and cli.ts share ONE implementation.
+ */
+/** The variadic IO signature shared by all command handlers. */
+type Output = (...parts: unknown[]) => void;
+declare const out: Output;
+declare const err: Output;
+declare function internalErrorMessage(err: unknown, emit: (s: string) => void, debug: boolean): void;
+//#endregion
+//#region src/commands/doctor-run.d.ts
+declare function runDoctorCommand(argv: string[], io?: {
+  out: Output;
+  err: Output;
+}): number;
+//#endregion
 //#region src/cli.d.ts
 declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniversalRules$1, fallbackWorkspace: typeof fallbackWorkspace$1, pathMatchesGlob: typeof pathMatchesGlob$1, isValidFindingRecord: typeof isValidFindingRecord$1, discoverRuntimeReport: typeof discoverRuntimeReport$1, KNOWN_RULE_IDS: ReadonlySet<string>, OVERLAP_META_BY_RULE_ID: ReadonlyMap<string, OverlapMeta>, EVIDENCE_OVERRIDES: ReadonlyMap<string, string>, SUITE_INVALIDATING_RULE_IDS: ReadonlySet<string>;
 /**
@@ -699,7 +719,7 @@ declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniver
  * `scripts/sync-sarif-version.cjs` on release and guarded by
  * `tests/version-consistency.spec.ts` locally.
  */
-declare const CLI_VERSION = "0.5.19";
+declare const CLI_VERSION = "0.5.20";
 /** A usage-error detail: the offending token, when one exists. */
 interface UsageErrorDetail {
   /** The unknown flag or rejected value (e.g. `--nope`, `loud`). */
@@ -718,9 +738,6 @@ declare function nearestFlags(flag: string, max?: number): string[];
  * to stderr; findings/usage stay on their documented streams.
  */
 declare function usageErrorMessage(detail: UsageErrorDetail): string;
-type Output = (...parts: unknown[]) => void;
-declare const out: Output;
-declare const err: Output;
 /** Testable `ci install` handler. Returns the process exit code. */
 declare function runCiInstall(argv: string[], io?: {
   out: Output;
@@ -741,11 +758,6 @@ declare function runDoctorPlaywright(argv: string[], io?: {
   out: Output;
   err?: Output;
 }): Promise<number>;
-/** Testable `doctor` handler — self-audit of Mjölnir's own rule base. */
-declare function runDoctorCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): number;
 /** Testable `rules` handler — rule catalog with Trust Metadata. */
 declare function runRulesCommand(argv: string[], io?: {
   out: Output;
@@ -852,15 +864,6 @@ declare function runHelpCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): number;
-/**
- * Friendly exit-20 path (plan M2): the crash says it's Mjölnir's bug,
- * not the user's repo, carries the underlying message for a report, and
- * prints the stack ONLY when `debug` is set (uniform across
- * subcommands — they don't parse scan flags). Tests pin
- * /internal error/i. Exported so the --debug stack arm is directly
- * spec-coverable (spawning a real crash under --debug would be flaky).
- */
-declare function internalErrorMessage(err: unknown, emit: (s: string) => void, debug: boolean): void;
 declare function isEntryPoint(): boolean;
 //#endregion
-export { CLI_VERSION, type CliArgs, EVIDENCE_OVERRIDES, KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID, Output, SUITE_INVALIDATING_RULE_IDS, type ScanHooks, UsageErrorDetail, buildUniversalRules, discoverRuntimeReport, err, exitForFindings, fallbackWorkspace, internalErrorMessage, isEntryPoint, isValidFindingRecord, levenshtein, main, nearestFlags, out, parseArgs, pathMatchesGlob, runBadgeCommand, runBaselineCommand, runCiInstall, runCreateRuleCommand, runDebtCommand, runDiffCommand, runDoctorCommand, runDoctorPlaywright, runExplainCommand, runFixCommand, runForensicsCommand, runHandoverCommand, runHelpCommand, runImpactCommand, runInitCommand, runPrCommentCommand, runPwReportCommand, runRulesCommand, runScan, runScanCommand, runStatsCommand, runSuppressions, runTriageCommand, usageErrorMessage };
+export { CLI_VERSION, type CliArgs, EVIDENCE_OVERRIDES, KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID, type Output, SUITE_INVALIDATING_RULE_IDS, type ScanHooks, UsageErrorDetail, buildUniversalRules, discoverRuntimeReport, err, exitForFindings, fallbackWorkspace, internalErrorMessage, isEntryPoint, isValidFindingRecord, levenshtein, main, nearestFlags, out, parseArgs, pathMatchesGlob, runBadgeCommand, runBaselineCommand, runCiInstall, runCreateRuleCommand, runDebtCommand, runDiffCommand, runDoctorCommand, runDoctorPlaywright, runExplainCommand, runFixCommand, runForensicsCommand, runHandoverCommand, runHelpCommand, runImpactCommand, runInitCommand, runPrCommentCommand, runPwReportCommand, runRulesCommand, runScan, runScanCommand, runStatsCommand, runSuppressions, runTriageCommand, usageErrorMessage };

package/dist/cli.mjs

@@ -13264,7 +13264,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.19",
+			version: "0.5.20",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -17630,6 +17630,18 @@ function renderFixReport(results, dryRun) {
 	return lines.join("\n");
 }
 //#endregion
+//#region src/cli-io.ts
+const out = (...parts) => console.log(parts.map(String).join(" "));
+const err = (...parts) => console.error(parts.map(String).join(" "));
+function internalErrorMessage(err, emit, debug) {
+	const message = err instanceof Error ? err.message : String(err);
+	emit("mjolnir internal error — this is a bug in Mjölnir, not your repo:");
+	emit(`  ${message}`);
+	if (debug && err instanceof Error && err.stack) emit(err.stack);
+	emit("Rerun with --debug for the stack trace. Please report this:");
+	emit("  https://github.com/Sergey-Bar/Mjolnir/issues");
+}
+//#endregion
 //#region src/engine/detector-hash.ts
 /**
 * Detector revision integrity engine (certification-audit Phase 3,
@@ -17837,6 +17849,15 @@ function errorText(e) {
 	return e instanceof Error ? e.message : String(e);
 }
 const ui$1 = plainContext();
+/** Builds the check record: `ok` is always the pass-mirror of `status`. */
+function check(name, status, details) {
+	return {
+		name,
+		status,
+		ok: status === "pass",
+		details
+	};
+}
 const VALID_ID = RULE_ID_RE;
 function nonHiddenFiles(dir) {
 	if (!existsSync(dir)) return [];
@@ -17859,11 +17880,7 @@ function checkFixtureFirewall(fixturesRoot) {
 			details.push(`${rule.id}: missing must-not-fire fixture`);
 		}
 	}
-	return {
-		name: "fixture-firewall",
-		ok,
-		details
-	};
+	return check("fixture-firewall", ok ? "pass" : "fail", details);
 }
 /** Check 2: registry sanity — IDs unique, well-formed, titles distinct. */
 function checkRegistry(rules = RULES) {
@@ -17886,20 +17903,12 @@ function checkRegistry(rules = RULES) {
 			details.push(`"${r.title}": duplicate title in family (${r.id})`);
 		}
 	}
-	return {
-		name: "registry-sanity",
-		ok,
-		details
-	};
+	return check("registry-sanity", ok ? "pass" : "fail", details);
 }
 /** Check 3: Trust Metadata presence (informational until full coverage). */
 function checkTrustMetadata(rules = RULES) {
 	const missing = rules.filter((r) => !r.languages?.length || !r.frameworks?.length || r.falsePositiveRisk === void 0);
-	return {
-		name: "trust-metadata",
-		ok: missing.length === 0,
-		details: missing.map((r) => `${r.id}: missing trust metadata`)
-	};
+	return check("trust-metadata", missing.length === 0 ? "pass" : "fail", missing.map((r) => `${r.id}: missing trust metadata`));
 }
 /**
 * Check 4 (Honesty Core): evidence-level honesty. A rule that claims a
@@ -17918,11 +17927,7 @@ function checkEvidenceHonesty(rules = RULES) {
 			details.push(`${r.id}: declares ${r.evidenceLevel} but findingType=${r.findingType}/confidence=${r.confidence} supports at most ${derived}`);
 		}
 	}
-	return {
-		name: "evidence-honesty",
-		ok,
-		details
-	};
+	return check("evidence-honesty", ok ? "pass" : "fail", details);
 }
 /**
 * Check 5 (Phase 4 — Tempering Plan, ratcheted per audit H-2):
@@ -17963,11 +17968,7 @@ function checkTierEnforcement(verdictsDir, rules = RULES) {
 	const total = coreRules.length;
 	const ok = unmeasured <= 0;
 	details.unshift(ok ? `Ratchet (Law #3): ${unmeasured}/${total} core rules lack a measured FP rate — cap is 0 (Phase 1 closed the unmeasured-core hole)` : `BLOCKING: ${unmeasured}/${total} core rules unmeasured — exceeds the Law #3 ratchet cap of 0`);
-	return {
-		name: "tier-enforcement",
-		ok,
-		details
-	};
+	return check("tier-enforcement", ok ? "pass" : "fail", details);
 }
 /**
 * Check 6 (Phase 7 — Tempering Plan): anti-creep law enforcement.
@@ -17986,11 +17987,7 @@ function checkAntiCreep(rules = RULES) {
 		for (const r of overflow.slice(0, 5)) details.push(`  overflow: ${r.id} — ${r.title}`);
 		if (overflow.length > 5) details.push(`  … and ${overflow.length - 5} more`);
 	} else details.push(`Core tier: ${count}/65 rules (${65 - count} slots available)`);
-	return {
-		name: "anti-creep",
-		ok,
-		details
-	};
+	return check("anti-creep", ok ? "pass" : "fail", details);
 }
 /**
 * Check 7 (audit H-1): quarantine enforcement. The tier policy must cap
@@ -18010,11 +18007,7 @@ function checkQuarantineEnforcement(rules = RULES) {
 		}
 	}
 	details.unshift(`${quarantine.length} quarantine rules capped to severity=info, evidence=E0 — no quarantine rule may emit error`);
-	return {
-		name: "quarantine-enforcement",
-		ok,
-		details
-	};
+	return check("quarantine-enforcement", ok ? "pass" : "fail", details);
 }
 /**
 * Check 8 (certification-audit Phase 2.5, plan G3 Layer A support):
@@ -18067,11 +18060,7 @@ function checkFixtureIntegrity(fixturesRoot, rules = RULES) {
 		details.push("typecheck-allowlist.json is unreadable/malformed");
 	}
 	details.unshift(`fixture trees: ${fixtureDirs} rule dirs, ${fixtureFiles} fixture files — orphaned dirs and empty dirs are blocking`);
-	return {
-		name: "fixture-integrity",
-		ok,
-		details
-	};
+	return check("fixture-integrity", ok ? "pass" : "fail", details);
 }
 /**
 * Check 9 (certification-audit Phase 3.3, G4/D8v2 — HARD-BLOCKING):
@@ -18096,35 +18085,19 @@ function checkRevisionIntegrity(repoRoot, rules = RULES) {
 	const details = [];
 	const manifestPath = join(repoRoot, "tests", "corpus", "detector-hashes.json");
 	const rulesDir = join(repoRoot, "src", "rules");
-	if (!existsSync(manifestPath)) return {
-		name: "revision-integrity",
-		ok: false,
-		details: ["INCONCLUSIVE: tests/corpus/detector-hashes.json is missing — run `npm run detector-hashes:update` (certification-critical: an unevaluable check never renders as pass)"]
-	};
-	if (!existsSync(rulesDir)) return {
-		name: "revision-integrity",
-		ok: false,
-		details: ["INCONCLUSIVE: src/rules is not present (installed package) — detector source identity cannot be verified here"]
-	};
+	if (!existsSync(manifestPath)) return check("revision-integrity", "inconclusive", ["INCONCLUSIVE: tests/corpus/detector-hashes.json is missing — run `npm run detector-hashes:update` (certification-critical: an unevaluable check never renders as pass)"]);
+	if (!existsSync(rulesDir)) return check("revision-integrity", "inconclusive", ["INCONCLUSIVE: src/rules is not present (installed package) — detector source identity cannot be verified here"]);
 	let manifest;
 	try {
 		manifest = loadManifest(manifestPath);
 	} catch {
-		return {
-			name: "revision-integrity",
-			ok: false,
-			details: ["INCONCLUSIVE: tests/corpus/detector-hashes.json is unreadable/malformed — regenerate with `npm run detector-hashes:update`"]
-		};
+		return check("revision-integrity", "inconclusive", ["INCONCLUSIVE: tests/corpus/detector-hashes.json is unreadable/malformed — regenerate with `npm run detector-hashes:update`"]);
 	}
 	let current;
 	try {
 		current = computeDetectorHashes(rules, rulesDir);
 	} catch (e) {
-		return {
-			name: "revision-integrity",
-			ok: false,
-			details: [`INCONCLUSIVE: detector hash computation failed — ${errorText(e)}`]
-		};
+		return check("revision-integrity", "inconclusive", [`INCONCLUSIVE: detector hash computation failed — ${errorText(e)}`]);
 	}
 	const failures = [];
 	for (const rule of rules) {
@@ -18139,18 +18112,10 @@ function checkRevisionIntegrity(repoRoot, rules = RULES) {
 	for (const id of Object.keys(manifest)) if (!rules.some((r) => r.id === id)) failures.push(`${id}: attested in the manifest but not in the registry`);
 	if (failures.length > 0) {
 		details.push(...failures);
-		return {
-			name: "revision-integrity",
-			ok: false,
-			details
-		};
+		return check("revision-integrity", "fail", details);
 	}
 	details.push(`${rules.length} rules attested: source identity and declared revision match the manifest (check A + check B, G4)`);
-	return {
-		name: "revision-integrity",
-		ok: true,
-		details
-	};
+	return check("revision-integrity", "pass", details);
 }
 function runDoctorSelfAudit(fixturesRoot) {
 	const verdictsDir = join(fixturesRoot, "..", "corpus", "verdicts");
@@ -18167,7 +18132,7 @@ function runDoctorSelfAudit(fixturesRoot) {
 	];
 	return {
 		checks,
-		healthy: checks.every((c) => c.ok)
+		healthy: checks.every((c) => c.status === "pass")
 	};
 }
 function renderDoctorReport(report) {
@@ -18177,7 +18142,7 @@ function renderDoctorReport(report) {
 		""
 	];
 	for (const c of report.checks) {
-		const mark = c.ok ? "✓" : "✗";
+		const mark = c.status === "pass" ? "✓" : c.status === "fail" ? "✗" : "? INCONCLUSIVE";
 		lines.push(`${mark} ${c.name}`);
 		for (const d of c.details.slice(0, 20)) lines.push(`    ${d}`);
 		if (c.details.length > 20) lines.push(`    … and ${c.details.length - 20} more`);
@@ -18186,6 +18151,88 @@ function renderDoctorReport(report) {
 	lines.push(report.healthy ? "Mjölnir self-audit: WORTHY" : "Mjölnir self-audit: VIOLATIONS FOUND");
 	return lines.join("\n");
 }
+/** Versioned JSON schema name for `doctor --json` (G5). */
+const DOCTOR_REPORT_SCHEMA = "mjolnir.doctor-report@1";
+/**
+* Serializes the doctor report to the machine-readable contract (Phase 5,
+* G5): versioned `schema` field, stable key order (constructed once, here),
+* details limited exactly like the text render, paths already POSIX-relative
+* (the checks build them that way), and byte-identical across two runs on
+* the same tree — the CI certification job re-runs the command twice and
+* diffs, so any nondeterminism fails there.
+*/
+function doctorReportJson(report, opts = {}) {
+	const maxDetails = opts.maxDetails ?? 20;
+	const summary = {
+		pass: 0,
+		fail: 0,
+		inconclusive: 0
+	};
+	const checks = report.checks.map((c) => {
+		summary[c.status]++;
+		return {
+			name: c.name,
+			status: c.status,
+			ok: c.ok,
+			details: c.details.length > maxDetails ? [...c.details.slice(0, maxDetails), `… and ${c.details.length - maxDetails} more`] : c.details
+		};
+	});
+	return {
+		schema: DOCTOR_REPORT_SCHEMA,
+		healthy: report.healthy,
+		summary,
+		checks
+	};
+}
+//#endregion
+//#region src/commands/doctor-run.ts
+/**
+* Doctor CLI entry (certification-audit Phase 5, G6): the command handler
+* lives beside the check implementations instead of in cli.ts — the CLI
+* file is a dispatch table, not a business-logic home.
+*
+* Exit-code contract (stable, e2e-locked):
+*   0  — WORTHY (every check pass)
+*   1  — VIOLATIONS FOUND (any fail OR inconclusive — G2: an
+*        INCONCLUSIVE check never renders as pass, in text or JSON, and
+*        never exits 0)
+*   2  — no fixtures directory at the target (not an mjolnir checkout)
+*   10 — usage error (unknown flag / flag-shaped positional)
+*   20 — internal error (crash; --debug prints the stack)
+*
+* `--json`: prints the versioned machine contract (doctorReportJson)
+* instead of the text render. stdout carries EXACTLY the JSON document —
+* no banners, no progress lines — so `doctor . --json > report.json` is
+* a clean file. The exit code is the gate; the JSON is the evidence.
+*/
+function runDoctorCommand(argv, io = {
+	out,
+	err
+}) {
+	const json = argv.includes("--json");
+	if (argv.filter((a) => a.startsWith("-") && a !== "--json").length > 0) {
+		io.err("Usage: mjolnir doctor [--json] [repo-root]");
+		return 10;
+	}
+	const targetArg = argv.find((a) => !a.startsWith("-")) ?? process.cwd();
+	try {
+		const fixturesRoot = resolve(join(targetArg, "tests", "fixtures"));
+		if (!existsSync(fixturesRoot)) {
+			io.err(`No fixtures directory at ${fixturesRoot}. Run from the mjolnir repo root.`);
+			return 2;
+		}
+		const report = runDoctorSelfAudit(fixturesRoot);
+		if (json) {
+			io.out(JSON.stringify(doctorReportJson(report), null, 2));
+			return report.healthy ? 0 : 1;
+		}
+		io.out(renderDoctorReport(report));
+		return report.healthy ? 0 : 1;
+	} catch (err) {
+		internalErrorMessage(err, io.err, process.argv.includes("--debug"));
+		return 20;
+	}
+}
 //#endregion
 //#region src/commands/rules-catalog.ts
 /**
@@ -18402,7 +18449,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.19";
+const CLI_VERSION = "0.5.20";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",
@@ -18567,8 +18614,6 @@ function parseArgsOrUsage(argv, io) {
 	if (!args && !reported) printUsage(io.out);
 	return args;
 }
-const out = (...parts) => console.log(parts.map(String).join(" "));
-const err = (...parts) => console.error(parts.map(String).join(" "));
 /** Testable `ci install` handler. Returns the process exit code. */
 function runCiInstall(argv, io = {
 	out,
@@ -18690,30 +18735,6 @@ async function runDoctorPlaywright(argv, io = { out }) {
 		return 20;
 	}
 }
-/** Testable `doctor` handler — self-audit of Mjölnir's own rule base. */
-function runDoctorCommand(argv, io = {
-	out,
-	err
-}) {
-	if (argv.some((a) => a.startsWith("-"))) {
-		io.err("Usage: mjolnir doctor [repo-root]");
-		return 10;
-	}
-	const targetArg = argv[0] ?? process$1.cwd();
-	try {
-		const fixturesRoot = resolve(join(targetArg, "tests", "fixtures"));
-		if (!existsSync(fixturesRoot)) {
-			io.err(`No fixtures directory at ${fixturesRoot}. Run from the mjolnir repo root.`);
-			return 2;
-		}
-		const report = runDoctorSelfAudit(fixturesRoot);
-		io.out(renderDoctorReport(report));
-		return report.healthy ? 0 : 1;
-	} catch (err) {
-		internalErrorMessage(err, io.err, process$1.argv.includes("--debug"));
-		return 20;
-	}
-}
 /** Testable `rules` handler — rule catalog with Trust Metadata. */
 async function runRulesCommand(argv, io = {
 	out,
@@ -19349,22 +19370,6 @@ function runHelpCommand(argv, io = {
 function printUsage(print) {
 	print(renderRootHelp());
 }
-/**
-* Friendly exit-20 path (plan M2): the crash says it's Mjölnir's bug,
-* not the user's repo, carries the underlying message for a report, and
-* prints the stack ONLY when `debug` is set (uniform across
-* subcommands — they don't parse scan flags). Tests pin
-* /internal error/i. Exported so the --debug stack arm is directly
-* spec-coverable (spawning a real crash under --debug would be flaky).
-*/
-function internalErrorMessage(err, emit, debug) {
-	const message = err instanceof Error ? err.message : String(err);
-	emit("mjolnir internal error — this is a bug in Mjölnir, not your repo:");
-	emit(`  ${message}`);
-	if (debug && err instanceof Error && err.stack) emit(err.stack);
-	emit("Rerun with --debug for the stack trace. Please report this:");
-	emit("  https://github.com/Sergey-Bar/Mjolnir/issues");
-}
 function isEntryPoint() {
 	const argv1 = process$1.argv[1];
 	if (!argv1) return false;

package/dist/mcp/stdio.mjs

@@ -13263,7 +13263,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.19",
+			version: "0.5.20",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -17084,6 +17084,18 @@ function renderFixReport(results, dryRun) {
 	return lines.join("\n");
 }
 //#endregion
+//#region src/cli-io.ts
+const out = (...parts) => console.log(parts.map(String).join(" "));
+const err = (...parts) => console.error(parts.map(String).join(" "));
+function internalErrorMessage(err, emit, debug) {
+	const message = err instanceof Error ? err.message : String(err);
+	emit("mjolnir internal error — this is a bug in Mjölnir, not your repo:");
+	emit(`  ${message}`);
+	if (debug && err instanceof Error && err.stack) emit(err.stack);
+	emit("Rerun with --debug for the stack trace. Please report this:");
+	emit("  https://github.com/Sergey-Bar/Mjolnir/issues");
+}
+//#endregion
 //#region src/rules/measurement.ts
 /** The rule's declared detector implementation revision (§07). */
 function declaredDetectorRevision(rule) {
@@ -17319,6 +17331,15 @@ function errorText(e) {
 	return e instanceof Error ? e.message : String(e);
 }
 const ui$2 = plainContext();
+/** Builds the check record: `ok` is always the pass-mirror of `status`. */
+function check(name, status, details) {
+	return {
+		name,
+		status,
+		ok: status === "pass",
+		details
+	};
+}
 const VALID_ID = RULE_ID_RE;
 function nonHiddenFiles(dir) {
 	if (!existsSync(dir)) return [];
@@ -17341,11 +17362,7 @@ function checkFixtureFirewall(fixturesRoot) {
 			details.push(`${rule.id}: missing must-not-fire fixture`);
 		}
 	}
-	return {
-		name: "fixture-firewall",
-		ok,
-		details
-	};
+	return check("fixture-firewall", ok ? "pass" : "fail", details);
 }
 /** Check 2: registry sanity — IDs unique, well-formed, titles distinct. */
 function checkRegistry(rules = RULES) {
@@ -17368,20 +17385,12 @@ function checkRegistry(rules = RULES) {
 			details.push(`"${r.title}": duplicate title in family (${r.id})`);
 		}
 	}
-	return {
-		name: "registry-sanity",
-		ok,
-		details
-	};
+	return check("registry-sanity", ok ? "pass" : "fail", details);
 }
 /** Check 3: Trust Metadata presence (informational until full coverage). */
 function checkTrustMetadata(rules = RULES) {
 	const missing = rules.filter((r) => !r.languages?.length || !r.frameworks?.length || r.falsePositiveRisk === void 0);
-	return {
-		name: "trust-metadata",
-		ok: missing.length === 0,
-		details: missing.map((r) => `${r.id}: missing trust metadata`)
-	};
+	return check("trust-metadata", missing.length === 0 ? "pass" : "fail", missing.map((r) => `${r.id}: missing trust metadata`));
 }
 /**
 * Check 4 (Honesty Core): evidence-level honesty. A rule that claims a
@@ -17400,11 +17409,7 @@ function checkEvidenceHonesty(rules = RULES) {
 			details.push(`${r.id}: declares ${r.evidenceLevel} but findingType=${r.findingType}/confidence=${r.confidence} supports at most ${derived}`);
 		}
 	}
-	return {
-		name: "evidence-honesty",
-		ok,
-		details
-	};
+	return check("evidence-honesty", ok ? "pass" : "fail", details);
 }
 /**
 * Check 5 (Phase 4 — Tempering Plan, ratcheted per audit H-2):
@@ -17445,11 +17450,7 @@ function checkTierEnforcement(verdictsDir, rules = RULES) {
 	const total = coreRules.length;
 	const ok = unmeasured <= 0;
 	details.unshift(ok ? `Ratchet (Law #3): ${unmeasured}/${total} core rules lack a measured FP rate — cap is 0 (Phase 1 closed the unmeasured-core hole)` : `BLOCKING: ${unmeasured}/${total} core rules unmeasured — exceeds the Law #3 ratchet cap of 0`);
-	return {
-		name: "tier-enforcement",
-		ok,
-		details
-	};
+	return check("tier-enforcement", ok ? "pass" : "fail", details);
 }
 /**
 * Check 6 (Phase 7 — Tempering Plan): anti-creep law enforcement.
@@ -17468,11 +17469,7 @@ function checkAntiCreep(rules = RULES) {
 		for (const r of overflow.slice(0, 5)) details.push(`  overflow: ${r.id} — ${r.title}`);
 		if (overflow.length > 5) details.push(`  … and ${overflow.length - 5} more`);
 	} else details.push(`Core tier: ${count}/65 rules (${65 - count} slots available)`);
-	return {
-		name: "anti-creep",
-		ok,
-		details
-	};
+	return check("anti-creep", ok ? "pass" : "fail", details);
 }
 /**
 * Check 7 (audit H-1): quarantine enforcement. The tier policy must cap
@@ -17492,11 +17489,7 @@ function checkQuarantineEnforcement(rules = RULES) {
 		}
 	}
 	details.unshift(`${quarantine.length} quarantine rules capped to severity=info, evidence=E0 — no quarantine rule may emit error`);
-	return {
-		name: "quarantine-enforcement",
-		ok,
-		details
-	};
+	return check("quarantine-enforcement", ok ? "pass" : "fail", details);
 }
 /**
 * Check 8 (certification-audit Phase 2.5, plan G3 Layer A support):
@@ -17549,11 +17542,7 @@ function checkFixtureIntegrity(fixturesRoot, rules = RULES) {
 		details.push("typecheck-allowlist.json is unreadable/malformed");
 	}
 	details.unshift(`fixture trees: ${fixtureDirs} rule dirs, ${fixtureFiles} fixture files — orphaned dirs and empty dirs are blocking`);
-	return {
-		name: "fixture-integrity",
-		ok,
-		details
-	};
+	return check("fixture-integrity", ok ? "pass" : "fail", details);
 }
 /**
 * Check 9 (certification-audit Phase 3.3, G4/D8v2 — HARD-BLOCKING):
@@ -17578,35 +17567,19 @@ function checkRevisionIntegrity(repoRoot, rules = RULES) {
 	const details = [];
 	const manifestPath = join(repoRoot, "tests", "corpus", "detector-hashes.json");
 	const rulesDir = join(repoRoot, "src", "rules");
-	if (!existsSync(manifestPath)) return {
-		name: "revision-integrity",
-		ok: false,
-		details: ["INCONCLUSIVE: tests/corpus/detector-hashes.json is missing — run `npm run detector-hashes:update` (certification-critical: an unevaluable check never renders as pass)"]
-	};
-	if (!existsSync(rulesDir)) return {
-		name: "revision-integrity",
-		ok: false,
-		details: ["INCONCLUSIVE: src/rules is not present (installed package) — detector source identity cannot be verified here"]
-	};
+	if (!existsSync(manifestPath)) return check("revision-integrity", "inconclusive", ["INCONCLUSIVE: tests/corpus/detector-hashes.json is missing — run `npm run detector-hashes:update` (certification-critical: an unevaluable check never renders as pass)"]);
+	if (!existsSync(rulesDir)) return check("revision-integrity", "inconclusive", ["INCONCLUSIVE: src/rules is not present (installed package) — detector source identity cannot be verified here"]);
 	let manifest;
 	try {
 		manifest = loadManifest(manifestPath);
 	} catch {
-		return {
-			name: "revision-integrity",
-			ok: false,
-			details: ["INCONCLUSIVE: tests/corpus/detector-hashes.json is unreadable/malformed — regenerate with `npm run detector-hashes:update`"]
-		};
+		return check("revision-integrity", "inconclusive", ["INCONCLUSIVE: tests/corpus/detector-hashes.json is unreadable/malformed — regenerate with `npm run detector-hashes:update`"]);
 	}
 	let current;
 	try {
 		current = computeDetectorHashes(rules, rulesDir);
 	} catch (e) {
-		return {
-			name: "revision-integrity",
-			ok: false,
-			details: [`INCONCLUSIVE: detector hash computation failed — ${errorText(e)}`]
-		};
+		return check("revision-integrity", "inconclusive", [`INCONCLUSIVE: detector hash computation failed — ${errorText(e)}`]);
 	}
 	const failures = [];
 	for (const rule of rules) {
@@ -17621,18 +17594,10 @@ function checkRevisionIntegrity(repoRoot, rules = RULES) {
 	for (const id of Object.keys(manifest)) if (!rules.some((r) => r.id === id)) failures.push(`${id}: attested in the manifest but not in the registry`);
 	if (failures.length > 0) {
 		details.push(...failures);
-		return {
-			name: "revision-integrity",
-			ok: false,
-			details
-		};
+		return check("revision-integrity", "fail", details);
 	}
 	details.push(`${rules.length} rules attested: source identity and declared revision match the manifest (check A + check B, G4)`);
-	return {
-		name: "revision-integrity",
-		ok: true,
-		details
-	};
+	return check("revision-integrity", "pass", details);
 }
 function runDoctorSelfAudit(fixturesRoot) {
 	const verdictsDir = join(fixturesRoot, "..", "corpus", "verdicts");
@@ -17649,7 +17614,7 @@ function runDoctorSelfAudit(fixturesRoot) {
 	];
 	return {
 		checks,
-		healthy: checks.every((c) => c.ok)
+		healthy: checks.every((c) => c.status === "pass")
 	};
 }
 function renderDoctorReport(report) {
@@ -17659,7 +17624,7 @@ function renderDoctorReport(report) {
 		""
 	];
 	for (const c of report.checks) {
-		const mark = c.ok ? "✓" : "✗";
+		const mark = c.status === "pass" ? "✓" : c.status === "fail" ? "✗" : "? INCONCLUSIVE";
 		lines.push(`${mark} ${c.name}`);
 		for (const d of c.details.slice(0, 20)) lines.push(`    ${d}`);
 		if (c.details.length > 20) lines.push(`    … and ${c.details.length - 20} more`);
@@ -17668,6 +17633,88 @@ function renderDoctorReport(report) {
 	lines.push(report.healthy ? "Mjölnir self-audit: WORTHY" : "Mjölnir self-audit: VIOLATIONS FOUND");
 	return lines.join("\n");
 }
+/** Versioned JSON schema name for `doctor --json` (G5). */
+const DOCTOR_REPORT_SCHEMA = "mjolnir.doctor-report@1";
+/**
+* Serializes the doctor report to the machine-readable contract (Phase 5,
+* G5): versioned `schema` field, stable key order (constructed once, here),
+* details limited exactly like the text render, paths already POSIX-relative
+* (the checks build them that way), and byte-identical across two runs on
+* the same tree — the CI certification job re-runs the command twice and
+* diffs, so any nondeterminism fails there.
+*/
+function doctorReportJson(report, opts = {}) {
+	const maxDetails = opts.maxDetails ?? 20;
+	const summary = {
+		pass: 0,
+		fail: 0,
+		inconclusive: 0
+	};
+	const checks = report.checks.map((c) => {
+		summary[c.status]++;
+		return {
+			name: c.name,
+			status: c.status,
+			ok: c.ok,
+			details: c.details.length > maxDetails ? [...c.details.slice(0, maxDetails), `… and ${c.details.length - maxDetails} more`] : c.details
+		};
+	});
+	return {
+		schema: DOCTOR_REPORT_SCHEMA,
+		healthy: report.healthy,
+		summary,
+		checks
+	};
+}
+//#endregion
+//#region src/commands/doctor-run.ts
+/**
+* Doctor CLI entry (certification-audit Phase 5, G6): the command handler
+* lives beside the check implementations instead of in cli.ts — the CLI
+* file is a dispatch table, not a business-logic home.
+*
+* Exit-code contract (stable, e2e-locked):
+*   0  — WORTHY (every check pass)
+*   1  — VIOLATIONS FOUND (any fail OR inconclusive — G2: an
+*        INCONCLUSIVE check never renders as pass, in text or JSON, and
+*        never exits 0)
+*   2  — no fixtures directory at the target (not an mjolnir checkout)
+*   10 — usage error (unknown flag / flag-shaped positional)
+*   20 — internal error (crash; --debug prints the stack)
+*
+* `--json`: prints the versioned machine contract (doctorReportJson)
+* instead of the text render. stdout carries EXACTLY the JSON document —
+* no banners, no progress lines — so `doctor . --json > report.json` is
+* a clean file. The exit code is the gate; the JSON is the evidence.
+*/
+function runDoctorCommand(argv, io = {
+	out,
+	err
+}) {
+	const json = argv.includes("--json");
+	if (argv.filter((a) => a.startsWith("-") && a !== "--json").length > 0) {
+		io.err("Usage: mjolnir doctor [--json] [repo-root]");
+		return 10;
+	}
+	const targetArg = argv.find((a) => !a.startsWith("-")) ?? process.cwd();
+	try {
+		const fixturesRoot = resolve(join(targetArg, "tests", "fixtures"));
+		if (!existsSync(fixturesRoot)) {
+			io.err(`No fixtures directory at ${fixturesRoot}. Run from the mjolnir repo root.`);
+			return 2;
+		}
+		const report = runDoctorSelfAudit(fixturesRoot);
+		if (json) {
+			io.out(JSON.stringify(doctorReportJson(report), null, 2));
+			return report.healthy ? 0 : 1;
+		}
+		io.out(renderDoctorReport(report));
+		return report.healthy ? 0 : 1;
+	} catch (err) {
+		internalErrorMessage(err, io.err, process.argv.includes("--debug"));
+		return 20;
+	}
+}
 //#endregion
 //#region src/commands/rules-catalog.ts
 /**
@@ -18038,7 +18085,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.19";
+const CLI_VERSION = "0.5.20";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",
@@ -18203,8 +18250,6 @@ function parseArgsOrUsage(argv, io) {
 	if (!args && !reported) printUsage(io.out);
 	return args;
 }
-const out = (...parts) => console.log(parts.map(String).join(" "));
-const err = (...parts) => console.error(parts.map(String).join(" "));
 /** Testable `ci install` handler. Returns the process exit code. */
 function runCiInstall(argv, io = {
 	out,
@@ -18326,30 +18371,6 @@ async function runDoctorPlaywright(argv, io = { out }) {
 		return 20;
 	}
 }
-/** Testable `doctor` handler — self-audit of Mjölnir's own rule base. */
-function runDoctorCommand(argv, io = {
-	out,
-	err
-}) {
-	if (argv.some((a) => a.startsWith("-"))) {
-		io.err("Usage: mjolnir doctor [repo-root]");
-		return 10;
-	}
-	const targetArg = argv[0] ?? process$1.cwd();
-	try {
-		const fixturesRoot = resolve(join(targetArg, "tests", "fixtures"));
-		if (!existsSync(fixturesRoot)) {
-			io.err(`No fixtures directory at ${fixturesRoot}. Run from the mjolnir repo root.`);
-			return 2;
-		}
-		const report = runDoctorSelfAudit(fixturesRoot);
-		io.out(renderDoctorReport(report));
-		return report.healthy ? 0 : 1;
-	} catch (err) {
-		internalErrorMessage(err, io.err, process$1.argv.includes("--debug"));
-		return 20;
-	}
-}
 /** Testable `rules` handler — rule catalog with Trust Metadata. */
 async function runRulesCommand(argv, io = {
 	out,
@@ -18985,22 +19006,6 @@ function runHelpCommand(argv, io = {
 function printUsage(print) {
 	print(renderRootHelp());
 }
-/**
-* Friendly exit-20 path (plan M2): the crash says it's Mjölnir's bug,
-* not the user's repo, carries the underlying message for a report, and
-* prints the stack ONLY when `debug` is set (uniform across
-* subcommands — they don't parse scan flags). Tests pin
-* /internal error/i. Exported so the --debug stack arm is directly
-* spec-coverable (spawning a real crash under --debug would be flaky).
-*/
-function internalErrorMessage(err, emit, debug) {
-	const message = err instanceof Error ? err.message : String(err);
-	emit("mjolnir internal error — this is a bug in Mjölnir, not your repo:");
-	emit(`  ${message}`);
-	if (debug && err instanceof Error && err.stack) emit(err.stack);
-	emit("Rerun with --debug for the stack trace. Please report this:");
-	emit("  https://github.com/Sergey-Bar/Mjolnir/issues");
-}
 function isEntryPoint() {
 	const argv1 = process$1.argv[1];
 	if (!argv1) return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mjolnir-qa",
-  "version": "0.5.19",
+  "version": "0.5.20",
   "description": "Mjölnir — the Verification Trust Engine for QA. Audits test suites and CI pipelines, reports a worthiness score and prioritized findings.",
   "type": "module",
   "engines": {