mjolnir-qa 2.0.0 → 2.0.2

package/README.uk.md

@@ -81,7 +81,7 @@ Mjölnir читає набір тестів, CI-workflow і, якщо він є,
 Реальне сканування [`examples/demo-repo`](examples/demo-repo), невеликого набору тестів Playwright із CI-workflow. Ось куди пішли його бали:
 
 <p align="center">
-  <img src="assets/readme/terminal-hero.svg" alt="Розбивка вирахувань Mjölnir: WORTHINESS 75/100 NEEDS WORK, оцінка за категоріями, блок вирахувань за серйозністю та список FIX THIS FIRST" width="520" />
+  <img src="assets/readme/terminal-hero.svg" alt="Розбивка вирахувань Mjölnir: WORTHINESS 80/100 WORTHY, оцінка за категоріями, блок вирахувань за серйозністю та список FIX THIS FIRST" width="520" />
 </p>
 
 <sub>Згенеровано командою `npm run docs:hero` з реального сканування і захищено від розбіжностей у CI. Повний звіт `--verbose` того самого сканування — [`demo.svg`](assets/readme/demo.svg) (`npm run docs:demo`).</sub>
@@ -312,8 +312,8 @@ e2e/login.spec.ts
   role/text: 1 · testid: 0 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 
 e2e/checkout.spec.ts
-  [█████████████████░░░]  86 / 100
-  role/text: 3 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
+  [██████████████████░░]  88 / 100
+  role/text: 4 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 ```
 
 Це вимірює **стійкість, а не коректність**. `.btn.btn-primary > div:nth-child(2)` проходить сьогодні й проходитиме, доки хтось не торкнеться розмітки. Низька оцінка ніколи не стверджує, що тест зламаний, — лише що він залежить від розмітки, яку ніхто не обіцяв зберігати.

package/README.vi.md

@@ -81,7 +81,7 @@ Mjölnir đọc bộ test, các workflow CI và, nếu bạn có, báo cáo củ
 Một lần quét thật trên [`examples/demo-repo`](examples/demo-repo), một bộ test Playwright nhỏ có workflow CI. Đây là nơi điểm của nó bị trừ:
 
 <p align="center">
-  <img src="assets/readme/terminal-hero.svg" alt="Bảng phân tích trừ điểm của Mjölnir: WORTHINESS 75/100 NEEDS WORK, điểm theo từng hạng mục, ô trừ điểm theo mức nghiêm trọng và danh sách FIX THIS FIRST" width="520" />
+  <img src="assets/readme/terminal-hero.svg" alt="Bảng phân tích trừ điểm của Mjölnir: WORTHINESS 80/100 WORTHY, điểm theo từng hạng mục, ô trừ điểm theo mức nghiêm trọng và danh sách FIX THIS FIRST" width="520" />
 </p>
 
 <sub>Được tạo bởi `npm run docs:hero` từ một lần quét thật và được khóa chống sai lệch trong CI. Báo cáo `--verbose` đầy đủ của cùng lần quét là [`demo.svg`](assets/readme/demo.svg) (`npm run docs:demo`).</sub>
@@ -312,8 +312,8 @@ e2e/login.spec.ts
   role/text: 1 · testid: 0 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 
 e2e/checkout.spec.ts
-  [█████████████████░░░]  86 / 100
-  role/text: 3 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
+  [██████████████████░░]  88 / 100
+  role/text: 4 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 ```
 
 Điều này đo **độ bền, không phải độ đúng**. `.btn.btn-primary > div:nth-child(2)` qua hôm nay và sẽ tiếp tục qua cho đến khi ai đó động vào markup. Điểm thấp không bao giờ khẳng định test bị hỏng, chỉ nói rằng nó phụ thuộc vào markup mà không ai hứa giữ nguyên.

package/README.zh.md

@@ -81,7 +81,7 @@ Mjölnir 读取测试套件、CI workflow，以及（如果有的话）一次真
 对 [`examples/demo-repo`](examples/demo-repo) 的一次真实扫描，这是一个带 CI workflow 的小型 Playwright 套件。它的分数都扣在了这里：
 
 <p align="center">
-  <img src="assets/readme/terminal-hero.svg" alt="Mjölnir 的扣分明细：WORTHINESS 75/100 NEEDS WORK、按类别的评分、按严重级别的扣分框，以及 FIX THIS FIRST 列表" width="520" />
+  <img src="assets/readme/terminal-hero.svg" alt="Mjölnir 的扣分明细：WORTHINESS 80/100 WORTHY、按类别的评分、按严重级别的扣分框，以及 FIX THIS FIRST 列表" width="520" />
 </p>
 
 <sub>由 `npm run docs:hero` 根据一次真实扫描生成，并在 CI 中锁定以防漂移。同一次扫描的完整 `--verbose` 报告是 [`demo.svg`](assets/readme/demo.svg)（`npm run docs:demo`）。</sub>
@@ -312,8 +312,8 @@ e2e/login.spec.ts
   role/text: 1 · testid: 0 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 
 e2e/checkout.spec.ts
-  [█████████████████░░░]  86 / 100
-  role/text: 3 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
+  [██████████████████░░]  88 / 100
+  role/text: 4 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 ```
 
 这衡量的是**韧性，而非正确性**。`.btn.btn-primary > div:nth-child(2)` 今天能通过，并会一直通过，直到有人改动标记结构。低分从不声称测试坏了，只说明它依赖于没有人承诺保留的标记结构。

package/README.zht.md

@@ -81,7 +81,7 @@ Mjölnir 讀取測試套件、CI workflow，以及（如果有的話）一次真
 對 [`examples/demo-repo`](examples/demo-repo) 的一次真實掃描，這是一個附帶 CI workflow 的小型 Playwright 套件。它的分數都扣在了這裡：
 
 <p align="center">
-  <img src="assets/readme/terminal-hero.svg" alt="Mjölnir 的扣分明細：WORTHINESS 75/100 NEEDS WORK、依類別的評分、依嚴重程度的扣分框，以及 FIX THIS FIRST 清單" width="520" />
+  <img src="assets/readme/terminal-hero.svg" alt="Mjölnir 的扣分明細：WORTHINESS 80/100 WORTHY、依類別的評分、依嚴重程度的扣分框，以及 FIX THIS FIRST 清單" width="520" />
 </p>
 
 <sub>由 `npm run docs:hero` 根據一次真實掃描產生，並在 CI 中鎖定以防漂移。同一次掃描的完整 `--verbose` 報告是 [`demo.svg`](assets/readme/demo.svg)（`npm run docs:demo`）。</sub>
@@ -312,8 +312,8 @@ e2e/login.spec.ts
   role/text: 1 · testid: 0 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 
 e2e/checkout.spec.ts
-  [█████████████████░░░]  86 / 100
-  role/text: 3 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
+  [██████████████████░░]  88 / 100
+  role/text: 4 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 ```
 
 這衡量的是**韌性，而非正確性**。`.btn.btn-primary > div:nth-child(2)` 今天能通過，並會一直通過，直到有人改動標記結構。低分從不聲稱測試壞了，只說明它依賴於沒有人承諾保留的標記結構。

package/dist/cli.d.mts

@@ -80,7 +80,7 @@ interface RuntimeCorroboration {
    * constrains TRUE-FLAKE derivation, which lives in the analysis, not
    * in the provenance label.
    */
-  source: "playwright-json" | "junit-xml" | "jest-json" | "vitest-json" | "playwright-trace";
+  source: "playwright-json" | "junit-xml" | "jest-json" | "vitest-json" | "playwright-trace" | "har";
   /** Number of tests executed in the finding's file (any level). */
   testsExecuted: number;
   /**
@@ -436,6 +436,13 @@ interface ScanResult {
     sourceCount: number;
     findingIds: string[];
   }>;
+  /**
+   * Aggregate forensic classifications from the discovered runtime
+   * report (plan §10.4, WAVE 5). Present only when a runtime report was
+   * ingested and produced ≥1 classified verdict — absent otherwise, so
+   * the machine contract's `forensicVerdicts` slot is never fabricated.
+   */
+  forensicVerdicts?: ForensicVerdictSummary;
   /**
    * Dependency graph metadata (ECO-005). Present when a dependency
    * manifest (package.json, pyproject.toml, pom.xml) was found.
@@ -490,6 +497,21 @@ interface TrustSummary {
   /** Which incompleteness factors applied (audit trail for the cap). */
   ceilingReasons: string[];
 }
+/**
+ * Aggregate forensic classifications from a runtime report (plan §10.4,
+ * WAVE 5). Present on a ScanResult when a runtime report was ingested
+ * and produced at least one classified verdict. `inconclusive` is a
+ * first-class outcome — the default when evidence is insufficient — and
+ * is also counted inside `byVerdict`.
+ */
+interface ForensicVerdictSummary {
+  /** Total verdicts carrying a forensic classification. */
+  classifications: number;
+  /** Classification count per verdict label. */
+  byVerdict: Record<string, number>;
+  /** INCONCLUSIVE outcome count — a first-class result, not a failure. */
+  inconclusive: number;
+}
 //#endregion
 //#region src/engine/tier-policy.d.ts
 type Tier = "core" | "extended" | "quarantine";
@@ -552,6 +574,13 @@ interface TestVerdict {
    */
   forensic?: ForensicClassification;
 }
+interface NetworkObservation {
+  file: string;
+  title: string;
+  outcome: "succeeded" | "failed" | "unknown";
+  durationMs: number;
+  errors?: string[];
+}
 interface ForensicsReport {
   forensicsSchemaVersion: number;
   /**
@@ -563,7 +592,7 @@ interface ForensicsReport {
    * `playwright-trace`: one record per trace artifact (the per-test
    * trace convention), action-level facts only.
    */
-  source: "playwright-json" | "junit-xml" | "jest-json" | "vitest-json" | "playwright-trace";
+  source: "playwright-json" | "junit-xml" | "jest-json" | "vitest-json" | "playwright-trace" | "har";
   totalTests: number;
   failed: number;
   skipped: number;
@@ -571,6 +600,9 @@ interface ForensicsReport {
   flakyTests: number;
   totalDurationMs: number;
   verdicts: TestVerdict[];
+  totalNetworkObservations?: number;
+  failedNetworkObservations?: number;
+  networkObservations?: NetworkObservation[];
   /**
    * Whether all discovered report files were successfully ingested.
    * FALSE when any files were skipped due to size limits, parse failures,
@@ -1055,7 +1087,7 @@ declare function loadConfig(root: string, options?: {
   warnings: string[];
 };
 declare namespace scan_pipeline_d_exports {
-  export { AssembleScanResultInput, CliArgs, DiscoveryResult, EVIDENCE_OVERRIDES$1 as EVIDENCE_OVERRIDES, FileAnalysisResult, KNOWN_RULE_IDS$1 as KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID$1 as OVERLAP_META_BY_RULE_ID, PostScanResult, SUITE_INVALIDATING_RULE_IDS$1 as SUITE_INVALIDATING_RULE_IDS, ScanHooks, applyPostScanProcessing, assembleScanResult, buildUniversalRules$1 as buildUniversalRules, discoverAndParseRuntimeReport$1 as discoverAndParseRuntimeReport, discoverTestFilesPhase, fallbackWorkspace$1 as fallbackWorkspace, isValidFindingRecord$1 as isValidFindingRecord, pathMatchesGlob$1 as pathMatchesGlob, runFileAnalysisPhase, runScan$1 as runScan, selectAdapter };
+  export { AssembleScanResultInput, CliArgs, DiscoveryResult, EVIDENCE_OVERRIDES$1 as EVIDENCE_OVERRIDES, FileAnalysisResult, KNOWN_RULE_IDS$1 as KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID$1 as OVERLAP_META_BY_RULE_ID, PostScanResult, SUITE_INVALIDATING_RULE_IDS$1 as SUITE_INVALIDATING_RULE_IDS, ScanHooks, applyPostScanProcessing, assembleScanResult, buildUniversalRules$1 as buildUniversalRules, discoverAndParseRuntimeReport$1 as discoverAndParseRuntimeReport, discoverTestFilesPhase, fallbackWorkspace$1 as fallbackWorkspace, isValidFindingRecord$1 as isValidFindingRecord, pathMatchesGlob$1 as pathMatchesGlob, runFileAnalysisPhase, runScan$1 as runScan, selectAdapter, summarizeForensicVerdicts };
 }
 /** Registered rule IDs — used to warn on unknown severityOverrides keys (M4). */
 declare const KNOWN_RULE_IDS$1: ReadonlySet<string>;
@@ -1220,11 +1252,11 @@ declare function pathMatchesGlob$1(path: string, glob: string): boolean;
  * Plan §16 + WI-11: locate a runtime run report next to the scan
  * target, using the exact conventions the forensics ingestion already
  * accepts. Zero-config search over conventional artifact names at
- * depth ≤ 2 (src/discovery/evidence-discovery.ts); the FIRST parsable
- * candidate wins (priority: mjolnir-report > playwright-json >
- * test-results-dir > junit-file). Validates each candidate by attempting
- * to parse it and checking that it produces at least one test. Returns
- * the parsed report alongside the path to avoid double-parsing.
+ * depth ≤ 2 (src/discovery/evidence-discovery.ts). The FIRST parsable
+ * candidate with `totalTests > 0` is kept as a fallback; the loop
+ * continues and returns a later candidate when one with
+ * `analysisComplete === true` is found. Returns the parsed report
+ * alongside the path to avoid double-parsing.
  */
 declare function discoverAndParseRuntimeReport$1(scanRoot: string): {
   path: string;
@@ -1272,8 +1304,17 @@ interface PostScanResult {
   suppressionCount: number;
   frameworks: ReturnType<typeof detectFrameworks>;
   runtimeReportPath: string | undefined;
+  /** Aggregate forensic classifications from the ingested runtime report. */
+  forensicVerdicts: ForensicVerdictSummary | undefined;
   config: ReturnType<typeof loadConfig>["config"];
 }
+/**
+ * Summarize forensic classifications from an ingested runtime report
+ * (plan §10.4, WAVE 5). Returns undefined when no verdict carries a
+ * classification — the machine contract slot stays absent rather than
+ * reporting all-zero counts.
+ */
+declare function summarizeForensicVerdicts(report: ForensicsReport): ForensicVerdictSummary | undefined;
 declare function applyPostScanProcessing(findings: Finding[], workspace: Workspace, args: CliArgs, hooks: ScanHooks, scanRoot: Workspace, declarationsByFile: Map<string, number>, testDeclarationCount: number, tierByRuleId: Map<string, Tier>, REVISION_BY_RULE_ID: Map<string, number>): PostScanResult;
 interface AssembleScanResultInput {
   findings: Finding[];
@@ -1307,6 +1348,7 @@ interface AssembleScanResultInput {
   suppressionCount: number;
   frameworks: ReturnType<typeof detectFrameworks>;
   runtimeReportPath: string | undefined;
+  forensicVerdicts: ForensicVerdictSummary | undefined;
   config: ReturnType<typeof loadConfig>["config"];
   fileProvenance: Array<{
     path: string;
@@ -1339,7 +1381,7 @@ declare function runScan$1(args: CliArgs, hooks?: ScanHooks): Promise<ScanResult
  * scripts/sync-sarif-version.cjs and guarded by the version-consistency
  * spec. cli.ts re-exports this as CLI_VERSION.
  */
-declare const ENGINE_VERSION = "2.0.0";
+declare const ENGINE_VERSION = "2.0.2";
 //#endregion
 //#region src/cli-io.d.ts
 /**
@@ -1516,6 +1558,91 @@ export declare function runReleaseTrustCommand(argv: string[], io?: {
   err: Output;
 }): number;
 //#endregion
+//#region src/commands/business-case.d.ts
+/**
+ * Entry point for `mjolnir business-case`.
+ *
+ * Flags:
+ *   --industry <type>    Industry cost profile (default/fintech/healthcare/...)
+ *   --history <months>   Use git history for the last N months (estimates from
+ *                        actual scan improvements, not projections)
+ *   --projected <months> Show projected savings over N months
+ *   --strict             Include quarantine-tier findings
+ */
+export declare function runBusinessCaseCommand(argv: string[], io?: {
+  out: Output;
+  err?: Output;
+}): Promise<number>;
+//#endregion
+//#region src/commands/release-report.d.ts
+/**
+ * CLI verb: `mjolnir release-report [--since <ref>] [--history <json>] [target]`.
+ */
+export declare function runReleaseReportCommand(argv: string[], io: {
+  out: Output;
+  err: Output;
+}): Promise<number>;
+//#endregion
+//#region src/commands/report-playwright.d.ts
+export declare function runReportPlaywrightCommand(argv: string[], io: {
+  out: Output;
+  err: Output;
+}): Promise<number>;
+//#endregion
+//#region src/commands/trend.d.ts
+export declare function runTrendCommand(argv: string[], io: {
+  out: Output;
+  err: Output;
+}): Promise<number>;
+//#endregion
+//#region src/commands/exec-report.d.ts
+export declare function runExecReportCommand(argv: string[], io: {
+  out: Output;
+  err: Output;
+}): Promise<number>;
+//#endregion
+//#region src/commands/policy.d.ts
+export declare function runPolicyCommand(argv: string[], io: {
+  out: Output;
+  err: Output;
+}): Promise<number>;
+//#endregion
+//#region src/commands/quarantine.d.ts
+export declare function runQuarantineCommand(argv: string[], io: {
+  out: Output;
+  err: Output;
+}): Promise<number>;
+//#endregion
+//#region src/commands/analyze.d.ts
+export declare function runAnalyzeCommand(argv: string[], io: {
+  out: Output;
+  err: Output;
+}): number;
+//#endregion
+//#region src/commands/ci-adapter.d.ts
+export declare function runCiAdapterCommand(argv: string[], io: {
+  out: Output;
+  err: Output;
+}): Promise<number>;
+//#endregion
+//#region src/commands/dashboard.d.ts
+export declare function runDashboardCommand(argv: string[], io: {
+  out: Output;
+  err: Output;
+}): Promise<number>;
+//#endregion
+//#region src/commands/enterprise.d.ts
+export declare function runEnterpriseCommand(argv: string[], io: {
+  out: Output;
+  err: Output;
+}): number;
+//#endregion
+//#region src/commands/maturity.d.ts
+export declare function runMaturityCommand(argv: string[], io: {
+  out: Output;
+  err: Output;
+}): number;
+//#endregion
 //#region src/cli.d.ts
 export declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniversalRules$1, fallbackWorkspace: typeof fallbackWorkspace$1, pathMatchesGlob: typeof pathMatchesGlob$1, isValidFindingRecord: typeof isValidFindingRecord$1, discoverAndParseRuntimeReport: typeof discoverAndParseRuntimeReport$1, KNOWN_RULE_IDS: ReadonlySet<string>, OVERLAP_META_BY_RULE_ID: ReadonlyMap<string, OverlapMeta>, EVIDENCE_OVERRIDES: ReadonlyMap<string, string>, SUITE_INVALIDATING_RULE_IDS: ReadonlySet<string>;
 /** A usage-error detail: the offending token, when one exists. */