mjolnir-qa 2.0.0 → 2.0.2

package/dist/mcp/stdio.mjs

@@ -3,7 +3,7 @@ import { createInterface } from "node:readline";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import * as ts$2 from "ts-morph";
 import ts, { Project, SyntaxKind, ts as ts$1 } from "ts-morph";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -109,31 +109,21 @@ function stampRuntimeCorroboration(findings, report, scanRoot) {
 			source: report.source,
 			testsExecuted
 		};
-		if (f.qaImpact === "FLAKY-RISK" && matched !== void 0 && !matched.skipped && (matched.passedOnRetry || matched.everFailed || matched.finalStatus === "timedOut")) corroboration.level = "defect";
+		if (f.qaImpact === "FLAKY-RISK" && matched !== void 0 && !matched.skipped && (matched.passedOnRetry || matched.finalStatus === "timedOut") && deriveTrustLevel(f, {
+			...corroboration,
+			level: "defect"
+		}) === "L5") corroboration.level = "defect";
 		f.runtimeCorroboration = corroboration;
 		f.trustLevel = deriveTrustLevel(f, corroboration);
 		corroborated++;
 	}
 	return corroborated;
 }
-/**
-* The test whose declaration span contains `line`. Playwright JSON
-* verdicts carry the spec's declaration line: the containing test is
-* the one with the greatest declaration line ≤ the finding's line in
-* the same file (specs are flat within a file). When the report cannot
-* place lines (JUnit, or some verdicts lack them) the only HONEST
-* claim is file-level corroboration — plus the unambiguous
-* single-test-file case. Claiming a specific test without range
-* knowledge would fabricate precision the report does not carry.
-*/
 function findContainingTest(verdicts, line) {
-	if (verdicts.length === 1) return verdicts[0];
+	if (!Number.isInteger(line) || line < 1) return void 0;
 	if (verdicts.some((v) => v.line === void 0)) return void 0;
-	const sorted = [...verdicts].sort((a, b) => (a.line ?? 0) - (b.line ?? 0));
-	let match;
-	for (const v of sorted) if ((v.line ?? 0) <= line) match = v;
-	else break;
-	return match;
+	const matches = verdicts.filter((v) => v.line === line);
+	return matches.length === 1 ? matches[0] : void 0;
 }
 /**
 * The deterministic L0–L5 derivation (see TRUST_ORDER). Static base
@@ -144,7 +134,7 @@ function findContainingTest(verdicts, line) {
 function deriveTrustLevel(finding, corroboration) {
 	const level = finding.evidenceLevel ?? (finding.findingType === "observation" ? "E0" : finding.findingType === "heuristic-risk" ? "E1" : finding.confidence === "low" ? "E1" : "E2");
 	if (!corroboration) return level === "E0" ? "L0" : level === "E1" ? "L1" : "L2";
-	if (corroboration.level === "defect") return "L5";
+	if (corroboration.level === "defect") return level === "E0" ? "L4" : "L5";
 	if (corroboration.level === "test") return "L4";
 	return "L3";
 }
@@ -441,7 +431,7 @@ const MEASURED_FP = {
 	"QA-PW-125": {
 		fpRate: 0,
 		n: 10,
-		detectorRevision: 1,
+		detectorRevision: 2,
 		ciLow: 0,
 		ciHigh: .2775
 	},
@@ -914,7 +904,7 @@ function buildEvidenceGraph(parts) {
 * scripts/sync-sarif-version.cjs and guarded by the version-consistency
 * spec. cli.ts re-exports this as CLI_VERSION.
 */
-const ENGINE_VERSION = "2.0.0";
+const ENGINE_VERSION = "2.0.2";
 //#endregion
 //#region src/engine/contract-versions.ts
 /**
@@ -1052,12 +1042,12 @@ function discoverWorkspace(rootDir) {
 	else if (rawWorkspaces && typeof rawWorkspaces === "object" && Array.isArray(rawWorkspaces.packages)) globs = rawWorkspaces.packages.filter((w) => typeof w === "string");
 	return {
 		root,
-		name: typeof pkg["name"] === "string" ? pkg["name"] : basename(root),
+		name: typeof pkg["name"] === "string" ? pkg["name"] : basename$1(root),
 		packageJson: pkg,
 		workspaceGlobs: globs
 	};
 }
-function basename(p) {
+function basename$1(p) {
 	const parts = p.split(/[\\/]/);
 	return parts[parts.length - 1];
 }
@@ -1713,41 +1703,25 @@ function getCodeOnlyText(file) {
 	try {
 		const text = file.text;
 		const ranges = [];
-		for (const d of sf.getDescendantsOfKind(ts$1.SyntaxKind.StringLiteral)) {
-			const s = d.getStart();
-			ranges.push({
-				start: s,
-				end: s + d.getWidth()
-			});
-		}
-		for (const d of sf.getDescendantsOfKind(ts$1.SyntaxKind.NoSubstitutionTemplateLiteral)) {
-			const s = d.getStart();
-			ranges.push({
-				start: s,
-				end: s + d.getWidth()
-			});
-		}
-		for (const d of sf.getDescendantsOfKind(ts$1.SyntaxKind.TemplateHead)) {
-			const s = d.getStart();
-			ranges.push({
-				start: s,
-				end: s + d.getWidth()
-			});
-		}
-		for (const d of sf.getDescendantsOfKind(ts$1.SyntaxKind.TemplateMiddle)) {
-			const s = d.getStart();
-			ranges.push({
-				start: s,
-				end: s + d.getWidth()
-			});
-		}
-		for (const d of sf.getDescendantsOfKind(ts$1.SyntaxKind.TemplateTail)) {
-			const s = d.getStart();
-			ranges.push({
-				start: s,
-				end: s + d.getWidth()
-			});
-		}
+		const compiler = sf.compilerNode;
+		const stringAndTemplateKinds = {
+			[ts$1.SyntaxKind.StringLiteral]: true,
+			[ts$1.SyntaxKind.NoSubstitutionTemplateLiteral]: true,
+			[ts$1.SyntaxKind.TemplateHead]: true,
+			[ts$1.SyntaxKind.TemplateMiddle]: true,
+			[ts$1.SyntaxKind.TemplateTail]: true
+		};
+		const collect = (node) => {
+			if (stringAndTemplateKinds[node.kind]) {
+				const s = node.getStart(compiler);
+				ranges.push({
+					start: s,
+					end: s + node.getWidth()
+				});
+			}
+			ts$1.forEachChild(node, collect);
+		};
+		ts$1.forEachChild(compiler, collect);
 		for (const r of commentAndStringRanges({
 			...file,
 			ast: sf
@@ -6677,7 +6651,7 @@ const swallowedVerificationFailure = defineRule({
 	autofix: false,
 	detectionStrategy: "FRAMEWORK",
 	detectionNotes: "Groovy try/catch block scan (string-aware brace matching) over the Jenkinsfile text",
-	introduced: "2.0.0",
+	introduced: "1.1.1",
 	tier: "quarantine",
 	run(ctx) {
 		const findings = [];
@@ -8105,6 +8079,7 @@ const pwGlobalSetupSharedState = defineRule({
 	},
 	detectionNotes: "regex heuristic",
 	introduced: "0.3.0",
+	detectorRevision: 2,
 	run(ctx) {
 		const text = ctx.text;
 		const findings = [];
@@ -8112,6 +8087,7 @@ const pwGlobalSetupSharedState = defineRule({
 		const re = /(?:execSync|exec|spawn|query|request)\s*\(\s*[`'"][^`'"]*(?:migrate|migration|seed|TRUNCATE|DROP\s+(?:TABLE|DATABASE)|DELETE\s+FROM)[^`'"]*[`'"]/gi;
 		let m;
 		while ((m = re.exec(text)) !== null) {
+			if (isMasked(ctx, m.index)) continue;
 			const lineStart = text.lastIndexOf("\n", m.index) + 1;
 			const lineEnd = text.indexOf("\n", m.index);
 			const prevLineStart = text.lastIndexOf("\n", lineStart - 2) + 1;
@@ -11190,6 +11166,10 @@ const RULES = [
 	seCSharpSleepLookup,
 	sePythonSleepLookup
 ];
+/**
+* Look up a rule by its ID in the active registry.
+* Returns undefined if the ID is not found (including retired IDs).
+*/
 function getRule(id) {
 	return RULES.find((r) => r.id === id);
 }
@@ -11907,7 +11887,7 @@ function hasBlocker(findings) {
 function analyzeMonorepo(packages, config) {
 	const results = packages.map((p) => ({
 		...p,
-		verdict: verdictOf(p.score)
+		verdict: hasBlocker(p.findings) ? "fail" : verdictOf(p.score)
 	}));
 	if (results.length === 0) return {
 		packages: results,
@@ -12014,7 +11994,7 @@ function configurableAggregation(results, config) {
 */
 const CACHE_VERSION = 2;
 /** Entry cap: a monorepo-scale suite stays far below this; bounded file. */
-const MAX_ENTRIES = 4096;
+const MAX_ENTRIES$1 = 4096;
 /**
 * Audit M5: total byte budget. The old cap counted only ENTRIES, so
 * 4096 files × ~100KB of findings each could still produce a
@@ -12159,7 +12139,7 @@ function createScanCache(root) {
 			entryBytes.set(key, newBytes);
 			totalBytes = totalBytes - replacedBytes + newBytes;
 			let count = Object.keys(entries).length;
-			while ((count > MAX_ENTRIES || totalBytes > MAX_TOTAL_BYTES) && count > 1) {
+			while ((count > MAX_ENTRIES$1 || totalBytes > MAX_TOTAL_BYTES) && count > 1) {
 				const oldest = Object.keys(entries)[0];
 				totalBytes -= entryBytes.get(oldest);
 				delete entries[oldest];
@@ -12601,6 +12581,7 @@ const ui$5 = plainContext();
 const MAX_RECORDS = 1e5;
 function analyze(records, source) {
 	const verdicts = [];
+	const networkObservations = [];
 	let failed = 0;
 	let skipped = 0;
 	let retried = 0;
@@ -12610,6 +12591,16 @@ function analyze(records, source) {
 		const attempts = rec.attempts;
 		const finalStatus = attempts[attempts.length - 1]?.status ?? "skipped";
 		const totalDurationMs = attempts.reduce((s, a) => s + a.durationMs, 0);
+		if (rec.evidenceKind === "network-observation") {
+			networkObservations.push({
+				file: rec.file,
+				title: rec.title,
+				outcome: finalStatus === "passed" ? "succeeded" : finalStatus === "skipped" ? "unknown" : "failed",
+				durationMs: totalDurationMs,
+				...rec.errors !== void 0 ? { errors: rec.errors } : {}
+			});
+			continue;
+		}
 		totalDuration += totalDurationMs;
 		const everFailed = attempts.some((a) => a.status === "failed" || a.status === "timedOut");
 		const passedOnRetry = finalStatus === "passed" && attempts.length >= 2 && everFailed;
@@ -12650,9 +12641,14 @@ function analyze(records, source) {
 		flakyTests: flaky,
 		totalDurationMs: totalDuration,
 		verdicts,
-		analysisComplete: true,
+		...networkObservations.length > 0 ? {
+			totalNetworkObservations: networkObservations.length,
+			failedNetworkObservations: networkObservations.filter((observation) => observation.outcome === "failed").length,
+			networkObservations
+		} : {},
+		analysisComplete: records.length <= MAX_RECORDS,
 		skippedReports: 0,
-		incompleteReasons: []
+		incompleteReasons: records.length > MAX_RECORDS ? ["record-count-limit"] : []
 	};
 }
 /** Flakiness Leaderboard: flakiest first, then slowest. */
@@ -12667,16 +12663,36 @@ function bar(ms, maxMs, width = 20) {
 	const filled = Math.round(ms / maxMs * width);
 	return "█".repeat(Math.min(width, filled)) + "░".repeat(Math.max(0, width - filled));
 }
+function renderNetworkObservations(report) {
+	if (!report.networkObservations?.length) return [];
+	const failures = report.networkObservations.filter((observation) => observation.outcome === "failed");
+	return [
+		`${report.networkObservations.length} network observations · ${failures.length} network failures (not test outcomes)`,
+		...failures.slice(0, 25).map((observation) => `NETWORK FAILURE ${observation.title} · ${(observation.durationMs / 1e3).toFixed(1)}s`),
+		""
+	];
+}
+function partialAnalysisMessage(report) {
+	const skippedReasons = report.incompleteReasons.filter((reason) => reason !== "record-count-limit");
+	const partialReasons = report.incompleteReasons.filter((reason) => reason === "record-count-limit").map(() => "record count limit reached");
+	if (report.skippedReports > 0) {
+		const skippedReasonText = skippedReasons.length > 0 ? ` (${skippedReasons.join(", ")})` : "";
+		const suffix = partialReasons.length > 0 ? `; ${partialReasons.join(", ")}.` : ".";
+		return `Analysis is partial — ${report.skippedReports} report(s) skipped${skippedReasonText}${suffix}`;
+	}
+	return `${partialReasons.length > 0 ? partialReasons.join(", ") : report.incompleteReasons.join(", ")}; analysis is partial.`;
+}
 function renderLeaderboard(report) {
 	const lines = [];
 	lines.push(sectionHeader("FLAKINESS LEADERBOARD", ui$5));
 	lines.push("");
 	lines.push(`${report.totalTests} tests · ${report.failed} failed · ${report.flakyTests} flaky · ${report.retriedTests} retried`);
 	lines.push("");
+	lines.push(...renderNetworkObservations(report));
 	const top = leaderboard(report);
 	if (top.length === 0) {
-		lines.push("No failures or retries found — nothing suspicious this run.");
-		if (!report.analysisComplete) lines.push(`⚠ Analysis is partial — ${report.skippedReports} report(s) skipped (${report.incompleteReasons.join(", ")}).`);
+		lines.push(report.totalTests === 0 && (report.totalNetworkObservations ?? 0) > 0 ? "No test outcomes available from network observations." : (report.totalNetworkObservations ?? 0) > 0 ? "No flaky or failing tests detected; network evidence is listed separately." : "No failures or retries found — nothing suspicious this run.");
+		if (!report.analysisComplete) lines.push(`⚠ ${partialAnalysisMessage(report)}`);
 		return lines.join("\n");
 	}
 	const maxMs = Math.max(...top.map((v) => v.totalDurationMs), 1);
@@ -12686,7 +12702,7 @@ function renderLeaderboard(report) {
 	}
 	if (!report.analysisComplete) {
 		lines.push("");
-		lines.push(`⚠ Analysis is partial — ${report.skippedReports} report(s) skipped (${report.incompleteReasons.join(", ")}).`);
+		lines.push(`⚠ ${partialAnalysisMessage(report)}`);
 	}
 	return lines.join("\n");
 }
@@ -12700,12 +12716,13 @@ function renderFlakyMd(report) {
 	lines.push("");
 	lines.push(`**${report.totalTests}** tests analyzed · **${report.flakyTests}** true flakes · **${report.retriedTests}** retried · **${report.failed}** failing`);
 	lines.push("");
+	lines.push(...renderNetworkObservations(report));
 	const top = leaderboard(report);
 	if (top.length === 0) {
-		lines.push("_No flaky or failing tests detected in this run._");
+		lines.push(report.totalTests === 0 && (report.totalNetworkObservations ?? 0) > 0 ? "_No test outcomes available from network observations._" : "_No flaky or failing tests detected in this run._");
 		if (!report.analysisComplete) {
 			lines.push("");
-			lines.push(`> ⚠ Analysis is partial — ${report.skippedReports} report(s) skipped (${report.incompleteReasons.join(", ")}).`);
+			lines.push(`> ⚠ ${partialAnalysisMessage(report)}`);
 		}
 		return lines.join("\n");
 	}
@@ -12717,7 +12734,7 @@ function renderFlakyMd(report) {
 	}
 	if (!report.analysisComplete) {
 		lines.push("");
-		lines.push(`> ⚠ Analysis is partial — ${report.skippedReports} report(s) skipped (${report.incompleteReasons.join(", ")}).`);
+		lines.push(`> ⚠ ${partialAnalysisMessage(report)}`);
 	}
 	lines.push("");
 	return lines.join("\n");
@@ -13236,6 +13253,92 @@ function parseVitestJson(json) {
 	return out;
 }
 //#endregion
+//#region src/forensics/parse-har.ts
+const MAX_ENTRIES = 2e4;
+function sanitizeTitleUrl(url) {
+	try {
+		const parsed = new URL(url);
+		parsed.username = "";
+		parsed.password = "";
+		parsed.search = "";
+		parsed.hash = "";
+		return `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+	} catch {
+		return url.split(/[?#]/, 1)[0] ?? url;
+	}
+}
+function serializeTransportError(value) {
+	if (typeof value === "string") return value;
+	try {
+		const serialized = JSON.stringify(value);
+		return serialized === void 0 ? String(value) : serialized;
+	} catch {
+		return "[unserializable transport error]";
+	}
+}
+function isValidHttpStatus(status) {
+	return typeof status === "number" && Number.isInteger(status) && status >= 100 && status <= 599;
+}
+/**
+* Sniff: a HAR root is `{ log: { entries: [...] } }` — distinct from
+* every other JSON shape the forensics layer accepts (Playwright/Jest/
+* Vitest all key on `testResults` or `suites`).
+*/
+function looksLikeHarJson(json) {
+	if (!json || typeof json !== "object") return false;
+	const log = json.log;
+	if (!log || typeof log !== "object") return false;
+	return Array.isArray(log.entries);
+}
+function parseHarJsonDetailed(json) {
+	if (!json || typeof json !== "object") return {
+		records: [],
+		truncated: false
+	};
+	const entries = json.log?.entries;
+	if (!Array.isArray(entries)) return {
+		records: [],
+		truncated: false
+	};
+	const out = [];
+	const truncated = entries.length > MAX_ENTRIES;
+	for (const entry of entries.slice(0, MAX_ENTRIES)) {
+		if (!entry || typeof entry !== "object") continue;
+		const method = typeof entry.request?.method === "string" ? entry.request.method : "GET";
+		const url = typeof entry.request?.url === "string" ? entry.request.url : void 0;
+		if (url === void 0 || url.length === 0) continue;
+		const status = typeof entry.response?.status === "number" ? entry.response.status : void 0;
+		const transportError = entry.response?._error ?? entry.response?.error ?? void 0;
+		const hasTransportError = transportError !== void 0 && transportError !== null;
+		const hasValidStatus = isValidHttpStatus(status);
+		if (!hasValidStatus && !hasTransportError) continue;
+		const httpFailed = hasValidStatus && status >= 400;
+		const errors = [];
+		if (hasTransportError) errors.push(sanitizeErrorText(serializeTransportError(transportError)));
+		if (httpFailed) {
+			const text = typeof entry.response?.statusText === "string" && entry.response.statusText.length > 0 ? entry.response.statusText : `HTTP ${status}`;
+			errors.push(sanitizeErrorText(`${status} ${text}`));
+		}
+		const durationMs = typeof entry.time === "number" && Number.isFinite(entry.time) ? Math.max(0, Math.round(entry.time)) : 0;
+		const attempt = {
+			index: 1,
+			status: hasTransportError || httpFailed ? "failed" : "passed",
+			durationMs
+		};
+		out.push({
+			file: "har",
+			evidenceKind: "network-observation",
+			title: `${method} ${sanitizeTitleUrl(url)}`,
+			attempts: [attempt],
+			...errors.length > 0 ? { errors } : {}
+		});
+	}
+	return {
+		records: out,
+		truncated
+	};
+}
+//#endregion
 //#region src/forensics/run.ts
 /**
 * `mjolnir forensics <dir-or-file>` — runtime evidence entry point (R4).
@@ -13252,6 +13355,16 @@ function parseVitestJson(json) {
 const MAX_FILES = 500;
 const MAX_REPORT_FILE_BYTES = 1048576;
 const MAX_CUMULATIVE_BYTES = 52428800;
+/**
+* Run forensics analysis on test result artifacts.
+*
+* Parses test result files (Playwright JSON, JUnit XML, HAR, etc.),
+* analyzes them for flakiness, determinism, and trust signals, and
+* returns a structured report plus rendered output strings.
+*
+* @param target - path to the test result artifact or directory
+* @param options - writeFlakyMd (default true) controls FLAKY.md output
+*/
 function runForensics(target, options = {}) {
 	const records = [];
 	let source = "playwright-json";
@@ -13264,7 +13377,7 @@ function runForensics(target, options = {}) {
 			output: [
 				renderLeaderboard(report),
 				"",
-				renderFlakyMdHint()
+				renderFlakyMdNotWritten(options)
 			].join("\n")
 		};
 	}
@@ -13299,15 +13412,8 @@ function runForensics(target, options = {}) {
 					].join("\n")
 				};
 			}
-			const report = analyze([record], "playwright-trace");
-			return {
-				report,
-				output: [
-					renderLeaderboard(report),
-					"",
-					renderFlakyMdHint()
-				].join("\n")
-			};
+			records.push(record);
+			source = "playwright-trace";
 		} catch {
 			const report = analyze([], "playwright-trace");
 			report.analysisComplete = false;
@@ -13322,10 +13428,15 @@ function runForensics(target, options = {}) {
 				].join("\n")
 			};
 		}
-		try {
+		else try {
 			const parsed = parseFile(target, readFileSync(target, "utf8"));
 			records.push(...parsed.records);
 			source = parsed.source;
+			if (parsed.parseFailed) {
+				skippedReports = 1;
+				incompleteReasons.push("parse-failure");
+			}
+			if (parsed.truncated && !incompleteReasons.includes("entry-count-limit")) incompleteReasons.push("entry-count-limit");
 		} catch {
 			skippedReports = 1;
 			incompleteReasons.push("parse-failure");
@@ -13357,13 +13468,18 @@ function runForensics(target, options = {}) {
 				if (/\.(?:zip|trace|ndjson)$/i.test(full)) {
 					const record = parseTraceArtifact(readFileSync(full), traceArtifactName(full));
 					if (record === void 0) continue;
-					if (records.length === 0) source = "playwright-trace";
+					if (records.length === 0 || source === "har") source = "playwright-trace";
 					records.push(record);
 					continue;
 				}
 				const parsed = parseFile(full, readFileSync(full, "utf8"));
+				if (parsed.parseFailed) {
+					skippedReports++;
+					if (!incompleteReasons.includes("parse-failure")) incompleteReasons.push("parse-failure");
+				}
+				if (parsed.truncated && !incompleteReasons.includes("entry-count-limit")) incompleteReasons.push("entry-count-limit");
 				if (parsed.records.length === 0) continue;
-				if (records.length === 0) source = parsed.source;
+				if (records.length === 0 || source === "har" && parsed.source !== "har") source = parsed.source;
 				records.push(...parsed.records);
 			} catch {
 				skippedReports++;
@@ -13380,10 +13496,10 @@ function runForensics(target, options = {}) {
 		}
 	}
 	const report = analyze(records, source);
-	if (skippedReports > 0) {
+	if (skippedReports > 0 || incompleteReasons.length > 0) {
 		report.analysisComplete = false;
 		report.skippedReports = skippedReports;
-		report.incompleteReasons = incompleteReasons;
+		report.incompleteReasons = [.../* @__PURE__ */ new Set([...report.incompleteReasons, ...incompleteReasons])];
 	}
 	let flakyMdPath;
 	if ((options.writeFlakyMd ?? true) && report.totalTests > 0) {
@@ -13400,7 +13516,7 @@ function runForensics(target, options = {}) {
 		output: [
 			renderLeaderboard(report),
 			"",
-			flakyMdPath !== void 0 ? renderFlakyMdHint() : renderFlakyMdNotWritten(options)
+			flakyMdPath !== void 0 ? renderFlakyMdHint() : report.totalTests === 0 && (report.totalNetworkObservations ?? 0) > 0 && options.writeFlakyMd !== false ? "FLAKY.md was not written — network observations do not establish test outcomes." : renderFlakyMdNotWritten(options)
 		].join("\n"),
 		flakyMdPath
 	};
@@ -13430,14 +13546,33 @@ function parseFile(path, text) {
 		source: "junit-xml"
 	};
 	let json;
+	const isHarFile = /\.har$/i.test(path);
 	try {
 		json = JSON.parse(text);
 	} catch {
 		return {
 			records: [],
-			source: "playwright-json"
+			source: isHarFile ? "har" : "playwright-json",
+			parseFailed: true
 		};
 	}
+	if (looksLikeHarJson(json)) {
+		const parsed = parseHarJsonDetailed(json);
+		return {
+			records: parsed.records,
+			source: "har",
+			truncated: parsed.truncated
+		};
+	}
+	if (isHarFile || json !== null && typeof json === "object" && [
+		"suites",
+		"specs",
+		"testResults"
+	].some((key) => key in json && !Array.isArray(json[key]))) return {
+		records: [],
+		source: isHarFile ? "har" : "playwright-json",
+		parseFailed: true
+	};
 	if (looksLikeJestJson(json)) return {
 		records: parseJestJson(json),
 		source: "jest-json"
@@ -13466,7 +13601,7 @@ function listFiles(dir) {
 			if (e.isDirectory()) {
 				if (["node_modules", ".git"].includes(e.name)) continue;
 				walk(full, depth + 1);
-			} else if (e.isFile() && /\.(?:json|xml|zip|trace|ndjson)$/i.test(e.name)) out.push(full);
+			} else if (e.isFile() && /\.(?:json|xml|zip|trace|ndjson|har)$/i.test(e.name)) out.push(full);
 		}
 	};
 	walk(dir, 0);
@@ -13813,18 +13948,22 @@ function loadJsonRule(path, result) {
 			for (const re of regexes) {
 				const run = new RegExp(re.source, "g");
 				let m;
-				while ((m = run.exec(view)) !== null) findings.push({
-					severity,
-					confidence,
-					findingType: "heuristic-risk",
-					qaImpact,
-					file: ctx.path,
-					line: 1 + view.slice(0, m.index).split("\n").length - 1,
-					column: m.index - (view.lastIndexOf("\n", m.index - 1) + 1) + 1,
-					message,
-					why,
-					fix
-				});
+				while ((m = run.exec(view)) !== null) {
+					if (findings.length >= 1e4) throw new Error(`External rule ${id} exceeded its match limit`);
+					if (m[0].length === 0) run.lastIndex = m.index + 1;
+					findings.push({
+						severity,
+						confidence,
+						findingType: "heuristic-risk",
+						qaImpact,
+						file: ctx.path,
+						line: 1 + view.slice(0, m.index).split("\n").length - 1,
+						column: m.index - (view.lastIndexOf("\n", m.index - 1) + 1) + 1,
+						message,
+						why,
+						fix
+					});
+				}
 			}
 			return findings;
 		}
@@ -14044,20 +14183,27 @@ function pathMatchesGlob(path, glob) {
 * Plan §16 + WI-11: locate a runtime run report next to the scan
 * target, using the exact conventions the forensics ingestion already
 * accepts. Zero-config search over conventional artifact names at
-* depth ≤ 2 (src/discovery/evidence-discovery.ts); the FIRST parsable
-* candidate wins (priority: mjolnir-report > playwright-json >
-* test-results-dir > junit-file). Validates each candidate by attempting
-* to parse it and checking that it produces at least one test. Returns
-* the parsed report alongside the path to avoid double-parsing.
+* depth ≤ 2 (src/discovery/evidence-discovery.ts). The FIRST parsable
+* candidate with `totalTests > 0` is kept as a fallback; the loop
+* continues and returns a later candidate when one with
+* `analysisComplete === true` is found. Returns the parsed report
+* alongside the path to avoid double-parsing.
 */
 function discoverAndParseRuntimeReport(scanRoot) {
+	let fallback;
 	for (const c of discoverEvidenceCandidates(scanRoot)) try {
 		const fr = runForensics(c.path, { writeFlakyMd: false });
-		if (fr.report.totalTests > 0) return {
+		if (fr.report.totalTests <= 0) continue;
+		if (!fallback) fallback = {
+			path: c.path,
+			report: fr.report
+		};
+		if (fr.report.analysisComplete === true) return {
 			path: c.path,
 			report: fr.report
 		};
 	} catch {}
+	return fallback;
 }
 /**
 * Audit W10 — runtime shape validation at the rule→Finding boundary.
@@ -14161,6 +14307,7 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 			continue;
 		}
 		let fileBudgetExceeded = false;
+		let fileRuleFailed = false;
 		const relPath = relative(workspace.root, path).replaceAll("\\", "/");
 		if (!isCiAdapter) {
 			const lang = {
@@ -14227,6 +14374,7 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 			} : parsedFile;
 			adapter.runRules(activeRules, fileForRules, (f, ruleId, category) => {
 				if (!isValidFindingRecord(f)) {
+					fileRuleFailed = true;
 					onRuleCrash?.(ruleId, relPath, /* @__PURE__ */ new Error(`malformed finding record rejected (severity/line/message must be present, severity ∈ error|warning|info): ${JSON.stringify(f)}`));
 					return;
 				}
@@ -14236,6 +14384,7 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 					category
 				});
 			}, (ruleId, error) => {
+				fileRuleFailed = true;
 				onRuleCrash?.(ruleId, relPath, error);
 			}, {
 				deadline: Math.min(deadline, Date.now() + LIMITS$1.maxFileAnalysisMs),
@@ -14246,7 +14395,7 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 					fileBudgetExceeded = true;
 				}
 			});
-			cache.store(cacheKey, findings.slice(findingsStart), fileBudgetExceeded);
+			if (!fileRuleFailed) cache.store(cacheKey, findings.slice(findingsStart), fileBudgetExceeded);
 		} catch {
 			skippedFiles++;
 			parseFailed++;
@@ -14263,6 +14412,31 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 		scanned
 	};
 }
+/**
+* Summarize forensic classifications from an ingested runtime report
+* (plan §10.4, WAVE 5). Returns undefined when no verdict carries a
+* classification — the machine contract slot stays absent rather than
+* reporting all-zero counts.
+*/
+function summarizeForensicVerdicts(report) {
+	if (report.analysisComplete !== true) return void 0;
+	const byVerdict = {};
+	let classifications = 0;
+	let inconclusive = 0;
+	for (const v of report.verdicts) {
+		if (!v.forensic) continue;
+		classifications++;
+		const label = v.forensic.verdict;
+		byVerdict[label] = (byVerdict[label] ?? 0) + 1;
+		if (label === "inconclusive") inconclusive++;
+	}
+	if (classifications === 0) return void 0;
+	return {
+		classifications,
+		byVerdict,
+		inconclusive
+	};
+}
 function applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, declarationsByFile, testDeclarationCount, tierByRuleId, REVISION_BY_RULE_ID) {
 	let scopeInfo = { scope: "all" };
 	if (args.scopeChanged) {
@@ -14311,9 +14485,11 @@ function applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, dec
 	for (const f of findings) f.fixGroupId = f.ruleId;
 	const discoveredReport = discoverAndParseRuntimeReport(scanRoot.root);
 	const runtimeReportPath = discoveredReport?.path;
-	if (discoveredReport) try {
+	let forensicVerdicts;
+	if (discoveredReport && discoveredReport.report.analysisComplete === true) try {
 		buildEvidenceRecords(discoveredReport.report, discoveredReport.path);
 		stampRuntimeCorroboration(findings, discoveredReport.report, workspace.root);
+		forensicVerdicts = summarizeForensicVerdicts(discoveredReport.report);
 	} catch {}
 	return {
 		testDeclarationCount,
@@ -14321,6 +14497,7 @@ function applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, dec
 		suppressionCount,
 		frameworks,
 		runtimeReportPath,
+		forensicVerdicts,
 		config
 	};
 }
@@ -14329,42 +14506,45 @@ function applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, dec
 * Uses the dependency graph to assign findings to their nearest package
 * manifest, falling back to the workspace root.
 */
-function partitionFindingsByPackage(findings, depGraph, workspaceRoot) {
-	const packagePaths = depGraph.allPaths;
-	if (packagePaths.length === 0) return [];
-	const normalizedRoot = workspaceRoot.replaceAll("\\", "/");
+function partitionFindingsByPackage(findings, depGraph, workspaceRoot, declarationsByFile, analysisComplete) {
 	const packageMap = /* @__PURE__ */ new Map();
-	for (const manifestPath of packagePaths) {
-		const relPath = manifestPath.replaceAll("\\", "/").replace(normalizedRoot, "").replace(/^\//, "");
-		const pathSegments = relPath.split("/");
-		const packageName = pathSegments.length > 1 ? pathSegments[1] ?? "root" : "root";
-		packageMap.set(manifestPath, {
-			packageName,
-			path: relPath.replace("/package.json", "").replace("/pyproject.toml", "").replace("/pom.xml", ""),
-			findings: []
-		});
-	}
-	for (const f of findings) {
-		const normalizedFile = f.file.replaceAll("\\", "/");
-		let bestMatch;
-		let bestLen = 0;
-		for (const manifestPath of packagePaths) {
-			const relToRoot = manifestPath.replaceAll("\\", "/").replace(/[/\\][^/\\]+$/, "").replace(normalizedRoot, "").replace(/^\//, "");
-			if (relToRoot && normalizedFile.startsWith(relToRoot + "/")) {
-				if (relToRoot.length > bestLen) {
-					bestLen = relToRoot.length;
-					bestMatch = manifestPath;
-				}
-			}
-		}
-		const target = bestMatch ? packageMap.get(bestMatch) : packageMap.values().next().value;
-		if (target) target.findings.push(f);
+	const addPackage = (path) => {
+		const entry = {
+			packageName: path === "" ? "root" : basename(path),
+			path: path || ".",
+			findings: [],
+			testDeclarations: 0,
+			testFileCount: 0
+		};
+		packageMap.set(path, entry);
+		return entry;
+	};
+	for (const manifestPath of depGraph.allPaths) {
+		const path = relative(workspaceRoot, dirname(manifestPath)).replaceAll("\\", "/");
+		if (path === ".." || path.startsWith("../")) continue;
+		if (!packageMap.has(path)) addPackage(path);
+	}
+	const packageForFile = (file) => {
+		const normalizedFile = file.replaceAll("\\", "/");
+		let bestPath = "";
+		for (const path of packageMap.keys()) if (path.length > bestPath.length && normalizedFile.startsWith(path + "/")) bestPath = path;
+		return packageMap.get(bestPath) ?? addPackage("");
+	};
+	for (const f of findings) packageForFile(f.file).findings.push(f);
+	for (const [file, declarations] of declarationsByFile) {
+		const target = packageForFile(file);
+		target.testDeclarations += declarations;
+		target.testFileCount++;
 	}
 	return [...packageMap.values()].map((p) => ({
 		packageName: p.packageName,
 		path: p.path,
 		findings: p.findings,
-		score: p.findings.length === 0 ? 100 : null
+		score: analysisComplete && p.testDeclarations > 0 && p.testFileCount > 0 ? computeTotal(computeDimensions(p.findings), p.findings, {
+			testDeclarations: p.testDeclarations,
+			testFileCount: p.testFileCount,
+			suiteInvalidatingRuleIds: SUITE_INVALIDATING_RULE_IDS
+		}) : null
 	}));
 }
 function assembleScanResult(o) {
@@ -14461,6 +14641,7 @@ function assembleScanResult(o) {
 		...o.pluginsLoaded.length > 0 ? { plugins: o.pluginsLoaded } : {},
 		...suiteInvalidatedBy.length > 0 ? { suiteInvalidatedBy } : {},
 		agenticProfile: computeAgenticProfile(o.fileProvenance, o.findings),
+		...o.forensicVerdicts !== void 0 ? { forensicVerdicts: o.forensicVerdicts } : {},
 		...o.args.cache ? { cache: {
 			hits: o.cache.stats.hits,
 			misses: o.cache.stats.misses,
@@ -14487,7 +14668,7 @@ function assembleScanResult(o) {
 		};
 	}
 	if (o.args.monorepo && o.dependencyGraph && o.dependencyGraph.size > 1) {
-		const packages = partitionFindingsByPackage(o.findings, o.dependencyGraph, o.workspace.root);
+		const packages = partitionFindingsByPackage(o.findings, o.dependencyGraph, o.workspace.root, o.declarationsByFile, !result.partial && scopeReasons.length === 0 && !o.args.scopeChanged);
 		if (packages.length > 1) {
 			const monorepoResult = analyzeMonorepo(packages, { weightingStrategy: "worst-package" });
 			result.monorepoAnalysis = {
@@ -14551,7 +14732,7 @@ async function runScan(args, hooks = {}) {
 	const REVISION_BY_RULE_ID = new Map(activeRules.map((r) => [r.id, r.detectorRevision ?? MEASURED_FP[r.id]?.detectorRevision ?? 1]));
 	const cache = args.cache ? createScanCache(workspace.root) : disabledScanCache;
 	const depGraph = buildDependencyGraph(workspace.root);
-	const rulesDigest = computeRulesDigest(activeRules);
+	const rulesDigest = `complete-file-v1:${computeRulesDigest(activeRules)}`;
 	if (args.cache && args.verbose) {
 		const safety = isIncrementalSafe([]);
 		if (!safety.safe) hooks.onConfigWarning?.(`incremental: ${safety.reasons.join("; ")}`);
@@ -14637,6 +14818,7 @@ async function runScan(args, hooks = {}) {
 		suppressionCount: postScan.suppressionCount,
 		frameworks: postScan.frameworks,
 		runtimeReportPath: postScan.runtimeReportPath,
+		forensicVerdicts: postScan.forensicVerdicts,
 		config: postScan.config,
 		fileProvenance,
 		started,
@@ -14693,10 +14875,14 @@ function canonicalScanJson(result) {
 	});
 }
 /** Advisory when the DERIVED evidence level is E0 (same rule as scoring). */
+function effectiveEvidenceLevel(f) {
+	return f.evidenceLevel ?? deriveEvidenceLevel(f.findingType, f.confidence);
+}
 function isAdvisory(f) {
-	return (f.evidenceLevel ?? deriveEvidenceLevel(f.findingType, f.confidence)) === "E0";
+	return effectiveEvidenceLevel(f) === "E0";
 }
-function levelFor(f) {
+function levelFor(f, evidenceLevel = effectiveEvidenceLevel(f)) {
+	if (evidenceLevel === "E0") return "notice";
 	if (f.severity === "error") return "failure";
 	if (f.severity === "warning") return "warning";
 	return "notice";
@@ -14710,15 +14896,18 @@ function countBy(findings, predicate) {
 */
 function buildMachineContract(result) {
 	const digest = createHash("sha256").update(canonicalScanJson(result)).digest("hex");
-	const annotations = result.findings.map((f) => ({
-		path: f.file,
-		start_line: f.line,
-		annotation_level: levelFor(f),
-		message: `${f.ruleId}: ${f.message}`,
-		ruleId: f.ruleId,
-		...f.detectorRevision !== void 0 ? { detectorRevision: f.detectorRevision } : {},
-		advisory: isAdvisory(f)
-	}));
+	const annotations = result.findings.map((f) => {
+		const evidenceLevel = effectiveEvidenceLevel(f);
+		return {
+			path: f.file,
+			start_line: f.line,
+			annotation_level: levelFor(f, evidenceLevel),
+			message: `${f.ruleId}: ${f.message}`,
+			ruleId: f.ruleId,
+			...f.detectorRevision !== void 0 ? { detectorRevision: f.detectorRevision } : {},
+			advisory: evidenceLevel === "E0"
+		};
+	});
 	return {
 		contractVersion: 1,
 		summary: {
@@ -14743,7 +14932,8 @@ function buildMachineContract(result) {
 			durationMs: result.analysisStatus.durationMs
 		},
 		...result.trustSummary !== void 0 ? { trustSummary: result.trustSummary } : {},
-		...result.agenticProfile !== void 0 ? { provenance: result.agenticProfile } : {}
+		...result.agenticProfile !== void 0 ? { provenance: result.agenticProfile } : {},
+		...result.forensicVerdicts !== void 0 ? { forensicVerdicts: result.forensicVerdicts } : {}
 	};
 }
 //#endregion