mjolnir-qa 0.5.5 → 0.5.7

package/CHANGELOG.md

@@ -74,6 +74,25 @@ scan`. Unknown categories are a usage error (exit 10).
 - help registry gained `why`, `handoff`, `install` and the new flags;
   site/reference/cli.md documents the handoff trust model.
 
+## [0.5.7] — 2026-09-06
+
+### Changes since 0.5.6
+
+- Merge pull request #40 from Sergey-Bar/eng/machine-contract-2.1
+- test: plural + unknown-cause arms for inconclusive resolution rendering
+- feat: machine verification contract + finding detectorRevision + lifecycle resolution (blueprint §12-§15, §17, §25)
+
+## [0.5.6] — 2026-09-06
+
+### Changes since 0.5.5
+
+- Merge pull request #39 from Sergey-Bar/eng/verification-trust-2.0
+- docs: regenerate readme SVGs under the revision-2 CI-rule measurements
+- docs: regenerate rule-doc occurrence tables (yarnpkg-berry corpus lane)
+- fix: eslint pragma for the file-wide consumer fallback regex
+- fix: rev-2 enforcement arm in QA-CI-008 was dead code + coverage arms for CI rules
+- ci-family trust repair: M2 detector re-adjudication, revision 2 re-measurement, workflow corpus lane
+
 ## [0.5.5] — 2026-09-06
 
 ### Audit Remediation 1.0 (engine correctness + trust boundary)

package/README.md

@@ -284,13 +284,13 @@ firewall.
 
 ### How much of this is measured
 
-**74 of 99 rules carry a false-positive rate measured against real OSS code** (≥ 10 hand-classified findings each; see
-[docs/FP-AUDIT.md](docs/FP-AUDIT.md)). The other 19 ship on the author's
+**76 of 99 rules carry a false-positive rate measured against real OSS code** (≥ 10 hand-classified findings each; see
+[docs/FP-AUDIT.md](docs/FP-AUDIT.md)). The other 23 ship on the author's
 estimate. Every scan footer tells you how many of the rules that _fired_
 are measured; `mjolnir rules --unmeasured` lists the ones that aren't;
 every rule's `mjolnir explain` page states its status. We publish the rate
 even when it's ugly — QA-CS-103 audits at 95% and is quarantined for it.
-Growing that 78 is the project's continuing work.
+Growing that number is the project's continuing work.
 
 ### Rule tiers and language maturity
 

package/dist/cli.d.mts

@@ -103,6 +103,15 @@ interface Finding {
   measuredFpRate?: number;
   /** Classified (TP+FP) verdicts behind `measuredFpRate`. */
   measuredFpN?: number;
+  /**
+   * Detector revision of the rule that produced this finding, stamped
+   * from the registry at scan time (blueprint §13, G-16). Identity
+   * participates: "same ruleId, different detectorRevision" is formally
+   * a different detector for comparison purposes. Additive within
+   * schemaVersion 1; absent means the producer predates the field
+   * (revision-unknown).
+   */
+  detectorRevision?: number;
   /**
    * Runtime corroboration from a real run report (plan §16), stamped
    * when a report was available and matched this finding's file/test.
@@ -690,7 +699,7 @@ declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniver
  * `scripts/sync-sarif-version.cjs` on release and guarded by
  * `tests/version-consistency.spec.ts` locally.
  */
-declare const CLI_VERSION = "0.5.5";
+declare const CLI_VERSION = "0.5.7";
 /** A usage-error detail: the offending token, when one exists. */
 interface UsageErrorDetail {
   /** The unknown flag or rejected value (e.g. `--nope`, `loud`). */

package/dist/cli.mjs

@@ -1766,8 +1766,10 @@ function parseWorkflow(text) {
 			const step = s;
 			return {
 				...typeof step["name"] === "string" ? { name: step["name"] } : {},
+				...typeof step["id"] === "string" ? { id: step["id"] } : {},
 				...typeof step["run"] === "string" ? { run: step["run"] } : {},
 				...typeof step["uses"] === "string" ? { uses: step["uses"] } : {},
+				...typeof step["if"] === "string" ? { if: step["if"] } : {},
 				...step["with"] && typeof step["with"] === "object" && !Array.isArray(step["with"]) ? { with: { ...step["with"] } } : {},
 				...typeof step["continue-on-error"] === "boolean" || typeof step["continue-on-error"] === "string" ? { "continue-on-error": step["continue-on-error"] } : {}
 			};
@@ -3546,7 +3548,7 @@ const VERIFICATION_GATE_RE = new RegExp([
 	String.raw`\bplaywright\s+test\b`,
 	String.raw`\b(?:pytest|tox|nox)\b`,
 	String.raw`\bpython\s+-m\s+(?:pytest|unittest)\b`,
-	String.raw`\bmvn\b[^\n]+\b(?:test|verify)\b`,
+	String.raw`\bmvn[wd]?\b[^\n]+\b(?:test|verify)\b`,
 	String.raw`\b(?:\./)?gradlew?\b[^\n]+\btest\b`,
 	String.raw`\bdotnet\s+test\b`,
 	String.raw`\bgo\s+test\b`,
@@ -3578,6 +3580,45 @@ function stepIsVerificationGate(step) {
 	}
 	return false;
 }
+/**
+* detectorRevision 2 (M2, 2026-09-04): legitimate continue-on-error shapes
+* the rev-1 detector flagged. Each class was proven by adjudication
+* (docs/FP-AUDIT.md notes, 2026-09-02):
+* 1. Re-run idiom (appsmith ci-test-playwright.yml): the gate runs under
+*    continue-on-error ONLY to convert attempt 1 into a non-failing
+*    outcome so a follow-up step can re-run the SAME gate; the follow-up
+*    runs unconditionally and its failure fails the job — the gate still
+*    blocks.
+* 2. Non-gate shapes that matched the rev-1 run-text regex: report
+*    aggregation (`test --merge-reports`), test-ID collection, shard
+*    rebalancing helpers — they execute no verification.
+* 3. Steps whose `if:`/name explicitly mark them advisory/non-blocking
+*    inside jobs that run the real gates (vault custom-linter,
+*    github-docs sync-sdk-docs).
+*/
+const RERUN_OUTCOME_RE = /steps\.[\w-]+\.outcome\s*==\s*['"]?failure['"]?|steps\.[\w-]+\.conclusion\s*==\s*['"]?failure['"]?/;
+function jobReRunsTheMaskedGate(steps, maskedIndex) {
+	return steps.some((s, i) => {
+		if (i === maskedIndex) return false;
+		const cond = typeof s?.if === "string" ? s.if : "";
+		if (!RERUN_OUTCOME_RE.test(cond)) return false;
+		return stepIsVerificationGate(s);
+	});
+}
+/** Explicit advisory/non-verification shapes in run text. */
+const NON_GATE_RUN_RE = /--merge-reports\b|\bmerge-reports\b|\bcollect[- ]only\b|list[- ]tests\b|\brebalance\b/i;
+/**
+* Steps whose own name declares the non-blocking intent (adjudicated FP:
+* vault code-checker.yml "Check custom linters (non-blocking)" — the
+* workflow's own vocabulary marks the advisory contract, so the green
+* check hides nothing the author claimed would gate).
+*/
+const NON_BLOCKING_NAME_RE = /\(\s*non-?blocking\s*\)|\[.*non-?blocking.*\]/i;
+function stepIsGateExcludingNonVerification(step) {
+	if (step.name && NON_BLOCKING_NAME_RE.test(step.name)) return false;
+	if (step.run && NON_GATE_RUN_RE.test(step.run)) return false;
+	return stepIsVerificationGate(step);
+}
 const continueOnError = defineRule({
 	id: "QA-CI-001",
 	category: "QA-CI",
@@ -3604,13 +3645,13 @@ const continueOnError = defineRule({
 		for (const [jobName, job] of Object.entries(jobs)) {
 			const steps = job?.steps ?? [];
 			if (job && job["continue-on-error"] === true) {
-				if (steps.some(stepIsVerificationGate)) findings.push({
+				if (steps.some(stepIsGateExcludingNonVerification)) findings.push({
 					severity: "error",
 					confidence: "high",
 					findingType: "deterministic-defect",
 					qaImpact: "FALSE-GREEN",
 					file: ctx.path,
-					line: findLine$4(ctx.text, new RegExp(`^\\s{2,6}${escapeRe$2(jobName)}:`, "m")),
+					line: findLine$2(ctx.text, new RegExp(`^\\s{2,6}${escapeRe$1(jobName)}:`, "m")),
 					column: 1,
 					message: `Job \`${jobName}\` runs a verification gate under \`continue-on-error: true\`.`,
 					why: "This job can fail every day and CI will still show green. The checkmark on this workflow cannot be trusted.",
@@ -3619,7 +3660,8 @@ const continueOnError = defineRule({
 			}
 			for (const [i, step] of steps.entries()) {
 				if (!step || step["continue-on-error"] !== true) continue;
-				if (!stepIsVerificationGate(step)) continue;
+				if (!stepIsGateExcludingNonVerification(step)) continue;
+				if (jobReRunsTheMaskedGate(steps, i)) continue;
 				findings.push({
 					severity: "error",
 					confidence: "high",
@@ -3681,7 +3723,7 @@ function locateStepContinueOnError(text, step) {
 	if (anchorAt !== -1) return lineOf(text, anchorAt);
 	return 1;
 }
-function findLine$4(text, re) {
+function findLine$2(text, re) {
 	const m = re.exec(text);
 	if (!m) return 1;
 	return lineOf(text, m.index);
@@ -3691,7 +3733,7 @@ function lineOf(text, index) {
 	for (let i = 0; i < index; i++) if (text[i] === "\n") line++;
 	return line;
 }
-function escapeRe$2(s) {
+function escapeRe$1(s) {
 	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 //#endregion
@@ -3716,6 +3758,7 @@ const swallowedExitCode = defineRule({
 	detectionStrategy: "LEXICAL",
 	introduced: "0.1.0",
 	tier: "extended",
+	detectorRevision: 2,
 	run(ctx) {
 		const findings = [];
 		const re = /\|\|\s*true\b|:\s*(?:npm|yarn|pnpm|make|pytest|go)\b[^`\n]*\|\|\s*echo/g;
@@ -3767,6 +3810,7 @@ const retryMasking = defineRule({
 	detectionStrategy: "LEXICAL",
 	introduced: "0.1.0",
 	tier: "extended",
+	detectorRevision: 2,
 	run(ctx) {
 		const findings = [];
 		const doc = ctx.ast;
@@ -3782,38 +3826,74 @@ const retryMasking = defineRule({
 					findingType: "deterministic-defect",
 					qaImpact: "FLAKY-RISK",
 					file: ctx.path,
-					line: findLine$3(ctx.text, new RegExp(escapeRe$1(step.uses))),
+					line: findStepUsesLine(ctx.text, step.uses, command),
 					column: 1,
 					message: `Job \`${jobName}\` wraps a test command in an automatic retry action.`,
 					why: "Retrying tests until they pass hides flaky and intermittent failures — the green check no longer means the suite passed.",
 					fix: "Remove the retry wrapper; investigate the underlying flakiness instead."
 				});
 			}
-			if (step?.run && /\bfor\b[\s\S]+retry|max_attempts|until.*succeed/i.test(step.run) && /test/i.test(step.run)) findings.push({
-				severity: "warning",
-				confidence: "medium",
-				findingType: "heuristic-risk",
-				qaImpact: "FLAKY-RISK",
-				file: ctx.path,
-				line: findLine$3(ctx.text, /max_attempts|until.*succeed/i),
-				column: 1,
-				message: `Job \`${jobName}\` contains a shell retry loop around tests.`,
-				why: "Retry-until-pass loops mask intermittent failures instead of surfacing them.",
-				fix: "Run tests once; track and fix flakes explicitly."
-			});
+			if (step?.run) {
+				const LOOP_RE = /\bfor\b[^\n]*\$\(\s*(?:seq|range)\b|\bfor\b[^\n]*\{\d+\.\.\d+\}|\bfor\s+\w+\s+in\s+\d+(?:[,\t ]+\d+)*[;\s]*do\b|\bwhile\b[^\n]*\btrue\b|\bwhile\s+:;|\bmax_attempts\b|\buntil\b[^\n]*\bsucceed\b/i;
+				const TEST_GATE_RE = /\b(?:npm|yarn|pnpm|bun)\s+(?:run\s+)?(?:test|t)\b|\bnpx\s+(?:vitest|jest|mocha|ava|playwright\s+test)\b|\b(?:vitest|jest|mocha|ava|tap)\b|\bplaywright\s+test\b|\b(?:pytest|tox|nox)\b|\bpython\s+-m\s+(?:pytest|unittest)\b|\bmvn[wd]?\b[^\n]+\b(?:test|verify)\b|\b(?:[.]\/)?gradlew?\b[^\n]+\btest\b|\bdotnet\s+test\b|\bgo\s+test\b|\bcargo\s+test\b|\bmake\s+[\w./\\-]*test\b/i;
+				const isCurlProbe = /\b(?:curl|wget)\b/.test(step.run) && !TEST_GATE_RE.test(step.run);
+				if (LOOP_RE.test(step.run) && TEST_GATE_RE.test(step.run) && !isCurlProbe) findings.push({
+					severity: "warning",
+					confidence: "medium",
+					findingType: "heuristic-risk",
+					qaImpact: "FLAKY-RISK",
+					file: ctx.path,
+					line: findStepLoopLine(ctx.text, step.run, LOOP_RE),
+					column: 1,
+					message: `Job \`${jobName}\` contains a shell retry loop around tests.`,
+					why: "Retry-until-pass loops mask intermittent failures instead of surfacing them.",
+					fix: "Run tests once; track and fix flakes explicitly."
+				});
+			}
 		}
 		return findings;
 	}
 });
-function findLine$3(text, re) {
+/**
+* Line of the loop construct belonging to THIS step.
+*
+* detectorRevision 2: anchors at the step's first run line, then finds the
+* loop construct at or after it — a file-wide LOOP_RE search reported every
+* matching step on the first loop occurrence in the file.
+*/
+function findStepLoopLine(text, run, loopRe) {
+	const firstLine = run.split("\n").map((l) => l.trim()).find((l) => l.length > 0);
+	const anchorAt = text.indexOf(firstLine);
+	const re = new RegExp(loopRe.source, "gi");
+	re.lastIndex = Math.max(0, anchorAt);
 	const m = re.exec(text);
 	if (!m) return 1;
 	let line = 1;
 	for (let i = 0; i < m.index; i++) if (text[i] === "\n") line++;
 	return line;
 }
-function escapeRe$1(s) {
-	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+* Line of the retry-action `uses:` belonging to THIS step.
+*
+* detectorRevision 2: anchors at the step's own `with.command` text and
+* takes the nearest `uses:` occurrence at or before it — a file-wide search
+* reported every wrapping step on the first occurrence when several jobs
+* use the same retry action at the same version.
+*/
+function findStepUsesLine(text, uses, command) {
+	const needle = uses.trim();
+	const firstCmdLine = command.trim().split("\n")[0]?.trim();
+	const at = nearestBefore(text, Math.max(0, text.indexOf(firstCmdLine)), needle);
+	if (at === -1) return 1;
+	let line = 1;
+	for (let i = 0; i < at; i++) if (text[i] === "\n") line++;
+	return line;
+}
+/** The nearest occurrence of `needle` ending at or before `at`. */
+function nearestBefore(text, at, needle) {
+	const windowStart = Math.max(0, at - 2e3);
+	const rel = text.slice(windowStart, at + 1).lastIndexOf(needle);
+	return rel !== -1 ? windowStart + rel : -1;
 }
 //#endregion
 //#region src/rules/ci/qa-ci-005-report-never-generated.ts
@@ -3825,15 +3905,76 @@ function escapeRe$1(s) {
 * that no previous step produces — the gate reads an empty or stale file
 * and passes vacuously. Product-MVP §35: "Required report not produced".
 */
+/**
+* Producer vocabulary for coverage reports, one regex over run text.
+*
+* detectorRevision 2 (M2, 2026-09-04): the rev-1 regex knew only
+* `vitest|jest|nyc --coverage`. Adjudication against the real corpus
+* (docs/FP-AUDIT.md rows) proved four blindness classes, each a real
+* producer the regex could not see:
+* 1. Java/JaCoCo — `mvn verify` with the jacoco-maven-plugin, Gradle
+*    `jacocoTestReport`
+* 2. Python — `pytest --cov` (pytest-cov), `coverage run/combine/json/xml`
+*    (coverage.py), `COVERAGE_FILE` env wiring
+* 3. Go / .NET / Rust — `go test -coverprofile`, `dotnet test --collect`,
+*    `cargo llvm-cov` / `cargo tarpaulin`
+* 4. Script-name coverage — `npm run test:coverage` and friends, where the
+*    coverage flag lives inside package.json, invisible from the workflow
+*
+* Known residual limitation (documented, not fixable single-file): a
+* producer in a DIFFERENT workflow (reusable workflows, artifact producers
+* from `workflow_run` jobs) or inside tox.ini / vitest.config is invisible;
+* cross-workflow consumers remain flaggable — measured rates carry those
+* verdicts (streamlit ai-test-coverage.yml class).
+*/
+/**
+* Producer vocabulary for coverage reports, tested one literal at a time
+* over run/`with` text.
+*
+* detectorRevision 2 (M2, 2026-09-04): the rev-1 regex knew only
+* `vitest|jest|nyc --coverage`. Adjudication against the real corpus
+* (docs/FP-AUDIT.md rows) proved four blindness classes, each a real
+* producer the regex could not see:
+* 1. Java/JaCoCo — `mvn verify` with the jacoco-maven-plugin, Gradle
+*    `jacocoTestReport`
+* 2. Python — `pytest --cov` (pytest-cov), `coverage run/combine/json/xml`
+*    (coverage.py), `COVERAGE_FILE` env wiring
+* 3. Go / .NET / Rust — `go test -coverprofile`, `dotnet test --collect`,
+*    `cargo llvm-cov` / `cargo tarpaulin`
+* 4. Script-name coverage — `npm run test:coverage` and friends, where the
+*    coverage flag lives inside package.json, invisible from the workflow
+*
+* Known residual limitation (documented, not fixable single-file): a
+* producer in a DIFFERENT workflow (reusable workflows, artifact producers
+* from `workflow_run` jobs) or inside tox.ini / vitest.config is invisible;
+* cross-workflow consumers remain flaggable — measured rates carry those
+* verdicts (streamlit ai-test-coverage.yml class).
+*/
+const COVERAGE_PRODUCERS = [
+	/\b(?:npx\s+)?(?:vitest|jest|nyc)\b[^\n]*--coverage\b/i,
+	/--coverage\b/i,
+	/\b(?:npm|yarn|pnpm|bun)\s+(?:run\s+)?[\w:@/.-]*coverage[\w:@/.-]*/i,
+	/\bmvn[wd]?\b[^\n]*\b(?:jacoco|verify)\b/i,
+	/\b(?:[.]\/)?gradlew?\b[^\n]*\bjacoco\w*\b/i,
+	/\bjacoco\w*Report\b/i,
+	/\bpytest\b[^\n]*--cov\b/i,
+	/\bcoverage\s+(?:run|combine|json|xml|report)\b/i,
+	/\bCOVERAGE_FILE\b/i,
+	/\bpytest-cov\b/i,
+	/\bgo\s+test\b[^\n]*-cover(?:profile|mode|age)\b/i,
+	/\bdotnet\s+test\b[^\n]*(?:--collect|--coverage|collect coverage)/i,
+	/\bcargo\s+(?:llvm-cov|tarpaulin)\b/i,
+	/\b(?:coverage|lcov|cobertura)[\w./-]*\.(?:info|xml|json|lcov)\b/i
+];
 /** Known report-consumption patterns and the commands that produce them. */
 const CONSUMERS = [{
 	re: /codecov|coveralls/i,
 	stepRe: /upload-artifact/i,
-	producer: /\b(?:npx\s+)?(?:vitest|jest|nyc)\b[\s\S]*--coverage|--coverage\b/i,
+	producers: COVERAGE_PRODUCERS,
 	label: "coverage artifact"
 }, {
 	re: /codecov|coveralls/i,
-	producer: /--coverage\b|(?:vitest|jest|nyc)\b[\s\S]+coverage/i,
+	producers: COVERAGE_PRODUCERS,
 	label: "coverage upload"
 }];
 const reportNeverGenerated = defineRule({
@@ -3852,27 +3993,34 @@ const reportNeverGenerated = defineRule({
 	detectionStrategy: "LEXICAL",
 	introduced: "0.1.0",
 	tier: "quarantine",
+	detectorRevision: 2,
 	run(ctx) {
 		const findings = [];
 		const doc = ctx.ast;
 		if (!doc?.jobs) return findings;
 		const jobEntries = Object.entries(doc.jobs);
-		const workflowRunText = jobEntries.map(([, j]) => (j?.steps ?? []).map((s) => s?.run ?? "").join("\n")).join("\n");
+		const stepText = (s) => [s.run ?? "", ...s.uses?.includes("upload-artifact") ? [] : Object.values(s.with ?? {}).filter((v) => typeof v === "string")].join("\n");
+		const workflowRunText = jobEntries.map(([, j]) => (j?.steps ?? []).map(stepText).join("\n")).join("\n");
 		for (const [jobName, job] of jobEntries) {
 			const steps = job?.steps ?? [];
-			const allRunText = steps.map((s) => s?.run ?? "").join("\n");
+			const allRunText = steps.map(stepText).join("\n");
 			for (const consumer of CONSUMERS) {
 				if (!(steps.some((s) => {
 					if (s.uses && consumer.re.test(s.uses)) return true;
 					if (consumer.stepRe && s.uses && consumer.stepRe.test(s.uses) && s.with && typeof s.with["path"] === "string" && /coverage|lcov/i.test(s.with["path"])) return true;
 					return false;
 				}) || consumer.re.test(allRunText))) continue;
-				if (!(consumer.producer.test(allRunText) || consumer.producer.test(workflowRunText))) findings.push({
+				const coverageDataDownload = steps.some((s) => s.uses?.includes("download-artifact") === true && s.with !== void 0 && [
+					"pattern",
+					"path",
+					"name"
+				].some((k) => typeof s.with?.[k] === "string" && /coverage/i.test(s.with[k])));
+				if (!(consumer.producers.some((p) => p.test(allRunText) || p.test(workflowRunText)) || coverageDataDownload)) findings.push({
 					severity: "error",
 					confidence: "high",
 					findingType: "deterministic-defect",
 					file: ctx.path,
-					line: findLine$2(ctx.text, consumer.re),
+					line: findJobConsumerLine(ctx.text, jobName, consumer.re),
 					column: 1,
 					message: `Job \`${jobName}\` consumes a ${consumer.label} that no step generates.`,
 					why: "The gate reads a report that is never produced — it passes on empty/stale data while appearing to verify something.",
@@ -3884,11 +4032,27 @@ const reportNeverGenerated = defineRule({
 		return findings;
 	}
 });
-function findLine$2(text, re) {
-	const m = re.exec(text);
-	if (!m) return 1;
+/**
+* Line of the consumer signal belonging to THIS job.
+*
+* detectorRevision 2: `findLine` searched the whole file and always
+* returned the FIRST consumer occurrence — every consuming job in a
+* multi-job workflow reported the same line, so distinct findings
+* collapsed into one verdict position. Anchoring at the job's own
+* declaration keeps each job's finding on its own line.
+*/
+function findJobConsumerLine(text, jobName, consumerRe) {
+	const declMatch = new RegExp(`^\\s{2,6}${jobName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}:`, "m").exec(text);
+	const re = new RegExp(consumerRe.source, "gi");
+	re.lastIndex = declMatch ? declMatch.index : 0;
+	const anchored = re.exec(text);
+	if (anchored) return lineOfIndex(text, anchored.index);
+	const anywhere = new RegExp(consumerRe.source, "i").exec(text);
+	return anywhere ? lineOfIndex(text, anywhere.index) : 1;
+}
+function lineOfIndex(text, index) {
 	let line = 1;
-	for (let i = 0; i < m.index; i++) if (text[i] === "\n") line++;
+	for (let i = 0; i < index; i++) if (text[i] === "\n") line++;
 	return line;
 }
 //#endregion
@@ -3901,6 +4065,18 @@ function findLine$2(text, re) {
 * failure-tolerant pattern can flip a red job green — the classic
 * false-green trick.
 */
+/**
+* Failure-enforcement shapes that legitimately follow tolerated steps: a
+* later `if: always()` step that checks the recorded status and exits
+* non-zero on failure. Adjudication (hashicorp/vault build.yml:889,
+* ci.yml:492, test-go.yml:992 — 2026-09-02) proved the rev-1 detector
+* blind to this canonical honest pattern: the tolerated steps' outcomes
+* ARE enforced after them, so nothing is masked.
+*/
+const ENFORCED_FAILURE_LATER = /(?:result|status)[^\n]*!=\s*['"]?success['"]?|exit\s+1\b|FAILURE|has\s*failed/i;
+function laterStepEnforcesFailure(steps, fromIndex) {
+	return steps.slice(fromIndex + 1).some((s) => typeof s?.if === "string" && /always\s*\(\)/.test(s.if) && /!=\s*['"]?success['"]?|==\s*['"]?failure['"]?|result/i.test(s.if) && typeof s?.run === "string" && ENFORCED_FAILURE_LATER.test(s.run));
+}
 const alwaysSuccessStep = defineRule({
 	id: "QA-CI-008",
 	category: "QA-CI",
@@ -3917,6 +4093,7 @@ const alwaysSuccessStep = defineRule({
 	detectionStrategy: "LEXICAL",
 	introduced: "0.1.0",
 	tier: "quarantine",
+	detectorRevision: 2,
 	run(ctx) {
 		const findings = [];
 		const doc = ctx.ast;
@@ -3926,9 +4103,11 @@ const alwaysSuccessStep = defineRule({
 			if (steps.length < 2) continue;
 			const last = steps[steps.length - 1];
 			if (!last?.run) continue;
-			const suspicious = /^\s*exit\s+0\s*$/m.test(last.run) || /^\s*(?:echo|printf)\b[^&|;]*$/.test(last.run.trim()) || /^\s*true\s*$/.test(last.run.trim());
-			const earlierTolerant = steps.slice(0, -1).some((s) => s?.["continue-on-error"] === true || /\|\|\s*true\b/.test(s?.run ?? ""));
-			if (suspicious && earlierTolerant) findings.push({
+			const suspicious = !/exit\s+1\b|!=\s*['"]?success['"]?|==\s*['"]?failure['"]?/.test(last.run) && (/^\s*exit\s+0\s*$/m.test(last.run) || /^\s*(?:echo|printf)\b[^&|;]*$/.test(last.run.trim()) || /^\s*true\s*$/.test(last.run.trim()));
+			const earlierTolerantGate = steps.slice(0, -1).some((s) => (s?.["continue-on-error"] === true || /\|\|\s*true\b/.test(s?.run ?? "")) && (looksLikeVerificationGate(s?.run ?? "") || s?.uses !== void 0 && /playwright|cypress|codecov\/codecov-action/i.test(s.uses)));
+			const toleratedIdx = steps.findIndex((s) => (s?.["continue-on-error"] === true || /\|\|\s*true\b/.test(s?.run ?? "")) && (looksLikeVerificationGate(s?.run ?? "") || s?.uses !== void 0 && /playwright|cypress|codecov\/codecov-action/i.test(s.uses)));
+			if (toleratedIdx !== -1 && laterStepEnforcesFailure(steps, toleratedIdx)) continue;
+			if (suspicious && earlierTolerantGate) findings.push({
 				severity: "error",
 				confidence: "high",
 				findingType: "deterministic-defect",
@@ -3981,6 +4160,8 @@ const exitCodeNotPropagated = defineRule({
 	detectionStrategy: "FRAMEWORK",
 	detectionNotes: "regex pattern on parsed workflow AST",
 	introduced: "0.4.0",
+	detectorRevision: 2,
+	tier: "extended",
 	run(ctx) {
 		const findings = [];
 		const doc = ctx.ast;
@@ -4008,11 +4189,13 @@ const exitCodeNotPropagated = defineRule({
 				});
 			}
 			if (/set\s+(?:-[A-Za-df-z]*e[A-Za-z]*|-o\s+errexit)\b/.test(run)) continue;
+			const strippedRun = stripQuoted(run);
 			const seqRe = new RegExp(`(?:${TEST_CMD$1.source})[^\\n;]*;\\s*[^\\n]+`, "g");
 			let sm;
-			while ((sm = seqRe.exec(run)) !== null) {
+			while ((sm = seqRe.exec(strippedRun)) !== null) {
 				const seg = sm[0];
 				if (/&&|\|\|/.test(seg)) continue;
+				if (/^\s*(?:do|then|else|fi|done|elif|esac)\b|^\s*\}/.test(seg.slice(seg.indexOf(";") + 1))) continue;
 				const afterSemi = seg.slice(seg.indexOf(";") + 1);
 				if (TEST_CMD$1.test(afterSemi)) continue;
 				findings.push({
@@ -4032,6 +4215,17 @@ const exitCodeNotPropagated = defineRule({
 		return findings;
 	}
 });
+/**
+* Replaces the CONTENT of double- and single-quoted segments with spaces
+* (length-preserving) so shell separators inside strings — a JS test file
+* echoed through `tee`, e.g. `echo "it('x'); expect(y)" | tee t.js` — can
+* never anchor a `;`-sequence finding. Quotes are shell-sensitive; this is
+* deliberately conservative: only quote-delimited, same-line segments are
+* stripped.
+*/
+function stripQuoted(text) {
+	return text.replace(/"[^"\n]*"|'[^'\n]*'/g, (m) => " ".repeat(m.length));
+}
 function findLine$1(text, needle) {
 	const idx = text.indexOf(needle);
 	if (idx === -1) return 1;
@@ -4057,7 +4251,19 @@ const TEST_CMD = /\b(?:npm|yarn|pnpm)\s+(?:run\s+)?test\b|\b(?:jest|vitest|pytes
 * `if:` conditions that skip the job on pull requests.
 * NOTE: `!=` only — `github.event_name == 'pull_request'` is the OPPOSITE
 * (run ONLY on PRs) and must never match here.
-*/
+*
+* detectorRevision 2 (M2, 2026-09-04): a condition that CONTAINS a
+* push-match alternative can still RUN on PRs via `||` branches —
+* `github.event_name == 'push' || ... || (pull_request && !draft)` runs on
+* non-draft PRs (adjudicated FPs: nocodb jest-unit-test.yml, grafana
+* pr-frontend-unit-tests.yml, streamlit publish jobs). The condition is a
+* skip only when EVERY PR-shaped alternative excludes PRs: i.e. the
+* condition contains a PR-inclusive branch (== pull_request, !draft,
+* labeled trigger) or consists solely of push/schedule/dispatch
+* alternatives — matched below only when no PR-inclusive alternative
+* exists anywhere in the condition.
+*/
+const PR_INCLUSIVE_RE = /github\.event_name\s*==\s*['"]?pull_request\b|pull_request[^\n]*!\s*=\s*['"]?draft|!\s*github\.event\.pull_request|github\.event\.label\.name|!=\s*['"]?draft['"]?|head\.repo\.fork\s*==\s*['"]?false['"]?/;
 const SKIP_ON_PR = /github\.event_name\s*!=\s*['"]?pull_request|github\.event_name\s*==\s*['"]?(?:push|schedule|workflow_dispatch)\b|!\s*github\.event\b|github\.ref\s*==\s*['"]?refs\/heads\/(?:main|master)\b/;
 const nonBlockingTestJob = defineRule({
 	id: "QA-CI-010",
@@ -4076,6 +4282,7 @@ const nonBlockingTestJob = defineRule({
 	detectionNotes: "regex heuristic on parsed workflow AST",
 	introduced: "0.4.0",
 	tier: "quarantine",
+	detectorRevision: 2,
 	run(ctx) {
 		const findings = [];
 		const doc = ctx.ast;
@@ -4083,6 +4290,7 @@ const nonBlockingTestJob = defineRule({
 		for (const [jobName, job] of Object.entries(doc.jobs)) {
 			if (!(job?.steps ?? []).some((s) => TEST_CMD.test(s?.run ?? ""))) continue;
 			const cond = typeof job?.if === "string" ? job.if : "";
+			if (cond && PR_INCLUSIVE_RE.test(cond)) continue;
 			if (cond && SKIP_ON_PR.test(cond)) findings.push({
 				severity: "error",
 				confidence: "medium",
@@ -8589,46 +8797,53 @@ function getRule(id) {
 //#region src/rules/measured-fp.generated.ts
 const MEASURED_FP = {
 	"QA-CI-001": {
-		fpRate: .316,
+		fpRate: .105,
 		n: 19,
 		detectorRevision: 2,
-		ciLow: .1536,
-		ciHigh: .5399
+		ciLow: .0294,
+		ciHigh: .3139
 	},
 	"QA-CI-002": {
-		fpRate: .188,
-		n: 16,
-		detectorRevision: 1,
-		ciLow: .0659,
-		ciHigh: .4301
+		fpRate: .111,
+		n: 18,
+		detectorRevision: 2,
+		ciLow: .031,
+		ciHigh: .328
 	},
 	"QA-CI-005": {
-		fpRate: .824,
-		n: 17,
-		detectorRevision: 1,
-		ciLow: .5897,
-		ciHigh: .9381
+		fpRate: .077,
+		n: 13,
+		detectorRevision: 2,
+		ciLow: .0137,
+		ciHigh: .3331
 	},
 	"QA-CI-007": {
-		fpRate: .273,
+		fpRate: 0,
 		n: 11,
-		detectorRevision: 1,
-		ciLow: .0975,
-		ciHigh: .5656
+		detectorRevision: 2,
+		ciLow: 0,
+		ciHigh: .2588
 	},
 	"QA-CI-008": {
-		fpRate: .75,
-		n: 16,
-		detectorRevision: 1,
-		ciLow: .505,
-		ciHigh: .8982
+		fpRate: .1,
+		n: 10,
+		detectorRevision: 2,
+		ciLow: .0179,
+		ciHigh: .4042
+	},
+	"QA-CI-009": {
+		fpRate: 0,
+		n: 10,
+		detectorRevision: 2,
+		ciLow: 0,
+		ciHigh: .2775
 	},
 	"QA-CI-010": {
-		fpRate: .4,
+		fpRate: .1,
 		n: 10,
-		detectorRevision: 1,
-		ciLow: .1682,
-		ciHigh: .6873
+		detectorRevision: 2,
+		ciLow: .0179,
+		ciHigh: .4042
 	},
 	"QA-CS-101": {
 		fpRate: 0,
@@ -8659,18 +8874,18 @@ const MEASURED_FP = {
 		ciHigh: .495
 	},
 	"QA-CS-108": {
-		fpRate: 1,
-		n: 20,
+		fpRate: .87,
+		n: 23,
 		detectorRevision: 1,
-		ciLow: .8389,
-		ciHigh: 1
+		ciLow: .6787,
+		ciHigh: .9546
 	},
 	"QA-CS-110": {
-		fpRate: 1,
-		n: 20,
+		fpRate: .769,
+		n: 26,
 		detectorRevision: 1,
-		ciLow: .8389,
-		ciHigh: 1
+		ciLow: .5795,
+		ciHigh: .8897
 	},
 	"QA-CS-111": {
 		fpRate: 1,
@@ -8688,17 +8903,17 @@ const MEASURED_FP = {
 	},
 	"QA-JV-101": {
 		fpRate: 0,
-		n: 20,
+		n: 23,
 		detectorRevision: 1,
 		ciLow: 0,
-		ciHigh: .1611
+		ciHigh: .1431
 	},
 	"QA-JV-102": {
-		fpRate: .3,
-		n: 20,
+		fpRate: .261,
+		n: 23,
 		detectorRevision: 1,
-		ciLow: .1455,
-		ciHigh: .519
+		ciLow: .1255,
+		ciHigh: .4647
 	},
 	"QA-JV-103": {
 		fpRate: .259,
@@ -8722,25 +8937,25 @@ const MEASURED_FP = {
 		ciHigh: .301
 	},
 	"QA-JV-108": {
-		fpRate: 1,
-		n: 20,
+		fpRate: .87,
+		n: 23,
 		detectorRevision: 1,
-		ciLow: .8389,
-		ciHigh: 1
+		ciLow: .6787,
+		ciHigh: .9546
 	},
 	"QA-JV-109": {
 		fpRate: 0,
-		n: 10,
+		n: 18,
 		detectorRevision: 1,
 		ciLow: 0,
-		ciHigh: .2775
+		ciHigh: .1759
 	},
 	"QA-JV-110": {
-		fpRate: 1,
-		n: 20,
+		fpRate: .833,
+		n: 24,
 		detectorRevision: 1,
-		ciLow: .8389,
-		ciHigh: 1
+		ciLow: .6415,
+		ciHigh: .9332
 	},
 	"QA-JV-111": {
 		fpRate: 1,
@@ -8764,11 +8979,11 @@ const MEASURED_FP = {
 		ciHigh: .4042
 	},
 	"QA-PW-004": {
-		fpRate: .375,
-		n: 16,
+		fpRate: .429,
+		n: 14,
 		detectorRevision: 1,
-		ciLow: .1848,
-		ciHigh: .6136
+		ciLow: .2138,
+		ciHigh: .6741
 	},
 	"QA-PW-005": {
 		fpRate: 1,
@@ -8785,11 +9000,11 @@ const MEASURED_FP = {
 		ciHigh: .1611
 	},
 	"QA-PW-103": {
-		fpRate: 1,
-		n: 20,
+		fpRate: .29,
+		n: 69,
 		detectorRevision: 1,
-		ciLow: .8389,
-		ciHigh: 1
+		ciLow: .1962,
+		ciHigh: .4057
 	},
 	"QA-PW-104": {
 		fpRate: 0,
@@ -8806,11 +9021,11 @@ const MEASURED_FP = {
 		ciHigh: 1
 	},
 	"QA-PW-107": {
-		fpRate: 1,
-		n: 20,
+		fpRate: .952,
+		n: 21,
 		detectorRevision: 1,
-		ciLow: .8389,
-		ciHigh: 1
+		ciLow: .7733,
+		ciHigh: .9915
 	},
 	"QA-PW-108": {
 		fpRate: 1,
@@ -8849,10 +9064,10 @@ const MEASURED_FP = {
 	},
 	"QA-PW-117": {
 		fpRate: 0,
-		n: 20,
+		n: 24,
 		detectorRevision: 1,
 		ciLow: 0,
-		ciHigh: .1611
+		ciHigh: .138
 	},
 	"QA-PW-118": {
 		fpRate: 1,
@@ -8883,11 +9098,11 @@ const MEASURED_FP = {
 		ciHigh: .2425
 	},
 	"QA-PW-122": {
-		fpRate: .25,
-		n: 20,
+		fpRate: .063,
+		n: 80,
 		detectorRevision: 1,
-		ciLow: .1119,
-		ciHigh: .4687
+		ciLow: .027,
+		ciHigh: .1381
 	},
 	"QA-PW-123": {
 		fpRate: .455,
@@ -8904,11 +9119,11 @@ const MEASURED_FP = {
 		ciHigh: .2775
 	},
 	"QA-PW-141": {
-		fpRate: .15,
-		n: 20,
+		fpRate: .091,
+		n: 33,
 		detectorRevision: 1,
-		ciLow: .0524,
-		ciHigh: .3604
+		ciLow: .0314,
+		ciHigh: .2357
 	},
 	"QA-PW-142": {
 		fpRate: .182,
@@ -8918,25 +9133,25 @@ const MEASURED_FP = {
 		ciHigh: .477
 	},
 	"QA-PW-143": {
-		fpRate: .25,
-		n: 20,
+		fpRate: .063,
+		n: 80,
 		detectorRevision: 1,
-		ciLow: .1119,
-		ciHigh: .4687
+		ciLow: .027,
+		ciHigh: .1381
 	},
 	"QA-PW-144": {
-		fpRate: .15,
-		n: 20,
+		fpRate: .143,
+		n: 21,
 		detectorRevision: 1,
-		ciLow: .0524,
-		ciHigh: .3604
+		ciLow: .0498,
+		ciHigh: .3464
 	},
 	"QA-PW-145": {
-		fpRate: 1,
-		n: 20,
+		fpRate: .5,
+		n: 40,
 		detectorRevision: 1,
-		ciLow: .8389,
-		ciHigh: 1
+		ciLow: .352,
+		ciHigh: .648
 	},
 	"QA-PW-146": {
 		fpRate: .118,
@@ -8960,25 +9175,25 @@ const MEASURED_FP = {
 		ciHigh: .2099
 	},
 	"QA-PY-003": {
-		fpRate: .824,
-		n: 17,
+		fpRate: .467,
+		n: 30,
 		detectorRevision: 3,
-		ciLow: .5897,
-		ciHigh: .9381
+		ciLow: .3023,
+		ciHigh: .6386
 	},
 	"QA-PY-004": {
-		fpRate: .762,
-		n: 21,
+		fpRate: .533,
+		n: 30,
 		detectorRevision: 3,
-		ciLow: .5491,
-		ciHigh: .8937
+		ciLow: .3614,
+		ciHigh: .6977
 	},
 	"QA-PY-005": {
-		fpRate: .158,
-		n: 19,
+		fpRate: .13,
+		n: 23,
 		detectorRevision: 1,
-		ciLow: .0552,
-		ciHigh: .3757
+		ciLow: .0454,
+		ciHigh: .3213
 	},
 	"QA-PY-006": {
 		fpRate: 1,
@@ -9023,39 +9238,46 @@ const MEASURED_FP = {
 		ciHigh: .4042
 	},
 	"QA-PY-012": {
-		fpRate: .6,
-		n: 20,
+		fpRate: .4,
+		n: 30,
 		detectorRevision: 1,
-		ciLow: .3866,
-		ciHigh: .7812
+		ciLow: .2459,
+		ciHigh: .5768
 	},
 	"QA-PY-103": {
-		fpRate: .1,
-		n: 20,
+		fpRate: .08,
+		n: 25,
 		detectorRevision: 1,
-		ciLow: .0279,
-		ciHigh: .301
+		ciLow: .0222,
+		ciHigh: .2497
+	},
+	"QA-PY-105": {
+		fpRate: 0,
+		n: 12,
+		detectorRevision: 2,
+		ciLow: 0,
+		ciHigh: .2425
 	},
 	"QA-TEST-001": {
-		fpRate: .632,
-		n: 19,
+		fpRate: .6,
+		n: 20,
 		detectorRevision: 1,
-		ciLow: .4104,
-		ciHigh: .8085
+		ciLow: .3866,
+		ciHigh: .7812
 	},
 	"QA-TEST-002": {
-		fpRate: .65,
-		n: 20,
+		fpRate: .619,
+		n: 21,
 		detectorRevision: 1,
-		ciLow: .4329,
-		ciHigh: .8188
+		ciLow: .4088,
+		ciHigh: .7925
 	},
 	"QA-TEST-003": {
-		fpRate: .85,
-		n: 20,
+		fpRate: .218,
+		n: 78,
 		detectorRevision: 1,
-		ciLow: .6396,
-		ciHigh: .9476
+		ciLow: .1408,
+		ciHigh: .3216
 	},
 	"QA-TEST-004": {
 		fpRate: .3,
@@ -9072,11 +9294,11 @@ const MEASURED_FP = {
 		ciHigh: .6462
 	},
 	"QA-TEST-010": {
-		fpRate: .9,
-		n: 20,
+		fpRate: .581,
+		n: 31,
 		detectorRevision: 1,
-		ciLow: .699,
-		ciHigh: .9721
+		ciLow: .4077,
+		ciHigh: .7358
 	},
 	"QA-TQUAL-001": {
 		fpRate: 1,
@@ -9086,11 +9308,11 @@ const MEASURED_FP = {
 		ciHigh: 1
 	},
 	"QA-TQUAL-002": {
-		fpRate: .85,
-		n: 20,
+		fpRate: .531,
+		n: 32,
 		detectorRevision: 1,
-		ciLow: .6396,
-		ciHigh: .9476
+		ciLow: .3645,
+		ciHigh: .6913
 	},
 	"QA-TQUAL-009": {
 		fpRate: .786,
@@ -9100,11 +9322,11 @@ const MEASURED_FP = {
 		ciHigh: .9243
 	},
 	"QA-TQUAL-011": {
-		fpRate: .3,
-		n: 20,
+		fpRate: .24,
+		n: 25,
 		detectorRevision: 1,
-		ciLow: .1455,
-		ciHigh: .519
+		ciLow: .115,
+		ciHigh: .4343
 	}
 };
 //#endregion
@@ -11185,6 +11407,7 @@ async function runScan$1(args, hooks = {}) {
 	});
 	const tierByRuleId = tiers;
 	const pluginsLoaded = pluginMeta;
+	const REVISION_BY_RULE_ID = new Map(activeRules.map((r) => [r.id, r.detectorRevision ?? MEASURED_FP[r.id]?.detectorRevision ?? 1]));
 	const cache = args.cache ? createScanCache(workspace.root) : disabledScanCache;
 	const rulesDigest = computeRulesDigest(activeRules);
 	for (const perr of pluginErrors) findings.push({
@@ -11397,6 +11620,10 @@ async function runScan$1(args, hooks = {}) {
 			f.measuredFpN = m.n;
 		}
 	}
+	for (const f of findings) {
+		const rev = REVISION_BY_RULE_ID.get(f.ruleId);
+		if (rev !== void 0) f.detectorRevision = rev;
+	}
 	enforceTierPolicy(findings, tierByRuleId);
 	for (const f of findings) f.fixGroupId = f.ruleId;
 	const runtimeReportPath = discoverRuntimeReport$1(scanRoot.root);
@@ -11454,6 +11681,103 @@ async function runScan$1(args, hooks = {}) {
 	await releaseTreeSitterResources();
 	return result;
 }
+/**
+* Fields that participate in the verification digest: identity (ruleId,
+* detectorRevision, file, line, column) + evidence (severity,
+* evidenceLevel, trustLevel, confidence, findingType) + lifecycle-adjacent
+* metadata (fixGroupId). PRESENTATION (message/why/fix) is excluded by
+* design: rewording a detector's prose must not change the digest of a
+* scan whose semantics are identical.
+*/
+function digestView(f) {
+	return {
+		ruleId: f.ruleId,
+		detectorRevision: f.detectorRevision ?? null,
+		file: f.file,
+		line: f.line,
+		column: f.column,
+		severity: f.severity,
+		evidenceLevel: f.evidenceLevel ?? null,
+		trustLevel: f.trustLevel ?? null,
+		confidence: f.confidence,
+		findingType: f.findingType,
+		fixGroupId: f.fixGroupId ?? null
+	};
+}
+/**
+* Deterministic canonical serialization: findings in ScanResult order
+* (already compareFindings-sorted), stable key insertion order, no
+* indentation. JSON.stringify of plain objects with fixed key order is
+* deterministic across runs and platforms. `durationMs` is EXCLUDED —
+* it is wall-clock, not semantics; including it would make two runs of
+* the same repo produce different digests.
+*/
+function canonicalScanJson(result) {
+	return JSON.stringify({
+		score: result.score,
+		partial: result.partial,
+		analysisStatus: {
+			discovery: result.analysisStatus.discovery,
+			rules: result.analysisStatus.rules,
+			skippedFiles: result.analysisStatus.skippedFiles,
+			rulesCrashed: result.analysisStatus.rulesCrashed ?? 0,
+			truncationReasons: result.analysisStatus.truncationReasons ?? []
+		},
+		findings: result.findings.map(digestView)
+	});
+}
+/** Advisory when the DERIVED evidence level is E0 (same rule as scoring). */
+function isAdvisory(f) {
+	return (f.evidenceLevel ?? deriveEvidenceLevel(f.findingType, f.confidence)) === "E0";
+}
+function levelFor(f) {
+	if (f.severity === "error") return "failure";
+	if (f.severity === "warning") return "warning";
+	return "notice";
+}
+function countBy(findings, predicate) {
+	return findings.filter(predicate).length;
+}
+/**
+* Project a canonical ScanResult into the machine contract. Pure:
+* same input → same output, always (§16 semantic integrity, §25.1).
+*/
+function buildMachineContract(result) {
+	const digest = createHash("sha256").update(canonicalScanJson(result)).digest("hex");
+	const annotations = result.findings.map((f) => ({
+		path: f.file,
+		start_line: f.line,
+		annotation_level: levelFor(f),
+		message: `${f.ruleId}: ${f.message}`,
+		ruleId: f.ruleId,
+		...f.detectorRevision !== void 0 ? { detectorRevision: f.detectorRevision } : {},
+		advisory: isAdvisory(f)
+	}));
+	return {
+		contractVersion: 1,
+		summary: {
+			digest: `sha256:${digest}`,
+			findings: result.findings.length,
+			score: result.score,
+			errors: countBy(result.findings, (f) => f.severity === "error"),
+			warnings: countBy(result.findings, (f) => f.severity === "warning"),
+			infos: countBy(result.findings, (f) => f.severity === "info"),
+			advisory: countBy(result.findings, isAdvisory)
+		},
+		annotations: annotations.slice(0, 50),
+		annotationsTruncated: result.findings.length > 50,
+		completeness: {
+			partial: result.partial,
+			discovery: result.analysisStatus.discovery,
+			rules: result.analysisStatus.rules,
+			skippedFiles: result.analysisStatus.skippedFiles,
+			rulesCrashed: result.analysisStatus.rulesCrashed ?? 0,
+			truncationReasons: result.analysisStatus.truncationReasons ?? [],
+			frameworkDetectionUnknown: result.frameworkDetectionUnknown,
+			durationMs: result.analysisStatus.durationMs
+		}
+	};
+}
 //#endregion
 //#region src/scorer/prioritize.ts
 /**
@@ -12251,7 +12575,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.5",
+			version: "0.5.7",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -12666,8 +12990,17 @@ function renderPrComment(result, options = {}) {
 	lines.push("");
 	lines.push(`_Advisory only — this comment never blocks merging. Generated by [Mjölnir](${options.repoUrl ?? "https://github.com/Sergey-Bar/Mjolnir"})._`);
 	if (usingDiff && diff.resolvedFindings.length > 0) {
-		lines.push("");
-		lines.push(`✨ ${diff.resolvedFindings.length} pre-existing finding${diff.resolvedFindings.length === 1 ? "" : "s"} fixed in this PR.`);
+		const verified = diff.resolvedFindings.filter((f) => f.resolution.status === "VERIFIED-RESOLVED");
+		const inconclusive = diff.resolvedFindings.filter((f) => f.resolution.status === "INCONCLUSIVE");
+		if (verified.length > 0) {
+			lines.push("");
+			lines.push(`✨ ${verified.length} pre-existing finding${verified.length === 1 ? "" : "s"} verified as fixed in this PR.`);
+		}
+		if (inconclusive.length > 0) {
+			const causes = [...new Set(inconclusive.map((f) => f.resolution.cause ?? "unknown"))].join(", ");
+			lines.push("");
+			lines.push(`ℹ ${inconclusive.length} pre-existing finding${inconclusive.length === 1 ? "" : "s"} disappeared, but this scan can't confirm a fix (${causes}).`);
+		}
 	}
 	return lines.join("\n");
 }
@@ -14963,7 +15296,7 @@ function gitBuffer(root, args) {
 	}
 }
 /** Fingerprint a finding for cross-commit matching (line numbers shift). */
-function fingerprint$1(f) {
+function fingerprint$2(f) {
 	return `${f.ruleId}\u0000${f.file}\u0000${f.message}`;
 }
 async function computeImpact(root, options) {
@@ -15070,9 +15403,9 @@ async function computeImpact(root, options) {
 	}
 	const headResult = await options.runScan(root);
 	const baseSet = /* @__PURE__ */ new Map();
-	for (const f of baseResult.findings) baseSet.set(fingerprint$1(f), f);
+	for (const f of baseResult.findings) baseSet.set(fingerprint$2(f), f);
 	const headSet = /* @__PURE__ */ new Map();
-	for (const f of headResult.findings) headSet.set(fingerprint$1(f), f);
+	for (const f of headResult.findings) headSet.set(fingerprint$2(f), f);
 	const resolved = [];
 	for (const [key, f] of baseSet) if (!headSet.has(key)) resolved.push({
 		ruleId: f.ruleId,
@@ -15130,6 +15463,79 @@ function renderImpact(report) {
 	return lines.join("\n");
 }
 //#endregion
+//#region src/engine/resolution.ts
+/** Correlation identity (v1-compatible): ruleId\0file\0message. */
+function fingerprint$1(entry) {
+	return `${entry.ruleId}\u0000${entry.file}\u0000${entry.message}`;
+}
+/**
+* The §15 ordered algorithm. Pure; first match wins.
+*/
+function resolve$1(input) {
+	const { entry, baseline, current } = input;
+	const fp = fingerprint$1(entry);
+	const comparedAgainst = input.baselineCommit ?? baseline.commit ?? "unknown baseline";
+	if (current.partial || current.analysisStatus.rules !== "complete") return {
+		status: "INCONCLUSIVE",
+		cause: "partial",
+		comparedAgainst
+	};
+	if (input.crashedRuleIds?.has(entry.ruleId)) return {
+		status: "INCONCLUSIVE",
+		cause: "crash",
+		comparedAgainst
+	};
+	if (input.skippedFiles?.has(entry.file)) return {
+		status: "INCONCLUSIVE",
+		cause: "skipped",
+		comparedAgainst
+	};
+	if (input.suppressed?.has(`${entry.ruleId}\u0000${entry.file}`)) return {
+		status: "SUPPRESSED",
+		comparedAgainst
+	};
+	if (input.excludedFiles?.has(entry.file)) return {
+		status: "DISAPPEARED-NON-FIX",
+		cause: "excluded",
+		comparedAgainst
+	};
+	const entryRev = entry.detectorRevision;
+	if (entryRev === void 0) return {
+		status: "INCONCLUSIVE",
+		cause: "legacy-baseline",
+		comparedAgainst
+	};
+	const registryRev = input.registryRevisions.get(entry.ruleId);
+	if (registryRev === void 0) return {
+		status: "DISAPPEARED-NON-FIX",
+		cause: "retired",
+		comparedAgainst
+	};
+	if (registryRev !== entryRev) return {
+		status: "INCONCLUSIVE",
+		cause: "revision-changed",
+		comparedAgainst
+	};
+	if (current.findings.some((f) => fingerprint$1(f) === fp)) return {
+		status: "STILL-PRESENT",
+		comparedAgainst
+	};
+	return {
+		status: "VERIFIED-RESOLVED",
+		comparedAgainst
+	};
+}
+/** The §15 rendering law: "FIXED" only for VERIFIED-RESOLVED. */
+function renderResolution(r) {
+	switch (r.status) {
+		case "VERIFIED-RESOLVED": return "FIXED SINCE BASELINE (verified by a complete same-revision scan)";
+		case "STILL-PRESENT": return "STILL PRESENT";
+		case "SUPPRESSED": return "SUPPRESSED (active ignore entry)";
+		case "INCONCLUSIVE": return `INCONCLUSIVE (${r.cause})`;
+		case "DISAPPEARED-NON-FIX": return `DISAPPEARED — NOT A FIX (${r.cause})`;
+	}
+}
+//#endregion
 //#region src/commands/baseline.ts
 /**
 * `mjolnir baseline` / `mjolnir diff` — Sprint 6 Task 24
@@ -15154,6 +15560,14 @@ function renderImpact(report) {
 const ui$7 = plainContext();
 const DEFAULT_BASELINE_PATH = join(".mjolnir", "baseline.json");
 /**
+* Registry-declared detector revisions (§17): a baseline entry whose
+* revision differs from today's registry is INCONCLUSIVE(revision-
+* changed), never resolved. Omitted declarations mean revision 1 (the
+* documented RuleMeta default for first-generation detectors); a
+* ruleId ABSENT from this map means the rule is retired.
+*/
+const REGISTRY_REVISIONS = new Map(RULES.map((r) => [r.id, r.detectorRevision ?? 1]));
+/**
 * Correlation identity for before/after comparison (agent-handoff plan
 * §5.2): ruleId + file + message, deliberately EXCLUDING `line` — a
 * source edit that shifts a finding still correlates. file:line is an
@@ -15175,7 +15589,8 @@ function buildBaseline(result, commit) {
 			ruleId: f.ruleId,
 			file: f.file,
 			message: f.message,
-			severity: f.severity
+			severity: f.severity,
+			...f.detectorRevision !== void 0 ? { detectorRevision: f.detectorRevision } : {}
 		}))
 	};
 }
@@ -15245,7 +15660,18 @@ function diffAgainstBaseline(result, baseline) {
 		else newFindings.push(f);
 	}
 	const resolvedFindings = [];
-	for (const [key, f] of baseSet) if (!headKeys.has(key)) resolvedFindings.push(f);
+	for (const [key, f] of baseSet) if (!headKeys.has(key)) {
+		const resolution = resolve$1({
+			entry: f,
+			baseline,
+			current: result,
+			registryRevisions: REGISTRY_REVISIONS
+		});
+		resolvedFindings.push({
+			...f,
+			resolution
+		});
+	}
 	return {
 		hasBaseline: true,
 		baselineCapturedAt: baseline.capturedAt,
@@ -15285,8 +15711,17 @@ function renderBaselineDiff(diff) {
 	}
 	lines.push("");
 	if (diff.resolvedFindings.length > 0) {
-		lines.push(`FIXED SINCE BASELINE (${diff.resolvedFindings.length}):`);
-		for (const f of diff.resolvedFindings) lines.push(`  ✓ ${f.ruleId} (${f.severity}) · ${f.file} — ${f.message}`);
+		const verified = diff.resolvedFindings.filter((f) => f.resolution.status === "VERIFIED-RESOLVED");
+		const unresolved = diff.resolvedFindings.filter((f) => f.resolution.status !== "VERIFIED-RESOLVED");
+		if (verified.length > 0) {
+			lines.push(`FIXED SINCE BASELINE (${verified.length}):`);
+			for (const f of verified) lines.push(`  ✓ ${f.ruleId} (${f.severity}) · ${f.file} — ${f.message}`);
+			lines.push("");
+		}
+		if (unresolved.length > 0) {
+			lines.push(`DISAPPEARED — NOT CLASSIFIED AS FIXED (${unresolved.length}):`);
+			for (const f of unresolved) lines.push(`  ${renderResolution(f.resolution)} · ${f.ruleId} (${f.severity}) · ${f.file} — ${f.message}`);
+		}
 	}
 	return lines.join("\n");
 }
@@ -16565,7 +17000,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.5";
+const CLI_VERSION = "0.5.7";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",
@@ -16992,7 +17427,10 @@ async function runScanCommand(argv, io = {
 		}
 		if (args.format === "sarif") io.out(renderSarif(result));
 		else if (args.format === "mermaid") io.out(renderMermaid(result));
-		else if (args.json) io.out(JSON.stringify(result, null, 2));
+		else if (args.json) io.out(JSON.stringify({
+			...result,
+			contract: buildMachineContract(result)
+		}, null, 2));
 		else {
 			const categories = args.categories;
 			const visible = categories && categories.length > 0 ? result.findings.filter((f) => categories.includes(f.category)) : result.findings;
@@ -17268,7 +17706,7 @@ async function runDiffCommand(argv, io = {
 			const statsPath = join(target, DEFAULT_STATS_PATH);
 			const stats = recordResolved(loadStats(statsPath), diff);
 			if (!saveStats(stats, statsPath)) io.err("  (warning: stats could not be written — read-only filesystem? counters not recorded)");
-			if (diff.resolvedFindings.length > 0) {
+			if (diff.resolvedFindings.some((f) => f.resolution.status === "VERIFIED-RESOLVED")) {
 				const milestone = recordMilestones(stats, ["first-debt-reduction"]);
 				if (milestone.newlyAnnounced.length > 0) {
 					if (saveStats(milestone.stats, statsPath)) for (const id of milestone.newlyAnnounced) io.out(MILESTONE_MESSAGES[id]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mjolnir-qa",
-  "version": "0.5.5",
+  "version": "0.5.7",
   "description": "Mjölnir — the Verification Trust Engine for QA. Audits test suites and CI pipelines, reports a worthiness score and prioritized findings.",
   "type": "module",
   "engines": {
@@ -35,6 +35,7 @@
     "fp-audit:generate": "tsx scripts/generate-fp-audit-table.ts",
     "docs:rules": "tsx scripts/generate-rule-docs.ts",
     "docs:capability": "tsx scripts/generate-capability-matrix.ts",
+    "docs:machine-contract": "tsx scripts/generate-machine-contract-doc.ts",
     "docs:hero": "tsx scripts/generate-readme-hero.ts",
     "docs:formats": "tsx scripts/generate-site-formats.ts",
     "docs:forensics-samples": "tsx scripts/generate-forensics-samples.ts",