mjolnir-qa 0.5.34 → 0.5.36

package/CHANGELOG.md

@@ -9,6 +9,18 @@ Rule behavior changes (new rules, FP-rate changes against the corpus,
 severity changes) are first-class entries here — rule IDs are immutable
 once shipped, so this file is the record of what changed between versions.
 
+## [0.5.36] — 2026-09-08
+
+### Changes since 0
+
+- P4: forensics breadth — Jest + Vitest JSON ingestion (honest degradation) (#66)
+
+## [0.5.35] — 2026-09-08
+
+### Changes since 0
+
+- P3a: GitLab CI — Code Quality report, MR recipe, exit-code discipline (#65)
+
 ## [0.5.34] — 2026-09-08
 
 ### Changes since 0

package/README.md

@@ -203,6 +203,7 @@ pinned to the `v1` major tag) by default, or plain `npx` with
 | `mjolnir forensics ./test-results/` | Runtime evidence from a real run                 |
 | `mjolnir handoff`                   | Remediation plan for a coding agent              |
 | `mjolnir --json` / `--format sarif` | Machine-readable / GitHub Code Scanning          |
+| `mjolnir --format codequality`      | GitLab Code Quality report (MR widget artifact)  |
 | `mjolnir --strict`                  | Also run quarantine-tier rules (higher FP risk)  |
 
 <details>
@@ -498,7 +499,8 @@ scanning.
 ## Runtime forensics
 
 Static analysis reasons about code that was never run. Forensics reads what
-actually happened — Playwright JSON reports and JUnit XML from any runner:
+actually happened — Playwright JSON, Jest JSON, Vitest JSON, and JUnit XML
+from any runner:
 
 ```text
 Static analysis  →  what the code appears to do
@@ -565,6 +567,10 @@ Or wire it into GitHub Code Scanning natively via SARIF:
     sarif_file: mjolnir.sarif
 ```
 
+On GitLab, `--format codequality` emits the Code Quality report the MR
+widget and diff annotations consume
+([docs/GITLAB-CI.md](docs/GITLAB-CI.md)).
+
 Editor and pipeline setup: [docs/SARIF-INTEGRATION.md](docs/SARIF-INTEGRATION.md).
 
 ### Changed-scope attribution
@@ -718,6 +724,7 @@ Rule IDs (`QA-<FAMILY>-NNN`) are immutable once shipped and never reused.
 | [docs/VERSIONING.md](docs/VERSIONING.md)               | Semver policy, frozen surfaces, deprecation cycle |
 | [docs/machine-contract.md](docs/machine-contract.md)   | The canonical machine-readable result             |
 | [docs/SARIF-INTEGRATION.md](docs/SARIF-INTEGRATION.md) | SARIF output + editor/CI setup                    |
+| [docs/GITLAB-CI.md](docs/GITLAB-CI.md)                 | GitLab: Code Quality report, MR recipe, gate      |
 | [docs/rules/](docs/rules/)                             | Generated per-rule catalog                        |
 | [CONTRIBUTING.md](CONTRIBUTING.md)                     | Dev setup + contribution workflow                 |
 | [SUPPORT.md](SUPPORT.md)                               | Where to ask, report and get help                 |

package/dist/cli.d.mts

@@ -72,8 +72,15 @@ type TrustLevel = (typeof TRUST_ORDER)[number];
 interface RuntimeCorroboration {
   /** Granularity of what the runtime report could vouch for. */
   level: "file" | "test" | "defect";
-  /** Report format the evidence came from. */
-  source: "playwright-json" | "junit-xml";
+  /**
+   * Report format the evidence came from. Widened additively in P4
+   * (plan 1788853205786) to mirror ForensicsReport's source union:
+   * Jest/Vitest JSON reports corroborate at file/test level exactly
+   * like Playwright's — their one-attempt-per-record shape only
+   * constrains TRUE-FLAKE derivation, which lives in the analysis, not
+   * in the provenance label.
+   */
+  source: "playwright-json" | "junit-xml" | "jest-json" | "vitest-json";
   /** Number of tests executed in the finding's file (any level). */
   testsExecuted: number;
   /**
@@ -565,7 +572,7 @@ interface CliArgs {
   verbose: boolean;
   maxDurationMs: number;
   scopeChanged: boolean;
-  format: "terminal" | "json" | "sarif" | "mermaid";
+  format: "terminal" | "json" | "sarif" | "mermaid" | "codequality";
   /** --width override for terminal box/gauge wrapping (Sprint 5 Task 22). */
   width?: number;
   /** --ascii / --no-ascii override for shouldUseAscii()'s heuristic. */
@@ -737,7 +744,7 @@ declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniver
  * `scripts/sync-sarif-version.cjs` on release and guarded by
  * `tests/version-consistency.spec.ts` locally.
  */
-declare const CLI_VERSION = "0.5.34";
+declare const CLI_VERSION = "0.5.36";
 /** A usage-error detail: the offending token, when one exists. */
 interface UsageErrorDetail {
   /** The unknown flag or rejected value (e.g. `--nope`, `loud`). */

package/dist/cli.mjs

@@ -11123,6 +11123,60 @@ function renderFlakyMd(report) {
 	return lines.join("\n");
 }
 //#endregion
+//#region src/forensics/parse-jest-json.ts
+function toStatus$2(raw) {
+	switch (raw) {
+		case "passed": return "passed";
+		case "failed": return "failed";
+		case "skipped":
+		case "pending":
+		case "todo":
+		case "disabled": return "skipped";
+		default: return "interrupted";
+	}
+}
+/**
+* Sniff: does this parsed JSON have the Jest shape? Exported for the
+* discovery dispatcher (run.ts) — Jest and Vitest share the top-level
+* `testResults` name; the discriminator is the per-file array's member
+* name (`testResults` = Jest, `assertionResults` = Vitest).
+*/
+function looksLikeJestJson(json) {
+	if (!json || typeof json !== "object") return false;
+	const testResults = json.testResults;
+	if (!Array.isArray(testResults) || testResults.length === 0) return false;
+	return testResults.some((r) => r && typeof r === "object" && Array.isArray(r.testResults));
+}
+function parseJestJson(json) {
+	if (!json || typeof json !== "object") return [];
+	const root = json;
+	const files = Array.isArray(root.testResults) ? root.testResults : [];
+	const out = [];
+	for (const fileResult of files.slice(0, 1e4)) {
+		if (!fileResult || typeof fileResult !== "object") continue;
+		const assertions = Array.isArray(fileResult.testResults) ? fileResult.testResults : [];
+		const file = fileResult.testFilePath ?? "unknown";
+		for (const assertion of assertions) {
+			if (!assertion || typeof assertion !== "object") continue;
+			const durationMs = Number.isFinite(assertion.duration) && assertion.duration >= 0 ? Math.round(assertion.duration) : 0;
+			const attempt = {
+				index: 1,
+				status: toStatus$2(assertion.status),
+				durationMs
+			};
+			const line = typeof assertion.location?.line === "number" && assertion.location.line > 0 ? assertion.location.line : void 0;
+			const title = assertion.title ?? "(unnamed)";
+			out.push({
+				file,
+				title,
+				attempts: [attempt],
+				...line !== void 0 ? { line } : {}
+			});
+		}
+	}
+	return out;
+}
+//#endregion
 //#region src/forensics/parse-junit.ts
 const MAX_INPUT = 20971520;
 function decodeEntities(s) {
@@ -11178,7 +11232,7 @@ function parseJunitXml(xml) {
 //#endregion
 //#region src/forensics/parse-playwright-json.ts
 const MAX_DEPTH = 32;
-function toStatus(raw) {
+function toStatus$1(raw) {
 	switch (raw) {
 		case "passed": return "passed";
 		case "failed": return "failed";
@@ -11211,7 +11265,7 @@ function parsePlaywrightJson(json) {
 					if (!r || typeof r !== "object") continue;
 					attempts.push({
 						index: ++i,
-						status: toStatus(r.status),
+						status: toStatus$1(r.status),
 						durationMs: Number.isFinite(r.duration) ? Math.max(0, r.duration) : 0
 					});
 				}
@@ -11230,6 +11284,54 @@ function parsePlaywrightJson(json) {
 	return out;
 }
 //#endregion
+//#region src/forensics/parse-vitest-json.ts
+function toStatus(raw) {
+	switch (raw) {
+		case "passed": return "passed";
+		case "failed": return "failed";
+		case "skipped":
+		case "pending":
+		case "todo":
+		case "disabled": return "skipped";
+		default: return "interrupted";
+	}
+}
+/** Sniff: the Vitest variant of the Jest-shaped report (see module doc). */
+function looksLikeVitestJson(json) {
+	if (!json || typeof json !== "object") return false;
+	const testResults = json.testResults;
+	if (!Array.isArray(testResults) || testResults.length === 0) return false;
+	return testResults.some((r) => r && typeof r === "object" && Array.isArray(r.assertionResults));
+}
+function parseVitestJson(json) {
+	if (!json || typeof json !== "object") return [];
+	const root = json;
+	const files = Array.isArray(root.testResults) ? root.testResults : [];
+	const out = [];
+	for (const fileResult of files.slice(0, 1e4)) {
+		if (!fileResult || typeof fileResult !== "object") continue;
+		const assertions = Array.isArray(fileResult.assertionResults) ? fileResult.assertionResults : [];
+		const file = fileResult.filepath ?? "unknown";
+		for (const assertion of assertions) {
+			if (!assertion || typeof assertion !== "object") continue;
+			const durationMs = Number.isFinite(assertion.duration) && assertion.duration >= 0 ? Math.round(assertion.duration) : 0;
+			const attempt = {
+				index: 1,
+				status: toStatus(assertion.status),
+				durationMs
+			};
+			const line = typeof assertion.location?.line === "number" && assertion.location.line > 0 ? assertion.location.line : void 0;
+			out.push({
+				file,
+				title: assertion.title ?? "(unnamed)",
+				attempts: [attempt],
+				...line !== void 0 ? { line } : {}
+			});
+		}
+	}
+	return out;
+}
+//#endregion
 //#region src/forensics/run.ts
 /**
 * `mjolnir forensics <dir-or-file>` — runtime evidence entry point (R4).
@@ -11237,7 +11339,9 @@ function parsePlaywrightJson(json) {
 * Accepts either a single report file or a directory. In a directory it
 * looks for, in priority order:
 *   1. report.json / playwright-report.json — Playwright JSON report
-*   2. *.xml                                — JUnit XML reports
+*   2. jest-report.json / vitest-report.json — Jest/Vitest JSON reports
+*   3. *.json (shape-sniffed: Playwright, Jest, Vitest)
+*   4. *.xml                                — JUnit XML reports
 *
 * Writes FLAKY.md next to the scan target unless --no-flaky-md.
 */
@@ -11308,17 +11412,27 @@ function parseFile(path, text) {
 		records: parseJunitXml(text),
 		source: "junit-xml"
 	};
+	let json;
 	try {
-		return {
-			records: parsePlaywrightJson(JSON.parse(text)),
-			source: "playwright-json"
-		};
+		json = JSON.parse(text);
 	} catch {
 		return {
 			records: [],
 			source: "playwright-json"
 		};
 	}
+	if (looksLikeJestJson(json)) return {
+		records: parseJestJson(json),
+		source: "jest-json"
+	};
+	if (looksLikeVitestJson(json)) return {
+		records: parseVitestJson(json),
+		source: "vitest-json"
+	};
+	return {
+		records: parsePlaywrightJson(json),
+		source: "playwright-json"
+	};
 }
 function listFiles(dir) {
 	const out = [];
@@ -13350,7 +13464,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.34",
+			version: "0.5.36",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -13422,6 +13536,62 @@ function renderSarif(result, repoRootUri) {
 	return JSON.stringify(sarif, null, 2);
 }
 //#endregion
+//#region src/reporter/codequality.ts
+/**
+* GitLab Code Quality reporter (product-gap-remediation master plan P3a,
+* plan 1788853205786 — flag 2, decision 2: GitLab is the in-plan second
+* platform).
+*
+* Emits the Code Quality report schema GitLab's `codequality` artifact
+* type consumes (docs.gitlab.com/ee/ci/testing/code_quality.html) so
+* findings render as MR widgets and diff annotations inside existing
+* governance — the same distribution logic as SARIF for GitHub, never a
+* second truth: this is a deterministic projection of the same
+* ScanResult the JSON contract carries.
+*
+* Usage: mjolnir --format codequality > gl-code-quality-report.json
+*
+* Severity map (documented in docs/GITLAB-CI.md):
+*   error   → major   (categorical defects — the gate's core)
+*   warning → minor
+*   info    → info
+*
+* Fingerprint stability: GitLab deduplicates MR findings across runs by
+* `fingerprint` — an unstable fingerprint would resurrect closed
+* findings on every push (the exact PR-noise the MR flow exists to
+* avoid). The fingerprint is sha256 over ruleId + repo-relative path +
+* line + column + message — the same finding shape the --why command
+* addresses, so a moved line legitimately re-reports and an unchanged
+* finding stays silent.
+*/
+function codeQualitySeverity(severity) {
+	if (severity === "error") return "major";
+	if (severity === "warning") return "minor";
+	return "info";
+}
+/**
+* sha256 hex over the identifying tuple. Exported for the contract test:
+* the fingerprint MUST be stable across runs for an unchanged finding
+* (GitLab dedup contract) and MUST change when the finding's identity
+* changes (otherwise an MR could hide a moved-and-still-broken line).
+*/
+function codeQualityFingerprint(f) {
+	return createHash("sha256").update(`${f.ruleId}\u0000${f.file}\u0000${f.line}\u0000${f.column}\u0000${f.message}`).digest("hex");
+}
+function renderCodeQuality(result) {
+	const issues = result.findings.map((f) => ({
+		description: f.message,
+		check_name: f.ruleId,
+		fingerprint: codeQualityFingerprint(f),
+		severity: codeQualitySeverity(f.severity),
+		location: {
+			path: f.file.replaceAll("\\", "/"),
+			lines: { begin: f.line }
+		}
+	}));
+	return JSON.stringify(issues, null, 2) + "\n";
+}
+//#endregion
 //#region src/reporter/mermaid.ts
 function sanitizeId(raw) {
 	return raw.replace(/[^a-z0-9]/gi, "_");
@@ -16384,6 +16554,10 @@ const HELP_FLAGS = [
 		flag: "--format sarif",
 		summary: "SARIF 2.1 for GitHub Code Scanning"
 	},
+	{
+		flag: "--format codequality",
+		summary: "GitLab Code Quality report (MR widget artifact)"
+	},
 	{
 		flag: "--format mermaid",
 		summary: "test-architecture diagram"
@@ -18848,7 +19022,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.34";
+const CLI_VERSION = "0.5.36";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",
@@ -18871,6 +19045,7 @@ function parseArgs(argv, onError) {
 			const fmt = argv[++i];
 			if (fmt === "sarif") args.format = "sarif";
 			else if (fmt === "mermaid") args.format = "mermaid";
+			else if (fmt === "codequality") args.format = "codequality";
 			else if (fmt === "json") {
 				args.format = "json";
 				args.json = true;
@@ -19255,6 +19430,7 @@ async function runScanCommand(argv, io = {
 		}
 		if (args.format === "sarif") io.out(renderSarif(result, pathToFileURL(target).href));
 		else if (args.format === "mermaid") io.out(renderMermaid(result));
+		else if (args.format === "codequality") io.out(renderCodeQuality(result));
 		else if (args.json) io.out(JSON.stringify({
 			...result,
 			contract: buildMachineContract(result)

package/dist/mcp/stdio.mjs

@@ -11122,6 +11122,60 @@ function renderFlakyMd(report) {
 	return lines.join("\n");
 }
 //#endregion
+//#region src/forensics/parse-jest-json.ts
+function toStatus$2(raw) {
+	switch (raw) {
+		case "passed": return "passed";
+		case "failed": return "failed";
+		case "skipped":
+		case "pending":
+		case "todo":
+		case "disabled": return "skipped";
+		default: return "interrupted";
+	}
+}
+/**
+* Sniff: does this parsed JSON have the Jest shape? Exported for the
+* discovery dispatcher (run.ts) — Jest and Vitest share the top-level
+* `testResults` name; the discriminator is the per-file array's member
+* name (`testResults` = Jest, `assertionResults` = Vitest).
+*/
+function looksLikeJestJson(json) {
+	if (!json || typeof json !== "object") return false;
+	const testResults = json.testResults;
+	if (!Array.isArray(testResults) || testResults.length === 0) return false;
+	return testResults.some((r) => r && typeof r === "object" && Array.isArray(r.testResults));
+}
+function parseJestJson(json) {
+	if (!json || typeof json !== "object") return [];
+	const root = json;
+	const files = Array.isArray(root.testResults) ? root.testResults : [];
+	const out = [];
+	for (const fileResult of files.slice(0, 1e4)) {
+		if (!fileResult || typeof fileResult !== "object") continue;
+		const assertions = Array.isArray(fileResult.testResults) ? fileResult.testResults : [];
+		const file = fileResult.testFilePath ?? "unknown";
+		for (const assertion of assertions) {
+			if (!assertion || typeof assertion !== "object") continue;
+			const durationMs = Number.isFinite(assertion.duration) && assertion.duration >= 0 ? Math.round(assertion.duration) : 0;
+			const attempt = {
+				index: 1,
+				status: toStatus$2(assertion.status),
+				durationMs
+			};
+			const line = typeof assertion.location?.line === "number" && assertion.location.line > 0 ? assertion.location.line : void 0;
+			const title = assertion.title ?? "(unnamed)";
+			out.push({
+				file,
+				title,
+				attempts: [attempt],
+				...line !== void 0 ? { line } : {}
+			});
+		}
+	}
+	return out;
+}
+//#endregion
 //#region src/forensics/parse-junit.ts
 const MAX_INPUT = 20971520;
 function decodeEntities(s) {
@@ -11177,7 +11231,7 @@ function parseJunitXml(xml) {
 //#endregion
 //#region src/forensics/parse-playwright-json.ts
 const MAX_DEPTH = 32;
-function toStatus(raw) {
+function toStatus$1(raw) {
 	switch (raw) {
 		case "passed": return "passed";
 		case "failed": return "failed";
@@ -11210,7 +11264,7 @@ function parsePlaywrightJson(json) {
 					if (!r || typeof r !== "object") continue;
 					attempts.push({
 						index: ++i,
-						status: toStatus(r.status),
+						status: toStatus$1(r.status),
 						durationMs: Number.isFinite(r.duration) ? Math.max(0, r.duration) : 0
 					});
 				}
@@ -11229,6 +11283,54 @@ function parsePlaywrightJson(json) {
 	return out;
 }
 //#endregion
+//#region src/forensics/parse-vitest-json.ts
+function toStatus(raw) {
+	switch (raw) {
+		case "passed": return "passed";
+		case "failed": return "failed";
+		case "skipped":
+		case "pending":
+		case "todo":
+		case "disabled": return "skipped";
+		default: return "interrupted";
+	}
+}
+/** Sniff: the Vitest variant of the Jest-shaped report (see module doc). */
+function looksLikeVitestJson(json) {
+	if (!json || typeof json !== "object") return false;
+	const testResults = json.testResults;
+	if (!Array.isArray(testResults) || testResults.length === 0) return false;
+	return testResults.some((r) => r && typeof r === "object" && Array.isArray(r.assertionResults));
+}
+function parseVitestJson(json) {
+	if (!json || typeof json !== "object") return [];
+	const root = json;
+	const files = Array.isArray(root.testResults) ? root.testResults : [];
+	const out = [];
+	for (const fileResult of files.slice(0, 1e4)) {
+		if (!fileResult || typeof fileResult !== "object") continue;
+		const assertions = Array.isArray(fileResult.assertionResults) ? fileResult.assertionResults : [];
+		const file = fileResult.filepath ?? "unknown";
+		for (const assertion of assertions) {
+			if (!assertion || typeof assertion !== "object") continue;
+			const durationMs = Number.isFinite(assertion.duration) && assertion.duration >= 0 ? Math.round(assertion.duration) : 0;
+			const attempt = {
+				index: 1,
+				status: toStatus(assertion.status),
+				durationMs
+			};
+			const line = typeof assertion.location?.line === "number" && assertion.location.line > 0 ? assertion.location.line : void 0;
+			out.push({
+				file,
+				title: assertion.title ?? "(unnamed)",
+				attempts: [attempt],
+				...line !== void 0 ? { line } : {}
+			});
+		}
+	}
+	return out;
+}
+//#endregion
 //#region src/forensics/run.ts
 /**
 * `mjolnir forensics <dir-or-file>` — runtime evidence entry point (R4).
@@ -11236,7 +11338,9 @@ function parsePlaywrightJson(json) {
 * Accepts either a single report file or a directory. In a directory it
 * looks for, in priority order:
 *   1. report.json / playwright-report.json — Playwright JSON report
-*   2. *.xml                                — JUnit XML reports
+*   2. jest-report.json / vitest-report.json — Jest/Vitest JSON reports
+*   3. *.json (shape-sniffed: Playwright, Jest, Vitest)
+*   4. *.xml                                — JUnit XML reports
 *
 * Writes FLAKY.md next to the scan target unless --no-flaky-md.
 */
@@ -11307,17 +11411,27 @@ function parseFile(path, text) {
 		records: parseJunitXml(text),
 		source: "junit-xml"
 	};
+	let json;
 	try {
-		return {
-			records: parsePlaywrightJson(JSON.parse(text)),
-			source: "playwright-json"
-		};
+		json = JSON.parse(text);
 	} catch {
 		return {
 			records: [],
 			source: "playwright-json"
 		};
 	}
+	if (looksLikeJestJson(json)) return {
+		records: parseJestJson(json),
+		source: "jest-json"
+	};
+	if (looksLikeVitestJson(json)) return {
+		records: parseVitestJson(json),
+		source: "vitest-json"
+	};
+	return {
+		records: parsePlaywrightJson(json),
+		source: "playwright-json"
+	};
 }
 function listFiles(dir) {
 	const out = [];
@@ -13349,7 +13463,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.34",
+			version: "0.5.36",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -13421,6 +13535,62 @@ function renderSarif(result, repoRootUri) {
 	return JSON.stringify(sarif, null, 2);
 }
 //#endregion
+//#region src/reporter/codequality.ts
+/**
+* GitLab Code Quality reporter (product-gap-remediation master plan P3a,
+* plan 1788853205786 — flag 2, decision 2: GitLab is the in-plan second
+* platform).
+*
+* Emits the Code Quality report schema GitLab's `codequality` artifact
+* type consumes (docs.gitlab.com/ee/ci/testing/code_quality.html) so
+* findings render as MR widgets and diff annotations inside existing
+* governance — the same distribution logic as SARIF for GitHub, never a
+* second truth: this is a deterministic projection of the same
+* ScanResult the JSON contract carries.
+*
+* Usage: mjolnir --format codequality > gl-code-quality-report.json
+*
+* Severity map (documented in docs/GITLAB-CI.md):
+*   error   → major   (categorical defects — the gate's core)
+*   warning → minor
+*   info    → info
+*
+* Fingerprint stability: GitLab deduplicates MR findings across runs by
+* `fingerprint` — an unstable fingerprint would resurrect closed
+* findings on every push (the exact PR-noise the MR flow exists to
+* avoid). The fingerprint is sha256 over ruleId + repo-relative path +
+* line + column + message — the same finding shape the --why command
+* addresses, so a moved line legitimately re-reports and an unchanged
+* finding stays silent.
+*/
+function codeQualitySeverity(severity) {
+	if (severity === "error") return "major";
+	if (severity === "warning") return "minor";
+	return "info";
+}
+/**
+* sha256 hex over the identifying tuple. Exported for the contract test:
+* the fingerprint MUST be stable across runs for an unchanged finding
+* (GitLab dedup contract) and MUST change when the finding's identity
+* changes (otherwise an MR could hide a moved-and-still-broken line).
+*/
+function codeQualityFingerprint(f) {
+	return createHash("sha256").update(`${f.ruleId}\u0000${f.file}\u0000${f.line}\u0000${f.column}\u0000${f.message}`).digest("hex");
+}
+function renderCodeQuality(result) {
+	const issues = result.findings.map((f) => ({
+		description: f.message,
+		check_name: f.ruleId,
+		fingerprint: codeQualityFingerprint(f),
+		severity: codeQualitySeverity(f.severity),
+		location: {
+			path: f.file.replaceAll("\\", "/"),
+			lines: { begin: f.line }
+		}
+	}));
+	return JSON.stringify(issues, null, 2) + "\n";
+}
+//#endregion
 //#region src/reporter/mermaid.ts
 function sanitizeId(raw) {
 	return raw.replace(/[^a-z0-9]/gi, "_");
@@ -15575,6 +15745,10 @@ const HELP_FLAGS = [
 		flag: "--format sarif",
 		summary: "SARIF 2.1 for GitHub Code Scanning"
 	},
+	{
+		flag: "--format codequality",
+		summary: "GitLab Code Quality report (MR widget artifact)"
+	},
 	{
 		flag: "--format mermaid",
 		summary: "test-architecture diagram"
@@ -18484,7 +18658,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.34";
+const CLI_VERSION = "0.5.36";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",
@@ -18507,6 +18681,7 @@ function parseArgs(argv, onError) {
 			const fmt = argv[++i];
 			if (fmt === "sarif") args.format = "sarif";
 			else if (fmt === "mermaid") args.format = "mermaid";
+			else if (fmt === "codequality") args.format = "codequality";
 			else if (fmt === "json") {
 				args.format = "json";
 				args.json = true;
@@ -18891,6 +19066,7 @@ async function runScanCommand(argv, io = {
 		}
 		if (args.format === "sarif") io.out(renderSarif(result, pathToFileURL(target).href));
 		else if (args.format === "mermaid") io.out(renderMermaid(result));
+		else if (args.format === "codequality") io.out(renderCodeQuality(result));
 		else if (args.json) io.out(JSON.stringify({
 			...result,
 			contract: buildMachineContract(result)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mjolnir-qa",
-  "version": "0.5.34",
+  "version": "0.5.36",
   "description": "Mjölnir — the Verification Trust Engine for QA. Audits test suites and CI pipelines, reports a worthiness score and prioritized findings.",
   "type": "module",
   "engines": {