mjolnir-qa 0.5.33 → 0.5.35

package/CHANGELOG.md

@@ -9,6 +9,18 @@ Rule behavior changes (new rules, FP-rate changes against the corpus,
 severity changes) are first-class entries here — rule IDs are immutable
 once shipped, so this file is the record of what changed between versions.
 
+## [0.5.35] — 2026-09-08
+
+### Changes since 0
+
+- P3a: GitLab CI — Code Quality report, MR recipe, exit-code discipline (#65)
+
+## [0.5.34] — 2026-09-08
+
+### Changes since 0
+
+- p2: structural anti-dilution — deduction-mass ceilings close the padding vector (plan 1788853205786 P2, decision 4) (#64)
+
 ## [0.5.33] — 2026-09-08
 
 ### Changes since 0.5.32

package/README.md

@@ -203,6 +203,7 @@ pinned to the `v1` major tag) by default, or plain `npx` with
 | `mjolnir forensics ./test-results/` | Runtime evidence from a real run                 |
 | `mjolnir handoff`                   | Remediation plan for a coding agent              |
 | `mjolnir --json` / `--format sarif` | Machine-readable / GitHub Code Scanning          |
+| `mjolnir --format codequality`      | GitLab Code Quality report (MR widget artifact)  |
 | `mjolnir --strict`                  | Also run quarantine-tier rules (higher FP risk)  |
 
 <details>
@@ -565,6 +566,10 @@ Or wire it into GitHub Code Scanning natively via SARIF:
     sarif_file: mjolnir.sarif
 ```
 
+On GitLab, `--format codequality` emits the Code Quality report the MR
+widget and diff annotations consume
+([docs/GITLAB-CI.md](docs/GITLAB-CI.md)).
+
 Editor and pipeline setup: [docs/SARIF-INTEGRATION.md](docs/SARIF-INTEGRATION.md).
 
 ### Changed-scope attribution
@@ -718,6 +723,7 @@ Rule IDs (`QA-<FAMILY>-NNN`) are immutable once shipped and never reused.
 | [docs/VERSIONING.md](docs/VERSIONING.md)               | Semver policy, frozen surfaces, deprecation cycle |
 | [docs/machine-contract.md](docs/machine-contract.md)   | The canonical machine-readable result             |
 | [docs/SARIF-INTEGRATION.md](docs/SARIF-INTEGRATION.md) | SARIF output + editor/CI setup                    |
+| [docs/GITLAB-CI.md](docs/GITLAB-CI.md)                 | GitLab: Code Quality report, MR recipe, gate      |
 | [docs/rules/](docs/rules/)                             | Generated per-rule catalog                        |
 | [CONTRIBUTING.md](CONTRIBUTING.md)                     | Dev setup + contribution workflow                 |
 | [SUPPORT.md](SUPPORT.md)                               | Where to ask, report and get help                 |

package/dist/cli.d.mts

@@ -201,6 +201,15 @@ interface ScanResult {
   testDeclarationCount?: number;
   /** Raw deduction total before normalization (Phase 5 — transparency). */
   rawDeductions?: number;
+  /**
+   * The evidence-discounted deduction mass the P2 anti-dilution ceiling
+   * caps against (equals rawDeductions today — E0 charges 0, E1 halves;
+   * the ceiling input is deliberately the full discount surface).
+   * Additive within schemaVersion 1; present so consumers recompute the
+   * ceiling from docs/SCORING.md formula v2 without re-deriving
+   * evidence levels.
+   */
+  effectiveDeductions?: number;
   /** Number of findings suppressed by active config entries (suppression transparency). */
   suppressionCount?: number;
   /**
@@ -556,7 +565,7 @@ interface CliArgs {
   verbose: boolean;
   maxDurationMs: number;
   scopeChanged: boolean;
-  format: "terminal" | "json" | "sarif" | "mermaid";
+  format: "terminal" | "json" | "sarif" | "mermaid" | "codequality";
   /** --width override for terminal box/gauge wrapping (Sprint 5 Task 22). */
   width?: number;
   /** --ascii / --no-ascii override for shouldUseAscii()'s heuristic. */
@@ -728,7 +737,7 @@ declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniver
  * `scripts/sync-sarif-version.cjs` on release and guarded by
  * `tests/version-consistency.spec.ts` locally.
  */
-declare const CLI_VERSION = "0.5.33";
+declare const CLI_VERSION = "0.5.35";
 /** A usage-error detail: the offending token, when one exists. */
 interface UsageErrorDetail {
   /** The unknown flag or rejected value (e.g. `--nope`, `loud`). */

package/dist/cli.mjs

@@ -10074,6 +10074,58 @@ function computeDimensions(findings) {
 	for (const dim of byCategory.values()) dim.score = Math.max(0, 100 - deductions.get(dim.category));
 	return [...byCategory.values()].sort((a, b) => a.category.localeCompare(b.category));
 }
+/**
+* Deduction-mass ceilings (product-gap-remediation master plan P2,
+* plan 1788853205786 — structural anti-dilution, decision 4).
+*
+* The Goodhart vector the density formula permits: fixed deduction mass
+* ÷ padded denominator → score → 99. A repo with 80 warning-points of
+* real findings and 10,000 test declarations reads 99+ ("one minor
+* issue") because the RATE is tiny — the padding is free. Density stays
+* as the legitimate differentiator for small masses (a lone warning in
+* a 10k suite must still read ≥ 95), but it can no longer dilute a
+* large mass: each absolute deduction-mass band caps the score. Padding
+* cannot move a ceiling — the vector is structurally closed. 80
+* warning-pts read ≤ 75 in ANY suite size.
+*
+* The error-severity floor (95) is the ≥ 8 band seen from the other
+* side: 1 error ≥ 8 pts, so it is subsumed and left standing as a named
+* special case for prose continuity. The > 0 band is the honesty guard
+* (clampWithFindings) — subsumed as well.
+*
+* Calibration (P2.4): these boundaries were chosen to hold the three
+* known data points (self 100, golden 49 via suiteVoided, demo 67) and
+* are then FROZEN with a changelog entry. Never tune them to flatter a
+* repo (docs/SCORING.md Correction section is the precedent).
+*/
+const DEDUCTION_MASS_CEILINGS = [
+	{
+		minMass: 160,
+		ceiling: 65
+	},
+	{
+		minMass: 80,
+		ceiling: 75
+	},
+	{
+		minMass: 40,
+		ceiling: 85
+	},
+	{
+		minMass: 8,
+		ceiling: 95
+	}
+];
+/**
+* The score ceiling for a given evidence-discounted deduction mass.
+* 0 → no ceiling (the 100 honesty guard lives in clampWithFindings);
+* below the smallest band → no ceiling beyond the named guards.
+* Exported for the JSON contract (effectiveDeductions) and the tests.
+*/
+function massCeiling(totalDeduction) {
+	for (const band of DEDUCTION_MASS_CEILINGS) if (totalDeduction >= band.minMass) return band.ceiling;
+	return null;
+}
 function computeTotal(dimensions, findings, exposure) {
 	if (findings.length === 0) return 100;
 	let totalDeduction = 0;
@@ -10086,6 +10138,8 @@ function computeTotal(dimensions, findings, exposure) {
 		const rate = totalDeduction / (declarations + 1);
 		score = clampWithFindings(100 - Math.min(100, rate * 5), totalDeduction);
 	} else score = clampWithFindings(100 - totalDeduction, totalDeduction);
+	const ceiling = massCeiling(totalDeduction);
+	if (ceiling !== null && score > ceiling) score = ceiling;
 	if (findings.some((f) => f.severity === "error" && deductionFor(f) > 0) && score > 95) score = 95;
 	return suiteVoided ? Math.min(score, 49) : score;
 }
@@ -12322,6 +12376,7 @@ async function runScan$1(args, hooks = {}) {
 	});
 	const dimensions = computeDimensions(findings);
 	const rawDeductions = findings.reduce((sum, f) => sum + deductionFor(f), 0);
+	const effectiveDeductions = rawDeductions;
 	const total = computeTotal(dimensions, findings, {
 		testDeclarations: testDeclarationCount,
 		testFileCount,
@@ -12346,6 +12401,7 @@ async function runScan$1(args, hooks = {}) {
 		testFileCount,
 		testDeclarationCount,
 		rawDeductions,
+		effectiveDeductions,
 		suppressionCount,
 		...pluginsLoaded.length > 0 ? { plugins: pluginsLoaded } : {},
 		agenticProfile: computeAgenticProfile(fileProvenance, findings),
@@ -12900,6 +12956,10 @@ function appendScoreSection(lines, result, p, width, ascii) {
 	lines.push(`  ${scoreGauge(result.score, p, gaugeWidth, ascii)}`);
 	lines.push(`  ${p.dim(headlineFor(state, result.findings.length))}`);
 	if (result.rawDeductions !== void 0 && result.testDeclarationCount) lines.push(`  ${p.dim(`(${result.rawDeductions} raw pts / ${result.testDeclarationCount} test declarations — normalized)`)}`);
+	if (result.effectiveDeductions !== void 0 && result.score !== null) {
+		const ceiling = massCeiling(result.effectiveDeductions);
+		if (ceiling !== null && result.score <= ceiling && result.rawDeductions !== void 0) lines.push(`  ${p.dim(`(capped: deduction mass ${result.effectiveDeductions} pts — absolute ceiling ${ceiling})`)}`);
+	}
 	if (result.suppressionCount && result.suppressionCount > 0) lines.push(`  ${p.dim(`(${result.suppressionCount} finding(s) suppressed by config)`)}`);
 	lines.push("");
 }
@@ -13290,7 +13350,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.33",
+			version: "0.5.35",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -13362,6 +13422,62 @@ function renderSarif(result, repoRootUri) {
 	return JSON.stringify(sarif, null, 2);
 }
 //#endregion
+//#region src/reporter/codequality.ts
+/**
+* GitLab Code Quality reporter (product-gap-remediation master plan P3a,
+* plan 1788853205786 — flag 2, decision 2: GitLab is the in-plan second
+* platform).
+*
+* Emits the Code Quality report schema GitLab's `codequality` artifact
+* type consumes (docs.gitlab.com/ee/ci/testing/code_quality.html) so
+* findings render as MR widgets and diff annotations inside existing
+* governance — the same distribution logic as SARIF for GitHub, never a
+* second truth: this is a deterministic projection of the same
+* ScanResult the JSON contract carries.
+*
+* Usage: mjolnir --format codequality > gl-code-quality-report.json
+*
+* Severity map (documented in docs/GITLAB-CI.md):
+*   error   → major   (categorical defects — the gate's core)
+*   warning → minor
+*   info    → info
+*
+* Fingerprint stability: GitLab deduplicates MR findings across runs by
+* `fingerprint` — an unstable fingerprint would resurrect closed
+* findings on every push (the exact PR-noise the MR flow exists to
+* avoid). The fingerprint is sha256 over ruleId + repo-relative path +
+* line + column + message — the same finding shape the --why command
+* addresses, so a moved line legitimately re-reports and an unchanged
+* finding stays silent.
+*/
+function codeQualitySeverity(severity) {
+	if (severity === "error") return "major";
+	if (severity === "warning") return "minor";
+	return "info";
+}
+/**
+* sha256 hex over the identifying tuple. Exported for the contract test:
+* the fingerprint MUST be stable across runs for an unchanged finding
+* (GitLab dedup contract) and MUST change when the finding's identity
+* changes (otherwise an MR could hide a moved-and-still-broken line).
+*/
+function codeQualityFingerprint(f) {
+	return createHash("sha256").update(`${f.ruleId}\u0000${f.file}\u0000${f.line}\u0000${f.column}\u0000${f.message}`).digest("hex");
+}
+function renderCodeQuality(result) {
+	const issues = result.findings.map((f) => ({
+		description: f.message,
+		check_name: f.ruleId,
+		fingerprint: codeQualityFingerprint(f),
+		severity: codeQualitySeverity(f.severity),
+		location: {
+			path: f.file.replaceAll("\\", "/"),
+			lines: { begin: f.line }
+		}
+	}));
+	return JSON.stringify(issues, null, 2) + "\n";
+}
+//#endregion
 //#region src/reporter/mermaid.ts
 function sanitizeId(raw) {
 	return raw.replace(/[^a-z0-9]/gi, "_");
@@ -16324,6 +16440,10 @@ const HELP_FLAGS = [
 		flag: "--format sarif",
 		summary: "SARIF 2.1 for GitHub Code Scanning"
 	},
+	{
+		flag: "--format codequality",
+		summary: "GitLab Code Quality report (MR widget artifact)"
+	},
 	{
 		flag: "--format mermaid",
 		summary: "test-architecture diagram"
@@ -18788,7 +18908,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.33";
+const CLI_VERSION = "0.5.35";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",
@@ -18811,6 +18931,7 @@ function parseArgs(argv, onError) {
 			const fmt = argv[++i];
 			if (fmt === "sarif") args.format = "sarif";
 			else if (fmt === "mermaid") args.format = "mermaid";
+			else if (fmt === "codequality") args.format = "codequality";
 			else if (fmt === "json") {
 				args.format = "json";
 				args.json = true;
@@ -19195,6 +19316,7 @@ async function runScanCommand(argv, io = {
 		}
 		if (args.format === "sarif") io.out(renderSarif(result, pathToFileURL(target).href));
 		else if (args.format === "mermaid") io.out(renderMermaid(result));
+		else if (args.format === "codequality") io.out(renderCodeQuality(result));
 		else if (args.json) io.out(JSON.stringify({
 			...result,
 			contract: buildMachineContract(result)

package/dist/mcp/stdio.mjs

@@ -10073,6 +10073,58 @@ function computeDimensions(findings) {
 	for (const dim of byCategory.values()) dim.score = Math.max(0, 100 - deductions.get(dim.category));
 	return [...byCategory.values()].sort((a, b) => a.category.localeCompare(b.category));
 }
+/**
+* Deduction-mass ceilings (product-gap-remediation master plan P2,
+* plan 1788853205786 — structural anti-dilution, decision 4).
+*
+* The Goodhart vector the density formula permits: fixed deduction mass
+* ÷ padded denominator → score → 99. A repo with 80 warning-points of
+* real findings and 10,000 test declarations reads 99+ ("one minor
+* issue") because the RATE is tiny — the padding is free. Density stays
+* as the legitimate differentiator for small masses (a lone warning in
+* a 10k suite must still read ≥ 95), but it can no longer dilute a
+* large mass: each absolute deduction-mass band caps the score. Padding
+* cannot move a ceiling — the vector is structurally closed. 80
+* warning-pts read ≤ 75 in ANY suite size.
+*
+* The error-severity floor (95) is the ≥ 8 band seen from the other
+* side: 1 error ≥ 8 pts, so it is subsumed and left standing as a named
+* special case for prose continuity. The > 0 band is the honesty guard
+* (clampWithFindings) — subsumed as well.
+*
+* Calibration (P2.4): these boundaries were chosen to hold the three
+* known data points (self 100, golden 49 via suiteVoided, demo 67) and
+* are then FROZEN with a changelog entry. Never tune them to flatter a
+* repo (docs/SCORING.md Correction section is the precedent).
+*/
+const DEDUCTION_MASS_CEILINGS = [
+	{
+		minMass: 160,
+		ceiling: 65
+	},
+	{
+		minMass: 80,
+		ceiling: 75
+	},
+	{
+		minMass: 40,
+		ceiling: 85
+	},
+	{
+		minMass: 8,
+		ceiling: 95
+	}
+];
+/**
+* The score ceiling for a given evidence-discounted deduction mass.
+* 0 → no ceiling (the 100 honesty guard lives in clampWithFindings);
+* below the smallest band → no ceiling beyond the named guards.
+* Exported for the JSON contract (effectiveDeductions) and the tests.
+*/
+function massCeiling(totalDeduction) {
+	for (const band of DEDUCTION_MASS_CEILINGS) if (totalDeduction >= band.minMass) return band.ceiling;
+	return null;
+}
 function computeTotal(dimensions, findings, exposure) {
 	if (findings.length === 0) return 100;
 	let totalDeduction = 0;
@@ -10085,6 +10137,8 @@ function computeTotal(dimensions, findings, exposure) {
 		const rate = totalDeduction / (declarations + 1);
 		score = clampWithFindings(100 - Math.min(100, rate * 5), totalDeduction);
 	} else score = clampWithFindings(100 - totalDeduction, totalDeduction);
+	const ceiling = massCeiling(totalDeduction);
+	if (ceiling !== null && score > ceiling) score = ceiling;
 	if (findings.some((f) => f.severity === "error" && deductionFor(f) > 0) && score > 95) score = 95;
 	return suiteVoided ? Math.min(score, 49) : score;
 }
@@ -12321,6 +12375,7 @@ async function runScan$1(args, hooks = {}) {
 	});
 	const dimensions = computeDimensions(findings);
 	const rawDeductions = findings.reduce((sum, f) => sum + deductionFor(f), 0);
+	const effectiveDeductions = rawDeductions;
 	const total = computeTotal(dimensions, findings, {
 		testDeclarations: testDeclarationCount,
 		testFileCount,
@@ -12345,6 +12400,7 @@ async function runScan$1(args, hooks = {}) {
 		testFileCount,
 		testDeclarationCount,
 		rawDeductions,
+		effectiveDeductions,
 		suppressionCount,
 		...pluginsLoaded.length > 0 ? { plugins: pluginsLoaded } : {},
 		agenticProfile: computeAgenticProfile(fileProvenance, findings),
@@ -12899,6 +12955,10 @@ function appendScoreSection(lines, result, p, width, ascii) {
 	lines.push(`  ${scoreGauge(result.score, p, gaugeWidth, ascii)}`);
 	lines.push(`  ${p.dim(headlineFor(state, result.findings.length))}`);
 	if (result.rawDeductions !== void 0 && result.testDeclarationCount) lines.push(`  ${p.dim(`(${result.rawDeductions} raw pts / ${result.testDeclarationCount} test declarations — normalized)`)}`);
+	if (result.effectiveDeductions !== void 0 && result.score !== null) {
+		const ceiling = massCeiling(result.effectiveDeductions);
+		if (ceiling !== null && result.score <= ceiling && result.rawDeductions !== void 0) lines.push(`  ${p.dim(`(capped: deduction mass ${result.effectiveDeductions} pts — absolute ceiling ${ceiling})`)}`);
+	}
 	if (result.suppressionCount && result.suppressionCount > 0) lines.push(`  ${p.dim(`(${result.suppressionCount} finding(s) suppressed by config)`)}`);
 	lines.push("");
 }
@@ -13289,7 +13349,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.33",
+			version: "0.5.35",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -13361,6 +13421,62 @@ function renderSarif(result, repoRootUri) {
 	return JSON.stringify(sarif, null, 2);
 }
 //#endregion
+//#region src/reporter/codequality.ts
+/**
+* GitLab Code Quality reporter (product-gap-remediation master plan P3a,
+* plan 1788853205786 — flag 2, decision 2: GitLab is the in-plan second
+* platform).
+*
+* Emits the Code Quality report schema GitLab's `codequality` artifact
+* type consumes (docs.gitlab.com/ee/ci/testing/code_quality.html) so
+* findings render as MR widgets and diff annotations inside existing
+* governance — the same distribution logic as SARIF for GitHub, never a
+* second truth: this is a deterministic projection of the same
+* ScanResult the JSON contract carries.
+*
+* Usage: mjolnir --format codequality > gl-code-quality-report.json
+*
+* Severity map (documented in docs/GITLAB-CI.md):
+*   error   → major   (categorical defects — the gate's core)
+*   warning → minor
+*   info    → info
+*
+* Fingerprint stability: GitLab deduplicates MR findings across runs by
+* `fingerprint` — an unstable fingerprint would resurrect closed
+* findings on every push (the exact PR-noise the MR flow exists to
+* avoid). The fingerprint is sha256 over ruleId + repo-relative path +
+* line + column + message — the same finding shape the --why command
+* addresses, so a moved line legitimately re-reports and an unchanged
+* finding stays silent.
+*/
+function codeQualitySeverity(severity) {
+	if (severity === "error") return "major";
+	if (severity === "warning") return "minor";
+	return "info";
+}
+/**
+* sha256 hex over the identifying tuple. Exported for the contract test:
+* the fingerprint MUST be stable across runs for an unchanged finding
+* (GitLab dedup contract) and MUST change when the finding's identity
+* changes (otherwise an MR could hide a moved-and-still-broken line).
+*/
+function codeQualityFingerprint(f) {
+	return createHash("sha256").update(`${f.ruleId}\u0000${f.file}\u0000${f.line}\u0000${f.column}\u0000${f.message}`).digest("hex");
+}
+function renderCodeQuality(result) {
+	const issues = result.findings.map((f) => ({
+		description: f.message,
+		check_name: f.ruleId,
+		fingerprint: codeQualityFingerprint(f),
+		severity: codeQualitySeverity(f.severity),
+		location: {
+			path: f.file.replaceAll("\\", "/"),
+			lines: { begin: f.line }
+		}
+	}));
+	return JSON.stringify(issues, null, 2) + "\n";
+}
+//#endregion
 //#region src/reporter/mermaid.ts
 function sanitizeId(raw) {
 	return raw.replace(/[^a-z0-9]/gi, "_");
@@ -15515,6 +15631,10 @@ const HELP_FLAGS = [
 		flag: "--format sarif",
 		summary: "SARIF 2.1 for GitHub Code Scanning"
 	},
+	{
+		flag: "--format codequality",
+		summary: "GitLab Code Quality report (MR widget artifact)"
+	},
 	{
 		flag: "--format mermaid",
 		summary: "test-architecture diagram"
@@ -18424,7 +18544,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.33";
+const CLI_VERSION = "0.5.35";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",
@@ -18447,6 +18567,7 @@ function parseArgs(argv, onError) {
 			const fmt = argv[++i];
 			if (fmt === "sarif") args.format = "sarif";
 			else if (fmt === "mermaid") args.format = "mermaid";
+			else if (fmt === "codequality") args.format = "codequality";
 			else if (fmt === "json") {
 				args.format = "json";
 				args.json = true;
@@ -18831,6 +18952,7 @@ async function runScanCommand(argv, io = {
 		}
 		if (args.format === "sarif") io.out(renderSarif(result, pathToFileURL(target).href));
 		else if (args.format === "mermaid") io.out(renderMermaid(result));
+		else if (args.format === "codequality") io.out(renderCodeQuality(result));
 		else if (args.json) io.out(JSON.stringify({
 			...result,
 			contract: buildMachineContract(result)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mjolnir-qa",
-  "version": "0.5.33",
+  "version": "0.5.35",
   "description": "Mjölnir — the Verification Trust Engine for QA. Audits test suites and CI pipelines, reports a worthiness score and prioritized findings.",
   "type": "module",
   "engines": {