mjolnir-qa 0.5.5 → 0.5.6

package/CHANGELOG.md

@@ -74,6 +74,17 @@ scan`. Unknown categories are a usage error (exit 10).
 - help registry gained `why`, `handoff`, `install` and the new flags;
   site/reference/cli.md documents the handoff trust model.
 
+## [0.5.6] — 2026-09-06
+
+### Changes since 0.5.5
+
+- Merge pull request #39 from Sergey-Bar/eng/verification-trust-2.0
+- docs: regenerate readme SVGs under the revision-2 CI-rule measurements
+- docs: regenerate rule-doc occurrence tables (yarnpkg-berry corpus lane)
+- fix: eslint pragma for the file-wide consumer fallback regex
+- fix: rev-2 enforcement arm in QA-CI-008 was dead code + coverage arms for CI rules
+- ci-family trust repair: M2 detector re-adjudication, revision 2 re-measurement, workflow corpus lane
+
 ## [0.5.5] — 2026-09-06
 
 ### Audit Remediation 1.0 (engine correctness + trust boundary)

package/README.md

@@ -284,13 +284,13 @@ firewall.
 
 ### How much of this is measured
 
-**74 of 99 rules carry a false-positive rate measured against real OSS code** (≥ 10 hand-classified findings each; see
-[docs/FP-AUDIT.md](docs/FP-AUDIT.md)). The other 19 ship on the author's
+**76 of 99 rules carry a false-positive rate measured against real OSS code** (≥ 10 hand-classified findings each; see
+[docs/FP-AUDIT.md](docs/FP-AUDIT.md)). The other 23 ship on the author's
 estimate. Every scan footer tells you how many of the rules that _fired_
 are measured; `mjolnir rules --unmeasured` lists the ones that aren't;
 every rule's `mjolnir explain` page states its status. We publish the rate
 even when it's ugly — QA-CS-103 audits at 95% and is quarantined for it.
-Growing that 78 is the project's continuing work.
+Growing that number is the project's continuing work.
 
 ### Rule tiers and language maturity
 

package/dist/cli.d.mts

@@ -690,7 +690,7 @@ declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniver
  * `scripts/sync-sarif-version.cjs` on release and guarded by
  * `tests/version-consistency.spec.ts` locally.
  */
-declare const CLI_VERSION = "0.5.5";
+declare const CLI_VERSION = "0.5.6";
 /** A usage-error detail: the offending token, when one exists. */
 interface UsageErrorDetail {
   /** The unknown flag or rejected value (e.g. `--nope`, `loud`). */

package/dist/cli.mjs

@@ -1766,8 +1766,10 @@ function parseWorkflow(text) {
 			const step = s;
 			return {
 				...typeof step["name"] === "string" ? { name: step["name"] } : {},
+				...typeof step["id"] === "string" ? { id: step["id"] } : {},
 				...typeof step["run"] === "string" ? { run: step["run"] } : {},
 				...typeof step["uses"] === "string" ? { uses: step["uses"] } : {},
+				...typeof step["if"] === "string" ? { if: step["if"] } : {},
 				...step["with"] && typeof step["with"] === "object" && !Array.isArray(step["with"]) ? { with: { ...step["with"] } } : {},
 				...typeof step["continue-on-error"] === "boolean" || typeof step["continue-on-error"] === "string" ? { "continue-on-error": step["continue-on-error"] } : {}
 			};
@@ -3546,7 +3548,7 @@ const VERIFICATION_GATE_RE = new RegExp([
 	String.raw`\bplaywright\s+test\b`,
 	String.raw`\b(?:pytest|tox|nox)\b`,
 	String.raw`\bpython\s+-m\s+(?:pytest|unittest)\b`,
-	String.raw`\bmvn\b[^\n]+\b(?:test|verify)\b`,
+	String.raw`\bmvn[wd]?\b[^\n]+\b(?:test|verify)\b`,
 	String.raw`\b(?:\./)?gradlew?\b[^\n]+\btest\b`,
 	String.raw`\bdotnet\s+test\b`,
 	String.raw`\bgo\s+test\b`,
@@ -3578,6 +3580,45 @@ function stepIsVerificationGate(step) {
 	}
 	return false;
 }
+/**
+* detectorRevision 2 (M2, 2026-09-04): legitimate continue-on-error shapes
+* the rev-1 detector flagged. Each class was proven by adjudication
+* (docs/FP-AUDIT.md notes, 2026-09-02):
+* 1. Re-run idiom (appsmith ci-test-playwright.yml): the gate runs under
+*    continue-on-error ONLY to convert attempt 1 into a non-failing
+*    outcome so a follow-up step can re-run the SAME gate; the follow-up
+*    runs unconditionally and its failure fails the job — the gate still
+*    blocks.
+* 2. Non-gate shapes that matched the rev-1 run-text regex: report
+*    aggregation (`test --merge-reports`), test-ID collection, shard
+*    rebalancing helpers — they execute no verification.
+* 3. Steps whose `if:`/name explicitly mark them advisory/non-blocking
+*    inside jobs that run the real gates (vault custom-linter,
+*    github-docs sync-sdk-docs).
+*/
+const RERUN_OUTCOME_RE = /steps\.[\w-]+\.outcome\s*==\s*['"]?failure['"]?|steps\.[\w-]+\.conclusion\s*==\s*['"]?failure['"]?/;
+function jobReRunsTheMaskedGate(steps, maskedIndex) {
+	return steps.some((s, i) => {
+		if (i === maskedIndex) return false;
+		const cond = typeof s?.if === "string" ? s.if : "";
+		if (!RERUN_OUTCOME_RE.test(cond)) return false;
+		return stepIsVerificationGate(s);
+	});
+}
+/** Explicit advisory/non-verification shapes in run text. */
+const NON_GATE_RUN_RE = /--merge-reports\b|\bmerge-reports\b|\bcollect[- ]only\b|list[- ]tests\b|\brebalance\b/i;
+/**
+* Steps whose own name declares the non-blocking intent (adjudicated FP:
+* vault code-checker.yml "Check custom linters (non-blocking)" — the
+* workflow's own vocabulary marks the advisory contract, so the green
+* check hides nothing the author claimed would gate).
+*/
+const NON_BLOCKING_NAME_RE = /\(\s*non-?blocking\s*\)|\[.*non-?blocking.*\]/i;
+function stepIsGateExcludingNonVerification(step) {
+	if (step.name && NON_BLOCKING_NAME_RE.test(step.name)) return false;
+	if (step.run && NON_GATE_RUN_RE.test(step.run)) return false;
+	return stepIsVerificationGate(step);
+}
 const continueOnError = defineRule({
 	id: "QA-CI-001",
 	category: "QA-CI",
@@ -3604,13 +3645,13 @@ const continueOnError = defineRule({
 		for (const [jobName, job] of Object.entries(jobs)) {
 			const steps = job?.steps ?? [];
 			if (job && job["continue-on-error"] === true) {
-				if (steps.some(stepIsVerificationGate)) findings.push({
+				if (steps.some(stepIsGateExcludingNonVerification)) findings.push({
 					severity: "error",
 					confidence: "high",
 					findingType: "deterministic-defect",
 					qaImpact: "FALSE-GREEN",
 					file: ctx.path,
-					line: findLine$4(ctx.text, new RegExp(`^\\s{2,6}${escapeRe$2(jobName)}:`, "m")),
+					line: findLine$2(ctx.text, new RegExp(`^\\s{2,6}${escapeRe$1(jobName)}:`, "m")),
 					column: 1,
 					message: `Job \`${jobName}\` runs a verification gate under \`continue-on-error: true\`.`,
 					why: "This job can fail every day and CI will still show green. The checkmark on this workflow cannot be trusted.",
@@ -3619,7 +3660,8 @@ const continueOnError = defineRule({
 			}
 			for (const [i, step] of steps.entries()) {
 				if (!step || step["continue-on-error"] !== true) continue;
-				if (!stepIsVerificationGate(step)) continue;
+				if (!stepIsGateExcludingNonVerification(step)) continue;
+				if (jobReRunsTheMaskedGate(steps, i)) continue;
 				findings.push({
 					severity: "error",
 					confidence: "high",
@@ -3681,7 +3723,7 @@ function locateStepContinueOnError(text, step) {
 	if (anchorAt !== -1) return lineOf(text, anchorAt);
 	return 1;
 }
-function findLine$4(text, re) {
+function findLine$2(text, re) {
 	const m = re.exec(text);
 	if (!m) return 1;
 	return lineOf(text, m.index);
@@ -3691,7 +3733,7 @@ function lineOf(text, index) {
 	for (let i = 0; i < index; i++) if (text[i] === "\n") line++;
 	return line;
 }
-function escapeRe$2(s) {
+function escapeRe$1(s) {
 	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 //#endregion
@@ -3716,6 +3758,7 @@ const swallowedExitCode = defineRule({
 	detectionStrategy: "LEXICAL",
 	introduced: "0.1.0",
 	tier: "extended",
+	detectorRevision: 2,
 	run(ctx) {
 		const findings = [];
 		const re = /\|\|\s*true\b|:\s*(?:npm|yarn|pnpm|make|pytest|go)\b[^`\n]*\|\|\s*echo/g;
@@ -3767,6 +3810,7 @@ const retryMasking = defineRule({
 	detectionStrategy: "LEXICAL",
 	introduced: "0.1.0",
 	tier: "extended",
+	detectorRevision: 2,
 	run(ctx) {
 		const findings = [];
 		const doc = ctx.ast;
@@ -3782,38 +3826,74 @@ const retryMasking = defineRule({
 					findingType: "deterministic-defect",
 					qaImpact: "FLAKY-RISK",
 					file: ctx.path,
-					line: findLine$3(ctx.text, new RegExp(escapeRe$1(step.uses))),
+					line: findStepUsesLine(ctx.text, step.uses, command),
 					column: 1,
 					message: `Job \`${jobName}\` wraps a test command in an automatic retry action.`,
 					why: "Retrying tests until they pass hides flaky and intermittent failures — the green check no longer means the suite passed.",
 					fix: "Remove the retry wrapper; investigate the underlying flakiness instead."
 				});
 			}
-			if (step?.run && /\bfor\b[\s\S]+retry|max_attempts|until.*succeed/i.test(step.run) && /test/i.test(step.run)) findings.push({
-				severity: "warning",
-				confidence: "medium",
-				findingType: "heuristic-risk",
-				qaImpact: "FLAKY-RISK",
-				file: ctx.path,
-				line: findLine$3(ctx.text, /max_attempts|until.*succeed/i),
-				column: 1,
-				message: `Job \`${jobName}\` contains a shell retry loop around tests.`,
-				why: "Retry-until-pass loops mask intermittent failures instead of surfacing them.",
-				fix: "Run tests once; track and fix flakes explicitly."
-			});
+			if (step?.run) {
+				const LOOP_RE = /\bfor\b[^\n]*\$\(\s*(?:seq|range)\b|\bfor\b[^\n]*\{\d+\.\.\d+\}|\bfor\s+\w+\s+in\s+\d+(?:[,\t ]+\d+)*[;\s]*do\b|\bwhile\b[^\n]*\btrue\b|\bwhile\s+:;|\bmax_attempts\b|\buntil\b[^\n]*\bsucceed\b/i;
+				const TEST_GATE_RE = /\b(?:npm|yarn|pnpm|bun)\s+(?:run\s+)?(?:test|t)\b|\bnpx\s+(?:vitest|jest|mocha|ava|playwright\s+test)\b|\b(?:vitest|jest|mocha|ava|tap)\b|\bplaywright\s+test\b|\b(?:pytest|tox|nox)\b|\bpython\s+-m\s+(?:pytest|unittest)\b|\bmvn[wd]?\b[^\n]+\b(?:test|verify)\b|\b(?:[.]\/)?gradlew?\b[^\n]+\btest\b|\bdotnet\s+test\b|\bgo\s+test\b|\bcargo\s+test\b|\bmake\s+[\w./\\-]*test\b/i;
+				const isCurlProbe = /\b(?:curl|wget)\b/.test(step.run) && !TEST_GATE_RE.test(step.run);
+				if (LOOP_RE.test(step.run) && TEST_GATE_RE.test(step.run) && !isCurlProbe) findings.push({
+					severity: "warning",
+					confidence: "medium",
+					findingType: "heuristic-risk",
+					qaImpact: "FLAKY-RISK",
+					file: ctx.path,
+					line: findStepLoopLine(ctx.text, step.run, LOOP_RE),
+					column: 1,
+					message: `Job \`${jobName}\` contains a shell retry loop around tests.`,
+					why: "Retry-until-pass loops mask intermittent failures instead of surfacing them.",
+					fix: "Run tests once; track and fix flakes explicitly."
+				});
+			}
 		}
 		return findings;
 	}
 });
-function findLine$3(text, re) {
+/**
+* Line of the loop construct belonging to THIS step.
+*
+* detectorRevision 2: anchors at the step's first run line, then finds the
+* loop construct at or after it — a file-wide LOOP_RE search reported every
+* matching step on the first loop occurrence in the file.
+*/
+function findStepLoopLine(text, run, loopRe) {
+	const firstLine = run.split("\n").map((l) => l.trim()).find((l) => l.length > 0);
+	const anchorAt = text.indexOf(firstLine);
+	const re = new RegExp(loopRe.source, "gi");
+	re.lastIndex = Math.max(0, anchorAt);
 	const m = re.exec(text);
 	if (!m) return 1;
 	let line = 1;
 	for (let i = 0; i < m.index; i++) if (text[i] === "\n") line++;
 	return line;
 }
-function escapeRe$1(s) {
-	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+* Line of the retry-action `uses:` belonging to THIS step.
+*
+* detectorRevision 2: anchors at the step's own `with.command` text and
+* takes the nearest `uses:` occurrence at or before it — a file-wide search
+* reported every wrapping step on the first occurrence when several jobs
+* use the same retry action at the same version.
+*/
+function findStepUsesLine(text, uses, command) {
+	const needle = uses.trim();
+	const firstCmdLine = command.trim().split("\n")[0]?.trim();
+	const at = nearestBefore(text, Math.max(0, text.indexOf(firstCmdLine)), needle);
+	if (at === -1) return 1;
+	let line = 1;
+	for (let i = 0; i < at; i++) if (text[i] === "\n") line++;
+	return line;
+}
+/** The nearest occurrence of `needle` ending at or before `at`. */
+function nearestBefore(text, at, needle) {
+	const windowStart = Math.max(0, at - 2e3);
+	const rel = text.slice(windowStart, at + 1).lastIndexOf(needle);
+	return rel !== -1 ? windowStart + rel : -1;
 }
 //#endregion
 //#region src/rules/ci/qa-ci-005-report-never-generated.ts
@@ -3825,15 +3905,76 @@ function escapeRe$1(s) {
 * that no previous step produces — the gate reads an empty or stale file
 * and passes vacuously. Product-MVP §35: "Required report not produced".
 */
+/**
+* Producer vocabulary for coverage reports, one regex over run text.
+*
+* detectorRevision 2 (M2, 2026-09-04): the rev-1 regex knew only
+* `vitest|jest|nyc --coverage`. Adjudication against the real corpus
+* (docs/FP-AUDIT.md rows) proved four blindness classes, each a real
+* producer the regex could not see:
+* 1. Java/JaCoCo — `mvn verify` with the jacoco-maven-plugin, Gradle
+*    `jacocoTestReport`
+* 2. Python — `pytest --cov` (pytest-cov), `coverage run/combine/json/xml`
+*    (coverage.py), `COVERAGE_FILE` env wiring
+* 3. Go / .NET / Rust — `go test -coverprofile`, `dotnet test --collect`,
+*    `cargo llvm-cov` / `cargo tarpaulin`
+* 4. Script-name coverage — `npm run test:coverage` and friends, where the
+*    coverage flag lives inside package.json, invisible from the workflow
+*
+* Known residual limitation (documented, not fixable single-file): a
+* producer in a DIFFERENT workflow (reusable workflows, artifact producers
+* from `workflow_run` jobs) or inside tox.ini / vitest.config is invisible;
+* cross-workflow consumers remain flaggable — measured rates carry those
+* verdicts (streamlit ai-test-coverage.yml class).
+*/
+/**
+* Producer vocabulary for coverage reports, tested one literal at a time
+* over run/`with` text.
+*
+* detectorRevision 2 (M2, 2026-09-04): the rev-1 regex knew only
+* `vitest|jest|nyc --coverage`. Adjudication against the real corpus
+* (docs/FP-AUDIT.md rows) proved four blindness classes, each a real
+* producer the regex could not see:
+* 1. Java/JaCoCo — `mvn verify` with the jacoco-maven-plugin, Gradle
+*    `jacocoTestReport`
+* 2. Python — `pytest --cov` (pytest-cov), `coverage run/combine/json/xml`
+*    (coverage.py), `COVERAGE_FILE` env wiring
+* 3. Go / .NET / Rust — `go test -coverprofile`, `dotnet test --collect`,
+*    `cargo llvm-cov` / `cargo tarpaulin`
+* 4. Script-name coverage — `npm run test:coverage` and friends, where the
+*    coverage flag lives inside package.json, invisible from the workflow
+*
+* Known residual limitation (documented, not fixable single-file): a
+* producer in a DIFFERENT workflow (reusable workflows, artifact producers
+* from `workflow_run` jobs) or inside tox.ini / vitest.config is invisible;
+* cross-workflow consumers remain flaggable — measured rates carry those
+* verdicts (streamlit ai-test-coverage.yml class).
+*/
+const COVERAGE_PRODUCERS = [
+	/\b(?:npx\s+)?(?:vitest|jest|nyc)\b[^\n]*--coverage\b/i,
+	/--coverage\b/i,
+	/\b(?:npm|yarn|pnpm|bun)\s+(?:run\s+)?[\w:@/.-]*coverage[\w:@/.-]*/i,
+	/\bmvn[wd]?\b[^\n]*\b(?:jacoco|verify)\b/i,
+	/\b(?:[.]\/)?gradlew?\b[^\n]*\bjacoco\w*\b/i,
+	/\bjacoco\w*Report\b/i,
+	/\bpytest\b[^\n]*--cov\b/i,
+	/\bcoverage\s+(?:run|combine|json|xml|report)\b/i,
+	/\bCOVERAGE_FILE\b/i,
+	/\bpytest-cov\b/i,
+	/\bgo\s+test\b[^\n]*-cover(?:profile|mode|age)\b/i,
+	/\bdotnet\s+test\b[^\n]*(?:--collect|--coverage|collect coverage)/i,
+	/\bcargo\s+(?:llvm-cov|tarpaulin)\b/i,
+	/\b(?:coverage|lcov|cobertura)[\w./-]*\.(?:info|xml|json|lcov)\b/i
+];
 /** Known report-consumption patterns and the commands that produce them. */
 const CONSUMERS = [{
 	re: /codecov|coveralls/i,
 	stepRe: /upload-artifact/i,
-	producer: /\b(?:npx\s+)?(?:vitest|jest|nyc)\b[\s\S]*--coverage|--coverage\b/i,
+	producers: COVERAGE_PRODUCERS,
 	label: "coverage artifact"
 }, {
 	re: /codecov|coveralls/i,
-	producer: /--coverage\b|(?:vitest|jest|nyc)\b[\s\S]+coverage/i,
+	producers: COVERAGE_PRODUCERS,
 	label: "coverage upload"
 }];
 const reportNeverGenerated = defineRule({
@@ -3852,27 +3993,34 @@ const reportNeverGenerated = defineRule({
 	detectionStrategy: "LEXICAL",
 	introduced: "0.1.0",
 	tier: "quarantine",
+	detectorRevision: 2,
 	run(ctx) {
 		const findings = [];
 		const doc = ctx.ast;
 		if (!doc?.jobs) return findings;
 		const jobEntries = Object.entries(doc.jobs);
-		const workflowRunText = jobEntries.map(([, j]) => (j?.steps ?? []).map((s) => s?.run ?? "").join("\n")).join("\n");
+		const stepText = (s) => [s.run ?? "", ...s.uses?.includes("upload-artifact") ? [] : Object.values(s.with ?? {}).filter((v) => typeof v === "string")].join("\n");
+		const workflowRunText = jobEntries.map(([, j]) => (j?.steps ?? []).map(stepText).join("\n")).join("\n");
 		for (const [jobName, job] of jobEntries) {
 			const steps = job?.steps ?? [];
-			const allRunText = steps.map((s) => s?.run ?? "").join("\n");
+			const allRunText = steps.map(stepText).join("\n");
 			for (const consumer of CONSUMERS) {
 				if (!(steps.some((s) => {
 					if (s.uses && consumer.re.test(s.uses)) return true;
 					if (consumer.stepRe && s.uses && consumer.stepRe.test(s.uses) && s.with && typeof s.with["path"] === "string" && /coverage|lcov/i.test(s.with["path"])) return true;
 					return false;
 				}) || consumer.re.test(allRunText))) continue;
-				if (!(consumer.producer.test(allRunText) || consumer.producer.test(workflowRunText))) findings.push({
+				const coverageDataDownload = steps.some((s) => s.uses?.includes("download-artifact") === true && s.with !== void 0 && [
+					"pattern",
+					"path",
+					"name"
+				].some((k) => typeof s.with?.[k] === "string" && /coverage/i.test(s.with[k])));
+				if (!(consumer.producers.some((p) => p.test(allRunText) || p.test(workflowRunText)) || coverageDataDownload)) findings.push({
 					severity: "error",
 					confidence: "high",
 					findingType: "deterministic-defect",
 					file: ctx.path,
-					line: findLine$2(ctx.text, consumer.re),
+					line: findJobConsumerLine(ctx.text, jobName, consumer.re),
 					column: 1,
 					message: `Job \`${jobName}\` consumes a ${consumer.label} that no step generates.`,
 					why: "The gate reads a report that is never produced — it passes on empty/stale data while appearing to verify something.",
@@ -3884,11 +4032,27 @@ const reportNeverGenerated = defineRule({
 		return findings;
 	}
 });
-function findLine$2(text, re) {
-	const m = re.exec(text);
-	if (!m) return 1;
+/**
+* Line of the consumer signal belonging to THIS job.
+*
+* detectorRevision 2: `findLine` searched the whole file and always
+* returned the FIRST consumer occurrence — every consuming job in a
+* multi-job workflow reported the same line, so distinct findings
+* collapsed into one verdict position. Anchoring at the job's own
+* declaration keeps each job's finding on its own line.
+*/
+function findJobConsumerLine(text, jobName, consumerRe) {
+	const declMatch = new RegExp(`^\\s{2,6}${jobName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}:`, "m").exec(text);
+	const re = new RegExp(consumerRe.source, "gi");
+	re.lastIndex = declMatch ? declMatch.index : 0;
+	const anchored = re.exec(text);
+	if (anchored) return lineOfIndex(text, anchored.index);
+	const anywhere = new RegExp(consumerRe.source, "i").exec(text);
+	return anywhere ? lineOfIndex(text, anywhere.index) : 1;
+}
+function lineOfIndex(text, index) {
 	let line = 1;
-	for (let i = 0; i < m.index; i++) if (text[i] === "\n") line++;
+	for (let i = 0; i < index; i++) if (text[i] === "\n") line++;
 	return line;
 }
 //#endregion
@@ -3901,6 +4065,18 @@ function findLine$2(text, re) {
 * failure-tolerant pattern can flip a red job green — the classic
 * false-green trick.
 */
+/**
+* Failure-enforcement shapes that legitimately follow tolerated steps: a
+* later `if: always()` step that checks the recorded status and exits
+* non-zero on failure. Adjudication (hashicorp/vault build.yml:889,
+* ci.yml:492, test-go.yml:992 — 2026-09-02) proved the rev-1 detector
+* blind to this canonical honest pattern: the tolerated steps' outcomes
+* ARE enforced after them, so nothing is masked.
+*/
+const ENFORCED_FAILURE_LATER = /(?:result|status)[^\n]*!=\s*['"]?success['"]?|exit\s+1\b|FAILURE|has\s*failed/i;
+function laterStepEnforcesFailure(steps, fromIndex) {
+	return steps.slice(fromIndex + 1).some((s) => typeof s?.if === "string" && /always\s*\(\)/.test(s.if) && /!=\s*['"]?success['"]?|==\s*['"]?failure['"]?|result/i.test(s.if) && typeof s?.run === "string" && ENFORCED_FAILURE_LATER.test(s.run));
+}
 const alwaysSuccessStep = defineRule({
 	id: "QA-CI-008",
 	category: "QA-CI",
@@ -3917,6 +4093,7 @@ const alwaysSuccessStep = defineRule({
 	detectionStrategy: "LEXICAL",
 	introduced: "0.1.0",
 	tier: "quarantine",
+	detectorRevision: 2,
 	run(ctx) {
 		const findings = [];
 		const doc = ctx.ast;
@@ -3926,9 +4103,11 @@ const alwaysSuccessStep = defineRule({
 			if (steps.length < 2) continue;
 			const last = steps[steps.length - 1];
 			if (!last?.run) continue;
-			const suspicious = /^\s*exit\s+0\s*$/m.test(last.run) || /^\s*(?:echo|printf)\b[^&|;]*$/.test(last.run.trim()) || /^\s*true\s*$/.test(last.run.trim());
-			const earlierTolerant = steps.slice(0, -1).some((s) => s?.["continue-on-error"] === true || /\|\|\s*true\b/.test(s?.run ?? ""));
-			if (suspicious && earlierTolerant) findings.push({
+			const suspicious = !/exit\s+1\b|!=\s*['"]?success['"]?|==\s*['"]?failure['"]?/.test(last.run) && (/^\s*exit\s+0\s*$/m.test(last.run) || /^\s*(?:echo|printf)\b[^&|;]*$/.test(last.run.trim()) || /^\s*true\s*$/.test(last.run.trim()));
+			const earlierTolerantGate = steps.slice(0, -1).some((s) => (s?.["continue-on-error"] === true || /\|\|\s*true\b/.test(s?.run ?? "")) && (looksLikeVerificationGate(s?.run ?? "") || s?.uses !== void 0 && /playwright|cypress|codecov\/codecov-action/i.test(s.uses)));
+			const toleratedIdx = steps.findIndex((s) => (s?.["continue-on-error"] === true || /\|\|\s*true\b/.test(s?.run ?? "")) && (looksLikeVerificationGate(s?.run ?? "") || s?.uses !== void 0 && /playwright|cypress|codecov\/codecov-action/i.test(s.uses)));
+			if (toleratedIdx !== -1 && laterStepEnforcesFailure(steps, toleratedIdx)) continue;
+			if (suspicious && earlierTolerantGate) findings.push({
 				severity: "error",
 				confidence: "high",
 				findingType: "deterministic-defect",
@@ -3981,6 +4160,8 @@ const exitCodeNotPropagated = defineRule({
 	detectionStrategy: "FRAMEWORK",
 	detectionNotes: "regex pattern on parsed workflow AST",
 	introduced: "0.4.0",
+	detectorRevision: 2,
+	tier: "extended",
 	run(ctx) {
 		const findings = [];
 		const doc = ctx.ast;
@@ -4008,11 +4189,13 @@ const exitCodeNotPropagated = defineRule({
 				});
 			}
 			if (/set\s+(?:-[A-Za-df-z]*e[A-Za-z]*|-o\s+errexit)\b/.test(run)) continue;
+			const strippedRun = stripQuoted(run);
 			const seqRe = new RegExp(`(?:${TEST_CMD$1.source})[^\\n;]*;\\s*[^\\n]+`, "g");
 			let sm;
-			while ((sm = seqRe.exec(run)) !== null) {
+			while ((sm = seqRe.exec(strippedRun)) !== null) {
 				const seg = sm[0];
 				if (/&&|\|\|/.test(seg)) continue;
+				if (/^\s*(?:do|then|else|fi|done|elif|esac)\b|^\s*\}/.test(seg.slice(seg.indexOf(";") + 1))) continue;
 				const afterSemi = seg.slice(seg.indexOf(";") + 1);
 				if (TEST_CMD$1.test(afterSemi)) continue;
 				findings.push({
@@ -4032,6 +4215,17 @@ const exitCodeNotPropagated = defineRule({
 		return findings;
 	}
 });
+/**
+* Replaces the CONTENT of double- and single-quoted segments with spaces
+* (length-preserving) so shell separators inside strings — a JS test file
+* echoed through `tee`, e.g. `echo "it('x'); expect(y)" | tee t.js` — can
+* never anchor a `;`-sequence finding. Quotes are shell-sensitive; this is
+* deliberately conservative: only quote-delimited, same-line segments are
+* stripped.
+*/
+function stripQuoted(text) {
+	return text.replace(/"[^"\n]*"|'[^'\n]*'/g, (m) => " ".repeat(m.length));
+}
 function findLine$1(text, needle) {
 	const idx = text.indexOf(needle);
 	if (idx === -1) return 1;
@@ -4057,7 +4251,19 @@ const TEST_CMD = /\b(?:npm|yarn|pnpm)\s+(?:run\s+)?test\b|\b(?:jest|vitest|pytes
 * `if:` conditions that skip the job on pull requests.
 * NOTE: `!=` only — `github.event_name == 'pull_request'` is the OPPOSITE
 * (run ONLY on PRs) and must never match here.
-*/
+*
+* detectorRevision 2 (M2, 2026-09-04): a condition that CONTAINS a
+* push-match alternative can still RUN on PRs via `||` branches —
+* `github.event_name == 'push' || ... || (pull_request && !draft)` runs on
+* non-draft PRs (adjudicated FPs: nocodb jest-unit-test.yml, grafana
+* pr-frontend-unit-tests.yml, streamlit publish jobs). The condition is a
+* skip only when EVERY PR-shaped alternative excludes PRs: i.e. the
+* condition contains a PR-inclusive branch (== pull_request, !draft,
+* labeled trigger) or consists solely of push/schedule/dispatch
+* alternatives — matched below only when no PR-inclusive alternative
+* exists anywhere in the condition.
+*/
+const PR_INCLUSIVE_RE = /github\.event_name\s*==\s*['"]?pull_request\b|pull_request[^\n]*!\s*=\s*['"]?draft|!\s*github\.event\.pull_request|github\.event\.label\.name|!=\s*['"]?draft['"]?|head\.repo\.fork\s*==\s*['"]?false['"]?/;
 const SKIP_ON_PR = /github\.event_name\s*!=\s*['"]?pull_request|github\.event_name\s*==\s*['"]?(?:push|schedule|workflow_dispatch)\b|!\s*github\.event\b|github\.ref\s*==\s*['"]?refs\/heads\/(?:main|master)\b/;
 const nonBlockingTestJob = defineRule({
 	id: "QA-CI-010",
@@ -4076,6 +4282,7 @@ const nonBlockingTestJob = defineRule({
 	detectionNotes: "regex heuristic on parsed workflow AST",
 	introduced: "0.4.0",
 	tier: "quarantine",
+	detectorRevision: 2,
 	run(ctx) {
 		const findings = [];
 		const doc = ctx.ast;
@@ -4083,6 +4290,7 @@ const nonBlockingTestJob = defineRule({
 		for (const [jobName, job] of Object.entries(doc.jobs)) {
 			if (!(job?.steps ?? []).some((s) => TEST_CMD.test(s?.run ?? ""))) continue;
 			const cond = typeof job?.if === "string" ? job.if : "";
+			if (cond && PR_INCLUSIVE_RE.test(cond)) continue;
 			if (cond && SKIP_ON_PR.test(cond)) findings.push({
 				severity: "error",
 				confidence: "medium",
@@ -8589,46 +8797,53 @@ function getRule(id) {
 //#region src/rules/measured-fp.generated.ts
 const MEASURED_FP = {
 	"QA-CI-001": {
-		fpRate: .316,
+		fpRate: .105,
 		n: 19,
 		detectorRevision: 2,
-		ciLow: .1536,
-		ciHigh: .5399
+		ciLow: .0294,
+		ciHigh: .3139
 	},
 	"QA-CI-002": {
-		fpRate: .188,
-		n: 16,
-		detectorRevision: 1,
-		ciLow: .0659,
-		ciHigh: .4301
+		fpRate: .111,
+		n: 18,
+		detectorRevision: 2,
+		ciLow: .031,
+		ciHigh: .328
 	},
 	"QA-CI-005": {
-		fpRate: .824,
-		n: 17,
-		detectorRevision: 1,
-		ciLow: .5897,
-		ciHigh: .9381
+		fpRate: .077,
+		n: 13,
+		detectorRevision: 2,
+		ciLow: .0137,
+		ciHigh: .3331
 	},
 	"QA-CI-007": {
-		fpRate: .273,
+		fpRate: 0,
 		n: 11,
-		detectorRevision: 1,
-		ciLow: .0975,
-		ciHigh: .5656
+		detectorRevision: 2,
+		ciLow: 0,
+		ciHigh: .2588
 	},
 	"QA-CI-008": {
-		fpRate: .75,
-		n: 16,
-		detectorRevision: 1,
-		ciLow: .505,
-		ciHigh: .8982
+		fpRate: .1,
+		n: 10,
+		detectorRevision: 2,
+		ciLow: .0179,
+		ciHigh: .4042
+	},
+	"QA-CI-009": {
+		fpRate: 0,
+		n: 10,
+		detectorRevision: 2,
+		ciLow: 0,
+		ciHigh: .2775
 	},
 	"QA-CI-010": {
-		fpRate: .4,
+		fpRate: .1,
 		n: 10,
-		detectorRevision: 1,
-		ciLow: .1682,
-		ciHigh: .6873
+		detectorRevision: 2,
+		ciLow: .0179,
+		ciHigh: .4042
 	},
 	"QA-CS-101": {
 		fpRate: 0,
@@ -8659,18 +8874,18 @@ const MEASURED_FP = {
 		ciHigh: .495
 	},
 	"QA-CS-108": {
-		fpRate: 1,
-		n: 20,
+		fpRate: .87,
+		n: 23,
 		detectorRevision: 1,
-		ciLow: .8389,
-		ciHigh: 1
+		ciLow: .6787,
+		ciHigh: .9546
 	},
 	"QA-CS-110": {
-		fpRate: 1,
-		n: 20,
+		fpRate: .769,
+		n: 26,
 		detectorRevision: 1,
-		ciLow: .8389,
-		ciHigh: 1
+		ciLow: .5795,
+		ciHigh: .8897
 	},
 	"QA-CS-111": {
 		fpRate: 1,
@@ -8688,17 +8903,17 @@ const MEASURED_FP = {
 	},
 	"QA-JV-101": {
 		fpRate: 0,
-		n: 20,
+		n: 23,
 		detectorRevision: 1,
 		ciLow: 0,
-		ciHigh: .1611
+		ciHigh: .1431
 	},
 	"QA-JV-102": {
-		fpRate: .3,
-		n: 20,
+		fpRate: .261,
+		n: 23,
 		detectorRevision: 1,
-		ciLow: .1455,
-		ciHigh: .519
+		ciLow: .1255,
+		ciHigh: .4647
 	},
 	"QA-JV-103": {
 		fpRate: .259,
@@ -8722,25 +8937,25 @@ const MEASURED_FP = {
 		ciHigh: .301
 	},
 	"QA-JV-108": {
-		fpRate: 1,
-		n: 20,
+		fpRate: .87,
+		n: 23,
 		detectorRevision: 1,
-		ciLow: .8389,
-		ciHigh: 1
+		ciLow: .6787,
+		ciHigh: .9546
 	},
 	"QA-JV-109": {
 		fpRate: 0,
-		n: 10,
+		n: 18,
 		detectorRevision: 1,
 		ciLow: 0,
-		ciHigh: .2775
+		ciHigh: .1759
 	},
 	"QA-JV-110": {
-		fpRate: 1,
-		n: 20,
+		fpRate: .833,
+		n: 24,
 		detectorRevision: 1,
-		ciLow: .8389,
-		ciHigh: 1
+		ciLow: .6415,
+		ciHigh: .9332
 	},
 	"QA-JV-111": {
 		fpRate: 1,
@@ -8764,11 +8979,11 @@ const MEASURED_FP = {
 		ciHigh: .4042
 	},
 	"QA-PW-004": {
-		fpRate: .375,
-		n: 16,
+		fpRate: .429,
+		n: 14,
 		detectorRevision: 1,
-		ciLow: .1848,
-		ciHigh: .6136
+		ciLow: .2138,
+		ciHigh: .6741
 	},
 	"QA-PW-005": {
 		fpRate: 1,
@@ -8785,11 +9000,11 @@ const MEASURED_FP = {
 		ciHigh: .1611
 	},
 	"QA-PW-103": {
-		fpRate: 1,
-		n: 20,
+		fpRate: .29,
+		n: 69,
 		detectorRevision: 1,
-		ciLow: .8389,
-		ciHigh: 1
+		ciLow: .1962,
+		ciHigh: .4057
 	},
 	"QA-PW-104": {
 		fpRate: 0,
@@ -8806,11 +9021,11 @@ const MEASURED_FP = {
 		ciHigh: 1
 	},
 	"QA-PW-107": {
-		fpRate: 1,
-		n: 20,
+		fpRate: .952,
+		n: 21,
 		detectorRevision: 1,
-		ciLow: .8389,
-		ciHigh: 1
+		ciLow: .7733,
+		ciHigh: .9915
 	},
 	"QA-PW-108": {
 		fpRate: 1,
@@ -8849,10 +9064,10 @@ const MEASURED_FP = {
 	},
 	"QA-PW-117": {
 		fpRate: 0,
-		n: 20,
+		n: 24,
 		detectorRevision: 1,
 		ciLow: 0,
-		ciHigh: .1611
+		ciHigh: .138
 	},
 	"QA-PW-118": {
 		fpRate: 1,
@@ -8883,11 +9098,11 @@ const MEASURED_FP = {
 		ciHigh: .2425
 	},
 	"QA-PW-122": {
-		fpRate: .25,
-		n: 20,
+		fpRate: .063,
+		n: 80,
 		detectorRevision: 1,
-		ciLow: .1119,
-		ciHigh: .4687
+		ciLow: .027,
+		ciHigh: .1381
 	},
 	"QA-PW-123": {
 		fpRate: .455,
@@ -8904,11 +9119,11 @@ const MEASURED_FP = {
 		ciHigh: .2775
 	},
 	"QA-PW-141": {
-		fpRate: .15,
-		n: 20,
+		fpRate: .091,
+		n: 33,
 		detectorRevision: 1,
-		ciLow: .0524,
-		ciHigh: .3604
+		ciLow: .0314,
+		ciHigh: .2357
 	},
 	"QA-PW-142": {
 		fpRate: .182,
@@ -8918,25 +9133,25 @@ const MEASURED_FP = {
 		ciHigh: .477
 	},
 	"QA-PW-143": {
-		fpRate: .25,
-		n: 20,
+		fpRate: .063,
+		n: 80,
 		detectorRevision: 1,
-		ciLow: .1119,
-		ciHigh: .4687
+		ciLow: .027,
+		ciHigh: .1381
 	},
 	"QA-PW-144": {
-		fpRate: .15,
-		n: 20,
+		fpRate: .143,
+		n: 21,
 		detectorRevision: 1,
-		ciLow: .0524,
-		ciHigh: .3604
+		ciLow: .0498,
+		ciHigh: .3464
 	},
 	"QA-PW-145": {
-		fpRate: 1,
-		n: 20,
+		fpRate: .5,
+		n: 40,
 		detectorRevision: 1,
-		ciLow: .8389,
-		ciHigh: 1
+		ciLow: .352,
+		ciHigh: .648
 	},
 	"QA-PW-146": {
 		fpRate: .118,
@@ -8960,25 +9175,25 @@ const MEASURED_FP = {
 		ciHigh: .2099
 	},
 	"QA-PY-003": {
-		fpRate: .824,
-		n: 17,
+		fpRate: .467,
+		n: 30,
 		detectorRevision: 3,
-		ciLow: .5897,
-		ciHigh: .9381
+		ciLow: .3023,
+		ciHigh: .6386
 	},
 	"QA-PY-004": {
-		fpRate: .762,
-		n: 21,
+		fpRate: .533,
+		n: 30,
 		detectorRevision: 3,
-		ciLow: .5491,
-		ciHigh: .8937
+		ciLow: .3614,
+		ciHigh: .6977
 	},
 	"QA-PY-005": {
-		fpRate: .158,
-		n: 19,
+		fpRate: .13,
+		n: 23,
 		detectorRevision: 1,
-		ciLow: .0552,
-		ciHigh: .3757
+		ciLow: .0454,
+		ciHigh: .3213
 	},
 	"QA-PY-006": {
 		fpRate: 1,
@@ -9023,39 +9238,46 @@ const MEASURED_FP = {
 		ciHigh: .4042
 	},
 	"QA-PY-012": {
-		fpRate: .6,
-		n: 20,
+		fpRate: .4,
+		n: 30,
 		detectorRevision: 1,
-		ciLow: .3866,
-		ciHigh: .7812
+		ciLow: .2459,
+		ciHigh: .5768
 	},
 	"QA-PY-103": {
-		fpRate: .1,
-		n: 20,
+		fpRate: .08,
+		n: 25,
 		detectorRevision: 1,
-		ciLow: .0279,
-		ciHigh: .301
+		ciLow: .0222,
+		ciHigh: .2497
+	},
+	"QA-PY-105": {
+		fpRate: 0,
+		n: 12,
+		detectorRevision: 2,
+		ciLow: 0,
+		ciHigh: .2425
 	},
 	"QA-TEST-001": {
-		fpRate: .632,
-		n: 19,
+		fpRate: .6,
+		n: 20,
 		detectorRevision: 1,
-		ciLow: .4104,
-		ciHigh: .8085
+		ciLow: .3866,
+		ciHigh: .7812
 	},
 	"QA-TEST-002": {
-		fpRate: .65,
-		n: 20,
+		fpRate: .619,
+		n: 21,
 		detectorRevision: 1,
-		ciLow: .4329,
-		ciHigh: .8188
+		ciLow: .4088,
+		ciHigh: .7925
 	},
 	"QA-TEST-003": {
-		fpRate: .85,
-		n: 20,
+		fpRate: .218,
+		n: 78,
 		detectorRevision: 1,
-		ciLow: .6396,
-		ciHigh: .9476
+		ciLow: .1408,
+		ciHigh: .3216
 	},
 	"QA-TEST-004": {
 		fpRate: .3,
@@ -9072,11 +9294,11 @@ const MEASURED_FP = {
 		ciHigh: .6462
 	},
 	"QA-TEST-010": {
-		fpRate: .9,
-		n: 20,
+		fpRate: .581,
+		n: 31,
 		detectorRevision: 1,
-		ciLow: .699,
-		ciHigh: .9721
+		ciLow: .4077,
+		ciHigh: .7358
 	},
 	"QA-TQUAL-001": {
 		fpRate: 1,
@@ -9086,11 +9308,11 @@ const MEASURED_FP = {
 		ciHigh: 1
 	},
 	"QA-TQUAL-002": {
-		fpRate: .85,
-		n: 20,
+		fpRate: .531,
+		n: 32,
 		detectorRevision: 1,
-		ciLow: .6396,
-		ciHigh: .9476
+		ciLow: .3645,
+		ciHigh: .6913
 	},
 	"QA-TQUAL-009": {
 		fpRate: .786,
@@ -9100,11 +9322,11 @@ const MEASURED_FP = {
 		ciHigh: .9243
 	},
 	"QA-TQUAL-011": {
-		fpRate: .3,
-		n: 20,
+		fpRate: .24,
+		n: 25,
 		detectorRevision: 1,
-		ciLow: .1455,
-		ciHigh: .519
+		ciLow: .115,
+		ciHigh: .4343
 	}
 };
 //#endregion
@@ -12251,7 +12473,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.5",
+			version: "0.5.6",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -16565,7 +16787,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.5";
+const CLI_VERSION = "0.5.6";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mjolnir-qa",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "Mjölnir — the Verification Trust Engine for QA. Audits test suites and CI pipelines, reports a worthiness score and prioritized findings.",
   "type": "module",
   "engines": {