mjolnir-qa 0.5.25 → 0.5.27

package/CHANGELOG.md

@@ -9,6 +9,18 @@ Rule behavior changes (new rules, FP-rate changes against the corpus,
 severity changes) are first-class entries here — rule IDs are immutable
 once shipped, so this file is the record of what changed between versions.
 
+## [0.5.27] — 2026-09-08
+
+### Changes since 0.5.26
+
+- fix(corpus-sample): refuse PARTIAL scans — findings from a truncated scan are not evidence (same refusal as corpus/audit.ts, D14/§19 discipline)
+
+## [0.5.26] — 2026-09-08
+
+### Changes since 0.5.25
+
+- Certification findings remediation: F1-F5 + P3 (plan 1788806598818) (#57)
+
 ## [0.5.25] — 2026-09-08
 
 ### Changes since 0.5.24

package/README.ar.md

@@ -295,7 +295,7 @@ npx mjolnir-qa@latest --scope changed
 [docs/FP-AUDIT.md](docs/FP-AUDIT.md)). الـ21 الأخرى تُشحن على تقدير
 المؤلف. ذيل كل فحص يخبرك كم من القواعد التي _انطلقت_ مقيسة؛ و
 `mjolnir rules --unmeasured` يسرد غير المقيسة؛ وصفحة `mjolnir explain`
-لكل قاعدة تُصرّح بحالتها. ننشر المعدل حتى حين يكون قبيحًا — QA-CS-103
+لكل قاعدة تُصرّح بحالتها. ننشر المعدل حتى حين يكون قبيحًا — QA-PW-107
 يدقّق عند 95% ولذلك هو في الحجر الصحي. تنمية ذلك العدد هي العمل
 المستمر للمشروع.
 

package/README.bn.md

@@ -299,7 +299,7 @@ false-positive ফায়ারওয়াল।
 প্রতিটি স্ক্যানের ফুটার বলে দেয় _ফায়ার_ করা রুলগুলোর কতগুলো পরিমাপকৃত;
 `mjolnir rules --unmeasured` যেগুলো নয় তা তালিকাভুক্ত করে; প্রতিটি রুলের
 `mjolnir explain` পেজ তার অবস্থা জানায়। আমরা হারটি প্রকাশ করি — এমনকি
-কুৎসিত হলেও — QA-CS-103 ৯৫%-এ অডিট হয় এবং এজন্যই কোয়ারেন্টাইনে। সেই
+কুৎসিত হলেও — QA-PW-107 ৯৫%-এ অডিট হয় এবং এজন্যই কোয়ারেন্টাইনে। সেই
 সংখ্যা বাড়ানোই প্রজেক্টের চলমান কাজ।
 
 ### রুল টিয়ার ও ভাষা-পরিপক্বতা

package/README.br.md

@@ -305,7 +305,7 @@ código OSS real** (≥ 10 findings classificados à mão cada; veja
 a estimativa do autor. O rodapé de cada escaneio diz quantas das regras
 _que dispararam_ são medidas; `mjolnir rules --unmeasured` lista as que
 não são; a página `mjolnir explain` de cada regra declara seu status.
-Publicamos a taxa mesmo quando ela é feia — QA-CS-103 audita em 95 % e
+Publicamos a taxa mesmo quando ela é feia — QA-PW-107 audita em 95 % e
 está em quarentena por isso. Fazer esse número crescer é o trabalho contínuo
 do projeto.
 

package/README.bs.md

@@ -297,7 +297,7 @@ OSS kodom** (≥ 10 ručno klasificiranih nalaza svako; vidi
 procjeni. Podnožje svakog skana kaže koliko od _okinutih_ pravila je
 izmjereno; `mjolnir rules --unmeasured` izlista neizmjerena; stranica
 `mjolnir explain` svakog pravila navodi njen status. Objavljujemo stopu
-čak i kad je ružna — QA-CS-103 se audita na 95 % i u karanteni je radi
+čak i kad je ružna — QA-PW-107 se audita na 95 % i u karanteni je radi
 toga. Rast tog broja je neprekidni rad projekta.
 
 ### Tierovi pravila i jezična zrelost

package/README.da.md

@@ -303,7 +303,7 @@ det er false-positive-firewallen.
 estimat. Hver scan-fodnote fortæller, hvor mange af de _udløste_ regler,
 der er målt; `mjolnir rules --unmeasured` lister de uregistrerede; hver
 regels `mjolnir explain`-side angiver dens status. Vi offentliggør
-raten, selv når den er grim — QA-CS-103 auditeres til 95 % og er sat i
+raten, selv når den er grim — QA-PW-107 auditeres til 95 % og er sat i
 karantæne for det. At få det tal til at vokse er projektets fortsatte
 arbejde.
 

package/README.de.md

@@ -308,7 +308,7 @@ Schätzung des Autors. Jeder Scan-Footer sagt dir, wie viele der
 _ausgelösten_ Regeln gemessen sind; `mjolnir rules --unmeasured` listet
 die nicht gemessenen; die `mjolnir explain`-Seite jeder Regel nennt
 ihren Status. Wir veröffentlichen die Rate, selbst wenn sie hässlich
-ist — QA-CS-103 auditiert bei 95 % und ist deshalb quarantäniert. Diese
+ist — QA-PW-107 auditiert bei 95 % und ist deshalb quarantäniert. Diese
 Zahl zu vergrößern ist die fortlaufende Arbeit des Projekts.
 
 ### Regel-Tiers und Sprachreife

package/README.es.md

@@ -305,7 +305,7 @@ código OSS real** (≥ 10 hallazgos clasificados a mano cada una; ver
 estimación del autor. Cada pie de escaneo te dice cuántas de las reglas
 _que se dispararon_ están medidas; `mjolnir rules --unmeasured` lista
 las que no; la página `mjolnir explain` de cada regla declara su
-estado. Publicamos la tasa aunque sea fea — QA-CS-103 audita al 95 % y
+estado. Publicamos la tasa aunque sea fea — QA-PW-107 audita al 95 % y
 está en cuarentena por ello. Hacer crecer esa cifra es el trabajo continuo
 del proyecto.
 

package/README.fr.md

@@ -307,7 +307,7 @@ l'estimation de l'auteur. Chaque pied de scan vous dit combien des
 règles _déclenchées_ sont mesurées ; `mjolnir rules --unmeasured` liste
 celles qui ne le sont pas ; la page `mjolnir explain` de chaque règle
 énonce son statut. Nous publions le taux même quand il est laid —
-QA-CS-103 s'audite à 95 % et est mis en quarantaine pour ça. Faire
+QA-PW-107 s'audite à 95 % et est mis en quarantaine pour ça. Faire
 grandir ce chiffre est le travail continu du projet.
 
 ### Tiers de règles et maturité par langage

package/README.gr.md

@@ -303,7 +303,7 @@ npx mjolnir-qa@latest --scope changed
 _ενεργούς_ κανόνες είναι μετρημένοι· `mjolnir rules --unmeasured`
 παραθέτει τους άμετρητους· η σελίδα `mjolnir explain` κάθε κανόνα
 δηλώνει την κατάστασή του. Δημοσιεύουμε το ποσοστό ακόμα κι όταν είναι
-άσχημο — ο QA-CS-103 αυτοελέγχεται στο 95 % και είναι σε καραντίνα γι'
+άσχημο — ο QA-PW-107 αυτοελέγχεται στο 95 % και είναι σε καραντίνα γι'
 αυτό. Να μεγαλώσει αυτός ο αριθμός είναι η συνεχιζόμενη δουλειά του έργου.
 
 ### Tiers κανόνων και ωριμότητα γλωσσών

package/README.he.md

@@ -294,7 +294,7 @@ npx mjolnir-qa@latest --scope changed
 המחבר. התחתית של כל סריקה אומרת כמה מהכללים ש_ירו_ נמדדו;
 `mjolnir rules --unmeasured` מפרט את אלה שלא; עמוד `mjolnir explain`
 של כל כלל מצהיר על מעמדו. אנחנו מפרסמים את השיעור גם כשהוא מכוער —
-QA-CS-103 נבדק ב‑95% ומצוי בהסגר בגין זה. להגדיל את המספר הזה הוא
+QA-PW-107 נבדק ב‑95% ומצוי בהסגר בגין זה. להגדיל את המספר הזה הוא
 העבודה המתמשכת של הפרויקט.
 
 ### רמות (tiers) של כללים ובשלות לפי שפה

package/README.it.md

@@ -304,7 +304,7 @@ codice OSS** (≥ 10 riscontri classificati a mano ciascuna; vedi
 dell'autore. Ogni footer di scansione dice quante delle regole
 _scattate_ sono misurate; `mjolnir rules --unmeasured` elenca quelle
 che non lo sono; la pagina `mjolnir explain` di ogni regola dichiara il
-suo stato. Pubblichiamo il tasso anche quando è brutto — QA-CS-103 si
+suo stato. Pubblichiamo il tasso anche quando è brutto — QA-PW-107 si
 audita al 95 % ed è in quarantena per questo. Far crescere quel numero è il
 lavoro continuo del progetto.
 

package/README.ja.md

@@ -300,7 +300,7 @@ false-positive 率を備えています**（各ルールにつき手作業で分
 は作者の推定で出荷されます。すべてのスキャンのフッターは、_発火した_
 ルールのうちいくつが測定済みかを教えてくれます。`mjolnir rules --unmeasured`
 は未測定のものを列挙します。各ルールの `mjolnir explain` ページはその
-状態を明言します。率は醜くても公開します——QA-CS-103 は 95% で監査され、
+状態を明言します。率は醜くても公開します——QA-PW-107 は 95% で監査され、
 それゆえ隔離されています。この数字を増やすことが、プロジェクトの継続的
 な仕事です。
 

package/README.ko.md

@@ -298,7 +298,7 @@ npx mjolnir-qa@latest --scope changed
 출시됩니다. 모든 스캔의 바닥글은 _발화한_ 규칙 중 몇 개가 측정되었는지
 말해줍니다; `mjolnir rules --unmeasured`는 측정되지 않은 것들을 나열합니다;
 각 규칙의 `mjolnir explain` 페이지는 그 상태를 명시합니다. 수치가 흉해도
-우리는 비율을 공개합니다 — QA-CS-103은 95%로 감사되었고 그래서 격리
+우리는 비율을 공개합니다 — QA-PW-107은 95%로 감사되었고 그래서 격리
 계층에 있습니다. 그 숫자를 늘려가는 것이 프로젝트의 지속적인 작업입니다.
 
 ### 규칙 계층과 언어 성숙도

package/README.md

@@ -216,8 +216,9 @@ Requires Node.js ≥ 22.18. Works on Windows, macOS, and Linux.
 - **QA / SDET** owning an e2e or integration suite who need evidence the
   suite actually deserves the green checkmark it produces.
 - **Platform / DevEx** teams responsible for CI integrity and release
-  gates — the people who care that a `continue-on-error` never silently
-  turns a red pipeline green.
+  gates — the people who care that a swallowed exit code (`\|\| true`,
+  caught by default) or a `continue-on-error` gate (caught under
+  `--strict`) never silently turns a red pipeline green.
 - **OSS maintainers** who want a cheap, always-on verification gate that
   runs locally and in CI with zero network calls.
 
@@ -246,8 +247,8 @@ frameworks.
 **Use AI review too.** It catches nuance, intent, and design flaws no regex
 can find. Mjölnir catches the structural patterns AI overlooks because they
 look "intentional" — a committed `.only`, a swallowed exit code, a
-`continue-on-error` on a test job. Those aren't bugs that need reasoning;
-they're facts that need scanning.
+`continue-on-error` on a test job (that one under `--strict`). Those aren't
+bugs that need reasoning; they're facts that need scanning.
 
 ---
 
@@ -258,7 +259,7 @@ they're facts that need scanning.
 | ⚖️  | **Worthiness Score** — one number, transparent deduction table, no black box                                      |
 | 🎭  | **Selector Health Score** — grades your Playwright locators, not just your pass rate                              |
 | 🔬  | **Runtime forensics** — reads real Playwright/JUnit run data to catch `TRUE-FLAKE`, not just static guesses       |
-| 🚨  | **CI-integrity rules** — catches `continue-on-error`, `\|\| true`, and other false-green tricks                   |
+| 🚨  | **CI-integrity rules** — catches `\|\| true` by default; `continue-on-error` detection runs under `--strict`      |
 | 🐍  | **All four Playwright bindings** — TypeScript, Python, Java, C#/.NET — plus pytest, JUnit/TestNG and CI workflows |
 | 🔒  | **Local-first** — zero network calls while scanning, zero telemetry, runs in seconds                              |
 
@@ -271,74 +272,77 @@ full catalog lives in [`docs/rules/`](docs/rules/),
 [what it checks](https://sergey-bar.github.io/Mjolnir/guide/what-it-checks),
 or `mjolnir rules --md`.
 
+> **Tier** — `quarantine` rules run only under `--strict` and never gate
+> (capped to info); the severity shown is the authored severity.
+
 <details>
 <summary><strong>Test Hygiene</strong></summary>
 
-| ID          | Rule                                                | Severity |
-| ----------- | --------------------------------------------------- | -------- |
-| QA-TEST-001 | Focused test committed (`.only`, `fit`)             | error    |
-| QA-TEST-002 | Skipped test without justification                  | error    |
-| QA-TEST-002 | Skipped test with tracked justification             | warning  |
-| QA-TEST-003 | Test with no assertions                             | error    |
-| QA-TEST-004 | Hard sleep (`waitForTimeout`, `sleep()`, `delay()`) | warning  |
-| QA-TEST-006 | Retry abuse hiding flakiness                        | warning  |
-| QA-TEST-010 | Empty test body                                     | error    |
+| ID          | Rule                                                | Severity | Tier       |
+| ----------- | --------------------------------------------------- | -------- | ---------- |
+| QA-TEST-001 | Focused test committed (`.only`, `fit`)             | error    | quarantine |
+| QA-TEST-002 | Skipped test without justification                  | error    | quarantine |
+| QA-TEST-002 | Skipped test with tracked justification             | warning  | quarantine |
+| QA-TEST-003 | Test with no assertions                             | error    | quarantine |
+| QA-TEST-004 | Hard sleep (`waitForTimeout`, `sleep()`, `delay()`) | warning  | extended   |
+| QA-TEST-006 | Retry abuse hiding flakiness                        | warning  | quarantine |
+| QA-TEST-010 | Empty test body                                     | error    | quarantine |
 
 </details>
 
 <details>
 <summary><strong>Test Quality</strong></summary>
 
-| ID           | Rule                        | Severity |
-| ------------ | --------------------------- | -------- |
-| QA-TQUAL-001 | Mock-only verification      | info     |
-| QA-TQUAL-002 | Tautological assertion      | error    |
-| QA-TQUAL-009 | Unawaited promise assertion | error    |
-| QA-TQUAL-011 | Commented-out tests         | warning  |
+| ID           | Rule                        | Severity | Tier       |
+| ------------ | --------------------------- | -------- | ---------- |
+| QA-TQUAL-001 | Mock-only verification      | info     | quarantine |
+| QA-TQUAL-002 | Tautological assertion      | error    | quarantine |
+| QA-TQUAL-009 | Unawaited promise assertion | error    | quarantine |
+| QA-TQUAL-011 | Commented-out tests         | warning  | extended   |
 
 </details>
 
 <details>
 <summary><strong>Playwright 🎭</strong></summary>
 
-| ID        | Rule                                     | Severity |
-| --------- | ---------------------------------------- | -------- |
-| QA-PW-002 | Unawaited locator assertion              | error    |
-| QA-PW-003 | `page.pause()` / `test.only()` committed | error    |
-| QA-PW-004 | Brittle CSS/XPath selectors              | warning  |
-| QA-PW-005 | Business logic inside `page.evaluate()`  | info     |
-| QA-PW-114 | Legacy element handles (`page.$`)        | info     |
-| QA-PW-118 | `networkidle` waits (flaky by design)    | info     |
-| QA-PW-123 | Hardcoded environment URLs               | warning  |
+| ID        | Rule                                     | Severity | Tier       |
+| --------- | ---------------------------------------- | -------- | ---------- |
+| QA-PW-002 | Unawaited locator assertion              | error    | core       |
+| QA-PW-003 | `page.pause()` / `test.only()` committed | error    | core       |
+| QA-PW-004 | Brittle CSS/XPath selectors              | warning  | quarantine |
+| QA-PW-005 | Business logic inside `page.evaluate()`  | info     | quarantine |
+| QA-PW-114 | Legacy element handles (`page.$`)        | info     | quarantine |
+| QA-PW-118 | `networkidle` waits (flaky by design)    | info     | quarantine |
+| QA-PW-123 | Hardcoded environment URLs               | warning  | quarantine |
 
 </details>
 
 <details>
 <summary><strong>CI Integrity</strong></summary>
 
-| ID        | Rule                                                              | Severity |
-| --------- | ----------------------------------------------------------------- | -------- |
-| QA-CI-001 | `continue-on-error` masks failures                                | error    |
-| QA-CI-002 | `\|\| true` swallows exit codes                                   | error    |
-| QA-CI-005 | Report consumed but never generated                               | error    |
-| QA-CI-007 | Retry wrappers around tests                                       | warning  |
-| QA-CI-008 | Always-success step masks failures                                | error    |
-| QA-CI-009 | Test exit code not propagated (`\|` without pipefail, `;` chains) | error    |
-| QA-CI-010 | Tests skipped where they must block (skip-on-PR guards)           | error    |
+| ID        | Rule                                                              | Severity | Tier       |
+| --------- | ----------------------------------------------------------------- | -------- | ---------- |
+| QA-CI-001 | `continue-on-error` masks failures                                | error    | quarantine |
+| QA-CI-002 | `\|\| true` swallows exit codes                                   | error    | extended   |
+| QA-CI-005 | Report consumed but never generated                               | error    | quarantine |
+| QA-CI-007 | Retry wrappers around tests                                       | warning  | extended   |
+| QA-CI-008 | Always-success step masks failures                                | error    | quarantine |
+| QA-CI-009 | Test exit code not propagated (`\|` without pipefail, `;` chains) | error    | extended   |
+| QA-CI-010 | Tests skipped where they must block (skip-on-PR guards)           | error    | quarantine |
 
 </details>
 
 <details>
 <summary><strong>Python / pytest 🐍</strong></summary>
 
-| ID        | Rule                                      | Severity |
-| --------- | ----------------------------------------- | -------- |
-| QA-PY-002 | Skipped test (`skip`, non-strict `xfail`) | warning  |
-| QA-PY-003 | Test function with no assertions          | error    |
-| QA-PY-005 | `time.sleep()` in tests                   | warning  |
-| QA-PY-006 | Empty test body (`pass`)                  | info     |
-| QA-PY-010 | Random/time dependence without freeze     | info     |
-| QA-PY-012 | Tautological assertion                    | error    |
+| ID        | Rule                                      | Severity | Tier       |
+| --------- | ----------------------------------------- | -------- | ---------- |
+| QA-PY-002 | Skipped test (`skip`, non-strict `xfail`) | warning  | core       |
+| QA-PY-003 | Test function with no assertions          | error    | quarantine |
+| QA-PY-005 | `time.sleep()` in tests                   | warning  | extended   |
+| QA-PY-006 | Empty test body (`pass`)                  | info     | quarantine |
+| QA-PY-010 | Random/time dependence without freeze     | info     | quarantine |
+| QA-PY-012 | Tautological assertion                    | error    | quarantine |
 
 20 Python rules total (QA-PY-001…012 pytest hygiene + QA-PY-101…108 Playwright-Python).
 
@@ -347,30 +351,30 @@ or `mjolnir rules --md`.
 <details>
 <summary><strong>Java / JUnit · TestNG ☕</strong></summary>
 
-| ID        | Rule                                     | Severity |
-| --------- | ---------------------------------------- | -------- |
-| QA-JV-101 | Disabled test (`@Disabled`)              | warning  |
-| QA-JV-102 | Hard sleep (`Thread.sleep()`)            | warning  |
-| QA-JV-103 | Test method with no assertions           | error    |
-| QA-JV-105 | Playwright `waitForTimeout()` hard sleep | warning  |
-| QA-JV-106 | Brittle selector instead of role locator | warning  |
-| QA-JV-108 | Hardcoded environment URL in test        | info     |
-| QA-JV-111 | Blanket `page.route("**")` mock          | info     |
+| ID        | Rule                                     | Severity | Tier       |
+| --------- | ---------------------------------------- | -------- | ---------- |
+| QA-JV-101 | Disabled test (`@Disabled`)              | warning  | core       |
+| QA-JV-102 | Hard sleep (`Thread.sleep()`)            | warning  | extended   |
+| QA-JV-103 | Test method with no assertions           | error    | extended   |
+| QA-JV-105 | Playwright `waitForTimeout()` hard sleep | warning  | core       |
+| QA-JV-106 | Brittle selector instead of role locator | warning  | quarantine |
+| QA-JV-108 | Hardcoded environment URL in test        | info     | quarantine |
+| QA-JV-111 | Blanket `page.route("**")` mock          | info     | quarantine |
 
 </details>
 
 <details>
 <summary><strong>C# / .NET — NUnit · xUnit · MSTest 🟣</strong></summary>
 
-| ID        | Rule                                       | Severity |
-| --------- | ------------------------------------------ | -------- |
-| QA-CS-101 | Skipped test (`[Ignore]`, `[Fact(Skip=)]`) | warning  |
-| QA-CS-102 | Hard sleep (`Thread.Sleep` / `Task.Delay`) | warning  |
-| QA-CS-103 | Test method with no assertions             | error    |
-| QA-CS-105 | `WaitForTimeoutAsync()` hard sleep         | warning  |
-| QA-CS-106 | Brittle selector instead of role locator   | warning  |
-| QA-CS-108 | Hardcoded environment URL in test          | info     |
-| QA-CS-111 | Blanket `page.RouteAsync("**")` mock       | info     |
+| ID        | Rule                                       | Severity | Tier       |
+| --------- | ------------------------------------------ | -------- | ---------- |
+| QA-CS-101 | Skipped test (`[Ignore]`, `[Fact(Skip=)]`) | warning  | core       |
+| QA-CS-102 | Hard sleep (`Thread.Sleep` / `Task.Delay`) | warning  | core       |
+| QA-CS-103 | Test method with no assertions             | error    | core       |
+| QA-CS-105 | `WaitForTimeoutAsync()` hard sleep         | warning  | extended   |
+| QA-CS-106 | Brittle selector instead of role locator   | warning  | quarantine |
+| QA-CS-108 | Hardcoded environment URL in test          | info     | quarantine |
+| QA-CS-111 | Blanket `page.RouteAsync("**")` mock       | info     | quarantine |
 
 </details>
 
@@ -413,7 +417,7 @@ test failure scheduled for whenever someone touches the markup.
 estimate. Every scan footer tells you how many of the rules that _fired_
 are measured; `mjolnir rules --unmeasured` lists the ones that aren't;
 every rule's `mjolnir explain` page states its status. We publish the rate
-even when it's ugly — QA-CS-103 audits at 95% and is quarantined for it.
+even when it's ugly — QA-PW-107 audits at 95% and is quarantined for it.
 Growing that number is the project's continuing work.
 
 ### Rule tiers and language maturity

package/README.no.md

@@ -302,7 +302,7 @@ det er false-positive-brannmuren.
 forfatterens estimat. Hver skann-fotnote forteller hvor mange av de
 _utløste_ reglene som er målt; `mjolnir rules --unmeasured` lister de
 umålte; hver regels `mjolnir explain`-side angir statusen. Vi publiserer
-raten selv når den er stygg — QA-CS-103 auditeres til 95 % og er satt i
+raten selv når den er stygg — QA-PW-107 auditeres til 95 % og er satt i
 karantene for det. Å få det tallet til å vokse er prosjektets fortsatte
 arbeid.
 

package/README.pl.md

@@ -303,7 +303,7 @@ zob. [docs/FP-AUDIT.md](docs/FP-AUDIT.md)). Pozostałe 21 wychodzi na
 oszacowaniu autora. Stopka każdego skanu mówi, ile z _odpalonych_
 reguł jest zmierzonych; `mjolnir rules --unmeasured` wypisuje
 niezmierzone; strona `mjolnir explain` każdej reguły deklaruje jej
-status. Publikujemy stopę, nawet gdy jest brzydka — QA-CS-103 audytuje
+status. Publikujemy stopę, nawet gdy jest brzydka — QA-PW-107 audytuje
 się na 95 % i za to trafia do kwarantanny. Powiększanie tej liczby to
 stale trwająca praca projektu.
 

package/README.ru.md

@@ -304,7 +304,7 @@ macOS и Linux.
 выходят на оценке автора. Футер каждого скана говорит, сколько из
 _сработавших_ правил измерены; `mjolnir rules --unmeasured` перечисляет
 неизмеренные; страница `mjolnir explain` каждого правила указывает её
-статус. Мы публикуем частоту, даже когда она уродлива — QA-CS-103
+статус. Мы публикуем частоту, даже когда она уродлива — QA-PW-107
 аудируется на 95 % и за это отправлен в карантин. Увеличивать это
 число — постоянная работа проекта.
 

package/README.th.md

@@ -295,7 +295,7 @@ fixture ลบของตัวเองจะปล่อยไม่ได้
 [docs/FP-AUDIT.md](docs/FP-AUDIT.md)) อีก 21 กฎออกมาบนการประเมินของผู้เขียน
 ส่วนท้ายของทุกการสแกนบอกว่ากฎที่ _ยิง_ มีกี่กฎที่วัดแล้ว;
 `mjolnir rules --unmeasured` แสดงกฎที่ยังไม่วัด; หน้า `mjolnir explain`
-ของทุกกฎระบุสถานะ เราเผยแพร่อัตรานี้แม้มันจะน่าเกลียด — QA-CS-103 ตรวจได้
+ของทุกกฎระบุสถานะ เราเผยแพร่อัตรานี้แม้มันจะน่าเกลียด — QA-PW-107 ตรวจได้
 ที่ 95 % และถูกส่งไปกักกันเพราะเหตุนี้ การทำให้ตัวเลขนั้นโตขึ้นคืองาน
 ต่อเนื่องของโปรเจกต์
 

package/README.tr.md

@@ -300,7 +300,7 @@ oranı taşıyor** (her biri için ≥ 10 elle sınıflandırılmış bulgu; bkz
 yayına giriyor. Her tarama alt bilgisi, _tetiklenen_ kuralların kaçının
 ölçüldüğünü söyler; `mjolnir rules --unmeasured` ölçülmeyenleri listeler;
 her kuralın `mjolnir explain` sayfası durumunu belirtir. Oranı çirkin
-olduğunda bile yayımlarız — QA-CS-103 %95 ile denetleniyor ve bu yüzden
+olduğunda bile yayımlarız — QA-PW-107 %95 ile denetleniyor ve bu yüzden
 karantinada. O sayıyı büyütmek, projenin süregelen işidir.
 
 ### Kural katmanları ve dil olgunluğu

package/README.uk.md

@@ -302,7 +302,7 @@ OSS-коді** (по ≥ 10 вручну класифікованих знахі
 автора. Футер кожного скана каже, скільки із _спрацьованих_ правил
 виміряно; `mjolnir rules --unmeasured` перелічує невиміряні; сторінка
 `mjolnir explain` кожного правила вказує її статус. Ми публікуємо
-частоту, навіть коли вона негарна — QA-CS-103 аудитується на 95 % і за
+частоту, навіть коли вона негарна — QA-PW-107 аудитується на 95 % і за
 це відправлено в карантин. Збільшувати це число — постійна робота проєкту.
 
 ### Тіри правил і зрілість мов

package/README.vi.md

@@ -298,7 +298,7 @@ thật** (≥ 10 finding được phân loại tay mỗi quy tắc; xem
 ước lượng của tác giả. Chân mỗi bản quét cho biết bao nhiêu quy tắc
 _đã bắn_ được đo; `mjolnir rules --unmeasured` liệt kê những quy tắc
 chưa đo; trang `mjolnir explain` của từng quy tắc nêu trạng thái. Chúng
-tôi công bố tỷ lệ kể cả khi nó xấu xí — QA-CS-103 kiểm toán ở mức 95 %
+tôi công bố tỷ lệ kể cả khi nó xấu xí — QA-PW-107 kiểm toán ở mức 95 %
 và bị cách ly vì thế. Mở rộng con số đó là công việc liên tục của
 dự án.
 

package/README.zh.md

@@ -292,7 +292,7 @@ npx mjolnir-qa@latest --scope changed
 作者的估计发布。每次扫描的页脚都会告诉你，_触发过的_ 规则中有多少经过
 测量；`mjolnir rules --unmeasured` 列出未测量的；每条规则的
 `mjolnir explain` 页面都声明其状态。即使数字难看我们也照样公布——
-QA-CS-103 的实测假阳性率是 95%，因此被隔离。把这个数字扩大，是项目的
+QA-PW-107 的实测假阳性率是 95%，因此被隔离。把这个数字扩大，是项目的
 持续性工作。
 
 ### 规则层级与语言成熟度

package/README.zht.md

@@ -292,7 +292,7 @@ npx mjolnir-qa@latest --scope changed
 作者的估計發布。每次掃描的頁尾都會告訴你，_觸發過的_ 規則中有多少經過
 測量；`mjolnir rules --unmeasured` 列出未測量的；每條規則的
 `mjolnir explain` 頁面都聲明其狀態。即使數字難看我們也照樣公布——
-QA-CS-103 的實測假陽性率是 95%，因此被隔離。把這個數字擴大，是專案的
+QA-PW-107 的實測假陽性率是 95%，因此被隔離。把這個數字擴大，是專案的
 持續性工作。
 
 ### 規則層級與語言成熟度

package/dist/cli.d.mts

@@ -728,7 +728,7 @@ declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniver
  * `scripts/sync-sarif-version.cjs` on release and guarded by
  * `tests/version-consistency.spec.ts` locally.
  */
-declare const CLI_VERSION = "0.5.25";
+declare const CLI_VERSION = "0.5.27";
 /** A usage-error detail: the offending token, when one exists. */
 interface UsageErrorDetail {
   /** The unknown flag or rejected value (e.g. `--nope`, `loud`). */

package/dist/cli.mjs

@@ -13290,7 +13290,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.25",
+			version: "0.5.27",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -13356,7 +13356,7 @@ function renderSarif(result, repoRootUri) {
 		].join("."),
 		runs: [repoRootUri ? {
 			...run,
-			originalUriBaseIds: { SRCROOT: { uri: repoRootUri.replaceAll("\\", "/").split("/").map((seg) => seg === "" ? "" : encodeURI(seg).replaceAll("#", "%23").replaceAll("?", "%3F")).join("/") } }
+			originalUriBaseIds: { SRCROOT: { uri: repoRootUri.replaceAll("\\", "/").split("/").map((seg) => seg === "" ? "" : encodeURI(seg).replaceAll("%25", "%").replaceAll("#", "%23").replaceAll("?", "%3F")).join("/") } }
 		} : run]
 	};
 	return JSON.stringify(sarif, null, 2);
@@ -13742,7 +13742,11 @@ function errorText$1(err) {
 /**
 * Parse-and-validate a saved report. Throws Error with a
 * human-explanatory message on: invalid JSON, non-object document,
-* wrong schemaVersion, missing findings array.
+* wrong schemaVersion, missing findings array, missing frameworks
+* array (certification F1: a schema-1 report is MORE than
+* `{schemaVersion, findings}` — summary/handoff/why read
+* `result.frameworks`, so a schema-incomplete stub must be rejected
+* HERE, by the one shared loader, not crash downstream).
 */
 function validateReportJson(text) {
 	let parsed;
@@ -13755,6 +13759,7 @@ function validateReportJson(text) {
 	const doc = parsed;
 	if (doc.schemaVersion !== 1) throw new Error(`unsupported schemaVersion ${JSON.stringify(doc.schemaVersion)} — expected 1`);
 	if (!Array.isArray(doc.findings)) throw new Error("missing a \"findings\" array — is this a Mjölnir --json report?");
+	if (!Array.isArray(doc.frameworks)) throw new Error("missing a \"frameworks\" array — is this a complete Mjölnir --json report?");
 	return parsed;
 }
 /** Load + validate a saved report from disk. Throws on any problem. */
@@ -16272,8 +16277,22 @@ function findEntry(verb) {
 function hasVerbHelp(verb) {
 	return findEntry(verb) !== void 0;
 }
+/**
+* Verbs whose detailed help IS the root help (certification P3):
+* `scan` is the product's one command — the registry has no separate
+* scan page, so `mjolnir scan --help` / `mjolnir help scan` must render
+* the overview (which carries the scan usage lines), not the "no
+* detailed help" stub. `ci` (the bare stem) and `help` are the same
+* shape: real verbs, no dedicated page.
+*/
+const ROOT_HELP_VERBS = /* @__PURE__ */ new Set([
+	"scan",
+	"ci",
+	"help"
+]);
 /** One per-verb help page: summary, usage, examples, next step. */
 function renderVerbHelp(verb) {
+	if (!hasVerbHelp(verb) && ROOT_HELP_VERBS.has(verb)) return renderRootHelp();
 	const e = findEntry(verb);
 	if (!e) return [
 		`  No detailed help for "${verb}".`,
@@ -18327,6 +18346,17 @@ function renderDoctorReport(report) {
 /** Versioned JSON schema name for `doctor --json` (G5). */
 const DOCTOR_REPORT_SCHEMA = "mjolnir.doctor-report@1";
 /**
+* G5 determinism allowlist: names of doctor --json fields whose values
+* legitimately vary between two runs on the same tree. EMPTY by default
+* — every field the doctor emits must be deterministic (stable key
+* order, no timestamps, no absolute paths), and the structural tests
+* assert this length stays 0. A future field that cannot be
+* deterministic (e.g. a duration) must be added to this constant
+* CONSCIOUSLY, with the CI byte-equality gate's expectations updated in
+* the same commit — never by quietly weakening the byte-compare.
+*/
+const NON_DETERMINISTIC_FIELDS = [];
+/**
 * Serializes the doctor report to the machine-readable contract (Phase 5,
 * G5): versioned `schema` field, stable key order (constructed once, here),
 * details limited exactly like the text render, paths already POSIX-relative
@@ -18350,13 +18380,22 @@ function doctorReportJson(report, opts = {}) {
 			details: c.details.length > maxDetails ? [...c.details.slice(0, maxDetails), `… and ${c.details.length - maxDetails} more`] : c.details
 		};
 	});
-	return {
+	return stripNonDeterministicFields({
 		schema: DOCTOR_REPORT_SCHEMA,
 		healthy: report.healthy,
 		summary,
 		checks,
 		measurement: report.measurement
-	};
+	});
+}
+/**
+* G5 strip step: removes every allowlisted field from the artifact.
+* `fields` is a seam (defaults to the shipped NON_DETERMINISTIC_FIELDS)
+* so the strip path is testable while the allowlist stays empty.
+*/
+function stripNonDeterministicFields(json, fields = NON_DETERMINISTIC_FIELDS) {
+	for (const field of fields) delete json[field];
+	return json;
 }
 //#endregion
 //#region src/commands/doctor-run.ts
@@ -18623,7 +18662,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.25";
+const CLI_VERSION = "0.5.27";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",
@@ -19022,7 +19061,7 @@ async function runScanCommand(argv, io = {
 			io.out(result.score === null ? "unknown" : String(result.score));
 			return exitForFindings(result.findings, args.blocking === "none" ? "advisory" : args.blocking ?? scoreConfig.gate ?? "error");
 		}
-		if (args.format === "sarif") io.out(renderSarif(result));
+		if (args.format === "sarif") io.out(renderSarif(result, pathToFileURL(target).href));
 		else if (args.format === "mermaid") io.out(renderMermaid(result));
 		else if (args.json) io.out(JSON.stringify({
 			...result,

package/dist/mcp/stdio.mjs

@@ -13289,7 +13289,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.25",
+			version: "0.5.27",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -13355,7 +13355,7 @@ function renderSarif(result, repoRootUri) {
 		].join("."),
 		runs: [repoRootUri ? {
 			...run,
-			originalUriBaseIds: { SRCROOT: { uri: repoRootUri.replaceAll("\\", "/").split("/").map((seg) => seg === "" ? "" : encodeURI(seg).replaceAll("#", "%23").replaceAll("?", "%3F")).join("/") } }
+			originalUriBaseIds: { SRCROOT: { uri: repoRootUri.replaceAll("\\", "/").split("/").map((seg) => seg === "" ? "" : encodeURI(seg).replaceAll("%25", "%").replaceAll("#", "%23").replaceAll("?", "%3F")).join("/") } }
 		} : run]
 	};
 	return JSON.stringify(sarif, null, 2);
@@ -13741,7 +13741,11 @@ function errorText$1(err) {
 /**
 * Parse-and-validate a saved report. Throws Error with a
 * human-explanatory message on: invalid JSON, non-object document,
-* wrong schemaVersion, missing findings array.
+* wrong schemaVersion, missing findings array, missing frameworks
+* array (certification F1: a schema-1 report is MORE than
+* `{schemaVersion, findings}` — summary/handoff/why read
+* `result.frameworks`, so a schema-incomplete stub must be rejected
+* HERE, by the one shared loader, not crash downstream).
 */
 function validateReportJson(text) {
 	let parsed;
@@ -13754,6 +13758,7 @@ function validateReportJson(text) {
 	const doc = parsed;
 	if (doc.schemaVersion !== 1) throw new Error(`unsupported schemaVersion ${JSON.stringify(doc.schemaVersion)} — expected 1`);
 	if (!Array.isArray(doc.findings)) throw new Error("missing a \"findings\" array — is this a Mjölnir --json report?");
+	if (!Array.isArray(doc.frameworks)) throw new Error("missing a \"frameworks\" array — is this a complete Mjölnir --json report?");
 	return parsed;
 }
 /** Load + validate a saved report from disk. Throws on any problem. */
@@ -15463,8 +15468,22 @@ function findEntry(verb) {
 function hasVerbHelp(verb) {
 	return findEntry(verb) !== void 0;
 }
+/**
+* Verbs whose detailed help IS the root help (certification P3):
+* `scan` is the product's one command — the registry has no separate
+* scan page, so `mjolnir scan --help` / `mjolnir help scan` must render
+* the overview (which carries the scan usage lines), not the "no
+* detailed help" stub. `ci` (the bare stem) and `help` are the same
+* shape: real verbs, no dedicated page.
+*/
+const ROOT_HELP_VERBS = /* @__PURE__ */ new Set([
+	"scan",
+	"ci",
+	"help"
+]);
 /** One per-verb help page: summary, usage, examples, next step. */
 function renderVerbHelp(verb) {
+	if (!hasVerbHelp(verb) && ROOT_HELP_VERBS.has(verb)) return renderRootHelp();
 	const e = findEntry(verb);
 	if (!e) return [
 		`  No detailed help for "${verb}".`,
@@ -17809,6 +17828,17 @@ function renderDoctorReport(report) {
 /** Versioned JSON schema name for `doctor --json` (G5). */
 const DOCTOR_REPORT_SCHEMA = "mjolnir.doctor-report@1";
 /**
+* G5 determinism allowlist: names of doctor --json fields whose values
+* legitimately vary between two runs on the same tree. EMPTY by default
+* — every field the doctor emits must be deterministic (stable key
+* order, no timestamps, no absolute paths), and the structural tests
+* assert this length stays 0. A future field that cannot be
+* deterministic (e.g. a duration) must be added to this constant
+* CONSCIOUSLY, with the CI byte-equality gate's expectations updated in
+* the same commit — never by quietly weakening the byte-compare.
+*/
+const NON_DETERMINISTIC_FIELDS = [];
+/**
 * Serializes the doctor report to the machine-readable contract (Phase 5,
 * G5): versioned `schema` field, stable key order (constructed once, here),
 * details limited exactly like the text render, paths already POSIX-relative
@@ -17832,13 +17862,22 @@ function doctorReportJson(report, opts = {}) {
 			details: c.details.length > maxDetails ? [...c.details.slice(0, maxDetails), `… and ${c.details.length - maxDetails} more`] : c.details
 		};
 	});
-	return {
+	return stripNonDeterministicFields({
 		schema: DOCTOR_REPORT_SCHEMA,
 		healthy: report.healthy,
 		summary,
 		checks,
 		measurement: report.measurement
-	};
+	});
+}
+/**
+* G5 strip step: removes every allowlisted field from the artifact.
+* `fields` is a seam (defaults to the shipped NON_DETERMINISTIC_FIELDS)
+* so the strip path is testable while the allowlist stays empty.
+*/
+function stripNonDeterministicFields(json, fields = NON_DETERMINISTIC_FIELDS) {
+	for (const field of fields) delete json[field];
+	return json;
 }
 //#endregion
 //#region src/commands/doctor-run.ts
@@ -18259,7 +18298,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.25";
+const CLI_VERSION = "0.5.27";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",
@@ -18658,7 +18697,7 @@ async function runScanCommand(argv, io = {
 			io.out(result.score === null ? "unknown" : String(result.score));
 			return exitForFindings(result.findings, args.blocking === "none" ? "advisory" : args.blocking ?? scoreConfig.gate ?? "error");
 		}
-		if (args.format === "sarif") io.out(renderSarif(result));
+		if (args.format === "sarif") io.out(renderSarif(result, pathToFileURL(target).href));
 		else if (args.format === "mermaid") io.out(renderMermaid(result));
 		else if (args.json) io.out(JSON.stringify({
 			...result,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mjolnir-qa",
-  "version": "0.5.25",
+  "version": "0.5.27",
   "description": "Mjölnir — the Verification Trust Engine for QA. Audits test suites and CI pipelines, reports a worthiness score and prioritized findings.",
   "type": "module",
   "engines": {